1

arXiv:1710.03248v1 [cs.PL] 9 Oct 2017

Synthesizing Bijective Lenses
ANDERS MILTNER, Princeton University, USA
KATHLEEN FISHER, Tufts University, USA
BENJAMIN C. PIERCE, University of Pennsylvania, USA
DAVID WALKER, Princeton University, USA
STEVE ZDANCEWIC, University of Pennsylvania, USA
Bidirectional transformations between diﬀerent data representations occur frequently in modern software
systems. They appear as serializers and deserializers, as parsers and pretty printers, as database views and
view updaters, and as a multitude of diﬀerent kinds of ad hoc data converters. Manually building bidirectional transformations—by writing two separate functions that are intended to be inverses—is tedious and
error prone. A better approach is to use a domain-speciﬁc language in which both directions can be written
as a single expression. However, these domain-speciﬁc languages can be diﬃcult to program in, requiring
programmers to manage ﬁddly details while working in a complex type system.
We present an alternative approach. Instead of coding transformations manually, we synthesize them
from declarative format descriptions and examples. Speciﬁcally, we present Optician, a tool for type-directed
synthesis of bijective string transformers. The inputs to Optician are a pair of ordinary regular expressions
representing two data formats and a few concrete examples for disambiguation. The output is a well-typed
program in Boomerang (a bidirectional language based on the theory of lenses). The main technical challenge
involves navigating the vast program search space eﬃciently enough. In particular, and unlike most prior
work on type-directed synthesis, our system operates in the context of a language with a rich equivalence
relation on types (the theory of regular expressions). Consequently, program synthesis requires search in two
dimensions: First, our synthesis algorithm must ﬁnd a pair of “syntactically compatible types,” and second,
using the structure of those types, it must ﬁnd a type- and example-compliant term. Our key insight is that
it is possible to reduce the size of this search space without losing any computational power by deﬁning a
new language of lenses designed speciﬁcally for synthesis. The new language is free from arbitrary function
composition and operates only over types and terms in a new disjunctive normal form. We prove (1) our
new language is just as powerful as a more natural, compositional, and declarative language and (2) our synthesis algorithm is sound and complete with respect to the new language. We also demonstrate empirically
that our new language changes the synthesis problem from one that admits intractable solutions to one that
admits highly eﬃcient solutions, able to synthesize lenses between complex ﬁle formats with great variation
in seconds. We evaluate Optician on a benchmark suite of 39 examples that includes both microbenchmarks
and realistic examples derived from other data management systems including Flash Fill, a tool for synthesizing string transformations in spreadsheets, and Augeas, a tool for bidirectional processing of Linux system
conﬁguration ﬁles.

1 INTRODUCTION
Programs that analyze consumer information, performance statistics, transaction logs, scientiﬁc
records, and many other kinds of data are essential components in many software systems. Oftentimes, the data analyzed comes in ad hoc formats, making tools for reliably parsing, printing,
cleaning, and transforming data increasingly important. Programmers often need to reliably transform back-and-forth between formats, not only transforming source data into a target format but
also safely transforming target data back into the source format. Lenses [13] are back-and-forth
transformations that provide strong guarantees about their round-trip behavior, guarding against
data corruption while reading, editing, and writing data sources.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:2

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

A lens comprises two functions, get and put. The get function translates source data into the
target format. If the target data is updated, the put function translates this edited data back into
the source format. A beneﬁt of lens-based languages is that they use a single term to express both
get and put. Furthermore, well-typed lenses give rise to get and put functions guaranteed to satisfy
desirable invertibility properties.
Lens-based languages are present in variety of tools and have found mainstream industrial use.
Boomerang [3, 5] lenses provide guarantees on transformations between ad hoc string document
formats. Augeas [26], a popular tool that reads Linux system conﬁguration ﬁles, uses the get
part of a lens to transform conﬁguration ﬁles into a canonical tree representation that users can
edit either manually or programmatically. It uses the lens’s put to merge the edited results back
into the original string format. Other lens-based languages and tools include GRoundTram [20],
BiFluX [30], BiYacc [41], Brul [40], BiGUL [21], bidirectional variants of relational algebra [4],
spreadsheet formulas [27], graph query languages [19], and XML transformation languages [25].
Unfortunately, these languages impose ﬁddly constraints on lenses, making lens programming
slow and tedious. For example, Boomerang programmers often must rearrange the order of data
items by recursively using operators that swap adjacent ﬁelds. Furthermore, the Boomerang type
checker is very strict, disallowing many programs because they contain ambiguity about how
certain data is transformed. In short, lens languages provide strong bidirectional guarantees at the
cost of forcing programmers to satisfy ﬁnicky type systems.
To make programming with lenses faster and easier, we have developed Optician, a tool for
synthesizing lenses from simple, high-level speciﬁcations. This work continues a recent trend toward streamlining programming tasks by synthesizing programs in a variety of domain-speciﬁc
languages [10, 15, 24, 31], many guided by types [10, 11, 14, 29, 32]. Speciﬁcally, Optician supports
the synthesis of bijective lenses, a useful subset of Boomerang. As inputs, Optician takes speciﬁcations of the source and target formats, plus a collection of concrete examples of the desired
transformation. Format speciﬁcations are supplied as ordinary regular expressions. Because regular expressions are so widely understood, we anticipate such inputs will be substantially easier for
everyday programmers to work with than the unfamiliar syntax of lenses. Moreover, including
these format descriptions communicates a great deal of information to the synthesis system. Thus,
requiring user input of regular expressions makes synthesis robust, helps the system scale to large
and complex data sources, and constrains the search space suﬃciently that the user typically needs
to give very few, if any, examples.
Despite the beneﬁts of Boomerang’s informative types, Boomerang is not well-suited to support
synthesis directly. Speciﬁcally, Boomerang’s types are regular expression pairs, and each regular
expression is equivalent to an inﬁnite number of other regular expressions. To synthesize all
Boomerang terms, a type-directed synthesizer must sometimes be able to ﬁnd, amongst all possible
equivalent regular expressions, the one with the right syntactic structure to guide the subsequent
search for a well-typed, example-compatible Boomerang term.
To resolve these issues, we introduce a new language of Disjunctive Normal Form (DNF) lenses.
Just as string lenses have pairs of regular expressions as types, DNF lenses have pairs of DNF
regular expressions as types. The typing judgements for DNF lenses limit how equivalences can be
used, greatly reducing the size of the search space. Despite the restrictive syntax and type system
of DNF lenses, we prove our new language is equivalent to a natural, declarative speciﬁcation of
the bijective fragment of Boomerang.
Figure 1 shows a high-level, schematic diagram for Optician. First, Optician uses the function
⇓ to convert the input regular expressions into DNF regular expressions. Next, SynthDNFLens
performs type-directed synthesis on these DNF regular expressions and the input examples to
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:3
Optician

S
T

⇓

DS
DT

SynthDNFLens

dl

⇑

l

exs
Fig. 1. Schematic Diagram for Optician. Regular expressions, S and T , and examples, exs, are given as input.
First, the function ⇓ converts S and T into their respective DNF forms, DS and DT. Next, SynthDNFLens
synthesizes a DNF lens, dl, from S, T , and exs. Finally, ⇑ converts dl into l, a lens in Boomerang that is
equivalent to dl.

synthesize a DNF lens. Finally, this DNF lens is converted back into a regular lens with the function
⇑, and returned to the user.
Contributions. Optician makes bidirectional programming more accessible by obviating the need
for programmers to write lenses by hand. We begin by brieﬂy reviewing some background on regular expressions and core lens combinators (§2). After we motivate our problem with an extended,
real-world example (§3), we oﬀer the following technical contributions:
• We introduce a new lens language (DNF Lenses) that is suitable for synthesis (§4 and §5).
We show how to convert ordinary regular expressions and lenses into the corresponding
DNF forms, and we prove that DNF lenses are sound and complete with respect to the
high-level bijective lens syntax.
• We present an eﬃcient, type-directed synthesis algorithm for synthesizing lenses (§6). We
prove that if there is a lens that satisﬁes the input speciﬁcation, this algorithm will return
such a lens.
• We evaluate Optician, its optimizations, and existing synthesis tools on 39 benchmarks,
including examples derived from Flash Fill [16] and the Augeas [26] system (§7). We show
that our optimizations are critical for synthesizing many of the complex lenses in our
benchmark suite and that our full algorithm succeeds on all benchmarks in under 5 seconds.
• While we are not aware of any other systems for automatically synthesizing bijective
transformations, we establish a baseline for our the eﬀectiveness of our techniques by
comparing our synthesis algorithm with the one used in Flash Fill [16], a well-known and
inﬂuential synthesis system deployed in Microsoft Excel. Flash Fill only synthesizes transformations in one direction, but it was only able to complete synthesis of 3 out of 39 of
our benchmarks. We conjecture that the extra information we supply the synthesis system via our regular format descriptions, allows it to scale to signiﬁcantly more complex
and varied formats than is possible in current string synthesis systems that do not use this
information.
We close with related work (§8) and conclusions (§9).
2

PRELIMINARIES

Technical Report. Throughout the paper, we will state a number of theorems. We have omitted
these proofs for space, and have included these details in the auxiliary technical report.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:4

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Regular Expressions. We use Σ to denote the alphabet of individual characters c; strings s and
t are elements of Σ∗ . Regular expressions, abbreviated REs, are used to express languages, which
are subsets of Σ∗. REs over Σ are:
S,T
::=
s
|
∅
|
S∗
|
S1 · S2
|
S1 | S2
∗
L(S) ⊆ Σ , the language of S, is deﬁned as usual.
Unambiguity. The typing derivations of lenses require regular expressions to be written in a
way that parses text unambiguously. S and T are unambiguously concatenable, written S ·! T if, for
all strings s1 , s2 ∈ L(S) and t1 , t2 ∈ L(T ), whenever s1 · t1 = s2 · t2 it is the case that s1 = s2 and
t1 = t2 . Similarly, S is unambiguously iterable, written S ∗! if, for all n, m ∈ N and for all strings
s1 , . . . , sn , t1 , . . . , tm ∈ L(S), whenever s1 · . . . · sn = t1 · . . . · tm it is the case that n = m and si = ti
for all i.
A regular expression S is strongly unambiguous if one of the following holds: (a) S = s, or (b) L(S) = {},
or (c) S = S1 · S2 with S1 ·! S2 , or (d) S = S1 | S2 with S1 ∩ S2 = ∅, or (e) S = (S ′)∗ with (S ′ )∗! . In the
recursive cases, S1 , S2 , and S ′ must also be strongly unambiguous.
Equivalences. S and T are equivalent, written S ≡ T , if L(S) = L(T ). There exists an equational
theory for determining whether two regular expressions are equivalent, presented by Conway [7],
and proven complete by Krob [23].1 Conway’s axioms consist of the semiring axioms (associativity,
commutativity, identities, and distributivity for | and ·) plus the following rules for equivalences
involving the Kleene star:
(S | T )∗ ≡ (S ∗ · T )∗ · S ∗
Sumstar
(S · T )∗ ≡ ϵ | (S · (T · S)∗ · T )
Prodstar
(S ∗ )∗ ≡ S ∗
Starstar
(S | T )∗ ≡ ((S | T ) · T | (S · T ∗ )n · S)∗ · (ϵ | (S | T )· ((S · T ∗ )0 | . . . | (S · T ∗ )n ))
Dicyc
While this equational theory is complete, naı̈vely using it in the context of lens synthesis presents
several problems. In the context of lens synthesis, we instead use the equational theory corresponding to the axioms of a star semiring [9]. If two regular expressions are equivalent within
this equational theory, they are star semiring equivalent, written S ≡s T . The star semiring axioms
consist of the semiring axioms plus the following rules for equivalences involving the Kleene star:
S ∗ ≡s ϵ | (S·S ∗ ) UnrollstarL
S ∗ ≡s ϵ | (S ∗ ·S) UnrollstarR
In §3, we provide intuition for why synthesis with full regular expression equivalence is problematic and justify our choice of using star semiring equivalence instead.
Bijective Lenses. All bijections between languages are lenses. We deﬁne bijective lenses to be
bijections created from the following Boomerang lens combinators, l.
l ::=
const(s 1 ∈ Σ∗ , s 2 ∈ Σ∗ )
| iterate(l)
| concat(l1 , l2 )
| swap(l1 , l2 )
| or(l1 , l2 )
| l1 ; l2
| id S
The denotation of a lens l is [[l]] ⊆ String × String. If (s1 , s2 ) ∈ [[l]], then l maps between s1 and s2 .
1 There are

other complete axiomatizations for regular expression equivalence, such as Kozen’s[22] and Salomaa’s[33]. We
focus on Conway’s for the sake of speciﬁcity, but discuss alternative theories in §8.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

s1 ∈ Σ∗

1:5

s2 ∈ Σ∗

l:S⇔T

T ∗!

iterate(l) : S ∗ ⇔ T ∗

const(s1 , s2 ) : s1 ⇔ s2
l1 : S1 ⇔ T1
l2 : S2 ⇔ T2
S1 · ! S2
T2 ·! T1

concat(l1 , l2 ) : S1 S2 ⇔ T1 T2

l1 : S1 ⇔ T1
L(S1) ∩ L(S2 ) = ∅

swap(l1 , l2 ) : S1 S2 ⇔ T2 T1
l1 : S1 ⇔ S2

S ∗!

l1 : S1 ⇔ T1
l2 : S2 ⇔ T2
S1 · ! S2
T1 ·! T2

l2 : S2 ⇔ T2
L(T1 ) ∩ L(T2 ) = ∅

or(l1 , l2 ) : S1 | S2 ⇔ T1 | T2

l2 : S2 ⇔ S3

S is strongly unambiguous

l1 ; l2 : S1 ⇔ S3

id S : S ⇔ S

l : S1 ⇔ S2

S1 ≡s S1′

S2 ≡s S2′

l : S1′ ⇔ S2′
Fig. 2. Lens Typing Rules

[[const(s1 , s2 )]]
[[iterate(l)]]
[[concat(l1 , l2 )]]
[[swap(l1 , l2 )]]
[[or(l1 , l2 )]]
[[l1 ; l2 ]]
[[id S ]]

=
=
=
=
=
=
=

{(s1 , s2 )}
{(s1 · . . . · sn , t1 · . . . · tn ) | n ∈ N ∧ ∀i ∈ [1, n], (si , ti ) ∈ [[l]]}
{(s1 · s2 , t1 · t2 ) | (s1 , t1 ) ∈ [[l1 ]] ∧ (s2 , t2 ) ∈ [[l2 ]]}
{(s1 · s2 , t2 · t1 ) | (s1 , t1 ) ∈ [[l1 ]] ∧ (s2 , t2 ) ∈ [[l2 ]]}
{(s, t) | (s, t) ∈ [[l1 ]] ∨ (s, t) ∈ [[l2 ]]}
{(s1 , s3 ) | ∃s2 (s1 , s2 ) ∈ [[l1 ]] ∧ (s2 , s3 ) ∈ [[l2 ]]}
{(s, s) | s ∈ L(S)}

The simplest lens in the combinator language is the constant lens between strings s, and t,
const(s, t). The lens const(s, t), when operated left-to-right, replaces the string s with t, and when
operated right-to-left, replaces string t with s. The identity lens on a regular expression, id S , operates in both directions by applying the identity function to strings in L(S). The composition
combinator, l1 ; l2 , operates by applying l1 then l2 when operating left to right, and applying l2
then l1 when operating right to left.
Each of the other lenses manipulates structured data. For instance, concat(l1 , l2 ) operates by
applying l1 to the left portion of a string, and l2 to the right, and concatenating the results. The
combinator swap(l1 , l2 ) does the same as concat(l1 , l2 ) but it swaps the results before concatenating.
The combinator or(l1 , l2 ) operates by applying either l1 or l2 to the string. The combinator iterate(l)
operates by repeatedly applying l to subparts of a string.
Lens Typing. The typing judgement for lenses has the form l : S ⇔ T , meaning l bijectively
maps between L(S) and L(T ). Figure 2 gives the typing relation. Many of the typing derivations
require side conditions about unambiguity. These side conditions guarantee that the semantics of
the language create a bijective function. For example, if l1 : S1 ⇔ T1 , and l2 : S2 ⇔ T2 , and S1 is
not unambiguously concatenable with S2 , then there would exist s1 , s1′ ∈ L(S1), and s2 , s2′ ∈ L(S2)
where s1 · s2 = s1′ · s2′ , but s1 , s1′ , and s2 , s2′ . The lens concat(l1 , l2 ) would no longer necessarily act
as a function when applied from left to right, as l1 could be applied to both s1 and to s1′ . Because any
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:6

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic
Legacy
Clients
Legacy
Server API

Modern
Clients
Lens

Modern
Server API
Server Stack

(a)

Legacy Work Item Representation
<WorkItem>
<Field Id=1>Bug</Field>
<Field Id=2>Return 400 on
bad PUT request</Field
>
<Field Id=5>Smith, J</
Field>
</WorkItem>

Modern Work Item Representation
{
Title: Return 400 on
bad PUT request,
Type: Bug,
AssignedTo: J Smith,
}

(b)

Fig. 3. VSTS Architecture Using Lenses. In (a), we show the proposed architecture of VSTS using lenses.
When a legacy client requests a work item, the server retrieves the data in a modern format through the new
APIs, then the lens converts it into a legacy format to return to the client. When a legacy client updates a
work item, it provides the data in the legacy format to the server. The lens then converts this data into the
modern format for the new endpoints to process. Idealized Task representations from legacy and modern
web service endpoints are given in (b).

ambiguous RE can be replaced by an equivalent unambiguous one, these ambiguity constraints do
not have an impact on the computational power of the language.
The typing rule for id S requires a strongly unambiguous regular expression. This unambiguity
allows the identity lens to be derivable from other lenses.2 This requirement does not, however,
reduce expressiveness, as any regular expression is equivalent to a strongly unambiguous regular
expression [6].
The last rule in Figure 2 is a type equivalence rule that lets the typing rules consider a lens
l : S1 ⇔ S2 to have type S1′ ⇔ S2′ so long as S1 ≡s S1 and S2 ≡s S2′ . Notice that this rule
uses star semiring equivalence as opposed to Conway equivalence. In theory, this reduces the
expressiveness of the type system; in practice, we have not found it restrictive. We explain and
justify the decision to use star semiring equivalence in the next section.
Finally, it is worthwhile at this point to notice that the problem of ﬁnding a well-typed lens l
given a pair of regular expressions—the lens synthesis problem—would not be diﬃcult if it were
not for lens composition and the type equivalence rules. When read bottom up, these two rules
apparently require wild guesses at additional regular expressions to continue driving synthesis
recursively in a type-directed fashion. In contrast, in the other rules, the shape of the lens is largely
determined by the given types. The following sections elaborate on this problem and describe our
solution.
3 OVERVIEW
To highlight the diﬃculties in synthesizing lenses, we use an extended example inspired by the
evolution of Microsoft’s Visual Studio Team Services (VSTS). VSTS is a collection of web services
for team management – providing a uniﬁed location for source control (e.g. a Git server), task
management (i.e. providing a means to keep track of TODOs and bugs), and more. In 2014, to
2 In

practice, we allow regular expressions that aren’t strongly unambiguous to appear in id S , provided that they are expressed as a user deﬁned regular expression. We elide such user-deﬁned regular expression information from the theory
for the sake of simplicity.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:7

increase third party developer interaction, VSTS released new web service endpoints [18]. However, despite VSTS introducing new, modernized web APIs, they must still maintain the old, legacy
web APIs for continued support of legacy clients [28]. Instead of maintaining server code for each
endpoint, we envision an architecture that uses a lens to convert resources of the old form into
resources of the new form and vice versa, as shown in Figure 3a. Writing each of these converters
by hand is slow and error prone. We speed up this process by only requiring users to input regular
expressions and input-output examples. Furthermore, the generated lenses are guaranteed to map
between the provided regular expressions and to act correctly on the provided examples.
Consider a “Work Item,” a resource that represents a task given to a team. Idealized versions
of the representations of work items from the new and old APIs are given in Figure 3b. In our
proposed architecture, if an old client performs an HTTP GET request to receive a work item, the
server ﬁrst retrieves that work item using the modern API, and then uses the lens’s get function to
convert this task into the legacy format. Similarly, if an old client performs an HTTP PUT request
to update a work item, the server ﬁrst uses the lens’s put function to convert that data into the
new format, and then inputs the work item in the new representation to the modern APIs. The
two representations contain the same information, but they are presented diﬀerently.
For simplicity, let’s consider only ﬁnding the mapping between the “Title” ﬁeld of the task in
the legacy and modern formats. The legacy client accepts inputs of the form
legacy_title = "<Field Id=2>" text_char* "</Field>"

while the modern client accepts inputs of the form
modern_title = ("Title:" text_char* text_char ",")
| ""

where text char is a user-deﬁned data type representing what characters can be present in a text
ﬁeld (like the title ﬁeld). We would like to be able to synthesize l, a lens that satisﬁes the typing
judgement l : legacy title ⇔ modern title (i.e. l maps between the legacy representation
legacy title, and the modern representation modern title). Because the modern API omits
the title ﬁeld if it is blank, the lens must perform diﬀerent actions depending on the number of
text characters present, functionality provided by or lenses. An or lens applies one of two lenses,
depending on which of the lenses’ source types matches the input string.
However, the typing rule for or does not suﬃce to type check lenses that map between legacy
title and modern title. While modern title is a regular expression with an outermost disjunction, legacy title is a regular expression with an outermost concatenation, so the rule
cannot be directly applied. We address this problem by allowing conversions between equivalent
regular expression types with the type equivalence rule. Using this rule, a type-directed synthesis
algorithm can convert legacy title into
legacy_title' =

"<Field Id=2></Field>"
| ("<Field Id=2>" text_char text_char* "</Field>")

There exist or lenses between legacy title’ and modern title, and the two cases of an empty
and a nonempty number of text characters can be handled separately. However, the need to ﬁnd
this equivalent type highlights a signiﬁcant challenge in synthesizing bijective lenses.
Challenge 1: Multi-dimensional Search Space. Since regular expression equivalence is decidable,
it is easy to check whether a given lens l with type S1 ⇔ S2 also has type S1′ ⇔ S2′ . During synthesis, however, deciding when and how to use type conversion is diﬃcult because there are inﬁnitely
many regular expressions that are equivalent to the source and target regular expressions. Does
the algorithm need to consider all of them? In what order? To convert from legacy title to
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:8

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

legacy title’, the algorithm must ﬁrst unroll text char* into "" | text char text char*,

and then it must distribute this disjunction on the left and the right.
A related challenge arises from the composition operator, l1 ; l2 . The typing rule for composition
requires that the target type of l 1 be the source type of l 2 . To synthesize a composition lens between
S1 and S3 , a sound synthesizer must ﬁnd an intermediate type S2 and lenses with types S1 ⇔ S2
and S2 ⇔ S3 . Searching for the correct regular expression S2 is again problematic because the
search space is inﬁnite.
Thus, naı̈vely applying type-directed synthesis techniques involves searching in three inﬁnite
dimensions. A complete naı̈ve synthesizer must search for (1) a type consisting of two regular
expressions equivalent to the given ones but with “similar shapes” and (2) a lens expression that
has the given type and is consistent with the user’s examples. Furthermore, whenever composition is part of the expression, naı̈ve type-directed synthesis requires a further search for (3) an
intermediate regular expression.
Our approach to this challenge is to deﬁne a new “DNF syntax” for types and lenses that reduces the synthesis search space in all dimensions. In this new language, regular expressions are
written in a disjunctive normal form, where disjunctions are fully distributed over concatenation
and where binary operators are replaced by n-ary ones, eliminating associativity rules. Using DNF
regular expressions, when presented with a synthesis problem with type (A|B)C ⇔ A′C ′ |B ′C ′ , Optician will ﬁrst convert this type into h[A·C] | [B ·C]i ⇔ h[A′ ·C ′] | [B ′ ·C ′]i, where h. . .i represents
n-ary disjunction and [. . .] represents n-ary concatenation. Like DNF regular expressions, DNF
lenses are stratiﬁed, with disjunctions outside of concatenations, and they use n-ary operators instead of binary ones. Furthermore, DNF lenses do not need a composition operator, eliminating
an entire dimension of search. This stratiﬁcation and the lack of composition creates a very tight
relationship between the structure of a well-typed DNF lens and its DNF regular expression types.
Translating regular expressions into DNF form collapses many equivalent REs into the same
syntactic form. However, this translation does not fully normalize regular expressions. Nor do we
want it to: If a synthesizer normalized ϵ | BB∗ to B∗, it would have trouble synthesizing lenses with
types like ϵ | BB∗ ⇔ ϵ | CD∗ where the ﬁrst occurrence of B on the left needs to be transformed
into C while the rest of the Bs need to be transformed into D. Normalization to DNF eliminates
many, but not all, of the regular expression equivalences that may be needed before a simple, typedirected structural search can be applied—i.e., DNF regular expressions are only pseudo-canonical.
Consequently, a type-directed synthesis algorithm must still search through some equivalent
regular expressions. To handle this search, SynthDNFLens is structured as two communicating
synthesizers, shown in Figure 4. The ﬁrst synthesizer, TypeProp, proposes DNF regular expressions equivalent to the input DNF regular expressions. TypeProp uses the axioms of a star semiring to unfold Kleene star operators in one or both types, to obtain equivalent (but larger) DNF
regular expression types. The second synthesizer, RigidSynth, performs a syntax-directed search
based on the structure of the provided DNF regular expressions, as well as the input examples. If
the second synthesizer ﬁnds a satisfying DNF lens, it returns that lens. If the second synthesizer
fails to ﬁnd such a lens, TypeProp learns of that failure, and proposes new candidate DNF regular
expression pairs.
Star Semiring Equivalence and Rewriting. One could try to search the space of DNF regular expressions equivalent to the input regular expressions by turning the Conway axioms into (undirected) rewrite rules operating on DNF regular expressions and then trying all possible combinations of rewrites. Doing so would be problematic because the Conway axiomatization itself is both
highly nondeterministic and inﬁnitely branching (due to the choice of n in the dyclicity axiom).
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:9
SynthDNFLens

DS
DT

TypeProp

DS’
DT ’

×
RigidSynth
X

dl

exs
Fig. 4. Schematic Diagram for DNF Lens Synthesis Algorithm. DNF regular expressions, DS and DT, and a
set of examples exs are given as input. The synthesizer, TypeProp, uses these input DNF regular expressions
to propose a pair of equivalent DNF regular expressions, DS ′ and DT ′ . The synthesizer RigidSynth then
attempts to generate a DNF lens, dl, which goes between DS ′ and DT ′ and satisfies all the examples in
exs. If RigidSynth is successful, dl is returned. If RigidSynth is unsuccessful, information of the failure is
returned to TypeProp, which continues proposing candidate DNF regular expressions until RigidSynth finds
a satisfying DNF lens.

We also want DNF lenses to be closed under composition – if it is not then we need to be
able to synthesize lenses containing composition operators. To be closed under composition, it
is suﬃcient for the equivalence relation used in the type equivalence rule to be the equivalence
closure of a rewrite system (→) satisfying four conditions. First, if S → S ′ , then L(S) = L(S ′).
Second, if S → S ′ and S is strongly unambiguous, then S ′ is also strongly unambiguous. The
remaining two properties relate the rewrite rules to the typing derivations of DNF lenses, when
those typing derivations do not use type equivalence. To express these properties, we use the
notation dl :̃ DS ⇔ DT to mean that if dl is a DNF lens that goes between DNF regular expressions
DS and DT , then the typing derivation contains no instances of the type equivalence rule. Using
this notation, we can express the conﬂuence property, as follows:
Deﬁnition 1 (Conﬂuence). Whenever dl 1 :̃ (⇓ S1 ) ⇔ (⇓ T1 ), if S1 → S2 and T1 → T2 , there exist
regular expressions S3 , and T3 and a DNF lens dl 3 , such that:
(1) S2 → S3
(2) T2 → T3
(3) dl 3 :̃ (⇓S3 ) ⇔ (⇓T3 )
(4) [[dl 3 ]] = [[dl 1 ]]
We call the ﬁnal property bisimilarity. Bisimilarity requires two symmetric conditions.
Deﬁnition 2 (Bisimilarity). Whenever dl 1 :̃ (⇓ S1 ) ⇔ (⇓ T1 ) and S1 → S2 , there exist a regular
expression T2 and a DNF lens dl 2 such that
(1) T1 → T2
(2) dl 2 :̃ (⇓S2 ) ⇔ (⇓T2 )
(3) [[dl 2 ]] = [[dl 1 ]]
To be bisimilar, the symmetric property must also hold for T1 → T2 .
Our solution for handling type equivalence is to use ≡s , the equivalence relation generated
by the axioms of a star semiring. This equivalence relation is compatible with our lens synthesis
strategy, as orienting these unrolling rules from left to right presents us with a rewrite relation that
is both conﬂuent and bisimilar, and whose equivalence closure is ≡s . The star semiring axioms are
the coarsest subset of regular expression equivalences we could ﬁnd that is generated by a rewrite
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:10

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

relation and is still conﬂuent and bisimilar. We have not been able to prove that this relation is
the coarsest such relation possible, but it is suﬃcient to cover all the test cases in our benchmark
suite (see §7). However, it is easy to show that Conway’s axioms (Prodstar in particular) are not
bisimilar, which is why we avoid this in our system.
Challenge 2: Large Types. DNF lenses are equivalent in expressivity to lenses and the algorithm
SynthDNFLens is quite fast. Unfortunately, the conversion to DNF incurs an exponential blowup.
In practical examples, the regular expressions describing complex ad hoc data formats may be
very large, causing the exponential blowup to have a signiﬁcant impact on synthesis time. The
key to addressing this issue is to observe that users naturally construct large types incrementally,
introducing named abbreviations for major subcomponents. For example, in the speciﬁcation of
legacy title and modern title, the variable text char describes which characters can be
present in a title. To include a large disjunction representing all valid title characters instead of
the concise variable text char in the deﬁnitions of legacy title and modern title would be
unmaintainable and diﬃcult to read.
Unfortunately, leaving these variables opaque introduces a new dimension of search. In addition
to searching through the rewrites on regular expressions, the algorithm must also search through
possible substitutions, replacements of variables with their deﬁnitions. We designate these two
types of equivalences expansions, using “rewrites” to denote expansions that arise from traversing
rewrite rules on the regular expressions, and using “substitutions” to denote expansions that arise
from replacing a variable with its deﬁnition.
Interestingly, Optician can exploit the structure inherent in these named abbreviations to speed
up the search dramatically. For example, if text char appears just once in both the source and
the target types, the system hypothesizes that the identity lens can be used to convert between
occurrences of text char. On the other hand, if text char appears in the source but not in the
target, the system recognizes that, to ﬁnd a lens, text char must be replaced by its deﬁnition. In
this way, the positions of names can serve as a guide for applying substitutions and rewrites in the
synthesis algorithm. By using these named abbreviations, TypeProp guides the transformation of
regular expression types during search by deducing when certain expansions must be taken, or
when one of a class of expansions must be taken.
4

DNF REGULAR EXPRESSIONS

The ﬁrst important step in Optician is to convert regular expression types into disjunctive normal
form (DNF). A DNF regular expression, abbreviated DNF RE, is an n-ary disjunction of sequences,
where a sequence alternates between concrete strings and atoms, and an atom is an iteration of
DNF regular expressions. The grammar below describes the syntax of DNF regular expressions
(DS,DT ), sequences (SQ,TQ), and atoms (A, B) formally.
A,B
::= DS ∗
SQ,TQ ::= [s0 · A1 · . . . · An · sn ]
DS,DT ::= hSQ 1 | . . . | SQn i
Notice that it is straightforward to convert an arbitrary series of atoms and strings into a sequence: if there are multiple concrete strings between atoms, the strings may be concatenated
into a single string. If there are multiple atoms between concrete strings, the atoms may be separated by empty strings, which will sometimes be omitted for readability. Notice also that a simple
string with no atoms may be represented as a sequence containing just one concrete string. In
our implementation, names of user-deﬁned regular expressions are also atoms. However, we elide
such deﬁnitions from our theoretical analysis.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:11

⊙SQ : Sequence → Sequence → Sequence
[s0 · A1 · . . . · An · sn ] ⊙SQ [t0 · B1 · . . . · Bm · tm ] = [s0 · A1 · . . . · An · sn · t0 · B1 · . . . · Bm · tm ]
⊙ : DNF → DNF → DNF
hSQ 1 | . . . | SQ n i ⊙ hTQ 1 | . . . | TQm i =
hSQ 1 ⊙SQ TQ 1 | · · · | SQ 1 ⊙SQ TQm | · · · | SQn ⊙SQ TQ 1 | · · · | SQn ⊙SQ TQm i
⊕ : DNF → DNF → DNF
hSQ 1 | . . . | SQ n i ⊕ hTQ 1 | . . . | TQm i = hSQ 1 | . . . | SQn | TQ 1 | . . . | TQm i
D :Atom → DNF
D(A) = h[ϵ · A · ϵ]i
Fig. 5. DNF Regular Expression Functions

Intuitions about DNF regular expressions may be conﬁrmed by their semantics, which we give
by deﬁning the language (set of strings) that each DNF regular expression denotes:
L(DS∗ ) = {s1 · . . . · sn | ∀isi ∈ L(DS)}
L([s0 · A1 · . . . · An · sn ]) = {s0 · t1 · · · tn · sn | ti ∈ L(Ai )}
L(hSQ 1 | . . . | SQn i) = {s | s ∈ L(SQi ) and i ∈ [1, n]}
A sequence of strings and atoms is sequence unambiguously concatenable, written ·! (s0 ; A1 ; . . . ; An ; sn ),
if, when si′ , ti′ ∈ L(Ai ) for all i, then s0 s1′ . . . sn′ sn = s0 t1′ . . . tn′ sn implies si′ = ti′ for all i. A DNF
regular expression S is unambiguously iterable, written S ∗! if, for all n, m ∈ N and for all strings
s1 , . . . , sn , t1 , . . . , tm ∈ L(S), if s1 · . . . · sn = t1 · . . . · tm then n = m and si = ti for all i.
Expressivity of DNF Regular Expressions. Any regular expression may be converted into an equivalent DNF regular expression. To deﬁne the conversion function, we rely on several auxiliary
functions deﬁned in Figure 5. Intuitively, DS ⊙ DS concatenates two DNF regular expressions, producing a well-formed DNF regular expression as a result. Similarly, DS ⊕ DS generates a new DNF
regular expression representing the union of two DNF regular expressions. Finally, D(A) converts
a naked atom into a well-formed DNF regular expression. The conversion algorithm itself, written
⇓S, is deﬁned below.
⇓s = h[s]i
⇓∅ = hi
⇓(S ∗) = D((⇓S)∗ )
⇓(S1 · S2 ) = ⇓S1 ⊙ ⇓S2
⇓(S1 | S2 ) = ⇓S1 ⊕ ⇓S2
Using ⇓ , the deﬁnition of legacy title’ gets converted into the DNF regular expression:
dnf legacy title =
h ["<Field Id=2></Field>"]
| ["<Field Id=2>" · text char · "" · h[text char]i ∗ · "<Field Id=2>"] i

and the deﬁnition of modern title gets converted into the DNF regular expression:
dnf modern title =
h ["Title:" · text char · "" · h[text char]i ∗ · ","]
| [""] i

Theorem 1 (⇓ Soundness). For all regular expressions S, L(⇓S) = L(S).
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:12

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic
Atom UnrollstarL

Atom UnrollstarR

DS ∗ →A h[ϵ]i ⊕ (DS ⊙ D(DS ∗ ))

DS ∗ →A h[ϵ]i ⊕ (D(DS∗ ) ⊙ DS)

Atom Structural Rewrite

DS → DS ′

DS ∗ →A h[DS ′∗ ]i
DNF Structural Rewrite

Aj →A DS
hSQ 1 | . . . | SQ i −1 i ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙ D(Aj ) ⊙ h[sj · . . . · Am · sm ]i ⊕ hSQ i +1 | . . . | SQ n i →
hSQ 1 | . . . | SQi −1 i ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙ DS ⊙ [sj · . . . · Am · sm ] ⊕ hSQ i +1 | . . . | SQn i
Fig. 6. DNF Regular Expression Rewrite Rules

DNF Regular Expression Rewrites. There are many fewer equivalences on DNF regular expressions than there are on regular expressions, but there still remain pairs of DNF regular expressions that, while syntactically diﬀerent, are semantically identical. Figure 6 deﬁnes a collection of
rewrite rules on DNF regular expressions designed to search the space of equivalent DNF REs. This
directed rewrite system helps limit the search space more than the non-directional equivalence ≡s
relation. However, because the rewrite rules are conﬂuent, it is just as powerful as the ≡s relation.
Because disjunctive normal form ﬂattens a series of unions or concatenations into an n-ary
sum-of-products, there is no need for rewriting rules that manage associativity or distributivity.
Moreover, the lens term language and synthesis algorithm itself manages out-of-order summands,
so we also have no need of rewriting rules to handle commutativity of unions. Hence, the rewriting
system need only focus on rewrites that involve Kleene star. The rule Atom UnrollstarL is a
directed rewrite rule designed to mirror UnrollstarL . Intuitively, it unfolds any atom DS ∗ into
ϵ | (DS · DS ∗ ). However, ϵ | (DS · DS ∗ ) is not a DNF regular expression. Hence, the rule uses DNF
concatenation (⊙) and union (⊕) in place of regular expression concatenation and union to ensure
a DNF regular expression is constructed. The rule Atom UnrollstarR mirrors the rule UnrollstarR
in a similar way.
The rules Atom Structural Rewrite and DNF Structural Rewrite make it possible to
rewrite terms involving Kleene star that are nested deep within a DNF regular expression, while
ensuring that the resulting term remains in DNF form.
5 DNF LENSES
The syntax of DNF lenses (dl), sequence lenses (sql) and atom lenses (al) is deﬁned below. DNF
lenses and sequence lenses both contain permutations (σ ) that help describe how these lenses act
on data.
al ::= iterate(dl)
sql ::= ([(s0 , t0 ) · al 1 · . . . · al n · (sn , tn )], σ )
dl ::= (hsql 1 | . . . | sqln i, σ )
A DNF lens consists of a list of sequence lenses and a permutation. Much like a DNF regular
expression is a list of disjuncted sequences, a DNF lens contains a list of ored sequence lenses. DNF
lenses also contain a permutation that provides information about which sequences are mapped
to which by the internal sequence lenses. As an example, consider a DNF lens that maps between
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:13

data with type dnf legacy title and data with type dnf modern title. In such a lens, the permutation σ indicates whether data matching ["<Field Id=2></Field>"] will be translated to
data matching ["Title:"·text char·""·h[text char]i ∗ ·","] or [""], and likewise for the other
sequence in dnf legacy title. In this case, we would use the permutation that swaps the order,
as the ﬁrst sequence in dnf legacy title gets mapped to the second in dnf modern title,
and vice-versa. As we will see in a moment, these permutations make it possible to construct a
well-typed lens between two DNF regular expressions regardless of the order in which clauses in
a DNF regular expression appear, thereby eliminating the need to consider equivalence modulo
commutativity of these clauses.
A sequence lens consists of a list of atom lenses separated by pairs of strings, and a permutation.
Intuitively, much like a sequence is a list of concatenated atoms and strings, a sequence lens is
a list of concatenated atom lenses and string pairs. Sequence lenses also contain a permutation
that makes get and put reorder data, allowing sequence lenses to take the job of both concat and
swap. If there are n elements in the series then the DNF sequence lens divides an input string up
into n substrings. The i th such substring is transformed by the i th element of the series. More
precisely, if that i th element is an atom lens, then the i th substring is transformed according to
that atom lens. If the i th element is a pair of strings (s 1 , s 2 ) then that pair of strings acts like a
constant lens: when used from left-to-right, such a lens translates string s 1 into s 2 ; when used
from right-to-left, such a lens translates string s 2 into s 1 . After all of the substrings have been
transformed, the permutation describes how to rearrange the substrings transformed by the atom
lenses to obtain the ﬁnal output. As an example, consider a sequence lens that maps between data
with type ["Title:"·text char·""·h[text char]i ∗·","] and data with type ["<Field Id=2>"·
text char · "" ·h[text char]i ∗ · "<Field Id=2>"]. We desire no reorderings between the atoms
text char and h[text char]i ∗ , so the permutation associated with this lens would be the identity
permutation.
An atom lens is an iteration of a DNF lens; its semantics is similar to the semantics of ordinary
iteration lenses. In our implementation, identity transformations between user-deﬁned regular
expressions are also atom lenses. However, we elide such deﬁnitions from our theoretical analysis.
The semantics of DNF Lenses, sequence lenses and atom lenses is deﬁned formally below.
[[iterate(dl)]] ::= {(s1 · . . . · sn , t1 · . . . · tn ) | n ∈ N ∧ (si , ti ) ∈ [[dl]]}
[[([(s0 , t0 ) · al 1 · . . . · al n · (sn , tn )], σ )]] ::= {(s0 s1′ . . . sn′ sn , t0 tσ′ (1) . . . tσ′ (n) tn ) | (si′, ti′ ) ∈ [[al i ]]}
[[(hsql 1 | . . . | sql n i, σ )]] ::= {(s, t) | (s, t) ∈ sql i for some i}
Type Checking. Figure 7 presents the type checking rules for DNF lenses. In order to control
where regular expression rewriting may be used (and thereby reduce search complexity), the ﬁgure
deﬁnes two separate typing judgements. The ﬁrst judgement has the form dl :̃ DS ⇔ DT . It
implies that the lens dl is a well-formed bijective map between the languages of DS and DT . This
judgement does not include the rule for rewriting the types of the source or target data. The second
judgement has the form dl : DS ⇔ DT . It rewrites the source and target types, and then searches
for a DNF lens with the rewritten types.
One of the key diﬀerences between these typing judgements and the judgements for ordinary
lenses are the permutations. For example, in the rule for typing DNF lenses, the permutation σ indicates how to match sequence types in the domain (SQ 1 . . . SQn ) and the range (TQ σ (1) . . . TQ σ (n) ).
Permutations are used in a similar way in the typing rule for sequence lenses.
Properties. While DNF lenses have a restrictive syntax, they remain as powerful as ordinary
bijective lenses. The following theorems characterize the relationship between the two languages.

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:14

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic
DS ∗!

dl :̃ DS ⇔ DT

DT ∗!

iterate(dl) :̃ DS ∗ ⇔ DT ∗

σ ∈ Sn

al 1 :̃ A1 ⇔ B1
...
·! (s0 ; A1 ; . . . ; An ; sn )

al n :̃ An ⇔ Bn
·! (t0 ; Bσ (1) ; . . . ; Bσ (n) ; tn )

([(s0 , t0 ) · al 1 · . . . · al n · (sn , tn )], σ ) :̃ [s0 · A1 · . . . · An · sn ] ⇔ [t0 · Bσ (1) · . . . · Bσ (n) · tn ]

σ ∈ Sn

sql 1 :̃ SQ 1 ⇔ TQ 1
...
i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅

sql n :̃ SQn ⇔ TQ n
i , j ⇒ L(TQi ) ∩ L(TQ j ) = ∅

(hsql 1 | . . . | sql n i, σ ) :̃ hSQ 1 | . . . | SQ n i ⇔ hTQ σ (1) | . . . | TQ σ (n) i
DS ′→∗ DS

DT ′ →∗ DT
′

dl : DS ⇔ DT

dl :̃ DS ⇔ DT
′

Fig. 7. DNF Lens Typing

Theorem 2 (DNF Lens Soundness). If there exists a derivation of dl : DS ⇔ DT , then there exist
a lens, ⇑ dl, and regular expressions, S and T , such that ⇑ dl : S ⇔ T and ⇓ S = DS and ⇓ T = DT
and [[⇑dl]] = [[dl]].
Theorem 3 (DNF Lens Completeness). If there exists a derivation for l : S ⇔ T , then there exists
a DNF lens dl such that dl : (⇓S) ⇔ (⇓T ) and [[l]] = [[dl]].
Discussion. DNF lenses are signiﬁcantly better suited to synthesis than regular bijective lenses.
First, they contain no composition operator. Second, the use of equivalence (rewriting) is highly
constrained: Rewriting may only be used once at the top-most level as opposed to interleaved
between uses of the other rules. Consequently, a type-directed synthesis algorithm may be factored
into two discrete steps: one step that searches for an eﬀective pair of regular expressions and a
second step that is directed by the syntax of the regular expression types that were discovered in
the ﬁrst step.
6

ALGORITHM
Synthesis Overview. Algorithm 1 presents the synthesis procedure. SynthLens takes the source
and target regular expressions S and T , and a list of examples exs, as input. First, SynthLens
validates the unambiguity of the input regular expressions, S and T , and conﬁrms that they parse
the input/output examples, exs. Next, the algorithm converts S and T into DNF regular expressions
DS and DT using the ⇓ operator. It then calls SynthDNFLens on DS, DT , and the examples to
create a DNF lens dl. Finally, it uses ⇑ to convert dl to a Boomerang lens.
SynthDNFLens starts by creating a priority queue Q to manage the search for a DNF lens.
Each element qe in the queue is a tuple of the source DNF regular expression DS ′ , the target DNF
regular expression DT ′, and a count e of the number of expansions needed to produce this pair
of DNF regular expressions from the originals DS and DT . (Recall that an expansion is a use of a
rewrite rule or the substitution of a user-deﬁned deﬁnition for its name.) The priority of each queue
element is e; DNF regular expressions that have undergone fewer expansions will get priority. The
algorithm initializes the queue with DS and DT , which have an expansion count of zero. The
algorithm then proceeds by iteratively examining the highest priority element from the queue
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:15

Algorithm 1 SynthLens
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:

function SynthDNFLens(DS, DT , exs)
Q ← CreatePQueue((DS, DT ), 0)
while true do
(qe, Q) ← Pop(Q)
(DS ′ , DT ′ , e) ← qe
dlo ← RigidSynth(DS ′ , DT ′ , exs)
match dlo with
| Some dl → return dl
| None →
qes ← Expand(DS, DT , e)
Q ← EnqeueMany(qes, Q)
function SynthLens(S, T , exs)
Validate(S, T , exs)
(DS, DT ) ← (⇓S, ⇓T )
dl ← SynthDNFLens(DS, DT , exs)
return ⇑dl

(this examination corresponds to TypeProp in Figure 4), and using the function RigidSynth to
try to ﬁnd a rewriteless DNF lens between the popped source and target DNF regular expressions
that satisfy the examples exs. If successful, the algorithm returns the DNF lens dl. Otherwise,
the function Expand produces a new set of candidate DNF regular expression pairs that can be
obtained from DS and DT by applying various expansions to the source and target DNF regular
expressions.

Algorithm 2 Expand
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:

function ExpandReqired(DS, DT ,e)
CS DS ← GetCurrentSet(DS)
CS DT ← GetCurrentSet(DT )
TS DS ← GetTransitiveSet(DS)
TS DT ← GetTransitiveSet(DT )
r ← false
foreach (U , i) ∈ CS DS \ TS DT
r ← true
(DS, e) ← ForceExpand(DS, U , i, e)
foreach (U , i) ∈ CS DT \ TS DS
r ← true
(DT , e) ← ForceExpand(DT , U , i, e)
if r then
return ExpandReqired(DS, DT , e)
return (DS, DT , e)

16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:

function FixProblemElts(DS, DT ,e)
CS DS ← GetCurrentSet(DS)
CS DT ← GetCurrentSet(DT )
qes ← []
foreach (U , i) ∈ CS DT \ CS DS
qes ← qes ++ Reveal(DS, U , i, e, DT )
foreach (U , i) ∈ CS DS \ CS DT
qes ← qes ++ Reveal(DT , U , i, e, DS)
return qes
function Expand(DS, DT ,e)
(DS, DT , e) ← ExpandReqired(DS, DT , e)
qes ← FixProblemElts(DS, DT , e)
match qes with
| [] → return ExpandOnce(DS, DT , e)
| → return qes

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:16

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Expand. Intelligent expansion inference is key to the eﬃciency of Optician. Expand, shown in
Algorithm 2, codiﬁes this inference. It makes critical use of the locations of user-deﬁned data types,
measured by their star depth, which is the number of nested ∗ ’s the data type occurs beneath. Star
depth locations are useful because we can quickly compute the current star depths of user-deﬁned
data types (with GetCurrentSet) and the star depths of user-deﬁned data types reachable via
expansions (with GetTransitiveSet). Furthermore, the star depths of user-deﬁned data types
have the following useful property:
Property 1. If U is present at star depth i in DS and there exists a rewriteless DNF lens dl such
that dl :̃ DS ⇔ DT , then U is also present at star depth i in DT . The symmetric property is true if
U is present at star depth i in DT .
Property 1 means that if there is a rewriteless DNF lens between two DNF regular expressions,
then the same user-deﬁned data types must be present at the same locations in both of the DNF
regular expressions. We use this property to determine when certain rules must be applied and to
direct the search to rules that make progress towards this required alignment.
Expand has three major components: ExpandReqired, FixProblemElts, and ExpandOnce,
which we discuss in turn. ExpandReqired performs expansions that must be taken. In particular, if a user-deﬁned data type U at star depth i is impossible to reach through any number of
expansions on the opposite side, then that user-deﬁned data type must be replaced by its deﬁnition at that depth. For example, consider trying to ﬁnd a lens between h[legacy title]i and
h[modern title]i. No matter how many expansions are performed on modern title, the userdeﬁned type legacy title will not be exposed because the set of possible reachable pairs of data
types and star depths in modern title is {(modern title, 0), (text char, 0), (text char, 1)}.
Because no number of expansions will reveal legacy title on the right, the algorithm must
replace legacy title with its deﬁnition on the left in order to ﬁnd a lens. ExpandReqired
continues until it ﬁnds all forced expansions.
ExpandReqired ﬁnds all the expansions that must be performed, but it does not perform any
other expansions. However, there are many situations where it is possible to infer that one of
a set of expansions must be performed without forcing any individual expansion. In particular,
for any pair of types that have a rewriteless lens between them, for each (user-deﬁned type, star
depth) pair (U , i) on one side, that same pair must be present on the other side. FixProblemElts
identiﬁes when there is a (U , i) pair present on only one side. After identifying these problem
elements, it calls Reveal to ﬁnd the expansions that will reveal this element. For example, after
h[legacy title]i has been expanded to
h["<Field Id=2>" · h[text char]i ∗ · "</Field>"]i
and h[modern title]i has been expanded to
h["Title:" · text char · "" · h[text char]i ∗ · ","] | [""]i
we can see that the modern expansion has an instance of text char at depth 0, where the legacy
one does not. For a lens to exist between the two types, text char must be revealed at star depth
0 in the legacy expansion. Revealing text char at depth zero will give back two candidate DNF
regular expressions, one from an application of Atom UnrollstarL , and one from an application
of Atom UnrollstarR .
Together ExpandReqired and FixProblemElts apply many expansions, but by themselves
they are not suﬃcient. Typically, when FixProblemElts and ExpandReqired do not ﬁnd all the
necessary expansions, the input data formats expect large amounts of similar information. For example, in trying to synthesize the identity transformation between "" | U | UU(U*) and "" |
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:17

U(U*), ExpandReqired and FixProblemElts ﬁnd no forced expansions. An expansion is necessary, but the set of pairs ({(U, 0), (U, 1)}) is the same for both sides. When this situation arises, the
algorithm uses the ExpandOnce function to conduct a purely enumerative search, implemented
by performing all single-step expansions.

RigidSynth. The function RigidSynth, shown in Algorithm 3, implements the portion of SynthLens that generates a lens from the types and examples without using any equivalences. Intuitively, it aligns the structures of the source and target regular expressions by ﬁnding appropriate
permutations of nested sequences and nested atoms, taking into account the information contained
in the examples. Once it ﬁnds an alignment, it generates the corresponding lens.
Searching for aligning permutations requires care, as naı̈vely considering all permutations between two DNF regular expressions hSQ 1 | . . . | SQn i and hTQ 1 | . . . | TQ n i would require time
proportional to n!. A better approach is to identify elements of the source and target DNF regular
expressions that match and to leverage that information to create candidate permutations.
RigidSynth performs this identiﬁcation via orderings on sequences (≤Seq ), and atoms (≤Atom ).
To determine if one expression is less than the other, the algorithm converts each expression into
a list of its subterms and returns whether the lexicographic ordering determines the ﬁrst list less
than the second. These orderings are carefully constructed so that equivalent terms have lenses
between them. For example, between two sequences, SQ and TQ, there is a lens sql :̃ SQ ⇔ TQ
if, and only if, SQ ≤Seq TQ and TQ ≤Seq SQ. Through these orderings, aligning the components
reduces to merely sorting and zipping lists. Furthermore, through composing the permutations
required to sort the sequences, the algorithm discovers the permutation used in the lens.
As an example, consider trying to ﬁnd a DNF lens between
h ["<Field Id=2></Field>"]
| ["<Field Id=2>" · text char · "" · h[text char]i ∗ · "<Field Id=2>"] i

and
h ["Title:" · text char · "" · h[text char]i ∗ · ","]
| [""] i

As RigidSynth considers the legacy DNF regular expression, it orders its two sequences by maintaining the existing order: ﬁrst ["<Field Id=2></Field>"], then ["<Field Id=2>"·text char·
"" · h[text char]i ∗ · "<Field Id=2>"]. In contrast, RigidSynth reorders the two sequences
of the modern DNF regular expression, making [""] ﬁrst, and ["Title:" · text char · "" ·
h[text char]i ∗ · ","] second; the overall permutation is a swap. As a result, the two string sequences become aligned, as do the two complex sequences.
Then, the algorithm calls RigidSynthSeq on the two aligned sequence pairs. There are no atoms
in both ["<Field Id=2></Field>"] and [""], trivially creating the sequence lens:
([("<FieldId=2></Field>", "")], id)

Next, the sequences ["<Field Id=2>" · text char · "" · h[text char]i ∗ · "<Field Id=2>"]
and ["Title=" · text char · ·"" · h[text char]i ∗ · ","] would be sent to RigidSynthSeq. In
RigidSynthSeq, the atoms would not be reordered, aligning text char with text char, and
h[text char]i ∗ with h[text char]i ∗ . Immediately, RigidSynthAtom ﬁnds the identity transformation on text char, and will recurse to ﬁnd iterate((h([("", "") · id text char · ("", ""), id])i, id))
for h[text char]i ∗ . Then, these generated atom lenses are combined into a sequence lens. Lastly,
the two sequence lenses are used with the swapping permutation to create the ﬁnal DNF lens.
By incorporating information about how examples are parsed in the orderings, SynthLens guarantees not only that there will be a lens between the regular expressions, but also that the lens
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:18

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Algorithm 3 RigidSynth
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:

function RigidSynthAtom(A, B, exs)
match (A, B) with
| (U , V ) →
exs
exs
if U ≤Atom
V ∧ V ≤Atom
U then
return Some id U
else
return None
| (DS ∗ ,DT ∗ ) →
match RigidSynth(DS, DT , exs) with
| Some dl → return iterate(dl)
| None → return None
| → return None
function RigidSynthSeq(SQ, TQ, exs)
[s0 · A1 · . . . · An · sn ] ← SQ
[t0 · B1 · . . . · Bm · tm ] ← TQ
if n , m then
return None
exs , [A · . . . · A ])
σ1 ← sorting(≤Atom
1
n
exs
σ2 ← sorting(≤Atom , [B1 · . . . · Bn ])
σ ← σ1−1 ◦ σ2
ABs ← Zip([A1 · . . . · An ], [Bσ (1) · . . . · Bσ (n) ])
alos ← Map(RigidSynthAtom(exs), ABs)
match AllSome(alos) with
| Some [al 1 · . . . · al n ] → return Some ([(s0 , t0 ) · al 1 · . . . · al n · (sn , tn )], σ −1 )
| None → return None
function RigidSynth(DS, DT , exs)
hSQ 1 | . . . | SQn i ← DS
hTQ 1 | . . . | TQm i ← DT
if n , m then
return None
exs , [SQ | . . . | SQ ])
σ1 ← sorting(≤Seq
1
n
exs , [TQ | . . . | TQ ])
σ2 ← sorting(≤Seq
1
n
σ ← σ1−1 ◦ σ2
STQs ← Zip([SQ 1 | . . . | SQ n ], [TQ σ (1) | . . . | TQ σ (n) ])
sqlos ← Map(RigidSynthSeq(exs), STQs)
match AllSome(sqlos) with
| Some [sql 1 | . . . | sql n ] → return Some (hsql 1 | . . . | sqln i, σ −1 )
| None → return None

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:19

exs TQ and TQ ≤ exs SQ (where ≤ exs is the ordering
will satisfy the examples. For example if SQ ≤Seq
Seq
Seq
incorporating example information) then there is not only a sequence lens between SQ and TQ,
but there is one that also satisﬁes the examples. Incorporating parse tree information lets the synthesis algorithm diﬀerentiate between previously indistinguishable subcomponents; a text char
that parsed only "a" would become less than a text char that parsed only "b". The details of
these orderings are formalized in Section B.12.

Correctness. We have proven two theorems demonstrating the correctness of our algorithm.
Theorem 4 (Algorithm Soundness). For all lenses l, regular expressions S and T , and examples
exs, if l = SynthLens(S, T , exs), then l : S ⇔ T and for all (s, t) in exs, (s, t) ∈ [[l]].
Theorem 5 (Algorithm Completeness). Given regular expressions S and T , and a set of examples exs, if there exists a lens l such that l : S ⇔ T and for all (s, t) in exs, (s, t) ∈ [[l]], then
SynthLens(S, T , exs) will return a lens.
Theorem 4 states that when we return a lens, that lens will match the speciﬁcations. Theorem 5
states that if there is a DNF lens that satisﬁes the speciﬁcation, then we will return a lens, but
not necessarily the same one. However, from Theorem 4, we know that this lens will match the
speciﬁcations. The proofs of these theorems, and the previous ones, are provided in the appendix.
Simpliﬁcation of Generated Lenses. While our system takes in only partial speciﬁcations, there
can be multiple lenses that satisfy the speciﬁcations. To help users determine if the synthesized
lens is correct, Optician transforms the generated code to make it easily readable. Optician (1)
maximally factors the concats and ors, (2) turns lenses that perform identity transformations into
identity lenses, and (3) simpliﬁes the regular expressions the identity lenses take as an argument.
Performing these transformations and pretty printing the generated lenses make the synthesized
lenses easy to understand.
Compositional Synthesis. Most synthesis problems can be divided into subproblems. For example, if the format S1 · S2 must be converted into T1 · T2 , one might ﬁrst work on the S1 ⇔ T1 and
S2 ⇔ T2 subproblems. After those subproblems have been solved, the lenses they generate can be
combined into a solution for S1 · S2 ⇔ T1 · T2 .
Our tool allows users to specify multiple synthesis problems in a single ﬁle, and allows the
later, more complex problems to use the results generated by earlier problems. This tactic allows
Optician to scale to problems of just about any size and complexity with just a bit more user input.
This compositional interface also provides users greater control over the synthesized lenses and
allows reuse of intermediate synthesized abstractions. The compositional synthesis engine allows
lenses previously deﬁned manually by the user, and lenses in the Boomerang standard library to
be included in synthesis.
7 EVALUATION
We have implemented Optician in 3713 lines of OCaml code. We have integrated our synthesis
algorithm into Boomerang, so users can input synthesis tasks in place of lenses. We have published
this code on GitHub, with a link given in the non-anonymized supplementary material.
We evaluate our synthesis algorithm by applying it to 39 benchmark programs. All evaluations
were performed on a 2.5 GHz Intel Core i7 processor with 16 GB of 1600 MHz DDR3 running
macOS Sierra.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:20

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Benchmark Suite Construction. We constructed our benchmarks by adapting examples from
Augeas [26] and Flash Fill [16] and by handcrafting speciﬁc examples to test various features of
the algorithm.
Augeas is a conﬁguration editing system for Linux that uses lens combinators similar to those
in Boomerang. However, it transforms strings on the left to structured trees on the right rather
than transforming strings to strings. We adapted these Augeas lenses to our setting by converting
the right-hand sides to strings that correspond to serialized versions of the tree formats. Augeas
also supports asymmetric lenses [13], which are more general than the bijective lenses Optician can
synthesize. We adapted these examples by adding extra ﬁelds to the target to make the transformations bijective and thus suitable for our study. We derived 29 of the benchmark tests by adapting
the ﬁrst 27 lenses in alphabetical order, as well as the lenses aug/xml-firstlevel and aug/xml
that were referenced by the ‘A’ lenses. Furthermore, the 12 last synthesis problems derived from
Augeas were tested after Optician was ﬁnalized, demonstrating that the optimizations were not
overtuned to perform well on the testing data.
Flash Fill is a system that allows users to specify common string transformations by example [16]. Many of the examples from Flash Fill are non-bijective because the user’s goal is often
to extract information. We were able to adapt some examples by adding information to the target
so the resulting transformation was bijective. We derived three benchmarks from examples in the
Flash Fill paper [16] that were close to bijections.
Finally, we added custom examples to highlight weaknesses of our algorithm (cap-prob and
2-cap-prob) and to test situations for which we thought the tool would be particularly useful (workitem-probs, date-probs, bib-prob, and addr-probs). These examples convert between work item formats, date formats, bibliography formats, and address formats, respectively.
We have both complex and simple synthesis tasks in our benchmark suite. We generate lenses of
sizes between 5 AST nodes, for simple problems like changing how dates are represented, and 305
AST nodes, for complex tasks like transforming arbitrary XML of depth 3 or less to a dictionary
representation.
Impact of Optimizations. We developed a series of optimizations that improve the performance
of the synthesis algorithm dramatically. To determine the relative importance of these optimizations, we developed the 5 diﬀerent modes that run the synthesis algorithm with various optimizations enabled. These modes are:
Full: All optimizations are enabled, and compositional synthesis is used.
NoCS: Like Full, but compositional synthesis is not used.
NoFPE: Like NoCS, but FixProblemElts is never called, expansions are only forced through ExpandReqired or processed enumeratively through ExpandOnce.
NoER: Like NoFPE, but all the expansions taken are generated through enumerative search from
ExpandOnce.
NoUD: User-deﬁned data types are no longer kept abstract until needed. All user-deﬁned regular
expressions get replaced by their deﬁnition at the start of synthesis.
We ran Optician in each mode over our benchmark suite. We summarize the results of these
tests in Figure 8. Full synthesized all 39 benchmarks, NoCS synthesized 48 benchmarks, NoFPE
synthesized 36 benchmarks, NoER synthesized 6 benchmarks, NoUD synthesized 8 benchmarks,
and Naı̈ve synthesized 0 benchmarks. Optician’s optimizations make synthesis eﬀective against
a wide range of complex data formats.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:21

Time vs Benchmarks Completed

40

Full
NoCS
NoFPE
NoUD
NoER
FlashExtract
Flash Fill
Naïve

Benchmarks Completed

35
30
25
20
15
10
5
0

0

100

200

300
400
Time (s)

500

600

Fig. 8. Number of benchmarks that can be solved by a given algorithm in a given amount of time. Full is
the full synthesis algorithm. NoCS is the synthesis algorithm using all optimizations but without using a
library of existing lenses. NoFPE is the core DNF synthesis algorithm augmented with user-defined data
types with forced expansions performed. NoER is the core synthesis augmented with user-defined data
types. NoUD is the core synthesis algorithm. FlashExtract is the existing FlashExtract system. Flash Fill
is the existing Flash Fill system. Naı̈ve is naı̈ve type-directed synthesis on the bijective lens combinators.
Our synthesis algorithm performs better than the naı̈ve approach and other string transformation systems,
and our optimizations speed up the algorithm enough that all tasks become solvable.

Interestingly, NoER performs worse than NoUD. Adding in user deﬁned data types introduces
the additional search through substitutions. The cost of this additional search outweighs the savings that these data type abstractions provide. In particular, because of the large fan-out of possible expansions, NoER can only synthesize lenses which require 5 or fewer expansions. However,
some lenses require over 50 expansions. Without a way to intelligently traverse expansions, the
need to search through substitutions makes synthesis unbearably slow.
In NoFPE, we can determine that many expansions are forced, so an enumerative search is often
unnecessary. Figure 9 shows that in a majority of examples, all the expansions can be identiﬁed
as required, minimizing the impact of the large fan-out. While unable to infer every expansion
for all the benchmarks, the full algorithm is able to infer quite a bit. In our benchmark suite,
ExpandReqired infers a median of 13 and a maximum of 75 expansions.
Merely inferring the forced expansions makes almost all the synthesis tasks solvable. In many
cases, NoFPE infers all the expansions. In 22 of the 38 examples solvable by NoCS, all expansions
were forced. However, the remaining 16 still require some enumerative search. This enumerative
search causes the NoFPE version of the algorithm to struggle with some of the more complex
benchmarks. Incorporating FixProblemElts speeds up these slow benchmarks. When using full
inference (FixProblemElts and ExpandReqired), the synthesis algorithm can recognize that
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Benchmark Count

1:22

30
25
20
15
10
5
0

Number of Benchmarks with Uninferred Expansions
NoCS
NoFPE

0

1
2
3
Expansions Not Inferred

4

Benchmark Count

Fig. 9. Number of expansions found using enumerative search for tasks requiring a given number of expansions. NoCS is using the full inference algorithm. NoFPE only counts forced inferences as found by the
ExpandRequired function. Both systems are able to infer the vast majority of expansions. Full inference
only rarely requires enumerative search.

14
12
10
8
6
4
2
0

Subtasks Specified During Compositional Synthesis

0

1

2
3
Subtasks Specified

4

Fig. 10. Number of subtasks specified during compositional synthesis. Splitting the task into just a few
subtasks provides huge performance benefits at the cost of a small amount of additional user work.

one of a few expansions must be performed. Adding in these types of inferred expansions directs the remaining search even more, both speeding up existing problems and solving previously
unmanageable benchmarks.
When combined, these optimizations implement an eﬃcient synthesis algorithm, which can
synthesize lenses between a wide range of data formats. However, some of the tasks are still
slow, and one remains unsolved. Using compositional synthesis lets the system scale to the most
complex synthesis tasks, synthesizing all lenses in under 5 seconds. Additional user interaction
is required for compositional synthesis, but the amount of interaction is minimal, as shown in
Figure 10. The number of subtasks used was in no way the minimal number of subtasks needed
for synthesis under 5 seconds, but rather subtasks were introduced where they naturally arose.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Benchmark Count

Synthesizing Bijective Lenses

35
30
25
20
15
10
5
0

1:23

Examples Required for Benchmarks
Experimental Average
Determinize Permutations

0

1-5

6-10 11-15
Example Count

16-20

>20

Fig. 11. Average number of random examples required to synthesize benchmark programs. Experimental
Average is the average number of randomly generated examples needed to correctly synthesize the lens.
Determinize Permutations is the theoretical number of examples required to determinize the choice all
the permutations in RigidSynth. In practice, far fewer examples are needed to synthesize the correct lens
than would be predicted by the number required to determinize permutations.

The benchmark that only completes with compositional synthesis is also the slowest benchmark
in Full, aug/xml3 . Optician can only synthesize a lens for this example when compositional synthesis is used because it is a complex data format, it requires a large number of expansions, and
relatively few expansions are forced. When not using compositional synthesis, the algorithm must
perform a total of 398 expansions, of which only 105 are forced. The synthesis algorithm is able
to force so few expansions because of the highly repetitive nature of the aug/xml speciﬁcation.
XML tags occur at many diﬀerent levels, and they all use the same user-deﬁned data types. This
repetitive nature causes our expansion inference to ﬁnd only a few of the large number of required
expansions. The large fan-out of expansions, combined with the large number of expansions that
must be performed, creates a search space too large for our algorithm to eﬀectively search. However, the synthesis algorithm is able to succeed on the easier task of ﬁnding the desired transformation when provided with two additional subtasks: synthesis on XML of depth one, and synthesis
of XML of depth up to two.
Importance of Examples. To evaluate how many user-supplied examples the algorithm requires
in practice, we randomly generated appropriate source/target pairs, mimicking what a naı̈ve user
might do. We did not write the examples by hand out of concern that our knowledge of the
synthesis algorithm might bias the selection. Figure 11 shows the number of randomly generated
examples it takes to synthesize the correct lens averaged over ten runs. The synthesis algorithm
almost never needs any examples: only 5 benchmarks need a nonzero number of examples to
synthesize the correct lens and only one, cust/workitem-probs required over 10 randomly
generated examples. A clever user may be able to reduce the number of examples further by
selecting examples carefully; we synthesized cust/workitem-probs with only 8 examples.
These numbers are low because there are relatively few well-typed bijective lenses between any
two source and target regular expressions. As one would expect, the benchmarks where there are
multiple ways to map source data to the target (and vice versa) require the most examples. For
3 Since

xml syntax is context-free, the source and target regular expressions describe only xml expressions up to depth 3.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:24

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

example, the benchmark cust/workitem-probs requires a large number of examples because
it must diﬀerentiate between data in diﬀerent text ﬁelds in both the source and target and map
between them appropriately. As these text ﬁelds are heavily permuted (the legacy format ordered
ﬁelds by a numeric ID, where the modern format ordered ﬁelds alphabetically) and ﬁelds can be
omitted, a number of examples are needed to correctly identify the mapping between ﬁelds.
The average number of examples to infer the correct lens does not tell the whole story. The
system will stop as soon as it ﬁnds a well typed lens that satisﬁes the supplied examples. This
inferred lens may or may not correctly handle unseen examples that correspond to unexercised
portions of the source and target regular expressions. Figure 11 lists the number of examples that
are required to determinize the generation of permutations in RigidSynth. Intuitively, this number represents the maximum number of examples that a user must supply to guide the synthesis
engine if it always guesses the wrong permutation when multiple permutations can be used to
satisfy the speciﬁcation.
The average number of examples is so much lower than the maximum number of required
examples because of correspondences in how we wrote the regular expressions for the source and
target data formats. Speciﬁcally, when we had corresponding disjunctions in both the source and
the target, we ordered them the same way. The algorithm uses the supplied ordering to guide its
search, and so the system requires fewer examples. We did not write the examples in this style
to facilitate synthesis, but rather because maintaining similar subparts in similar orderings makes
the types much easier to read. We expect that most users would do the same.
Comparison Against Other Tools. We are the ﬁrst tool to synthesize bidirectional transformations
between data formats, so there is no tool to which we can make an apple-to-apples comparison.
Instead, we compare against tools for generating unidirectional transformations instead. Figure 8
includes a comparison against two other well-known tools that synthesize text transformation and
extraction functions from examples – Flash Fill and FlashExtract. For this evaluation, we used the
version of these tools distributed through the PROSE project [38].
To generate speciﬁcations for Flash Fill, we generated input/output speciﬁcations by generating
random elements of the source language, and running the lens on those elements to generate
elements of the target language. These were then fed to Flash Fill.
To generate speciﬁcations for FlashExtract, we extracted portions of strings mapped in the generated lens either through an identity transformation or through a previously synthesized lens,
whereas strings that were mapped through use of const were considered boilerplate and so not
extracted.
As these tools were designed for a broader audience, they put less of a burden on the user. These
tools only use input/output examples (for Flash Fill), or marked text regions (for FlashExtract), as
opposed to Optician’s use of regular expressions to constrain the format of the input and output. By
using regular expressions, Optician is able to synthesize signiﬁcantly more programs than either
existing tool.
Flash Fill and FlashExtract have two tasks: to determine how the data is transformed, they
must also infer the structure of the data, a diﬃcult job for complex formats. In particular, neither
Flash Fill nor FlashExtract was able to synthesize transformations or extractions present under
two iterations, a type of format that is notoriously hard to infer. These types of dual iterations are
pervasive in Linux conﬁguration ﬁles, making Flash Fill and FlashExtract ill suited for many of the
synthesis tasks present in our test suite.
Furthermore, as unidirectional transformations, Flash Fill and FlashExtract have a more expressive calculus. To guarantee bidirectionality, our syntax must be highly restrictive, providing a
smaller search space to traverse.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses
8

1:25

RELATED WORK

In searching for equivalent regular expressions, we focused on Conway’s equational theory rather
than alternative axiomatizations such as Kozen’s [22] and Salomaa’s [33]. Kozen and Salomaa’s
axiomatizations are not equational theories: applying certain inference rules requires that side
conditions must be satisﬁed. Consequently, using these axiomatizations does not permit a simple
search strategy – our algorithm could no longer merely apply rewrite rules because it would need
to conﬁrm that the side conditions are satisﬁed. To avoid these complications, we focused on
Conway’s equational theory.
The literature on bidirectional programming languages and on lens-like structures is extensive.
We discussed highlights in the introduction; readers can also consult a (slightly dated) survey [8]
and recent theoretical perspectives [1, 12].
While we do not know of any previous eﬀorts to synthesize bidirectional transformations, there
is a good deal of other recent research on synthesizing unidirectional string transformations [16,
24, 31, 35, 36]. We compared our system to two of these unidirectional string transformers, Flash
Fill [16] and FlashExtract [24]. We found that these tools were unsuccessful in synthesizing the
complex transformations we are performing – both these tools synthesized under 5 of our 39 examples. Furthermore, neither of these tools were able to infer transformations which occurred
under two iterations. Much of this work assumes, like us, that the synthesis engine is provided
with a collection of examples. Our work diﬀers in that we assume the programmer supplies both
examples and format descriptions in the form of regular expressions. There is a trade-oﬀ here. On
the one hand, a user must have some programming expertise to write regular expression speciﬁcations and it requires some work. On the other hand, such speciﬁcations provide a great deal of
information to the synthesis system, which decreases the number of examples needed (often to
zero), makes the system scale well, and allows it to handle large, complex formats, as shown in §7.
By providing these format speciﬁcations, the synthesis engine does not have to both infer the format of the data as well as the transformations on it, obviating the need to infer tricky formats like
those involving nested iterations. Furthermore, through focusing on bidirectional transformations
we limit the space of synthesized functions to bijective ones, reducing the search space.
There are many other recent results showing how to synthesize functions from type-based speciﬁcations [2, 11, 14, 29, 32, 34]. These systems enumerate programs of their target language, orienting their search procedures to process only terms that are well-typed. Our system is distinctive in
that it synthesizes terms in a language with many type equivalences. Perhaps the most similar is
InSynth [17], a system for synthesizing terms in the simply-typed lambda calculus that addresses
equivalences on types. Instead of trying to directly synthesize terms of the simply-typed lambda
calculus, InSynth synthesizes a well-typed term in the succinct calculus, a language with types
that are equivalent “modulo isomorphisms of products and currying” [17]. Our type structure is
signiﬁcantly more complex. In particular, because our types do not have full canonical forms, we
use a pseudo-canonical form, which captures part of the equivalence relation over types. To preserve completeness, we push some of the remaining parts of the type equivalence relation into a
set of rewriting rules and other parts into the RigidSynth algorithm itself.
Morpheus [10] is another synthesis system that uses two communicating synthesizers to generate programs. In both Morpheus and Optician, one synthesizer provides an outline for the program,
and the other ﬁlls in that outline with program details that satisfy the user’s speciﬁcations. This
approach works well in large search spaces, which require some enumerative search. Our systems
diﬀer in that an outline for Morpheus is a sketch—an expression containing holes—whereas an outline for Optician is a pair of DNF regular expressions, i.e., a type. Moreover, in order to implement
an eﬃcient search procedure, we had to create both a new type language and a new term language
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:26

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

for lenses. Once we did so, we proved our new, more constrained language designed for synthesis was just as expressive as the original, more ﬂexible and compositional language designed for
human programmers.
Many synthesis algorithms work on domain-speciﬁc languages custom built for synthesis [15,
24, 37, 39]. We too built a custom domain-speciﬁc language for synthesis – DNF lenses. We provide
the capabilities to convert speciﬁcations in an existing language, Boomerang, to speciﬁcations as
DNF regular expressions, and provide the capabilities to convert our generated DNF lenses to
Boomerang lenses. But we go further than merely providing a converter to Boomerang, we also
provide completeness results stating exactly which terms of Boomerang we are able to synthesize.
9 CONCLUSION
Data processing systems often need to convert data back-and-forth between diﬀerent formats.
Domain-speciﬁc languages for generating bidirectional programs help prevent data corruption in
such contexts, but are unfamiliar and hard to use. To simplify the development of bidirectional
applications, we have created the ﬁrst synthesizer of a bidirectional language, generating lenses
from data format speciﬁcations and input/output examples. To reduce the size of the synthesis
search space, our system introduces a new language of DNF lenses, which are typed by DNF regular
expressions. We have proven our new language sound and complete with respect to a declarative
speciﬁcation. We also describe eﬀective optimizations for eﬃciently searching through the reﬁned
space of lenses.
We evaluated our system on a range of practical examples drawn from other systems in the
literature including Flash Fill and Augeas. In general, we found our system to be robust, to require
few examples, and to ﬁnish in seconds, even on complex data formats. We found that our typedirected synthesis algorithm is able to generate data transformations too complex for both existing
example-directed systems and for a naı̈ve type-directed algorithm, succeeding on 35 more benchmarks than the tested existing alternatives. We attribute its success to a combination of (1) the
information provided by format speciﬁcations, (2) the structure induced by user-speciﬁed names,
and (3) the inferences used to guide search. The approaches we used are generalizable both to
other bidirectional languages, as well as to other domain-speciﬁc languages with large numbers
of equivalences on the types.
REFERENCES
[1] F. Abou-Saleh, J. Cheney, J. Gibbons, J. McKinna, and P. Stevens. Reﬂections on monadic lenses. In A List of Successes
That Can Change the World - Essays Dedicated to Philip Wadler on the Occasion of His 60th Birthday, pages 1–31, 2016.
[2] L. Augustsson.
[haskell] announcing djinn, version 2004-12-11, a coding wizard.
Mailing List, 2004.
http://www.haskell.org/pipermail/haskell/2005-December/017055.html.
[3] D. M. J. Barbosa, J. Cretin, N. Foster, M. Greenberg, and B. C. Pierce. Matching lenses: Alignment and view update.
In ACM SIGPLAN International Conference on Functional Programming (ICFP), Baltimore, Maryland, Sept. 2010.
[4] A. Bohannon, J. A. Vaughan, and B. C. Pierce. Relational lenses: A language for updateable views. In Principles of
Database Systems (PODS), 2006. Extended version available as University of Pennsylvania technical report MS-CIS05-27.
[5] A. Bohannon, J. N. Foster, B. C. Pierce, A. Pilkiewicz, and A. Schmitt. Boomerang: Resourceful lenses for string data.
In Proceedings of the 35th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL
’08. ACM, 2008.
[6] R. Book, S. Even, S. Greibach, and G. Ott. Ambiguity in graphs and expressions. IEEE Trans. Comput., 20(2), Feb. 1971.
ISSN 0018-9340.
[7] J. H. Conway. Regular Algebra and Finite Machines. Printed in GB by William Clowes & Sons Ltd, 1971.
[8] K. Czarnecki, J. N. Foster, Z. Hu, R. Lämmel, A. Schürr, and J. F. Terwilliger. Bidirectional transformations: A crossdiscipline perspective. In R. F. Paige, editor, ICMT, volume 5563 of Lecture Notes in Computer Science, pages 260–283.
Springer, 2009. ISBN 978-3-642-02407-8.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:27

[9] M. Droste, W. Kuich, and H. Vogler, editors. Semirings and Formal Power Series, pages 3–28. Springer Berlin Heidelberg,
2009. URL http://dx.doi.org/10.1007/978-3-642-01492-5 1.
[10] Y. Feng, R. Martins, J. Van Geﬀen, I. Dillig, and S. Chaudhuri. Component-based synthesis of table consolidation and
transformation tasks from examples. In Proceedings of the 38th ACM SIGPLAN Conference on Programming Language
Design and Implementation, PLDI 2017. ACM, 2017. URL http://doi.acm.org/10.1145/3062341.3062351.
[11] J. K. Feser, S. Chaudhuri, and I. Dillig. Synthesizing data structure transformations from input-output examples. In
Proceedings of the 36th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI), 2015.
[12] S. Fischer, Z. Hu, and H. Pacheco. The essence of bidirectional programming. SCIENCE CHINA Information Sciences,
58(5):1–21, 2015.
[13] J. N. Foster, M. B. Greenwald, J. T. Moore, B. C. Pierce, and A. Schmitt. Combinators for bidirectional tree transformations: A linguistic approach to the view-update problem. ACM Transactions on Programming Languages and Systems,
29(3):17, May 2007.
[14] J. Frankle, P.-M. Osera, D. Walker, and S. Zdancewic. Example-directed synthesis: A type-theoretic interpretation
(extended version). Technical Report MS-CIS-15-12, University of Pennsylvania, 2015.
[15] S. Gulwani. Automating string processing in spreadsheets using input-output examples. In ACM SIGPLAN Notices,
volume 46. ACM, 2011.
[16] S. Gulwani. Automating string processing in spreadsheets using input-output examples. In Proceedings of the 38th
Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL ’11. ACM, 2011.
[17] T. Gvero, V. Kuncak, I. Kuraj, and R. Piskac. Complete completion using types and weights. In Proceedings of the 2013
ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI), 2013.
[18] B. Harry. A new api for visual studio online, 2014.
[19] S. Hidaka, Z. Hu, K. Inaba, H. Kato, K. Matsuda, and K. Nakano. Bidirectionalizing graph transformations. In Proceeding of the 15th ACM SIGPLAN international conference on Functional programming, ICFP 2010, Baltimore, Maryland,
USA, September 27-29, 2010, pages 205–216, 2010.
[20] S. Hidaka, Z. Hu, K. Inaba, H. Kato, and K. Nakano. Groundtram: An integrated framework for developing wellbehaved bidirectional model transformations. In Automated Software Engineering (ASE), 2011.
[21] H. Ko, T. Zan, and Z. Hu. BiGUL: A formally veriﬁed core language for putback-based bidirectional programming.
In Proceedings of the 2016 ACM SIGPLAN Workshop on Partial Evaluation and Program Manipulation, PEPM 2016, St.
Petersburg, FL, USA, January 20 - 22, 2016, pages 61–72, 2016.
[22] D. Kozen. A completeness theorem for kleene algebras and the algebra of regular events. Information and Computation,
110(2), 1994. ISSN 0890-5401. URL http://www.sciencedirect.com/science/article/pii/S0890540184710376.
[23] D. Krob. Complete systems of b-rational identities. Theor. Comput. Sci., 89(2), Oct. 1991. ISSN 0304-3975. URL
http://dx.OMITdoi.org/10.1016/0304-3975(91)90395-I.
[24] V. Le and S. Gulwani. FlashExtract: A framework for data extraction by examples. In Proceedings of the 35th ACM
SIGPLAN Conference on Programming Language Design and Implementation, PLDI ’14. ACM, 2014.
[25] D. Liu, Z. Hu, and M. Takeichi. Bidirectional interpretation of XQuery. In Proceedings of the 2007 ACM SIGPLAN
Workshop on Partial Evaluation and Semantics-based Program Manipulation, 2007, Nice, France, January 15-16, 2007,
pages 21–30, 2007.
[26] D. Lutterkort. Augeas: A Linux conﬁguration API, Feb. 2007. Available from http://augeas.net/.
[27] N. Macedo, H. Pacheco, N. R. Sousa, and A. Cunha. Bidirectional spreadsheet formulas. In IEEE Symposium on Visual
Languages and Human-Centric Computing, VL/HCC 2014, Melbourne, VIC, Australia, July 28 - August 1, 2014, pages
161–168, 2014.
[28] Requirements and compatibility — Team Foundation Server Setup, Update and Administration. Microsoft Corporation,
2017.
[29] P.-M. Osera and S. Zdancewic. Type-and-example-directed program synthesis. In Proceedings of the 36th ACM SIGPLAN Conference on Programming Language Design and Implementation. ACM, 2015.
[30] H. Pacheco, T. Zan, and Z. Hu. Biﬂux: A bidirectional functional update language for XML. In Proceedings of the 16th
International Symposium on Principles and Practice of Declarative Programming, Kent, Canterbury, United Kingdom,
September 8-10, 2014, pages 147–158, 2014.
[31] D. Perelman, S. Gulwani, D. Grossman, and P. Provost. Test-driven synthesis. In Proceedings of the 35th ACM SIGPLAN
Conference on Programming Language Design and Implementation, PLDI ’14, 2014.
[32] N. Polikarpova, I. Kuraj, and A. Solar-Lezama. Program synthesis from polymorphic reﬁnement types. In Proceedings
of the 37th ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI ’16. ACM, 2016.
URL http://doi.acm.org/10.1145/2908080.2908093.
[33] A. Salomaa. Two complete axiom systems for the algebra of regular events. J. ACM, 13(1), Jan. 1966. ISSN 0004-5411.
URL http://doi.acm.org/10.1145/321312.321326.

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:28

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

[34] G. Scherer and D. Rèmy. Which simple types have a unique inhabitant? In Proceedings of the 18th ACM SIGPLAN
International Conference on Functional Programming (ICFP), 2015.
[35] R. Singh. Blinkﬁll: Semi-supervised programming by example for syntactic string transformations. Proc. VLDB
Endow., 9(10), June 2016.
[36] R. Singh and S. Gulwani. Learning semantic string transformations from examples. Proceedings of the VLDB Endowment, 5(8), 2012.
[37] A. Solar-Lezama. Program Synthesis by Sketching. PhD thesis, University of California, Berkeley, 2008.
[38] M. P. Team. Microsoft Program Synthesis using Examples SDK, 2017. URL https://microsoft.github.io/prose/.
[39] N. Yaghmazadeh, C. Klinger, I. Dillig, and S. Chaudhuri. Synthesizing transformations on hierarchically structured
data. In Proceedings of the 37th ACM SIGPLAN Conference on Programming Language Design and Implementation,
PLDI ’16. ACM, 2016.
[40] T. Zan, L. Liu, H. Ko, and Z. Hu. Brul: A putback-based bidirectional transformation library for updatable views. In
Proceedings of the 5th International Workshop on Bidirectional Transformations, Bx 2016, co-located with The European
Joint Conferences on Theory and Practice of Software, ETAPS 2016, Eindhoven, The Netherlands, April 8, 2016., pages
77–89, 2016.
[41] Z. Zhu, H. Ko, P. Martins, J. Saraiva, and Z. Hu. Biyacc: Roll your parser and reﬂective printer into one. In Proceedings
of the 4th International Workshop on Bidirectional Transformations co-located with Software Technologies: Applications
and Foundations, STAF 2015, L’Aquila, Italy, July 24, 2015., pages 43–50, 2015.

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:29

A FORMAL DEFINITIONS
Deﬁnition 3 (Unambiguous Concatenation Language). If L 1 and L 2 are languages, such that for
all strings s1 , t1 ∈ L 1 , and for all strings s2 , t2 ∈ L 2 , If s1 · s2 = t1 · t2 , then L 1 is unambiguously
concatenable with L 2 , written L 1 ·! L 2 .
Deﬁnition 4 (Conway’s Regular Expression Equivalences).
S|∅ ≡ S
+ Ident
S·∅ ≡ ∅
0 ProjR
∅·S ≡ ∅
0 ProjL
(S · S ′) · S ′′ ≡ S · (S ′ · S ′′ )
· Assoc
(S | S ′ ) | S ′′ ≡ S | (S ′ | S ′′ )
| Assoc
S|T ≡ T |S
| Comm
S · (S ′ | S ′′ ) ≡ (S · S ′ ) | (S · S ′′ )
DistR
(S ′ | S ′′ ) · S ≡ (S ′ · S) | (S ′′ · S)
DistL
ϵ ·S ≡ S
· IdentL
S ·ϵ ≡ S
· IdentR
(S | T )∗ ≡ (S ∗ · T )∗ · S ∗
Sumstar
(S · T )∗ ≡ ϵ | (S · (T · S)∗ · T )
Prodstar
(S ∗ )∗ ≡ S ∗
Starstar
(S | T )∗ ≡ ((S | T ) · T | (S · T ∗ )n · S)∗ ·
Dicyc
(ϵ | (S | T )·
((S · T ∗ )0 | . . . | (S · T ∗ )n ))
Deﬁnition 5 (Deﬁnitional Regular Expression Equivalences).
S | ∅ ≡s S
+ Ident
S · ∅ ≡s ∅
0 ProjR
∅ · S ≡s ∅
0 ProjL
(S · S ′) · S ′′ ≡s S · (S ′ · S ′′ )
· Assoc
(S | S ′ ) | S ′′ ≡s S | (S ′ | S ′′ )
| Assoc
S | T ≡s T | S
| Comm
S · (S ′ | S ′′ ) ≡s (S · S ′) | (S · S ′′ )
DistR
(S ′ | S ′′ ) · S ≡s (S ′ · S) | (S ′′ · S)
DistL
S · ϵ ≡s S
· IdentL
S · ϵ ≡s S
· IdentR
S ∗ ≡s ϵ | (S · S ∗ )
UnrollstarL
S ∗ ≡s ϵ | (S ∗ · S)
UnrollstarR
B PROOFS
The proof is split into separate subsections based on what is being done. The overall goals are to
prove soundness and completeness of DNF regular expressions with respect to regular expressions,
and soundness and completeness of DNF lenses with respect to lenses.
• Subsection B.1 deﬁnes conﬂuence with respect to a property, bisimilarity, and makes some
general proofs about those properties. These are used later for the proof of conﬂuence of
rewriting with respect to semantics, which is used in lens completeness.
• Subsection B.2 proves some general statements about languages, relating to the relationship between nonintersection of pairs of languages, and sets of languages, and the relationship between shared preﬁxes and suﬃxes of pairs of languages. These are used for proving
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:30

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

•

•
•

•
•
•

•

•

•
•
•

B.1

statements about unambiguity of DNF regular expressions from unambiguous regular expressions, and vice-versa.
Subsection B.3 proves some intuitive statements about lenses and DNF lenses. These statements are properties like inversion, closure under composition for rewriteless DNF lenses,
and proves that bijective lenses and bijective DNF lenses actually express bijections between the languages of their types.
Subsection B.4 proves soundness and completeness of DNF regular expressions to regular
expressions.
Subsection B.5 proves statements relating to the retention of unambiguity across languages.
In particular, it proves statements about ⇓ and ⇑, and also proves statements about the retention of unambiguity through rewrites.
Subsection B.6 proves statements about the retention of language through proofs, and the
equivalences of expressibility of various rewrite systems.
Subsection B.7 proves the soundness of DNF lenses to lenses, using the machinery above.
Subsection B.8 deﬁnes operators on DNF lenses, which provide combinators similar to the
combinators of normal lenses. This section also proves statements about these combinators, like how the combinators act similarly to normal lenses.
Subsection B.9 proves more complex properties about lens operators. These more complex
statements are needed because DNF regular expressions don’t have rewrites that order
clauses.
Subsection B.10 proves statements about the ability to build up rewrites on DNF regular
expressions composed of less complex ones, from the rewrites of those less complex DNF
regular expressions. It also proves the proof of conﬂuence of rewrites.
Subsection B.11 proves the completeness of dnf lenses with respect to lenses.
Subsection B.12 proves the algorithm correct.
Subsection B.13 proves some random statements we make, but don’t formally express, in
the paper.

Confluence Proofs

This section begins by deﬁning conﬂuence and bisimilarity. Next we prove that if a rewrite system
is bisimilar with respect to a property, then the transitive and reﬂexive closure of that rewrite
system is too. Next, a similar statement about transitive and reﬂexive closure of rewrite systems
for conﬂuence is proven, under the conditions that the property conﬂuence is deﬁned with respect
to is transitive. Next, propagators are deﬁned, and used in if a rewrite system is conﬂuent with
respect to a property with left and right propagators, then the transitive and reﬂexive closures of
that rewrite system is conﬂuent with respect to the same property.
Deﬁnition 6. Let → and p be two binary relations on a set S. We say that → is conﬂuent with
respect to p, written conﬂuent p (→), if, given x 1 , x 2 ∈ S, where p(x 1 , x 2 ), if x 1 → x 1′ and x 2 → x 2′ ,
then there exists x 1′′ and x 2′′ such that x 1′ → x 1′′, x 2′ → x 2′′, and p(x 1′′, x 2′′ ).
Deﬁnition 7. Let → and p be two binary relations on a set S. We say that → is bisimilar through
p, written bisimilar p (→), if, given x 1 , x 2 ∈ S, where p(x 1 , x 2 ), if x 1 → x 1′ then there exists some x 2
such that x 2 → x 2′ where p(x 1′ , x 2′ ), and if x 2 → x 2′ , then there exists some x 1′ such that x 1 → x 1′
where p(x 1′ , x 2′ ).

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:31

Deﬁnition 8. Let p be a binary relation. p∗ is the binary relation deﬁned via the inference rules
Base

Reflexivity

Transitivity

p∗ (x, y)

p(x, y)

p∗ (x, x)

p∗ (x, y)

p∗ (y, z)

p∗ (x, z)

Lemma 1 (Bisimilarity Preserved through Star left). Let bisimilar p (→). If p(x, y) and x→∗x ′ then
there exists some y ′ such that y→∗y ′ where p(x ′, y ′ )
Proof. By induction on the derivation of x→∗x ′.
Case 1 (Reflexivity).
x→∗x
Consider the derivation
y→∗y
and by assumption p(x, y).
Case 2 (Base).
x → x′
x→∗x ′
As bisimilar p (→), y → y ′ where p(x ′, y ′ ).
y → y′
y→∗y ′
Case 3 (Transitivity).
x→∗x ′′

x ′′ →∗x ′

x→∗x ′
By IH, y→∗y ′′ where p(x ′′, y ′′ ). By IH, y ′′ →∗y ′ where p(x ′, y ′ ).
y→∗y ′′

y ′′ →∗y ′

y→∗y ′

Lemma 2 (Bisimilarity Preserved through Star right). Let bisimilar p (→). If p(x, y) and x→∗x ′
then there exists some y ′ such that y→∗y ′ where p(x ′, y ′ )
Proof. Symmetrically to Lemma 1.



Lemma 3 (Bisimilarity Preserved through Star). If bisimilar p (→), then bisimilar p (→∗ ).
Proof. By application of Lemma 1 and Lemma 2.



Lemma 4. If conﬂuent p (→), bisimilar p (→), p(x, y) ∧ p(y, z) ⇒ p(x, z), and p(x, y) ⇒ p(x, x) ∧ p(y, y)
then if p(x, y), x→∗x 1 , y → x 1 , then there exists some x 2 , xy such that x 1 → x 2 , y1 →∗y2 , and
p(x 2 , y2 ).
Proof. By induction on the derivation of x→∗x 1 .
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:32

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Case 1 (Reflexivity).
x→∗x
By bisimilar p (→), there exists some x 1 such that x → x 1 and p(x 1 , y1 ). Furthermore,
y1 →∗y1
so we are done.
Case 2 (Base).
x → x1
x→∗x 1
As conﬂuent p (→), there exists x 2 , y2 such that x 1 → x 2 , y1 → y2 , and p(x 2 , y2 ). Furthermore
y1 → y2
y1 →∗y2
Case 3 (Transitivity).

x→∗x 1

x 1 →∗x 2

x 1 →∗x 2
By IH, there exists x 3 , y2 such that x 1 → x 3 , and y1 →∗y2 , and p(x 3 , y2 ).
As p(x, y), we have p(x, x). As p(x, x), and x→∗x 1 , then there exists x ′ such that p(x 1 , x ′ ), so
p(x 1 , x 1 ). So, by IH, as p(x 1, x 1 ), x 1 →∗x 2 , and x 1 → x 3 , there exists x 4 , x 5 such that x 2 → x 4 ,
x 3 →∗x 5 , and p(x 4 , x 5 ).
As p(x 3 , y2 ), and x 3 →∗x 5 , then by bisimilar p (→) and Lemma 3, there exists y3 such that y2 →∗y3 ,
and p(x 5 , y3 ). By Transitivity, y1 →∗y3 . From before, x 2 → x 4 . Because we have p(x 4 , x 5 ) and
p(x 5 , y3 ), we have p(x 4 , y3 ).

Lemma 5. If conﬂuent p (→), bisimilar p (→), and p(x, y) ∧ p(y, z) ⇒ p(x, z), and p(x, y) ⇒
p(x, x) ∧ p(y, y) then if p(x, y), x→∗x 1 , y→∗x 1 , then there exists some x 2 , xy such that x 1 →∗x 2 ,
y1 →∗y2 , and p(x 2 , y2 ).
Proof. By induction on the derivation of y→∗y1 .
Case 1 (Reflexivity).
y→∗y
By bisimilar p (→), and Lemma 3, there exists some y1 such that y→∗y1 and p(x 1 , y1 ). Furthermore,
y1 →∗y1
so we are done.
Case 2 (Base).
y → y1
y→∗y1
As conﬂuent p (→), bisimilar p (→), y → y1 , x→∗x 1 , and p∗ (x, y) if, and only if p(x, y), by Lemma 4,
there exists x 2 , y2 such that x 1 → x 2 , y1 →∗y2 , and p(x 2 , y2 ). Furthermore
x1 → x2
x 1 →∗x 2
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:33

Case 3 (Transitivity).
y→∗y1

y1 →∗y2

y→∗y2
By IH, there exists x 2 , y3 such that x 1 →∗x 2 , and y1 →∗y3 , and p(x 2 , y3 ).
As p(x, y), we have p(y, y). As p(y, y), and y→∗y1 , then there exists y ′ such that p(y1 , y ′ ), so
p(y1 , y1 ). So, by IH, as p(y1 , y1 ), y1 →∗y3 , and y1 →∗y2 , there exists y4 , y5 such that y3 →∗y4 , y2 →∗y5 ,
and p(y4 , y5 ).
As p(x 2 , y3 ), and y3 →∗y4 , then by bisimilar p (→) and Lemma 3, there exists x 3 such that x 2 →∗x 3 ,
and p(x 3 , y4 ). By Transitivity, x 1 →∗x 3 . From before, y2 → y5 . As we have p(x 3 , y4 ) and p(y4 , y5 ),
we have p(x 3 , y5 ).

Deﬁnition 9. A property q is a left propagator for p with respect to → if bisimilar q (→), conﬂuent q (→
), q(x, y) ∧ q(y, z) ⇒ q(x, z), q(x, y) ⇒ q(x, x) ∧ q(y, y)), p(x, y) ⇒ q(x, x), and q(x, y) ∧ p(y, z) ⇒
p(x, z).
Deﬁnition 10. A property q is a right propagator for p with respect to → if bisimilar p (→),
conﬂuent p (→), q(x, y) ∧ q(y, z) ⇒ q(x, z), q(x, y) ⇒ q(x, x) ∧ q(y, y)), p(x, y) ⇒ q(y, y), and
p(x, y) ∧ q(y, z) ⇒ p(x, z).
Lemma 6. Let conﬂuent p (→). Let bisimilar p (→). Let qL be a left propagator for p with respect to
→. If p(x 1 , x 2 ), x 1 →∗x 1′ , x 2 → x 2′ , then there exists some x 1′′ , x 2′′ such that x 1′ → x 1′′ , x 2′ →∗x 2′′, and
p(x 1′′, x 2′′ ).
Proof. By induction on the derivation of x 1 →∗x 1′ .
Case 1 (Reflexivity).
x 1 →∗x 1
By bisimilar p (→), there exists some x 1′ such that x 1 → x 1′ and p(x 1′ , x 2′ ). Furthermore,
x 2′ →∗x 2′
so we are done.
Case 2 (Base).
x 1 → x 1′
x 1 →∗x 1′
As conﬂuent p (→), there exists x 2 , y2 such that x 1 → x 2 , y1 → y2 , and p(x 2 , y2 ). Furthermore
y1 → y2
y1 →∗y2
Case 3 (Transitivity).
x→∗x 1

x 1 →∗x 2

x 1 →∗x 2
By IH, there exists x 3 , y2 such that x 1 → x 3 , and y1 →∗y2 , and p(x 3 , y2 ).
As qL ∗ (a, b) if, and only if qL (a, b), qL (x 1 , x 1 ).
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:34

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

As p(x, y), we have qL (x, x). As qL (x, x) and x→∗x 1 , there exists x ′ such that x→∗x ′, and
qL (x 1 , x ′), which means that qL (x 1 , x 1 ). As qL is a propagator with respect to →, it ﬁlls the properties required for Lemma 4, So, as qL (x 1 , x 1 ), x 1 →∗x 2 , and x 1 → x 3 , there exists x 4 , x 5 such that
x 2 → x 4 , x 3 →∗x 5 , and qL (x 4 , x 5 ).
As p(x 3 , y2 ), and x 3 →∗x 5 , then by bisimilar p (→) and Lemma 3, there exists y3 such that y2 →∗y3 ,
and p(x 5 , y3 ). By Transitivity, y1 →∗y3 . From before, x 2 → x 4 . Because qL (x 4 , x 5 ) and p(x 5 , y3 ),
and qL is a left propagator, p(x 4 , y3 ).

Theorem 6 (Conﬂuence Preserved Through Star). Let conﬂuent p (→). Let bisimilar p (→). Let qL
be a left propagator for p with respect to →. Let qR be a right propagator for p with respect to
→. If p(x 1 , x 2 ), x 1 →∗x 1′ , x 2 → x 2′ , then there exists some x 1′′ , x 2′′ such that x 1′ → x 1′′ , x 2′ →∗x 2′′, and
p(x 1′′, x 2′′ ).
Proof. By induction on the derivation of y→∗y1 .
Case 1 (Reflexivity).
y→∗y
By bisimilar p (→), and Lemma 3, there exists some y1 such that y→∗y1 and p(x 1 , y1 ). Furthermore,
y1 →∗y1
so we are done.
Case 2 (Base).
y → y1
y→∗y1
As conﬂuent p (→), bisimilar p (→), y → y1 , x→∗x 1 , and p∗ (x, y) if, and only if p(x, y), by Lemma 6,
there exists x 2 , y2 such that x 1 → x 2 , y1 →∗y2 , and p(x 2 , y2 ). Furthermore
x1 → x2
x 1 →∗x 2
Case 3 (Transitivity).
y→∗y1

y1 →∗y2
∗

y→ y2
→∗x

∗
By IH, there exists x 2 , y3 such that x 1
2 , and y1 → y3 , and p(x 2 , y3 ).
∗
As p(x, y), we have qR (y, y). As qR (x, x) and y→ y1 , there exists y ′ such that y→∗y ′ , and
qR (y1 , y ′ ), which means that qR (y1 , y1 ). As qL is a propagator with respect to →, it ﬁlls the properties required for Lemma 5, So, as qR (y1 , y1 ), y1 →∗y3 , and y1 →∗y2 , there exists y4 , y5 such that
y3 →∗y4 , y2 →∗y5 , and qR (y4 , y5 ).
As p(x 2 , y3 ), and y3 →∗y4 , then by bisimilar p (→) and Lemma 3, there exists x 3 such that x 2 →∗x 3 ,
and p(x 3 , y4 ). By Transitivity, x 1 →∗x 3 . From before, y2 → y5 . Because p(x 3 , y4 ) and qR (y4 , y5 ),
and qR is a right propagator, p(x 3 , y5 ).


, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:35

Deﬁnition 11. Let p be a binary relation. ≡p is the binary relation deﬁned via the inference rules
Base

p(x, y)
≡p (x, y)

Reflexivity

≡p (x, x)

Transitivity

≡p (x, y)

Symmetry

≡p (y, z)

≡p (x, z)

p(x, y)
≡p (y, x)

B.2 Language Proofs
These proofs prove similar things to unambiguity, but on general languages.
′ be nonempty languages. If ·! (L ; . . . ; L ), ·! (L ′ ; . . . ; L ′ ), and
Lemma 7. Let L 1 , . . . , Ln , L ′1 , . . . , Lm
1
n
m
1
{s1 · . . . · sn | si ∈ Li } ·! {s1 · . . . · sm | si ∈ Li′ }, then ·! (L 1 ; . . . ; Ln ; L ′1 ; . . . ; Ln′ )
′ ), and {s · . . . ; s | s ∈ L } ·! {s · . . . · s | s ∈ L ′ }
Proof. Let ·! (L 1 ; . . . ; Ln ), ·! (L ′1 ; . . . ; Lm
1
n
i
i
1
m
i
i
′ ′
′
′
′
Let si , ti ∈ Li , si , ti ∈ Li . Let s1 · . . . · sn · s1′ · . . . · sm
= t1 · . . . · tn · t1′ · . . . · tm
. Because
′ = t ′ ·. . .·t ′ .
{s1 ·. . . ; sn | si ∈ Li }·! {s1 ·. . .·sm | si ∈ Li′ }, we know s1 ·. . .·sn = t1 ·. . .·tn and s1′ ·. . .·sm
m
1
!
!
′
′
′
′
!
′
Because · (L 1 ; . . . ; Ln ), si = ti . Because · (L 1 ; . . . ; Ln ), si = ti . So · (L 1 ; . . . ; Ln ; L 1 ; . . . ; Ln′ )

′ be nonempty languages. ·! (L ; . . . ; L ), ·! (L ′ ; . . . ; L ′ ), and
Lemma 8. Let L 1 , . . . , Ln , L ′1 , . . . , Lm
1
n
m
1
!
{s1 · . . . · sn | si ∈ Li } · {s1 · . . . · sm | si ∈ Li′ } if, and only if ·! (L 1 ; . . . ; Ln ; L ′1 ; . . . ; Ln′ )

Proof.
Case 1 (⇒). By Lemma 7.
Case 2 (⇐). Let s, t ∈ {s1 · . . . · sn | si ∈ Li }. Let s ′ , t ′ ∈ {s1 · . . . · sm | si ∈ Li′ }. Let s · s ′ = t · t ′ .
′ where s ′ ∈ L ′ , and
s = s1 · . . . · sn where si ∈ Li , t = t1 · . . . · tn where ti ∈ Li , s ′ = s1′ · . . . · sm
i
i
′
′
′
′
′
′
′
′
′
′ .
t = t1 · . . . · tm where ti ∈ Li . s · s = s1 · . . . · sn · s1 · . . . · sm and t · t = s1 · . . . · sn · s1′ · . . . · sm
′
′
′
′
By assumption si = ti and si = ti . This means s = t and s = t .
Let si , ti ∈ Li , and let s1 · . . . ·sn = t1 · . . . ·tn . Consider some strings si′ ∈ Li′ . s1 · . . . ·sn ·s1′ · . . . ·sn′ =
t1 · . . . · tn · s1′ · . . . · sn′ .
By assumption, si = ti , as desired.

′ be languages. Let L
′
Lemma 9. Let L 1 , . . . , Ln , L ′1 , . . . , Lm
i ,j = {s · t | s ∈ L i ∧ t ∈ L j }. Let
Ð
Ð
′
′
′
A = i ∈[1,n] Li , {}. Let B = i ∈[1,m] Li , {}. i , j ⇒ Li ∩ L j = {} i , j ⇒ Li ∩ L j = {} and A ·! B
if, and only if (i 1 , j 1 ) , (i 2 , j 2 ) ⇒ Li′′1 ,j1 ∩ Li′′2 ,j2 = {} and for all i ∈ [1, n], j ∈ [1, m], we have Li ·! L ′j .

Proof.
Case 1 (⇒). Let i , j ⇒ Li , L j i , j ⇒ Li′ , L ′j and A ·! B
We shall prove (i 1 , j 1 ) , (i 2 , j 2 ) ⇒ Li′′1 ,j1 ∩ Li′′2 ,j2 = {} by contrapositive. Let s ∈ Li′′1 ,j1 ∩ Li′′2 ,j2 . This
means that s = si 1 · sj1 for some si 1 ∈ Li 1 and some sj1 ∈ L j1 , and that s = si 2 · sj2 for some si 2 ∈ Li 2
and some sj2 ∈ L j2 .
Because A ·! B si 1 = si 2 and sj1 = sj2 . Because each of A and B are pairwise disjoint, this means
i 1 = i 2 and j 1 = j 2 .
Let si , ti ∈ Li . Let sj , tj ∈ L ′j . Let si · sj = ti · tj By deﬁnition, si , ti ∈ A and sj , tj ∈ B. By
assumption, A ·! B, so si = ti and sj = tj .
Case 2 (⇐). Let (i 1 , j 1 ) , (i 2 , j 2 ) ⇒ Li′′1 ,j1 ∩ Li′′2 ,j2 = {} and for all i ∈ [1, n], j ∈ [1, m], we have
Li ·! L ′j .
We prove i , j ⇒ Li ∩ L j = {} by contrapositive. Let Li ∩ L j , {}. Let s ∈ Li ∩ L j Let t ∈ B.
t ∈ Lk′ for some k ∈ [1, m]. s · t ∈ Li′′,k and s · t ∈ L ′′j,k . By assumption (i, k) = (j, k), so i = j.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:36

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

We prove i , j ⇒ Li′ ∩ L ′j = {} in the same way.
Let s1 , s2 ∈ A, t1 , t2 ∈ B, and s1 · t1 = s2 · t2 . s1 ∈ Li for some i, and s2 ∈ L j for some j, t1 ∈ Lk′
for some k, and t2 ∈ Ll′ for some l. This means s1 · t1 ∈ Li′′,k , s2 · t2 ∈ L ′′j,l . Because s1 · t1 = s2 · t2 ,
(i, k) = (j, l). So as s1 ∈ Li , s2 ∈ Li , t1 ∈ Lk , t2 ∈ Lk′ , and Li ·! Lk′ , s1 = s2 and t2 = t2 .

′ }, C = {L ′′ , . . . , L ′′
Lemma 10. Let A = {L 1 , . . . , Ln }, B = {L ′1 , . . . , Lm
n+m }, be sets of languages
1
Ð
Ð
′
Such that A∪B = C. ( i ∈[1,n] Li ) ∩( i ∈[1,m] Li ) = ∅, for all i, j ∈ [1, n], i , j ⇒ Lanдuaдei ∩L j = ∅,
and for all i, j ∈ [1, m], i , j ⇒ Li′ ∩L ′j = ∅ if, and only if for all i, j ∈ [1, n +m], i , j ⇒ Li′′ ∩L ′′j = ∅.

Proof.
Case 1 (⇒). Let Li′′ , L ′′j ∈ C, where i , j. If Li′′ ∈ A and L ′′j ∈ A, then, by pigeonhole principle,
there exists an i ′, j ′ where i ′ , j ′ such that Li′′ = Li ′ and L ′′j = L j ′ . By assumption, Li ′ ∩ L j ′ = {},
so |Lanдuaдei′′ ∩ L ′′j = {}.
Similarly for if Li′′ ∈ B and L ′′j ∈ B.
Ð
Ð
If Li′′ ∈ A, and L ′′j ∈ B. ( i ∈[1,n] Li ) ∩ ( i ∈[1,m] Li′ ) = ∅. By application of distributivity
Ð
′′
′′
′
(k,l )∈[1,n]×[1,m] L k ∩ L l = {}. This means that for all (k, l) ∈ [1, n] × [1, m], L k ∩ L l = {}. In
particular, Li′′ ∩ L ′′j = {}.
Case 2 (⇐). Let i, j ∈ [1, n] and i , j. By pigeonhole principle, there exists some i ′, j ′ where i ′ , j ′
such that Li = Li′′′ and L j = L ′′j ′ . By assumption, Li′′′ ∩ L ′′j ′ = {}, so Li ∩ L j = {}.
Similarly for i, j ∈ [1, m].
Ð
Ð
Assume there exists some s ∈ ( i ∈[1,n] Li ) ∩ ( i ∈[1,m] Li′ ). Then s ∈ Li for some i ∈ [1, n],
and s ∈ L ′j for some j ∈ [1, m]. There exists some i ′, j ′ where i ′ , j ′ in [1, n + m] such that
Li = Li′′′ and L j = L ′′j ′ . But, by assumption, Li′′′ ∩ L ′′j ′ , so we have a contraction. So there is no
Ð
Ð
Ð
Ð
s ∈ ( i ∈[1,n] Li ) ∩ ( i ∈[1,m] Li′ ), so ( i ∈[1,n] Li ) ∩ ( i ∈[1,m] Li′ ) = {}.


B.3 Lens and DNF Basic Property Proofs
There are many intuitive facts about DNF lenses. For example, without rewrites, they are closed
under composition. Furthermore, we can express the identity transformation on DNF lenses. Welltyped DNF lenses and normal lenses express bijections between their types. These properties are
proven in this section, and used throughout the paper.
Lemma 11 (DNF Lens Inversion).
(1) If dl : DS ⇔ DT , then there exists some DS ′ , DT ′ such that dl :̃ DS ′ ⇔ DT ′ , DS→∗ DS ′ ,
and DT →∗ DT ′ .
(2) If dl :̃ DS ⇔ DT , then there exists some n ∈ N, SQ 1 , . . . , SQn , TQ 1 , . . . TQn , σ ∈ Sn , and
sql 1 ; . . . ; sql n such that for all i ∈ [1, n], sql i :̃ SQi ⇔ TQ i , dl = (hsql 0 | . . . | sql n i, σ ),
DS = hSQ 1 | . . . | SQ n i, and DT = hTQ σ (1) | . . . | TQ σ (n) i.
(3) If sql :̃ SQ ⇔ TQ, there exists some n ∈ N, A1 , . . . , An , B1 , . . . , Bn , Strinд0 , . . . , sn , t0 , . . . , tn ,
σ ∈ Sn , and al 1 , . . . , al n such that for all i ∈ [1, n], al i :̃ Ai ⇔ Bi , sql = ([(s0 , t0 ) · A1 · . . . ·
An · (sn , tn )], σ ), SQ = [s0 · A1 · . . . · An · sn ], and TQ = [t0 · Aσ (1) · . . . · Aσ (n) · tn ].
(4) If al :̃ A ⇔ B, then there exists some dl, DS, DT , such that dl :̃ DS ⇔ DT , al = iterate(dl),
A = DS ∗ , and B = DT ∗ .
Proof.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:37

(1) Let dl : DS ⇔ DT . The only rule that introduces a typing of this form is Rewrite
DNF Regex Lens. Because of this, there exists some DS ′ , DT ′ such that dl :̃ DS ′ ⇔ DT ′ ,
DS→∗ DS ′ , and DT →∗ DT ′ , to build up the typing
dl :̃ DS ′ ⇔ DT ′

DS→∗ DS ′

DT →∗ DT ′

dl : DS ⇔ DT
(2) Let dl :̃ DS ⇔ DT . The only rule that introduces a typing of this form is DNF Lens. Because
of this there exists some n ∈ N, SQ 1 , . . . , SQn , TQ 1 , . . . TQ n , σ ∈ Sn , and sql 1 | . . . | sql n
such that for all i ∈ [1, n], sql i :̃ SQ i ⇔ TQi , dl = (hSQ 0 | . . . | SQ n i, σ ), DS = hSQ 1 | . . . | SQ n i,
DT = hTQ σ (1) | . . . | TQ σ (n) i, i , j ⇒ SQ i ∩ SQ j = ∅, and i , j ⇒ TQ i ∩ TQ j = ∅, to build
up the typing
sql i :̃ SQi ⇔ TQi

i , j ⇒ SQi ∩ SQ j = ∅

i , j ⇒ TQ i ∩ TQ j = ∅

dl :̃ DS ⇔ DT
(3) Let sql :̃ SQ ⇔ TQ. The only rule that introduces a typing of this form is Seqence Lens.
Because of this there exists some n ∈ N, A1 , . . . , An , B1 , . . . , Bn , Strinд0 , . . . , sn , t0 , . . . , tn ,
σ ∈ Sn , and al 1 , . . . , al n such that for all i ∈ [1, n], al i :̃ Ai ⇔ Bi , sql = ([(s0 , t0 ) · al 1 · . . . ·
al n · (sn , tn )], σ ), SQ = [s0 · A1 · . . . · An · sn ], and TQ = [t0 · Aσ (1) · . . . · Aσ (n) · tn ] to build up
the typing
al i :̃ Ai ⇔ Bi

·! (s0 ; A1 ; . . . ; An ; sn )

·! (t0 ; Bσ (1) ; . . . ; Bσ (n) ; tn )

([(s0 , t0 ) · al 1 · . . . · al n · (sn , tn )], σ ) :̃ [s0 · A1 · . . . · An · sn ] ⇔ [t0 · Aσ (1) · . . . · Aσ (n) · tn ]
(4) Let al :̃ A ⇔ B. The only rule that introduces a typing of this form is Atom Lens. Because
of this, there exists some dl, DS, DT , such that dl :̃ DS ⇔ DT , al = iterate(dl), A = DS ∗ ,
and B = DT ∗ to build up the typing
DN FReдex ∗!

dl :̃ DS ⇔ DT

DN FReдexAlt ∗!

iterate(dl) :̃ DS ∗ ⇔ DT ∗

Lemma 12. If l : S ⇔ T , then [[l]] is a bijection between L(S) and L(T ).
Proof. By induction on the typing derivation of the lens
Case 1 (Const).
s1 ∈ Σ∗

s2 ∈ Σ∗

const(s1 , s2 ) : s1 ⇔ s2
L(s1 ) = {s1 }.
L(s2 ) = {s2 }.
SemanticsO f const(s1 , s2 ) = {(s1 , s2 )}.
Case 2 (Identity).
S is strongly unambiguous
id S : S ⇔ S
L(S) = L(S)
The identity relation on L(S) is a bijection.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:38

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Case 3 (Iterate).
l:S⇔T

S ∗!

T ∗!

iterate(l) : S ∗ ⇔ T ∗
Let s1 , s2 in L(S ∗ ), and (s1 , t) ∈ [[iterate(l)]], and (s2 , t) ∈ [[iterate(l)]].
′ , and
So s1 = s1,1 · . . . · s1,n , t = t1 · . . . tn , and (s1,i , ti ) ∈ [[l]]. So s2 = s2,1 · . . . · s2,m , t = t1′ · . . . tm
′
∗!
′
(s2,i , ti ) ∈ [[l]]. By T , this means that m = n, and ti = ti . So (s1,i , ti ), and (s2,i , ti ) are both in [[l]].
As l is a bijection, by IH, s1,i = s2,i , so s1 = s2 .
Similarly for t1 , t2 in L(T ∗ ).
Let s ∈ L(S ∗). s = s1 · . . . · sn , where si ∈ L(S). By IH, as l is a bijection, there exists ti ∈ L(S)
such that (si , ti ) ∈ [[l]]. So (s, t1 · . . . · tn ) ∈ [[iterate(l)]], and t1 · . . . · tn ∈ L(T ∗ ).
Similarly for t ∈ L(T ∗ ).
Case 4 (ConcatLensType).
l1 : S1 ⇔ T1
l2 : S2 ⇔ T2
S1 · ! S2
T1 ·! T2
concat(l1 , l2 ) : S1 S2 ⇔ T1 T2
Let s1 , s2 in L(S1 · S2 ), and (s1 , t) ∈ [[concat(l1 , l2 )]], and (s2 , t) ∈ [[concat(l1 , l2 )]].
So s1 = s1,1 · s1,2 , t = t1 t2 , and (s1,i , ti ) ∈ [[li ]]. So s2 = s2,1 · s2,2 , t = t1′ · t2′ , and (s2,i , ti′ ) ∈ [[li ]]. By
T1 ·! T2 , ti = ti′ . So (s1,i , ti ), and (s2,i , ti ) are both in [[li ]]. As li is a bijection, by IH, s1,i = s2,i , so
s1 = s2 .
Similarly for t1 , t2 in L(T1 · T2 ).
Let s ∈ L(S1 · S2 ). s = s1 · s2 , where si ∈ L(Si ). By IH, as li is a bijection, there exists ti ∈ L(DT)
such that (si , ti ) ∈ [[li ]]. So (s, t1 · t2 ) ∈ [[concat(l1 , l2 )]].
Similarly for t ∈ L(T1 · T2 ).
Case 5 (Swap).
l1 : S1 ⇔ T1
l2 : S2 ⇔ T2
S1 · ! S2
T2 ·! T1
swap(l1 , l2 ) : S1 S2 ⇔ T2 T1
Let s1 , s2 in L(S1 · S2 ), and (s1 , t) ∈ [[swap(l1 , l2 )]], and (s2 , t) ∈ [[swap(l1 , l2 )]].
So s1 = s1,1 · s1,2 , t = t2 t1 , and (s1,i , ti ) ∈ [[li ]]. So s2 = s2,1 · s2,2 , t = t2′ · t1′ , and (s2,i , ti′ ) ∈ [[li ]]. By
T2 ·! T1 , ti = ti′ . So (s1,i , ti ), and (s2,i , ti ) are both in [[li ]]. As li is a bijection, by IH, s1,i = s2,i , so
s1 = s2 .
Similarly for t1 , t2 in L(T2 · T1 ).
Let s ∈ L(S1 · S2 ). s = s1 · s2 , where si ∈ L(Si ). By IH, as li is a bijection, there exists ti ∈ L(Ti )
such that (si , ti ) ∈ [[li ]]. So (s, t2 · t1 ) ∈ [[swap(l1 , l2 )]], and t2 · t1 ∈ L(S2 · S1 ).
Similarly for t ∈ L(T2 · T1 ).
Case 6 (Or).
l1 : S1 ⇔ T1
L(S1 ) ∩ L(S2 ) = ∅

l2 : S2 ⇔ T2
L(T1 ) ∩ L(T2 ) = ∅

or(l1 , l2 ) : S1 | S2 ⇔ T1 | T2
Let s1 , s2 in L(S1 | S2 ), and (s1 , t) ∈ [[or(l1 , l2 )]], and (s2 , t) ∈ [[or(l1 , l2 )]].
So (s1 , t) ∈ [[l1 ]] or (s1 , t) ∈ [[l2 ]]. So (s2 , t) ∈ [[l1 ]] or (s2 , t) ∈ [[l2 ]].
As L(T1 ) ∩ L(T2 ) = ∅, ti is in only one of L(T1 ) or L(T2 ).
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:39

Let ti ∈ L(T1 ). This means that (s1 , t) ∈ [[l1 ]] and (s2 , t) ∈ [[l1 ]]. As l1 is a bijection, by IH, s1 = s2 .
Similarly if t ∈ L(T2 ).
Similarly for t1 , t2 in L(T2 · T1 ).
Let s ∈ L(S1 | S2 ). So s is either in L(S1) or L(S2 ). If s ∈ L(S1 ), then as l1 is a bijection between
L(S1 ) and L(S2), there exists t ∈ L(ReдexAlt 1 ) such that (s, t) ∈ [[l1 ]], so (s, t) ∈ [[or(l1 , l2 )]], and
t ∈ L(T1 | T2 ). Similarly if s ∈ L(S2 ).
Similarly for t ∈ L(T2 · T1 ).
Case 7 (Compose).
l1 : S1 ⇔ S2

l2 : S2 ⇔ S3

l1 ; l2 : S1 ⇔ S3
By IH, [[l1 ]] is a bijection between L(S1 ) and L(S2 ). By IH, [[l2 ]] is a bijection between L(S2 ) and
L(S3 ). From math, this means that their composition is also a bijection.

Lemma 13.
• If dl :̃ DS ⇔ DT , then [[dl]] is a bijection between L(DS) and L(DT).
• If sql :̃ SQ ⇔ TQ, then [[sql]] is a bijection between L(SQ) and L(TQ).
• If al :̃ A ⇔ B, then [[al]] is a bijection between L(A) and L(B).
Proof. By mutual induction on the typing derivations of DNF lenses, sequence lenses, and atom
lenses.
Case 1 (Iterate).
dl :̃ DS ⇔ DT

DS ∗!

DT ∗!

iterate(dl) :̃ DS ∗ ⇔ DT ∗
Let s1 , s2 in L(DS∗ ), and (s1 , t) ∈ [[iterate(dl)]], and (s2 , t) ∈ [[iterate(dl)]].
′ ,
So s1 = s1,1 · . . . · s1,n , t = t1 · . . . tn , and (s1,i , ti ) ∈ [[dl]]. So s2 = s2,1 · . . . · s2,m , t = t1′ · . . . tm
′
∗!
′
and (s2,i , ti ) ∈ [[dl]]. By DT , this means that m = n, and ti = ti . So (s1,i , ti ), and (s2,i , ti ) are both
in [[dl]]. As dl is a bijection, by IH, s1,i = s2,i , so s1 = s2 .
Similarly for t1 , t2 in L(DT ∗ ).
Let s ∈ L(DS∗ ). s = s1 · . . . · sn , where si ∈ L(DS). By IH, as dl is a bijection, there exists
ti ∈ L(DT) such that (si , ti ) ∈ [[dl]]. So (s, t1 · . . . · tn ) ∈ [[iterate(dl)]], and t1 · . . . · tn ∈ L(DT).
Similarly for t ∈ L(DT ∗ ).
Case 2 (SequenceLens).
...

al n :̃ An ⇔ Bn

σ ∈ Sn

([(s0 , t0 ) · al 1 · . . . · al n · (sn , tn )], σ ) :̃

al 1 :̃ A1 ⇔ B1
·! [s0 · A1 · . . . · An · sn ]

·! [t0 · Bσ (1) · . . . · Bσ (n) · tn ]

[s0 · A1 · . . . · An · sn ] ⇔ [t0 · Bσ (1) · . . . · Bσ (n) · tn ]

Let s1 , s2 in L([s0 · A1 · . . . · An · sn ]), and (s1 , t) ∈ [[([(s0 , t0 ) · al 1 · . . . · al n · (sn , tn )], σ )]], and
(s2 , t) ∈ [[([(s0 , t0 ) · al 1 · . . . · al n · (sn , tn )], σ )]].
So s1 = s0 ·s1,1 ·. . .·s1,n ·sn , t = t0 ·t1,σ (i ) ·. . . t1,σ (n) ·tn , and (s1,i , t1,i ) ∈ [[ali ]]. So s2 = s0 ·s2,1 ·. . .·s2,n ·sn ,
t = t0 · t2,σ (1) · . . . · t2,n · tσ (n) , and (s2,i , t2,i ) ∈ [[dl]]. By ·! [t0 · Bσ (1) · . . . · Bσ (n) · tn ], this means that
t1,i = t2,i . So (s1,i , t1,i ), and (s2,i , t1,i ) are both in [[al i ]]. As al is a bijection, by IH, s1,i = s2,i , so
s1 = s2 .
Similarly for t1 , t2 in L(DT ∗ ).
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:40

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Let s ∈ L([s0 · A1 · . . . · An · sn ]). s = s0 · s1′ . . . · sn′ · sn , where si′ ∈ L(Ai ). By IH, as SQ i is a
bijection, there exists ti′ ∈ L(Bi ) such that (si′ , ti′ ) ∈ [[al]]. So (s, t0 · tσ′ (1) · . . . · tσ′ (n) · tn ) ∈ [[sql]], and
t0 · tσ′ (1) · . . . · tσ′ (n) · tn ∈ L([t0 · Bσ (1) · . . . · Bσ (n) · tn ])
Similarly for t ∈ L(DT ∗ ).
Case 3 (DNFLens).
σ ∈ Sn

sql 1 :̃ SQ 1 ⇔ TQ 1
...
i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅

(hsql 1 | . . . | sql n i, σ ) :̃

sql n :̃ SQ n ⇔ TQ n
i , j ⇒ L(TQi ) ∩ L(TQ j ) = ∅

hSQ 1 | . . . | SQn i ⇔ hTQ σ (1) | . . . | TQ σ (n) i

Let s1 , s2 in L(hSQ 1 | . . . | SQ n i), and (s1 , t) ∈ [[(hsql 1 | . . . | sql n i, σ )]],
and (s2 , t) ∈ [[(hsql 1 | . . . | sql n i, σ )]].
So ∃i.s1 ∈ L(SQi ), t ∈ L(TQσ (i ) ), and (s1 , t) ∈ [[sqli ]]. So ∃j.s2 ∈ L(SQ j ), t ∈ L(TQσ (j) ), and
(s1 , t) ∈ [[sql j ]]. As i , j ⇒ L(TQi ) ∩ L(TQ j ) = ∅, i = j. So s1 ∈ L(SQi ), s2 ∈ L(SQi ). As, by IH,
sql i is a bijection, s1 = s2 .
Similarly for t1 , t2 in L(DT ∗ ).
Let s ∈ L(hSQ 1 | . . . | SQn i). So there exists an i such that s ∈ L(SQi ). By IH, as SQ i is a
bijection, there exists t ∈ L(TQi ) such that (s, t) ∈ [[SQi ]]. So (s, t) ∈ [[(hsql 1 | . . . | sql n i, σ )]], and
t ∈ L(hTQ σ (1) | . . . | TQ σ (n) i).
Similarly for t ∈ L(DT ∗ ).

Lemma 14 (Closure of Rewriteless Regular Expressions under Composition).
(1) If there are two atom lenses al 1 :̃ A1 ⇔ A2 and al 2 :̃ A2 ⇔ A3 , then there exists an atom
lens al :̃ A1 ⇔ A3 , such that [[al]] = {(s1 , s3 ) | ∃s2 (s1 , s2 ) ∈ [[al 1 ]] ∧ (s2 , s3 ) ∈ [[al 2 ]]}
(2) If there are two sequence lenses sql 1 :̃ SQ 1 ⇔ SQ 2 and sql 2 :̃ SQ 2 ⇔ SQ 3 , then there exists
an sequence lens sql :̃ SQ 1 ⇔ SQ 3 , such that [[sql]] = {(s1 , s3 ) | ∃s2 (s1 , s2 ) ∈ [[sql 1 ]] ∧ (s2 , s3 ) ∈
[[sql 2 ]]}
(3) If there are two DNF lenses dl 1 :̃ DS 1 ⇔ DS 2 and dl 2 :̃ DS 2 ⇔ DS 3 , then there exists a
DNF lens dl :̃ DS 1 ⇔ DS 3 , such that [[dl]] = {(s1 , s3 ) | ∃s2 (s1 , s2 ) ∈ [[dl 1 ]] ∧ (s2 , s3 ) ∈ [[dl 2 ]]}
Proof. By mutual induction
Case 1 (Atom Lenses). Let DS 1 ∗ , DS 2 ∗ , DS 3 ∗ be three atoms, and iterate(dl 1 ) :̃ DS 1 ∗ ⇔ DS 2 ∗ with
iterate(dl 2 ) :̃ DS 2 ∗ ⇔ DS 3 ∗ lenses between them. By induction assumption, there exists the typing
of a lens
dl :̃ DS 1 ⇔ DS 3
such that [[dl]] = {(s1 , s3 ) | ∃s2 (s1 , s2 ) ∈ [[dl 1 ]] ∧ (s2 , s3 ) ∈ [[dl 2 ]]}
∗!
∗!
iterate(dl 1 ) and iterate(dl 2 ) came from Atom Lens, so DS ∗!
1 , DS 2 , and DS 3 .
Consider the lens
dl :̃ DS 1 ⇔ DS 3

DS ∗!
1

iterate(dl) :̃ DS 1 ∗ ⇔ DS 3 ∗
This lens has the semantics
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

DS ∗!
2

Synthesizing Bijective Lenses

1:41

[[iterate(dl)]]= {(s1,1 · . . . · s1,n , s3,1 · . . . · s3,n ) | (s1,i , s3,i ) ∈ [[dl]]}
= {(s1,1 · . . . · s1,n , s3,1 · . . . · s3,n ) | ∃s2,i (s1,i , s2,i ) ∈ [[dl1 ]] ∧ (s2,i , s3,i ) ∈ [[dl 2 ]]}
= {(s1,1 · . . . · s1,n , s3,1 · . . . · s3,n )
| ∃s2,1 · . . . · s2,n
(s1,1 · . . . · s1,n , s2,1 · . . . · s2,n ) ∈ [[iterate(dl)]]
∧ (s2,1 · . . . · s2,n , s3,1 · . . . · s3,n ) ∈ [[iterate(dl)]]}
= {(s1 , s3 ) | ∃s2 (s1 , s2 ) ∈ [[iterate(dl 1 )]] ∧ (s2 , s3 ) ∈ [[iterate(dl 2 )]]}
Case 2 (Sequence Lenses). Let [s1,0 · A1,1 · . . . · A1,n · s1,n ] and [s2,0 · A2,σ1 (1) · . . . · A2,σ1 (n) · s2,n ] and
[s3,0 · A3,σ2 ◦σ1 (1) · . . . · A3,σ2 ◦σ1 (n) · s3,n ] be sequences, with ([(s1,0 , s2,0 ) · al 1,1 · . . . · al 1,n · (s1,n , s2,n )], σ1 )
and ([(s2,0 , s3,0 ) · al 2,1 · . . . · al 2,n · (s2,n , s3,n )], σ2 ) be lenses between them. By induction assumption,
there is a typing of lenses
al i :̃ A1,i ⇔ A3,i
such that [[al i ]] = {(s1 , s3 ) | ∃s2 (s1 , s2 ) ∈ [[al 1,i ]] ∧ (s2 , s3 ) ∈ [[A2,i ]]} Deﬁne σ = σ2 ◦ σ1 .
([(s1,0 , s2,0 ) · al 1,1 · . . . · al 1,n · (s1,n , s2,n )], σ1 ) and ([(s2,0 , s3,0 ) · al 2,1 · . . . · al 2,n · (s2,n , s3,n )], σ2 ) came
from Seqence Lens, so ·! ([s1,0 · A1,1 · . . . · A1,n · s1,n ]) and ·! ([s3,0 · Aσ (3),1 · . . . · Aσ (3),n · s3,n ]).
Consider the typing of the lens
al 0 :̃ A1,0 ⇔ A3,0
...
·! ([s1,0 · A1,1 · . . . · A1,n · s1,n ])

σ ∈ Sn

al n :̃ A1,n ⇔ A3,n
·! ([s3,0 · Aσ (3),1 · . . . · Aσ (3),n · s3,n ])

([(s1,0 , s3,0 ) · al 1 · . . . · al n · (s1,n , s3,n )], σ ) :̃
[s1,0 · A1,1 · . . . · A1,n · s1,n ] ⇔ [s3,0 · A3,σ (1) · . . . · A3,σ (n) · s3,n ]
Furthermore, we can prove the desired property of the semantics.
[[([(s1,0 , s3,0 ) · al 1 · . . . · al n · (s1,n , s3,n )], σ )]]=
{(s1,0 · s1 · . . . · sn · s1,n , s3,0 · tσ (1) · . . . · tσ (n) · s1,n ) | (si , ti ) ∈ [[ali ]]}=
{(s1,0 · s1 · . . . · sn · s1,n , s3,0 · tσ (1) · . . . · tσ (n) · s1,n ) | ∃si′ ∈ L(A2,i ) . (si , si′ ) ∈ [[ali ]] ∧ (si′ , ti ) ∈ [[ali ]]}=
{(s1,0 · s1 · . . . · sn · s1,n , s3,0 · tσ (1) · . . . · tσ (n) · s1,n ) | ∃si′ ∈ L(A2,i )
(s1,0 · s1 · . . . · sn · s1,n , s2,0 · sσ′ 1 (1) · . . . · sσ′ 1 (n) · s2,n ) ∈ [[([(s1,0 , s2,0 )·al 1,1 ·. . .·al 1,n ·(s1,n , s2,n )], σ1 )]] ∧
(s2,0 ·sσ′ 1 (1) ·. . .·sσ′ 1 (n) ·s2,n , s3,0 ·tσ (1) ·. . .·tσ (n) ·s1,n ) ∈ [[([(s2,0 , s3,0 )·al 2,1 ·. . .·al 2,n ·(s2,n , s3,n )], σ2 )]]}=
{(s1 , s3 ) | ∃s2 ∈ L([s2,0 · A2,σ1 (1) · . . . · A2,σ1 (n) · s2,n ])
(s1 , s2 ) ∈ [[([(s1,0 , s2,0 ) · al 1,1 · . . . · al 1,n · (s1,n , s2,n )], σ1 )]] ∧
(s2 , s3 ) ∈ [[([(s2,0 , s3,0 ) · al 2,1 · . . . · al 2,n · (s2,n , s3,n )], σ2 )]]}
Case 3 (DNF Lenses). Let DS 1 = hSQ 1,1 | . . . | SQ 1,n i and DS 2 = hSQ 2,σ1 (1) | . . . | SQ 2,σ1 (n) i and
DS 3 = hSQ 3,σ2 ◦σ1 (1) | . . . | SQ 3,σ2 ◦σ1 (n) i be three DNF regular expressions.
Let dl 1 = (hsql 1,1 | . . . | sql 1,n i, σ1 ) :̃ DS 1 ⇔ DS 2 and dl 2 = (hsql 2,1 | . . . | sql 2,n i, σ2 ) :̃ DS 2 ⇔ DS 3
be lenses between them. By induction assumption, there exists a typing of lenses
sql i :̃ SQ 1,i ⇔ SQ 3,i
Deﬁne σ = σ2 ◦ σ1
Consider the lens
sql i :̃ SQ 1,i ⇔ SQ 3,i

i , j ⇒ SQ 1,i ∩ SQ 1,j = ∅

i , j ⇒ TQ 3,i ∩ TQ 3,j = ∅

(hsql 1 | . . . | sql n i, σ2 ◦ σ1 ) :̃ hSQ 1,1 | . . . | SQ 1,n i ⇔ hSQ 3,σ2 ◦σ1 (1) | . . . | SQ 3,σ2 ◦σ1 (n) i
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:42

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Furthermore, we can prove the desired property of the semantics.
[[(hsql 1 | . . . | sql n i, σ )]]=
{(s, t) | ∃i . (s, t) ∈ [[sql i ]]}=
{(s, t) | ∃i . ∃s ′ ∈ L(SQ2,i ) . (s, s ′ ) ∈ [[sql 1,i ]] ∧ (s ′ , t) ∈ [[sql 2,i ]]}=
{(s, t) | ∃s ′ ∈ L(hSQσ1 (1) | . . . | SQ σ1 (n) i) . (s, s ′ ) ∈ [[sql 1,i ]] ∧ (s ′ , t) ∈ [[sql 2,i ]]}

Lemma 15 (Expressibility of Identity on Strongly Unambiguous DNF Regex, Clauses, and Atoms).
(1) If DS is a strongly unambiguous DNF Regular expression, then there exists a DNF lens
dl :̃ DS ⇔ DS, such that [[dl]] = {(s, s) | s ∈ L(DS)}, where dl typing includes no rewrite
rules.
(2) If SQ is a strongly unambiguous sequence, then there exists a sequence lens sql :̃ SQ ⇔ SQ,
such that [[sql]] = {(s, s) | s ∈ L(DS)}, where sql typing includes no rewrite rules.
(3) If A is a strongly unambiguous atom, then there exists an atom lens al :̃ A ⇔ A, such that
[[al]] = {(s, s) | s ∈ L(DS)}, where al typing includes no rewrite rules.
Proof. By mutual induction on the structure of the DNF regular expression, atom, and clause.
Case 1 (Star). Let A = DS ∗ . As A is strongly unambiguous, DS is strongly unambiguous, and DS ∗! .
By IH, there exists dl :̃ DS ⇔ DS such that [[dl]] = {(s, s) | s ∈ L(DS)}. Consider the atom lens
dl :̃ DS ⇔ DS

DS ∗!

DS ∗!

iterate(dl) :̃ DS ∗ ⇔ DS ∗
with typing as desired.
[[iterate(dl)]] = {(s1 ·. . .·sn , t1 ·. . .·tn ) | (si , ti ) ∈ [[dl]]}. So through semantics of dl, [[iterate(dl)]] =
{(s1 · . . . · sn , s1 · . . . · sn ) | s ∈ L(DS)}, so through the deﬁnition of DS ∗ , [[iterate(dl)]] = {(s, s) | s ∈
L(DS∗ )}
Case 2 (MultiConcat). Let SQ = [s0 · A1 · . . . · An · sn ]. As SQ is strongly unambiguous, for all i, Ai
is strongly unambiguous, and ·! (s0 ; A1 ; . . . ; An ; sn ).
By IH, for all i, there exists al i :̃ Ai ⇔ Ai such that [[al i ]] = {(s, s) | s ∈ L(Ai )}.
Consider the typing
...

al n :̃ An ⇔ An

id ∈ Sn

al 1 :̃ A1 ⇔ A1
·! (s0 ; A1 ; . . . ; An ; sn )

([(s0 , s0 ) · al 1 · . . . · al n · (sn , sn )], id) :̃

·! (s0 ; A1 ; . . . ; An ; sn )

[s0 · A1 · . . . · An · sn ] ⇔ [s0 · A1 · . . . · An · sn ]

, as desired.
[[([(s0 , s0 )·al 1·. . .·aln ·(sn , sn )], id)]] = {(s0 ·t1 ·. . .·tn ·sn , s0 ·t1′ ·. . .·tn′ ·sn ) | (ti , ti′ ) ∈ [[ali ]]}. So, through
the deﬁnition of al i , [[([(s0 , s0 )·al 1 ·. . .·al n ·(sn , sn )], id)]] = {(s0 · t1 · . . . · tn · sn , s0 · t1 · . . . · tn · sn ) | ti ∈
L(Ai )}. So, through the deﬁnition of [s0 · A1 · . . . · An · sn ], [[([(s0 , s0 ) · al 1 · . . . · al n · (sn , sn )], id)]] =
{(s, s) | s ∈ L([s0 · A1 · . . . · An · sn ])}, as desired.
Case 3 (MultiOr). Let DS = hSQ 1 | . . . | SQn i. As DS is strongly unambiguous, for all i, SQi is
strongly unambiguous, and i , j ⇒ L(SQi ) ∩ L(SQ j ) = {}.
By IH, for all i, there exists al i :̃ Ai ⇔ Ai such that [[al i ]] = {(s, s) | s ∈ L(Ai )}.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:43

Consider the typing
id ∈ Sn

sql 1 :̃ SQ 1 ⇔ SQ 1
...
i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅

(hsql 1 | . . . | sql n i, id) :̃

sql 1 :̃ SQ 1 ⇔ SQ 1
i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅

hSQ 1 | . . . | SQn i ⇔ hSQ 1 | . . . | SQ n i

as desired.
[[(hsql 1 | . . . | sql n i, id)]] = {(s, t) | ∃i.(s, t) ∈ [[sql i ]]}. So, through the deﬁnition of sql i ,
[[(hsql 1 | . . . | . . . sql n i, id)]] = {(s, s) | ∃i.s ∈ L(SQi )}. So, through the deﬁnition of hSQ 1 | . . . | SQ n i,
[[(hsql 1 | . . . | sql n i, id)]] = {(s, s) | s ∈ L(hSQ1 | . . . | SQn i)}, as desired

Deﬁnition 12 (Strong Unambiguity on DNF Regular Expressions).
(1) hSQ 1 | . . . | SQn i is strongly umambiguous if SQ i is strongly unambiguous for all i, and
i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅.
(2) [s0·A1·. . .·An ·SQn ] is strongly unambiguous if Ai is strongly unambiguous, and ·! (s0 ; A1 ; . . . ; An ; sn ).
(3) DS ∗ is strongly unambiguous if DS is strongly unambiguous, and DS ∗! .
Lemma 16 (Strong Unambiguity in Lens Types). If l : S ⇔ T , then S is strongly unambiguous,
and T is strongly unambiguous.
Proof. By induction on the typing derivation of l
Case 1 (Const).
s1 ∈ Σ∗

s2 ∈ Σ∗

const(s1 , s2 ) : s1 ⇔ s2
Base strings are strongly unambiguous.
Case 2 (Concat).
l1 : S1 ⇔ T1
l2 : S2 ⇔ T2
S1 · ! S2
T1 ·! T2
concat(l1 , l2 ) : S1 S2 ⇔ T1 T2
So by IH, S1 , S2 , T1 , and T2 are all strongly unambiguous.
As S1 ·! S2 , S1 · S2 is strongly unambiguous.
As T1 ·! T2 , T1 · T2 is strongly unambiguous.
Case 3 (Iterate).
l:S⇔T

S ∗!

T ∗!

iterate(l) : S ∗ ⇔ T ∗
So, by IH, S and T are both strongly unambiguous.
As S ∗! , S ∗ is strongly unambiguous.
As T ∗! , T ∗ is strongly unambiguous.
Case 4 (Swap).
l1 : S1 ⇔ T1
l2 : S2 ⇔ T2
S1 · ! S2
T2 ·! T1
swap(l1 , l2 ) : S1 S2 ⇔ T2 T1
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:44

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

So by IH, S1 , S2 , T1 , and T2 are all strongly unambiguous.
As S1 ·! S2 , S1 · S2 is strongly unambiguous.
As T2 ·! T1 , T2 · T1 is strongly unambiguous.
Case 5 (Or).
l1 : S1 ⇔ T1
L(S1 ) ∩ L(S2 ) = ∅

l2 : S2 ⇔ T2
L(T1 ) ∩ L(T2 ) = ∅

or(l1 , l2 ) : S1 | S2 ⇔ T1 | T2
So by IH, S1 , S2 , T1 , and T2 are all strongly unambiguous.
As L(S1 ) ∩ L(S2 ) = ∅, S1 | S2 is strongly unambiguous.
As L(T2 ) ∩ L(T1 ) = ∅, T2 | T1 is strongly unambiguous.
Case 6 (Compose).
l1 : S1 ⇔ S2

l2 : S2 ⇔ S3

l1 ; l2 : S1 ⇔ S3
By IH, S1 is strongly unambiguous, and S3 is strongly unambiguous.
Case 7 (Identity).
S is strongly unambiguous
id S : S ⇔ S
By assumption, S is strongly unambiguous.

Lemma 17 (Strong Unambiguity in Rewriteless DNF Lens Types).
• If dl :̃ DS ⇔ DT , then DS is strongly unambiguous, and DT is strongly unambiguous.
• If sql :̃ SQ ⇔ TQ, then SQ is strongly unambiguous, and TQ is strongly unambiguous.
• If al :̃ A ⇔ B, then A is strongly unambiguous, and B is strongly unambiguous.
Proof. By mutual induction on the typing derivation of dl, sql, and al.
Case 1 (AtomLens).
dl :̃ DS ⇔ DT

DS ∗!

DT ∗!

iterate(dl) :̃ DS ∗ ⇔ DT ∗
By IH, DS and DT are strongly unambiguous.
As DS ∗! , DS ∗ is strongly unambiguous.
As DT ∗! , DT ∗ is strongly unambiguous.
Case 2 (SequenceLens).
...

al n :̃ An ⇔ Bn

σ ∈ Sn

al 1 :̃ A1 ⇔ B1
·! [s0 · A1 · . . . · An · sn ]

([(s0 , t0 ) · al 1 · . . . · al n · (sn , tn )], σ ) :̃

·! [t0 · Bσ (1) · . . . · Bσ (n) · tn ]

[s0 · A1 · . . . · An · sn ] ⇔ [t0 · Bσ (1) · . . . · Bσ (n) · tn ]

By IH, Ai and Bi are strongly unambiguous for all i.
As ·! [s0 · A1 · . . . · An · sn ], we have [s0 · A1 · . . . · An · sn ] is strongly unambiguous.
As ·! [t0 · Bσ (1) · . . . · Bσ (n) · tn ], we have [t0 · Bσ (1) · . . . · Bσ (n) · tn ] is strongly unambiguous.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:45

Case 3 (DNFLens).
σ ∈ Sn

sql 1 :̃ SQ 1 ⇔ TQ 1
...
i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅

(hsql 1 | . . . | sql n i, σ ) :̃

sql n :̃ SQ n ⇔ TQ n
i , j ⇒ L(TQi ) ∩ L(TQ j ) = ∅

hSQ 1 | . . . | SQn i ⇔ hTQ σ (1) | . . . | TQ σ (n) i

By IH, SQi and TQi are strongly unambiguous for all i.
As i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅, we have hSQ 1 | . . . | SQn i is strongly unambiguous.
As i , j ⇒ L(TQi ) ∩ L(TQ j ) = ∅, we have hTQ σ (1) | . . . | TQ σ (n) i is strongly unambiguous.

Lemma 18 (Closure of Rewriteless DNF Lenses Under Inversion).
(1) If dl :̃ DS ⇔ DT , then there exists a dnf lens dl −1 :̃ DT ⇔ DS such that [[DS −1 ]] =
{(t, s) | (s, t) ∈ [[dl]]}
(2) If sql :̃ SQ ⇔ TQ, then there exists a sequence lens sql −1 :̃ TQ ⇔ SQ such that [[sql −1 ]] =
{(t, s) | (s, t) ∈ [[sql]]}
(3) If al :̃ A ⇔ B, then there exists an atom lens al −1 :̃ B ⇔ A such that [[al −1 ]] = {(t, s) | (s, t) ∈
[[al]]}
Proof. By mutual induction on the typing derivation of dl, sql, and al.
Case 1 (DNF Lens).
σ ∈ Sn

sql 1 :̃ SQ 1 ⇔ TQ 1
...
i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅

sql n :̃ SQ n ⇔ TQ n
i , j ⇒ L(TQi ) ∩ L(TQ j ) = ∅

(hsql 1 | . . . | sql n i, σ ) :̃ hSQ 1 | . . . | SQn i ⇔ hTQ σ (1) | . . . | TQ σ (n) i
By IH, there exists sql i−1 :̃ TQi ⇔ SQi where [[sql i−1 ]] = {(t, s) | (s, t) ∈ [[sqli ]]}.
Consider the typing
σ

−1

sql −1
...
sql −1
σ (1) :̃ TQ σ (1) ⇔ SQ σ (1)
σ (n)−1 :̃ TQ σ (n) ⇔ SQ σ (n)
∈ Sn
i , j ⇒ L(TQi ) ∩ L(TQ j ) = ∅
i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅

−1
−1
(hsql −1
σ (1) | . . . | sql σ (n) i, σ ) :̃ hTQ σ (1) | . . . | TQ σ (n) i ⇔ hSQ σ −1 (σ (1)) | . . . | SQ σ −1 (σ (n) )i
−1
−1
So (hsql −1
σ (1) | . . . | sql σ (n) i, σ ) :̃ hTQ σ (1) | . . . | TQ σ (n) i ⇔ hSQ 1 | . . . | SQn )i, or in other
words (hsql σ (1) | . . . | sql σ (n) i, σ −1 ) :̃ DT ⇔ DS, as desired.
−1
−1
−1
[[(hsql −1
σ (1) | . . . | sql σ (n) i, σ )]] = {(s, t) | ∃i.(s, t) ∈ [[sql σ (i ) ]]} = {(t, s) | ∃i.(s, t) ∈ [[sql i ]]} =
{(t, s) | (s, t) ∈ [[dl]]}, as desired.

Case 2 (Seqence Lens).
...

al n :̃ An ⇔ Bn

σ ∈ Sn

al 1 :̃ A1 ⇔ B1
·! [s0 · A1 · . . . · An · sn ]

·! [t0 · B1 · . . . · Bn · tn ]

([(s0 , t0 ) · A1 · . . . · An · (sn , tn )], σ ) :̃ [s0 · A1 · . . . · An · sn ] ⇔ [t0 · Bσ (1) · . . . · Bσ (n) · tn ]
By IH, there exists al i−1 :̃ Bi ⇔ Ai where [[al i−1 ]] = {(t, s) | (s, t) ∈ [[al i ]]}.
Consider the typing
al −1
σ (n)

:̃ Bσ (n) ⇔ Aσ (n)

al −1
...
σ (1) :̃ Bσ (1) ⇔ Aσ (n)
σ −1 ∈ Sn
·! [t0 · B1 · . . . · Bn · tn ] ·! [s0 · A1 · . . . · An · sn ]

([(t0 , s0 ) · A1 · . . . · An · (tn , sn )], σ ) :̃ [t0 · Bσ (1) · . . . · Bσ (n) · tn ] ⇔ [s0 · Aσ −1 (σ (1)) · . . . · Aσ −1 (σ (n)) · sn ]
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:46

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

−1
−1
So ([(t0 , s0 ) ·al −1
σ (1) · . . . ·al σ (n) ·(tn , sn )], σ ) :̃ [t0 ·TQ σ (1) · . . . ·TQ σ (n) ·tn ] ⇔ [s0 ·SQ 1 | . . . | SQn )],
−1
−1
or in other words ([(t0 , s0 ) · al σ (1) · . . . · al σ (n) · (tn , sn )], σ −1 ) :̃ TQ ⇔ SQ, as desired.
−1
−1
′
′
′
′
′ ′
[[([(t0 , s0 ) · al −1
σ (1) · . . . · al σ (n) · (tn , sn )], σ )]] = {(t0 s1 . . . sn tn , s0 tσ −1 (1) . . . tσ (n)−1 sn ) | ∀i.(si , ti ) ∈
′
′
′
′
′ ′
[[al −1
σ (i ) ]]} = {(t0 tσ (1) . . . tσ (n) tn , s0 s1 . . . sn sn ) | ∀i.(s , t ) ∈ [[al i ]]} = {(t, s) | (s, t) ∈ [[sql]]}, as desired.

Case 3 (Atom Lens).
dl :̃ DS ⇔ DT DS ∗!

DT ∗!

iterate(dl) :̃ DS ∗ ⇔ DT ∗
By IH, there exists dl −1 :̃ DT ⇔ DS where [[dl −1 ]] = {(t, s) | (s, t) ∈ [[dl]]}.
Consider the typing
dl −1 :̃ DT ⇔ DSDT ∗!
DS ∗!
iterate(dl −1 ) :̃ DT ∗ ⇔ DS ∗
So iterate(dl −1 ) :̃ DT ∗ ⇔ DS ∗ , or in other words (iterate(dl −1 )) :̃ AtomAlt ⇔ Atom as desired.
[[iterate(dl −1 )]] = {(s0 . . . sn , t0 . . . tn ) | ∀i.(si , ti ) ∈ [[dl −1 ]]} = {(t0 . . . tn , s0 . . . sn ) | ∀i.(si , ti ) ∈
[[dl]]} = {(t, s) | (s, t) ∈ [[sql]]}, as desired.

B.4

DNF Regular Expression and Regular Expression Proofs

This subsection is in the aims of proving that ⇓ preserves language, and ⇑ is its left inverse. We use
this throughout. These functions are built on the DNF regular expression operators of ⊙, ⊕, and
⇓. In this section, we prove that these operators do as we expect them to, and use these lemmas
throughout the paper.
Lemma 19 (Equivalence of ⊙SQ and ·). If L(S) = L(SQ), and L(T ) = L(TQ), then L(S · T ) =
L(SQ ⊙SQ TQ).
Proof. Let SQ = [s0 · A1 · . . . · An · sn ], and let
TQ = [t0 · B1 · . . . · Bm · tm ]
L(SQ ⊙SQ TQ)= L([s0 · A1 · . . . · An · sn · t0 · B1 · . . . · Bm · tm ])
′ ·t
= {s0 · s1′ · . . . · sn′ · sn · t0 · t1′ · . . . · tm
m
′
′
| si ∈ L(Ai ) ∧ ti ∈ L(Bi )}
= {s · t | s ∈ L(SQ) ∧ t ∈ L(TQ)}
= {s · t | s ∈ L(S) ∧ t ∈ L(T )}
= L(S · T )



Lemma 20 (Equivalence of ⊙ and ·). If L(S) = L(DS), and L(T ) = L(DT ), then L(S · T ) =
L(DS ⊙ DT ).

L(DS ⊙ DT )= L(hSQi ⊙SQ TQ j for i ∈ [1
= {s | s ∈ SQi ⊙SQ TQ j
where i ∈ [1, n
= {s · t | s ∈ L(SQi ) ∧ t ∈
Proof. Let DS = hSQ 0 | . . . | SQn i, and let DT = hTQ 0 | . . . | TQm i
where i ∈ [1, n
= {s · t | s ∈ L(DS) ∧ t ∈ L
= {s · t | s ∈ L(S) ∧ t ∈ L(
= L(S · T )

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:47

Lemma 21 (Equivalence of A and D(A)). L(A) = L(D(A))
Proof. L(D(A)) = L(h[ϵ · A · ϵ]i)
L(h[ϵ · A · ϵ]i) = {s | s ∈ L([ϵ · A · ϵ])}.
L([ϵ · A · ϵ]) = {ϵ · s · ϵ | s ∈ L(A)} = {s | s ∈ L(A)} = L(A).
This means L(h[ϵ · A · ϵ]i) = {s | s ∈ L(A)} = L(A).



Lemma 22 (Equivalence of ⊕ and | ). If L(S) = L(DS), and L(T ) = L(DT), then L(S | T ) =
L(DS ⊕ DT ).
Proof. Let DS = hSQ 0 | . . . | SQ n i, and let DT = hTQ 0 | . . . | TQm i
L(DS ⊕ DT )= L(hSQ0 | . . . | SQn | TQ 1 | . . . | TQm i)
= {s | s ∈ SQi ∨ s ∈ TQ j
where i ∈ [1, n], j ∈ [1, m]}
= {s | s ∈ L(DS) ∨ s ∈ L(DT)}
= {s | s ∈ L(S) ∨ s ∈ L(T )}
= L(S | T )

Theorem 7. For all regular expressions S, L(⇓S) = L(S).
Proof. By structural induction.
Let S = s. L(⇓ (s)) = L(h[s]i) = {s} = L(s)
Let S = ∅. L(⇓ (∅)) = L(hi) = {} = L(∅).
Let S = S ′∗ . By induction assumption, L(⇓ (S ′)) = L(S ′).
L(⇓ (DS ′∗ ))= L(h[⇓ (S ′ )∗ ]i)
= {s | s ∈ L([⇓ (S ′)∗ ])}
= {s | s ∈ L(⇓ (S ′)∗ )}
= {s1 · . . . · sn | n ∈ N
∧ si ∈ L(⇓ (S ′))}
= {s1 · . . . · sn | n ∈ N ∧ si ∈ L(S ′)}
= L(S ′∗ )
Let S = S1 ·S2 . By induction assumption, L(⇓ (S1 )) = L(S1), and L(⇓ (S2 )) = L(S2 ). ⇓ (S1 ·S2 ) =⇓
(S1 )⊙ ⇓ (S2 ). By Lemma 20, S1 · S2 =⇓ (S1 )⊙ ⇓ (S2 ).
Let S = S1 | S2 . By induction assumption, L(⇓ (S1 )) = L(S1 ), and L(⇓ (S2 )) = L(S2 ). ⇓
(S1 | S2 ) =⇓ (S1 )⊕ ⇓ (S2 ). By Lemma 22, S1 | S2 =⇓ (S1 )⊕ ⇓ (S2 ).

Lemma 23. Let [s0 · A1 · . . . An · sn ] be a sequence, and
⇓ (⇑ (Ai )) = h[Ai ]i. Then,
⇓ (⇑ ([s0 · A1 · . . . An · sn ])) =
h[s0 · A1 · . . . An · sn ]i.
Proof. By induction on n.
Let n = 0. SQ = [s0 ].
⇓ (⇑ ([s0 ])) =⇓ (s0 ) = h[s0 ]i
Let n > 0, SQ = [s0 · A1 · . . . An · sn ].
⇓ (⇑ ([s0 · A1 · . . . An · sn ]))
⇓ (⇑ ([s0 · A1 · . . . An−1 · sn−1 ])· ⇑ (An ) · sn )=
⇓ (⇑ ([s0 · A1 · . . . An−1 · sn−1 ]))⊙ ⇓ (⇑ (An )) ⊙
⇓ (sn−1 )= h[s0 · A1 · . . . An−1 · sn−1 ]i ⊙
h[An ]i ⊙ h[sn ]i= h[s0 · A1 · . . . An · sn ]i.


, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:48

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Lemma 24. Let hSQ 1 | . . . | SQn i be a sequence, and
⇓ (⇑ (SQi )) = hSQi i. Then,
⇓ (⇑ (hSQ 1 | . . . | SQn i)) = hSQ 1 | . . . | SQn i.
Proof. By induction on n.
Let n = 0 ⇓ (⇑ (hi)) =⇓ (∅) = hi.
Let n > 0 ⇓ (⇑ (hSQ 1 ·. . .·SQn i)) =⇓ (⇑ (hSQ 1 ·. . .·SQn−1 i)· ⇑ (SQn ))= ⇓ (⇑ (hSQ 1 ·. . .·SQn−1 i)) ⊙
⇓ (⇑ (SQn ))= hSQ 1 · . . . · SQn i

Lemma 25 (Elimination of ⇓ ◦ ⇑).
(1) ⇓ (⇑ (A)) = h[A]i
(2) ⇓ (⇑ (SQ)) = hSQi
(3) ⇓ (⇑ (DS)) = DS
Proof. By mutual induction
Let DS ∗ be an atom. ⇓ (⇑ (DS ∗ )) =⇓ (⇑ (DS)∗ ) = h[⇓ (⇑ (DS))∗ ]i = h[DS ∗ ]i
Let [s0 · A1 · . . . · An · sn ] be a sequence. ⇓ (⇑ ([s0 · A1 · . . . · An · sn ])). By induction assumption, for
each Ai , ⇓ (⇑ (Ai )) = h[Ai ]i. By Lemma 23, ⇓ (⇑ ([s0 · A1 · . . . · An · sn ])) = h[s0 · A1 · . . . · An · sn ]i.
Let hSQ 1 · . . . · SQn i be a DNF regular expression. By induction assumption, for each SQ i , ⇓ (⇑
(SQi )) = hSQi i. By Lemma 24, ⇓ (⇑ (hSQ 1 · . . . · SQ n i)) = hSQ 1 · . . . · SQ n i.

Lemma 26. (DS1 ⊕ DS 2 ) ⊕ DS 3 = DS 1 ⊕ (DS 2 ⊕ DS 3 )
Proof. Let DS 1 = hSQ 1,1 | . . . | SQ 1,n1 i and DS 2 = hSQ 2,1 | . . . | SQ 2,n2 i and
DS 3 = hSQ 3,1 | . . . | SQ 3,n3 i.
(DS 1 ⊕ DS 2 ) ⊕ DS 3

hSQ 1,1 | . . . | SQ 1,n1 | SQ 2,1 | . . . | SQ 2,n2 i ⊕ DS 3
hSQ 1,1 | . . . | SQ 1,n1 | SQ 2,1 | . . . | SQ 2,n2 | SQ 3,1 | . . . | SQ 3,n3 i
DS 1 ⊕ hSQ 2,1 | . . . | SQ 2,n2 | SQ 3,1 | . . . | SQ 3,n3 i
DS 1 ⊕ (DS 2 ⊕ DS 3 )

=
=
=
=


Lemma 27. (SQ 1 ⊙SQ SQ 2 ) ⊙SQ SQ 3 = SQ 1 ⊙SQ (SQ 2 ⊙SQ SQ 3 )
Proof. Let SQ 1 = [s1,0 · A1,1 · . . . · A1,n1 · s1,n1 ], SQ 2 = [s2,1 · A2,1 · . . . · A2,n2 · s2,n2 ], and SQ 3 =
[s3,1 · A3,1 · . . . · A3,n3 · s3,n3 ].
(SQ 1 ⊙SQ SQ 2 ) ⊙SQ SQ 3

=
=
=
=

[s1,1 · A1,1 · . . . · A1,n1 · s1,n1 · s2,1 · A2,1 · . . . · A2,n2 · s2,n2 ] ⊙SQ SQ 3
[s1,1 · A1,1 · . . . · A1,n1 · s1,n1 · s2,0 · A2,1 · . . . · A2,n2 ·
s2,n2 · s3,0 · A3,1 · . . . · A3,n3 · s3,n3 ]
SQ 1 ⊙SQ [s2,0 · A2,1 · . . . · A2,n2 · s2,n2 · s3,0 · A3,1 · . . . · A3,n3 · s3,n3 ]
SQ 1 ⊙SQ (SQ 2 ⊙SQ SQ 3 )


Lemma 28. (DS1 ⊙ DS 2 ) ⊙ DS 3 = DS 1 ⊙ (DS 2 ⊙ DS 3 )
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:49

Proof. Let DS 1 = hSQ 1,1 | . . . | SQ 1,n1 i, DS 2 = hSQ 2,1 | . . . | SQ 2,n2 i, and DS 3 = hSQ 3,1 | . . . | SQ 3,n3 i.
(DS 1 ⊙ DS 2 ) ⊙ DS 3

=
=
=
=
=

hSQ 1,1 ⊙SQ SQ 2,1 | . . . | . . . | SQ 1,n1 ⊙SQ SQ 2,n2 i
h(SQ 1,1 ⊙SQ SQ 2,1 ) ⊙SQ SQ 3,1 | . . . | . . . | . . . |
(SQ 1,n1 ⊙SQ SQ 2,n2 ) ⊙SQ SQ 3,n3 i
hSQ 1,1 ⊙SQ (SQ 2,1 ⊙SQ SQ 3,1 ) | . . . | . . . | . . . |
SQ 1,n1 ⊙SQ (SQ 2,n2 ⊙SQ SQ 3,n3 )i
DS 1 ⊙SQ hSQ 2,1 ⊙SQ SQ 3,1 | . . . | . . . | SQ 2,n2 ⊙SQ SQ 3,n3 i
DS 1 ⊙ (DS 2 ⊙ DS 3 )


Lemma 29. hi ⊕ DS 1 = DS 1
Proof. By inspection.



Lemma 30. DS 1 ⊕ hi = DS 1
Proof. By inspection.



Lemma 31. h[ϵ]i ⊙ DS = DS
Proof. By inspection, [ϵ] ⊙SQ SQ = SQ.
Let DS = hSQ 1 | . . . | SQn i.
h[ϵ]i ⊙ DS

=
=
=

h[ϵ] ⊙SQ SQ 1 | . . . | [ϵ] ⊙SQ SQ n i
hSQ 1 | . . . | SQn i
DS


Lemma 32. DS ⊙ h[ϵ]i = DS
Proof. Done similarly to Lemma 31.



Lemma 33. hi ⊙ DS = hi
Proof. By inspection.



Lemma 34. DS ⊙ hi = hi
Proof. By inspection.



Lemma 35. (DS1 ⊕ DS 2 ) ⊙ DS 3 = (DS 1 ⊙ DS 3 ) ⊕ (DS 2 ⊙ DS 3 )
Proof. Let DS 1 = hSQ 1,1 | . . . | SQ 1,n1 i.
Let DS 2 = hSQ 2,1 | . . . | SQ 2,n2 i.
Let DS 3 = hSQ 3,1 | . . . | SQ 3,n3 i.
(DS 1 ⊕ DS 2 ) ⊙ DS 3 = (SQ 1,1 | . . . | SQ 1,n1 | SQ 2,1 | . . . | SQ 2,n2 ) ⊙ hSQ 3,1 | . . . | SQ 3,n3 i. So, through
application of ⊙, hSQ 1,1 ⊙SQ SQ 3,1 | . . . | SQ 1,1 ⊙SQ SQ 3,n3 | SQ 2,n2 ⊙SQ SQ 3,1 | . . . | SQ 2,n2 ⊙SQ SQ 3,n3 i.
This equals hSQ 1,1 ⊙SQ SQ 3,1 | . . . | SQ 1,1 ⊙SQ SQ 3,n3 | SQ 1,n1 ⊙SQ SQ 3,1 | . . . | SQ 1,n1 ⊙SQ SQ 3,n3 i ⊕
hSQ 2,1 ⊙SQ SQ 3,1 | . . . | SQ 2,1 ⊙SQ SQ 3,n3 | SQ 2,n2 ⊙SQ SQ 3,1 | . . . | SQ 2,n2 ⊙SQ SQ 3,n3 i, which is
(DS 1 ⊙ DS 2 ) ⊕ (DS 1 ⊙ DS 3 )

Lemma 36. hSQi ⊙ (DS 1 ⊕ DS 2 ) = (hSQi ⊙ DS 1 ) ⊕ (hSQi ⊙ DS 2 )
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:50

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Proof. Let DS 1 = hSQ 1,1 | . . . | SQ 1,n1 i. Let DS 2 = hSQ 2,1 | . . . | SQ 2,n2 i.
hSQi ⊙ (DS 1 ⊕ DS 2 ) = hSQi ⊙ (hSQ 1,1 | . . . | SQ 1,n1 i ⊕ hSQ 2,1 | . . . | SQ 2,n2 i). So, through
application of ⊙, hSQ ⊙SQ SQ 1,1 | . . . | SQ ⊙SQ SQ 1,n1 | SQ ⊙SQ SQ 2,1 | . . . SQ ⊙SQ SQ 2,n2 i. This
equals hSQ ⊙SQ SQ 1,1 | . . . | SQ ⊙SQ SQ 1,n1 i ⊕ hSQ ⊙SQ SQ 2,1 | . . . SQ ⊙SQ SQ 2,n2 i, which through
the deﬁnitions, equals (hSQi ⊙ DS 1 ) ⊕ (hSQi ⊙ DS 2 ).

Lemma 37 (≡s is ﬁner than ≡). If S ≡s T , then S ≡ T
Proof. By induction on the derivation of ≡s
Case 1 (+ Ident). Through the use of ≡’s + Ident.
Case 2 (0 ProjR ). Through the use of ≡’s 0 ProjR .
Case 3 (0 ProjL ). Through the use of ≡’s 0 ProjL .
Case 4 (· Assoc). Through the use of ≡’s · Assoc.
Case 5 ( | Assoc). Through the use of ≡’s | Assoc.
Case 6 ( | Comm). Through the use of ≡’s | Comm.
Case 7 (DistR ). Through the use of ≡’s DistR .
Case 8 (DistL ). Through the use of ≡’s DistL .
Case 9 (· IdentL ). Through the use of ≡’s · IdentL .
Case 10 (· IdentR ). Through the use of ≡’s · IdentR .
Case 11 (UnrollstarL ). Let S ≡s T through an application of UnrollstarL .
So, without loss of generality, from symmetry, we can say S = S ′∗ and T = ϵ | (S ′ · S ′∗ ).
Consider the derivations
S′ ≡ S′ · ϵ
S ′∗ ≡ (S ′ · ϵ)∗
S ′ · ϵ ∗ ≡ ϵ | (S ′ · (ϵ · S ′ )∗ · ϵ)
S ′ · (ϵ · S ′)∗ · ϵ ≡ S ′ · (ϵ · S ′)∗
ϵ | (S ′ · (ϵ · S ′ )∗ · ϵ) ≡ ϵ | (S ′ · (ϵ · S ′ )∗ )
S′ · ϵ ≡ S′
··
·
∗
′
′
ϵ | (S · (ϵ · S ) ) ≡ ϵ | (S ′ · S ′ ∗ )
Through repeated application of equational theory transitivity, S ≡ T .
Case 12 (UnrollstarR ). Let S ≡s T through an application of UnrollstarL .
So, without loss of generality, from symmetry, we can say S = S ′∗ and T = ϵ | (S ′∗ · S ′ ).
Consider the derivations
S′ ≡ ϵ · S′
S ′∗ ≡ (ϵ · S ′ )∗
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:51

ϵ · S ′∗ ≡ ϵ | (ϵ · (S ′ · ϵ)∗ · S ′ )
ϵ · (S ′ · ϵ)∗ · S ′ ≡ (S ′ · ϵ)∗ · S ′
ϵ | (ϵ · (S ′ · ϵ)∗ · S ′) ≡ ϵ | (S ′ (S ′ · ϵ)∗ )
S′ · ϵ ≡ S′
··
·
ϵ | ((S ′ · ϵ)∗ · S ′) ≡ ϵ | (S ′ · S ′∗ )
Through repeated application of equational theory transitivity, S ≡ T .

B.5

Unambiguity Property Proofs

Unambiguity is critical in the typing derivations, so unambiguity proofs are similarly critical. In
this section, we prove requirements for maintaining unambiguity. The bulk of the work for many
of these is proven in the language unambiguity proofs in Subsection B.2. However, this combines
these together to prove things like unambiguity is maintained through application of the deﬁnitional equivalence rules.
Lemma 38. If S | T be strongly unambiguous, then L(S) ∩ L(T ) = {}, and both S and T are
strongly unambiguous.
Proof. If S | T is strongly unambiguous, then either L(S | T ) = {}, or L(S) ∩ L(T ) = {}, and
S and T are both strongly unambiguous.
If the latter, then we are done.
If the former, then both L(S) = {} and L(T ) = {}. This means they are both strongly unambiguous. Furthermore, {} ∩ {} = {}, so L(S) ∩ L(T ) = {}.

Lemma 39. Let S ≡s T . If S is strongly unambiguous, then T is strongly unambiguous.
Proof. If L(S) = {}, then L(T ) = {}, by Lemma 37.
For the case where L(S) , {}, we proceed by induction on the derivation of equivalence of S
and T .
Case 1 (+ Ident left to right). Let the last step of the derivation be + Ident left to right. S ≡s S | ∅.
∅ is strongly unambiguous, as its language is empty. S is strongly unambiguous by assumption
L(S) ∩ L(∅) = L(S) ∩ {} = ∅, so T is strongly unambiguous.
Case 2 (+ Ident right to left). Let the last step of the derivation be + Ident right to left. T | ∅ ≡s T .
If L(T | ∅) = {} then L(T ) = {}, so T is strongly unambiguous.
Otherwise T is strongly unambiguous, which is what is desired.
Case 3 (0 ProjR both directions). Let the last step of the derivation be 0 ProjR . The language of both
sides is {}, by Lemma 37.
Case 4 (0 ProjL both directions). Let the last step of the derivation be 0 ProjL . The language of both
sides is {}, by Lemma 37.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:52

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Case 5 (· Assoc left to right). Let the last step of the derivation be · Assoc left to right. (S1 · S2 ) · S3 ≡s
S1 · (S2 · S3 )
Because Sis strongly unambiguous. S1 ·! S2 and (S1 · S2 ) ·! S3
Let s2 , t2 ∈ S2 , let s3 , t3 ∈ S3 , and let s2 · s3 = t2 · t3 . Consider s1 in S1 which exists as L(S) , {}.
(s1 · s2 ) · s3 = (s1 · t2 ) · t3 , so s3 = t3 and s1 · s2 = s1 · t2 , so s2 = t2 .
Let s2 · s3 ∈ S2 · S3 , t2 · t3 ∈ S2 · S3 , s1 , t1 ∈ S1 , and let s1 · (s2 · s3 ) = t1 · (t2 · t3 ). This means
(s1 · s2 ) · s3 = (t1 · t2 ) · t3 ).
So by assumption, s3 = t3 , and s1 · s2 = t1 · t2 . So by assumption, s1 = t1 and s2 = t2 . So,
s2 · s3 = t2 · t3 , and s1 = t1 .
Case 6 (· Assoc right to left). Very similarly to left to right.
Case 7 ( | Assoc left to right). S1 | (S2 | S3 ) ≡s (S1 | S2 ) | S3 .
L(S1 ) ∩ L(S2 | S3 ) = {}. This means that L(S1 ) ∩ (L(S2) ∪ L(S3)) = {}, so through distributivity,
L(S1 ) ∩ L(S2 ) ∪ L(S1 ) ∩ L(S3) = {}. This means L(S1 ) ∩ L(S2 ) = {} and L(S1 ) ∩ L(S3 ) = {}.
If L(S2 | S3 ) = {}, then the language of each is empty, so they are each strongly unambiguous.
This means S1 | S2 is strongly unambiguous.
Furthermore, L(S1 ) ∩ L(S3 ) ∪ L(S2 ) ∩ L(S3 ) = {} as each of the intersections is empty. So the
whole thing is unambiguous.
Case 8 ( | Assoc right to left). Done very similarly to the left to right case.
Case 9 ( | Comm). S1 | S2 ≡s S2 | S1 So if the languages are empty, then they are both empty.
Otherwise, S1 is strongly unambiguous, and S2 is strongly unambiguous, and L(S1 )∩L(S2 ) = {}.
So L(S2 ) ∩ L(S1 ) = {}, and so S2 | S1 is strongly unambiguous.
Case 10 (DistR left to right). S1 · (S2 | S3 ) ≡s (S1 · S2 ) | (S1 · S3 ).
If L(S1 · (S2 | S3 )) = {}, then (S1 · S2 ) | (S1 · S3 ) = {}, and we are done.
If the language is nonempty, so too are the languages of each side, so S1 is nonempty, and S2 | S3
is nonempty, and S1 is strongly unambiguous, and S2 | S3 is strongly unambiguous.
S2 | S3 being strongly unambiguous implies S2 is strongly unambiguous, S3 is strongly unambiguous, and L(S2 ) ∩ L(S3) = {}, by Lemma 38.
Let s1 , t1 ∈ L(S1 ), s2 , t2 ∈ L(S2 ), s1 · s2 = t1 · t2 . s. Then t1 ∈ L(S1 | S2 ), and t2 ∈ L(S1 | S2 ). By
assumption of strong unambiguity, where the languages are not empty, s1 = s2 anc t1 = t2 .
Similarly for s1 , t1 ∈ L(S1), s3 , t3 ∈ L(S3).
Assume there exists some s ∈ L(S1 · S2 ) ∩ L(S1 · S3 ). This means s = s1 · s2 , for s1 ∈ L(S1 ) and
s2 ∈ L(S2 ), uniquely. It means s = t1 · t2 , for t1 ∈ L(S1 ) and t2 ∈ L(S2 ). From assumption, as
s ∈ L(S1 · (S2 | S3 )), s1 = t1 and s2 = t3 . Contradiction, as L(S2 ) ∩ L(S3 ) = {}. So there is no string
in the intersection, or in other words L(S1 · S2 ) ∩ L(S1 · S3 ) = {}
As such, (S1 · S2 ) | (S1 · S3 ) is strongly unambiguous
Case 11 (DistR right to left). (S1 · S2 ) | (S1 · S3 ) ≡s S1 · (S2 | S3 ).
If L(S1 ) = {}, then the language of the entire S is empty, and we are done. Otherwise assume
L(S1 ) , {}.
From assumption S1 · S2 is strongly unambiguous, S1 · S3 is strongly unambiguous, and L(S1 ·
S2 ) ∩ L(S1 · S3 ) = {}.
Assume there exists some s ∈ L(S2 ) ∩ L(S3 ). Let s1 ∈ L(S1). This makes s1 · s ∈ L(S1 · S2 ) ∩
L(S1 · S3 ). This is a contradiction, so L(S2 ) ∩ L(S3) = {}.
Let s1 , t1 ∈ L(S1 ). Let s, t ∈ L(S2 | S3 ). Let s1 · s = t1 · t. Assume s ∈ L(S2 ). Then t ∈ L(S2),
as otherwise S is not strongly unambiguous. So as s1 · s ∈ L(S1 · S2 ), and t1 · t ∈ L(S1 · S2 ), by
assumption, s1 = t1 , and s = t. If s < L(S2 ), then s ∈ L(S3 ), and the same argument applies.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:53

Case 12 (DistL both directions). Proceeds the same as DistR .
Case 13 (· IdentL left to right). ϵ · S ′ ≡s S ′
If they have empty languages, we are done.
If nonempty, then S ′ is strongly unambiguous, and we are done.
Case 14 (· IdentL right to left). S ′ ≡s ϵ · S ′
Both S ′ and ϵ are strongly unambiguous, by assumption and deﬁnition, respectively.
Furthermore, let s1 , t1 ∈ L(ϵ), and s2 , t2 ∈ L(S ′), and s1 · s2 = t1 · t2 s1 = t1 = ϵ, so s1 = t2 , which
makes s2 = t2 .
Case 15 (· IdentR both directions). Very similar to · IdentL .
Case 16 (UnrollstarL left to right). S ′∗ ≡s ϵ | (S ′ · S ′∗ )
Let s ∈ L(ϵ) ∩ L(S ′ · S ′∗ ). So s = ϵ. So ϵ ∈ L(S ′). Contradiction, as if ϵ in L(S ′), then if
s1 · sn = t1 · tm , n no longer must equal m, as arbitrarily many ϵs can be input.
ϵ is strongly unambiguous.
If L(S ′) = ∅, then S ′ · S ′∗ also has an empty language, and is strongly unambiguous.
If the language is nonempty, S ′ is strongly unambiguous.
Let s1 , s2 ∈ L(S ′), t1 , t2 ∈ L(S ′∗ ). Let s1 · t1 = t2 · t2 . t1 = t1,1 · . . . · t1,n and t2 = t2,1 · . . . · t1,m , where
t1,i , t2,i ∈ L(S ′∗ ). Consider s1 · t1,1 · . . . · t1,n and s2 · t2,1 · . . . · t2,m . As S ′ is unambiguously iterable,
n + 1 = m + 1, and s1 = s2 and t1,i = t2,i . This means that t1 = t2 . So Reдex ′ is unambiguously
concatenable with S ′∗ .
Case 17 (UnrollstarL right to left). ϵ | (S ′ · S ′∗ ) ≡s S ′∗
If L(S ′) = {}, then it is vacuously unambiguously concatenable, and S ′ is strongly unambiguous,
so S ′∗ is strongly unambiguous.
Let L(S ′) not be empty.
Let s1 · . . . · sn = t1 · . . . · tm , and si , ti ∈ L(S ′). We want to show that n = m and si = ti . This can
be done by induction on n.
If n = 0, then m = 0, as otherwise m > 0, which would imply that ϵ ∈ L(S ′), making S not
strongly unambiguous.
If n , 0, then by the unambiguous concatenability of S ′ and S ′∗ , s1 = t1 , and s2 ·. . .·sn = t2 ·. . .·tn ,
and the IH applies.
Case 18 (UnrollstarR both directions). Done similarly to UnrollstarL .
Case 19 (All structural cases). As ≡s is ﬁner than ≡, the subparts will have the same languages. If
the language of S is empty, then we are done, otherwise, each subpart will be strongly unambiguous, by the induction hypothesis. As the top level unambiguity condition is based on the language,
and the languages of the subparts are equal, the top level unambiguity condition will be satisﬁed.
Case 20 (Transitivity of Equational Theory). If S ≡s S ′ and S ≡s T , then by IH, S ′ is strongly
unambiguous, and by IH again, T is strongly unambiguous.

Lemma 40. If DS 1 ⊙ (DS 2 ⊕ DS 3 ) is strongly unambiguous, then (DS 1 ⊙ DS 2 ) ⊕ (DS 1 ⊙ DS 3 ) is
strongly unambiguous.
Proof. Let DS 1 = hSQ 1,1 | . . . | SQ 1,n1 i.
Let DS 2 = hSQ 2,1 | . . . | SQ 2,n2 i.
Let DS 3 = hSQ 3,1 | . . . | SQ 3,n3 i.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:54

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

DS 2 ⊕ DS 3 = hSQ 2,1 | . . . | SQ 2,n2 | SQ 3,1 | . . . | SQ 3,n3 i.
DS 1 ⊙ (DS 2 ⊕ DS 3 ) = hSQ 1,1 ⊙SQ SQ 2,1 | . . . | SQ 1,1 ⊙SQ SQ 2,n2 | SQ 1,1 ⊙SQ SQ 3,1 | . . . | SQ 1,1 ⊙SQ
SQ 3,n3 | . . . | SQ 1,n1 ⊙SQ SQ 2,1 | . . . | SQ 1,n1 ⊙SQ SQ 2,n2 | SQ 1,n1 ⊙SQ SQ 3,1 | . . . | SQ 1,n1 ⊙SQ SQ 3,n3 i. As
this is strongly unambiguous, SQ 1,i ⊙SQ SQ j,k is strongly unambiguous for all i, j, k. Furthermore,
by strong unambiguity, if (i 1 , j 1 , k 1 ) , (i 2 , j 2 , k 2 ), then SQ 1,i 1 ⊙SQ SQ j1 ,k1 ∩ SQ 1,i 2 ⊙SQ SQ j1 ,k1 .
(DS 1 ⊙ DS 2 ) ⊕ (DS 1 ⊙ DS 3 ) =
hSQ 1,1 ⊙SQ SQ 2,1 | . . . SQ 1,1 ⊙SQ SQ 2,n2 | . . . | SQ 1,n1 ⊙SQ SQ 2,1 | . . . | SQ 1,n1 ⊙SQ SQ 2,n2 | SQ 1,1 ⊙SQ
SQ 3,1 | . . . SQ 1,1 ⊙SQ SQ 3,n3 | SQ 1,n1 ⊙SQ SQ 3,1 | . . . SQ 1,n1 ⊙SQ SQ 3,n3 i
From before, if (i 1 , j 1 , k 1 ) , (i 2 , j 2 , k 2 ), then SQ 1,i 1 ⊙SQ SQ j1 ,k1 ∩SQ 1,i 2 ⊙SQ SQ j1 ,k1 = {}. Furthermore,
each SQ 1,i ⊙SQ SQ j,k is still strongly unambiguous for all i, j, k, so (DS 1 ⊙ DS 2 ) ⊕ (DS 1 ⊙ DS 3 ) is
strongly unambiguous.
The same process can be repeated to show that assumping (DS1 ⊙ DS 2 ) ⊕ (DS 1 ⊙ DS 3 ) is strongly
unambiguous, we can show DS ⊙ (DS 2 ⊕ DS 3 ) is strongly unambiguous.

B.6

Rewrite Equivalence Proofs

This subsection goes through equivalence associated with the rewrites. In this section, proofs
of rewrites not altering the language are proven. Furthermore, it is shown that the Deﬁnitional
Equivalence Rules are ﬁner than the base axioms. We prove that both ⇓ and ⇑ maintain unambiguity. Parallel Rewrites with Swap are shown to be equivalent to the deﬁnitional equivalence rules.
We prove that the reﬂexive and transitive closure of rewrites is equivalent in expressibility to the
reﬂexive and transitive closure of parallel rewrites. Lastly, we prove that if the DNF versions of
two regular expressions are can be written to each other, then those two regular expressions are
deﬁnitionally equivalent.
Lemma 41 (Single Rewrites Respecting Language).
• If A →A DS, then L(A) = L(DS)
• If DS → DT , then L(DS) = L(DT)
Proof. By mutual induction on the derivation of → and →A
Case 1 (Atom UnrollstarL ).
DS ∗ →A h[ϵ]i ⊕ (DS ⊙ D(DS ∗ ))
Let ⇑DS = S.
S ∗ ≡ ϵ | (S · S ∗ ), by Lemma 37. By Theorem 1, L(⇓ S ∗) = L(⇓ (ϵ | (S · S ∗ ))). So L(D((⇓S)∗ )) =
L(⇓(ϵ | (S · S ∗ ))). So by Lemma 21, and application of ⇓, L(DS∗ ) = L(h[ϵ]i ⊕ DS ⊙ D((DS ∗ ))), as
desired.
Case 2 (Atom UnrollstarR ).
DS ∗ →A h[ϵ]i ⊕ (D(DS∗ ) ⊙ DS)
Let ⇑DS = S.
S ∗ ≡ ϵ | (S · S ∗ ), by Lemma 37. By Theorem 1, L(⇓ S ∗) = L(⇓ (ϵ | (S ∗ · S))). So L(D((⇓S)∗ )) =
L(⇓(ϵ | (S ∗ · S))). So by Lemma 21, and application of ⇓, L(DS∗ ) = L(h[ϵ]i ⊕ D((DS ∗ )) ⊙ DS), as
desired.
Case 3 (Atom Structural Rewrite).
DS → DT
∗

DS →A D(DT ∗ )
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:55

L(DS) = L(DT ), so L(DS∗ ) = L(DT ∗ ). Through application of Lemma 21, L(DS∗ ) = L(D(DT ∗ )).
Case 4 (DNF Structural Rewrite).
Aj →A DS
hSQ 1 | . . . | SQ i −1 i ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙ D(Aj ) ⊙ h[sj · . . . · Am · sm ]i ⊕ hSQ i +1 | . . . | SQ n i →
hSQ 1 | . . . | SQi −1 i ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙ DS ⊙ [sj · . . . · Am · sm ] ⊕ hSQ i +1 | . . . | SQn i
As L(D(Aj )) = L(DS), by IH and Lemma 21, and because the left side is the same as the right,
except with D(Aj ) replacing DS, the two languages are the same.

Lemma 42 (Rewrites Respecting Language). If

DS→∗ DT ,

then L(DS) = L(DT)

Proof. By induction on the derivation of →∗
Case 1 (Reflexivity).
DS→∗ DS
L(DS) = L(DS) so we’re done.
Case 2 (Base).
DS → DT
DS→∗ DT
By Lemma 41, as DS → DT , L(DS) = L(DT).
Case 3.

By IH, L(DS) =

DS→∗ DS ′
L(DS ′ ).

By IH,

L(DS ′)

DS ′ →∗ DT

DS→∗ DT
= L(DT). So L(DS) = L(DT).


Lemma 43. If ⇓S = hi, and S ≡ T , then ⇓T = hi.
Proof. By induction on the proof of equivalence
Case 1 (Structural Equality Rule). Then T = S, so ⇓T =⇓S = hi.
Case 2 (+ Ident left to right). S ≡ S | ∅. ⇓(S | ∅) =⇓S⊕ ⇓∅ = hi ⊕ hi.
Case 3 (+ Ident right to left). T ≡ T | ∅. ⇓ (T | ∅) = hi. So by deﬁnition, ⇓ T ⊕ ⇓ ∅ = hi. Again by
deﬁnition, ⇓T ⊕ hi = hi. So by Lemma 30, ⇓T = hi
Case 4 (0 ProjR left to right). T = ∅ so ⇓T = hi
Case 5 (0 ProjR right to left). T = S · ∅, so ⇓T =⇓S⊙ ⇓∅ =⇓S ⊙ hi, so by Lemma 33, ⇓T = hi.
Case 6 (0 ProjL both directions). Done similarly to 0 ProjR .
Case 7 (· Assoc left to right). (S1 · S2 ) · S3 ≡ S1 · (S2 · S3 ). Throguh deﬁnitions, and Lemma 27,
hi =⇓((S1 · S2 ) · S3 ) = (⇓S1 ⊙ ⇓S2 )⊙ ⇓S3 ) =⇓S1 ⊙ (⇓S2 ⊙ ⇓S3 ) =⇓(S1 · (S2 · S3 ))
Case 8 (· Assoc right to left). Analogously to left to right
Case 9 ( | Assoc left to right). (S1 | S2 ) | S3 ≡ S1 | (S2 | S3 ). Through deﬁnitions, and Lemma 26,
hi =⇓((S1 | S2 ) | S3 ) = (⇓S1 ⊕ ⇓S2 )⊕ ⇓S3 ) =⇓S1 ⊕ (⇓S2 ⊕ ⇓S3 ) =⇓(S1 | (S2 | S3 ))
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:56

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Case 10 ( | Assoc right to left). Analogously to left to right
Case 11 ( | Comm). S1 | S2 ≡ S1 | S2 . hi =⇓ (S1 | S2 ) =⇓ S1 ⊕ ⇓ S2 . By the deﬁnition of ⊕, ⇓ S1 = hi,
and ⇓S2 = hi. ⇓(S2 | S1 ) =⇓S2 ⊕ ⇓S1 = hi ⊕ hi = hi.
Case 12 (DistR left to right). S1 · (S2 | S3 ) ≡ (S1 · S2 ) | (S1 · S3 )
⇓ S1 · (S2 | S3 ) =⇓ S1 ⊙ (⇓ S2 ⊕ ⇓ S3 ) = hi. By the deﬁnition of ⊙, this means ⇓ S1 = hi, or
⇓S2 ⊕ ⇓S3 = hi.
If ⇓S1 = hi, then by Lemma 33, ⇓S1 ⊙ ⇓S2 = hi and ⇓S1 ⊙ ⇓S3 = hi, so ⇓((S1 · S2 ) | (S1 · S3 ) = (⇓
S1 ⊙ ⇓S2 )⊕ ⇓S1 ⊙ ⇓S3 = hi.
If ⇓S2 ⊕ ⇓S3 = hi, then by deﬁnition of ⊕, ⇓S2 = hi and ⇓S3 = hi. By Lemma 34, ⇓S1 ⊙ ⇓S2 = hi
and ⇓S1 ⊙ ⇓S3 = hi, so ⇓((S1 · S2 ) | (S1 · S3 ) = (⇓S1 ⊙ ⇓S2 )⊕ ⇓S1 ⊙ ⇓S3 = hi.
Case 13 (DistR right to left). (S1 · S2 ) | (S1 · S3 ) ≡ S1 · (S2 | S3 )
⇓ ((S1 · S2 ) | (S1 · S3 )) = (⇓ S1 ⊙ ⇓ S2 ) ⊕ (⇓ S1 ⊙ ⇓ S3 ) = hi. By the deﬁnition of ⊕, this means
⇓S1 ⊙ ⇓S2 = hi, and ⇓S1 ⊙ ⇓S3 = hi.
As ⇓S1 ⊙ ⇓S2 = hi.
If ⇓S1 = hi, then by Lemma 33, ⇓S1 ⊙ (⇓S2 ⊕ ⇓S3 ) = hi, so S1 · (S2 | S3 ) = hi.
If ⇓ S1 , hi, then ⇓ S2 = hi and ⇓ S3 = hi. This means ⇓ S2 ⊕ ⇓ S3 = hi. So, by Lemma 33,
⇓S1 ⊙ (⇓S2 ⊕ ⇓S3 ) = hi, so ⇓(S1 · (S2 | S3 )).
Case 14 (DistL both directions). Proceeds analogously to DistR .
Case 15 (· IdentL left to right). ϵ · T ≡ T . By assumption, ⇓ (ϵ · T ) = hi This means ⇓ϵ ⊙ ⇓ T = hi.
By Lemma 31, ⇓ϵ ⊙ ⇓T =⇓T , so ⇓T = hi.
Case 16 (· IdentL right to left). S ≡ ϵ · S. By assumption, ⇓ S = hi. By Lemma 31, ⇓ (ϵ · S) =⇓ S, so
⇓S = hi.
Case 17 (· IdentR both dierections). Done analogously to · IdentL .
Case 18 (Sumstar, Prodstar, Starstar, Dicyc, Structural Star Equality). In all of these cases, the
regular expression on the left is of the form S ′∗ , for some S ′ . ϵ ∈ S ′∗ for all S ′ . However, L(hi) = {},
and by Theorem 1, L(⇓S) = L(S). This means that ⇓S ′∗ , hi, for all S ′ , so these rules do not apply.
Case 19 (Structural Or Equality).
S1 ≡ T1

S2 ≡ T2

S1 | S2 ≡ T1 | T2
⇓ (S1 | S2 ) =⇓ S1 ⊕ ⇓ S2 = hi. By the deﬁnition of ⊕, ⇓ S1 = hi and ⇓ S2 = hi. So, by induction,
⇓T1 = hi and ⇓T2 = hi. So ⇓T1 ⊕ ⇓T2 =⇓(T1 | T2 ) = hi.
Case 20 (Structural Concat Equality).
S1 ≡ T1

S2 ≡ T2

S1 · S2 ≡ T1 · T2
⇓ (S1 · S2 ) =⇓ S1 ⊙ ⇓ S2 = hi. By the deﬁnition of ⊙, ⇓ S1 = hi or ⇓ S2 = hi. So, by induction,
⇓T1 = hi or ⇓T2 = hi. So ⇓T1 ⊙ ⇓T2 =⇓(T1 · T2 ) = hi.
Case 21 (Transitivity of Equational Theories).
S ≡ S′

S′ ≡ T

S≡T
By IH, ⇓S ′ = hi. So, by IH, ⇓T = hi.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.



Synthesizing Bijective Lenses

1:57

Lemma 44. If L(S) = {}, then ⇓S = hi
Proof. L(∅) = {}. We know L(S) = {}, so S ≡ ∅. ⇓∅ = hi. So, by Lemma 43, ⇓S = hi.



Lemma 45. If S is strongly unambiguous as a regular expression, then ⇓S is strongly unambiguous
as a DNF regular expression.
Proof. We proceed by induction.
Case 1 (Base). ⇓s = h[s]i, which is strongly unambiguous.
Case 2 (Empty). ⇓∅ = hi, which is strongly unambiguous.
Case 3 (Star). Let S =⇓(S ′∗ ) be strongly unambiguous. ⇓(S ′∗ ) = D((⇓S ′)∗ ) By IH, ⇓S ′ is strongly
unambiguous. Furthermore, L(S ′) = L(⇓ S ′) is unambiguously iterable, so (⇓S ′)∗ is strongly
unambiguous. This means that D((⇓S ′)∗ ) is strongly unambiguous.

Case 4 (Concat). Let S = S1 · S2 be strongly unambiguous.
If L(S) = {}, by Lemma 44, ⇓S = hi, which is strongly unambiguous.
Let ⇓ S1 = hSQ 1 | . . . | SQn i. Let ⇓ S2 = hTQ 1 | . . . | TQm i. If L(S) , {}, this means that L(⇓
S1 ) , {}, and L(⇓S2) , {}. This means that SQi is nonempty, and so is TQi , for all i. Furthermore,
as S is strongly unambiguous, and L(S) , {}, S1 and S2 are strongly unambiguous, which means
so too are hSQ 1 | . . . | SQn i and hTQ 1 | . . . | TQm i, and so too are SQi and TQ i .
As ⇓ S1 ·! ⇓ S2 , i , j ⇒ SQi ∩ SQ j = ∅, and i , j ⇒ TQi ∩ TQ j = ∅ I know from Lemma 9,
(i 1 , j 1 ) , (i 2 , j 2 ) ⇒ L(SQi 1 ⊙ SQ j1 ) ∩ L(SQi 2 ⊙ SQ j2 ) = {}. and L(SQi ) ·! L(TQ j ).
Let SQi = [si ,0 ·Ai ,1 ·. . .·Ai ,ni ·si ,ni ] and TQi = [ti ,0 ·Bi ,1 ·. . .·Bi ,ni ·ti ,ni ]. ·! (si ,0 , Ai ,1 , . . . , Ai ,ni , si ,ni )
!
· (ti ,0 , Bi ,1 , . . . , Bi ,ni , ti ,ni ) Furthermore, SQi and TQ i have nonempty languages. By Lemma 8, ·! (si ,0 , Ai ,1 , . . . , Ai ,
tj,0 , Bj,1 , . . . , Bj,n j , tj,n j )
As SQ i and TQi are strongly unambiguous, we know Ai ,j and Bi ,j are strongly unambiguous. So,
as ·! (si ,0 , Ai ,1 , . . . , Ai ,ni , si ,ni · tj,0 , Bj,1 , . . . , Bj,n j , tj,n j ), SQi ⊙ TQ j is strongly unambiguous.
Furthermore, as SQi ⊙ TQ j is strongly unambiguous and (i 1 , j 1 ) , (i 2 , j 2 ) ⇒ L(SQi 1 ⊙ SQ j1 ) ∩
L(SQi 2 ⊙ SQ j2 ) = {}, then hSQ 1 ⊙ TQ 1 | . . . | SQn ⊙ TQm i.
Case 5 (Or). Let S = S1 | S2 be strongly unambiguous.
If L(S) = {}, by Lemma 44, ⇓S = hi, which is strongly unambiguous.
Otherwise, S1 and S2 are strongly unambiguous, and L(S1 ) ∩ L(S2 ) = {}. This means ⇓ S1 and
⇓S2 are also strongly unambiguous, by IH.

SQ i
if i ≤ n
.
Let ⇓ S1 = hSQ 1 | . . . | SQn i. Let ⇓ S2 = hTQ 1 | . . . | TQn i. Let SQi′ =
TQ i −n otherwise
As ⇓ S1 and ⇓ S2 are strongly unambiguous, i , j ⇒ L(SQi ) ∩ L(SQ j ) = {} and i , j ⇒
Ð
Ð
L(TQi ) ∩ L(TQ j ) = {}. Furthermore, as i ∈[1,n] L(SQi ) ∩ j ∈[1,m] L(SQ j ), from Lemma 10, i ,
j ⇒ L(SQi′ ) ∩ L(SQ ′j ) = {}, and as each SQi and TQi is strongly unambiguous, ⇓ S1 ⊕ ⇓ S2 is
strongly unambiguous.

Lemma 46. If DS = hSQ 1 | . . . | SQn i is strongly unambiguous, and for all i, ⇑ SQi is strongly
unambiguous, then ⇑DS is strongly unambiguous.
Proof. By induction on n
Case 1 (n = 0). ⇑ hi = ∅, which is strongly unambiguous.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:58

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Case 2 (n > 0). ⇑SQ1 | . . . | SQn =⇑SQ1 | . . . | SQ n−1 | ⇑SQn . By IH, ⇑SQ1 | . . . | SQn−1 is strongly
unambiguous. Furthermore, as DS is strongly unambiguous, by Lemma 10, L(⇑SQ1 | . . . | SQ n−1 )∩ ⇑
SQn = ∅, so ⇑SQn is strongly unambiguous, so the entire thing is strongly unambiguous.

Lemma 47. If SQ = [s0 · A1 · . . . · An · sn ] is strongly unambiguous, and for all i, ⇑ Ai is strongly
unambiguous, then ⇑SQ is strongly unambiguous.
Proof. By induction on n
Case 1 (n = 0). ⇑[s0 ] = s0 , which is strongly unambiguous.
Case 2 (n > 0). ⇑s0 · A1 · . . . · An · sn =⇑s0 · A1 · . . . · An−1 · sn−1 · ⇑An · ⇑sn . From ⇑An and ⇑sn , we
know ⇑ An ·! sn because the second part will always be sn , so the ﬁrst part must be the same. By
IH, ⇑SQ 1 | . . . | SQn−1 is strongly unambiguous. Furthermore, as SQ is strongly unambiguous, by
Lemma 8, L(⇑s0 · A1 · . . . · An−1 · sn−1 ) ·! (⇑An · ⇑sn ), so as each side is also is strongly unambiguous,
the entire thing is strongly unambiguous.

Lemma 48.
• If DS is strongly unambiguous as a DNF regular expression, then ⇑ DS is strongly unambiguous as a regular expression
• If SQ is strongly unambiguous as a sequence, then ⇑ SQ is strongly unambiguous as a
sequence
• If A is strongly unambiguous as an atom, then ⇑A is strongly unambiguous as an atom
Proof.
Case 1 (MultiOr). Let DS = hSQ 1 | . . . | SQn i. By IH, ⇑SQi is strongly unambiguous. By Lemma 46,
⇑DS is strongly unambiguous.
Case 2 (MultiConcat). Let SQ = [s0 · A1 · . . . · An · sn ]. By IH, ⇑ Ai is strongly unambiguous. By
Lemma 47, ⇑SQ is strongly unambiguous.
Case 3 (StarAtomType). Let A = DS ∗ . By IH, ⇑ DS is strongly unambiguous. As DS ∗ is strongly
unambiguous, DS ∗! , so L(DS)∗! , so (⇑DS)∗! . So DS ∗ is strongly unambiguous.

Deﬁnition 13 (Parallel Rewriting Without Reordering).
Atom UnrollstarL

Atom UnrollstarR

∗
DS ∗ →
k A h[ϵ]i ⊕ (DS ⊙ h[DS ]i)

∗
DS ∗ →
k A h[ϵ]i ⊕ (h[DS ]i ⊙ DS)

Parallel Atom Structural Rewrite
′
DS →
k DS

′∗
DS ∗ →
k A h[DS ]i

Parallel DNF Structural Rewrite

DS = hSQ 1 | . . . | SQn i
∀i.SQi = [si ,0 · Ai ,1 · . . . · Ai ,ni · si ,ni ]
∀i, j.Ai ,j →
k A DS i ,j
∀i.DSi = h[si ,0 ]i ⊙ DSi ,1 ⊙ . . . ⊙ DSi ,ni ⊙ h[si ,ni ]i
DS →
k DS 1 ⊕ . . . ⊕ DS n
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Identity Rewrite

DS →
k DS

Synthesizing Bijective Lenses

1:59

Deﬁnition 14 (Parallel Rewriting With Reordering).
Atom UnrollstarL

Atom UnrollstarR n

swap
DS ∗ →
k A h[ϵ]i

DS ∗ →
k A

swap

⊕ (DS ⊙ h[DS ∗ ]i)

DNF Reorder

Parallel Swap Atom Structural Rewrite
swap
DS →
k
DS ′

DS

∗

h[ϵ]i ⊕ (h[DS ∗ ]i ⊙ DS)
σ ∈ Sn

swap
′∗
→
k A h[DS ]i

swap
hSQ 1 | . . . | SQn i →
k
hSQ σ (1) | . . . | SQ σ (n) i

Parallel Swap DNF Structural Rewrite

DS = hSQ 1 | . . . | SQn i
∀i.SQi = [si ,0 · Ai ,1 · . . . · Ai ,ni · si ,ni ]
swap
∀i.DSi = h[si ,0 ]i ⊙ DSi ,1 ⊙ . . . ⊙ DS i ,ni ⊙ h[si ,ni ]i
∀i, j.Ai ,j →
k A DS i ,j
swap
DS →
k
DS 1 ⊕ . . . ⊕ DSn

Identity Rewrite
swap
DS →
k
DS

∗
∗
Lemma 49 ( →
k Maintained Under Iteration). Let DS →
k DT , then h[DS ]i →
k h[DT ]i.

Proof. Consider the derivation
DS →
k DT
∗

∗
DS →
k A h[DT ]i
∗
h[DS ∗ ]i →
k h[DT ]i


Lemma 50. If DS →
k DS through an application of Identity Rewrite, then DS →
k DS through an
application of Parallel DNF Structural Rewrite.
Proof. Let DS →
k DS through an application of Identity Rewrite.
Let DS = hSQ 1 | . . . | SQn i. Let SQi = [si ,0 · Ai ,1 · . . . · Ai ,ni · si ,ni ]. By Lemma 70, Ai ,j →
k A D(Ai ,j ).
Deﬁne DSi ,j as D(DSi ,j )
Deﬁne DSi as h[si ,0 ]i ⊙ DS i ,1 ⊙ . . . ⊙ DS i ,ni ⊙ h[si ,ni ]i, so as DS i ,j = D(Ai ,j ), through the deﬁnition
of ⊙, DN FReдex i = hSQ i i.
By the deﬁnition of ⊕, hSQ 1 i ⊕ . . . ⊕ hSQ n i = hSQ 1 | . . . | SQn i = DS.
DS = hSQ 1 | . . . | SQn i
∀i.SQi = [si ,0 · Ai ,1 · . . . · Ai ,ni · si ,ni ]
∀i, j.Ai ,j →
k A DS i ,j
∀i.DSi = h[si ,0 ]i ⊙ DSi ,1 ⊙ . . . ⊙ DSi ,ni ⊙ h[si ,ni ]i
DS →
k DS 1 ⊕ . . . ⊕ DS n
So DS →
k DS, with the ﬁnal rule being an application of Identity Rewrite.



Lemma 51 ( →
k Maintained Under ⊕). Let DS →
k DS ′ and DT →
k DT ′ then DS ⊕ DT →
k DS ′ ⊕ DT ′ .
Proof. By Lemma 50, a derivation with the ﬁnal rule being an application of Identity Rewrite,
can be converted into a derivation with the ﬁnal rule being an application of Parallel DNF Structural Rewrite. So we can assume that the ﬁnal rule of each is an application of Parallel DNF
Structural Rewrite.
DS = hSQ 1 | . . . | SQn i
∀i.SQi = [si ,0 · Ai ,1 · . . . · Ai ,ni · si ,ni ]
∀i, j.Ai ,j →
k A DS i ,j
∀i.DSi = h[si ,0 ]i ⊙ DSi ,1 ⊙ . . . ⊙ DSi ,ni ⊙ h[si ,ni ]i
DS →
k DS 1 ⊕ . . . ⊕ DS n
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:60

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

DT = hTQ 1 | . . . | SQm i
∀i.TQi = [ti ,0 · Bi ,1 · . . . · Bi ,mi · ti ,mi ]
∀i, j.Bi ,j →
k A DT i ,j
∀i.DT i = h[ti ,0 ]i ⊙ DT i ,1 ⊙ . . . ⊙ DT i ,ni ⊙ h[ti ,ni ]i

Deﬁne Ai′′,j =
Deﬁne si′′,j =
Deﬁne ni′′ =





DT →
k DT 1 ⊕ . . . ⊕ DT n
Ai ,j

if i ≤ n

Bi −n,j if i > n
si ,j
if i ≤ n

ti −n,j

ni
mi −n

if i > n
if i ≤ n
if i > n

Deﬁne SQi′′ = [si′′,0 · Ai′′,1 · . . . · Ai′′,n′′ · si′′,n′′ ]. By inspection, SQ i′′ =



if i ≤ n

SQi

TQi −n
′′
Deﬁne DS ′′ = hSQ 1′′ | . . . | SQn+m
i. By inspection, DS ′′ = DS ⊕ DT .

DS i ,j
if i ≤ n
′′
′′
Deﬁne DSi ,j =
. By inspection Ai′′,j →
k DS i ,j .
DT i −n,j if i > n
i

Deﬁne

DSi′′

as

h[si′′,0 ]i

DS 1′′

⊙

DS i′′,1

i

⊙...⊙

′′
DS n+m

DSi′′,n′′
i

⊙

h[si′′,n′′ ]i.
i

By inspection,

DSi′′

if i > n

=



.

DS i

if i ≤ n

DT i −n if i > n
= (DS 1 ⊕ . . . ⊕ DSn ⊕ DT 1 ⊕ . . . ⊕ DT m ) = DS ′ ⊕ DT ′ .

.

This means that
⊕ ... ⊕
Consider the derivation
′′
i
∀i.SQi′′ = [si′′,0 · Ai′′,1 · . . . · Ai′′,n′′ · si′′,n′′ ]
DS ′′ = hSQ 1′′ | . . . | SQ n+m
i
i
′′
′′
′′
∀i, j.Ai ,j →
k A DS i ,j
∀i.DSi = h[si′′,0 ]i ⊙ DSi′′,1 ⊙ . . . ⊙ DSi′′,ni ⊙ h[si′′,n′′ ]i
i

′′
′′
DS ′′ →
k DS 1 ⊕ . . . ⊕ DS n+m


∗
∗
Lemma 52 ( →
k ∗ Maintained Under Iteration). Let DS →
k ∗ DT , then D(DS ) →
k ∗ D(DT ).

Proof. By induction on the derivation of →
k ∗.
Case 1 (Reflexivity).
∗
DS →
k DS

By reﬂexivity rule
∗
∗
D(DS ∗ ) →
k D(DS )

Case 2 (Base).
DS →
k DT
∗
DS →
k DT

By Lemma 49, D(DS ∗ ) →
k D(DT ∗ )
Consider the derivation

∗
D(DS ∗ ) →
k D(DT )
∗
∗
D(DS ∗ ) →
k D(DT )

Case 3 (Transitivity).
∗
′
DS →
k DS

∗
DS ′ →
k DT

∗
DS →
k DT

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:61

∗
∗
By IH, D(DS∗ ) →
k ∗ D(DS ′ ) and D(DS ′ ) →
k ∗ D(DT ∗ ).


Lemma 53 (Equivalence of ⇑ ◦ ⇓). (⇑ ◦ ⇓)S ≡s S
Proof. By induction on the structure of S
Case 1 (Base). (⇑ ◦ ⇓)s =⇑ h[s]i = ∅ | s
∅ | s ≡s s.
Case 2 (Empty). (⇑ ◦ ⇓)∅ =⇑ hi = ∅
∅ ≡s ∅.
Case 3 (Star). (⇑ ◦ ⇓)S ′∗ =⇑ h[ϵ · (⇓S ′)∗ · ϵ]i = ∅ | (ϵ · ((⇑ ◦ ⇓)S ′)∗ · ϵ) Then, through application of
equational theory transitivity, + Ident, · IdentL , and · IdentR , We get (⇑ ◦ ⇓)S ′∗ ≡s ((⇑ ◦ ⇓)S ′)∗ . By
application of the IH, and transitivity, we get (⇑ ◦ ⇓)S ′∗ ≡s S ′∗
Case 4 (Concat). Let (⇑ ◦ ⇓)(S1 · S2 ) =⇑ (⇓ S1 ⊙ ⇓ S2 ). Let ⇓ S1 = hSQ 1 | . . . | SQn i and ⇓ S2 =
hTQ 1 | . . . | SQm i.
S1 ≡s (⇑ ◦ ⇓)(S1 ) = (∅ | (⇑ SQ 1 | (. . . | (⇑ SQn ) . . .))) ≡s ⇑ SQ 1 | . . . | ⇑ SQ n and S2 ≡s (⇑ ◦ ⇓
)(S2 ) = (∅ | (⇑TQ1 | (. . . | (⇑TQm ) . . .))) ≡s ⇑TQ 1 | . . . | ⇑TQm .
So by structural Concat identity, and transitivity, S1 · S2 ≡s (⇑SQ1 | . . . | ⇑SQn ) · (⇑TQ1 | . . . | ⇑
TQm ).
Through repeated application of DistR and DistL , S1 · S2 ≡s (⇑SQ1 · ⇑TQ 1 | . . . | ⇑SQn · ⇑TQm ).
Now, I want to show ⇑ SQ i · ⇑ TQ j ≡s ⇑ (SQi ⊙ TQ j ). Let SQi = [si ,0 · Ai ,1 · . . . · Ai ,ni · si ,ni ], and
TQ j = [tj,0 ·Bj,1 ·. . .·Aj,m j ·sj,n j ]. ⇑(SQi ⊙ SQ j ) =⇑[si ,0 ·Ai ,1 ·. . .·Ai ,ni ·si ,ni · tj,0 ·Bj,1 ·. . .·Aj,m j ·sj,n j ] =
si ,0 · (Ai ,1 · (. . . · si ,ni · tj,0 · (Bj,1 · (. . . · (Aj,n j · sj,n j ) . . .)) . . .)) So through repeated application of ·
Assoc, ⇑(SQi ⊙ SQ j ) ≡s (si ,0 · (Ai ,1 · (. . . · (Ai ,ni · si ,ni ) . . .))) · (tj,0 · (Bj,1 · (. . . · (Bj,n j · sj,n j ) . . .))).
Because of this S1 · S2 ≡s ⇑ (SQ 1 ⊙ TQ 1 ) | . . . | ⇑ (SQn ⊙ TQ n ). Through repeated application
of | Assoc, and + Ident, S1 · S2 ≡s ∅ | (⇑ (SQ 1 ⊙ TQ 1 ) | . . . (⇑ (SQn ⊙ TQm )) . . .). Furthermore,
∅ | (⇑(SQ1 ⊙ TQ 1 ) | . . . (⇑(SQn ⊙ TQm )) . . .) =⇑ hSQ 1 ⊙SQ TQ 1 | . . . | SQn · TQm i = (⇑ ◦ ⇓)(S1 · S2 )
as desired.
Case 5 (Or). Let (⇑ ◦ ⇓)(S1 | S2 ) =⇑ (⇓ S1 ⊕ ⇓ S2 ). Let ⇓ S1 = hSQ 1 | . . . | SQn i and ⇓ S2 =
hTQ 1 | . . . | TQm i. So (⇑ ◦ ⇓)(S1 | S2 ) =⇑ hSQ 1 | . . . | SQn | TQ 1 | . . . | TQm i = ∅ | (⇑SQ1 | (. . . | (⇑
TQm ) . . .)). Through applying associativity a lot, and + Ident once, I get (⇑ ◦ ⇓)(S1 | S2 ) = (∅ | (⇑
SQ 1 | (. . . | (⇑SQn ) . . .))) | (∅ | (⇑TQ1 | (. . . | (⇑TQm ) . . .))).
(⇑ ◦ ⇓)(S1 | S2 ) = (∅ | (⇑ SQ 1 | (. . . | (⇑ SQn ) . . .))) = (⇑ ◦ ⇓)S1 and (∅ | (⇑ TQ 1 | (. . . | (⇑
TQm ) . . .))) = (⇑ ◦ ⇓)S2 , so by IH (⇑ ◦ ⇓)(S1 | S2 ) = (∅ | (⇑ SQ 1 | (. . . | (⇑ SQn ) . . .))) ≡s S1 and
(∅ | (⇑TQ1 | (. . . | (⇑TQm ) . . .))) ≡s S2 .
Through an application of structural Or equality, (∅ | (⇑ SQ 1 | (. . . | (⇑ SQn ) . . .))) | (∅ | (⇑
TQ 1 | (. . . | (⇑TQm ) . . .))) ≡s S1 | S2 , as desired.

Lemma 54 (Equivalence of Preimage of ⇓). If ⇓S =⇓T , then S ≡s T .
Proof. ⇓S =⇓T , so (⇑ ◦ ⇓)S = (⇑ ◦ ⇓)T . By Lemma 53, S ≡s (⇑ ◦ ⇓)T ≡s T



Lemma 55 (Equivalence of Adjacent Swapping Permutation of Or). Let S1 | . . . | Sn . Let σi be an
adjacent swapping permutation. S1 | . . . | Sn ≡s Sσi (1) | . . . | Sσi (n) .
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:62

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Proof. S1 | . . . | Sn ≡s (S1 | . . . | Si −1 ) | (Si | Si +1 ) | (Si +2 | . . . | Sn ) by repeated application of
associativity.
Si | Si +1 = Si +1 | Si by Or commutativity, so by Or structural equality,
(S1 | . . . | Si −1 ) | (Si | Si +1 ) | (Si +2 | . . . | Sn ) ≡s (S1 | . . . | Si −1 ) | (Si +1 | Si ) | (Si +2 | . . . | Sn )
(S1 | . . . | Si −1 ) | (Si +1 | Si ) | (Si +2 | . . . | Sn ) ≡s Sσi (1) | . . . | Sσi (n) by repeated application of
associativity.
So, by the transitivity of equational theories, S1 | . . . | Sn ≡s Sσi (1) | . . . | Sσi (n) .

swap
Lemma 56 (Expressibility of →
k
in ≡s Up To Preimage).
swap
s
(1) If ⇓S →
k
⇓T , then S ≡ T .
swap
(2) If ⇓S = h[A]i and A →
k A
⇓T then S ≡s T .
swap

Proof. By mutual induction on the derivation of →
k swap and →
k A

.

swap

⇓ T from Atom UnrollstarL . This
Case 1 (Atom UnrollstarL ). Let ⇓ S = h[A]i, and A →
k A
means that A = DS ∗ and ⇓T = h[ϵ]i ⊕ (DS ⊙ h[DS ∗ ]i).
Let S ′ =⇑DS. As ⇓S ′∗ = h[DS ∗ ]i, then from Lemma 54, S ′∗ ≡s S. Similarly, as ⇓(ϵ | (S ′ · S ′∗ )) =
h[ϵ]i ⊕ (DS ⊙ h[DS ∗ ]i), then from Lemma 54, ϵ | (S ′ · S ′∗ ) ≡s T .
So, through an application of UnrollstarLeftRule, S ≡s S ′ ∗ ≡s ϵ | (S ′ · S ′ ∗ ) ≡s T , as desired.
swap

Case 2 (Atom UnrollstarR ). Let ⇓ S = h[A]i, and A →
k A
⇓ T from Atom UnrollstarR . This
means that A = DS ∗ and ⇓T = h[ϵ]i ⊕ (h[DS ∗ ]i ⊙ DS).
Let S ′ =⇑DS. As ⇓S ′∗ = h[DS ∗ ]i, then from Lemma 54, S ′∗ ≡s S. Similarly, as ⇓(ϵ | (S ′∗ · S ′ )) =
h[ϵ]i ⊕ (h[DS ∗ ]i ⊙ DS), then from Lemma 54, ϵ | (S ′∗ · S ′ ) ≡s T .
So, through an application of UnrollstarRightRule, S ≡s S ′∗ ≡s ϵ | (S ′∗ · S ′ ) ≡s T , as desired.
swap

⇓ T This
Case 3 (Parallel Swap Atom Structural Rewrite). Let ⇓ S = h[A]i, and A →
k A
swap
means that A = DS ∗ and ⇓T = h[DT ])i where DS →
k
DT .
Let ⇑ DS = S ′ and ⇑ DT = T ′ . By induction assumption, S ′ ≡s T ′ . By structural equivalence,
∗
′
S = T ′ ∗ . As ⇓ S ′∗ = h[DS ∗ ]i, from Lemma 54, S ′ ∗ ≡s S. As ⇓ T ′ ∗ = h[DT ∗ ]i, from Lemma 54,
T ′∗ ≡s T .
S ≡s S ′ ∗ ≡s T ′ ∗ ≡s T , as desired.
Case 4 (DNF Reorder). Let ⇓ S →
k swap ⇓ T , and the last step of the proof is an application of
DNF Reorder. Let ⇓S = hSQ 1 | . . . | SQn i. Then, for some σ ∈ Sn , ⇓T = hSQ σ (1) | . . . | SQ σ (n) i.
⇑⇓S =⇑SQ 1 | . . . | ⇑SQn and ⇑⇓T =⇑SQσ (1) | . . . | ⇑SQ σ (n) .
σ can then be broken down into a number of adjacent swapping permutations, σi 1 ◦. . . ◦σim = σ
By Lemma 55, each σi j can be applied to a sequence of Ors.
Consider the derivation
⇑SQ 1 | . . . | ⇑SQn ≡s ⇑SQ 1 | . . . | ⇑SQn
··
·
⇑SQσim (1) | . . . | ⇑SQσim (n) ≡s ⇑SQ 1 | . . . | ⇑SQn
··
·
⇑SQ(σi

1 ◦...◦σ im )(1)

| . . . | ⇑SQ (σi

1 ◦...◦σ im )(n)

≡s ⇑SQ 1 | . . . | ⇑SQn

So, by Lemma 54, S ≡s ⇑⇓S and ⇑⇓T ≡s T . Furthermore, ⇑⇓S ≡s ⇑⇓T . So by the transitivity of an
equational theory, S ≡s T .
Case 5 (Identity Rewrite). Let ⇓S →
k swap ⇓T by an application of Identity Rewrite.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:63

That means ⇓S =⇓T .
So, by Lemma 54, That means that S ≡s ⇑⇓S ≡s T
Case 6 (Parallel Swap DNF Structural Rewrite). Let ⇓ S →
k swap ⇓ T by an application of
Parallel Swap DNF Structural Rewrite.
⇓S = hSQ 1 | . . . | SQn i
∀i.SQi = [si ,0 · Ai ,1 · . . . · Ai ,ni · si ,ni ]
swap
∀i.DSi = h[si ,0 ]i ⊙ DSi ,1 ⊙ . . . ⊙ DS i ,ni ⊙ h[si ,ni ]i
∀i, j.Ai ,j →
k A DS i ,j
swap
S→
k
DS 1 ⊕ . . . ⊕ DSn

⇓T = DS 1 ⊕ . . . ⊕ DSn .
swap
Ai ,j →
k A DS i ,j , ⇓⇑D(Ai ,j ) = D(Ai ,j ), and ⇓⇑DSi ,j = DS i ,j , so by IH, ⇑D(Ai ,j ) ≡s ⇑DSi ,j .
Consider the regular expressions Si = si ,0 · ⇑D(Ai ,1 ) · . . . · ⇑D(Ai ,ni ) · si ,ni .
Consider the regular expressions Ti = si ,0 · ⇑DSi ,j · . . . · ⇑DSi ,ni · si ,ni .
By structural equality of Concat, Si ≡s Ti .
Consider the regular expression S ′ = S1 ⊕ . . . ⊕ Sn and the regular expression T ′ = T1 | . . . | Tn .
By structural equality of Or, S ′ ≡s T ′
⇓Si = h[si ,0 ]i ⊙ D(Ai ,1 ) ⊙ . . . ⊙ D(Ai ,ni ) ⊙ h[si ,ni ]i = h[si ,0 · Ai ,1 · . . . · Ai ,ni · si ,ni ]i = hSQ i i
⇓ S ′ =⇓ S1 ⊕ . . . ⊕ ⇓ Sn = hSQ 1 i ⊕ . . . ⊕ hSQ n i = hSQ 1 | . . . | SQ n i. This means, by Lemma 54,
that S ≡s S ′
⇓Ti = h[si ,0 ]i ⊙ DSi ,1 ⊙ . . . ⊙ DSi ,ni ⊙ h[si ,ni ]i = DS i .
⇓T ′ =⇓T1 ⊕ . . . ⊕ ⇓Tn = DS 1 ⊕ . . . ⊕ DS n . This means, by Lemma 54, that T ′ ≡s T
So, S ≡s S ′ ≡s T ′ ≡s T , so by transitivity of equational theories, S ≡s T .

s
s
Lemma 57 (Expressibility of ≡ →
k swap in ≡ ). If ⇓S ≡ →
k swap ⇓T , then S ≡ T .

Proof. By induction on the typing derivation of ≡ →
k swap
Case 1 (Reflexivity). Let ⇓ S ≡ →
k swap ⇓ T , and the last step of the derivation is an application of
Reflexivity.
This means ⇓S =⇓T . That means ⇑⇓S =⇑⇓T . By Lemma 54, S ≡s ⇑⇓S. By Lemma 54, ⇑⇓T ≡s = T .
By the transitivity of equational theories, S ≡s T .
Case 2 (Base). Let ⇓S ≡ →
k swap ⇓T , and the last step of the derivation is an application of Base.
swap
This means that ⇓S →
k
⇓T .
By Lemma 56, S ≡s T .
Case 3 (Symmetry). Let ⇓S ≡ →
k swap ⇓T , and the last step of the derivation is an application of Base.
This means that ⇓S →
k swap ⇓T .
By Lemma 56, S ≡s T .

swap
swap
swap
Lemma 58 (Propagation of →
k
through ⊕ on the left). If DS →
k
DS ′, then DS⊕DT →
k
DS ′ ⊕
DT
swap
Proof. This will be done by cases on the last step of the derivation of →
k
′
Case 1 (DNF Reorder). Let DS →
k swap DS by an application of DNF Reorder. This means, for
some SQ 1 , . . . , SQn , and some σ ∈ Sn , DS = hSQ 1 | . . . | SQ n i and DS ′ = hSQ σ (1) | . . . | SQ σ (n) i.

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:64

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

The DNF regular expression DT = hTQ 1 | . . . | TQm i for some TQ 1 , . . . , TQm . Let id m be the

SQ i
if i ≤ n
′
′
identity permutation on m elements. Deﬁne σ = σ ⊙ idm . Deﬁne SQi =
.
TQ i −n otherwise
′
′
hSQ 1 | . . . | SQ n+m i = DS ⊕ DT .
hSQ σ′ ′(1) | . . . | SQ σ′ ′(n+m) i = hSQ σ (1) | . . . | SQ σ (n) | TQ 1 | . . . | TQm i = DS ′ ⊕ DT .
Consider the derivation
′
swap
hSQ 1′ | . . . | SQn+m
i→
k
hSQ σ′ ′(1) | . . . | SQ σ′ ′(n+m) i

as desired.
′
Case 2 (Parallel Swap Atom Structural Rewrite). Let DS →
k swap DS by an application of Parallel Swap Atom Structural Rewrite.
DS = hSQ 1 | . . . | SQn i
∀i.SQi = [si ,0 · Ai ,1 · . . . · Ai ,ni · si ,ni ]
swap
∀i.DSi = h[si ,0 ]i ⊙ DSi ,1 ⊙ . . . ⊙ DS i ,ni ⊙ h[si ,ni ]i
∀i, j.Ai ,j →
k A DS i ,j
swap
DS →
k
DS 1 ⊕ . . . ⊕ DS n

Let DT = hTQ 1 | . . . | TQm i. Let TQi = [ti ,0 · Bi ,1 · . . . · Bi ,mi · ti ,mi ].

ni if i ≤ n
Let ki =
mi otherwise

SQi
if i ≤ n
′′
Let SQ i′′ =
. Let DS ′′ = DS ⊕ DT = hSQ 1′′ | . . . | SQn+m
i. Let Ai′′,j =
TQi −n otherwise


Ai ,j
if i ≤ n
si ,j
if i ≤ n
Let si′′,j =
Bi −n,j otherwise
ti −n,j otherwise

DSi ,j
if i ≤ n
Let DSi′′,j =
D(Bi −n,j ) otherwise
swap
If i ≤ n, by assumption Ai′′,j = Ai ,j →
k A DS i ,j = DS i′′,j . If i > n, by Parallel Swap Atom
swap
′′
Structural Rewrite, Ai′′,j = Bi −n,j →
k A D(Bi −n,j ) = DS i ,j .

DS i
if i ≤ n
Let DSi′′ =
h[ti −n,0 ]i ⊙ Bi −n,1 · . . . · ⊙Bi −n,mi ⊙ ti −n,mi otherwise
For i > n, DSi′′ = h[ti −n,0 ]i ⊙ Bi −n,1 · . . . · ⊙Bi −n,ki ⊙ ti −n,ki = hTQ i i through application of ⊙ on
many singleton DNF regular expressions.
′′
′′
⊕ . . . ⊕ DSn+m
= hTQ 1 i ⊕ . . . hTQm i = hTQ 1 | . . . | TQm i through repeated application
DSn+1
of ⊕ to singleton DNFs.
′′
′′
As DS 1′′ ⊕ . . . ⊕ DS n′′ = DS 1 ⊕ . . . ⊕ DS n = DS ′, and DS n+1
⊕ . . . ⊕ DSn+m
= DT , we get
′′
′′
′
DS 1 ⊕ . . . ⊕ DSn+m = DS ⊕ DT
Consider the derivation
′′
DS ′′ = hSQ 1′′ | . . . | SQ n+m
i
∀i.SQi′′ = [si′′,0 · Ai′′,1 · . . . · Ai′′,ki · si′′,ki ]
swap
′′
′′
′′
∀i, j.Ai ,j →
k A DS i ,j
∀i.DSi = h[si′′,0 ]i ⊙ DSi′′,1 ⊙ . . . ⊙ DSi′′,ni ⊙ h[si′′,ki ]i
swap
′′
DS ′′ →
k
DS 1′′ ⊕ . . . ⊕ DSn+m

as desired.

Lemma 59 (Propagation of
DS ⊙ DT →
k swap DS ′ ⊙ DT

→
k swap

through ⊕ on the right). If

Proof. Proceeds as Lemma 58, but on the right.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

′
DS →
k swap DS ,

then


Synthesizing Bijective Lenses

1:65

′
Lemma 60 (Propagation of ≡ →
k swap through ⊕ on the left). If DS ≡ →
k swap DS , then DS ⊕ DT ≡ →
k swap
′
DS ⊕ DT
′
Proof. By induction on the last step of the derivation of DS ≡ →
k swap DS .
′
′
Case 1 (Reflexivity). If DS ≡ →
k swap DS through an application of Reflexivity, then DS = DS.
So, through reﬂexivity, DS ⊕ DT ≡ →
k swap DS ⊕ DT
′
′
swap
Case 2 (Base). If DS ≡ →
k
DS. From
k swap DS through an application of Reflexivity, then DS →
′
′
swap
Lemma 58 DS ⊕ DT →
k swap DS ⊕ DT , so DS ⊕ DT ≡ →
DS
⊕
DT
.
k
′
Case 3 (Transitivity). If DS ≡ →
k swap DS through an application of Transitivity, then there
′′
′′
′′
′
′′
exists a DS such that DS ≡ →
k swap DS and DS ≡ →
k swap DS . By IH, DS ⊕ DT ≡ →
k swap DS ⊕ DT
′′
′
and DS ⊕ DT ≡ →
k swap DS ⊕ DT .
This gives us the derivation
′′
DS ⊕ DT ≡ →
k swap DS ⊕ DT

′
DS ′′ ⊕ DT ≡ →
k swap DS ⊕ DT

′
DS ⊕ DT ≡ →
k swap DS ⊕ DT


′
Lemma 61 (Propagation of ≡ →
k swap through ⊕ on the right). If DS ≡ →
k swap DS , then DS⊕DT ≡ →
k swap
′
DS ⊕ DT

Proof. Proceeds as Lemma 60, but on the right.



′
′
Lemma 62 (Propagation of ≡ →
k swap through ⊕). If DS ≡ →
k swap DS and DT ≡ →
k swap DT , then
′
′
DS ⊕ DT ≡ →
k swap DS ⊕ DT .
′
′
′
′
Proof. By Lemma 60, DS ⊕ DT ≡ →
k swap DS ⊕ DT . By Lemma 61, DS ⊕ DT ≡ →
k swap DS ⊕ DT .
Consider the derivation
′
′
′
DS ⊕ DT ≡ →
DS ′ ⊕ DT ≡ →
k swap DS ⊕ DT
k swap DS ⊕ DT
′
′
DS ⊕ DT ≡ →
k swap DS ⊕ DT


′
′
Lemma 63 (Propagation of →
k swap through ⊙ on the left). If DS →
k swap DS , then DS⊙DT →
k swap DS ⊙
DT

Proof. By induction on the derivation of →
k swap .
′
Case 1 (DNF Reorder). Let DS →
k swap DS by an application of DNF Reorder. This means, for
some SQ 1 , . . . , SQn , and some σ ∈ Sn , DS = hSQ 1 | . . . | SQ n i and DS ′ = hSQ σ (1) | . . . | SQ σ (n) i.
The DNF regular expression DT = hTQ 1 | . . . | TQm i for some TQ 1 , . . . , TQm . Let id m be the
identity permutation on m elements. Deﬁne σ ′ = σ ⊗ idm . Deﬁne SQi ,j = SQi ⊙SQ TQ j .
By deﬁnition of ⊙, hSQ 1,1 | . . . | SQn,m i = hSQ 1 ⊙ TQ 1 | . . . | SQ n ⊙ TQm i = DS ⊙ DT .
By the deﬁnition of ⊙ and ⊗, hSQ σ ′(1,1) | . . . | SQ σ ′(n,m) i = hSQ (σ (1),1) | . . . | SQ (σ (n),m) i =
hSQ σ (1) ⊙ TQ 1 | . . . | SQ σ (n) ⊙ TQm i = DS ′ ⊙ DT .
′
Case 2 (Parallel Swap DNF Structural Rewrite). Let DS →
k swap DS by an application of Parallel Swap DNF Structural Rewrite.
DS = hSQ 1 | . . . | SQn i
∀i.SQi = [si ,0 · Ai ,1 · . . . · Ai ,ni · si ,ni ]
swap
∀i.DSi = h[si ,0 ]i ⊙ DSi ,1 ⊙ . . . ⊙ DS i ,ni ⊙ h[si ,ni ]i
∀i, j.Ai ,j →
k A DS i ,j
swap
DS →
k
DS 1 ⊕ . . . ⊕ DS n

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:66

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Let DT = hTQ 1 | . . . | TQm i. Let TQi = [ti ,0 · Bi ,1 · . . . · Bi ,mi · ti ,mi ]. Let SQi′′,j = SQi ⊙SQ SQ j

Ai ,j,k
if k ≤ ni
′′
′′
Let DS ′′ = DS ⊙ DT = hSQ 1,1
| . . . | SQn,m
i. Let Ai′′,j,k =
Let si′′,j,k =
Bi ,j,k−ni otherwise

si ,k
if i < ni




si ,ni · tj,0 if i = ni


 tj,k−ni
otherwise


DSi ,k
if i ≤ ni
′′
Let DSi ,j,k =
D(Bi ,j,k−ni ) otherwise
swap
′′
If k ≤ ni , by assumption Ai′′,j,k = Ai ,j →
k A DS i ,j,k = DS i ,j,k . If k > n i , by Parallel Swap Atom
swap
′′
Structural Rewrite, Ai′′,j,k = Bj,k−ni →
k A D(Bj,k−n i ) = DS i ,j,k .
′′
Let DSi ,j = DSi ⊙ h[ti −n,0 ]i ⊙ Bi −n,1 · . . . · ⊙Bi −n,ni ⊙ ti −n,ni
Through repeated application of ⊙ on singletons, DS i′′,j = DS i ⊙ hTQ j i.
This means DS 0,0 ⊕ . . . ⊕ DSn,m = (DS 1 ⊕ . . . ⊕ DSn ) ⊙ DT = DS ′ ⊙ DT .
Consider the derivation
′′
′′
DS ′′ = hSQ 1,1
| . . . | SQ n,m
i
∀i, j.SQi′′,j = [si′′,j,0 · Ai′′,j,1 · . . . · Ai′′,j,ni +m j · si′′,j,ni +m j ]
swap
′′
′′
′′
∀i, j.DSi ,j = h[si′′,j,0 ]i ⊙ DS i′′,j,1 ⊙ . . . ⊙ DSi′′,j,ni +mi ⊙ h[si′′,j,ni +mi ]i
∀i, j, k.Ai ,j,k →
k A DS i ,j,k
swap
′′
′′
DS ′′ →
k
DS 1,1
⊕ . . . ⊕ DS n,m

as desired.

Lemma 64 (Propagation of
DT ′

→
k swap

through ⊙ on the right). If DT

′
→
k swap DT , then DS⊙DT →
k swap DS⊙

Proof. Proceeds as Lemma 58, but on the right.


′

Lemma 65 (Propagation of ≡ →
k swap through ⊙ on the left). If DS ≡ →
k swap DS , then DS ⊙ DT ≡ →
k swap
DS ′ ⊙ DT
′
Proof. By induction on the last step of the derivation of DS ≡ →
k swap DS .
′
′
Case 1 (Reflexivity). If DS ≡ →
k swap DS through an application of Reflexivity, then DS = DS.
So, through reﬂexivity, DS ⊙ DT ≡ →
k swap DS ⊙ DT
′
′
Case 2 (Base). If DS ≡ →
k swap DS. From
k swap DS through an application of Reflexivity, then DS →
′
′
swap
Lemma 63 DS ⊙ DT →
k
DS ⊙ DT , so DS ⊙ DT ≡ →
k swap DS ⊙ DT .
′
Case 3 (Transitivity). If DS ≡ →
k swap DS through an application of Transitivity, then there
′′
′
′′
swap
exists a DS ′′ such that DS ≡ →
DS
and
DS ′′ ≡ →
k
k swap DS . By IH, DS ⊙ DT ≡ →
k swap DS ⊙ DT
′
swap
and DS ′′ ⊙ DT ≡ →
DS
⊙
DT
.
k
This gives us the derivation
′′
DS ⊙ DT ≡ →
k swap DS ⊙ DT

′
DS ′′ ⊙ DT ≡ →
k swap DS ⊙ DT

′
DS ⊙ DT ≡ →
k swap DS ⊙ DT


′

Lemma 66 (Propagation of ≡ →
k swap through ⊙ on the right). If DS ≡ →
k swap DS , then DS⊙DT ≡ →
k swap
DS ′ ⊙ DT
Proof. Proceeds as Lemma 65, but on the right.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.



Synthesizing Bijective Lenses

1:67

′
′
Lemma 67 (Propagation of ≡ →
k swap through ⊙). If DS ≡ →
k swap DS and DT ≡ →
k swap DT , then
′
′
DS ⊙ DT ≡ →
k swap DS ⊙ DT .
′
′
′
′
Proof. By Lemma 65, DS ⊙ DT ≡ →
k swap DS ⊙ DT . By Lemma 66, DS ⊙ DT ≡ →
k swap DS ⊙ DT .
Consider the derivation
′
′
′
DS ⊕ DT ≡ →
DS ′ ⊕ DT ≡ →
k swap DS ⊕ DT
k swap DS ⊕ DT
′
′
DS ⊕ DT ≡ →
k swap DS ⊕ DT


Lemma 68 (Propagation of ≡ →
k swap through

∗ ).

∗

∗

If DS ≡ →
k swap DT , then D(DS ) ≡ →
k swap D(DT )

Proof. By induction on the derivation of ≡ →
k swap .
Case 1 (Reflexivity). Let DS ≡ →
k swap DT , with the last step of the derivation being Reflexivity.
This means DT = DS. Consider the derivation
∗
D(DS ∗ ) ≡ →
k swap D(DS )

Case 2 (Base). Let DS ≡ →
k swap DT , with the last step of the derivation being Base. That means
DS →
k swap DT . Consider the derivation
swap
DS →
k
DT
swap

DS ∗ →
k A
∗

D(DS ) →
k

D(DT ∗ )

swap

D(DT ∗ )

∗
D(DS ∗ ) ≡ →
k swap D(DT )

Case 3 (Symmetry). Let DS ≡ →
k swap DT , with the last step of the derivation being Symmetry. That
means DT →
k swap DS. Consider the derivation
swap
DT →
k
DS
swap

DT ∗ →
k A

D(DS ∗ )

swap
D(DT ∗ ) →
k
D(DS ∗ )
∗
D(DS ∗ ) ≡ →
k swap D(DT )

Case 4 (Transitivity). Let DS ≡ →
k swap DT , with the last step of the derivation being Transitivity.
That means that, for some DS ′ , the last step of the derivation is
′
DS ≡ →
k swap DS

DS ′ ≡ →
k swap DT

DS ≡ →
k swap DT
′∗
′∗
∗
By induction assumption,
≡→
k swap D(DS ) and D(DS ) ≡ →
k swap D(DT ). Consider the
derivation
′∗
∗
D(DS ∗ ) ≡ →
D(DN FReдex ′∗ ) ≡ →
k swap D(DS )
k swap D(DT )

D(DS ∗ )

∗
D(DS ∗ ) ≡ →
k swap D(DT )


s
Lemma 69 (Expressibility of ≡s in ≡ →
k swap ). If S ≡ T , then ⇓S ≡ →
k swap ⇓T .

Proof. Assume S ≡s T . Prove by induction on the deduction of ≡s
Case 1 (Structural Equality Rule). Let S ≡s T , and the last step of the deduction is an application
of structural equality rule. That means that T = S. Through reﬂexivity, ⇓S ≡ →
k swap ⇓S =⇓T .
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:68

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Case 2 (+ Ident). Let S ≡s T , and the last step of the deduction is an application of + Ident. Without
loss of generality, from symmetry, T = S | ∅.
⇓S | ∅ =⇓S⊕ ⇓∅ =⇓S ⊕ hi =⇓S. Through reﬂexivity, ⇓S ≡ →
k swap ⇓S =⇓S | ∅
Case 3 (0 ProjR ). Let S ≡s T , and the last step of the deduction is an application of 0 ProjR . Without
loss of generality, from symmetry, S = S ′ · ∅, and T = ∅.
⇓S ′ · ∅ =⇓S⊙ ⇓∅ =⇓S ⊙ hi = hi. Through reﬂexivity, ⇓S =⇓∅ ≡s ⇓∅ =⇓T .
Case 4 (0 ProjL ). Let S ≡s T , and the last step of the deduction is an application of 0 ProjR . Without
loss of generality, from symmetry, S = ∅ · S ′ , and T = ∅.
⇓∅ · S ′ =⇓∅⊙ ⇓S = hi⊙ ⇓S = hi. Through reﬂexivity, ⇓S =⇓∅ ≡ →
k swap ⇓∅ =⇓T .
Case 5 (· Assoc). Let S ≡s T , and the last step of the deduction is an application of · Assoc. Without
loss of generality, from symmetry, S = S1 · (S2 · S3 ), and T = (S1 · S2 ) · S3 .
⇓ (S1 · (S2 · S3 )) =⇓ S1 ⊙ (⇓ S2 ⊙ ⇓ S3 ) = (⇓ S1 ⊙ ⇓ S2 )⊙ ⇓ S3 =⇓ (S1 · S2 ) · S3 . Through reﬂexivity,
⇓S =⇓S1 ⊙ (⇓S2 ⊙ ⇓S3 ) ≡ →
k swap ⇓S1 ⊙ (⇓S2 ⊙ ⇓S3 ) =⇓T .
Case 6 ( | Assoc). Let S ≡s T , and the last step of the deduction is an application of | Assoc.
Without loss of generality, from symmetry, S = S1 | (S2 | S3 ), and T = (S1 | S2 ) | S3 .
⇓ (S1 | (S2 · S3 )) =⇓ S1 ⊕ (⇓ S2 ⊕ ⇓ S3 ) = (⇓ S1 ⊕ ⇓ S2 )⊕ ⇓ S3 =⇓ (S1 | S2 ) | S3 . Through reﬂexivity,
⇓S =⇓S1 ⊕ (⇓S2 ⊕ ⇓S3 ) ≡ →
k swap ⇓S1 ⊕ (⇓S2 ⊕ ⇓S3 ) =⇓T .
Case 7 ( | Comm). Let S ≡s T , and the last step of the deduction is an application of | Comm.
S = S1 | S2 , and T = S2 | S1 .
Let ⇓S1 = hSQ 1 | . . . | SQ n i and ⇓S2 = hTQ 1 | . . . | SQm i. hSQ 1 | . . . | SQn i⊕hTQ 1 | . . . | SQm i =
hSQ 1 | . . . | SQ n | TQ 1 | . . . | TQm i.
hTQ 1 | . . . | SQm i ⊕ hSQ 1 | . . . | SQn i = hTQ 1 | . . . | TQn | SQ 1 | . . . | SQm i.

SQ i
if i ∈ [1, n]
Let SQi′ =
TQ i −n if i ∈ [n + 1, m]
Consider the deduction
id n sidm ∈ Sn+m
′
swap
′
′
hSQ 1′ | . . . | SQn+m
i→
k
hSQ id
| . . . | SQ id
i
n sid m (1)
n sid m (n+m)
′′
hSQ 1′′ | . . . | SQn+m
i

′
′
hSQ id
| . . . | SQ id
i
n sid m (1)
n sid m (n+m)

=
=

hSQ 1 | . . . | SQn | TQ 1 | . . . | TQn i
⇓S1 ⊕ ⇓S2

=
=
=
=

′
′
′
hSQ id
| . . . | SQ id
| SQ id
| . . . | SQ id n (n) i
m (1)+n
m (m)+n
n (1)
′
′
hSQ n+1 | . . . | SQ n+m | SQ 1 | . . . | SQn′ i
hTQ 1 | . . . | TQm | SQ 1 | . . . | SQ n i
⇓S2 ⊕ ⇓S1

swap
So ⇓S1 ⊕ ⇓S2 →
k
⇓S2 ⊕ ⇓S1 , which means ⇓S1 ⊕ ⇓S2 ≡ →
k swap ⇓S2 ⊕ ⇓S1

Case 8 (DistR ). Let S ≡s T , and the last step of the deduction is an application of DistR . Without
loss of generality, from symmetry, S = S1 · (S2 | S3 ), and T = (S1 · S2 ) | (S1 · S3 ).
Let ⇓S1 = hSQ 1,1 | . . . | SQ 1,n1 i. Let ⇓S2 = hSQ 2,1 | . . . | SQ 2,n2 i. Let ⇓S3 = hSQ 3,1 | . . . | SQ 3,n3 i.
⇓(S1 · (S2 | S3 )) =
=
=

⇓S1 ⊙ (⇓S2 ⊕ ⇓S3 )
⇓S1 ⊙ hSQ 2,1 | . . . | SQ 2,n2 | SQ 3,1 | . . . | SQ 3,n3 i
hSQ 1,1 ⊙SQ SQ 2,1 | . . . | SQ 1,1 ⊙SQ SQ 3,n3 | . . .
| SQ 1,n1 ⊙SQ SQ 2,n2 | . . . | SQ 1,n1 ⊙SQ SQ 3,n3 i

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:69

⇓((S1 · S2 ) | (S1 · S3 )) =
=

(⇓S1 ⊙ ⇓S2 ) ⊕ (⇓S1 ⊙ ⇓S3 )
hSQ 1,1 ⊙SQ SQ 2,1 | . . . | . . . | SQ 1,n1 ⊙SQ SQ 2,n2 i⊕
hSQ 1,1 ⊙SQ SQ 3,1 | . . . | . . . | SQ 1,n1 ⊙SQ SQ 3,n3 i
= hSQ 1,1 ⊙SQ SQ 2,1 | . . . | . . . | SQ 1,n1 ⊙SQ SQ 2,n2
| SQ 1,1 ⊙SQ SQ 3,1 | . . . | . . . | SQ 1,n1 ⊙SQ SQ 3,n3 i
So ⇓ (S1 · (S2 | S3 )) is diﬀerent from ⇓ ((S1 · S2 ) | (S1 · S3 )) only by the diﬀerence in the ordering
of the sequences.
Through using DNFReorderRule, ⇓(S1 · (S2 | S3 )) →
k swap ⇓((S1 · S2 ) | (S1 · S3 )), so through the base
rule, ⇓(S1 · (S2 | S3 )) ≡ →
k swap ⇓((S1 · S2 ) | (S1 · S3 )).
Case 9 (DistL ). Let S ≡s T , and the last step of the deduction is an application of DistL . Without
loss of generality, from symmetry, S = (S1 | S2 ) · S3 , and T = (S1 · S3 ) | (S2 · S3 ).
⇓(S1 | S2 ) · S3 = (⇓S1 ⊕ ⇓S2 )⊙ ⇓S3 = (⇓S1 ⊙ ⇓S3 ) ⊕ (⇓S2 ⊙ ⇓S3 ) =⇓(S1 · S3 ) | (S2 · S3 ).
Through reﬂexivity, ⇓S =⇓((S1 | S2 ) · S3 ) ≡ →
k swap ⇓(S1 · S3 ) | (S2 · S3 ) =⇓T
Case 10 (· IdentL ). Let S ≡s T , and the last step of the deduction is an application of DistL . Without
loss of generality, from symmetry, S = S ′ · ϵ, and T = S ′ .
⇓(S ′ · ϵ) =⇓S ′ ⊙ ⇓ϵ =⇓S ′ ⊙ h[ϵ]i =⇓S ′.
′
Through reﬂexivity, ⇓S =⇓(S ′ · ϵ) ≡ →
k swap ⇓S =⇓T
Case 11 (· IdentR ). Let S ≡s T , and the last step of the deduction is an application of DistL . Without
loss of generality, from symmetry, S = ϵ · S ′ , and T = S ′ .
⇓(ϵ · S ′ ) =⇓ϵ ⊙ ⇓S ′ = h[ϵ]i⊙ ⇓S ′ =⇓S ′
′
Through reﬂexivity, ⇓S =⇓(ϵ · S ′ ) ≡ →
k swap ⇓S =⇓T
Case 12 (UnrollstarL ). Let S ≡s T , and the last step of the deduction is an application of UnrollstarL .
Without loss of generality, from symmetry, S = S ′∗ , and T = ϵ | (S ′ · S ′∗ ).
⇓S ′∗ = D((⇓S ′)∗ ). ⇓(ϵ | (S ′ · S ′∗ )) = h[ϵ]i ⊕ (⇓S ′ ⊙ D((⇓S ′)∗ )).
∗
k swap ⇓(ϵ | (S ′ · S ′ )) =⇓T .
Through Atom UnrollstarL , ⇓S =⇓S ′∗ →
Case 13 (UnrollstarR ). Let S ≡s T , and the last step of the deduction is an application of UnrollstarR .
Without loss of generality, from symmetry, S = S ′∗ , and T = ϵ | (S ′∗ · S ′ ).
⇓S ′∗ = D((⇓S ′)∗ ). ⇓(ϵ | (S ′∗ · S ′ )) = h[ϵ]i ⊕ (D((⇓S ′)∗ )⊙ ⇓S ′).
Through Atom UnrollstarR , ⇓S =⇓S ′∗ →
k swap ⇓(ϵ | (S ′∗ · S ′ )) =⇓T .
Case 14 (Structural Or Equality). Let S ≡s T , through structural equality of Or. S = S1 | S2 , and
T = T1 | T2 , S1 ≡s T1 , and S2 ≡s T2 .
By induction assumption, ⇓S1 ≡ →
k swap ⇓T1 and ⇓S2 ≡ →
k swap ⇓T2 .
By Lemma 62, ⇓S1 ⊕ ⇓S2 ≡ →
k swap ⇓T1 ⊕ ⇓T2 . By the deﬁnition of ⇓ , ⇓(S1 | S2 ) ≡ →
k swap ⇓(T1 | T2 ),
as desired.
Case 15 (Structural Concat Equality). Let S ≡s T , through structural equality of Concat. S = S1 · S2 ,
and T = T1 · T2 , S1 ≡s T1 , and S2 ≡s T2 .
By induction assumption, ⇓S1 ≡ →
k swap ⇓T1 and ⇓S2 ≡ →
k swap ⇓T2 .
swap
By Lemma 67, ⇓ S1 ⊙ ⇓ S2 ≡ →
⇓
T
⊙
⇓
T
.
By
the
deﬁnition
of ⇓ , ⇓ (S1 · S2 ) ≡ →
1
2
k
k swap ⇓ (T1 · T2 ),
as desired.
Case 16 (Structural Star Equality). Let S ≡s T , through structural equality of Star. S = S ′∗ , T = T ′∗ ,
and S ′ ≡s T ′ .
′
By induction assumption, ⇓S ′ ≡ →
k swap ⇓T .
∗
∗
′
′
′∗
swap
By Lemma 68, D(⇓S ) ≡ →
D(⇓S ). By the deﬁnition of ⇓ , ⇓S ′∗ ≡ →
k
k swap ⇓T , as desired.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:70

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Case 17 (Transitivity of Equational Theory). Let S ≡s T through the transitivity of an equational
theory. This means there exists a S ′ such that S ≡s S ′ and S ′ ≡s T .
′
′
By induction assumption, ⇓S ≡ →
k swap ⇓S and ⇓S ≡ →
k swap ⇓T .
Consider the derivation
′
⇓S ≡ →
⇓S ′ ≡ →
k swap ⇓S
k swap ⇓T
⇓S ≡ →
k swap ⇓T

s
s
Theorem 8 (Equivalence of ≡ →
k swap and ≡ ). S ≡ T if, and only if ⇓S ≡ →
k swap ⇓T

Proof. The forward direction is proven by Lemma 69. The reverse direction is proven by
Lemma 57

Lemma 70. A →
k A D(A).
Proof. A = DS ∗ for some DNF regular expression. Consider the derivation
DS →
k DS
∗

∗
DS →
k D(DS )

as desired.



Lemma 71.
• If A → DT , then A →
k DT .
• If DS → DT , then DS →
k DT .
Proof. By mutual induction on the derivation of → and →A
Case 1 (Atom UnrollstarL ).
DS ∗ →A h[ϵ]i ⊕ (DS ⊙ D(DS ∗ ))
Consider the derivation
∗
DS ∗ →
k A h[ϵ]i ⊕ (DS ⊙ D(DS ))

Case 2 (Atom UnrollstarR ).
DS ∗ →A h[ϵ]i ⊕ (D(DS∗ ) ⊙ DS)
Consider the derivation
∗
DS ∗ →
k A h[ϵ]i ⊕ (D(DS ) ⊙ DS)

Case 3 (Atom Structural Rewrite).
DS → DT ′
DS ∗ → D(DT ′∗ )
′
By IH, DS →
k DT , so consider the derivation
′
DS →
k DT
′∗
DS ∗ →
k D(DT )

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:71

Case 4 (DNF Structural Rewrite).
Aj →A DS
hSQ 1 | . . . | SQ i −1 i ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙ D(Aj ) ⊙ h[sj · . . . · Am · sm ]i ⊕ hSQ i +1 | . . . | SQ n i →
hSQ 1 | . . . | SQi −1 i ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙ DS ⊙ [sj · . . . · Am · sm ] ⊕ hSQ i +1 | . . . | SQn i
Deﬁne SQ i as [s0 · A1 · . . . · Am · sm ]. Through the deﬁnition of ⊕ and ⊙, DS = hSQ 1 | . . . | SQ n i.
Deﬁne SQ k = [sk,0 · Ak,1 · . . . · Ak,nk · sk,nk ]. So, in particular, Ai ,j = Aj , and ni = m. Deﬁne DS k,l =

DS
if (k, l) = (i, j)
So, for all k, l, Ak,l →
k A DS k,l , as if (k, l) = (i, j), then by assumption
D(Ak,l ) otherwise
Ai ,j →
k A DS, and otherwise, from Lemma 70, Ak,l →
k A D(Ak,l ).
Deﬁne DSk as h[sk,0 ]i ⊙ DSk,1 ⊙ . . . ⊙ DSk,nk ⊙ h[sk,nk ]i.
DS = hSQ 1 | . . . | SQn i
∀i.SQi = [si ,0 · Ai ,1 · . . . · Ai ,ni · si ,ni ]
∀i, j.Ai ,j →
k A DS i ,j
∀i.DSi = h[si ,0 ]i ⊙ DSi ,1 ⊙ . . . ⊙ DSi ,ni ⊙ h[si ,ni ]i
DS →
k DS 1 ⊕ . . . ⊕ DS n
So DSk , for k , i = h[sk,0 ]i ⊙ D(Ak,1 ) ⊙ . . . ⊙ D(Ak,nk ) ⊙ h[sk,nk ]i = SQk
DSi = h[s0 · A1 · . . . · sj−1 ]i ⊙ D(Aj ) ⊙ h[sj · . . . · Am · sm ]i,
so, through the deﬁnition of ⊕, DS 1 ⊕ . . . ⊕ DSn = hSQ 1 | . . . | SQi −1 i ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙
DS ⊙ [sj ·. . . ·Am ·sm ] ⊕ hSQ i +1 | . . . | SQn i, so we get DS →
k DS 1 ⊕ . . . ⊕ DS n = hSQ 1 | . . . | SQi −1 i ⊕
h[s0 · A1 · . . . · sj−1 ]i ⊙ DS ⊙ [sj · . . . · Am · sm ] ⊕ hSQ i +1 | . . . | SQn i.

Lemma 72. If

DS→∗ DT ,

then

DS →
k ∗ DT

Proof. By induction on the derivation of →∗
Case 1 (Reflexivity).
DS→∗ DS
Consider the following derivation
∗
DS →
k DS

Case 2 (Base).
DS → DT
DS→∗ DT
By Lemma 80,

DS →
k ∗ DT .

Case 3 (Transitivity).

DS→∗ DS ′

DS ′ →∗ DT

DS→∗ DT
′
′
By IH, DS →
k ∗ DS and DS →
k ∗ DT .
Consider the following derivation
∗
′
DS →
k DS

∗
DS ′ →
k DT

∗
DS →
k DT


Lemma 73. If DS→∗ DT , then D(DS ∗ )→∗ D(DT ∗ ).
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:72

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Proof. By induction on the derivation of →∗
Case 1 (Reflexivity).
DS→∗ DS
Consider the derivation
D(DS)→∗ D(DS)
Case 2 (Base).
DS → DT
DS→∗ DT
Consider the derivation
DS → DT
∗

DS →A D(DT ∗ )
D(DS ∗ ) → D(DT ∗ )
D(DS ∗ )→∗ D(DT ∗ )
Case 3 (Transitivity).
DS→∗ DS ′

DS ′ →∗ DT

DS→∗ DT
By IH, there exists derivations of D(DS ∗ )→∗ D(DS ′ ∗ ) and D(DS ′ ∗ )→∗ D(DT ∗ ).
Consider the derivation
D(DS ∗ )→∗ D(DS ′∗ )
D(DS ′∗ )→∗ D(DT ∗ )
D(DS ∗ )→∗ D(DT ∗ )

Lemma 74. If DS 1 →∗ DS 2 , then for all DT , DS 1 ⊕ DT →∗ DS 2 ⊕ DT
Proof. By induction on the derivation of →∗
Case 1 (Reflexivity).
DS 1 →∗ DS 1
so, by Reflexivity
DS 1 ⊕ DT →∗ DS 1 ⊕ DT
Case 2 (Base).
DS 1 → DS 2
DS 1 →∗ DS 2
The only way to get a derivation of → is with an application of DNF Structural Rewrite, so
by inversion,
Aj → DS
hSQ 1 | . . . | SQ i −1 i ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙ D(Aj ) ⊙ h[sj · . . . · Am · sm ]i ⊕ hSQ i +1 | . . . | SQ n i →
hSQ 1 | . . . | SQi −1 i ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙ DS ⊙ [sj · . . . · Am · sm ] ⊕ hSQ i +1 | . . . | SQn i
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:73

where DS 1 = hSQ 1 | . . . | SQ i −1 i⊕h[s0·A1·. . .·sj−1 ]i⊙D(Aj )⊙h[sj ·. . .·Am ·sm ]i⊕hSQ i +1 | . . . | SQn i
and where DS 2 = hSQ 1 | . . . | SQ i −1 i ⊕ h[s0 ·A1 ·. . .·sj−1 ]i ⊙DS ⊙[sj ·. . .·Am ·sm ] ⊕ hSQ i +1 | . . . | SQ n i.
So, let DT = hTQ 1 | . . . | TQ n′ i.
Consider the derivation
Aj → DS
hSQ 1 | . . . | SQi −1 i ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙ D(Aj ) ⊙ h[sj · . . . · Am · sm ]i⊕
hSQ i +1 | . . . | SQn | TQ 1 | . . . | TQ n′ i →
hSQ 1 | . . . | SQi −1 i⊕
h[s0 · A1 · . . . · sj−1 ]i ⊙ DS ⊙ [sj · . . . · Am · sm ] ⊕ hSQ i +1 | . . . | SQ n | TQ 1 | . . . | TQn′ i
hSQ 1 | . . . | SQ i −1 i ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙ D(Aj ) ⊙
h[sj · . . . · Am · sm ]i ⊕ hSQ i +1 | . . . | SQn | TQ 1 | . . . | TQ n′ i =
hSQ 1 | . . . | SQ i −1 i ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙ D(Aj ) ⊙ h[sj · . . . · Am · sm ]i ⊕ (hSQ i +1 | . . . | SQn i ⊕
hTQ 1 | . . . | TQn′ i). So through associativity of ⊕, hSQ 1 | . . . | SQi −1 i ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙
D(Aj ) ⊙ h[sj · . . . · Am · sm ]i ⊕ hSQ i +1 | . . . | SQ n | TQ 1 | . . . | TQn′ i = DS 1 ⊕ DT .
hSQ 1 | . . . | SQ i −1 i ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙ DS ⊙
h[sj · . . . · Am · sm ]i ⊕ hSQ i +1 | . . . | SQn | TQ 1 | . . . | TQ n′ i =
hSQ 1 | . . . | SQi −1 i ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙ DS ⊙ h[sj · . . . · Am · sm ]i ⊕ (hSQi +1 | . . . | SQn i ⊕
hTQ 1 | . . . | TQn′ i). So through associativity of ⊕, hSQ 1 | . . . | SQi −1 i ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙ DS ⊙
h[sj · . . . · Am · sm ]i ⊕ hSQ i +1 | . . . | SQn | TQ 1 | . . . | TQ n′ i = DS 2 ⊕ DT .
Case 3 (Transitivity).
DS 1 →∗ DS 3

DS 3 →∗ DS 2

DS 1 →∗ DS 2
By IH, DS 1 ⊕ DT →∗ DS 3 ⊕ DT . By IH, DS 3 ⊕ DT →∗ DS 2 ⊕ DT .
Consider the derivation
DS 1 ⊕ DT →∗ DS 3 ⊕ DT
DS 3 ⊕ DT →∗ DS 2 ⊕ DT
DS 1 ⊕ DT →∗ DS 2 ⊕ DT

Lemma 75. If DS 1 →∗ DS 2 , then for all DT , DT ⊕ DS 1 →∗ DT ⊕ DS 2
Proof. Proven symmetrically to Lemma 74.



Lemma 76. If DS 1 →∗ DS 2 , and DT 1 →∗ DT 2 , then DS 1 ⊕ DT 1 →∗ DS 2 ⊕ DT 2
Proof. By Lemma 74, DS 1 ⊕ DS 2 →∗ DT 1 ⊕ DS 2 . By Lemma 75, DT 1 ⊕ DS 2 →∗ DT 1 ⊕ DT 2 .
Consider the derivation
DS 1 ⊕ DS 2 →∗ DT 1 ⊕ DS 2
DT 1 ⊕ DS 2 →∗ DT 1 ⊕ DT 2
DS 1 ⊕ DS 2 →∗ DT 1 ⊕ DT 2

Lemma 77. If DS 1 →∗ DS 2 , then for all SQ, DS 1 ⊙ hSQi→∗ DS 2 ⊙ hSQi
Proof. By induction on the derivation of →∗
Case 1 (Reflexivity).
DS 1 →∗ DS 1
so, by Reflexivity
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:74

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

DS 1 ⊙ hSQi→∗ DS 1 ⊙ hSQi
Case 2 (Base).
DS 1 → DS 2
DS 1 →∗ DS 2
The only way to get a derivation of → is with an application of DNF Structural Rewrite, so
by inversion,
Aj → DS
hSQ 1 | . . . | SQ i −1 i ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙ D(Aj ) ⊙ h[sj · . . . · Am · sm ]i ⊕ hSQ i +1 | . . . | SQ n i →
hSQ 1 | . . . | SQi −1 i ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙ DS ⊙ [sj · . . . · Am · sm ] ⊕ hSQ i +1 | . . . | SQn i
Consider the derivation
Aj → DS
hSQ 1 ⊙SQ SQ | . . . | SQ i −1 ⊙SQ SQi ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙ D(Aj ) ⊙ h[sj · . . . · Am · sm ] ⊙SQ SQi⊕
hSQi +1 ⊙SQ SQ | . . . | SQn ⊙SQ SQi →
hSQ 1 ⊙SQ SQ | . . . | SQ i −1 ⊙SQ SQi ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙ DS ⊙ h[sj · . . . · Am · sm ] ⊙SQ SQi⊕
hSQ i +1 ⊙SQ SQ | . . . | SQn ⊙SQ SQi
By the deﬁnition of ⊙, using Lemma 36 this is equal to DS 1 ⊙ hSQi → DS 2 ⊙ hSQi, so, consider
the derivation
Aj → DS
DS 1 ⊙ hSQi → DS 2 ⊙ hSQi
DS 1 ⊙ hSQi→∗ DS 2 ⊙ hSQi
Case 3 (Transitivity).
DS 1 →∗ DS 3 DS 3 →∗ DS 2
DS 1 →∗ DS 2
By IH, DS 1 ⊙ hSQi→∗ DS 3 ⊙ hSQi. By IH, hSQi ⊙ DS 3 →∗ hSQi ⊙ DS 2 .
Consider the derivation
hSQi ⊙ DS 1 →∗ hSQi ⊙ DS 3

hSQi ⊙ DS 3 →∗ hSQi ⊙ DS 2

hSQi ⊙ DS 1 →∗ hSQi ⊙ DS 2

Lemma 78. If DS 1 →∗ DS 2 , then for all DT , DT ⊙ DS 1 →∗ DT ⊙ DS 2
Proof. By induction on the derivation of →∗
Case 1 (Reflexivity).
DS 1 →∗ DS 1
so, by Reflexivity
DT ⊙ DS 1 →∗ DT ⊙ DS 1
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:75

Case 2 (Base).
DS 1 → DS 2
DS 1 →∗ DS 2
The only way to get a derivation of → is with an application of DNF Structural Rewrite, so
by inversion,
Aj → DS
hSQ 1 | . . . | SQ i −1 i ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙ D(Aj ) ⊙ h[sj · . . . · Am · sm ]i ⊕ hSQ i +1 | . . . | SQ n i →
hSQ 1 | . . . | SQi −1 i ⊕ h[s0 · A1 · . . . · sj−1 ]i ⊙ DS ⊙ [sj · . . . · Am · sm ] ⊕ hSQ i +1 | . . . | SQn i
Let DT = hSQ 1′ | . . . | SQn′ ′ i.
′
By Lemma 78, hSQ k′ i ⊙ DS 1 →
k hSQ k i ⊙ DS 2 . So, through repeated application of Lemma 76,
′
′
′
′
k (hSQ 1 i ⊙ DS 2 ) ⊕ . . . ⊕ (hSQ n ′ i ⊙ DS 2 )
(hSQ 1 i ⊙ DS 1 ) ⊕ . . . ⊕ (hSQn′ i ⊙ DS 1 ) →
′
′
′
From Lemma 35, (hSQ 1 i ⊙ DS 1 ) ⊕ . . . ⊕ (hSQn′ i ⊙ DS 1 ) = (hSQ 1 i ⊕ . . . ⊕ hSQ n′ ′ i) ⊙ DS 1 = DT ⊙ DS 1
and (hSQ 1′ i ⊙ DS 2 ) ⊕ . . . ⊕ (hSQ n′ ′ i ⊙ DS 2 ) = (hSQ 1′ i ⊕ . . . ⊕ hSQ n′ ′ i) ⊙ DS 2 = DT ⊙ DS 2 .
So we have DT ⊙ DS 1 →∗ DT ⊙ DS 2 .
Case 3 (Transitivity).
DS 1 →∗ DS 3 DS 3 →∗ DS 2
DS 1 →∗ DS 2
By IH, DS 1 ⊙ DT →∗ DS 3 ⊙ DT . By IH, DS 3 ⊙ DT →∗ DS 2 ⊙ DT .
Consider the derivation
DS 1 ⊙ DT →∗ DS 3 ⊙ DT
DS 3 ⊙ DT →∗ DS 2 ⊙ DT
DS 1 ⊙ DT →∗ DS 2 ⊙ DT

Lemma 79. Let D(Ai )→∗ DS i . h[s0 · A1 · . . . · An · sn ]i→∗ h[s0 ]i ⊙ DS 1 ⊙ . . . ⊙ DS n ⊙ h[sn ]i
Proof. By induction on n.
Case 1 (n = 0). Through use of Reflexivity
h[s0 ]i →∗ h[s0 ]i
Case 2 (n > 0). h[s0 · A1 · . . . · An · sn ]i = h[s0 · A1 · . . . · An−1 · sn−1 ]i ⊙ h[ϵ · An · sn ]i by the deﬁnition
of ⊙.
From IH, h[s0 · A1 · . . . · An−1 · sn−1 ]i→∗ h[s0 ]i ⊙ DS 1 ⊙ . . . ⊙ DSn−1 ⊙ h[sn−1 ]i From Lemma 77,
h[s0 · A1 · . . . · An−1 · sn−1 ]i ⊙ h[ϵ · An · sn ]i→∗ h[s0 ]i ⊙ DS 1 ⊙ . . . ⊙ DSn−1 ⊙ h[ϵ · An · sn ]i.
h[ϵ · An · sn ]i = D(An ) ⊙ h[sn ]i From Lemma 77, as D(An )→∗ DSn h[ϵ · An · sn ]i→∗ DSn ⊙ h[sn ]i.
As h[ϵ·An ·sn ]i→∗ DSn ⊙ h[sn ]i, from Lemma 78, h[s0 ]i ⊙DS 1 ⊙. . . ⊙DSn−1 ⊙ h[ϵ·An ·sn ]i→∗ h[s0 ]i ⊙
DS 1 ⊙ . . . ⊙ DSn−1 ⊙ DSn ⊙ h[sn ]i.
Consider the derivation
h[s0 · A1 · . . . · An−1 · sn−1 ]i ⊙ h[ϵ · An · sn ]i→∗ h[s0 ]i ⊙ DS 1 ⊙ . . . ⊙ DSn−1 ⊙ h[ϵ · An · sn ]i
h[s0 ]i ⊙ DS 1 ⊙ . . . ⊙ DSn−1 ⊙ h[ϵ · An · sn ]i→∗ h[s0 ]i ⊙ DS 1 ⊙ . . . ⊙ DSn−1 ⊙ DSn ⊙ h[sn ]i
h[s0 · A1 · . . . · An · sn ]i = h[s0 · A1 · . . . · An−1 · sn−1 ]i ⊙ h[ϵ · An · sn ]i→∗
h[s0 ]i ⊙ DS 1 ⊙ . . . ⊙ DSn−1 ⊙ DSn ⊙ h[sn ]i
So, h[s0 · A1 · . . . · An · sn ]i→∗ h[s0 ]i ⊙ DS 1 ⊙ . . . ⊙ DSn ⊙ h[sn ]i, as desired.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:76

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic


Lemma 80.
• If A →
k A DT , then D(DS)→∗ DT .
• If DS →
k DT , then D(DS)→∗ DT .
Proof. By mutual induction on the derivation of →
k A
Case 1 (Atom UnrollstarL ).
∗
DS ∗ →
k A h[ϵ]i ⊕ (DS ⊙ D(DS ))

Consider the derivation
DS ∗ →A h[ϵ]i ⊕ (DS ⊙ D(DS ∗ ))
D(DS ∗ ) → h[ϵ]i ⊕ (DS ⊙ D(DS ∗ ))
D(DS ∗ )→∗ h[ϵ]i ⊕ (DS ⊙ D(DS ∗ ))
Case 2 (Atom UnrollstarR ).
∗
DS ∗ →
k A h[ϵ]i ⊕ (D(DS ) ⊙ DS)

Consider the derivation
DS ∗ →A h[ϵ]i ⊕ (D(DS∗ ) ⊙ DS)
D(DS ∗ ) → h[ϵ]i ⊕ (DS ⊙ D(DS ∗ ))
D(DS ∗ )→∗ h[ϵ]i ⊕ (DS ⊙ D(DS ∗ ))
Case 3 (Parallel Atom Structural Rewrite).
′
DS →
k DT
′∗
DS ∗ →
k D(DT )

By IH, DS→∗ DT ′ , so by Lemma 73, D(DS ∗ )→∗ D(DT ′ ∗ ).
Case 4 (ParallelDNFStructuralRewriteRule).
DS = hSQ 1 | . . . | SQn i
∀i.SQi = [si ,0 · Ai ,1 · . . . · Ai ,ni · si ,ni ]
∀i, j.Ai ,j →
k A DS i ,j
∀i.DSi = h[si ,0 ]i ⊙ DSi ,1 ⊙ . . . ⊙ DSi ,ni ⊙ h[si ,ni ]i
DS →
k DS 1 ⊕ . . . ⊕ DS n
From the deﬁnition of ⊕, DS = hSQ 1 i ⊕ . . . ⊕ hSQ n i. From IH, D(Ai ,1 )→∗ DSi ,j . From Lemma 79,
hSQ i i = h[si ,0 ·Ai ,1 ·. . .·Ai ,ni ·si ,ni ]i→∗ h[si ,0 ]i ⊙ DS i ,1 ⊙ . . . ⊙ DS i ,ni ⊙ h[si ,ni ]i = DSi , so hSQ i i→∗ DSi .
From Lemma 76, DS = hSQ i i ⊕ . . . ⊕ hSQ n i→∗ DS 1 ⊕ . . . ⊕ DSn .
Case 5 (Identity Rewrite).
DS →
k DS
Through application of Reflexivity
DS→∗ DS

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:77

Lemma 81. If DS →
k ∗ DT , then DS→∗ DT
Proof. By induction on the derivation of →
k ∗
Case 1 (Reflexivity).
∗
DS →
k DS

Consider the following derivation
DS→∗ DS
Case 2 (Base).
DS →
k DT
∗
DS →
k DT

By Lemma 80, DS→∗ DT .
Case 3 (Transitivity).
∗
′
DS →
k DS

∗
DS ′ →
k DT

∗
DS →
k DT

By IH, DS→∗ DS ′ and DS ′ →∗ DT .
Consider the following derivation
DS→∗ DS ′

DS ′ →∗ DT

DS→∗ DT

′
′
Theorem 9. DS →
k ∗ DS , if, and only if DS→∗ DS

Proof. Forward direction is proven by Lemma 72. Reverse direction is proven by Lemma 81. 
Corollary 1 (→∗ Maintained Under Iteration). If DS→∗ DT , then h[DS ∗ ]i→∗ h[DT ∗ ]i.
Proof. From Theorem 9 applied to Lemma 52.



Lemma 82 ( →
k can be expressed in →
k swap ). If DS →
k DT then DS →
k swap DT
Proof. →
k swap has all of the inference rules of →
k , so a straightforward induction using those
rules can prove this.

Lemma 83 ( →
k can be expressed in ≡s ). If ⇓S →
k ⇓T , then S ≡s T .
Proof. By Lemma 82, ⇓S →
k swap ⇓T , then by Lemma 56, S ≡s T .



Lemma 84 ( →
k ∗ can be expressed in ≡s ). If ⇓S →
k ∗ ⇓T , then S ≡s T .
Proof. By straightforward induction, using for base rule, Lemma 83, for transitivity the transitivity of equational theories, and for reﬂexivity the reﬂexivity of equational theories.

Lemma 85 (→∗ can be expressed in ≡s ). If ⇓S→∗ ⇓T , then S ≡s T .
Proof. By Lemma 84 and Theorem 9.


, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:78
B.7

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic
Lens Soundness

Using the above machinery, we prove the soundness of DNF lenses. The unambiguity is guaranteed
through prior unambiguity proofs. The rewrite portion of DNF lenses are proven to be correct
through the above subsection. The bulk of this is showing that the lenses can be built up from
their subcomponents, and that arbitrary permutations can be expressed.
Lemma 86 (Expressibility of Safe Boilerplate Alterations). Suppose
(1) ·! [s0 · A1 · . . . · An · sn ]
(2) ·! [t0 · A1 · . . . · An · tn ]
Then there exists a lens l : S ⇔ T such that
(1) S =⇑ ([s0 · A1 · . . . · An · sn ])
(2) T =⇑ ([t0 · A1 · . . . · An · tn ])
(3) [[l]] = {(s, t) | s = s0 · s1′ · . . . · sn′ · sn ∧
t = t0 · s1′ · . . . · sn′ · tn ∧
si ∈ L(Ai )}
Proof. By induction on n.
Let n = 0. Consider the Lens
const(s0 , t0 ) : s0 ⇔ t0
By inspection, this satisﬁes the desired properties.
Let n > 0. By induction, there exists a lens l : S ⇔ T satisfying the desired properties. Consider
the lens
D

l:S⇔T

const(sn , tn ) : sn ⇔ tn

concat(l, const(sn , tn )) : S · sn ⇔ T · tn
D

id ⇑(An ) :⇑ (An ) ⇔⇑ (An )

concat(concat(l, const(sn , tn )), id ⇑(An ) ) :

S · sn · ⇑ (An ) ⇔ S · tn · ⇑ (An )

By inspection, this satisﬁes the desired properties.



Lemma 87 (Creation of Lens from Identity Perm Sequence Lens). Suppose
(1) SQ = [s0 · A1 · . . . · An · sn ]
(2) TQ = [t0 · B1 · . . . · Bn · tn ]
(3) ([(s0 , t0 ) · al 1 · . . . · al n · (sn , tn )], id) :̃ SQ ⇔ TQ
(4) For each al i :̃ Ai ⇔ Bi , there exists a li :̃ ⇑ (Ai ) ⇔⇑ (Bi ) such that [[li ]] = [[al i ]]
then there exists a l :̃ ⇑ (SQ) ⇔⇑ (DT ) such that [[l]] = [[([(s0 , t0 ) · al 1 · . . . · al n · (sn , tn )], id)]].
Proof. By induction on n.
Let n = 0, ([(s0 , t0 )], id) :̃ [s0 ] ⇔ [t0 ]. Then consider
const(s0 , t0 ) : s0 ⇔ t0
s0 =⇑ ([s0 ]), and t0 =⇑ ([t0 ]). [[const(s0 , t0 )]] = {s0 , t0 } = [[[(s0 , t0 )], id)]].
Let n > 0. Let SQ ′ = [s0 · A1 · . . . · An−1 · sn−1 ], and TQ ′ = [t0 · B1 · . . . · Bn−1 · tn−1 ] By induction
assumption, there exists a typing derivation
l :⇑ (SQ ′ ) ⇔⇑ (TQ ′ )
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:79

satisfying [[l]] =
[[([(s0 , t0 ) · al 1 · . . . · al n−1 · (sn−1 , tn−1 )], id)]]
By problem statement, there exists a typing derivation
lal n :⇑ (An ) ⇔⇑ (Bn )
satisfying [[lAn ]] = [[An ]].
Consider the following lens typing

D

Dn

const(sn , tn ) : sn ⇔ tn

concat(lal n , const(sn , tn )) :⇑ (An ) · sn ⇔⇑ (Bn ) · tn
l :⇑ (SQ) ⇔⇑ (TQ)

concat(l, concat(lal n , const(sn , tn ))) :

D

⇑ (SQ)· ⇑ (An ) · sn ⇔⇑ (TQ)· ⇑ (Bn ) · tn

[[concat(l, concat(lal n , const(sn , tn )))]]
={(s, t) | s = s ′ · s ′′ · sn ∧ t = t ′ · t ′′ · tn ∧
(s ′ , t ′ ) ∈ [[l]] ∧ (s ′′ , t ′′ ) ∈ [[lal n ]]}
′
={(s, t) | s = s0 · s0′ · . . . · sn−1
· sn−1 · sn · sn′ ∧
′
′
t = t0 · t0 · . . . · tn−1 · tn−1 · tn · tn′ ∧
si′ ∈ Ai ∧ ti′ ∈ Bi }
=[[([(s0 , t0 ) · al 1 · . . . · al n · (sn , tn−1 )], id)]]



Lemma 88 (Unambiguity of $). Let Σ be an alphabet. Let Σ$ = Σ ∪ {$}, where $ is a character not
in Σ. If L 1 , . . . , Ln , are languages in Σ∗ , then ·! [L($); L 1; L($); . . . ; L($); Ln ; L($)].
Proof. We prove this by induction on n.
Let n = 0. ·! [L($)], as ·! [L], for any language L.
Let n > 0. Let si , ti ∈ Li for all i ∈ [1, n], and let $s1 $ . . . $sn $ = $t1 $ . . . $tn $. We want to show
that sn $ = tn $. If they were not equal, then one string is strictly contained in the other, say without
loss of generality sn $ is strictly contained in tn $. Because of that $sn $ is contained in tn $, so $ is
contained in tn ∈ Σ∗. This is a contradiction, as $ < Σ, so we know sn $ = tn $, and so sn = tn . This
means that $s0 $ . . . $sn−1 $ = $t0 $ . . . $tn−1 , so by induction, I know si = ti for all i.

Deﬁnition 15 (Adjacent Swapping Permutation). Let σi ∈ Sn be the permutation where σi (i) =
i + 1, σi (i + 1) = i, σi (k) = k when k , i, and k , i + 1.
Lemma 89 (Expressibility of Adjacent Swapping Permutation Lens). Suppose
(1) σi is an adjacent element swapping permutation
(2) [$ · A1 · $ . . . $ · An · $] is a sequence with all base strings equal to $.
Then there exists a typing of a lens l : S ⇔ T such that
(1) L(S) = L([$ · A1 · . . . · An · $])
(2) L(T ) = L([$ · Aσi (1) · . . . · Aσi (n) · $])
(3) [[l]] = {(s, t) | s = $ · s1 · $ · . . . · $ · sn · $ ∧
t = $ · sσi (1) · $ · . . . · $ · sσi (n) $ ∧
si ∈ L(Ai )}
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:80

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Proof. By the soundness of regular expressions, deﬁne regular expressions S1 , S2 , S3 , S4 as S1 =⇑
([$ · A1 · . . . · Ai −1 · $]), S2 =⇑ (Ai ), S3 =⇑ (Ai +1 ), and S4 =⇑ ([$ · Ai +1 · . . . · An · $]). Consider the
following deduction
D

id $ : $ ⇔ $ id S3 : S3 ⇔ S3

D’

swap(id $ , id S3 ) : $ · S3 ⇔ S3 · si

D”

id S2 : S2 ⇔ S2

swap(id S2 , s(id $ , id S3 )) : S2 · $ · S3 ⇔ S3 · $ · S2
D′

id S1 : S1 ⇔ S1
concat(id S1 , s(id S2 , s(id $ , id S3 ))) :
D ′′

D

S1 · S2 · $ · S3 ⇔ S1 · S3 · $ · S2
id S4 : S4 ⇔ S4

concat(c(id S1 , s(id S2 , s(id $ , id S3 ))), id S4 ) :

S1 · S2 · $ · S3 · S4 ⇔ S1 · S3 · $ · S2 · S4

By inspection, the ﬁnal lens c(c(id S1 , s(id S2 , s(id $ , id S3 ))), id S4 ) : S1 · S2 · $ · S3 · S4 ⇔ S1 · S3 · $ · S2 · S4
satisﬁes L(S1 ·S2 ·si ·S3 ·S4 ) = L([$·A1·$·. . .·$·An ·$]) and L(S1 ·S3 ·si ·S2 ·S4 ) = L([$·Aσi (1) ·. . .·Aσi (n) ·$])
and has the desired semantics of swapping the strings at spots i and i + 1.

Lemma 90 (Expressibility of Adjacent Swapping Permutation Composition). Suppose
(1) σ = σi 1 ◦ . . . ◦ σim
(2) [$ · A1 · $ . . . $ · An · $] is a sequence with all base strings equal to $.
Then there exists a typing of a lens l : S ⇔ T such that
(1) L(S) = L([$ · A1 · . . . · An · $])
(2) L(T ) = L([$ · Aσ (1) · . . . · Aσ (n) · $])
(3) [[l]] = {(s, t) | s = $ · s1 · $ · . . . · $ · sn · $ ∧
t = $ · sσ (1) · $ · . . . · $ · sσ (n) $ ∧
si ∈ L(Ai )}
Proof. By induction on m.
Let m = 0. Then σ = id. Consider the lens id ⇑([$·A1 ·$...$·An ·$]) :⇑ ([$ · A1 · $ . . . $ · An · $]) ⇔⇑
([$ · A1 · $ . . . $ · An · $]). By inspection, this lens satisﬁes the requirements.
Let m > 0. Let σ ′ = σi 1 ◦ . . . ◦ σim−1 . Let l : S ⇔ T be the lens obtained by an application of the
induction assumption on σ ′ . Let lm : T ′ ⇔ T ′′ be the lens obtained by an application of Lemma 89
to the permutation σm and the sequence [$ · Aσ ′(1) · . . . · Aσ ′(n) · $]. From the induction assumption
and the previous lemmas, we know L(T ) = L([$ · Aσ ′(1) · . . . · Aσ ′ (n) · $]) = L(T ′). Consider the
following Lens typing
l:S⇔T

L(T ) = L(T ′)
l : S ⇔ T′

lm : T ′ ⇔ T ′′

lm ; l : S ⇔ T ′′
The language of S is already as desired, and L(T ′′) = L([$·Aσm ◦σ ′(1)·. . .·Aσm ◦σ ′(n) ]) = L([$·Aσ (1)·
. . . · Aσ (n) ]), as desired. Furthermore, the composition of the lenses composes the permutations of
strings, giving the semantics as desired.

Lemma 91 (Expressibility of Permutation). Suppose
(1) σ is a permutation in Sn
(2) [$ · A1 · $ . . . $ · An · $] is a sequence with all base strings equal to $.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:81

Then there exists a typing of a lens l : S ⇔ T such that
(1) L(S) = L([$ · A1 · . . . · An · $])
(2) L(T ) = L([$ · Aσ (1) · . . . · Aσ (n) · $])
(3) [[l]] = {(s, t) | s = $ · s1 · $ · . . . · $ · sn · $ ∧
t = $ · sσ (1) · $ · . . . · $ · sσ (n) $ ∧
si ∈ L(Ai )}
Proof. By algebra, any permutation can be expressed as the composition of adjacent swapping
permutations. As such, σ = σi 1 ◦ . . . ◦ σim for some adjacency swapping permutations σi j . By
Lemma 90, we obtain a lens with the properties desired.

Lemma 92 (Creation of Lens from Identity Perm DNF Lens). Suppose
(1) DS = hSQ 1 | . . . | SQ n i
(2) DT = hTQ 1 | . . . | TQn i
(3) (hsql 1 | . . . | sql n i, id) :̃ DS ⇔ DT
(4) For each sql i :̃ SQi ⇔ TQi , there exists a li such that [[li ]] = [[sqli ]].
then there exists a l :̃ ⇑ (DS) ⇔⇑ (DT ) such that [[l]] = [[([sql 1 | . . . | sql n ], id)]].
Proof. By induction on n
Let n = 0. hi :̃ hi ⇔ hi. Then consider
id ⇑(hi) :̃ ⇑ (hi) ⇔⇑ (hi)
This has the desired typing, and [[id ⇑(hi) ]] = [[id ∅ ]] = {} = [[hi]].
Let n > 0. Let DS ′ = hSQ 1 | . . . | SQ n−1 i, and DT ′ = hTQ 1 | . . . | TQn−1 i. By induction
assumption, there exists a derivation of l :⇑ (DS ′ ) ⇔⇑ (DT ′ ). By problem statement, there exists
a typing derivation ln :⇑ (SQn ) ⇔⇑ (TQn ) Consider the following derivation
l :⇑ (DS ′) ⇔⇑ (DT ′ )

ln :⇑ (SQn ) ⇔⇑ (TQn )

′

or(ln , l) :⇑ (DS ) | ⇑ (SQn ) ⇔⇑ (DT ′ ) | ⇑ (SQn )
[[or(l, ln )]] = {(s, t) | (s, t) ∈ l ∨ (s, t) ∈ ln }
= {(s, t) | (s, t) ∈ hsql 1 | . . . | sqln−1 i
∨ (s, t) ∈ hsql n i}
= {(s, t) | (s, t) ∈ sql i }.



Lemma 93 (Ineﬀectiveness of Permutation on DNF Regex Semantics). Let σ ∈ Sn , and hSQ 1 . . . SQ n i
be a DNF regex. L(hSQ 1 | . . . | SQ n i) = L(hSQσ (1) | . . . | SQ σ (n) i).
Proof. By inspection.



Lemma 94 (Ineﬀectiveness of Permutation on DNF Lens Semantics). Let σ ∈ Sn , and
(hsql 1 | . . . | sql n i, id) :̃ hSQ 1 | . . . | SQ n i ⇔ hTQ 1 | . . . | TQn i be a typing of a DNF lens with an
identity permutation. [[(hsql 1 | . . . | sql n i, id)]] = [[(hsql 1 | . . . | sql n i, σ )]]
Proof. By inspection



Lemma 95 (Soundness of DNF, Sequence, and Atom Lenses).
(1) Let DS and DT be two dnf regular expressions, and dl :̃ DS ⇔ DT . Then there exists a l
such that l :⇑ (DS) ⇔⇑ (DT ), [[l]]=[[dl]]
(2) Let SQ and TQ be two clauses, and sql :̃ SQ ⇔ TQ. Then there exists a l such that l :⇑
(SQ) ⇔⇑ (TQ), [[l]]=[[sql]].
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:82

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic
(3) Let A and B be two atoms, and al :̃ A ⇔ B. Then there exists a l, such that l :̃ ⇑ (A) ⇔⇑ (B),
[[l]]=[[al]].

Proof. By mutual induction on the structure of the DNF Regex, Sequence, and Atom lenses
typing.
Let dl :̃ DS ⇔ DT be formed from an application of
Rewrite DNF Regex Lens.
dl :̃ DS ′ ⇔ DT ′
DS ′ → DS

DT ′ → DT

dl :̃ DS ⇔ DT
By induction assumption, there exists a l :̃ ⇑ (DS ′ ) ⇔⇑ (DT ′ ), and from Lemma 42, we know
L(DS) = L(DS ′ ), and L(DT) = L(DT ′ ). Consider the derivation
l :̃ ⇑ (DS ′ ) ⇔⇑ (DT ′ )

L(⇑ (DS ′ )) = L(⇑ (DS))

L(⇑ (DT ′ )) = L(⇑ (DT ))

l :̃ ⇑ (DS) ⇔⇑ (DT )
This has the desired typing, and by induction assumption, has the desired semantics.
Let (hsql 1 | . . . | sqln i, σ ) :̃ hSQ 1 | . . . | SQ n i ⇔ hTQ σ (1) | . . . | TQ σ (n) i be formed from an
application of DNF Lens. By Induction assumption, for each sql i :̃ SQ i ⇔ TQ i there exists a
li :̃ ⇑ (SQi ) ⇔⇑ (TQi ).
By Lemma 92 there exists a l :̃ ⇑ (hSQ 1 | . . . | SQn i) ⇔⇑ (hTQ 1 | . . . | TQn i) such that [[l]] =
[[([sql 1 | . . . sql n ], id)]], By Lemma 94, [[(DN FO f sql 1 | . . . | sql n , id)]] = [[(hsql 1 | . . . | sql n i, σ )]].
By Lemma 93, L(hTQ 1 | . . . | TQn i) = L(hTQ σ (1) | . . . | TQ σ (n) i). Consider the following typing
l :̃ ⇑ (hSQ 1 | . . . | SQ n i) ⇔⇑ (hTQ 1 | . . . | TQn i)
L(⇑ (hTQ 1 | . . . | TQn i)) = L(⇑ (hTQ σ (1) | . . . | TQ σ (n) i))
l :̃ ⇑ (hSQ 1 | . . . | SQ n i) ⇔⇑ (hTQ σ (1) | . . . | TQ σ (n) i)
This has the typing and semantics as desired.
Let ([(s0 , t0 ) · al 1 · . . . · al n · (sn , tn )], σ ∈ Sn ) :̃ [s0 · A1 · . . . · An · sn ] ⇔ [t0 · Bσ (1) · . . . · Bσ (n) · tn ]
be formed from an application of
Seqence Lens. By induction assumption, for each al i :̃ Ai ⇔ Bi there exists a li :⇑ (Si ) ⇔⇑ (Ti ).
By Lemma 87, there exists a l : S ⇔ T such that [[l]] = [[([(s0 , t0 ) · al 1 · . . . · al n · (sn , tn )], id)]],
S =⇑ ([s0 · A1 · . . . · An · sn ]), and T =⇑ ([t0 · B1 · . . . · Bn · tn ]). Deﬁne T$ as ⇑ ([$ · B1 · . . . · Bn · $]).
By Lemma 86, there exists a l ′ : T ⇔ T$ , with semantics of merely changing the boilerplate. By
Lemma 91, there exists a l ′′ : T$′ ⇔ T$′′ where [[T$′]] = [[T$ ]] and [[T$′′ ]] = [[[$ · Bσ (1) · . . . · Bσ (n) · $]]].
Lastly, with Lemma 86, there exists a l ′′′ : T$′′ ⇔ T ′ , where T =⇑ ([t0 ·Bσ (1) ·. . .·Bσ (n) ·tn ]). Through
composition of all these lenses, we ﬁnally get a lens with the desired type and semantics.
Let iterate(dl) :̃ DS ∗ ⇔ DT ∗ be introduced through an application of Atom Lens. From induction
assumption, I know that there exists l :̃ S ⇔ T , such that [[dl]] = [[l]], S=⇑(DS), and T =⇑ (DT ).
Consider iterate(l) :̃ S ∗ ⇔ T ∗ .
By deﬁnition, S ∗ and T ∗ are ⇑ (DS ∗ ) and ⇑ (S ∗ ), respectively.
[[iterate(l)]] = {(s0 . . . sn , t0 . . . tn ) | (si , ti ) ∈ [[l]]}
= {(s0 . . . sn , t0 . . . tn ) | (si , ti ) ∈ [[dl]]}

= [[iterate(dl)]]
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:83

Theorem 10. If there exists a derivation of dl : DS ⇔ DT , then there exist a lens, ⇑dl, and regular
expressions, S and T , such that ⇑dl : S ⇔ T and ⇓S = DS and ⇓T = DT and [[⇑dl]] = [[dl]].
Proof. Let dl : DS ⇔ DT .
By inversion, the last step is
dl :̃ DS ′ ⇔ DT ′

DS→∗ DS ′

DT →∗ DT ′

dl : DS ⇔ DT
:⇑DS ′

From Lemma 95, there exists l
⇔⇑DT ′.
′
∗
∗
So, as ⇓⇑DS→ ⇓⇑DS , and ⇓⇑DT→ ⇓⇑DT ′, from Lemma 85, ⇑DS ≡s ⇑DS ′ , and ⇑DT ≡s ⇑DT ′ .
l :⇑DS ′ ⇔⇑DT ′

⇑DS ≡s ⇑DS ′

⇑DT ≡s ⇑DT ′

l :⇑DS ≡s ⇑DT
We call this lens ⇑dl(constructiveproo f ).
Furthermore, we also know that ⇓⇑DS = DS, and similarly for DT .
B.8



DNF Lens Operators

DNF lens operators are deﬁned to give DNF lenses similar capabilities to lenses. This allows the
proof of many of the cases of completeness to be trivial, leaving only the complications of proving statements about rewrites, proving closure under composition, and proving the ability to use
rewrites to express lens retyping.
Deﬁnition 16 (Permutation Functions).
⊙ : S n → Sm →
 Sn+m
σ1 (i)
if i ≤ n
(σ1 ⊙ σ2 )(i) =
σ2 (i − n) + n otherwise
s : Sn → Sm → Sn+m
σ1 (i) + n if i ≤ n
(σ1 sσ2 )(i) =
σ2 (i − n) otherwise
⊗ : Sn → Sm → Sn×m
(σ1 ⊗ σ2 )(i, j) = (σ1 (i), σ2 (j))
⊗s : Sn → Sm → Sn×m
(σ1 ⊗ σ2 )(i, j) = (σ2 (j), σ1 (i))
Deﬁnition 17 (DNF Lens Functions).
⊙sql : SequenceLens → SequenceLens → SequenceLens
′
′ , t ′ )], σ ) =
([(s0 , t0 ) · al 1 · . . . · al n · (sn , tn )], σ1 ) ⊙sql ([(s0′ , t0′ ) · al 1′ · . . . · alm
· (sm
2
m
′
′
′
′
′
′
([(s0 , t0 ) · al 1 · . . . · al n · (sn · s0 , tn · t0 ) · al 1 · . . . · alm · (sm , tm )], σ1 ⊙ σ2 )
ssql : SequenceLens → SequenceLens → SequenceLens


t′
si
for i ∈ [0, n − 1]





 i′


Let ti′′ = tm · t0
Let si′′ = sn · s0 for i = n




 ti
s′
for
i
∈
[n
+
1,
n
+
m]
i



for i ∈ [0, m − 1]
for i = m
for i ∈ [m + 1, m + n]

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:84

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

′
′ , t ′ )], σ ) =
([(s0 , t0 ) · al 1 · . . . · al n · (sn , tn )], σ1 )ssql ([(s0′ , t0′ ) · al 1′ · . . . · al m
· (sm
2
m
′
′
′′
′′
′′
′′
′′
′′
′′
′′ )], σ sσ )
([(s0 , t0 ) · al 1 · . . . · al n · (sn , tn ) · al 1 · (sn+1 , tn ) . . . · al n · (sn+m , tn+m
1
2

⊙ : DNFLens → DNFLens → DNFLens
′
(hsql 1 | . . . | sql n i, σ1 ) ⊙ (hsql 1′ | . . . | sqlm
i, σ2 ) =
(h sql 1 ⊙sql sql 1′ |
· · · sql n ⊙sql sql 1′ |

···
···

′
|
sql 1 ⊙sql sqlm
′
sql n ⊙sql sqlm

i, σ1 ⊗ σ1 )

s : DNFLens → DNFLens → DNFLens
′
i, σ2 ) =
(hsql 1 | . . . | sql n i, σ1 )s(hsql 1′ | . . . | sqlm
(h sql 1 ssql sql 1′ |
· · · sql n ssql sql 1′ |

···
···

′
|
sql 1 ssql sqlm
′
sql n ssql sqlm

i, σ1 ⊗s σ1 )

⊕ : DNFLens → DNFLens → DNFLens
′ i, σ )=
(hsql 1 | . . . | sql n i, σ1 ) ⊕ (hsql 1′ | . . . | SQm
2
′
(hsql 1 | . . . | sql n | sql 1′ | . . . | SQm
i, σ1 ⊙ σ2 )
D : AtomLens → DNFLens
D(al) = (h([(ϵ, ϵ) · al · (ϵ, ϵ)], id)i, id)
Lemma 96. (h([(ϵ, ϵ)], id 0 )i, id 1 ) ⊙ dl = dl, where id 0 is the identity permutation on 0 elements,
and id 1 is the identity permutation on 1 element.
Proof. Let dl = (hsql 1 | . . . | sql n i, σ ). By deﬁnition, (id 1 ⊗ σ )(1, i) = (1, σ (i)). By deﬁnition,
id 0 ⊙ σ = σ . Let sql i = ([(si ,0 , ti ,0 ) · al i ,1 · . . . al i ,ni · (si ,ni , ti ,ni )], σi ). So ([(ϵ, ϵ)], id 0 ) ⊙sql sql i =
([(ϵ · si ,0 , ϵ · ti ,0 )·al i ,1 ·. . . al i ,ni ·(si ,ni , ti ,ni )], σi ) = sql i . So (h([(ϵ, ϵ)], id 0 )i, id 1 ) ⊙ hsql 1 | . . . | sql n i =
(h([(ϵ, ϵ)], id0 ) ⊙sql sql 1 | . . . | ([(ϵ, ϵ)], id 0 ) ⊙sql sql n i, id 1 ⊗ σ ) = (hsql 1 | . . . | sql n , σ i).

Lemma 97. dl ⊙ h[(ϵ, ϵ)]i = dl
Proof. Done similarly to Lemma 96.



Lemma 98 (Typing and Semantics of ⊙sql ). Let sql 1 : SQ 1 ⇔ TQ 1 and sql 2 : SQ 2 ⇔ TQ 2 be the
typing of two sequence lenses, where L(SQ1 ) ·! L(SQ2 ) and L(TQ 1 ) ·! L(TQ2 ). Then sql 1 ⊙sql sql 2 :
SQ 1 ⊙SQ SQ 2 ⇔ TQ 1 ⊙SQ TQ 2 and [[sql 1 ⊙sql sql 2 ]] = {(s1 ·s2 , t1 ·t2 ) | (s1 , t1 ) ∈ [[sql 1 ]] ∧ (s2 , t2 ) ∈ [[sql 2 ]]}
Proof. By assumption, there exists typing derivations
sql 1 :̃ SQ 1 ⇔ TQ 1
and
sql 2 :̃ SQ 2 ⇔ TQ 2
By inversion, we know that the last rule application on each side was DNF Lens, giving
al i : Ai ⇔ Bi

σ1 ∈ S n

·! (s0 · A1 · . . . · An · sn )

·! (t0 · Bσ1 (1) · . . . · Bσ1 (n) · tn )

([(s0 , t0 ) · al 1 · . . . · al n ], σ1 ) :̃ [s0 · A1 · . . . · An · sn ] ⇔ [t0 · Bσ1 (1) · . . . · Bσ1 (n) · tn ]
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:85

and
al i′ : Ai′ ⇔ Bi′

′
′
·! (s0′ · A1′ · . . . · Am
· sm
)

σ 2 ∈ Sm

·! (t0′ · Bσ′ 2 (1) · . . . · Bσ′ 2 (n) · tn′ )

′
′
′
′
′
′
]
([(s0′ , t0′ ) · al 1′ · . . . · alm
· (sm
, tm
)], σ2 ) :̃ [s0′ · A1′ · . . . · Am
· sm
] ⇔ [t0′ · Bσ′ 2 (1) · . . . · Bσ′ 2 (m) · tm

where
sql 1
SQ 1
TQ 1
sql 2
SQ 2
TQ 2

=
=
=
=
=
=

([(s0 , t0 ) · al 1 · . . . · al n ], σ1 )
[s0 · A1 · . . . · An · sn ]
[t0 · Bσ1 (1) · . . . · Bσ1 (n) · tn ]
′
′ , t ′ )], σ )
([(s0′ , t0′ ) · al 1′ · . . . · alm
· (sm
2
m
′
′
′
′
[s0 · A1 · . . . · Am · sm ]
′ ]
[t0′ · Bσ′ (1) · . . . · Bσ′ (m) · tm
2

2

Deﬁne si′′ as si for i ∈ [1, n − 1], and as si′−n for i ∈ [n + 1, n + m], and as sn · s0′ for i = n.
Deﬁne ti′′ as ti for i ∈ [1, n − 1], and as ti′ as ti −n for i ∈ [n + 1, n + m], and as tn · t0 for i = n.
Deﬁne Ai′′ as Ai for i ∈ [1, n], and as Ai′−n for i ∈ [n + 1, n + m].
Deﬁne Bi′′ as Ai for i ∈ [1, n], and as Bi′−n for i ∈ [n + 1, n + m].
Deﬁne al i as al i for i ∈ [1, n], and as al i′−n for i ∈ [n + 1, n + m].
′ ·s ′ ), and [s ·A ·. . .·A ·s ]·! [s ′ ·A′ ·. . .·A′ ·s ′ ],
From Lemma 8, as ·! (s0 ·A1 ·. . .·An ·sn ), ·! (s0′ ·A1′ ·. . .·Am
0 1
n n
m
m m
0 1
′ ; s ′ ), so ·! (s ′′ ; A′′ ; . . . ; A′′ ; s ′′ ).
then ·! (s0 ; A1 ; . . . ; An ; sn · s0′ ; A1′ ; . . . ; Am
m
n+m n+m
0
1
′ ), and [t · B
From Lemma 8, as ·! (t0 ; Bσ′ (1) ; . . . ; Bσ1 (n) ; tn ), ·! (t0′ ; Bσ′ (1) ; . . . ; Bσ′ (m) ; tm
0
σ1 (1) · . . . ·
1
2
2
!
′
′
′
′
!
′ ),
Bσ1 (n) · tn ] · [t0 · Bσ (1) · . . . · Bσ (m) · tm ], then · (t0 ; Bσ1 (1) ; . . . ; Bσ1 (n) ; tn · t0′ ; Bσ′ (1) ; . . . ; Bσ′ (m) ; tm
2
2
2
2
′′
so ·! (t0′′ ; Bσ′′1 ⊙σ2 (1) ; . . . ; Bσ′′1 ⊙σ2 (n+m) ; tn+m
).
Consider the derivation
al i : Ai ⇔ Bi
′′
′′
′′
)
·! (s0′′ ; A1′′ ; . . . ; An+m
; sn+m
)
·! (t0′′ ; Bσ′′1 ⊙σ2 (1) ; . . . ; Bσ′′1 ⊙σ2 (n+m) ; tn+m

σ1 ⊙ σ2 ∈ Sn+m

′′
′′
([(s0′′, t0′′ ) · al 1 · . . . · al n+m · (sn+m
, tn+m
)], σ1 ⊙ σ2 ) :̃
′′
′′
′′
′′
′′
′′
′′
· A1 · . . . · An+m · sn+m ] ⇔ [t0 · B1 · . . . · Bn+m
· tn+m
]

[s0′′

We wish to show that this is a derivation of sql 1 ⊙sql sql 2 : SQ 1 ⊙SQ SQ 2 ⇔ TQ 1 ⊙SQ TQ 2 .
′′
′′
′′
([(s0′′ , t0′′ ) · al 1′′ · . . . · al n+m
· (sn+m
, tn+m
)], σ1 ⊙ σ2 ) =

=
=
′′
′′ ]
[s0′′ · A1′′ · . . . · An+m
· sn+m

′′ ]
[t0′′ · Bσ′′1 ⊙σ2 (1) · . . . · Bσ′′1 ⊙σ2 (n+m) · tn+m

([(s0′′ , t0′′ ) · al 1′′ · . . . · al n′′ · (sn′′ , tn′′ )·
′′
′′
′′ , t ′′ )], σ ⊙ σ )
al n+1
· . . . · al n+m
· (sn+m
1
2
n+m
([(s0 , t0 ) · al 1 · . . . · al n · (sn · s0′ , tn · t0′ )·
′
′ , t ′ )], σ ⊙ σ )
al 0′ · . . . · alm
· (sm
1
2
m
sql 1 ⊙sql sql 2

′′ · . . . A′′
′′
[s0′′ · A1′′ · . . . · An′′ · sn′′ · An+1
n+m · sn+m ]
′ · s′ ]
[s0 · A1 · . . . · An · (sn · s0′ ) · A1′ · . . . Am
m
SQ 1 ⊙SQ SQ 2

=
=
=

[t0′′ · Bσ′′1 ⊙σ2 (1) · . . . · Bσ′′1 ⊙σ2 (n)·
′′ ]
tn′′ · Bσ′′1 ⊙σ2 (n+1) · . . . · Bσ′′1 ⊙σ2 (n+m) · tn+m
′′
′′
′′
′′
′′
′′
= [t0 · Bσ1 (1) · . . . · Bσ1 (n) · tn · Bσ2 (1)+n · . . . · Bσ′′2 (m)+n · tn+m
]
′
= [t0 · Bσ1 (1) · . . . · Bσ1 (n) · tn · t0
′ ]
·Bσ′ 2 (1) · . . . · Bσ′ 2 (m) · tm
= TQ 1 ⊙SQ TQ 2
=

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:86

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

So we have a derivation of sql 1 ⊙sql sql 2 : SQ 1 ⊙SQ SQ 2 ⇔ TQ 1 ⊙SQ TQ 2
We also wish to have the desired semantics.
′′
′′
′′
[[([(s0′′, t0′′ ) · al 1′′ · . . . · al n+m
· (sn+m
, tn+m
)], σ1 ⊙ σ2 )]]
′′
′′
′′ ))
′′
= {(s0 · s1 · . . . · sn+m · sn+m , t0 · tσ1 ⊙σ2 (1) · . . . · tσ1 ⊙σ2 (n+m) · tn+m
′′
| ∀i ∈ [1, n + m].(si , ti ) ∈ sql i }
′
′ · s′ , t · t
′
= {(s0 · s1 · . . . · sn · sn · s0′ · s0′ · . . . · sm
m 0 σ1 (1) · . . . · tσ1 (n) · tn · t0 · tσ

[1, m].(si′, ti′ )

| (∀i ∈ [1, n].(si , ti ) ∈ sql i ∧ ∀i ∈
= {(s · s ′ , t · t ′ ) | (s, t) ∈ [[sql 1 ]] ∧ (s ′ , t ′ ) ∈ [[sql 2 ]]}

∈

sql i′ }

2 (0)

· . . . · tσ′

2 (m)

′ ))
· tm


Lemma 99 (Typing and Semantics of ssql ). Let sql 1 : SQ 1 ⇔ TQ 1 and sql 2 : SQ 2 ⇔ TQ 2 be the
typing of two sequence lenses, where L(SQ1 ) ·! L(SQ2 ) and L(TQ2 ) ·! L(TQ1 ) Then sql 1 ⊙sql sql 2 :
SQ 1 ⊙SQ SQ 2 ⇔ TQ 1 ⊙SQ TQ 2 and [[sql 1 ⊙sql sql 2 ]] = {(s1 ·s2 , t1 ·t2 ) | (s1 , t1 ) ∈ [[sql 1 ]] ∧ (s2 , t2 ) ∈ [[sql 2 ]]}
Proof. By assumption, there exists typing derivations
sql 1 :̃ SQ 1 ⇔ TQ 1
and
sql 2 :̃ SQ 2 ⇔ TQ 2
By inversion, we know that the last rule application on each side was DNF Lens, giving
al i : Ai ⇔ Bi

σ1 ∈ S n

·! (s0 · A1 · . . . · An · sn )

·! (t0 · Bσ1 (1) · . . . · Bσ1 (n) · tn )

([(s0 , t0 ) · al 1 · . . . · al n ], σ1 ) :̃ [s0 · A1 · . . . · An · sn ] ⇔ [t0 · Bσ1 (1) · . . . · Bσ1 (n) · tn ]
and
al i′ : Ai′ ⇔ Bi′

′
′
·! (s0′ · A1′ · . . . · Am
· sm
)

σ 2 ∈ Sm

·! (t0′ · Bσ′ 2 (1) · . . . · Bσ′ 2 (n) · tn′ )

′
′
′
′
′
′
]
([(s0′ , t0′ ) · al 1′ · . . . · alm
· (sm
, tm
)], σ2 ) :̃ [s0′ · A1′ · . . . · Am
· sm
] ⇔ [t0′ · Bσ′ 2 (1) · . . . · Bσ′ 2 (m) · tm

where
sql 1
SQ 1
TQ 1
sql 2
SQ 2
TQ 2

=
=
=
=
=
=

([(s0 , t0 ) · al 1 · . . . · al n ], σ1 )
[s0 · A1 · . . . · An · sn ]
[t0 · Bσ1 (1) · . . . · Bσ1 (n) · tn ]
′
′ , t ′ )], σ )
· (sm
([(s0′ , t0′ ) · al 1′ · . . . · alm
2
m
′
′
′
′
[s0 · A1 · . . . · Am · sm ]
′ ]
[t0′ · Bσ′ (1) · . . . · Bσ′ (m) · tm
2

2

Deﬁne si′′ as si for i ∈ [1, n − 1], and as si′−n for i ∈ [n + 1, n + m], and as sn · s0′ for i = n.
′ · t for i = m.
Deﬁne ti′′ as ti′ for i ∈ [1, m − 1], and as ti −m for i ∈ [m + 1, m + n], and as tm
0
′′
′
Deﬁne Ai as Ai for i ∈ [1, n], and as Ai −n for i ∈ [n + 1, n + m].
Deﬁne Bi′′ as Bi′ for i ∈ [1, m], and as Bi −m for i ∈ [m + 1, m + n].
Deﬁne al i as al i for i ∈ [1, n], and as al i′−n for i ∈ [n + 1, n + m].
′
′
From Lemma 8, as ·! (s0 ; A1 ; . . . ; An ; sn ), ·! (s0′ ; A1′ ; . . . ; Am
; sm
), and [s0 · A1 · . . . · An · sn ] ·! [s0′ · A1′ ·
′
′
!
′
′
′
′
′′ ; s ′′ ).
. . . · Am · sm ], then · (s0 ; A1 ; . . . ; An ; sn · s0 ; A1 ; . . . ; Am ; sm ), so ·! (s0′′ ; A1′′ ; . . . ; An+m
n+m
! ′ ′
′
′
!
′
From Lemma 8, as · (t0 ; Bσ2 (1) ; . . . ; Bσ2 (m) ; tm ), · (t0 ; Bσ1 (1) ; . . . ; Bσ1 (n) ; tn ), and [t0′ · Bσ′ 2 (1) · . . . ·
′ ] ·! [t · B
! ′ ′
′
′
Bσ′ 2 (m) · tm
0
σ1 (1) · . . . · Bσ1 (n) · tn ], then · (t0 ; Bσ2 (1) ; . . . ; Bσ2 (m) ; tm · t0 ; Bσ1 (1) ; . . . ; Bσ1 (n) ; tn ),
!
′′
′′
′′
′′
so · (t0 ; Bσ1 sσ2 (1) ; . . . ; Bσ1 sσ2 (n+m) ; tn+m ).
Consider the derivation
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:87

al i : Ai ⇔ Bi
′′
′′
′′
)
·! (s0′′ ; A1′′ ; . . . ; An+m
; sn+m
)
·! (t0′′ ; Bσ′′1 ⊙σ2 (1) ; . . . ; Bσ′′1 ⊙σ2 (n+m) ; tn+m

σ1 sσ2 ∈ Sn+m

′′
′′
([(s0′′, t0′′ ) · al 1 · . . . · al n+m · (sn+m
, tn+m
)], σ1 sσ2 ) :̃
′′
′′
′′
′′
′′
′′
′′
· A1 · . . . · An+m · sn+m ] ⇔ [t0 · B1 · . . . · Bn+m
· tn+m
]

[s0′′

We wish to show that this is a derivation of sql 1 ssql sql 2 : SQ 1 ⊙SQ SQ 2 ⇔ TQ 2 ⊙SQ TQ 1 .
′′
′′
By the deﬁnition of ssql , si′′ , and ti′′ , ([(s0′′ , t0′′ )·al 1 ·. . .·al n+m ·(sn+m
, tn+m
)], σ1 sσ2 ) = sql 1 ssql sql 2
′′
′′ ]
· sn+m
[s0′′ · A1′′ · . . . · An+m

=
=
=

′′ · . . . A′′
′′
[s0′′ · A1′′ · . . . · An′′ · sn′′ · An+1
n+m · sn+m ]
′
′
′
′
[s0 · A1 · . . . · An · (sn · s0 ) · A1 · . . . Am · sm ]
SQ 1 ⊙SQ SQ 2

′′
[t0′′ · Bσ′′1 sσ2 (1) · . . . · Bσ′′1 sσ2 (n+m) · tn+m
]

[t0′′ · Bσ′′1 sσ2 (1) · . . . · Bσ′′1 sσ2 (m)
′′ · B′′
·tm
σ1 sσ2 (n+1)
′′
· . . . · Bσ′′1 sσ2 (n+m) · TQ n+m
]
′′
′′
′′
= [t0 · Bσ2 (1)+n · . . . · Bσ2 (m)+n
′′ ]
·tn′′ · Bσ′′1 (1) · . . . · Bσ′′(m) · tn+m
= [t0′ · Bσ′ 2 (1) · . . . · Bσ′ 2 (m)
′ · t ·B
·tm
0
σ1 (1) · . . . · Bσ1 (n) · tn ]
= TQ 1 ⊙SQ TQ 2
So we have a derivation of sql 1 ⊙sql sql 2 : SQ 1 ⊙SQ SQ 2 ⇔ TQ 1 ⊙SQ TQ 2
We also wish to have the desired semantics.
=

′′
′′
′′
[[([(s0′′, t0′′ ) · sql 1′′ · . . . · sql n+m
· (sn+m
, tn+m
)], σ1 sσ2 )]]
′′
′′
′′ ))
′′
= {(s0 · s1 · . . . · sn+m · sn+m , t0 · tσ1 sσ2 (1) · . . . · tσ1 sσ2 (n+m) · tn+m
′′
| ∀i ∈ [1, n + m].(si , ti ) ∈ sql i }
′
′ · s′ , t ′ · t ′
′
= {(s0 · s1 · . . . · sn · sn · s0′ · s0′ · . . . · sm
m 0 σ (1) · . . . · tσ (m) · tm · t0 · tσ1 (0) · . . . · tσ1 (n) · tn ))
2

2

| (∀i ∈ [1, n].(si , ti ) ∈ sql i ∧ ∀i ∈ [1, m].(si′, ti′ ) ∈ sql i′ }
′
= {(s · s , t ′ · t) | (s, t) ∈ [[sql 1 ]] ∧ (s ′ , t ′ ) ∈ [[sql 2 ]]}

Lemma 100 (Typing and Semantics of ⊙). Let dl 1 : DS 1 ⇔ DT 1 and dl 2 : DS 2 ⇔ DT 2 be
the typing of two DNF lenses, where L(DS1 ) ·! L(DS2 ) and L(DT 1 ) ·! L(DT 2 ). Then dl 1 ⊙ dl 2 :
DS 1 ⊙ DS 2 ⇔ DT 1 ⊙ DT 2 and [[dl 1 ⊙ dl 2 ]] = {(s1 · s2 , t1 · t2 ) | (s1 , t1 ) ∈ [[dl 1 ]] ∧ (s2 , t2 ) ∈ [[dl 2 ]]}
Proof. By assumption, there exists typing derivations
dl 1 :̃ DS 1 ⇔ DT 1
and
dl 2 :̃ DS 2 ⇔ DT 2
By inversion, we know that the last rule application on each side was DNF Lens, giving

σ1 ∈ S n

sql 1 :̃ SQ 1 ⇔ TQ 1
...
i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅

(hsql 1 | . . . | sql n i, σ1 ) :̃

sql n :̃ SQ n ⇔ TQ n
i , j ⇒ L(TQi ) ∩ L(TQ j ) = ∅

hSQ 1 | . . . | SQn i ⇔ hTQ σ1 (1) | . . . | TQ σ1 (n) i
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:88

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

and
σ 2 ∈ Sm

′
⇔ TQm
...
sql n′ :̃ SQm
sql 1′ :̃ SQ 1′ ⇔ TQ 1
i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅
i , j ⇒ L(TQi ) ∩ L(TQ j ) = ∅

(hsql 1′ | . . . | sql n′ i, σ2 ) :̃

hSQ 1′ | . . . | SQ n′ i ⇔ hTQ σ′ 2 (1) | . . . | TQ σ′ 2 (m) i

where
dl 1
DS 1
DT 1
dl 2
DS 2
DT 2

=
=
=
=
=
=

(hsql 1 | . . . | sql n i, σ1 )
hSQ 1 | . . . | SQn i
hTQ σ1 (1) | . . . | TQ σ1 (n) i
(hsql 1′ | . . . | sql n′ i, σ2 )
hSQ 1′ | . . . | SQn′ i
hTQ σ′ 2 (1) | . . . | TQ σ′ 2 (m) i

Deﬁne SQi ,j as SQi ⊙SQ SQ ′j .
Deﬁne TQi ,j as TQi ⊙SQ TQ ′j
From Lemma 9, as i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅, i , j ⇒ L(SQi′ ) ∩ L(SQ ′j ) = ∅, and
′ i, then SQ ·! SQ ′ , and (i , j ) , (i , j ) ⇒ L(SQ
hSQ 1 | . . . | SQn i·! hSQ 1′ | . . . | SQm
1 1
2 2
i
i 1 ,j1 )∩L(SQi 2 ,j2 ) =
j
∅.
From Lemma 9, as i , j ⇒ L(TQi ) ∩ L(TQ j ) = ∅, i , j ⇒ L(TQi′ ) ∩ L(TQ ′j ) = ∅, and
′ i, then TQ ·! TQ ′ , and (i , j ) , (i , j ) ⇒ L(TQ
hTQ 1 | . . . | TQ n i ·! hTQ 1′ | . . . | TQm
1 1
2 2
i
i 1 ,j1 ) ∩
j
L(TQi 2 ,j2 ) = ∅.
So, from Lemma 98, sql i ⊙sql sql j :̃ SQ i ⊙SQ SQ j ⇔ TQ i ⊙SQ TQ j .
Deﬁne sql i ,j = sql i ⊙sql sql j
Consider the derivation
sqli ,j : SQi ,j ⇔ TQ i ,j

σ1 ⊗ σ2 ∈ Sn×m
(i 1 , j 1 ) , (i 2 , j 2 ) ⇒ L(SQi 1 ,j1 ) ∩ L(SQi 2 ,j2 ) = ∅
(i 1 , j 1 ) , (i 2 , j 2 ) ⇒ L(TQi 1 ,j1 ) ∩ L(TQi 2 ,j2 ) = ∅

(hsql 1,1 | . . . | sql n,m i, σ1 ⊗ σ2 ) :̃ hSQ 1,1 | . . . | SQ n,m i ⇔ hTQ 1,1 | . . . | TQ n,m i
We wish to show that this is a derivation of dl 1 ⊙ dl 2 : DS 1 ⊙ DS 2 ⇔ DT 1 ⊙ DT 2 .
′
(hsql 1,1 | . . . | sql n,m i, σ1 ⊗ σ2 ) = (sql 1 ⊙sql sql 1′ | . . . | sql n ⊙sql sqlm
, σ1 ⊗ σ2 ) = dl 1 ⊙ dl 2 .
′
′
hSQ 1,1 | . . . | SQn,m i = hSQ 1 ⊙SQ SQ 1 | . . . | SQn ⊙SQ SQm i = DS 1 ⊙ DS 2
′
hTQ 1,1 | . . . | TQn,m i = hTQ 1 ⊙SQ TQ 1′ | . . . | TQn ⊙SQ TQm
i = DT 1 ⊙ DT 2
So we have a derivation of sql 1 ⊙sql sql 2 : SQ 1 ⊙SQ SQ 2 ⇔ TQ 1 ⊙SQ TQ 2
We also wish to have the desired semantics.
[[(hsql 1,1 | . . . | sql n,m i, σ1 ⊗ σ2 )]]
= {(s1 · s2 , t1 · t2 ) | ∃i, j.(s1 , t1 ) ∈ [[sql i ]] ∧ (s2 , t2 ) ∈ [[sql j ]]}
= {(s1 · s2 , t1 · t2 ) | (s1 , t1 ) ∈ [[dl]] ∧ (s2 , t2 ) ∈ [[dl ′ ]]}

Lemma 101 (Typing and Semantics of s). Let dl 1 : DS 1 ⇔ DT 1 and dl 2 : DS 2 ⇔ DT 2 be
the typing of two DNF lenses, where L(DS1 ) ·! L(DS2 ) and L(DT 2 ) ·! L(DT 1 ). Then dl 1 ⊙ dl 2 :
DS 1 ⊙ DS 2 ⇔ DT 1 ⊙ DT 2 and [[dl 1 ⊙ dl 2 ]] = {(s1 · s2 , t1 · t2 ) | (s1 , t1 ) ∈ [[dl 1 ]] ∧ (s2 , t2 ) ∈ [[dl 2 ]]}
Proof. By assumption, there exists typing derivations
dl 1 :̃ DS 1 ⇔ DT 1
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:89

and
dl 2 :̃ DS 2 ⇔ DT 2
By inversion, we know that the last rule application on each side was DNF Lens, giving

σ1 ∈ S n

sql 1 :̃ SQ 1 ⇔ TQ 1
...
i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅

(hsql 1 | . . . | sql n i, σ1 ) :̃
and
σ 2 ∈ Sm

sql n :̃ SQ n ⇔ TQ n
i , j ⇒ L(TQi ) ∩ L(TQ j ) = ∅

hSQ 1 | . . . | SQn i ⇔ hTQ σ1 (1) | . . . | TQ σ1 (n) i

′
⇔ TQm
...
sql n′ :̃ SQm
sql 1′ :̃ SQ 1′ ⇔ TQ 1
i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅
i , j ⇒ L(TQi ) ∩ L(TQ j ) = ∅

(hsql 1′ | . . . | sql n′ i, σ2 ) :̃

hSQ 1′ | . . . | SQ n′ i ⇔ hTQ σ′ 2 (1) | . . . | TQ σ′ 2 (m) i

where
dl 1
DS 1
DT 1
dl 2
DS 2
DT 2

=
=
=
=
=
=

(hsql 1 | . . . | sql n i, σ1 )
hSQ 1 | . . . | SQn i
hTQ σ1 (1) | . . . | TQ σ1 (n) i
(hsql 1′ | . . . | sql n′ i, σ2 )
hSQ 1′ | . . . | SQn′ i
hTQ σ′ 2 (1) | . . . | TQ σ′ 2 (m) i

Deﬁne SQi ,j as SQi ⊙SQ SQ ′j .
Deﬁne TQ j,i as TQ ′j ⊙SQ TQi
From Lemma 9, as i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅, i , j ⇒ L(SQi′ ) ∩ L(SQ ′j ) = ∅, and
′ i, then SQ ·! SQ ′ , and (i , j ) , (i , j ) ⇒ L(SQ
hSQ 1 | . . . | SQn i·! hSQ 1′ | . . . | SQm
1 1
2 2
i
i 1 ,j1 )∩L(SQi 2 ,j2 ) =
j
∅.
From Lemma 9, as i , j ⇒ L(TQi ) ∩ L(TQ j ) = ∅, i , j ⇒ L(TQi′ ) ∩ L(TQ ′j ) = ∅, and
′ i ·! hTQ | . . . | TQ i, then TQ ′ ·! TQ , and (j , i ) , (j , i ) ⇒ L(TQ
hTQ 1′ | . . . | TQm
1 1
2 2
1
n
i
j1 ,i 1 ) ∩
j
L(TQ j2 ,i 2 ) = ∅.
So, from Lemma 99, sql i ssql sql j :̃ SQi ⊙SQ SQ j ⇔ TQ j ⊙SQ TQ i .
Deﬁne sql i ,j = sql i ssql sql j
Consider the derivation
sql i ,j : SQi ,j ⇔ TQ j,i

σ1 ⊗s σ2 ∈ Sn×m
(i 1 , j 1 ) , (i 2 , j 2 ) ⇒ L(SQi 1 ,j1 ) ∩ L(SQi 2 ,j2 ) = ∅
(j 1 , i 1 ) , (j 2 , i 2 ) ⇒ L(TQ j1 ,i 1 ) ∩ L(TQ j2 ,i 2 ) = ∅

(hsql 1,1 | . . . | sql n,m i, σ1 ⊗s σ2 ) :̃ hSQ 1,1 | . . . | SQn,m i ⇔ hTQ 1,1 | . . . | TQm,n i
We wish to show that this is a derivation of dl 1 sdl 2 : DS 1 ⊙ DS 2 ⇔ DT 2 ⊙ DT 1 .
′
(hsql 1,1 | . . . | sql n,m i, σ1 ⊗s σ2 ) = (sql 1 ssql sql 1′ | . . . | sql n ssql sqlm
, σ1 ⊗s σ2 ) = dl 1 sdl 2 .
′
′
hSQ 1,1 | . . . | SQn,m i = hSQ 1 ⊙SQ SQ 1 | . . . | SQn ⊙SQ SQm i = DS 1 ⊙ DS 2
′
hTQ 1,1 | . . . | TQm,n i = hTQ 1′ ⊙SQ TQ 1 | . . . | TQm
⊙SQ TQ n i = DT 2 ⊙ DT 1
So we have a derivation of sql 1 ssql sql 2 : SQ 1 ⊙SQ SQ 2 ⇔ TQ 2 ⊙SQ TQ 1
We also wish to have the desired semantics.
[[(hsql 1,1 | . . . | sql n,m i, σ1 ⊗s σ2 )]]
= {(s1 · s2 , t2 · t1 ) | ∃i, j.(s1 , t1 ) ∈ [[sql i ]] ∧ (s2 , t2 ) ∈ [[sql j ]]}
= {(s1 · s2 , t2 · t1 ) | (s1 , t1 ) ∈ [[dl]] ∧ (s2 , t2 ) ∈ [[dl ′ ]]}

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:90

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Lemma 102 (Typing and Semantics of ⊕). Let dl 1 : DS 1 ⇔ DT 1 and dl 2 : DS 2 ⇔ DT 2 be the
typing of two DNF lenses, where L(DS1 ) ∩ L(DS2 ) = ∅ Then dl 1 ⊕ dl 2 : DS 1 ⊕ DS 2 ⇔ DT 1 ⊕ DT 2
and [[dl 1 ⊕ dl 2 ]] = {(s, t) | (s, t) ∈ [[dl1 ]] ∨ (s, t) ∈ [[dl 2 ]]}
Proof. By assumption, there exists typing derivations
dl 1 :̃ DS 1 ⇔ DT 1
and
dl 2 :̃ DS 2 ⇔ DT 2
By inversion, we know that the last rule application on each side was DNF Lens, giving
sql i : SQi ⇔ TQi

σ1 ∈ S n

i , j ⇒ SQi ∩ SQ j = ∅

i , j ⇒ TQi ∩ TQ j = ∅

(hsql 1 | . . . | sql n i, σ1 ) :̃ hSQ 1 | . . . | SQn i ⇔ hTQ σ1 (1) | . . . | TQ σ1 (n) i
and
sql i′ : SQi′ ⇔ TQi′

i , j ⇒ SQi′ ∩ SQ ′j = ∅

σ 2 ∈ Sm

i , j ⇒ TQ i′ ∩ TQ ′j = ∅

′
′
(hsql 1′ | . . . | sqlm
i, σ2 ) :̃ hSQ 1′ | . . . | SQm
i ⇔ hTQ σ′ 2 (1) | . . . | TQ σ′ 2 (m) i

where dl 1 = (hsql 1 | . . . | sql n i, σ1 ), DS 1 = hSQ 1 | . . . | SQn i, DT 1 = hTQ σ1 (1) | . . . | TQ σ1 (n) i,
′
′
dl 2 = (hsql 1′ | . . . | sqlm
i, σ2 ), DS 2 = hSQ 1′ | . . . | SQm
i, and DT 2 = hTQ σ′ 2 (1) | . . . | TQ σ′ 2 (m) i.
Deﬁne SQ i as SQi′−n for i ∈ [n + 1, n + m]. Deﬁne TQ i as TQ i −n for i ∈ [n + 1, n + m]. Deﬁne sql i
as sql i′−n for i ∈ [n + 1, n + m].
If i , j, and i, j ∈ [1, n], then SQi ∩SQ j = ∅ by the derivation of dl 1 . If i , j, and i, j ∈ [n+1, n+m],
then SQi ∩ SQ j = ∅ by the derivation of dl 2 . If i , j and i ∈ [1, n] and j ∈ [n + 1, n + m], then
SQi ∩ SQ j = ∅ as DS 1 ∩ DS 2 = ∅, and L(SQi ) ⊂ L(DS1 ), and L(SQ j ) ⊂ L(DS1 ). If i , j and
i ∈ [n + 1, n + m] and j ∈ [1, n], then SQi ∩ SQ j = ∅ as ∩ is commutative. Because of these cases, if
i , j, then SQi ∩ SQ j = ∅ for all i, j ∈ [1, n + m].
For a symmetric reason, if i , j, then TQi ∩ TQ j = ∅, for all i, j ∈ [1, n + m].
Consider the derivation
sql i : SQi ⇔ TQi

σ1 ⊙ σ2 ∈ S n

i , j ⇒ SQi ∩ SQ j = ∅

i , j ⇒ TQi ∩ TQ j = ∅

(hsql 1 | . . . | sql n+m i, σ1 ⊙ σ2 ) :̃ hSQ 1 | . . . | SQ n+m i ⇔ hTQ σ1 ⊙σ2 (1) | . . . | TQ σ1 ⊙σ2 (1)(n+m) i
We wish to show that this is a derivation of dl 1 ⊕ dl 2 : DS 1 ⊕ DS 2 ⇔ DT 1 ⊕ DT 2 .
(hsql 1 | . . . | sql n+m i, σ1 ⊙ σ2 )
hSQ 1 | . . . | SQn+m i
hTQ σ1 ⊙σ2 (1) | . . . | TQ σ1 ⊙σ2 (n+m) i

=
=
=
=

′
i, σ1 ⊙ σ2 )
= (hsql 1 | . . . | sql n | sql 1′ | . . . | sqlm
= dl 1 ⊕ dl 2

= hSQ 1 | . . . | SQn | SQ 1′ | . . . SQn′ i
= DS 1 ⊕ DS 2
hTQ σ1 (1) | . . . | TQ σ1 (n) | TQ σ2 (n+1−n)+n | TQ σ2 (n+m−n)+n i
hTQ σ1 (1) | . . . | TQ σ1 (n) | TQ σ2 (1)+n | TQ σ2 (m)+n i
hTQ σ1 (1) | . . . | TQ σ1 (n) | TQ σ′ 2 (1) | TQ σ′ 2 (m) i
DT 1 ⊕ DT 2

So we have a derivation of dl 1 ⊕ dl 2 : DS 1 ⊕ DS 2 ⇔ DT 1 ⊕ DT 2
We also wish to have the desired semantics.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:91

{(s, t) | (s, t) ∈ sqli for some i}
{(s, t) | (s, t) ∈ sqli for some i ∈ [1, n]∨
(s, t) ∈ sql i for some i ∈ [n + 1, n + m]}
{(s, t) | (s, t) ∈ sqli for some i ∈ [1, n]∨
(s, t) ∈ sql i′ for some i ∈ [1, m]}
{(s, t) | (s, t) ∈ [[dl1 ]] ∨ (s, t) ∈ [[dl 2 ]]}

[[(hsql 1 | . . . | sql n+m i, σ1 ⊙ σ2 )]] =
=
=
=


Lemma 103 (Typing and Semantic of D). If al :̃ A ⇔ B is the typing of a rewriteless Atom lens,
then D(al) :̃ D(A) ⇔ D(B), and [[D(al)]] = [[al]].
Proof. Let al :̃ A ⇔ B.
·! ((ϵ; A; ϵ)) because L(ϵ) = {ϵ }. ·! ((ϵ; B; ϵ)) because L(ϵ) = {ϵ }.
As there is only one sequence, the pointwise disjoint condition for DNF lenses are true vacuously.
Consider the typing derivation
al :̃ A ⇔ B

·! ((ϵ; A; ϵ))

·! ((ϵ; B; ϵ))

([(ϵ, ϵ) · al · (ϵ, ϵ)], id) :̃ [ϵ · A · ϵ] ⇔ [ϵ · B · ϵ]

i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅

(h([(ϵ, ϵ) · al · (ϵ, ϵ)], id)i, id) :̃ h[ϵ · A · ϵ]i ⇔ h[ϵ · B · ϵ]i
D(al) = (h([(ϵ, ϵ) · al · (ϵ, ϵ)], id)i, id).
[[[(ϵ, ϵ) · al · (ϵ, ϵ)]]] = {(ϵ, s, ϵ, ϵ, t, ϵ) | (s, t) ∈ L(al)} = [[al]].
[[(h([(ϵ, ϵ) · al · (ϵ, ϵ)], id)i, id)]] = {(s, t) | (s, t) ∈ [[[(ϵ, ϵ) · al · (ϵ, ϵ)]]]} = {(s, t) | (s, t) ∈ [[al]]} =
[[al]]

Lemma 104 (Typing and Semantics of D(iterate(·))). Let dl :̃ DS ⇔ DT be the typing of a rewriteless DNF lens, where DS ∗! and DT ∗! . h[iterate(dl)]i :̃ h[DS ∗ ]i ⇔ h[DT ∗ ]i and [[h[iterate(dl)]i]] =
{(s1 · . . . · sn , t1 · . . . · tn ) | (si , ti ) ∈ [[dl]]}
Proof. By assumption, there exists a typing derivation
dl :̃ DS ⇔ DT
Consider the typing derivation
dl :̃ DS ⇔ DT

DS ∗!

DT ∗!

iterate(dl) :̃ DS ∗ ⇔ DT ∗

·! (ϵ; DS; ϵ)

·! (ϵ; DT; ϵ)

[(ϵ, ϵ) · iterate(dl) · (ϵ, ϵ)] :̃ [ϵ · DS · ϵ] ⇔ [ϵ · DS · ϵ]
h[iterate(dl)]i :̃ h[DS ∗ ]i ⇔ h[DT ∗ ]i
And the semantics are shown to be equal to the desired semantics.
[[h[iterate(dl)]i]] =
=
=

{(s, t) | (s, t) ∈ [[[iterate(dl)]]]}
{(ϵ · s · ϵ, ϵ · t · ϵ) | (s, t) ∈ [[iterate(dl)]]}
{(s1 · . . . · sn , t1 · . . . · tn ) | (si , ti ) ∈ [[dl]]}

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:92
B.9

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic
Complex Lens Operator Properties

The previous properties of lens operators were merely about the operators, and how they could be
typed. This portion writes about how lens operators have the same semantics as lenses with very
complex properties, up to the existence of an identity lens. Much of this complication comes from
the fact that the DNF regular expression operators don’t have right distributivity. An analogue to
the commutativity of regular expression Or to be expressed using these properties.
Lemma 105 (Commutativity of ⊕). If there exists a lens dl :̃ DS 1 ⊕ DS 2 ⇔ DT 1 ⊕ DT 2 , then there
exists a lens dl :̃ DS 1 ⊕ DS 2 ⇔ DT 2 ⊕ DT 1 .
Proof. Let DS 1 = hSQ 1,1 | . . . | SQ 1,n i.
Let DS 2 = hSQ 2,1 | . . . | SQ 2,n′ i.
Let DT 1 = hTQ 1,1 | . . . | TQ 1,m i.
Let DT 2 = hTQ 2,1 | . . . | TQ 2,m′ i.
Let dl = (hsql 1 | . . . | sql n+m i, σ )
So DS 1 ⊕ DS 2 = hSQ 1 | . . . | SQn+n′ i, where SQi =



SQ 1,i
SQ 2,i −n

So DT 1 ⊕ DT 2 = hTQ σ (1) | . . . | TQ σ (m+m′) i, where TQ σ (i ) =

if i ≤ n
if i > n

TQ 1,i

TQ 2,i −m

if i ≤ m
if i > m

By inversion
σ ∈ Sn

sql 1 :̃ SQ 1 ⇔ TQ 1
...
i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅

(hsql 1 | . . . | sql n i, σ ) :̃
Consider the permutation σ ′(i) =

sql n :̃ SQ n ⇔ TQ n
i , j ⇒ L(TQi ) ∩ L(TQ j ) = ∅

hSQ 1 | . . . | SQn i ⇔ hTQ σ (1) | . . . | TQ σ (n) i

σ (i + m) if σ (i) ≤ m ′
σ (i − m) if σ (i) > m ′

Consider the lens
σ ′ ∈ Sn

sql 1 :̃ SQ 1 ⇔ TQ 1
...
i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅

sql n :̃ SQ n ⇔ TQ n
i , j ⇒ L(TQi ) ∩ L(TQ j ) = ∅

(hsql 1 | . . . | sql n i, σ ′ ) :̃
hSQ 1 | . . . | SQ n i ⇔ hTQ σ ′(1) | . . . | TQ σ ′(n) i

TQ σ (i +m) = TQ 2,i if σ (i) ≤ m ′
So TQ σ ′(i ) =
TQ σ (i −m) = TQ 1,i if σ (i) > m
So hTQ σ ′(1) | . . . | TQ σ ′(m+m′ ) i = DT 2 ⊕ DT 1 .
Furthermore, The semantics are the same, as permutation has no impact on the semantics of
DNF lenses.

Lemma 106 (Left Unrolling of iterate). If iterate(dl) :̃ DS ∗ ⇔ DT ∗ is an atom lens, then dl ′ =
h[(ϵ, ϵ)]i ⊕ (dl ⊙ D(iterate(dl))) :̃ h[ϵ]i ⊕ (DS ⊙ D(DS ∗ )) ⇔ h[ϵ]i ⊕ (DT ⊙ D(DT ∗ )) is a DNF Lens
with [[iterate(dl)]] = [[dl ′ ]]
Proof. So DS ∗ and DT ∗ are strongly unambiguous atoms.
As such, this means DS ∗! , DT ∗! , DS is strongly unambiguous, and DT is strongly unambiguous.
Want to show: because DS ∗! , DS·! D(DS ∗ ). Let s1 , s2 ∈ L(DS). Let t1 , t2 ∈ L(DS∗ ). Let s1 ·t1 = s2 ·t2 .
This is s1 · t1,1 · . . . · t1,n and s2 · t2,1 · . . . · t2,n′ . where each substring is in L(DS). By unambiguous
iteration, n = n ′, and s1 = s2 , t1,i = t2,i , so s1 = s2 and t1 = t2 .
As such Lemma 100 applies, so (dl ⊙ D(iterate(dl))) :̃ (DS ⊙ D(DS ∗ )) ⇔ (DT ⊙ D(DT ∗ )).
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:93

Want to show: because DS ∗! , L(h[ϵ]i) ∩ L(DS ⊙ D(DS∗ )) = ∅. ϵ is the only element of L(h[ϵ]i).
ϵ < L(DS ⊙ D(DS ∗ )), as it cannot be in L(DS). Otherwise if ϵ ∈ L(DS), then for all s1 · . . . · sn =
ϵ · s1 · . . . · sn , betraying unambiguous iteration.
As such Lemma 102 applies, so h[(ϵ, ϵ)]i ⊕ (dl ⊙ D(iterate(dl))) :̃ h[(ϵ, ϵ)]i ⊕ (DS ⊙ D(DS ∗ )) ⇔
h[(ϵ, ϵ)]i ⊕ (DT ⊙ D(DT ∗ )).
[[h[(ϵ, ϵ)]i ⊕ (dl ⊙ D(iterate(dl)))]] = {(s, t) | (s, t) ∈ [[h[(ϵ, ϵ)]i]] ∨ (s, t) ∈ [[dl ⊙ D(iterate(dl))]]} =
{(s, t) | (s, t) ∈ [[h[(ϵ, ϵ)]i]]} ∪ {(s, t) | (s, t) ∈ [[dl ⊙ D(iterate(dl))]]}. By the deﬁnition of ⊙ and
iterate, this equals {(ϵ, ϵ)} ∪ {(s1 · . . . · sn , t1 · . . . · tn ) | n ≥ 1 ∧ (si , ti ) ∈ [[dl]]}. Through combining
the zero case and the one case, this is {(s1 · . . . · sn , t1 · . . . · tn ) | (si , ti ) ∈ [[dl]]} = [[iterate(al)]]. 
Lemma 107 (Right Unrolling of iterate). If iterate(dl) :̃ DS ∗ ⇔ DT ∗ is an atom lens, then dl ′ =
h[(ϵ, ϵ)]i ⊕ (D(iterate(dl)) ⊙ dl) :̃ h[ϵ]i ⊕ (D(DS ∗ ) ⊙ DS) ⇔ h[ϵ]i ⊕ (D(DT ∗ ) ⊙ DT ) is a DNF Lens
with [[iterate(dl)]] = [[dl ′ ]]
Proof. This is proven symmetrically to Lemma 106.



Lemma 108 (Left Unrolling of iterate DNF). If D(iterate(dl)) is a DNF lens, then dl ′ = h[(ϵ, ϵ)]i ⊕
(dl ⊙ D(iterate(dl))) is a DNF Lens with [[iterate(dl)]] = [[dl ′ ]]
Proof. This is through a combination of Lemma 106, and Lemma 103.


′

Lemma 109 (Right Unrolling of iterate DNF). If D(iterate(dl)) is a DNF lens, then dl = h[(ϵ, ϵ)]i ⊕
(D(iterate(dl)) ⊙ dl) is a DNF Lens with [[iterate(dl)]] = [[D(dl ′ )]]
Proof. This is through a combination of Lemma 107, and Lemma 103.



Lemma 110 (Expressibility of Adjacency Swapping Permutation of Separated Concat List). Let
for all i ∈ [1, n], dli :̃ DSi ⇔ DT i Let σi be an adjacency swapping permutation, where 1 ≤ i < n.
There exists a DNF lens dl :̃ h[$]iDS 1 ⊙ h[$]i ⊙ . . . ⊙ h[$]i ⊙ DS n ⊙ h[$]i ⇔ h[$]i ⊙ DT σi (1) ⊙ . . . ⊙
DT σi (n) ⊙ h[$]i, where [[DS]] = {($ · s1 · $ · . . . · $sn · $, $ · tσi (1) · $ · . . . · $ · tσi (n) · $) | (si , ti ) ∈ [[dli ]]}.
Proof. As DSi and DT i are strongly unambiguous, by Lemma 17, and from Lemma 88, we have
that
·! (h[$]iDS 1 , h[$]i, . . . , h[$]i, h[$]i, DSn , h[$]i) and ·! (h[$]iDT σi (1) , h[$]i, . . . , h[$]i, DT σi (n) , h[$]i)
Consider the lens h[($, $)]i ⊙dl 1 ⊙ . . . ⊙((h[($, $)]i ⊙dli )s(h[($, $)]i ⊙dli +1 )) ⊙ . . . ⊙dl n ⊙ h[($, $)]i,
which by Lemma 100 and Lemma 101. h[($, $)]i ⊙ dl1 ⊙ . . . ⊙ ((h[($, $)]i ⊙ dli )s(h[($, $)]i ⊙ dli +1 )) ⊙
. . . ⊙ dl n ⊙ h[($, $)]i :̃ h[$]i ⊙ DS 1 ⊙ h[$]i ⊙ . . . ⊙ h[$]i ⊙ DS n ⊙ h[$]i ⇔ h[$]i ⊙ DS 1 ⊙ h[$]i ⊙ . . . ⊙
h[$]i ⊙ DT i +1 ⊙ h[$]i ⊙ DT i h[$]i ⊙ . . . ⊙ h[$]i ⊙ DSn ⊙ h[$]i as desired.
Also by Lemma 101, the semantics are as desired.

Lemma 111 (Expressibility of Permutation of Separated Concat List). Let for all i ∈ [1, n], dli :̃ DSi ⇔
DT i Let σ be a permutation, where 1 ≤ i < n. There exists a DNF lens dl :̃ h[$]iDS 1 ⊙ h[$]i ⊙ . . . ⊙
h[$]i ⊙ h[$]iDS n h[$]i ⇔ h[$]i ⊙ DT σ (1) ⊙ . . . ⊙ DT σ (n) ⊙ h[$]i, where [[DS]] = {($ · s1 · $ · . . . · $sn ·
$, $ · tσ (1) · $ · . . . · $ · tσ (n) · $) | (si , ti ) ∈ [[dli ]]}.
Proof. As DSi and DT i are strongly unambiguous, by Lemma 17, and as h[$]i ·! L, and L ·! h[$]i,
for all L, we have that h[$]i ⊙ DS 1 ⊙ h[$]i ⊙ . . . ⊙ h[$]i ⊙ h[$]iDS n h[$]i is strongly unambiguous.
From algebra, σ can be decomposed into a series of σi j ◦ . . . ◦ σi 1 .
We proceed by induction
Case 1 (j = 0). σ = id.
Through repeated application of ⊙, h[($, $)]i ⊙ dl 1 ⊙ . . . ⊙ dln ⊙ h[($, $)]i :̃ h[$]iDS 1 ⊙ h[$]i ⊙
. . . ⊙ h[$]i ⊙ h[$]iDSn h[$]i ⇔ DT σ (1) ⊙ . . . ⊙ DT σ (n) , where [[DS]] = {($ · s1 · $ · . . . · $sn · $, $ · t1 ·
$ · . . . · $ · tn · $) | (si , ti ) ∈ [[dli ]]}
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:94

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Case 2 (j > 0). σ = σi j ◦ . . . ◦ σi 1 . σ ′ = σi j −1 ◦ . . . ◦ σi 1 . σ = σi j ◦ σ ′.
By IH there exists a DNF lens dl :̃ h[$]iDS 1 ⊙h[$]i⊙. . .⊙h[$]i⊙h[$]iDS n h[$]i ⇔ h[$]i⊙DT σ ′(1) ⊙
. . . ⊙ DT σ ′(n) ⊙ h[$]i, where [[DS]] = {($ · s1 · $ · . . . · $sn · $, $ · tσ ′(1) · $ · . . . · $ · tσ ′(n) · $) | (si , ti ) ∈ [[dli ]]}
As DT i are strongly unambiguous, by Lemma 15, there exists an identity lens dl i′ :̃ DT i ⇔ DT i ,
for each DT i .
By Lemma 110, there exists a DNF lens dl ′ :̃ h[$]iDT σ ′(1) ⊙h[$]i⊙. . .⊙h[$]i⊙h[$]iDT σ ′ (n) h[$]i ⇔
DT σi j (σ ′ (1)) ⊙ . . . ⊙ DT σi j (σ ′(n)) , where [[DS]] = {($ · tσ ′(1) · $ · . . . · $tσ ′ (n) · $, $ · tσi j (σ ′(1)) · $ · . . . · $ ·
tσi j (σ ′ (n)) · $) | (tσ ′(i ) , tσ ′ (i ) ) ∈ [[dli ]]}.
So, by Lemma 14, there exists a DNF lens dl :̃ h[$]iDS 1 ⊙ h[$]i ⊙ . . . ⊙ h[$]i ⊙ h[$]iDSn h[$]i ⇔
h[$]i⊙DT σ (1) ⊙. . .⊙DT σ (n) ⊙h[$]i, where [[DS]] = {($·s1 ·$·. . .·$sn ·$, $·tσ (1) ·$·. . .·$·tσ (n) ·$) | (si , ti ) ∈
[[dli ]]}

Lemma 112 (Expressibility of Concat Permutation). Let for all i ∈ [1, n], dli :̃ DS i ⇔ DT i . Let
·! (s0 , DS 1 , . . . , DT n , sn ). Let σ be a permutation. Let ·! (t0 , DT σ (n) , . . . , DT σ (n) , tn ). There exists a
DNF lens dl :̃ h[s0 ]i ⊙ DS 1 ⊙ h[s1 ]i ⊙ . . . ⊙ h[sn−1 ]i ⊙ DSn ⊙ h[sn ]i ⇔ h[s0 ]i ⊙ DT σ (1) ⊙ . . . ⊙ DT σ (n) ⊙
h[sn ]i, where [[DS]] = {(s0 · s1′ · s1 · . . . · sn−1 sn′ · sn , t0 · tσ′ (1) · t1 · . . . · tn−1 · tσ′ (n) · tn ) | (si′ , ti′ ) ∈ [[dli ]]}.
Proof. By Lemma 17, DSi and DT i are strongly unambiguous.
By Lemma 15, there exists dli′ :̃ DSi ⇔ DS i , which are the identity transformations.
By Lemma 15, there exists dli′′ :̃ DT i ⇔ DT i , which are the identity transformations.
Consider the lenses
[(si , $)] :̃ [si ] ⇔ [$]
h[(si , $)]i :̃ h[si ]i ⇔ h[$]i
[($, ti )] :̃ [$] ⇔ [ti ]
h[($, ti )]i :̃ h[$]i ⇔ h[ti ]i
h[(s0 , $)]i ⊙dl 1′ ⊙ . . . ⊙
⊙ h[(sn , $)]i :̃ h[s0 ]i ⊙ DS 1 ⊙ . . . ⊙ DSn ⊙ h[sn ]i ⇔ h[$]i ⊙ DS 1 ⊙ . . . ⊙ DSn ⊙ h$i, with semantics
[[h[(s0 , $)]i ⊙ dl 1′ ⊙ . . . ⊙ dl n′ ⊙ h[(sn , $)]i]] = {(s0 · s1′ · . . . · sn′ · sn , $ · s1′ · . . . · sn′ · $) | si ∈ L(DSi )}
Because ·! ($, DT σ (1) , . . . , DT σ (n) , $), through repeated application of Lemma 100, h[($, t0 )]i ⊙
′′
dl σ (1) ⊙ . . . ⊙ dl σ′′(n) ⊙ h[($, tn )]i :̃ h[$]i ⊙ DT σ (1) ⊙ . . . ⊙ DT σ (n) ⊙ h$i ⇔ h[t0 ]i ⊙ DT σ (1) ⊙ . . . ⊙
DT σ (n) ⊙ h[tn ]i, with semantics [[h[($, t0 )]i ⊙ dl σ′′(1) ⊙ . . . ⊙ dl σ′′(n) ⊙ h[($, tn )]i]] = {($ · tσ′ (1) · . . . ·
tσ′ (n) · $, t0 · tσ′ (1) · . . . · tσ′ (n) · tn ) | si ∈ L(DT i )}
By Lemma 111, there exists a lens dl :̃ h[$]i ⊙ DS 1 ⊙ . . . ⊙ DSn ⊙ h$i ⇔ h[$]i ⊙ DT σ (1) ⊙ . . . ⊙
DT σ (n) ⊙ h$i, with semantics [[dl]] = {($ · s1′ · $ · . . . · $sn′ · $, $ · tσ′ (1) · $ · . . . · $ · tσ′ (n) · $) | (si′ , ti′ ) ∈ [[dli ]]}.
By Lemma 14, there exists a lens dl ′ :̃ h[s0 ]i ⊙ DS 1 ⊙ . . . ⊙ DSn ⊙ h[sn ]i ⇔ h[t0 ]i ⊙ DT σ (1) ⊙ . . . ⊙
DT σ (n) ⊙ h[tn ]i. The semantics, through running the strings through, is {(s0 · s1′ · s1 · . . . · sn−1 sn′ ·
sn , t0 · tσ′ (1) · t1 · . . . · tn−1 · tσ′ (n) · tn ) | (si′ , ti′ ) ∈ [[dli ]]}.

Because ·! ($, DS

dln′

1 , . . . , DS n , $), through repeated application of Lemma 100,

Lemma 113 (Identity Transformation on Adjacent Swapping Or). Let DS 1 , . . . , DSn be strongly
unambiguous DNF regular expressions, where j , k ⇒ L(DSi ) = L(DS j ).
Let σi be an adjacent swapping permutation.
There exists a lens dl :̃ DS 1 ⊕ . . . ⊕ DS n ⇔ DS σi (1) ⊕ . . . ⊕ DS σi (n) , such that [[dl]] = {(s, s) | s ∈
L(DS1 ⊕ . . . ⊕ DSn )}.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:95

Proof. As each DNF regular expression is strongly unambiguous, there exists a DNF lens
dl j :̃ DS j ⇔ DS j such that [[dl j ]] = {(s, s) | s ∈ L(DS j )}. By assumption, L(DSi )∩ L(DSi +1 ) = ∅, so
by Lemma 105, there exists dl ′ :̃ DSi ⊕ DT i ⇔ DT i ⊕ DS i . By repeated application of Lemma 102,
dl 0 ⊕ . . . ⊕ dli −1 ⊕ dl ′ ⊕ dl i +2 ⊕ . . . ⊕ dln :̃ DS 1 ⊕ . . . ⊕ DSn ⇔ DS 1 ⊕ . . . ⊕ DSi +1 ⊕ DS i ⊕ . . . ⊕ DSn .
Because each of the lenses included in this is the identity lens, the overall lens is the identity
lens.

Lemma 114 (Identity Transformation on Or Permutations). Let DS 1 , . . . , DS n be strongly unambiguous DNF regular expressions, where j , k ⇒ L(DSi ) = L(DS j ).
Let σ be a permutation.
There exists a lens dl :̃ DS 1 ⊕ . . . ⊕ DSn ⇔ DS σ (1) ⊕ . . . ⊕ DS σ (n) , such that [[dl]] = {(s, s) | s ∈
L(DS1 ⊕ . . . ⊕ DSn )}.
Proof. From algebra, there exists a decomposition of σ into adjacency switching permutations
σ = σi j ◦ . . . ◦ σi 1 .
We prove this by induction on n!
Case 1 (j = 0). σ = id
As each DSi there exists an identity transformation dl i :̃ DS i ⇔ DSi .
By repeated application of Lemma 102, dl 1 ⊕ . . . ⊕ dln :̃ DS 1 ⊕ . . . ⊕ DS n ⇔ DS 1 ⊕ . . . ⊕ DS n
with semantics of the identity, as each of the lenses that built it up have identity semantics.
Case 2 (j > 0). σ = σi j ◦ . . . ◦ σi 1 Deﬁne σ ′ = σi j −1 ◦ . . . ◦ σi 1 By IH, there exists a DNF lens
dl :̃ DS 1 ⊕ . . . ⊕ DS n ⇔ DS σ ′(1) ⊕ . . . ⊕ DS σ ′(n) .
By Lemma 113, there exists a lens dl ′ :̃ DS σ ′(1) ⊕ . . . ⊕ DS σ ′(n) ⇔ DS (σi j ◦σ ′ )(1) ⊕ . . . ⊕ DS (σi j ◦σ ′)(n) ,
so dl ′ :̃ DS σ ′(1) ⊕ . . . ⊕ DS σ ′(n) ⇔ DS σ (1) ⊕ . . . ⊕ DS σ (n) , where dl has the identity semantics.
By Lemma 14, there exists dl ′′ :̃ DS 1 ⊕ . . . ⊕ DSn ⇔ DS σ (1) ⊕ . . . ⊕ DS σ (n) . As each of its
component transformations has identity semantics identity, it too has identity semantics.

Lemma 115 (Or Permutating Lenses). Let n a natural number, and for all i ∈ [1, n], dli :̃ DSi ⇔
DT i . Let i , j ⇒ DS i ∩ DS j = ∅ and i , j ⇒ DT i ∩ DT j = ∅. Let σ be a permutation. There exists
a lens dl :̃ DS 1 ⊕ . . . ⊕ DS n ⇔ DT σ (1) ⊕ . . . ⊕ DT σ (n) such that [[dl]] = {(s, t) | ∃i . (s, t) ∈ [[dli ]]}
Proof. By Lemma 102, there exists dl 1 ⊕ . . . ⊕ dl n :̃ DS 1 ⊕ . . . ⊕ DSn ⇔ DT 1 ⊕ . . . ⊕ DT n with
[[dl 1 ⊕ . . . ⊕ dl n ]] = {(s, t) | ∃i . (s, t) ∈ [[dli ]]}. By Lemma 114, there exists a lens dl ′ :̃ DT 1 ⊕ . . . ⊕
DT n ⇔ DT σ (1) ⊕ . . . ⊕ DT σ (n) , with [[dl ′ ]] = {(s, s) | s ∈ L(DT 1 ⊕ . . . ⊕ DT n )}. By Lemma 14,
there exists dl ′′ :̃ DS 1 ⊕ . . . ⊕ DSn ⇔ DT σ (1) ⊕ . . . ⊕ DT σ (n) with semantics {(s, t) | ∃s ′ . (s, s ′ ) ∈
[[dl 1 ⊕ . . . ⊕ dl n ]] ∧ (s ′, t) ∈ [[dl ′ ]]}. As dl ′ is merely the identity, this has the desired semantics. 
Lemma 116 (Propagation of Unambiguity to Subcomponents ⊕). If DS ⊕ DT is strongly unambiguous, then DS is strongly unambiguous, DT is strongly unambiguous, and L(DS) ∩ L(DT) = ∅.
Proof. Let DS = hSQ 1 | . . . | SQ n i.
Let DT = hTQ 1 | . . . | TQm i.
DS ⊕ DT = hSQ 1 | . . . | SQn | TQ 1 | . . . | TQm i.
This means that, as it is strongly unambiguous, all of the sequences are pairwise disjoint, and
each sequence is strongly unambiguous. By Lemma 10, this means that all of the sequences in DS
are pairwise disjoint, all the sequences in DT are pairwise disjoint, and L(DS) ∩ L(DT) = ∅. 
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:96

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Lemma 117 (Reordering of ⊕ Right). If there exists a DNF lens dl :̃ DS 1 ⊕ . . . ⊕ DS n ⇔ DT 1 ⊕
. . . ⊕ DT n , then for all permutations σ ∈ Sn , there exists a DNF lens dl ′ :̃ DS 1 ⊕ . . . ⊕ DS n ⇔
DT σ (1) ⊕ . . . ⊕ DT σ (n) where [[dl ′ ]] = [[dl]].
Proof. From Lemma 17, DT 1 ⊕ . . . ⊕ DT n is strongly unambiguous. By repeated application of
Lemma 116, i , j ⇒ DT i ∩ DT j = {}, and each DT i is strongly unambiguous.
This means Lemma 114 applies, so there exists a DNF lens dl ′ :̃ DT 1 ⊕ . . . ⊕ DT n ⇔ DT σ (1) ⊕
. . . ⊕ DT σ (n) such that [[dl ′ ]] is the identity semantics.
So, by composing dl with dl ′ from Lemma 14, we get
′′
dl :̃ DS 1 ⊕ . . . ⊕ DSn ⇔ DT σ (1 ⊕ . . . ⊕ DT σ (n) , which has [[dl ′′ ]] = [[dl]] as dl ′ has identity
semantics.

Lemma 118. If DS 1 ⊙ (DS 2 ⊕ DS 3 ) is strongly unambiguous, then there exists a lens dl :̃ DS 1 ⊙
(DS 2 ⊕ DS 3 ) ⇔ (DS 1 ⊙ DS 2 ) ⊕ (DS 1 ⊙ DS 3 ).
Proof. If L(DS1 ⊙ (DS 2 ⊕ DS 3 )) = {}, then this is trivial, as DS 1 ⊙ (DS2 ⊕ DS 3 ) = {}.
Assume the language is nonempty. Let DS 1 = hSQ 1,1 | . . . | SQ 1,n1 i.
Let DS 2 = hSQ 2,1 | . . . | SQ 2,n2 i.
Let DS 3 = hSQ 3,1 | . . . | SQ 3,n3 i.
DS 2 ⊕ DS 3 = hSQ 2,1 | . . . | SQ 2,n2 | SQ 3,1 | . . . | SQ 3,n3 i.
DS 1 ⊙ (DS 2 ⊕ DS 3 ) = hSQ 1,1 ⊙SQ SQ 2,1 | . . . | SQ 1,1 ⊙SQ SQ 2,n2 | SQ 1,1 ⊙SQ SQ 3,1 | . . . | SQ 1,1 ⊙SQ
SQ 3,n3 | . . . | SQ 1,n1 ⊙SQ SQ 2,1 | . . . | SQ 1,n1 ⊙SQ SQ 2,n2 | SQ 1,n1 ⊙SQ SQ 3,1 | . . . | SQ 1,n1 ⊙SQ SQ 3,n3 i.
As this is strongly unambiguous, SQ 1,i ⊙SQ SQ j,k is strongly unambiguous for all i, j, k. Furthermore, by strong unambiguity, if (i 1 , j 1 , k 1 ) , (i 2 , j 2 , k 2 ), then SQ 1,i 1 ⊙SQ SQ j1 ,k1 ∩ SQ 1,i 2 ⊙SQ SQ j1 ,k1
DS 1 ⊙DS 2 = hSQ 1,1 ⊙SQ SQ 2,1 | . . . SQ 1,1 ⊙SQ SQ 2,n2 | . . . | SQ 1,n1 ⊙SQ SQ 2,1 | . . . | SQ 1,n1 ⊙SQ SQ 2,n2 i.
DS 1 ⊙ DS 3 = hSQ 1,1 ⊙SQ SQ 3,1 | . . . SQ 1,1 ⊙SQ SQ 3,n3 |
SQ 1,n1 ⊙SQ SQ 3,1 | . . . | SQ 1,n1 ⊙SQ SQ 3,n3 i.
(DS 1 ⊙ DS 2 ) ⊕ (DS 1 ⊙ DS 3 ) =
hSQ 1,1 ⊙SQ SQ 2,1 | . . . SQ 1,1 ⊙SQ SQ 2,n2 | . . . | SQ 1,n1 ⊙SQ SQ 2,1 | . . . | SQ 1,n1 ⊙SQ SQ 2,n2 |
SQ 1,1 ⊙SQ SQ 3,1 | . . . SQ 1,1 ⊙SQ SQ 3,n3 | . . . SQ 1,n1 ⊙SQ SQ 3,1 | . . . SQ 1,n1 ⊙SQ SQ 3,n3 i
From before, if (i 1 , j 1 , k 1 ) , (i 2 , j 2 , k 2 ), then SQ 1,i 1 ⊙SQ SQ j1 ,k1 ∩ SQ 1,i 2 ⊙SQ SQ j1 ,k1 = {}.
As SQ 1,i ⊙SQ SQ j,k is strongly unambiguous, there exists sqli ,j,k :̃ SQ 1,i ⊙SQ SQ j,k ⇔ SQ 1,i ⊙SQ
SQ j,k , from Lemma 15.
There exists a unique permutation σ that sends SQ 1,i ⊙SQ SQ j,k in DS 1 ⊙ (DS 2 ⊕ DS 3 ) to SQ 1,i ⊙SQ
SQ j,k in (DS1 ⊙ DS 2 ) ⊕ (DS 1 ⊙ DS 3 ). As a permutation is merely a bijective between a ﬁnite number
of elements. Note, this permutation is not necessarily the identity permutation. In particular, the
sequence at position n 1 + 1, if such a sequence exists, in DS 1 ⊙ (DS 2 ⊕ DS 3 ) is SQ 1,1 ⊙SQ SQ 3,1 .
However, the sequence at position n 1 + 1, if such a sequence exists, in (DS 1 ⊙ DS 2 ) ⊕ (DS 1 ⊙ DS 3 ),
is SQ 1,2 ⊙SQ SQ 2,1 .
Consider the derivation
sql :̃ SQ 1,i ⊙SQ SQ j,k ⇔ SQ 1,i ⊙SQ SQ j,k
(i 1 , j 1 , k 1 ) , (i 2 , j 2 , k 2 ) ⇒ (SQ 1,i 1 ⊙SQ SQ j1 ,k1 ) ∩ (SQ 1,i 2 ⊙SQ SQ j2 ,k2 ) = {}
σ ∈ Sn1 ×n2 ×n3
(i 1 , j 1 , k 1 ) , (i 2 , j 2 , k 2 ) ⇒ (SQ 1,i 1 ⊙SQ SQ j1 ,k1 ) ∩ (SQ 1,i 2 ⊙SQ SQ j2 ,k2 ) = {}
(hsql 1,2,1 | . . . | sql 1,2,n2 | sql 1,3,1 | . . . | sql 1,3,n3 | . . . |
sql n1 ,2,1 | . . . | sql n1 ,2,n2 | sqln1 ,3,1 | . . . | sql n1 ,3,n3 i, σ ) :̃
DS 1 ⊙ (DS 2 ⊕ DS 3 ) ⇔ (DS 1 ⊙ DS 2 ) ⊕ (DS 1 ⊙ DS 3 )
Furthermore, as each sql has the identity transformation, then as σ has no impact on semantics,
the total DNF lens has the identity transformation.

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:97

Lemma 119. If (DS 1 ⊙ DS 2 ) ⊕ (DS 1 ⊙ DS 3 ) is strongly unambiguous, then there exists a lens
dl :̃ (DS 1 ⊙ DS 2 ) ⊕ (DS 1 ⊙ DS 3 ) ⇔ DS 1 ⊙ (DS2 ⊕ DS 3 ).
Proof. By Lemma 40, DS 1 ⊙(DS 2 ⊕DS 3 ) is strongly unambiguous. So by Lemma 118, there exists
an identity lens dl :̃ (DS 1 ⊙ DS 2 ) ⊕ (DS 1 ⊙ DS 3 ) ⇔ DS 1 ⊙ (DS 2 ⊕ DS 3 ). As rewriteless DNF lenses are
closed under inversion, there exists a lens dl −1 :̃ DS 1 ⊙(DS 2 ⊕DS 3 ) ⇔ (DS 1 ⊙DS 2 )⊕(DS 1 ⊙DS 3 ). 
Lemma 120. If (DS 1 ⊕ DS 2 ) ⊙ DS 3 is strongly unambiguous, then there exists a lens dl :̃ (DS 1 ⊕
DS 2 ) ⊙ DS 3 ⇔ (DS 1 ⊙ DS 3 ) ⊕ (DS 2 ⊙ DS 3 ).
Proof. By Lemma 35, (DS 1 ⊕ DS 2 ) ⊙ DS 3 = (DS 1 ⊙ DS 3 ) ⊕ (DS 2 ⊙ DS 3 ), so by Lemma 15, there
is an identity lens between them.

Lemma 121. If (DS 1 ⊕ DS 2 ) ⊙ DS 3 is strongly unambiguous, then there exists a lens dl :̃ (DS 1 ⊙
DS 3 ) ⊕ (DS 2 ⊙ DS 3 ) ⇔ (DS 1 ⊕ DS 2 ) ⊙ DS 3 .
Proof. By Lemma 35, (DS 1 ⊕ DS 2 ) ⊙ DS 3 = (DS 1 ⊙ DS 3 ) ⊕ (DS 2 ⊙ DS 3 ), so by Lemma 15, there
is an identity lens between them.

B.10 Rewrite Property Maintenance
Here the proof of bisimilarity and conﬂuence on parallel rewrites with respect to the property of
having a lens’s semantics is presented. First a proof must be presented on Parallel Rewrites’ ability
to be built up from smaller parts through concatenation. Because of the lack of a distributivity rule,
this is only maintained up to an identity lens, we cannot merely concatenate the two rewritten
parts. With this, bisimilarity is proven, as is conﬂuence.
Lemma 122 ( →
k Maintained Under ⊙ up to id). Let DS be strongly unambiguous. Let DT be
′
′
′′
strongly unambiguous. Let L(DS) ·! L(DT ). If DS →
k ∗ DS , DT →
k ∗ DT , and DS ⊙ DT →
k ∗ DS such
′
′
′′
that there exists a rewriteless DNF lens dl :̃ DS ⊙DT ⇔ DS , and [[dl]] = {(s, s) | s ∈ L(DS ⊙DT )}.
Proof. Because L(DS) ·! L(DT ), DS ⊙ DT is strongly unambiguous.
By induction on the derivation of →
k ∗
DS = hSQ 1 | . . . | SQn i
∀i.SQi = [si ,0 · Ai ,1 · . . . · Ai ,ni · si ,ni ]
∀i, j.Ai ,j →
k A DS i ,j
∀i.DSi = h[si ,0 ]i ⊙ DSi ,1 ⊙ . . . ⊙ DSi ,ni ⊙ h[si ,ni ]i
DS →
k DS 1 ⊕ . . . ⊕ DS n
DT = hTQ 1 | . . . | SQm i
∀i.TQi = [ti ,0 · Bi ,1 · . . . · Bi ,mi · ti ,mi ]
∀i, j.Bi ,j →
k A DT i ,j
∀i.DT i = h[ti ,0 ]i ⊙ DT i ,1 ⊙ . . . ⊙ DT i ,ni ⊙ h[ti ,ni ]i

Deﬁne Ai′′,j,k =



DT →
k DT 1 ⊕ . . . ⊕ DT n
Ai ,k

if k ≤ ni

Bj,k−ni if i > ni

s
if k < ni

i ,k



′′
Deﬁne si ,j,k = si ,ni · tj,0 if k = ni


 tj,k−ni
if i > n

Deﬁne ni ,j = ni + m j .
Deﬁne SQi′′,j = [si′′,j,0 · Ai′′,j,1 · . . . · Ai′′,j,ni ,j · si′′,j,ni ,j ]. By inspection, SQ i′′,j = SQ i ⊙SQ SQ j .
′′ | . . . | SQ ′′ i. By inspection, DS ′′ = DS ⊙ DT .
Deﬁne DS ′′ = hSQ 1,1
n,m

DS
if
k
≤ ni
i
,k
′′
Deﬁne DSi′′,j,k =
. By inspection Ai′′,j,k →
k DS
.
i ,j,k
DT j,k−ni if i > ni
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:98

Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

Deﬁne DSi′′,j as h[si′′,j,0 ]i ⊙ DSi′′,j,1 ⊙ . . . ⊙ DS i ,j,ni ,j ⊙ h[si ,j,ni ,j ]i. By inspection, DS i′′,j = DSi ⊙ DS j
′′
′′
′′
′′
This means that DS 1,1
⊕ . . . ⊕ DS 1,m
⊕ . . . ⊕ DS n,1
⊕ . . . ⊕ DS n,m
= (DS 1 ⊙ DT 1 ) ⊕ . . . ⊕ (DS 1 ⊙ DT m ) ⊕
. . . ⊕ (DSn ⊙ DT 1 ) ⊕ . . . ⊕ (DSn ⊙ DT m ) By repeated application of Lemma 119 and Lemma 121,
′′
′′
there exists a DNF lens dl :̃ DS 1,1
⊕ . . . ⊕ DSn,m
⇔ (DS 1 ⊕ . . . ⊕ DSn ) ⊙ (DT 1 ⊕ . . . ⊕ DT m ), so
′′
′′
′
′
dl :̃ DS 1,1 ⊕ . . . ⊕ DSn,m ⇔ DS ⊙ DT .
Consider the derivation
′′
′′
DS ′′ = hSQ 1,1
| . . . | SQn,m
i
∀i, j.SQi′′,j = [si′′,j,0 · Ai′′,j,1 · . . . · Ai′′,j,ni ,j · si′′,j,ni ,j ]
′′
′′
′′
∀i, j.Ai ,j →
k A DS i ,j
∀i, j.DSi ,j = h[si′′,j,0 ]i ⊙ DSi′′,j,1 ⊙ . . . ⊙ DSi′′,j,ni ,j ⊙ h[si′′,j,ni ,j ]i
′′
′′
DS ′′ →
k DS 1,1 ⊕ . . . ⊕ DS n,m
′′
′′
′′
′′
DS ⊙ DT →
k DS 1,1 ⊕ . . . ⊕ DS n,m , DS 1,1 ⊕ . . . ⊕ DS n,m
′
′
′′
If DS →
k DS and DT →
k DT , then DS ⊙ DS →
k DS such that there exists a rewriteless DNF lens
dl :̃ DS ⊙ DT ⇔ DS ′′ , and [[dl]] = {(s, s) | s ∈ L(DS ⊙ DT )}, as desired.


Lemma 123 (Swap’s Unimportance For Identity).
(1) If DS is strongly unambiguous and DS →
k swap DS 1 then there exists a DS 2 such that DS →
k DS 2
and there exists a lens l :̃ DS 1 ⇔ DS 2 such that [[l]] = {(s, s) | s ∈ L(DS)}
swap
(2) If A is strongly unambiguous and A →
k A DS 1 then there exists a DS 2 such that A →
k A DS 2
and there exists a lens l :̃ DS 1 ⇔ DS 2 such that [[l]] = {(s, s) | s ∈ L(A)}
Proof. By mutual induction on the derivation of →
k swap .
swap

Case 1 (Atom UnrollstarL ). Let A →
k A DS 1 , and the last step of the derivation is an application
of Atom UnrollstarR . That means A = DS ∗ and DS 1 = h[ϵ]i ⊕ (DS ⊙ D(DS ∗ )).
Consider an application of →
k A ’s Atom UnrollstarR . A →
k DS 1 . By Lemma 15, there exists a
DNF lens dl :̃ DS 1 ⇔ DS 1 and [[dl]] = {(s, s) | s ∈ L(A)}.
swap

Case 2 (AtomUnrollstarRightRule). Let A →
k A DS 1 , and the last step of the derivation is an application of Atom UnrollstarL . That means A = DS ∗ and DS 1 = D(DS 1′ ), where
Consider an application of →
k A ’s Atom UnrollstarR . A →
k DS 1 . By Lemma 15, there exists a
DNF lens dl :̃ DS 1 ⇔ DS 1 and [[dl]] = {(s, s) | s ∈ L(A)}.
swap

Case 3 (Parallel Swap Atom Structural Rewrite). Let A →
k A DS 1 , and the last step of the
derivation is an application of Parallel Swap Atom Structural Rewrite. That means A = DS ∗
swap
′
and DS 1 = D(DS 1′ ∗ ), and DS →
k A DS 1 .
′
′
′
By IH, there exists DS 2 such that DS →
k DS 2 , and there exists a rewriteless DNF lens dl :̃ DS 1 ⇔
′
DS 2 .
′∗
By Parallel Swap Atom Structural Rewrite, A →
k A D(DS 2 ).
∗
∗
By Lemma 104, D(iterate(dl)) :̃ D(DS 1 ) ⇔ D(DS 2 ), with
[[D(iterate(dl))]] = {(s1 . . . sn , t1 . . . tn ) | (si , ti ) ∈ [[dl]]}
= {(s1 . . . sn , s1 . . . sn ) | (si , si ) ∈ L(DS)}
= {(s, s) | s ∈ L(A))}
swap
Case 4 (Parallel Swap DNF Structural Rewrite). Let DS →
k
DS ′ , and the last step of the
derivation is an application of Parallel Swap DNF Structural Rewrite.

DS = hSQ 1 | . . . | SQn i
∀i.SQi = [si ,0 · Ai ,1 · . . . · Ai ,ni · si ,ni ]
swap
∀i, j.Ai ,j →
k A DS i ,j
∀i.DSi = h[si ,0 ]i ⊙ DSi ,1 ⊙ . . . ⊙ DS i ,ni ⊙ h[si ,ni ]i
swap
DS →
k
DS 1 ⊕ . . . ⊕ DS n

and DS ′ = DS 1 ⊕ ⊕ . . . ⊕ DS n .
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:99

There exists lenses By IH, there exist DT i ,j and dli ,j , such that Ai ,j →
k DT i ,j , dl i ,j :̃ DS i ,j ⇔ DT i ,j ,
and [[dli ,j ]] = {(s, s) | s ∈ L(Ai ,j )}.
Deﬁne DT i = h[si ,0 ]i ⊙ DT i ,1 ⊙ . . . ⊙ DT i ,ni ⊙ h[si ,ni ]i.
Deﬁne DT = DT 0 ⊕ . . . ⊕ DT n
By repeated application of Lemma 100, there exists a lens dli = (h([(si ,0 , si ,0 )], id)i, id) ⊙ dl i ,1 ⊙
. . . ⊙ dl i ,ni ⊙ (h([(si ,ni , si ,ni )], id)i, id) :̃ h[si ,0 ]i ⊙ DS i ,1 ⊙ . . . ⊙ DSi ,ni ⊙ h[si ,ni ]i ⇔ h[si ,0 ]i ⊙ DT i ,1 ⊙
. . . ⊙ DT i ,ni ⊙ h[si ,ni ]i
By pushing around the deﬁnitions of ⊙, this becomes dli :̃ DSi ⇔ DT i and [[dli ]] = {(s, s) | s ∈
L(SQi )}.
By repeated applications of Lemma 102, there exists a lens dl = dl 0 ⊕. . .⊕dln :̃ DS 1 ⊕. . .⊕DS n ⇔
DT 1 ⊕ . . . ⊕ DT n .
By pushing around the deﬁnitions of ⊕, this becomes dl :̃ DS ′ ⇔ DT , and [[dl]] = {(s, s) | s ∈
L(DS)}
Furthermore,
DS = hSQ 1 | . . . | SQn i
∀i.SQi = [si ,0 · Ai ,1 · . . . · Ai ,ni · si ,ni ]
∀i, j.Ai ,j →
k DT i ,j
∀i.DT i = h[si ,0 ]i ⊙ DT i ,1 ⊙ . . . ⊙ DT i ,ni ⊙ h[si ,ni ]i
DS →
k DT 1 ⊕ . . . ⊕ DT n
Case 5 (Identity Rewrite). Let DS →
k swap DS 1 , and the last step of the derivation is an application
of Identity Rewrite.
This means DS →
k swap DS
Consider the application of →
k ’s Identity Rewrite, DS →
k DS.
By Lemma 15, there exists a DNF lens dl :̃ DS ⇔ DS and [[dl]] = {(s, s) | s ∈ L(DS)}.
Case 6 (DNF Reorder). Let DS →
k swap DS 1 , and the last step of the derivation is an application of
DNF Reorder.
Let DS = hSQ 1 | . . . | SQn i. This means that there exists a σ such that DS 1 = hSQ σ (1) | . . . | SQ σ (n) i.
Consider DS →
k DS. By Lemma 15, there exists sequence lenses sql i such that sql i :̃ SQi ⇔ SQ i
and [[sqli ]] = {(s, s) | s ∈ L(SQi )}
Consider (hsql 1 | . . . | sql n i, σ ) :̃ hSQ 1 | . . . | SQn i ⇔ hSQ σ (1) | . . . | SQ σ (n) i, which is typed as
desired. [[(hsql 1 | . . . | sql n i, σ )]] = {(s, t) | ∃i.(s, t) ∈ [[sql i ]]} = {(s, s) | ∃i.s ∈ L(SQi )} = {(s, s) | s ∈
L(DS)}

l

l

Deﬁnition 18. Let l be a lens. Deﬁne the binary relation, ⇐
⇒⊆ DNF × DNF , as DS ⇐
⇒ DT if, and
id

only if there exists a DNF Lens dl such that dl :̃ DS ⇔ DT , and [[dl]] = [[l]]. DS ⇐
⇒ DT is shorthand
id DS

for DS ⇐=
⇒ DT .
Lemma 124.
′
′
′
′
′
′
(1) Let dl :̃ DS ⇔ DT and DS →
k DS . There exists some DT , dl such that DT →
k DT , dl :̃ DS ⇔
′
′
DT , and [[dl]] = [[dl ]].
′
(2) Let al :̃ A ⇔ B and A →
k A DS. There exists some DT , dl, such that B →
k A DT , dl :̃ DS ⇔ DT ,
and [[dl]] = [[al]].

Proof. By mutual induction on the derivation of →
k and →
k A

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:100 Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic
Case 1 (Atom UnrollstarL ). Let al :̃ A ⇔ B, and A →
k A DS through an application of Atom
UnrollstarL . By inversion, there exists a derivation of
dl :̃ DS ′ ⇔ DT ′

DS ′∗!

DT ′∗!

iterate(dl) :̃ DS ′∗ ⇔ DT ′∗
Where iterate(dl) = al, DS ′ ∗ = A, and DT ′ ∗ = B.
As Atom UnrollstarL was applied, DS = h[ϵ]i ⊕ (DS ′ ⊙ h[DS ′∗ ]i).
′
′∗
Consider applying Atom UnrollstarL to DT ′∗ . DT ′∗ →
k A h[ϵ]i ⊕ (DT ⊙ h[DT ]i)
Consider the lenses
[(ϵ, ϵ)]
h[(ϵ, ϵ)]i
iterate(dl) :̃ DS ∗ ⇔ DT ∗
[iterate(dl)] :̃ [DS ∗ ] ⇔ [DT ∗ ]
h[iterate(dl)]i :̃ h[DS ∗ ]i ⇔ h[DT ∗ ]i
As DS ∗! , L(DS) ·! L(h[DS∗ ]i). As DS ∗! , ϵ < L(DS). This means ϵ < L(DS ⊙ h[DS ∗ ]i), so L(h[ϵ]i) ∩
L(DS ⊙ h[DS ∗ ]i) = ∅
Because of this, by Lemma 100 and Lemma 102, there exists the typing for the lens h[(ϵ, ϵ)]i ⊕
(dl ⊙ h[iterate(dl)]i) :̃ h[ϵ]i ⊕ (DS ⊙ h[DS ∗ ]i) ⇔ h[ϵ]i ⊕ (DT ⊙ h[DT ∗ ]i), which is the desired typing.
[[h[(ϵ, ϵ)]i ⊕ (dl ⊙ h[iterate(dl)]i)]]

=
=
=
=

=
=
=

{(s, t) | (s, t) ∈ [[h[(ϵ, ϵ)]i]]
∨(s, t) ∈ [[dl ⊙ h[iterate(dl)]i]]}
{(ϵ, ϵ)} ∪ {(s, t) | (s, t) ∈ [[dl ⊙ h[iterate(dl)]i]]}
{(ϵ, ϵ)} ∪ {(s1 · s2 , t1 · t2 ) | (s1 , t1 ) ∈ [[dl]]
∧ (s2 , t2 ) ∈ [[h[iterate(dl)]i]]}
{(ϵ, ϵ)} ∪ {(s1 · (s2,1 · . . . · s2,n ), t1 · (t2,1 · . . . · s2,n ))
| (s1 , t1 ) ∈ [[dl]] ∧ n ≥ 0 ∧
∀i ∈ [1, n].(s2,i , t2,i ) ∈ [[dl]]}
{(ϵ, ϵ)} ∪ {(s1 · . . . · sn , t1 · . . . · tn ) |
n ≥ 1 ∧ ∀i ∈ [1, n].(si , ti ) ∈ [[dl]]}
{(s1 · . . . · sn , t1 · . . . · tn ) | n ≥ 0
∧ ∀i ∈ [1, n].(si , ti ) ∈ [[dl]]}
[[iterate(dl)]]

Case 2 (Atom UnrollstarR ). Let al :̃ A ⇔ B, and A →
k A DS through an application of Atom
UnrollstarR .
Case 3 (Parallel Atom Structural Rewrite). Let al :̃ A ⇔ B, and A →
k A DS through an application of Parallel Atom Structural Rewrite. By inversion, there exists a derivation of
dl :̃ DS ′ ⇔ DT ′
iterate(dl) :̃ DS
′∗

′∗

DS ′∗!
′∗

⇔ DT

DT ′∗!
′∗

Where iterate(dl) = al, DS = A, and DT = B.
∗
As Parallel Atom Structural Rewrite was applied, DS ′ →
k DS ′′ , and DS = h[DS ′′ ]i.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:101

By induction hypothesis, there exists some dl ′ , DT ′′ , such that dl ′ :̃ DS ′ ⇔ DS ′′ , and [[dl ′ ]] =
[[dl]]. Because L(DS ′′ ) = L(DS ′ ) and L(DT ′′ ) = L(DT ′ ), DS ′′∗! and DT ′′∗! .
Consider the typing
dl ′ :̃ DS ′′ ⇔ DT ′′

DS ′′∗!

′

DT ′′∗!

iterate(dl ) :̃ DS

′′∗

⇔ DT

′

′′∗

] ⇔ [DT ′′∗ ]

[iterate(dl )] :̃ [DS

′′∗

h[iterate(dl ′)]i :̃ h[DS ′′ ∗ ]i ⇔ h[DT ′′ ∗ ]i
This is the desired typing. The semantics are as desired as well.
[[h[iterate(dl ′)]i]]

= {(s1 · . . . · sn , t1 · . . . · tn ) | n ≥ 0 ∧ ∀i ∈ [1, n](si , ti ) ∈ [[dl ′ ]]}
= {(s1 · . . . · sn , t1 · . . . · tn ) | n ≥ 0 ∧ ∀i ∈ [1, n](si , ti ) ∈ [[dl]]}
= [[al]]

Case 4 (DNF Reorder). Let dl :̃ DS ⇔ DT , and DS →
k DS ′ through an application of DNF Reorder.
′
Case 5 (Parallel DNF Structural Rewrite). Let dl :̃ DS ⇔ DT , and DS →
k DS through an
application of Parallel DNF Structural Rewrite.
′
Case 6 (Identity Rewrite). Let dl :̃ DS ⇔ DT , and DS →
k DS through an application of Identity
Rewrite.


Lemma 125.
′
(1) Let dl :̃ DS ⇔ DT and DT →
k DT .
′
′
′
′
′
′
′
There exists some DS , dl such that DS →
k DS , dl :̃ DS ⇔ DT , and [[dl]] = [[dl ]].
(2) Let al :̃ A ⇔ B and B →
k A DT .
′
There exists some DS, dl, such that A →
k A DS, dl :̃ DS ⇔ DT , and [[dl]] = [[al]].

Proof. This can be proven symmetrically to Lemma 124.
Lemma 126. For all lenses l : S ⇔ T , bisimilar
DNF regular expressions.

l

⇐
⇒



(→
k ), over the set of strongly unambiguous
l

Proof. Let DS, DT be strongly unambiguous DNF regular expressions, with DS ⇐
⇒ DT . So
there exists a rewriteless DNF lens dl :̃ DS ⇔ DT where [[dl]] = [[l]].
′
′
′
′
′
′
′
Let DS →
k DS . By Lemma 126, there exists dl , DT such that DT →
k DT , dl :̃ DS ⇔ DT , and
l

[[dl ′ ]] = [[dl]] = [[l]], so DS ′ ⇐
⇒ DT ′ .
′
′
′
′
′
′
′
Let DT →
k DT . By Lemma 126, there exists dl , DS such that DS →
k DS , dl :̃ DS ⇔ DT , and
l

[[dl ′ ]] = [[dl]] = [[l]], so DS ′ ⇐
⇒ DT ′ .
Lemma 127. For all lenses l : S ⇔ T , bisimilar
DNF regular expressions.


l

⇐
⇒

(→
k ∗ ), over the set of strongly unambiguous

Proof. By Lemma 3 and Lemma 126.



Corollary 2 (Bisimilarity in Star Sequential). By Lemma 127 and Theorem 9.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:102 Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic
Lemma 128 ( →
k Maintained Under ⊙ up to id on the left). Let DS be strongly unambiguous. Let
′
′′
DT be strongly unambiguous. Let L(DS) ·! L(DT). If DS →
k ∗ DS , then DS ⊙ DT →
k ∗ DS such that
′
′′
there exists a rewriteless DNF lens dl :̃ DS ⊙ DT ⇔ DS , and [[dl]] = {(s, s) | s ∈ L(DS ⊙ DT )}.
Proof. As L(DS) ·! L(DT), DS ⊙ DT is strongly unambiguous.
We proceed by induction on the derivation of →
k ∗.
Case 1 (Reflexivity).
∗
DS →
k
DS

By reﬂexivity
∗
DS ⊙ DT →
k DS ⊙ DT

Furthermore, as DS ⊙ DT is strongly unambiguous, there exists a lens dl :̃ DS ⊙ DT ⇔ DS ⊙ DT .
Case 2 (Base).
′
DS →
k DS
∗
′
DS →
k DS

So DS →
k DS ′ , and by Identity Rewrite, DT →
k DT .
So Lemma 122 says that there exists DS ′′ such that
′′
DS ⊙ DT →
k DS
∗
′′
DS ⊙ DT →
k DS

where there exists a DNF lens dl :̃ DS ′ ⊙ DT ⇔ DS ′′ such that [[dl]] = {(s, s) | s ∈ L(DS ⊙ DT )}.
Case 3 (Transitivity).
∗
DS →
k DS 1

∗
′
DS 1 →
k DS

∗
′
DS →
k DS

By IH, there exists DS 1′′ such that DS ⊙DT →
k ∗ DS 1′′ , and there exists a DNF lens dl 1 :̃ DS 1 ⊙DT ⇔
DS 1′′ , and [[dl 1 ]] = {(s, s) | s ∈ L(DS ⊙ DT )}.
∗
′′
′
By IH, there exists DS ′′ such that DS 1 ⊙ DT →
k DS , and there exists a DNF lens dl :̃ DS ⊙ DT ⇔
DS ′′ , and [[dl]] = {(s, s) | s ∈ L(DS ⊙ DT )}.
′
′′
′
′′
′
By Lemma 127, as DS 1 ⊙ DT →
k ∗ DS , then there exists DS 1 , dl 1 such that DS 1 →
k ∗ DS 1 , and
′
dl 1 :̃ DS ′′ ⇔ DS ′′ ⇔ DS 1′ , with the same semantics as dl 1 .
So dl :̃ DS ′ ⊙ DT ⇔ DS ′′ , and dl 1′ :̃ DS ′′ ⇔ DS ′′ ⇔ DS 1′ . By Lemma 14, there exists a DNF lens,
′
dl :̃ DS ′ ⊙ DT ⇔ DS 1′ . As both the lenses in the composition are the identity lens, this lens is the
identity lens, so [[dl ′ ]] = {(s, s) | s ∈ L(DS ⊙ DT )}
Furthermore
∗
′′
∗
′
DS ⊙ DT →
k DS 1
DS 1′′ →
k DS 1
∗
′
DS ⊙ DT →
k DS 1


Lemma 129 ( →
k Maintained Under ⊙ up to id on the right). Let DS be strongly unambiguous. Let
′
′′
DT be strongly unambiguous. Let L(DT) ·! L(DS). If DS →
k ∗ DS , then DT ⊙ DS →
k ∗ DS such that
′
′′
there exists a rewriteless DNF lens dl :̃ DT ⊙ DS ⇔ DS , and [[dl]] = {(s, s) | s ∈ L(DS ⊙ DT )}.
Proof. This is done symmetrically to Lemma 128.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.



Synthesizing Bijective Lenses

1:103

Lemma 130 ( →
k Maintained Under ⊙ up to id). Let DS be strongly unambiguous. Let DT be
′
′
′′
strongly unambiguous. Let L(DT) ·! L(DS). Let DS →
k ∗ DS . Let DT →
k ∗ DT . Then DS ⊙ DT →
k ∗ DS
′
′
′′
such that there exists a rewriteless DNF lens dl :̃ DS ⊙ DT ⇔ DS , and [[dl]] = {(s, s) | s ∈
L(DS ⊙ DT )}.
Proof. By Lemma 129, there exists a DNF lens dl 1 :̃ DS ⊙DT ′ ⇔ DS 1 , such that DS ⊙DT →
k ∗ DS 1
and [[dl 1 ]] = {(s, s) | s ∈ L(DS ⊙ DT )}.
By Lemma 128, there exists a DNF lens dl 2 :̃ DS ′ ⊙ DT ′ ⇔ DS 2 , such that DS ⊙ DT ′ →
k ∗ DS 2 and
[[dl 2 ]] = {(s, s) | s ∈ L(DS ⊙ DT )}.
′
′
By Lemma 127, as DS ⊙ DT ′ →
k ∗ DS 2 , there exists a DNF lens dl 1 :̃ DS 2 ⇔ DS 1 with [[dl 2 ]] =
′
∗
{(s, s) | s ∈ L(DS ⊙ DT )} and DS 1 →
k DS 1
So dl 2 :̃ DS ′ ⊙ DT ′ ⇔ DS 2 , and dl 1′ :̃ DS 2 ⇔ DS 1′ . By Lemma 14, there exists a DNF lens,
dl ′ :̃ DS ′ ⊙ DT ′ ⇔ DS 1′ . As both the lenses in the composition are the identity lens, this lens is the
identity lens, so [[dl ′ ]] = {(s, s) | s ∈ L(DS ⊙ DT )}
Furthermore
∗
∗
′
DS ⊙ DT →
k DS 1
DS 1 →
k DS 1
∗
′
DS ⊙ DT →
k DS 1


Corollary 3 (→∗ Maintained Under ⊙). Let DS be strongly unambiguous. Let DT be strongly
unambiguous. Let L(DT) ·! L(DS). Let DS→∗ DS ′. Let DT →∗ DT ′ . Then DS ⊙ DT →∗ DS ′′ such that
there exists a rewriteless DNF lens dl :̃ DS ′ ⊙ DT ′ ⇔ DS ′′ , and [[dl]] = {(s, s) | s ∈ L(DS ⊙ DT )}.
Proof. From Theorem 9 applied to Lemma 130.



Lemma 131 (Pre-Conﬂuence of Parallel Rewriting Without Reordering).
′
′
• If dl :̃ DS ⇔ DT , DS →
k DS , and DT →
k DT , then
′′
′
′′
(1) There exists a DS such that DS →
k DS
′′
′
′′
(2) There exists a DT such that DT →
k DT
′
′′
′′
(3) There exists a dl :̃ DS ⇔ DS such that [[dl ′ ]] = [[dl]].
• If al :̃ A ⇔ B, A →
k A DS, and B →
k A DT , then
′
(1) There exists a DS ′ such that DS →
k DS
′
(2) There exists a DT such that DT →
k DT ′
′
′
(3) There exists a dl :̃ DS ⇔ DT such that [[dl]] = [[al]]
Proof. By mutual induction on the derivation of →
k and →
k A . We will split into cases by the
last step taken in each derivation.
Case 1 (Atom UnrollstarL ,Atom UnrollstarL ). Let al : A ⇔ B. Let A = DS ′ ∗ and DT ′ ∗ →
k A h[ϵ]i⊕
(DS ′ ⊙ h[DS ′∗ ]i) through an application of Atom UnrollstarL . Let B = DT ∗ and DT ∗ →
k A h[ϵ]i ⊕
(DT ⊙ h[DT ∗ ]i) through an application of Atom UnrollstarL .
(1) Consider using Identity Rewrite
∗
h[ϵ]i ⊕ (DS ⊙ h[DS ∗ ]i) →
k h[ϵ]i ⊕ (DS ⊙ h[DS ]i)

(2) Consider using Identity Rewrite
∗
h[ϵ]i ⊕ (DT ⊙ h[DT ∗ ]i) →
k h[ϵ]i ⊕ (DT ⊙ h[DT ]i)

(3) By inversion, al = dl ∗ , and dl :̃ DS ⇔ DT .
By Lemma 100, Lemma 102, and Lemma 104 h[(ϵ, ϵ)]i ⊕ (dl ′ ⊙ D(iterate(dl ′))) :̃ h[ϵ]i ⊕
(DS ′ ⊙ D(DS ′ ∗ )) ⇔ h[ϵ]i ⊕ (DT ′ ⊙ D(DT ′ ∗ )), which is the desired typing.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:104 Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic
By Lemma 106, [[h[(ϵ, ϵ)]i ⊕ (dl ′ ⊙ D(iterate(dl ′)))]] = [[al]], which is the desired semantics.
Case 2 (Atom UnrollstarL ,Atom UnrollstarR ). Let al : A ⇔ B. Let A = DS ′ ∗ and DT ′∗ →
k A h[ϵ]i⊕
(DS ′ ⊙ D(DS ′∗ )) through an application of Atom UnrollstarL . Let B = DT ∗ and DT ∗ →
k A h[ϵ]i ⊕
(D(DT ∗ ) ⊙ DT ) through an application of Atom UnrollstarR .
(1)
′∗
′
DS ′∗ →
k A h[ϵ]i ⊕ (D(DS ) ⊙ DS )
′∗
′
D(DS ′∗ ) →
k h[ϵ]i ⊕ (D(DS ) ⊙ DS )

′
DS ′ →
k DS
By Lemma 122 there exists a DS 1 such that DS ′ ⊙ D(DS ′∗ ) →
k DS 1 , and there exists
dl 1 :̃ DS 1 ⇔ DS ′ ⊙ (h[ϵ]i ⊕ (D(DS ′ ∗ ) ⊙ DS ′ )) where dl 1 has identity semantics.

h[ϵ]i →
k h[ϵ]i
So by Lemma 51, h[ϵ]i ⊕ (DS ′ ⊙ D(DS ′∗ )) →
k h[ϵ]i ⊕ DS 1 .
Furthermore, as h[(ϵ, ϵ)]i :̃ h[ϵ]i ⇔ h[ϵ]i has identity semantics, through Lemma 51 we
get h[(ϵ, ϵ)]i ⊕ dl 1 :̃ h[ϵ]i ⊕ DS 1 ⇔ h[ϵ]i ⊕ (DS ′ ⊙ (h[ϵ]i ⊕ (D(DS ′ ∗ ) ⊙ DS ′))), which has
the identity semantics.
(2)

′
′∗
DT ′ ∗ →
k A h[ϵ]i ⊕ (DT ⊙ D(DT ))
′
′∗
D(DT ′ ∗ ) →
k h[ϵ]i ⊕ (DT ⊙ D(DT ))

′
DT ′ →
k DT
By Lemma 122 there exists a DT 2 such that DT ′ ⊙ D(DT ′ ∗ ) →
k DT 2 , and there exists
dl 2 :̃ (h[ϵ]i ⊕ (DT ′ ⊙ D(DT ′∗ ))) ⊙ DT ′ ⇔ DT 2 where dl 2 has identity semantics.

h[ϵ]i →
k h[ϵ]i
∗
′
So by Lemma 51, h[ϵ]i ⊕ (D(DT ) ⊙ DT ′ ) →
k h[ϵ]i ⊕ DT 2 .
Furthermore, as h[(ϵ, ϵ)]i :̃ h[ϵ]i ⇔ h[ϵ]i has identity semantics, through Lemma 51 we
get h[(ϵ, ϵ)]i ⊕ dl 2 :̃ h[ϵ]i ⊕ ((h[ϵ]i ⊕ (DT ′ ⊙ D(DT ′ ∗ ))) ⊙ DT ′ ) ⇔ h[ϵ]i ⊕ DT 2 , which has
the identity semantics.
(3) As al :̃ DS ′∗ ⇔ DT ′∗ , by inversion, al = iterate(dl), and dl :̃ DS ′ ⇔ DT ′.
Let dl ′ = h[(ϵ, ϵ)]i ⊕ (dl ⊙ D(iterate(dl))) By Lemma 107, [[dl ′ ]] = [[al]], and dl ′ :̃ h[ϵ]i ⊕
(DS ′ ⊙ D(DS ∗ )) ⇔ h[ϵ]i ⊕ (DT ′ ⊙ D(DT ∗ )).
Let dl ′′ = h[(ϵ, ϵ)]i ⊕ (D(iterate(dl)) ⊙ dl) By Lemma 109, [[dl ′′ ]] = [[D(al)]], and
′′
dl :̃ h[ϵ]i ⊕ (D(DS ∗ ) ⊙ DS ′ ) ⇔ h[ϵ]i ⊕ (D(DT ∗ ) ⊙ DT ′).
Consider the DNF lens dl ′′′ = h[(ϵ, ϵ)]i ⊕ (dl ⊙ dl ′′ ). dl ′′′ :̃ h[ϵ]i ⊕ (DS ′ ⊙ (h[ϵ]i ⊕
(D(DS∗ ) ⊙ DS ′ ))) ⇔ h[ϵ]i ⊕ (DT ′ ⊙ (h[ϵ]i ⊕ (D(DT ∗ ) ⊙ DT ′ ))), where dl ′′′ has the same
semantics as dl ′, as dl ′′ has the same semantics as D(al).
By Lemma 118, there exists dl 3 :̃ h[ϵ]i ⊕ (DT ′ ⊙ (h[ϵ]i ⊕ (D(DT ∗ ) ⊙ DT ′ ))) ⇔ h[ϵ]i ⊕
(DT ′ ⊙ h[ϵ]i) ⊕ (DT ′ ⊙ D(DT ∗ ) ⊙ DT ′ ).
By Lemma 121, there exists dl 4 :̃ h[ϵ]i ⊕ (h[ϵ]i ⊙ DT ′ ) ⊕ (DT ′ ⊙ D(DT ∗ ) ⊙ DT ′ ) ⇔
h[ϵ]i ⊕ ((h[ϵ]i ⊕ DT ′ ⊙ D(DT ∗ )) ⊙ DT ′).
Consider the composition of h[(ϵ, ϵ)]i ⊕ dl 1 , dl ′′′ , dl 3 , dl 4 , and h[(ϵ, ϵ)]i ⊕ dl 2
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:105

Because of Lemma 14, there exists a lens dl 5 :̃ h[ϵ]i ⊕ DS 1 ⇔ h[ϵ]i ⊕ DT 2 . Furthermore,
as all lenses except dl ′′′ are the identity lens, [[dl5 ]] = [[dl ′′′ ]] = [[al]].
Case 3 (Atom UnrollstarL ,Parallel Atom Structural Rewrite). Let al : A ⇔ B. Let A = DS ∗
∗
and DT ∗ →
k A h[ϵ]i ⊕ (DS ′ ⊙ D(DS ′ )) through an application of Atom UnrollstarL . Let B = DT ∗
and
′
DT →
k DT
′
DT ∗ →
k A D(DT )

through an application of Parallel Atom Structural Rewrite.
From inversion, al = iterate(dl), and dl :̃ DS ⇔ DT .
From Lemma 127, there exists DN FReдex ′ such that DS →
k DS ′ , such that there exists a lens
′
′
′
′
dl :̃ DS ⇔ DT , and [[dl ]] = [[dl]]
(1)
′
′∗
DS ′ ∗ →
k A h[ϵ]i ⊕ (DS ⊙ D(DS ))
′
′∗
D(DS ′ ∗ ) →
k h[ϵ]i ⊕ (DS ⊙ D(DS ))

(2)
′
DT →
k DT
′∗
DT ∗ →
k A D(DT )
′∗
D(DS ∗ ) →
k D(DS )

By Lemma 122 there exists a DT 1 such that DT ⊙ D(DT ∗ ) →
k DT 1 , and there exists
dl 1 :̃ DT ′ ⊙ D(DT ′∗ ) ⇔ DT 1 where dl 1 has identity semantics.
h[ϵ]i →
k h[ϵ]i
So by Lemma 51, h[ϵ]i ⊕ (DT ⊙ D(DT ∗ )) →
k h[ϵ]i ⊕ DT 1 .
Furthermore, as h[(ϵ, ϵ)]i :̃ h[ϵ]i ⇔ h[ϵ]i has identity semantics, through Lemma 51
we get h[(ϵ, ϵ)]i ⊕ dl 1 :̃ h[ϵ]i ⊕ (DT ′ ⊙ D(DT ′∗ )) ⇔ h[ϵ]i ⊕ DT 1 , which has the identity
semantics.
(3) Let dl ′′ = h[(ϵ, ϵ)]i ⊕ (dl ′ ⊙ D(iterate(dl ′ ))) By Lemma 107, [[dl ′′ ]] = [[iterate(dl ′ )]] = [[al]]
and dl ′′ :̃ h[ϵ]i ⊕ (DS ′ ⊙ D(DS ′∗ )) ⇔ h[ϵ]i ⊕ (DT ′ ⊙ D(DT ′∗ )).
By Lemma 14, we can compose lenses, so consider dl ′′′ , the composition of the lenses
′′
dl and h[(ϵ, ϵ)]i ⊕ dl 1 . dl ′′′ :̃ h[ϵ]i ⊕ (DS ′ ⊙ D(DS ′∗ )) ⇔ h[ϵ]i ⊕ DT 1 . Furthermore, as all
lenses in the composition except dl ′′′ are the identity, [[dl ′′′ ]] = [[dl]] = [[al]].
Case 4 (Atom UnrollstarR ,Atom UnrollstarL ). This is easily transformed into the case of (Atom
UnrollstarL ,Atom UnrollstarR ), and the solution to that case transformed to a solution of this
case, through two applications of Lemma 18

Case 5 (Atom UnrollstarR ,Atom UnrollstarR ). This proceeds in the same way as (Atom UnrollstarL ,Atom
UnrollstarL ).
Case 6 (Atom UnrollstarR ,Parallel Atom Structural Rewrite). This proceeds in the same
way as (Atom UnrollstarL ,Parallel Atom Structural Rewrite)
Case 7 (Parallel Atom Structural Rewrite,Atom UnrollstarL ). This is easily transformed
into the case of (Atom UnrollstarL ,Parallel Atom Structural Rewrite), and the solution to
that case transformed to a solution of this case, through two applications of Lemma 18
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:106 Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic
Case 8 (Parallel Atom Structural Rewrite,Atom UnrollstarR ). This is easily transformed
into the case of (Atom UnrollstarR ,Parallel Atom Structural Rewrite), and the solution to
that case transformed to a solution of this case, through two applications of Lemma 18
Case 9 (Parallel Atom Structural Rewrite,Parallel Atom Structural Rewrite). Let al :
A ⇔ B. Let A = DS ∗ and
′
DS →
k DS
′
DS ∗ →
k D(DS )
through an application of Atom UnrollstarL . Let B = DT ∗ and
′
DT →
k DT
′
DT ∗ →
k A D(DT )

through an application of Parallel Atom Structural Rewrite.
From inversion, al = iterate(dl), and dl :̃ DS ⇔ DT .
′′
′′
′
′′
′′
′′
By IH, there exists DS ′′ , DT ′′ , and dl ′′ such that DS ′ →
k DS , DT →
k DT , and dl :̃ DS ⇔ DT
′′
with [[dl ]] = [[dl]].
(1)
′′
DS ′ →
k DS
′′ ∗
DS ′ ∗ →
k A D(DS )
′′ ∗
D(DS ′ ∗ ) →
k D(DS )

(2)

′′
DT ′ →
k DT
′′ ∗
DT ′ ∗ →
k A D(DT )

′′ ∗
D(DT ′ ∗ ) →
k D(DT )
(3) As [[dl]] = [[dl ′′ ]], [[al]] = [[iterate(dl)]] = [[iterate(DNFLens ′′ )]]. Furthermore, as L(DS ′′ ) =
L(DS) and L(DT ′′ ) = L(DS ′′ ), DT ′′∗! and DS ′′∗! . This means iterate(dl ′′ ) :̃ DS ′′∗ ⇔ DT ′′∗
From Lemma 103, [[iterate(dl ′′ )]] = [[D(iterate(dl ′′ ))]], and
D(iterate(iterate(dl ′′ ))) :̃ D(DS ′′∗ ) ⇔ D(DT ′′∗ ).

Case 10 (Identity Rewrite,Identity Rewrite). Let dl : DS ⇔ DT . Let DS →
k DS through an
application of Atom UnrollstarL . Let DT →
k DT through an application of Atom UnrollstarL .
(1)
DS →
k DS
(2)
DT →
k DT
(3) dl :̃ DS ⇔ DT , and [[dl]] = [[dl]].
Case 11 (Identity Rewrite,Parallel DNF Structural Rewrite). Let dl : DS ⇔ DT . Let
′
DS →
k DS through an application of Atom UnrollstarL . Let DT →
k DT through an application
of Parallel DNF Structural Rewrite.
′
′
′
′
′
By Lemma 126, there exists dl ′ , DS ′ such that DS →
k DS , dl :̃ DS ⇔ DT , [[dl]] = [[dl ]]
′
(1) DS →
k DS
(2)
′
DS ′ →
k DS

(3) dl ′ :̃ DS ′ ⇔ DT ′ and [[dl]] = [[dl ′ ]]
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:107

Case 12 (Parallel DNF Structural Rewrite,Identity Rewrite). This is easily transformed into
the case of (Identity Rewrite,Parallel DNF Structural Rewrite), and the solution to that case
transformed to a solution of this case, through two applications of Lemma 18
Case 13 (Parallel DNF Structural Rewrite,Parallel DNF Structural Rewrite). Let dl :
DS ⇔ DT . Let DS →
k DS ′ through an application of Parallel DNF Structural Rewrite. Let
′
DT →
k DT through an application of Parallel DNF Structural Rewrite.
By inversion,
sql 1 :̃ SQ 1 ⇔ TQ 1
...
i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅

σ ∈ Sn

(hsql 1 | . . . | sql n i, σ ) :̃

sql n :̃ SQ n ⇔ TQ n
i , j ⇒ L(TQi ) ∩ L(TQ j ) = ∅

hSQ 1 | . . . | SQn i ⇔ hTQ σ (1) | . . . | TQ σ (n) i

Also by inversion
σi ∈ S n i

al i ,1 :̃ A1 ⇔ Bi ,1
...
· [si ,0 · Ai ,1 · . . . · Ai ,ni · si ,ni ]
!

al i ,ni :̃ An ⇔ Bi ,ni
·! [ti ,0 · Bi ,σi (1) · . . . · Bi ,σi (ni ) · ti ,ni ]

([(si ,0 , ti ,0 ) · al i ,1 · . . . · al i ,ni · (si ,ni , ti ,ni )], σi ) :̃
[si ,0 · Ai ,1 · . . . · Ai ,ni · si ,ni ] ⇔ [ti ,0 · Bi ,σi (1) · . . . · Bi ,σi (ni ) · ti ,ni ]
where dl = hsql 1 | . . . | sql n i, σ ), sqli = ([(si ,0 , ti ,0 ) · al i ,1 · . . . · al i ,ni · (si ,ni , ti ,ni )], σi ), DS =
hSQ 1 | . . . | SQ n i, DT = hTQ σ (1) | . . . | TQ σ (n) i, SQi = [si ,0 · Ai ,1 · . . . · Ai ,ni · si ,ni ], and TQi =
[ti ,0 · Bi ,σi (1) · . . . · Bi ,σi (ni ) · ti ,ni ]
DS = hSQ 1 | . . . | SQn i
∀i.SQi = [si ,0 · Ai ,1 · . . . · Ai ,ni · si ,ni ]
∀i, j.Ai ,j →
k A DS i ,j
∀i.DSi = h[si ,0 ]i ⊙ DSi ,1 ⊙ . . . ⊙ DSi ,ni ⊙ h[si ,ni ]i
DS →
k DS 1 ⊕ . . . ⊕ DS n
DT = hTQ σ (1) | . . . | TQ σ (n) i
∀i.TQ σ (i ) = [tσ (i ),0 · Bσ (i ),σi (1) · . . . · Bσ (i ),σi (ni ) · tσ (i ),ni ]
∀i, j.Bσ (i ),σi (j) →
k A DT σ (i ),σi (j)
∀i.DT σ (i ) = h[sσ (i ),0 ]i ⊙ DS σ (i ),σi (1) ⊙ . . . ⊙ DS σ (i ),σi (ni ) ⊙ h[sσ (i ),ni ]i
DT →
k DT σ (1) ⊕ . . . ⊕ DT σ (n)
′
′
By IH, as Ai ,j →
k DS i ,j , Bi ,j →
k DT i ,j , and al i ,j :̃ Ai ,j ⇔ Bi ,j , then there exists DS i ,j , DT i ,j , and dl i ,j
′
′
such that DSi ,j →
k DS i ,j , DT i ,j →
k DT i ,j , and dl i ,j :̃ DS i ,j ⇔ DT i ,j , where [[dl i ,j ]] = [[al i ,j ]].
′
(1) DSi ,j →
k DS i ,j , for all i, j.

h[si ,j ]i →
k h[si ,j ]i
Deﬁne DSi′ = h[si ,0 ]i ⊙ DSi′,1 ⊙ . . . ⊙ DSi′,ni ⊙ h[si ,ni ]i.
By repeated application of Lemma 122, there exists DS i′′ such that DSi = h[si ,0 ]i ⊙DS i ,1 ⊙
′′
′′
′
. . . ⊙ DSi ,ni ⊙ h[si ,ni ]i →
k DS i , and there exists dl i such that dl i :̃ DS i ⇔ DS i , and dl i has
the identity semantics on L(DSi ).
′ . Furthermore,
By repeated application of Lemma 122, DS 1 ⊕ . . . ⊕ DS n →
k DS 1′ ⊕ . . . ⊕ DS n
through application of Lemma 102, dl 1 ⊕ . . . ⊕ dln :̃ DS 1′′ ⊕ . . . ⊕ DSn′′ ⇔ DS 1′ ⊕ . . . ⊕ DSn′ .
′
(2) DT σ (i ),σi (j) →
k DT
, for all i, j.
σ (i ),σi (j)
h[sσ (i ),j ]i →
k h[sσ (i ),j ]i
Deﬁne

DT σ′ (i )

= h[sσ (i ),0 ]i ⊙ DS σ′ (i ),σi (1) ⊙ . . . ⊙ DS σ′ (i ),σi (ni ) ⊙ h[sσ (i ),σi (ni ) ]i.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:108 Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic
By repeated application of Lemma 122, there exists DT σ′′(i ) such that DT σ (i ) = h[tσ (i ),0 ]i⊙
′
DT σ (i ),σi (1) ⊙ . . . ⊙ DT σ (i ),σi (ni ) ⊙ h[tσ (i ),ni ]i →
k DT i′′ , and there exists dl σ (i ) such that
dl σ′ (i ) :̃ DT σ′ (i ) ⇔ DT σ′′(i ) , and dl σ′ (i ) has the identity semantics on L(DT σ (i ) ).
′′
By repeated application of Lemma 51, DT σ (1) ⊕ . . . ⊕ DT σ (n) →
k DT
⊕ . . . ⊕ DT σ′′(n) .
σ (1)
′
′
Furthermore, through application of Lemma 102, dl σ (1) ⊕ . . . ⊕ dl σ (n) :̃ DT σ′ (1) ⊕ . . . ⊕
DT σ′ (n) ⇔ DT σ′′(1) ⊕ . . . ⊕ DT σ′′(1) .
(3) As L(Ai ,j ) = L(DSi′,j ), and L(Bi ,j ) = L(DT i′,j ), then ·! (si ,0 , DSi′,1 , . . . , DSi′,ni , si ,ni ). and
·! (ti ,0 , DT i′,σi (1) , . . . , DT i′,σi (ni ) , ti ,ni ). Then by Lemma 112, with the permutation σi , there
exists a DNF lens dl i :̃ DSi′ ⇔ DT i′ , with
[[dli ]] = {(si ,0 si′,1 . . . si′,ni si ,ni , ti ,0 ti′,σi (1) . . . ti′,σi (ni ) ti ,ni ) | (si′,j , ti′,j ) ∈ [[dli ,j ]]}
= {(si ,0 si′,1 . . . si′,ni si ,ni , ti ,0 ti′,σi (1) . . . ti′,σi (ni ) ti ,ni ) | (si′,j , ti′,j ) ∈ [[al i ,j ]]}
= [[sqli ]].
As L(DSi′ ) = L(SQi ), i , j ⇒ L(DSi ) ∩ L(DS j ) = {}. By Lemma 115, with the
permutation σ , there exists a DNF lens dl = :̃ DS 1′ ⊕ . . . ⊕ DSn′ ⇔ DT σ′ (1) ⊕ . . . ⊕ DT σ′ (n) ,
with [[dl]] = {(s, t) | ∃i.(s, t) ∈ [[dli ]]} = {(s, t) | ∃i.(s, t) ∈ [[sql i ]]} = [[dl]].
Consider the dl ′ , the composition of dl 1 ⊕ . . . ⊕ dl n , dl, and dl 1′ ⊕ . . . ⊕ dl n , dl ′ :̃ DS 1′′ ⊕
. . . ⊕ DSn′′ ⇔ DT 1′′ ⊕ . . . ⊕ DSn′′ . Furthermore, all but dl are identity, [[dl ′′′ ]] = [[dl]] = [[dl]].

Theorem 11 (Conﬂuence of Parallel Rewriting Without Reordering). For all lenses l : S ⇔ T ,
conﬂuent l ( →
k ).
⇐
⇒
l

Proof. Let DS ⇐
⇒ DT . This means there exists some dl :̃ DS ⇔ DT such that [[dl]] = [[l]]. Let
′
′
′
′′
′′
′
′′
DS →
k DS and DT →
k DT . From Lemma 131, there exists a DS , DT , dl such that DS →
k DS ,
l

′
′
′
′′
′′
′′
′′
DT ′ →
k DT , dl : DS ⇔ DT , and [[dl ]] = [[dl]]. Because [[dl ]] = [[dl]] = [[l]], DS ⇐
⇒ DT ′′ .



id S

Lemma 132 (Identity is a left propagator). If l : S ⇔ T is a lens, then ⇐
⇒ is a left propagator for
l

⇐
⇒ with respect to →
k .
Proof. If l : S ⇔ T is a lens, by Lemma 16, S is strongly unambiguous. By Lemma 45, ⇓ S is
id S

strongly unambiguous. As such, id S : S ⇔ S. Consider ⇐
⇒.
By Lemma 126, bisimilar idS ( →
k ).
⇐
⇒
By Theorem 11, conﬂuent id S ( →
k ).
⇐
⇒
id S
id S
⇒ DS 3 . So there exists dl 1 , dl 2 such that dl 1 :̃ DS 1 ⇔ DS 2 and
⇒ DS 2 , and DS 2 ⇐
Let DS 1 ⇐
dl 2 :̃ DS 2 ⇔ DS 3 , where [[dl1 ]] = [[id S ]] = [[dl 2 ]]. By Lemma 14, there exists dl 3 :̃ DS 1 ⇔ DS 3 , with
semantics [[dl 3 ]] = [[id S ]], as the semantics of each side of the composition was the identity relation
id S

⇒ DS 3 .
on L(S). This means DS 1 ⇐
id S

Let DS ⇐
⇒ DT . So there exists dl :̃ DS ⇔ DT . By Lemma 12, [[l]] is a bijection between L(S) and
L(T ). As [[dl]] = [[l]], [[dl]] is a bijection between L(S) and L(T ). [[dl]] is a bijection between L(DS)
and L(DT), by Lemma 13, so L(DS) = L(S) and L(DT) = L(T ). As DS is strongly unambiguous,
there exists an identity lens by Lemma 15 id L :̃ DS ⇔ DS, such that [[id L ]] = {(s, s) | s ∈ L(DS)} =
id S

{(s, s) | s ∈ L(S)} = [[id S ]]. This means DS ⇐
⇒ DS. As DT is strongly unambiguous, there exists an
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:109

identity lens id R :̃ DT ⇔ DT , such that [[id R ]] = {(s, s) | s ∈ L(DT)} = {(s, s) | s ∈ L(T )} = [[id T ]].
id S

This means DT ⇐
⇒ DT .
l
Let DS ⇐
⇒ DT . This means there exists dl :̃ DS ⇔ DT . This means that DS is strongly unambiguous, so there exists a DNF lens dl ′ :̃ DS ⇔ DS, with [[dl ′]] = {(s, s) | s ∈ L(DS)}. By the same
logic as above, L(DS) = L(S), so [[dl ′]] = {(s, s) | s ∈ L(S)} = [[id S ]].

id T

Lemma 133 (Identity is a right propagator). If l : S ⇔ T is a lens, then ⇐
⇒ is a right propagator
l

for ⇐
⇒ with respect to →
k .
Proof. By a symmetric argument to Lemma 132.



Lemma 134 (Conﬂuence of Starred Parallel Rewriting Without Reordering). For all lenses l : S ⇔
∗
T , conﬂuent l ( →
k ).
⇐
⇒
Proof. By Lemma 126 For all lenses l : S ⇔ T , bisimilar l ( →
k ). For all lenses l : S ⇔ T ,
⇐
⇒
id S
id S
l
conﬂuent l ( →
k ). By Lemma 132, ⇐
⇒ is a left propagator for ⇐
⇒. By Lemma 133, ⇐
⇒ is a right
⇐
⇒
l
propagator for ⇐
⇒. By Theorem 6, conﬂuent l ( →
k ∗ ).

⇐
⇒
Corollary 4. For all lenses l, conﬂuent l (→∗ )
⇐
⇒
Proof. By Theorem 11, and Theorem 6, for all lenses l, conﬂuent l ( →
k ∗ ). By Theorem 9, for
⇐
⇒
all lenses l, conﬂuent l (→∗ ).

⇐
⇒
B.11

Completeness

Finally, with all the above machinery, all parts of conﬂuence can be proven. The ﬁnal statement
is a quick one, with the bulk of the work done by proving a lemma involving rewrites and lens
expressibility.
′
′
Lemma 135. Let DS be strongly unambiguous, and let DS ≡ →
k swap DT . There exists dl, DS , DT
∗
′
′ ∗
′
′
′
such that DS→ DS , DT → DT , dl :̃ DS ⇔ DT , and [[dl]] = {(s, s) | s ∈ L(DS)}.

Proof. Proof by induction on the typing of ≡ →
k swap
Case 1 (Reflexivity). Let DS ≡ →
k swap DT through an application of Reflexivity. That means
DT = DS.
Consider DS→∗ DS, and DT →∗ DS through applications of Reflexivity.
Then, by Lemma 15, there exists a lens dl :̃ DS ⇔ DS such that [[dl]] = {(s, s) | s ∈ L(DS)}
Case 2 (Base). Let DS ≡ →
k swap DT .
k swap DT through an application of Base. That means DS →
∗
DT → DT through an application of Reflexivity.
By Lemma 123, there exists a DNF regular expression, DS ′ , and a DNF lens dl, such that DS →
DS ′ , dl :̃ DS ′ ⇔ DT , and [[dl]] = {(s, s) | s ∈ L(DS)}. Through an application of Base, DS →
k ∗ DS ′ .
′
∗
From Theorem 9, DS→ DS , as desired.
Case 3 (Symmetry). Let DS ≡ →
k swap DT through an application of Symmetry. That means DT ≡ →
k swap
DS.
By IH, there exists DNF regular expressions DT ′ , DS ′ , and a DNF lens dl such that DT →∗ DT ′ ,
DS→∗ DS ′ , dl :̃ DT ′ ⇔ DS ′ , and [[DT ′ ]] = {(s, s) | s ∈ L(DT)}.
s
Because ≡ →
k swap is equivalent to ≡ , L(DS) = L(DT)
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:110 Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic
By Lemma 18, there exists dl ′ :̃ DS ′ ⇔ DT ′ , and [[dl ′ ]] = {(s, s) | s ∈ L(DS)}, as desired.
Case 4 (Transitivity). Let DS ≡ →
k swap DT through an application of Transitivity. That means
′
′
there exists DS ′ such that DS ≡ →
k swap DS and DS ≡ →
k swap DT .
By IH, there exists DNF regular expressions DS 1 , DS 2 , and a DNF lens dl 1 such that DS→∗ DS 1 ,
DS ′ →∗ DS 2 , and dl 1 :̃ DS 1 ⇔ DS 2 .
By IH, there exists DNF regular expressions DS 3 , DS 4 , and a DNF lens dl 2 such that DS ′ →∗ DS 3 ,
DT →∗ DS 4 , and dl 2 :̃ DS 3 ⇔ DS 4 .
By Lemma 15, there exists a lens dl id 1 :̃ DS ′ ⇔ DS ′ , where [[dl id 1 ]] = {(s, s) | s ∈ L(DS ′ )}.
id

Because DS ′ ⇐
⇒ DS ′ , and by Corollary 4, there exists DS 5 and DS 6 , such that DS 2 →∗ DS 5 ,
id

DS 3 →∗ DS 6 , and DS 5 ⇐
⇒ DS 6 . That means there exists dl id 2 :̃ DS 5 ⇔ DS 6 , where [[dl id 2 ]] =
{(s, s) | s ∈ L(DS ′ )}.
By Corollary 2, as DS 2 →∗ DS 5 , and dl 1 :̃ DS 1 ⇔ DS 2 . Because DS 2 →∗ DS 5 , there exists a DNF
lens dl 3 , and DNF regular expression DS 7 such that DS 1 →∗ DS 7 , dl 3 :̃ DS 7 ⇔ DS 5 , and [[dl 3 ]] =
{(s, s) | s ∈ L(DS)}.
By Corollary 2, as DS 3 →∗ DS 6 , and dl 2 :̃ DS 3 ⇔ DS 4 . Because DS 3 →∗ DS 6 , there exists a DNF
lens dl 4 , and DNF regular expression DS 8 such that DS 4 →∗ DS 8 , dl 4 :̃ DS 6 ⇔ DS 8 , and [[dl 3 ]] =
{(s, s) | s ∈ L(DS ′ )}.
So there are lenses dl 3 :̃ DS 7 ⇔ DS 5 , dl id 2 :̃ DS 5 ⇔ DS 6 , and dl 4 :̃ DS 6 ⇔ DS 8 , so by Lemma 14,
there exists a lens dl 5 :̃ DS 7 ⇔ DS 8 . Because all of these have the semantics of the identity lens
on DNF regular expressions with the same language, [[dl 5 ]] = {(s, s) | s ∈ L(DS)}.
Furthermore, DS→∗ DS 1 and DS 1 →∗ DS 7 , so DS→∗ DS 7 . DT →∗ DS 4 and DS 4 →∗ DS 8 , so DT →∗ DS 8 ,
as desired.

Lemma 136. Let S ≡s T , and let S be strongly unambiguous. There exists dl, DS, DT such that
dl :̃ DS ⇔ DT , ⇓S→∗ DS, ⇓T →∗ DT , and [[dl]] = {(s, s) | s ∈ L(S)}
Proof. From Lemma 8, as S ≡s T , ⇓ S ≡ →
k swap ⇓ T . Because S is strongly unambiguous, by
Lemma 45, ⇓ S is strongly unambiguous. Because of this, from Lemma 135, there exists DS, DT ,
and dl such that ⇓S→∗ DS, ⇓T →∗ DT , and [[dl]]{(s, s) | s ∈ L(⇓S)}. From Theorem 1, L(⇓S) = L(S),
as desired.

Lemma 137. If l : S ⇔ T then there exists dl, DS, DT such that dl :̃ DS ⇔ DT , ⇓ S→∗ DS,
⇓T →∗ DT , and [[dl]] = [[l]]
Proof. By induction of the typing derivation of l : S ⇔ T .
Let the last typing rule be an instance of Iterate Lens.
l:S⇔T
iterate(l) : S ∗ ⇔ T ∗
By IH, there exists dl, DS, DT such that
dl :̃ DS ⇔ DT
⇓ S→∗ DS
⇓ T →∗ DT
[[dl]] = [[l]]
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:111

By Lemma 104, h[iterate(dl)]i :̃ h[DS ∗ ]i ⇔ h[DT ∗ ]i. By Corollary 1, h[⇓S∗ ]i→∗ h[DS ∗ ]i and
h[⇓T ∗ ]i→∗ h[DT ∗ ]i. From this, we get
h[⇓S∗ ]i→∗ h[DS ∗ ]i

h[iterate(dl)]i :̃ h[DS ∗ ]i ⇔ h[DT ∗ ]i

h[⇓T ∗ ]i→∗ h[DT ∗ ]i

h[iterate(dl)]i :⇓S ∗ ⇔⇓T ∗
By Lemma 104, [[h[iterate(dl)]i]] = {(s1 · . . . · sn , t1 · . . . · tn ) | (si , ti ) ∈ [[dl]]} = {(s1 · . . . · sn , t1 ·
. . . · tn ) | (si , ti ) ∈ [[l]]} = [[iterate(l)]]

Let the last typing rule be an instance of Constant Lens.
const(s1 , s2 )
Consider DNF Lens Derivation
[(s1 , s2 )] :̃ [s1 ] ⇔ [s2 ]
h[s1 ]i→∗ h[s1 ]i

h[(s1 , s2 )]i :̃ h[s1 ]i ⇔ h[s2 ]i

h[s2 ]i→∗ h[s2 ]i

h[(s1 , s2 )]i : h[s1 ]i ⇔ h[s2 ]i
[[h[(s1 , s2 )]i]] = {(s1 , s2 )} = [[const(s1 , s2 )]]

Let the last typing rule be an instance of Concat Lens.
l1 : S1 ⇔ T1

l2 : S2 ⇔ T2

concat(l1 , l2 ) : S1 · S2 ⇔ T1 · T2
By IH, there exists dl 1 , DS 1 , DT 1 , dl 2 , DS 2 , and DT 2 such that
dl 1 :̃ DS 1 ⇔ DT 1
⇓ S1 →∗ DS 1
⇓ T1 →∗ DT 1
[[dl 1 ]] = [[l1 ]]
dl 2 :̃ DS 2 ⇔ DT 2
⇓ S2 →∗ DS 2
⇓ T2 →∗ DT 2
[[dl 2 ]] = [[l2 ]]
From Lemma 100, dl 1 ⊙ dl 2 :̃ DS 1 ⊙ DS 2 ⇔ DT 1 ⊙ DT 2 .
By Corollary 3, and Lemma 11, there exists a DNF regular expression, DS L , and a DNF lens, dl L ,
such that dl L :̃ DS L ⇔ DS 1 ⊙ DS 2 , where [[dl L ]] = {(s, s) | s ∈ L(⇓ (DS1 ⊙ DS 2 ))}. Furthermore,
⇓(DS1 ⊙ DS 2 )→∗ DS L .
By Corollary 3, there exists a DNF regular expression, DS R , and a DNF lens, dl R , such that
dl R :̃ DT 1 ⊙ DT 2 ⇔ DS R , where [[dl R ]] = {(s, s) | s ∈ L(⇓ (DT 1 ⊙ DT 2 ))} Furthermore, ⇓ (DT 1 ⊙
DT 2 )→∗ DS R .
By Lemma 14, as dl L :̃ DS L ⇔ DS 1 ⊙ DS 2 , dl 1 ⊙ dl 2 :̃ DS 1 ⊙ DS 2 ⇔ DT 1 ⊙ DT 2 , and dl R :̃ DT 1 ⊙
DT 2 ⇔ DS R there exists a DNF Lens dl :̃ DS L ⇔ DS R , with semantics of the composition of the
three lenses. Because the left and right lenses are the identity lenses, [[dl]] = [[dl 1 ⊙ dl 2 ]].
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:112 Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic
By Lemma 100, [[dl]] = [[dl 1 ⊙ dl 2 ]] = {(s1 · s2 , t1 · t2 ) | (s1 , t1 ) ∈ [[dl 1 ]] ∧ (s2 , t2 ) ∈ [[dl 2 ]]} =
{(s1 · s2 , t1 · t2 ) | (s1 , t1 ) ∈ [[l1 ]] ∧ (s2 , t2 ) ∈ [[l2 ]]} = [[concat(l1 , l2 )]].
dl :̃ DS L ⇔ DS R
⇓(S1 · S2 )→∗ DS L
⇓(T1 · T2 ) ⇔ DS L
[[dl]] = [[concat(l1 , l2 )]]

Let the last typing rule be an instance of Or Lens.
l1 : S1 ⇔ T1

l2 : S2 ⇔ T2

or(l1 , l2 ) : S1 | S2 ⇔ T1 | T2
By IH, there exists dl 1 , DS 1 , DT 1 , dl 2 , DS 2 , and DT 2 such that
dl 1 :̃ DS 1 ⇔ DT 1
⇓ S1 →∗ DS 1
⇓ T1 →∗ DT 1
[[dl 1 ]] = [[l1 ]]
dl 2 :̃ DS 2 ⇔ DT 2
⇓ S2 →∗ DS 2
⇓ T2 →∗ DT 2
[[dl 2 ]] = [[l2 ]]
From Lemma 102, dl 1 ⊕ dl 2 :̃ DS 1 ⊕ DS 2 ⇔ DT 1 ⊕ DT 2 . By Lemma 76, ⇓S1 | S2 →∗ DS 1 ⊕ DS 2 and
⇓T1 | T2 →∗ DT 1 ⊕ DT 2 .
By Lemma 102, [[dl 1 ⊕ dl 2 ]] = {(s, t) | (s, t) ∈ [[dl 1 ]] ∨ (s, t) ∈ [[dl 2 ]]} = {(s, t) | (s, t) ∈ [[l1 ]] ∨ (s, t) ∈
[[l2 ]]} = [[or(l1 , l2 )]].
l1 ⊕ l2 :̃ DS 1 ⊕ DS 2 ⇔ DT 1 ⊕ DT 2
⇓(S1 | S2 )→∗ DS 1 ⊕ DS 2
⇓(T1 | T2 )→∗ DT 1 ⊕ DT 2
[[dl 1 ⊕ dl 2 ]] = [[or(l1 , l2 )]]

Let the last typing rule be an instance of Swap Lens.
l1 : S1 ⇔ T1

l2 : S2 ⇔ T2

swap(l1 , l2 ) : S1 · S2 ⇔ T2 · T1
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:113

By IH, there exists dl 1 , DS 1 , DT 1 , dl 2 , DS 2 , and DT 2 such that.

dl 1 :̃ DS 1 ⇔ DT 1
⇓ S1 →∗ DS 1
⇓ T1 →∗ DT 1
[[dl 1 ]] = [[l1 ]]
dl 2 :̃ DS 2 ⇔ DT 2
⇓ S2 →∗ DS 2
⇓ T2 →∗ DT 2
[[dl 2 ]] = [[l2 ]]
From Lemma 101, dl 1 sdl 2 :̃ DS 1 ⊙ DS 2 ⇔ DT 2 ⊙ DT 1 .
By Corollary 3, and Lemma 11, there exists a DNF regular expression, DS L , and a DNF lens, dl L ,
such that dl L :̃ DS L ⇔ DS 1 ⊙ DS 2 , where [[dl L ]] = {(s, s) | s ∈ L(⇓ (DS1 ⊙ DS 2 ))}. Furthermore,
⇓(DS1 ⊙ DS 2 )→∗ DS L .
By Corollary 3, there exists a DNF regular expression, DS R , and a DNF lens, dl R , such that
dl R :̃ DT 2 ⊙ DT 1 ⇔ DS R , where [[dl R ]] = {(s, s) | s ∈ L(⇓ (DT 2 ⊙ DT 1 ))} Furthermore, ⇓ (DT 2 ⊙
DT 1 )→∗ DS R .
By Lemma 14, as dl L :̃ DS L ⇔ DS 1 ⊙ DS 2 , dl 1 sdl 2 :̃ DS 1 ⊙ DS 2 ⇔ DT 2 ⊙ DT 1 , and dl R :̃ DT 2 ⊙
DT 1 ⇔ DS R there exists a DNF Lens dl :̃ DS L ⇔ DS R , with semantics of the composition of the
three lenses. Because the left and right lenses are the identity lenses, [[dl]] = [[dl 1 sdl 2 ]].
By Lemma 101, [[dl]] = [[dl 1 sdl 2 ]] = {(s1 · s2 , t2 · t1 ) | (s1 , t1 ) ∈ [[dl 1 ]] ∧ (s2 , t2 ) ∈ [[dl 2 ]]} =
{(s1 · s2 , t2 · t1 ) | (s1 , t1 ) ∈ [[l1 ]] ∧ (s2 , t2 ) ∈ [[l2 ]]} = [[swap(l1 , l2 )]].

dl :̃ DS L ⇔ DS R
⇓(S1 · S2 )→∗ DS L
⇓(T2 · T1 )→∗ DS R
[[dl]] = [[swap(l1 , l2 )]]

Let the last rule be an instance of Compose Lens.
l1 : S1 ⇔ S2

l2 : S2 ⇔ S3

l2 ; l1 : S1 ⇔ S3
By induction assumption, there exists dl 1 , DS 1 , DS 2 , dl 2 , DT 2 , and DS 3 such that
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:114 Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic

dl 1 :̃ DS 1 ⇔ DS 2
⇓S1 →∗ DS 1
⇓S2 →∗ DS 2
[[dl 1 ]] = [[l1 ]]
dl 2 :̃ DS 2 ⇔ DS 3
⇓S2 →∗ DS 2′
⇓S3 →∗ DS 3
[[dl 2 ]] = [[l2 ]]
From Lemma 15, there exists a rewriteless dnf lens dl id :̃ ⇓ S2 ⇔⇓ S2 where [[dlid ]] = {(s, s) | s ∈
L(S2 )}. From Corollary 4, we know that, as ⇓ S2 →∗ DS 2 and as ⇓ S2 →∗ DT 2 , there must exist some
′
DS 2′ , DT 2′ such that DS 2 →∗ DS 2′ and DT 2 →∗ DT 2′ and there exists a rewriteless dnf lens dl id
:̃ DS 2′ ⇔
′
′
DT 2 where [[dl id ]] = {(s, s) | s ∈ L(S2)}. From Corollary 2 and Corollary 2, there exists DS 1′ , DS 3′ ,
dl 1′ , and dl 2′ such that DS 1 →∗ DS 1′ , DS 3 →∗ DS 3′ , dl 1′ :̃ DS 1′ ⇔ DS 2′ , dl 2′ :̃ DT 2′ ⇔ DS 3′ , [[dl 1 ]] = [[dl 1′ ]]
and [[dl 2 ]] = [[dl 2′ ]]. From Lemma 14 rewriteless DNF lenses are closed under composition, so there
′
]]◦[[dl 1′ ]] = [[dl 2′ ]]◦[[dl 1′ ]] =
exists a rewriteless DNF lens dl ′ :̃ DS 1′ ⇔ DS 2′ where [[dl ′]] = [[dl 2′ ]]◦[[dl id
′
∗
∗
∗
[[l2 ]] ◦ [[l1 ]] = [[l2 ◦ l1 ]]. Furthermore, ⇓ S1 → DS→ DS 1 so ⇓ S1 → DS 1 . ⇓ S3 →∗ DS 3 →∗ DS 3′ so
⇓ S3 →∗ DS 3′ .
dl ′ :̃ DS 1′ ⇔ DS 3′
⇓S1 →∗ DS 1′
⇓S3 →∗ DS 3′
[[dl ′ ]] = [[l1 ; l2 ]]

Let the last rule be an instance of Rewrite Regex Lens.
S ≡ S′

l:S⇔T

T ≡ T′

l : S′ ⇔ T ′
By IH, there exists dl, DS, DT such that
dl :̃ DS ⇔ DT
⇓S→∗ DS
⇓T →∗ DT
[[dl]] = [[l]]
As S ′ ≡s S, and S is strongly unambiguous, from Lemma 136 there exists a rewriteless DNF lens
dl S′ ,S :̃ DS ′ ⇔ DS such that ⇓S→∗ DS, ⇓S ′→∗ DS ′, and [[dl S′ ,S ]] = {(s, s) | s ∈ L(⇓S)}.
As T ≡s T ′ , and T is strongly unambiguous, from Lemma 136 there exists a rewriteless DNF
lens dl T ,T ′ :̃ DT ⇔ DT ′ such that ⇓T →∗ DT , ⇓T ′→∗ DT ′ , and [[dl T ,T ′ ]] = {(s, s) | s ∈ L(⇓T )}.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:115

From Lemma 15, there exists a lens dl ⇓S :̃ ⇓S ⇔⇓S. As ⇓S→∗ DS and ⇓S→∗ DS, by Corollary 4,
˜ DS→∗ DS,
˜ ⇔ DS,
˜ such that DS→∗ DS,
˜ and [[dl˜⇓S ]] = [[dl ⇓S ]]. From
there exists some dl˜⇓S :̃ DS
˜
˜
˜
Corollary 2, there exists a dl S˜ ′ ,S :̃ DS ′ ⇔ DS such that DS ′→∗ DS ′ and [[dlS˜′ ,S ]] = [[dl S′,S ]]
From Lemma 15, there exists a lens dl ⇓T :̃ ⇓T ⇔⇓T . As ⇓T →∗ DT and ⇓T →∗ DT , by Corollary 4,
˜
˜
˜ , DT →∗ DT
˜ ⇔ DT
, such that DT →∗ DT
, and [[dl˜⇓T ]] = [[dl ⇓T ]]. From
there exists some dl˜⇓T :̃ DT
˜
˜
˜
′
′
∗
′
Corollary 2, there exists a dl T˜ ,T ′ :̃ DT ⇔ DT such that DT → DT and [[dl T˜ ′,T ]] = [[dl T ′,T ]].
˜ ∗ DS,
˜ and DT →∗ DT
˜ , by Corollary 4 there exists a lens dl :̃ DS ⇔ DT such that DS→
As DS→∗ DS
∗
˜
DT → DT , and [[dl]] = [[dl]].
˜
˜
˜
From Corollary 2, there exists dl˜⇓S :̃ DS ⇔ DS such that DS→∗ DS and [[dl˜⇓S ]] = [[dl˜⇓S ]]. From
˜
˜′ ∗ ˜′
˜ such that DS
Corollary 2, there exists dl S˜′ ,S :̃ DS ′ ⇔ DS
→ DS and [[dl S˜ ′,S ]] = [[dl S˜ ′ ,S ]].
˜
˜
˜
From Corollary 2, there exists dl˜⇓T :̃ DT ⇔ DT such that DT →∗ DT and [[dl˜⇓T ]] = [[dl˜⇓T ]]. From
˜′
˜
˜
˜ ⇔ DT
Corollary 2, there exists dl ˜ ′ :̃ DT
such that DT ′ →∗ DT ′ and [[dl ˜ ′ ]] = [[dl ˜ ′ ]].
T ,T

T ,T

T ,T

˜
˜
From Lemma 14, there exists a lens dl :̃ DS ′ ⇔ DT ′ . Because the semantics of all lenses in
˜
the composition for dl were all the identity relation, [[dl]] = [[dl]]. Furthermore, ⇓ S ′→∗ DS ′ and
˜
⇓T ′→∗ DT ′, so we have
˜
˜
dl :̃ DS ′ ⇔ DT ′
˜
⇓S ′→∗ DS ′
˜
⇓T ′ →∗ DT ′
[[dl]] = [[l]]

Theorem 12. If there exists a derivation for l : S ⇔ T , then there exists a DNF lens dl such that
dl : (⇓S) ⇔ (⇓T ) and [[l]] = [[dl]].
Proof. By Lemma 137, there exists dl, DS, DT such that dl :̃ DS ⇔ DT , ⇓ S→∗ DS, ⇓ T →∗ DT ,
and [[dl]] = [[l]]. Because of that, we have the derivation
dl :̃ DS ⇔ DT

⇓S→∗ DS

⇓T →∗ DT

dl :⇓S ⇔⇓T

B.12

Algorithm Correctness

We use an auxiliary data structure of a set-of-examples-parse-tree to deﬁne the orderings.
Deﬁnition 19. We use il to denote list of ints.
Deﬁnition 20. We use ils to denote a set of int lists.
Deﬁnition 21. We use sils to denote a set of string and int list pairs. We also require that the int
lists are distinct.
Deﬁnition 22. To get the strings out of sils, we use projectstrings. In particular,
projectstrings({(s1 , il 1 ), . . . , (sn , il n )}) = {s1 , . . . , sn }.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:116 Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic
Deﬁnition 23. To get the int lists out of sils, we use projectils. In particular,
projectils({(s1 , il 1 ), . . . , (sn , il n )}) = {il 1 , . . . , il n }.
Deﬁnition 24. Deﬁne an exampled atom, exampled sequence, and exampled DNF regular expression as:
EA,EB
::= (EDS ∗ ,ils)
ESQ,ETQ ::= ([s0 · EA1 · . . . · EAn · sn ], ils)
EDS,EDT ::= (hESQ 1 | . . . | ESQ n i, ils)
Intuitively, an exampled regular expression is a DNF regular expression, with the parse trees for
a number of strings which match it embedded.
We build the typing derivation of the form sils ∈ DS
EDS to express that the strings
projectstrings(sils) , labelled by the identiﬁers projectils(sils) when they have their parse trees embedded in DS, generate EDS. Similarly for SQ and ESQ, and A and EA.
Deﬁnition 25.
{(s1,1 , 1 :: il 1 ), . . . , (s1,n1 , n 1 :: il 1 ), . . . , (sm,1 , 1 :: ilm ), . . . , (sm,nm , nm :: ilm )} ∈ DS
{(s1,1 · . . . · s1,n1 , il 1 ), . . . , (sm,1 · . . . · sm,nm , ilm )} ∈ DS

∗

EDS

∗

(EDS , {il 1 , . . . , ilm })

{(s1,1 , il 1 ), . . . , (sm,1 , ilm )} ∈ A1
{(s0′

· s1,1 · . . . · s1,n ·

Ø

EA1
...
{(s1,n , il 1 ), . . . , (sm,n , ilm )} ∈ An
′
′
sn , il 1 ), . . . , (s0 · sm,1 · . . . · sm,n · sn′ , ilm )} ∈ [s0′ · A1 · . . . · An
([s0′ · EA1 · . . . · EAn · sn′ ], {il 1 , . . . , ilm })

sils 1 ∈ SQ 1

ESQ 1

silsi ∈ hSQ 1 | . . . | SQ n i

...

silsn ∈ SQ n

ESQ n

(hESQ 1 | . . . | ESQ n i, projectils(

i ∈[1,n]

Ø

EAn
· sn′ ]

sils i ))

i ∈[1,n]

This is a big typing derivation, and we feel it is clear that, when a DNF regular expression is
strongly unambiguous, this typing derivation is unique for a given set of strings and DNF regular
expression, so it is functional from the ﬁrst two arguments of the derivation. Furthermore, we
can perform this function by doing case analysis on all the possible ways the string is split up
(though it is slow). We perform this function by performing this embedding the function into a
NFA matching algorithm. We elide these details.
Deﬁnition 26. Deﬁne EmbedExamples as the function from DNF Regex DS and intlist labelled
examples sils to exampled DNF regex, such that sils ∈ DS
EmbedExamples(sils, DS)
Now, we are going to build up the machinery to deﬁne an ordering on exampled DNF regular
expressions, exampled sequences, and exampled atoms. We need to deﬁne some general orderings
ﬁrst.
Deﬁnition 27. Let ≤ be an ordering on A. Let [x 1 , . . . , x n ] be a list of As. Deﬁne sorting([x 1 ; . . . ; x n ], ≤
) as a permutation σ ∈ Sn such that σ (i) ≤ σ (j) ⇒ x σ (i ) ≤ x σ (j) .
Deﬁnition 28. Let ≤ be an ordering on A. Let [x 1 ; . . . ; x n ] be a list of As. Deﬁne sort([x 1 ; . . . ; x n ], ≤
) = [x σ (1) ; . . . ; x σ (n) ] where σ = sorting([x 1 ; . . . ; x n ], ≤).
Deﬁnition 29. Let ≤1 be an ordering on A1 . Let ≤2 be an ordering on A2 . Deﬁne the product
ordering (≤1 , ≤2 ) on A1 × A2 as the lexicographic ordering on the two elements.
Deﬁnition 30. Let ≤ be an ordering on A. We write [≤] for the lexicographic ordering on A List.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:117

Property 2. [x 1 ; . . . ; x n ][≤][y1 ; . . . ; ym ] and [y1 ; . . . ; ym ][≤][x 1 ; . . . ; x n ] if, and only if n = m and
for all i ∈ [1, n] x i ≤ yi and yi ≤ x i
Deﬁnition 31. Let ≤ be an ordering on A. Deﬁne {≤} as the ordering on A List as: [x 1 ; . . . ; x n ]{≤
}[y1 ; . . . ; ym ] if sort(x 1 ; . . . ; x n , ≤)[≤]sort(y1 ; . . . ; ym , ≤). We also use {≤} to operate on sets, by
ﬁrst converting the set to a list, then using that ordering.
Deﬁnition 32. Deﬁne an ordering on int list sets, ≤intlistset , as {[≤]}, where ≤ is the usual on
integers.
Lemma 138. If
[x 1 ; . . . ; x n ]{≤}[y1 ; . . . ; ym ],
[y1 ; . . . ; ym ]{≤}[x 1 ; . . . ; x n ],
σ1 = sorting([x 1 ; . . . ; x n ], ≤) and
σ2 = sorting([y1 ; . . . ; ym ], ≤), then
n = m,
x i ≤ y(σ1−1 ◦σ2 )(i ) , and
y(σ1−1 ◦σ2 )(i ) ≤ x i
Proof. Let σ1 = sorting([x 1 ; . . . ; x n ], ≤) and σ2 = sorting([y1 ; . . . ; ym ], ≤)
This means that [x σ1 (1) ; . . . ; x σ1 (n) ][≤][yσ2 (1) ; . . . ; yσ2 (m) ] and [yσ2 (1) ; . . . ; yσ2 (m) ][≤][x σ1 (1) ; . . . ; x σ1 (n) ].
By the above property about dictionary orderings, this means that n = m and x σ1 (i ) ≤ yσ2 (i ) and
yσ2 (i ) ≤ x σ1 (i )
Consider the permutation σ = σ1−1 ◦ σ2 . We know x σ1 (i ) ≤ yσ2 (i ) and yσ2 (i ) ≤ x σ1 (i ) . By reordering through the permutation σ1−1 , we get x σ1−1 ◦σ1 (i ) ≤ yσ1−1 ◦σ2 (i ) and yσ1−1 ◦σ2 (i ) ≤ x σ1−1 ◦σ1 (i ) . By
simplifying we get x i ≤ yσ (i ) and yσ (i ) ≤ x i

Lemma 139. [x 1 ; . . . ; x n ]{≤}[y1 ; . . . ; ym ] and [y1 ; . . . ; ym ]{≤}[x 1 ; . . . ; x n ] if, and only if, n = m
and there exists a permutation σ such that x i ≤ yσ (i ) and yσ (i ) ≤ x i
Proof.
Case 1 (⇒). By Lemma 138.
Case 2 (⇐). Let n = m and σ be a permutation such that x i ≤ yσ (i ) and yσ (i ) ≤ x i .
We know the number of equivalence classes in the two lists is equal, as otherwise there would
be some equivalence class in one that is not in the other, a contradiction with the assumption.
We proceed by induction on the number of equivalence classes:
Base Case: no equivalence classes, no elements, trivially true.
Induction Step: Let there be n + 1 equivalence classes. Let σ1 = sorting([x 1 ; . . . ; x n ],) and σ2 =
sorting([y1 ; . . . ; yn ],).
Consider the largest equivalence class. We know that all except that equivalence class must
map to each other, so when we remove that equivalence class, we get that all except the largest
elements are ordered with {≤}, by IH. Adding those elements back in, we know they must go at the
end. Furthermore, they must have the same number of elements on each side k, else we contradict
the assumption. This means that in sort([x 1 ; . . . ; x n ], a)ndsort([y1 ; . . . ; yn ],) are ordered such that
the jth element in the x list is equivalent to the jth element in the y list, until the end, but the last
k elements are all equivalent as they are all the largest equivalence class, so we are done.

Now we can deﬁne what

exs
≤Atom
,

exs
≤Seq

and

exs
≤D
NF

are, mutually.
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:118 Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic
Deﬁnition 33.
exs
• We say (EDS ∗ , ils 1 ) ≤Atom
(EDT ∗ , ils2 ) if
exs , ≤
(EDS, ils1 )(≤D
)(EDT
, ils2 ).
intlistset
NF
exs ([t · EB · . . . · EB · t ], ils ) if
• We say ([s0 · EA1 · . . . · EAn · sn ], ils1 ) ≤Seq
0
1
m n
2
exs
([EA1 ; . . . ; EAn ], ils1 )([≤Atom ], ≤intlistset )([EB 1 ; . . . ; EBm ], ils2 ).
exs
• We say (hESQ 1 | . . . | ESQ n i, ils 1 ) ≤D
N F (hETQ 1 | . . . | ETQ n i, ils 2 ) if
exs
([ESQ 1; . . . ; ESQ n ], ils1 )([≤Seq ], ≤intlistset )([ETQ 1 ; . . . ; ETQm ], ils2 ).
Now, using this we provide the more formal deﬁnition of algorithm, with the formal use of the
examples in Algorithm 4. We do not include information about user deﬁned data types.
Lemma 140.
• Let A and B be strongly unambiguous atoms. Let sils1 be a string int list set. Let sils 2 be a
string int list set. Let EA and EB be exampled atoms. Let sils 1 ∈ A
EA. Let sils 2 ∈ B
EB. If RigidSynthAtom(EA, EB) returns an atom lens, Some al, then projectils(sils1 ) =
projectils(sils2 ), al :̃ A ⇔ B, and for each (s, t) pair with the same int list in sils 1 and sils 2 ,
(s, t) ∈ [[al]].
• Let SQ and TQ be strongly unambiguous sequences. Let sils 1 be a string int list set. Let
sils2 be a string int list set.
Let ESQ and ETQ be exampled sequences. Let sils1 ∈ SQ
ESQ. Let sils 2 ∈ TQ
ETQ. If RigidSynthSeq(ESQ, ETQ) returns a sequence lens, Some sql, then projectils(sils1 ) =
projectils(sils2 ). sql :̃ SQ ⇔ TQ, and for each (s, t) pair with the same int list in sils 1 and
sils2 , (s, t) ∈ [[sql]].
• Let DS and DT be strongly unambiguous DNF regular expressions. Let sils 1 be a string int
list set. Let sils 2 be a string int list set. Let EDS and EDT be exampled DNF regular expressions. Let sils 1 ∈ EDS
EDS. Let sils 2 ∈ EDT
EDT . If RigidSynthInternal(EDS, EDT )
returns a DNF lens, Some dl, then projectils(sils1 ) = projectils(sils2 ), dl :̃ DS ⇔ DT , and for
each (s, t) pair with the same int list in sils1 and sils 2 , (s, t) ∈ [[dl]].
Proof.
Case 1 (atom). Unfolding deﬁnitions.
′ , il ′ )}.
Let sils1 = {(s1′ , il 1′ ), . . . , (sm
m′
′′
′ ′′
′
,
il
Let sils2 = {(t1 , il 1 ), . . . , (tm
′′
m′′ )}
By inverison on sils 1 ∈ A
EA and sils 2 ∈ B
EB, we know that
′
′
′
′
′ , 1 :: il ′ ); . . . ; (s ′ , n ′ :: il ′ ); . . . ; (s ′
,
1
::
il
);
{(s1,1
′
1
1
m . . . ; (sm′ ,n ′ , nm′ :: il m′ )} ∈ DS
m′ ,1
1,n ′ 1
m′

1

′ , 1 :: il ′′ ); . . . ; (t ′ , n ′′ :: il ′′ ); . . . ; (t ′
{(t1,1
1
1
m′′ ,1 , 1
1,n ′′1 1
′
′
si ,1 · . . . · si ,n′ = si ,
i
ti′,1 · . . . · ti′,n′′ = ti ,
i
′
EA = (EDS ∗ , {il 1′ , . . . , ilm
}), and
′′
′′
∗
EB = (EDT , {il 1 , . . . , ilm
})

::

′′
′′
′
ilm
′′ ); . . . ; (s ′′ ′′ , nm ′′
m ,n ′′
m

::

′′
ilm
′′ )}

∈ DT

EDS,
EDT ,

As RigidSynthAtom returns, then it must return iterate(RigidSynthInternal(EDS, EDT )).
By IH that means that
′
′
′
′
′
′
′
′
′
projectils({(s1,1
, 1 :: il 1′ ); . . . ; (s1,n
′ , n1 :: il 1 ); . . . ; (sm′ ,1 , 1 :: il m′ ); . . . ; (sm′ ,n′ , nm′ :: il m′ )})
1

m′

′′
′′
′
′′
′ , 1 :: il ′′ ); . . . ; (t ′ , n ′′ :: il ′′ ); . . . ; (t ′
= projectils({(t1,1
1
1
m′′ ,1 , 1 :: il m′′ ); . . . ; (sm′′ ,n′′m′′ , nm′′ :: il m′′ )}),
1,n′′1 1
So, by reindexing,
projectils({(s1,1 , 1 :: il 1 ); . . . ; (s1,n1 , n1 :: il 1 ); . . . ; (sm,1 , 1 :: il m ); . . . ; (sm,nm , nm :: il m )})
= projectils({(t1,1 , 1 :: il 1 ); . . . ; (t1,n1 , n1 :: il 1 ); . . . ; (tm,1 , 1 :: il m ); . . . ; (sm,nm , nm :: il m )}),

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:119

Algorithm 4 RigidSynth
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:

function RigidSynthAtom((EDS ∗ , ils 1 ), (EDT ∗ , ils2 ))
if ils 1 6≤intlistset ils2 ∨ ils2 6≤intlistset ils 1 then
return None
match RigidSynthInternal(EDS, EDT ) with
| Some dl → return iterate(dl)
| None → return None
function RigidSynthSeq(ESQ, ETQ)
([s0 · EA1 · . . . · EAn · sn ], ils 1 ) ← ESQ
([t0 · EB 1 · . . . · EBm · tm ], ils2 ) ← ETQ
if ils 1 6≤intlistset ils2 ∨ ils2 6≤intlistset ils 1 then
return None
if n , m then
return None
exs , [EA · . . . · EA ])
σ1 ← sorting(≤Atom
1
n
exs , [EB · . . . · EB ])
σ2 ← sorting(≤Atom
1
n
σ ← σ1−1 ◦ σ2
EABs ← Zip([EA1 · . . . · EAn ], [EB σ (1) · . . . · EB σ (n) ])
alos ← Map(RigidSynthAtom, EABs)
match AllSome(alos) with
| Some [al 1 · . . . · al n ] → return Some ([(s0 , t0 ) · al 1 · . . . · al n · (sn , tn )], σ −1 )
| None → return None
function RigidSynthInternal(EDS, EDT )
(hESQ 1 | . . . | ESQ n i, ils 1 ) ← EDS
(hETQ 1 | . . . | ETQm i, ils 2 ) ← EDT
if ils 1 6≤intlistset ils2 ∨ ils2 6≤intlistset ils 1 then
return None
if n , m then
return None
exs , [ESQ | . . . | ESQ ])
σ1 ← sorting(≤Seq
1
n
exs
σ2 ← sorting(≤Seq , [ETQ 1 | . . . | ETQ n ])
σ ← σ1−1 ◦ σ2
ESTQs ← Zip([ESQ 1 | . . . | ESQ n ], [ETQ σ (1) | . . . | ETQ σ (n) ])
sqlos ← Map(RigidSynthSeq, ESTQs)
match AllSome(sqlos) with
| Some [sql 1 | . . . | sql n ] → return Some (hsql 1 | . . . | sqln i, σ −1 )
| None → return None
function RigidSynth(DS, DT , exs)
[(s1 , t1 ); . . . ; (sn , tn )] ← exs
EDS ← EmbedExamples([([1], s1 ); . . . ; ([n], sn )], DS)
EDT ← EmbedExamples([([1], t1 ); . . . ; ([n], tn )], DT )
return RigidSynthInternal(EDS, EDT )

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:120 Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic
sils 1 = {(s1 , il 1 ), . . . , (sm , ilm )}, and
sils 2 = {(t1 , il 1 ), . . . , (tm , ilm )}, so we have
projectils({(s1 , il 1 ), . . . , (sm , il m )}) = projectils({(t1 , il 1 ), . . . , (tm , il m )}), as desired. (also we know by
the condition which returns None)
Furthermore, by IH, for all i, j, we have (si ,j , ti ,j ) ∈ [[dl]]. This means that (si ,1 · . . . · si ,ni , ti ,1 · . . . ·
ti ,ni ) ∈ [[dl]] for all i, so (si , ti ) ∈ [[dl]] for all i.
Furthermore, by IH, dl :̃ DS ⇔ DT . Thusly, as A and B are strongly unambiguous, DS and DT
are unambiguously iterable, so we have
dl :̃ DS ⇔ DT

DS ∗!

DT ∗!

iterate(dl) :̃ DS ∗ ⇔ DT ∗
Case 2 (sequence). Unfolding deﬁnitions.
′′ , il ′ )}.
Let sils1 = {(s1′′ , il 1′ ), . . . , (sm
′
m′
′′
′′
′′ , il ′′ )}
Let sils2 = {(t1 , il 1 ), . . . , (tm
′′
m′′
By inverison on sils 1 ∈ SQ
ESQ and sils 2 ∈ TQ
ETQ, we know that
′′ , il ′ ); . . . ; (s ′′ , il ′ )} ∈ A
EA
,
{(s1,i
′
′
i
i
1
m ,i m
′′ , il ′′ ); . . . ; (t ′′ , il ′′ )} ∈ B
{(t1,i
EBi ,
i
1
m′′ ,i m′′
s0′ · si′′,1 · . . . · si′′,n · sn′ = si ,
t0′ · ti′′,1 · . . . · ti′′,n′ · tn′ ′ = ti′′ ,
′
ESQ = ([s0′ · EA1 · . . . · EAn · sn′ ], {il 1′ , . . . , ilm
′ }), and
′′
′′
′
′
ETQ = ([s0 · EB 1 · . . . · EBn′ · sn′ ], {il 1 , . . . , ilm
′′ })
Let σ1 = sorting([EA1 ; . . . ; EAn ],). Let σ2 = sorting([EA1 ; . . . ; EAn ],). Let σ = σ1−1 ◦ σ2 .
As RigidSynthSeq returns, AllSome(alos) must be true, which means that for each i ∈ [1, n],
RigidSynthAtom(EAi , EB σ (i ) ) returns a lens, al i .
By IH, that means that
′′ , il ′ ); . . . ; (s ′′ , il ′ )})
projectils({(s1,i
1
m′ ,i m′
′′
′′
′
′′
′′
= projectils({(t1,σ
,
il
);
.
. . ; (tm′′′′,σ (i) , il m
′′ )}), which immediately implies that m = m .
1
(i)
So, by reindexing, and aligning the int lists, projectils({(s1,i , il 1 ); . . . ; (sm,i , il m )})
= projectils({(t1,σ (i) , il 1 ); . . . ; (tm,σ (i) , il m )}),
sils 1 = {(s1 , il 1 ), . . . , (sm , ilm )}, and
sils 2 = {(t1 , il 1 ), . . . , (tm , ilm )}, so we have
projectils({(s1 , il 1 ), . . . , (sm , il m )})
= projectils({(t1 , il 1 ), . . . , (tm , il m )}), as desired. (also we know by the condition which returns
None)
Furthermore, by IH, for all (i, j) we have (si ,j , ti ,σ (j) ) ∈ [[al j ]]. By the deﬁnition of sequence lens
semantics, (s0′ ·si ,1 ·. . . ·si ,n sn′ , t0′ ·ti ,σ −1 (σ (1)) ·. . . ·ti ,σ −1 (σ (n)) ·tn′ ) ∈ [[([(s0′ , t0′ )·al 1 ·. . .·al n ·(sn′ , tn′ )], σ −1 )]].
By simplifying, we get (s0′ · si ,1 · . . . · si ,n sn′ , t0′ · ti ,1 · . . . · ti ,n · tn′ ) ∈ [[([(s0′ , t0′ )·al 1 ·. . .·aln ·(sn′ , tn′ )], σ −1 )]].
By simplifying even more, we gets (si , ti ) ∈ [[([(s0′ , t0′ ) · al 1 · . . . · al n · (sn′ , tn′ )], σ −1 )]], as desired.
Furthermore, by IH, al i :̃ Ai ⇔ Bσ (i ) . Thusly, as SQ and TQ are strongly unambiguous, they are
sequence unambiguously concatenable, so we have:
al i :̃ Ai ⇔ Bσ (i )

·! (s0′ ; A1 ; . . . ; An ; sn′ )

·! (t0′ ; Bσ −1 (σ (1)) ; . . . ; Bσ −1 (σ (n)) ; tn′ )

([(s0′ , t0′ ) · al 1 · . . . · al n · (sn′ , tn′ )], σ −1 ) :̃ [s0′ · A1 · . . . · An · sn′ ] ⇔ [s0′ · Bσ −1 (σ (1)) · . . . · Bσ −1 (σ (n)) · sn′ ]
Which, by simplifying is:
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

al i :̃ Ai ⇔ Bσ (i )

1:121

·! (s0′ ; A1 ; . . . ; An ; sn′ )

·! (t0′ ; B1 ; . . . ; Bn ; tn′ )

([(s0′ , t0′ ) · al 1 · . . . · al n · (sn′ , tn′ )], σ −1 ) :̃ [s0′ · A1 · . . . · An · sn′ ] ⇔ [s0′ · B1 · . . . · Bn · sn′ ]
As desired.
Case 3 (dnfregex). Unfolding deﬁnitions.
′′ , il ′ )}.
Let sils1 = {(s1′′ , il 1′ ), . . . , (sm
′
m′
′′
′′
′′ , il ′′ )}
Let sils2 = {(t1 , il 1 ), . . . , (tm
′′
m′′
By inverison on sils 1 ∈ DS
EDS and sils2 ∈ DT
EDT , we know that
Si = {(si′,1 , il i′,1 ); . . . ; (si′,m′ , il i′,m′ )},
i
i
Si′ = {(ti′,1 , il i′′,1 ); . . . ; (ti′,m′′ , il i′′,m′′ )},
i
i
Si ∈ SQi
ESQ i ,
S ′ ∈ TQi
ETQ i ,
Ði
S
=
sils1 ,
Ði ∈[1,n] i′
S
=
sils 2 ,
i ∈[1,n] i
EDS = hESQ 1 | . . . | ESQ n i, and
EDT = hETQ 1 | . . . | ETQ n i
Let σ1 = sorting([EA1 ; . . . ; EAn ],). Let σ2 = sorting([EA1 ; . . . ; EAn ],). Let σ = σ1−1 ◦ σ2 .
As RigidSynthInternal returns, AllSome(sqlos) must be true, which means that for each i ∈
[1, n], RigidSynthSeq(ESQ i , ETQ σ (i ) ) returns a lens, sql i .
By IH, that means that projectils(Si ) = projectils(Sσ′ (i) ). This means that, projectils(sils1 ) =
projectils(sils2 ),as they are each the union of all these sets. We also know this through the fact we
return a value, as desired. This immediately implies that m ′ = m ′′. Furthermore, we can use this
to reindex Si as Si = {(si ,1 , il i ,1 ); . . . ; (si ,mi , il i ,mi )}, and Si′ as Sσ′ (i ) = {(ti ,1 , il i ,1 ); . . . ; (ti ,mi , il i ,mi )}.
Furthermore, by IH, for all (i, j) we have (si ,j , ti ,j ) ∈ [[sql i ]]. By the deﬁnition of dnf lens semanÐ
tics, [[(hsql 1 | . . . | sqln i, σ −1 )]] = i ∈[1,n] [[sqli ]]. Let (si , ti ) arbitrary from sils 1 and sils2 sharing the
same int list ili . By them being the union of all Si and Si′ , there exists some i ′, j such that si = si ,j
and ti = ti ,j . As such, (si , ti ) ∈ [[(hsql 1 | . . . | sql n i, σ −1 )]], as desired.
Furthermore, by IH, sql i :̃ SQ i ⇔ TQ σ (i ) . Thusly, as DS and DT are strongly unambiguous, they
are pairwise disjoint in sequences, so we have:
sql i :̃ SQ i ⇔ TQ σ (i )

i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅

i , j ⇒ L(TQi ) ∩ L(TQ j ) = ∅

(hsql 1 | . . . | sql n i, σ −1 ) :̃ hSQ 1 | . . . | SQ n i ⇔ hTQ σ −1 (σ (1)) | . . . | TQ σ −1 (σ (n)) i
Which, by simplifying is:
sql i :̃ SQ i ⇔ TQ σ (i )

i , j ⇒ L(SQi ) ∩ L(SQ j ) = ∅

i , j ⇒ L(TQi ) ∩ L(TQ j ) = ∅

−1

(hsql 1 | . . . | sql n i, σ ) :̃ hSQ 1 | . . . | SQ n i ⇔ hTQ 1 | . . . | TQn i
As desired.

Lemma 141. Let DS and DT be strongly unambiguous DNF regular expressions. Let
[(s1 , t1 ); . . . ; (sm , tm )] be a list of input-output examples. If RigidSynth(EDS, EDT ) returns a DNF
lens, Some dl, then dl :̃ DS ⇔ DT , and (si , ti ) ∈ [[dl]].
Proof. Let [(s1 , t1 ); . . . ; (sn , tn )] = exs.
Let EDS = EmbedExamples([([1], s1 ); . . . ; ([n], sn )], DS)
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:122 Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic
Let EDT = EmbedExamples([([1], t1 ); . . . ; ([n], tn )], DT )
This means that [([1], s1 ); . . . ; ([n], sn )] ∈ DS
EDS and [([1], t1 ); . . . ; ([n], tn )] ∈ DT
EDT .
As RigidSynth returns a lens, then RigidSynthInternal(EDS, EDT ) must return a lens.
By the above statements, Lemma 140 applies, so the DNF lens returned by it satisﬁes dl :̃ DS ⇔
DT , and (si , ti ) ∈ [[dl]].
As dl :̃ DS ⇔ DT , we know that DS and DT are strongly unambiguous.
exs
exs
As such the conditions for Lemma 143 apply so EDS ≤D
N F EDT and EDT ≤D N F EDS.
By Lemma 144, that means that RigidSynthInternal(EDS, EDT ) returns a DNF lens, so then
so too does RigidSynth.
Let DS and DT be strongly unambiguous DNF regular expressions. Let sils 1 be a string int list
set. Let sils 2 be a string int list set. Let EDS and EDT be exampled DNF regular expressions. Let
sils 1 ∈ EDS
EDS. Let sils2 ∈ EDT
EDT . If RigidSynthInternal(EDS, EDT ) returns a
sequence lens, Some dl, then projectils(sils1 ) = projectils(sils 2 ), dl :̃ DS ⇔ DT , and for each (s, t)
pair with the same int list in sils 1 and sils2 , (s, t) ∈ [[dl]].

Lemma 142. Let DS and DT be strongly unambiguous DNF regular expressions. Let
[(s1 , t1 ); . . . ; (sm , tm )] be a list of input-output examples. If SynthDNFLens(EDS, EDT ) returns a
DNF lens, Some dl, then dl : DS ⇔ DT , and (si , ti ) ∈ [[dl]].
Proof. If SynthDNFLens returns, then there must be some (S ′, T ′ ) popped from the queue
which returned a DNF lens dl = RigidSynthInternal(S ′, T ′ ). These regular expressions are such
that DS→DS ∗ DS ′ and DT →DS ∗ DT ′ , as the regular expressions are always either the originals, or
have been added to the queue from an expansion on a previously popped element. Inductively,
everything in the queue is an expansion on DS or DT .
As DS and DT are strongly unambiguous DNF regular expressions, DS→DS ∗ DS ′ means that DS ′
is strongly unambiguous, and similarly for DT and DT ′ .
So, by Lemma 141, dl :̃ DS ′ ⇔ DT ′ . Furthermore, for each (si , ti ) pair in the examples (si , ti ) ∈
[[dl]].
Lastly, we can then build the typing derivation:
dl :̃ DS ′ ⇔ DT ′

DS→DS ∗ DS ′

DT →DS ∗ DT ′

dl :̃ DS ⇔ DT

Theorem 13. For all lenses l, regular expressions S and T , and examples exs, if
l = SynthLens(S, T , exs), then l : S ⇔ T and for all (s, t) in exs, (s, t) ∈ [[l]].
Proof. As SynthLens returns, then SynthDNFLens(DS, DT ) returns, where DS =⇓ S and
DT =⇓T . As Validate(S, T , exs) does not error out, then we know S and T are strongly unambiguous, and exs matches them. This then means that DS and DT are also strongly unambiguous.
As such, by Lemma 142, we know that dl = SynthDNFLens(DS, DT ) returns, that dl : DS ⇔ DS,
and that for each (s, t) in the examples, (s, t) ∈ [[dl]]. By Theorem 2, there exists S ′ and T ′ such
that ⇑dl and ⇓S ′ = DS and ⇓T ′ = DT and [[⇑dl]] = [[dl]].
As ⇓S =⇓S ′ and ⇓T =⇓T ′, we have S ≡s S ′ and T ≡s T ′ .
⇑dl : S ′ ⇔ T ′

S ≡s S ′

⇑dl : S ⇔ T
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

T ≡s T ′

Synthesizing Bijective Lenses

1:123

Furthermore, as [[dl]] = [[⇑ dl]], we have for each (s, t) in the examples, (s, t) ∈ [[⇑ dl]], as
desired.

Lemma 143.
• Let A and B be strongly unambiguous atoms. Let sils1 be a string int list set. Let sils 2 be a
string int list set. Let projectils(sils 1 ) = projectils(sils2 ). Let EA and EB be exampled atoms.
Let sils1 ∈ A
EA. Let sils2 ∈ B
EB. If al :̃ A ⇔ B, and for each (s, t) pair with the
exs
exs
same int list in sils 1 and sils 2 , (s, t) ∈ [[al]], then EA ≤Atom
EB and EB ≤Atom
EA.
• Let SQ and TQ be strongly unambiguous sequences. Let sils 1 be a string int list set. Let sils 2
be a string int list set. Let projectils(sils 1 ) = projectils(sils2 ). Let ESQ and ETQ be exampled
sequences. Let sils1 ∈ SQ
ESQ. Let sils2 ∈ TQ
ETQ. If sql :̃ SQ ⇔ TQ, and for each
exs ETQ and
(s, t) pair with the same int list in sils 1 and sils2 , (s, t) ∈ [[sql]], then ESQ ≤Seq
exs
ETQ ≤Seq ESQ.
• Let DS and DT be strongly unambiguous DNF regular expressions. Let sils 1 be a string int
list set. Let sils 2 be a string int list set. Let projectils(sils 1 ) = projectils(sils2 ). Let EDS and
EDT be exampled DNF regular expressions. Let sils 1 ∈ EDS
EDS. Let sils 2 ∈ EDT
EDT . If dl :̃ DS ⇔ DT , and for each (s, t) pair with the same int list in sils 1 and sils 2 ,
exs
exs
(s, t) ∈ [[dl]], then EDS ≤D
N F EDT and EDT ≤D N F EDS.
Proof. We proceed by mutual induction
Case 1 (atom case). Unfolding deﬁnitions.
Let sils1 = {(s1 , il 1 ), . . . , (sm , ilm )}.
Let sils2 = {(t1 , il 1 ), . . . , (tm , ilm )}
By inversion on al :̃ A ⇔ B, we know DS ∗ = A, DT ∗ = B, iterate(dl) = al, and dl :̃ DS ⇔ DT .
By inversion on [[iterate(dl)]], there exist s1,1 · . . . · s1,n1 = s1 through sm,1 · . . . · sm,nm = sm and
t1,1 · . . . · t1,n1 = t1 through tm,1 · . . . · sm,nm = tm such that (si ,j , ti ,j ) ∈ [[dl]].
Furthermore, this means that si ,j ∈ L(DS) and ti ,j ∈ L(DT).
By inverison on sils 1 ∈ A
EA and sils 2 ∈ B
EB, we know that
′
′ , 1 :: il ); . . . ; (s ′ , n ′ :: il ); . . . ; (s ′ , 1 :: il ); . . . ; (s ′
EDS,
{(s1,1
′ , nm :: il m )} ∈ DS
1
m
1
m,1
m,nm
1,n ′1 1
′′
′
′
′′
′
′
EDT ,
{(t1,1 , 1 :: il 1 ); . . . ; (t1,n′′ , n 1 :: il 1 ); . . . ; (tm,1 , 1 :: ilm ); . . . ; (sm,n′′ , nm :: ilm )} ∈ DT
m
1
si′,1 · . . . · si′,n′ = si ,
i
ti′,1 · . . . · ti′,n′′ = si ,
i
EA = (EDS ∗ , {il 1 , . . . , ilm }), and
EB = (EDT ∗ , {il 1 , . . . , ilm })
As A and B are strongly unambiguous, ni = ni′ = ni′′ , si ,j = si′,j , ti ,j = ti′,j , and DS and DT are
strongly unambiguous.
By inspection
projectils({(s1,1 , 1 :: il 1 ); . . . ; (s1,n1 , n1 :: il 1 ); . . . ; (sm,1 , 1 :: il m ); . . . ; (sm,nm , nm :: il m )})
= projectils({(t1,1 , 1 :: il 1 ); . . . ; (t1,n1 , n1 :: il 1 ); . . . ; (tm,1 , 1 :: il m ); . . . ; (sm,nm , nm :: il m )})
exs
Using the above facts, we have satisﬁed the preconditions to use the IH, so EDS ≤D
N F EDT and
exs
EDT ≤D N F EDS.
exs
exs
EA.
EB and EB ≤Atom
Furthermore, {il 1 , . . . , ilm } ≤intlistset {il 1 , . . . , ilm }, so EA ≤Atom
Case 2 (sequence case). Unfolding deﬁnitions.
Let sils1 = {(s1 , il 1 ), . . . , (sm , ilm )}.
Let sils2 = {(t1 , il 1 ), . . . , (tm , ilm )}
By inversion on sql :̃ SQ ⇔ TQ, we know [s0′ ·A1 ·. . .·An ·sn′ ] = SQ, [t0′ ·Bσ (1) ·. . . ·Bσ (n) ·tn′ ] = TQ,
([(s0′ , t0′ ) · al 1 · . . . · al n · (sn′ , tn′ )], σ ) = sql, and al i :̃ Ai ⇔ Bi .
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:124 Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic
By inversion on [[([(s0′ , t0′ ) ·al 1 · . . . ·al n ·(sn′ , tn′ )], σ )]], there exist s0′ · s1,1 · . . . · s1,n · sn′ = s1 through
= sm and t0′ · t1,σ (1) · . . . · t1,σ (n) · tn′ = t1 through t0′ · tm,σ (1) · . . . · sm,σ (n) · tn′ = tm
[[al j ]].
Furthermore, this means that si ,j ∈ L(Aj ) and ti ,j ∈ L(Bj ).
By inverison on sils 1 ∈ SQ
ESQ and sils 2 ∈ TQ
ETQ, we know that
′′
′′
{(s1,i
, il 1 ); . . . ; (sm,i
, ilm )} ∈ Ai
EAi ,
′′
′′
{(t1,i
, il 1 ); . . . ; (tm,i
, ilm )} ∈ Bi
EBi ,
′
′′
′′
s0 · si ,1 · . . . · si ,n · sn′ = si ,
t0′ · ti′′,1 · . . . · ti′′,n · tn′ = ti ,
ESQ = ([s0′ · EA1 · . . . · EAn · sn′ ], {il 1 , . . . , ilm }), and
ETQ = ([s0′ · EB σ (1) · . . . · EB σ (n) · sn′ ], {il 1 , . . . , ilm })
As SQ and TQ are strongly unambiguous, si ,j = si′′,j , ti ,j = ti′′,j , and Ai and Bi are strongly
unambiguous.
By inspection projectils({(s1,i , il 1 ); . . . ; (sm,i , il m )}) = projectils({(t1,i , il 1 ); . . . ; (tm,i , il m )})
exs
Using the above facts, we have satisﬁed the preconditions to use the IH, so EAi ≤Atom
EBi and
exs
EBi ≤Atom EAi .
exs
As such, from Lemma 139, [EA1 ; . . . ; EAn ]{≤Atom
}[EB σ (1) ; . . . ; EB σ (n) ].
This means that, as {il 1 , . . . , ilm } ≤intlistset {il 1 , . . . , ilm }, we have
exs }, ≤
([EA1 ; . . . ; EAn ], {il 1 , . . . , ilm })({≤Atom
intlistset )([EB σ (1) ; . . . ; EB σ (n) ], {il 1 , . . . , il m }). Which means
exs
that ESQ ≤Seq ETQ.
s0′ · sm,1 · . . . · sm,n · sn′
such that (si ,j , ti ,j ) ∈

Case 3 (DNF regex case). Unfolding deﬁnitions.
Let sils1 = {(s1 , il 1 ), . . . , (sm , ilm )}.
Let sils2 = {(t1 , il 1 ), . . . , (tm , ilm )}
By inversion on dl :̃ DS ⇔ DT , we know hSQ 1 | . . . | SQn i = DS, hTQ σ (1) | . . . | TQ σ (n) i = DT ,
(h(sql 1 | . . . | sql n i, σ ) = sql, and sql i :̃ SQ i ⇔ TQ i .
By inversion on [[(h(sql 1 | . . . | sql n i, σ )]], there exist {(s1,1 , t1,1 ), . . . , (s1,m1 , t1,m1 )} = S1 through
Ð
{(sn,1 , tn,1 ), . . . , (sn,mn , tn,mn )} = Sn such that i ∈[1,n] Si = {(s1 , t1 ), . . . , (sm , tm )}, such that Si ⊂
[[sqli ]], also with this reindexing Furthermore, this means that si ,j ∈ L(SQi ) and ti ,j ∈ L(TQi ).
By inverison on sils 1 ∈ DS
EDS and sils2 ∈ DT
EDT , we know that
{(si′,1 , il i′,1 ); . . . ; (si′,m′ , il i′,m′ )} ∈ SQi
ESQ i ,
i
i
′ , il ′′ ); . . . ; (t ′
{(t1,i
, il i′′,m′′ )} ∈ TQ i
ETQ i ,
i ,1
i ,m′′i
i
Ð
′
′
i ∈[1,n] {si ,1 , . . . , si ,m′ } = {s1 , . . . , sm }
i
Ð
′
′
i ∈[1,n] {ti ,1 , . . . , ti ,m′′ } = {t1 , . . . , tm }
i
EDS = (hESQ 1 | . . . | ESQ n i, {il 1 , . . . , ilm }), and
EDT = (hETQ σ (1) | . . . | ETQ σ (n) i, {il 1 , . . . , ilm })
As DS and DT are strongly unambiguous, {si ,1 , . . . , si ,mi } = {si′,1 , . . . , si′,m′ },
i
{ti ,1 , . . . , ti ,mi } = {ti′,1 , . . . , ti′,m′ },
i
By aligning with their int lists (which are unique), we get ilsi = {(si′,1 , il i′,1 ); . . . ; (si′,m′ , il i′,m′ )} =
i
i
{(si ,1 , il i ,1 ); . . . ; (si ,mi , il i ,mi )} and
′
ilsi′ = {(t1,i
, il i′′,1 ); . . . ; (ti′,m′′ , il i′′,m′′ )} = {(t1,i , ili ,1 ); . . . ; (ti ,mi , il i ,mi )}
i
i
By inspection projectils({(si,1 , il i,1 ); . . . ; (si,mi , il i,mi )}) = projectils({(t1,i , il i,1 ); . . . ; (ti,mi , il i,mi )})
exs ETQ
Using the above facts, we have satisﬁed the preconditions to use the IH, so ESQ i ≤Seq
i
exs
and ETQ i ≤Seq ESQ i .
exs
As such, from Lemma 139, [ESQ 1 ; . . . ; ESQ n ]{≤Seq
}[ETQ σ (1) ; . . . ; ETQ σ (n) ].
, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:125

This means that, as {il 1 , . . . , ilm } ≤intlistset {il 1 , . . . , ilm }, we have
exs }, ≤
([ESQ 1 ; . . . ; ESQ n ], {il 1 , . . . , ilm })({≤Seq
intlistset )([ETQ σ (1) ; . . . ; ETQ σ (n) ], {il 1 , . . . , ilm }). Which
exs
means that EDS ≤D N F EDT .

Lemma 144.
exs
exs
• Let EA and EB be exampled atoms. If EA ≤Atom
EB and EB ≤Atom
EA, then
RigidSynthAtom returns an atom lens.
exs ETQ and ETQ ≤ exs ESQ, then
• Let ESQ and ETQ be exampled atoms. If ESQ ≤Seq
Seq
RigidSynthSeq returns a sequence lens.
exs
exs
• Let EDS and EDT be exampled atoms. If EDS ≤D
N F EDT and EDT ≤D N F EDS, then
RigidSynthInternal returns a DNF lens.

Proof.
exs
exs
Case 1 (atoms). Let (EDS ∗ , ils) = EA Let (EDT ∗ , ils ′ ) = EB. As EA ≤Atom
EB, we have EDS ≤D
NF
EDT . By IH, this means that RigidSynthInternal(EDS, EDT ) returns a DNF lens, dl, this means
that the match goes to the ﬁrst, returning iterate(dl), an atom lens.

Case 2 (seqs). Let ([s0 · EA1 · . . . · EAn · sn ], ils) = ESQ and ([t0 · EB 1 · . . . · EBm · tm ], ils ′ ) = ETQ.
exs ETQ and
Let σ1 = sorting([EA1 ; . . . ; EAn ],) Let σ2 = sorting([EB 1 ; . . . ; EBm ],) As ESQ ≤Seq
exs ESQ, we know n = m. By Lemma 138 σ = σ −1 ◦ σ is such that EA ≤ EB
ETQ ≤Seq
2
i
σ (i ) and
1
EB σ (i ) ≤ EAi .
By IH, this means that calling RigidSynthAtom(EAi , EB σ (i ) ) returns an atom lens, al i . As such,
AllSome on all these atom lens options returns a list of atom lenses. This then returns the sequence
lens ([(s0 , t0 ) · al 1 · . . . · al n · (sn , tn )], σ −1 ).
Case 3 (dnf regexps). Let (hESQ 1 | . . . | ESQ n i, ils) = EDS and (hETQ 1 | . . . | EBm i, ils ′ ) = ETQ.
exs
Let σ1 = sorting([ESQ 1; . . . ; ESQ n ],) Let σ2 = sorting([ETQ 1 ; . . . ; ETQm ],) As EDS ≤D
N F EDT
exs
−1
and ETQ ≤D N F EDS, we know n = m. By Lemma 138 σ = σ1 ◦ σ2 is such that EAi ≤ EB σ (i ) and
EB σ (i ) ≤ EAi .
By IH, this means that calling RigidSynthSeq(ESQ i , ETQ σ (i ) ) returns a sequence lens, sql i . As
such, AllSome on all these sequence lens options returns a list of sequence lenses. This then
returns the DNF lens (hsql 1 | . . . | sql n i, σ −1 ).

Lemma 145. Let DS and DT be DNF regexes. Let exs be a set of string pairs. If there exists a DNF
lens dl :̃ DS ⇔ DT such that exs ∈ [[dl]], then RigidSynth(DS, DT , exs) returns a DNF lens.
Proof. Let [(s1 , t1 ); . . . ; (sn , tn )] = exs.
Let EDS = EmbedExamples([([1], s1 ); . . . ; ([n], sn )], DS)
Let EDT = EmbedExamples([([1], t1 ); . . . ; ([n], tn )], DT )
We know that EmbedExamples doesn’t fail, as each si ∈ L(DS) and each ti ∈ L(DT ).
This means that [([1], s1 ); . . . ; ([n], sn )] ∈ DS
EDS and [([1], t1 ); . . . ; ([n], tn )] ∈ DT
EDT .
As dl :̃ DS ⇔ DT , we know that DS and DT are strongly unambiguous.
exs
exs
As such the conditions for Lemma 143 apply so EDS ≤D
N F EDT and EDT ≤D N F EDS.
By Lemma 144, that means that RigidSynthInternal(EDS, EDT ) returns a DNF lens, so then
so too does RigidSynth.

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

1:126 Anders Miltner, Kathleen Fisher, Benjamin C. Pierce, David Walker, and Steve Zdancewic
Lemma 146. Given DNF regular expressions DS and DT , and a set of examples exs, if there exists
a DNF lens dl such that dl : DS ⇔ DT and for all (s, t) in exs, (s, t) ∈ [[dl]], then
SynthDNFLens(DS, DT , exs) will return a DNF lens.
Proof. If dl : DS ⇔ DT , then there exist DNF regular expressions DS ′ and DT ′ such that
dl :̃ DS ′ ⇔ DT ′ , DS→DS ∗ DS ′ , and DT →DS ∗ DT ′.
However, we may not perform the same single rewrites as DS→DS ∗ DT , because we infer certain
expansions, which are then taken earlier. However, conﬂuence allows us to reorganize the order
of the expansions (though this may possibly increase the total number of expansions, and change
the ultimate DNF lens), as was done in the retype case of DNF completeness.
As such, we know that, there exist two DNF regular expressions DS ′′ and DT ′′ , and a DNF lens
′
dl such that DS→DS ∗ DS ′′ , DT →DS ∗ DT ′′ , dl ′ :̃ DS ′′ ⇔ DT ′′ , [[dl ′ ]] = [[dl]], and (DS ′′ , DT ′′ ) are
enumerated by the queue.
If there are any (DS ′′′ , DT ′′′ ) pairs enumerated before (DS ′′ , DT ′′ ) such that
RigidSynth(DS ′′′ , DT ′′′ ) returns a lens, then that lens is returned, and we are done.
If not, eventually (DS ′′ , DT ′′ ) are enumerated.
By Lemma 145, as dl ′ :̃ DS ′′ ⇔ DT ′′ , RigidSynth(DS ′′ , DT ′′ ) returns. This is then immediately
returned by SynthDNFLens.

Theorem 14. Given regular expressions S and T , and a set of examples exs, if there exists a lens
l such that l : S ⇔ T and for all (s, t) in exs, (s, t) ∈ [[l]], then SynthLens(S, T , exs) will return a
lens.
Proof. Let l : S ⇔ T . By Theorem 3, there exists a DNF lens dl :⇓S ⇔⇓T , such that [[dl]] = [[l]].
In particular, this means that exs ⊂ [[dl]]. This means, from Lemma 146, SynthDNFLens(⇓S, ⇓T )
returns a lens, dl ′′ . From Theorem 2, we can then convert using ⇑, to get a lens which we return. 
B.13

Additional Proofs

In the paper, some claims were made that aren’t necessarily the main theorems. In this area we
prove those claims.
Deﬁnition 34. Let → be a rewrite rule on regular expressions. We deﬁne →⇓ as the rewrite
relation on DNF regular expressions deﬁned by ⇓S →⇓ ⇓T if S → T .
l

Deﬁnition 35. We overload ⇐
⇒ to extend to regular expressions with rewriteless DNF lenses
l

after conversion to DNF form. In particular, S ⇐
⇒ T if there exists dl such that [[dl]] = [[l]] and
dl :̃ (⇓S) ⇔ (⇓T ).
l (→) implies conﬂuent l (→⇓ ).
⇐
⇒
⇐
⇒
Proof. Let dl :̃ DS ⇔ DT , with [[dl]] = [[l]]. Let DS →⇓ DS 1 and DT →⇓ DT 2 . This means that
there exists S, T , S2 , and T2 such that S → S2 , T → T2 , ⇓S = DS, ⇓T = DT , ⇓S2 = DS 2 , and ⇓T2 =
DT 2 . This means, as conﬂuent l (→), there exists S3 , T3 such that there exists dl 3 :̃ ⇓ S3 ⇔⇓ T3
⇐
⇒
where [[dl 3 ]] = [[dl]], S2 → S3 and T2 → T3 . This means that DS 2 →⇓ ⇓S3 , and DT 2 →⇓ ⇓S3 , and as
before there exists dl 3 :̃ ⇓S3 ⇔⇓T3 where [[dl 3 ]] = [[dl]]. As such, conﬂuent l (→⇓ ).

⇐
⇒
Lemma 148. conﬂuent l (→⇓ ) implies conﬂuent l (→).
⇐
⇒
⇐
⇒
Proof. Let dl :̃ ⇓ S ⇔⇓ T . Let S → S1 and T → T2 . This means that ⇓ S →⇓ ⇓ S2 and
⇓ T →⇓ ⇓ T2 . As conﬂuent l (→⇓ ), then there exists dl 3 , DS 3 and DT 3 such that ⇓ S2 →⇓ DS 3 ,
⇐
⇒

Lemma 147. conﬂuent

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

Synthesizing Bijective Lenses

1:127

⇓T2 →⇓ DT 3 , dl 3 :̃ DS 3 ⇔ DT 3 , and [[dl 3 ]] = [[dl]]. This means that DS 3 =⇓S3 , DT 3 =⇓T3 . As such,
dl 3 :̃ ⇓S3 ⇔⇓T3 , so conﬂuent l (→).

⇐
⇒
Lemma 149. If bisimilar l (→), then bisimilar l (→⇓ ).
⇐
⇒
⇐
⇒
Proof. Let dl :̃ DS ⇔ DT , with [[dl]] = [[l]]. Let DS →⇓ DS 2 . This means that there exists S and
S2 such that S → S2 , ⇓ S = DS, and ⇓ S2 = DS 2 . This means, as conﬂuent l (→), there exists T2
⇐
⇒
such that there exists dl 2 :̃ ⇓S2 ⇔⇓T2 where [[dl 2 ]] = [[dl]], and ⇑DT → T2 . Symmetrically for if
DT →⇓ DT 2 , so bisimilar l (→⇓ ).

⇐
⇒
Lemma 150. If bisimilar l (→⇓ ), then bisimilar l (→).
⇐
⇒
⇐
⇒
Proof. Let dl :̃ ⇓S ⇔⇓T , with [[dl]] = [[l]]. Let S → S2 . This means that ⇓S →⇓ ⇓S2 . This means
that, as bisimilar l (→⇓ ) there exists DT 2 , dl 2 such that ⇓T →⇓ DT 2 , and dl 2 :̃ ⇓S2 ⇔ DT 2 , and
⇐
⇒
[[dl 2 ]] = [[dl]]. As ⇓ T →⇓ DT 2 , we have DT 2 =⇓ T2 , where T → T2 . Symmetrically for if T → T2 ,
so bisimilar l (→).

⇐
⇒
Lemma 151. If → doesn’t introduce ambiguity, then neither does →⇓ .
Proof. Let DS →⇓ DT , where DS is strongly unambiguous. This means DS =⇓S and DT =⇓T ,
and S → T . As ⇓ S is strongly unambiguous iﬀ S is, S is strongly unambiguous. By assumption,
we now have T is strongly unambiguous, so then ⇓T also is.

Lemma 152. If →⇓ doesn’t introduce ambiguity, then neither does →.
Proof. Let S → T , where S is strongly unambiguous. This means ⇓ Reдex →⇓ ⇓ T . By assumption, that means ⇓ T is strongly unambiguous. As ⇓ T strongly unambiguous iﬀ T strongly
unambiguous, by assumption we have T is strongly unambiguous.

Lemma 153. →⇓ maintains the language if, and only if → does.
Proof. S → T . L(S) = L(⇓S). L(T ) = L(⇓T ). ⇓S = L(⇓T ). ⇓S →⇓ ⇓T . DS →⇓ DT .



Thus, we have conﬂuence, bisimilarity, unambiguity retention, language retention on rewrites
for regular expressions, iﬀ we also do for the DNF rewrites they induce. As such, because conﬂuence and bisimilarity, alongside not introducing ambiguity or changing the language, is suﬃcient
on DNF rewrites, then it is suﬃcient on rewrite rules for regular expressions as a suﬃcient condition is fulﬁlled.

, Vol. 1, No. 1, Article 1. Publication date: October 2017.

