PROCEEDINGS OF THE 1992

WORKSHOP ON

TYPES FOR PROOFS AND PROGRAMS

Båstad

June 1992

Eds Bengt Nordström, Kent Petersson and Gordon Plotkin

Contents

Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Workshop Programme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 List of Participants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Demonstrations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 P. Aczel: Schematic Consequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 P. Audebaud: CC^{+} : an extension of the Calculus of Constructions with fixpoints . . . . . 18 F. Barbanera: Continuations and Simple Types: a Strong Normalization Result (ab-

stract) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 S. Berardi: Game theory and Program extraction (abstract) . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 R. Burstall, James McKinna: Deliverables: a categorical approach to program devel-

opment in type theory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 T. Coquand: Pattern Matching with Dependent Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 C. Coquand: A proof of normalization for simply typed lambda calculus written in ALF 80 V. Danos, L. Regnier: Virtual reduction (abstract) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 J. Despeyroux, A. Hirschowitz: Natural Semantics in Coq. First experiments . . . . . . . 89 P. Dybjer: Universes and a General Notion of Simultaneous Inductive-Recursive Defini-

tion in Type Theory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 D. Fridlender: Formalizing Properties of Well-Quasi Ordered Sets in ALF . . . . . . . . . . . . . 115 V. Gaspes: Formal Proofs of Combinatorial Completeness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 V. Gaspes, J. M. Smith: Machine Checked Normalization Proofs for Typed Combinator

Calculi . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 H. Geuvers: Inductive and Coinductive types with Iteration and Recursion . . . . . . . . . . . . 183 L. Helmink: Girard’s Paradox in lambda U (abstract) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208 H. Herbelin: Computable interpretation of cross-cuts procedure (abstract) . . . . . . . . . . . . . 209 B. Jutting: Typing in Pure Type Systems (abstract). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210 J. Lipton: Relating Logic Programming and Propositions-as-Types: A Logical Compila-

tion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211 F. Leclerc, C. Paulin-Mohring: Programming with Streams in Coq. A case study :

the Sieve of Eratosthenes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231 Z. Luo: Compositional understanding of type theory (abstract) . . . . . . . . . . . . . . . . . . . . . . . . . 248 L. Magnusson: The new Implementation of ALF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 N. Mendler, P. Aczel: An implementation of Constructive Set Theory, in the Lego

system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267 M. Parigot: lambda mu-calculus: an algorithmic interpretation of classical natural de-

duction (abstract). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269 F. Pfenning: Teaching Theory of Programming Languages Using a Logical Framework:

an Experience Report (abstract). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270 R. Pollack: Typechecking in Pure Type Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271 D. Pym, G.Plotkin: A Relevant Analysis of Natural Deduction (abstract). . . . . . . . . . . . . 289 C. Raffalli: Fixed point and type systems (abstract) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290 P. Rudnicki: An Overview of the MIZAR Project . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291 A. K. Simpson: Kripke Semantics for a Logical Framework . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313 B. Werner: A Normalization Proof for an Impredicative Type System with Large Elimi-

nation over Integers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341

⋆⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆_{?}_{⋆} Types and ⋆⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆_{?}_{⋆} Programs

Foreword

This document is the preliminary proceedings of the 1992 Workshop on Types for Proofs and Programs held at Hotel Riviera in Båstad, Sweden, from the 8th to the 12th of June 1992. The workshop was organized by Peter Dybjer, Bengt Nordström, Kent Petersson and Jan Smith from Göteborg together with Rod Burstall and Claire Jones from Edinburgh. The workshop was attended by 55 people.

Local arrangements were looked after by Marie Larsson et al and Lennart Augustsson and Per Lundgren took care of the computer equipment.

These preliminary proceedings have been collected from LaTEX sources, using electronic mail and spliced together. They comprise 18 of the 31 papers presented at the meeting (11 abstracts are also included).

This document may be obtained by anonymous ftp from Chalmers University of Technol-

ogy (compressed file pub/baastad/proc.ps.Z on animal.cs.chalmers.se login name “anony-

mous” and your ordinary name as password).

Workshop Programme: Types for Proofs and Programs

Sunday, June 7th

8.00pm  Dinner

Monday, June 8th

9.00–10.00am  Per Martin-Löf

Does denotational semantics have any role to play in type theory?

10.00–10.30am Peter Aczel

A LEGO implementation of constructive set theory

10.30–11.15am Coffee Break
11.15–12.00am Zhaohui Luo

Compositional understanding of type theory

12.00–12.25pm Veronica Gaspes and Jan Smith

Machine checked normalization proofs for typed combinator calculi

12.25–12.50pm Veronica Gaspes

Formal proofs of combinatorial completeness

12.50–3.00pm  Lunch
3.00–3.45pm  Vincent Danos and Laurent Regnier

Virtual reduction

3.45–4.10pm  Christine Paulin-Mohring

Representation of specifications and programs involving streams in the Calculus of Inductive Constructions

4.10–4.35pm  Lena Magnusson

The new implementation of ALF

4.35–5.15pm  Coffee Break
5.15–6.00pm  Demo Session
8.00pm  Dinner

Tuesday, June 9th

9.00–9.45am  Thierry Coquand

Contexts, substitutions and pattern-matching

9.45–10.15am  Joelle Despeyroux

Natural semantics in Coq, first experiments

10.15–10.30am Piotr Rudnicki

Mizar

10.30–11.15am Coffee Break
11.15–11.40am Leen Helmink

Girard’s paradox in lambda-U

11.40–12.50pm DEMO SESSION
12.50–3.00pm  Lunch
3.00–3.45pm  Benjamin Werner

Strong normalization of lambda-calculi with types defined by recursion

3.45–4.30pm  James McKinna

Deliverables: an approach to program development

4.30–5.15pm  Coffee break
5.15–6.00pm  PANEL SESSION
6.00–7.30pm  Site leaders meeting
7.30pm  Dinner
9.00pm  Concert (in Båstad Church)

Wednesday, June 10th

9.00–9.45am  Michel Parigot

λμ-calculus: an algorithmic interpretation of classical natural deduction

9.45–10.30am  Hugo Herbelin

Computable interpretation of cross-cuts procedure

10.30–11.15am Coffee Break
11.15–12.00am Stefano Berardi

Game theory and program extraction

12.00–12.25pm Franco Barbanera

Continuations and simple types: A strong normalisation result

12.25–12.50pm Thomas Streicher

Truly intensional models for type theory arising from modified realizability

12.50–2.45pm  Lunch
2.45pm  FREE AFTERNOON

Bus leaves for walks (various distances) to Hovs hallar

7.00pm  Dinner in Torekov (bus from Hovs hallar at 6.00pm)

Thursday, June 11th

9.00–9.45am  Peter Aczel

Schematic consequence

9.45–10.30am  Randy Pollack

Type checking in Pure Type Systems

10.30–11.15am Coffee Break
11.15–12.00pm Bert Jutting

Typing in Pure Type Systems

12.00–12.45pm Alex Simpson

Kripke semantics for a logical framework

12.45–3.00pm  Lunch
3.00–3.25pm  Catarina Coquand

The proof of normalisation for simply typed lambda calculus written in ALF

3.25–3.50pm  Daniel Fridlender

Formalizing proofs of properties of well-quasi-orders

3.50–4.35pm  Frank Pfenning

Teaching theory of programming languages using a logical framework: an experience report

4.35–5.15pm  Coffee Break
5.15–6.00pm  Christophe Raffalli

Fixed point and type systems

8.00pm  Dinner

Friday, June 12th

9.00–10.00am  Jim Lipton

Logic programming and propositions as types: A realizability interpretation of declarative programs

10.00–10.30am David Pym and Gordon Plotkin

A relevant analysis of natural deduction

10.30–11.15am Coffee Break
11.15–12.00am Phillipe Audebaud

An extension of the calculus of constructions using fixpoints

12.00–12.45pm Peter Dybjer

Simultaneous inductive-recursive definitions in type theory

12.45–3.00pm  Lunch

List of Participants

INRIA, Rocquencourt

Samuel Boutin  boutin@margaux.inria.fr
Hugo Herbelin  herbelin@margaux.inria.fr
Gérard Huet  huet@margaux.inria.fr
Chet Murthy  murthy@margaux.inria.fr
Benjamin Werner  werner@margaux.inria.fr

Lyon

Catherine Parent  parent@lip.ens-lyon.fr
Christine Paulin  cpaulin@lip.ens-lyon.fr

Eindhoven

Leen Helmink  helmink@prl.philips.nl
Erik Poll  erik@win.tue.nl

Edinburgh/Oxford

Rod Burstall  rb@dcs.ed.ac.uk
Philippa Gardner  pag@dcs.ed.ac.uk
Claire Jones  ccmj@dcs.ed.ac.uk
Zhaohui Luo  zl@dcs.ed.ac.uk
Savi Maharaj  svm@dcs.ed.ac.uk
James McKinna  jhm@dcs.ed.ac.uk
Randy Pollack  rap@dcs.ed.ac.uk
David Pym  dpym@dcs.ed.ac.uk
Alex Simpson  als@dcs.ed.ac.uk

Manchester

Peter Aczel  petera@cs.man.ac.uk

Nijmegen

Henk Barendregt  henk@cs.kun.nl

Bert van Benthem Jutting

Mark Ruys  markr@cs.kun.nl

Paris 7

Vincent Danos  danos@logique.jussieu.fr
Jean-Louis Krivine  krivine@logique.jussieu.fr
Pascal Manoury  eleph@logique.jussieu.fr
Patrick Meche  meche@logique.jussieu.fr
Michel Parigot  parigot@logique.jussieu.fr
Christophe Raffalli  raffalli@logique.jussieu.fr
Laurent Regnier  regnier@logique.jussieu.fr
Marianne Simonot  simonot@logique.jussieu.fr

Sophia-Antipolis

Joëlle Despeyroux  jd@sophia.inria.fr

Torino

Stefano Berardi  stefano@di.unito.it
Franco Barbanera  barba@di.unito.it
Pietro Di Gianantonio  digianant@uduniv.cineca.it

Göteborg

Lennart Augustsson  augustss@cs.chalmers.se
Jan Cederqvist  ceder@cs.chalmers.se
Catarina Coquand  catarina@cs.chalmers.se
Thierry Coquand  coquand@cs.chalmers.se
Peter Dybjer  peterd@cs.chalmers.se
Veronica Gaspes  vero@cs.chalmers.se
Michael Hedberg  hedberg@cs.chalmers.se
Daniel Friedlender  frito@cs.chalmers.se
Lena Magnusson  lena@cs.chalmers.se
Bengt Nordström  bengt@cs.chalmers.se
Kent Petersson  kentp@cs.chalmers.se
Jan Smith  smith@cs.chalmers.se
Nora Szasz  nora@cs.chalmers.se
Alvaro Tasistro  tato@cs.chalmers.se

Others

Jean-Paul Audebaud  paudebau@lip.ens-lyon.fr
Eduardo Gimenez  gimenez@incouy.edu.uy
Jim Lipton  lipton@saul.cis.upenn.edu
Per Martin-Löf  Barnhusgatan 4, 111 23 Stockholm, Sweden
Frank Pfenning  Frank.Pfenning@cs.cmu.edu
Piotr Rudnicki  piotr@cs.ualberta.ca
Anne Salvesen  abs@ifi.uio.no
Thomas Streicher  streicher@informatik.uni-muenchen.de

Demonstrations

In the demo-sessions the following systems were shown:

• ALF-2 Lennart Augustsson and Thierry Coquand,
• Coq  Catherine Parent and Benjamin Werner,
• Elf  Frank Pfenning.
• Lego Randy Pollack.

Schematic Consequence^{∗}

Peter Aczel Manchester University

August 1992

Abstract

The aim of this note is first to set up some general theory for discussing different aspects of the notion of a logic and then to draw attention to the schematic aspects of logic and suggest a way of capturing this aspect without making any commitment to the kind of syntax a logic should have.

Introduction

Nowadays we are well aware that there are many different logics. There are computer systems which are meant to be used to implement many logics. But there is no generally accepted account of what a logic is. Perhaps this is as it should be. We need imprecision in our vocabulary to mirror the flexible imprecision of our thinking. There are a number of related phrases that seem to have a similar imprecision; e.g. formal system, language, axiom system, theory, deductive system, logical system, etc... These are sometimes given technical meanings, often without adequate consideration of the informal notions.

When a logic has been implemented in a computer system the logic has been represented in the logical framework that the computer system uses. The logical framework will involve a particular approach to syntax, which may differ from the approach to syntax taken when the logic was first presented. This means that in order to represent the logic, as first presented, in the framework a certain amount of coding may be needed and the question will arise whether the logic as first presented is indeed the logic that has been represented in the framework. To make this question precise it is necessary to have a notion of a logic that abstracts away from particular approaches to syntactic presentation.

So we want to have a formal abstract definition of the notion ”a logic”. It is probable that there is no single notion to be captured but rather several related notions hiding under the single phrase. Nevertheless it would seem to be very worthwhile to try to analyse the situation and come up with some technical definitions that can be used to capture the various facets of the notion(s) of a logic. Of course there has been previous work on this topic. An important ingredient in all recent work is the notion of a consequence relation. This is essentially due to Tarski who developed a fairly general theory of consequence operators and deductive systems in the 1920s. Dana Scott has more recently focused on the notion of a consequence relation.

∗This paper is incomplete and reports on work in progress. An earlier version was called The Notion of a Logic and was based on a talk given at the workshop on “Deductive Systems” at Oberwolfach in May 1991. My attention was drawn to the adjoint situations in the topic by a question after my talk. This work was partially supported by the Esprit Basic Research Action ‘Logical Frameworks’ and an SERC research Fellowship.

Another important development was Barwise’s abstract model theory ([Barwise 1974], which gave a model theoretic approach to a general class of logics, those based on classical first order semantic structures. A further stage of abstraction gives rise to Goguen and Burstall’s notion of an institution, ([Goguen and Burstall, 1990]). This level of abstraction seems to be needed to capture the variety of logics that seem to be of relevence in computer science and linguistics. The notion of an institution only focuses on the semantic aspect of logical consequence. Meseguer, in [Meseguer, 1989], has given a definition of a logic which uses an institution to capture the semantic aspect but also uses an entailment system to capture the operational aspect. An entailment system is roughly a system of consequence relations indexed by signatures. In Meseguer’s notion of a logic the consequence relations of the entailment system are required to be sound with respect to the semantic consequence relations of the institution. The notion of an entailment system has also been used in [Harper, Sannella and Tarlecki, 1990?], where they called it a logical system or logic.

At this point we should also mention the Edinburgh Logical Framework ([Harper, Honsell and Plotkin, 1987]) and other systems playing similar roles in connection with computer systems for implementing logics. These logical frameworks provide an environment in which the operational, non-semantic aspects of a logic can be specified, provided that a syntax for the logic is acceptable to the framework or can be made acceptable without essentially changing the logic. One approach to the notion of a logic might be to choose a logical framework and require that the operational part of a logic must have a representation in the logical framework.

What are the key issues in connection with the notion(s) of a logic? We list some of them.

1. Logic is concerned with what follows from what; i.e. with logical consequence.

2. Logic is generally applicable; i.e. a logic should have a range of possible applications so that if A follows logically from B in a logic then in every application (or interpretation or context) where A is true B is true.

3. Logic is schematic; e.g. the rule of modus ponens, that B follows logically from A and A → B, is not expressed in the language of any particular application of the logic, but in a language of schematic expressions involving parameters which can be instantiated in any application language.

In the next section below we give some definitions relevent to the first issue. We focus on finitary traditional consequence. More general notions are of interest. See for example [Avron, 1991]. But the more restricted and familiar notion of a consequence relation will be good enough for our present purposes. We also introduce several other notions which are relevent in connection with the formation of consequence relations either operationally from an axiomatic system or semantically from a semantic system. Both methods of formation can be seen to use the notion of a truth system. We also define a hybrid notion incorporating a semantic system with an axiomatic system that is sound.

We address the second issue above by indexing the above notions in section 3. Finally we address the third and less familiar issue in section 4. There is a good deal more to be said on these topics and we hope to produce an expanded version of this paper. In section 2 we make a slight detour from the main topic to consider the connections with Scott’s notion of an information system and domains.

1 Finitary Traditional Consequence

We describe five categories relevent to an abstract theory of finitary traditional consequence and study the relationships between them.

Axiomatic systems

An axiomatic system (A, Φ) consists of a set A and a set Φ ⊆ (finA) × A, where finA is the set of finite subsets of A. Axiomatic systems form a category AS. A map π : (A, Φ) → (A′, Φ′) of AS is a function π : A → A′ such that

(Γ, θ) ∈ Φ ⇒ (πΓ, πθ) ∈ Φ

where πΓ = {πγ | γ ∈ Γ} if Γ ∈ F inA.

We think of an axiomatic system as specifying a notion of proof whose inference steps have the form

\frac{γ_{1} ⋯ γ_{n}}{θ}

where ({γ_{1}, …, γ_{n}}, θ) ∈ Φ. Here of course γ_{1}, …, γ_{n} are the premises of the inference step and θ is the conclusion.

Consequence Relations

A consequence relation (A, ⊢) is an axiomatic system satisfying the following.

reflexivity : {θ} ⊢ θ
monotonicity : Γ ⊢ θ ⇒ Γ ∪ {φ} ⊢ θ
transitivity : Γ ⊢ φ and Γ ∪ {φ} ⊢ θ ⇒ Γ ⊢ θ

Consequence relations form a full subcategory CR of AS.

Proposition 1 The inclusion functor CR ↪ AS has a left adjoint AS → CR which associates with each axiomatic system (A, Φ) the consequence relation (A, ⊢_{Φ}) generated by (A, Φ); i.e. ⊢_{Φ} is the least relation including Φ such that (A, ⊢_{Φ}) is a consequence relation, or alternatively

Γ ⊢_{Φ} θ ⟺ θ is in the smallest Φ-closed set including Γ,

where X ⊆ A is Φ-closed if whenever (Γ, θ) ∈ Φ

Γ ⊆ X ⇒ θ ∈ X.

Truth Systems

A truth system (A, M) consists of a set A and a set M ⊆ powA, where powA is the set of all subsets of A. Truth systems form a category T S, where a map π : (A, M) → (A′, M′) of T S is a function π : A → A′ such that

X ∈ M′ ⇒ π^{−1}X ∈ M.

With each axiomatic system (A, Φ) we may associate the truth system (A, cl(Φ)) where cl(Φ) is the set of Φ-closed subsets of A.

Proposition 2 (A, Φ) ↦ (A, cl(Φ)) can be made into a functor AS → T S which factorises AS → CR → T S. Moreover CR → T S has a right adjoint T S → CR which associates with each truth system (A, M) the consequence relation (A, ⊧_{M}) where

Γ ⊧_{M} θ ⟺ (∀X ∈ M)[ Γ ⊆ X ⇒ θ ∈ X ].

Closure Systems

A closure system is a truth system (A, M) such that

1. ⋂ X ∈ M for all X ⊆ M (where we take ⋂ X = A when X = ∅),

2. ⋃ X ∈ M for all directed X ⊆ M.

Let CS be the full subcategory of T S whose objects are the closure systems.

Proposition 3 The adjoint functors CR → T S and T S → CR have factorisations CR → CS ↪ T S and T S → CS → CR which are also adjoints. Moreover the functors CR → CS and CS → CR are inverses of each other, so that CR ≅ CS.

Semantical Systems

A semantical system (A, Mod, ⊧) consists of a set A, a class Mod and a class relation ⊧ that is a subclass of Mod×A. Semantical systems form a category SS, where a map (π_{1}, π_{2}) : (A, Mod, ⊧ ) → (A′, Mod′, ⊧′) of SS consists of a function π_{1} : A → A′ and a function π_{2} : Mod′ → Mod such that for m′ ∈ Mod′, θ ∈ A

(π_{2}m′) ⊧ θ ⟺ m′ ⊧′ (π_{1}θ).

Each truth system (A, M) determines a semantical system (A, M, ∋_{M}) where m ∋_{M} θ ⟺ θ ∈ m ∈ M. This gives a functor T S → SS.

Proposition 4 The functor T S → SS has a right adjoint SS → T S which associates with each semantical system (A, Mod, ⊧) the truth system

(A, {th(m) | m ∈ Mod})

where, for each m ∈ Mod,

th(m) = {θ ∈ A | m ⊧ θ}.

Note that the composition SS → T S → CR gives a functor SS → CR that sends each semantical system (A, Mod, ⊧) to the consequence relation (A, |≡) where

Γ |≡ θ ⟺ (∀m ∈ Mod)[ (∀γ ∈ Γ)(m ⊧ γ) ⇒ m ⊧ θ ].

Axiomatic system with semantics

We now describe a hybrid notion. An axiomatic system with semantics (A, Φ, Mod, ⊧) consists of an axiomatic system (A, Φ) and a semantical system (A, Mod, ⊧) such that

soundness : Γ ⊢_{Φ} θ ⇒ Γ |≡ θ.

The axiomatic system with semantics is complete if the converse holds; i.e.

Γ |≡ θ ⇒ Γ ⊢_{Φ} θ.

Axiomatic systems with semantics form a category ASS in the obvious way.

Summary

We have defined the four categories AS, CR, T S, SS with functors

AS → CR ≅ CS ↪ T S → SS

which have right adjoints

AS ↩ CR ≅ CS ← T S ← SS.

There is also the hybrid category ASS with the obvious forgetfull functors ASS → AS and ASS → SS. All these categories and functors are “over the category of sets”; i.e. for each of these categories C there is a forgetful functor C → Sets and for each of the above functors C → C′ the diagram

C ⟶ C′
↘ ↙
Sets

commutes.

Lindenbaum Algebras

A more abstract algebraic treatment of traditional consequence will work with (meet) semilattices and the Lindenbaum algebra construction. Consider the following natural way to make a (meet) semilattice (A, ≤) into a consequence relation (A, ⊢_{≤}), where

C ⊢_{≤} a ⇔ ⋀ C ≤ a.

This gives rise to a functor from the category SL of semilattices to the category CR. We can characterise the Lindenbaum algebra construction as a left adjoint CR → SL to this functor that maps (A, ⊢) to (Q, ≤) where Q is a quotient of finA with respect to the equivalence relation ≡ given by

C_{1} ≡ C_{2} ⇔ for all a ∈ A C_{1} ⊢ a iff C_{2} ⊢ a

and ≤ is the partial ordering on Q given by

[C_{1}] ≤ [C_{2}] ⇔ C_{1} ⊢ a for all a ∈ C_{2}.

2 Consequence Relations and Scott’s Information Systems

This section is really a detour from the main topic. As in the previous section the categories and functors that we will consider are all “over the category of sets”.

There is an interesting relationship between the notion of a consequence relation and Scott’s notion of an information system, (see [Scott, 1982]). This gives rise to a relationship between closure systems and Scott domains. Essentially a Scott Information System can be viewed as a consequence relation (A, ⊢) and a consistency notion Con for it; i.e. Con ⊆ finA such that for all C ∈ finA, a ∈ A

1. C ∪ {a} ∈ Con ⇒ C ∈ Con,

2. C ⊬ a ⇒ C ∈ Con,

3. C ⊢ a and C ∈ Con ⇒ C ∪ {a} ∈ Con.

Given such a consistency notion we can call a ⊢-closed set X ⊆ A consistent if finX ⊆ Con. Then the set Cl(A, ⊢, Con) = {X ∈ cl(⊢) | X is consistent} of ‘elements’ of the information system form a Scott domain, when partially ordered by the subset relation. It is a standard fact that every Scott domain is isomorphic to one of these.

We call a truth system (A, M) a weak closure system if it satisfies the two conditions of a closure system, except that, in condition 1, ⋂ X ∈ M need only hold for non-empty X ⊆ M. So a closure system is simply a weak closure system (A, M) such that A ∈ M. We may form the category wCS which is the full subcategory of CS consisting of weak closure systems. Also let CRC be the category whose objects are triples (A, ⊢, Con) where (A, ⊢) is a consequence relation and Con is a consistency notion for it. The maps π : (A, ⊢, Con) → (A′, ⊢′, Con′) in this category are the maps π : (A, ⊢) → (A′, ⊢′) in CR such that for all X ∈ finA

πX ∈ Con′ ⇒ X ∈ Con.

Then we get an isomorphism

CRC ≅ wCS

given by mapping (A ⊢, Con) in CRC to (A, Cl(A, ⊢, Con)) in wCS. The inverse of this isomorphism maps (A, M) in wCS to (A, ⊢_{M}, Con_{M}) in CRC, where the map (A, M) ↦ (A, ⊢_{M}) is given by the functor wCS ↪ T S → CR and

Con_{M} = {C ∈ finA | C ⊆ X for some X ∈ M}.

Given a consequence relation (A ⊢), there are two extreme ways to form a consistency notion Con for it. The maximum consistency notion is given by Con = finA. The minimum consistency notion is given by

Con = Con(A, ⊢) = {X ∈ finA | X ⊬ a for some a ∈ A}.

Of course in some cases the two consistency notions may coincide so that the consequence relation has a unique consistency notion. But in familiar cases we expect the two notions to be distinct (e.g. in a logic with negation we might expect that {b, ¬b} ⊢ a for all a so that if X = {b, ¬b} then X is in finA, but not in Con(A, ⊢)). Can there be other consistency notions for a given consequence relation? I was initially surprised to observe that:

Proposition 5 For any consequence relation the two extreme consistency notions are the only possible ones.

To see why this is so let Con be a consistency notion for the consequence relation (A, ⊢) which is different from Con(A, ⊢). It follows that there is some C ∈ Con such that C ⊢ a for all a ∈ A. We want to show that any X ∈ finA is in Con. So let X = {a_{1}, …, a_{n}} ∈ finA. As C ⊢ a we get that C ∪ {a_{1}} ∈ Con. As C ⊢ a_{2} we get C ∪ {a_{1}} ⊢ a_{2} so that C ∪ {a_{1}, a_{2}} ∈ Con. Continuing in this way we eventually get that C ∪ X ∈ Con. As X ⊆ C ∪ X it follows that X ∈ Con.

The two ways to construct consistency notions give rise to functors in a natural way, though for the second way a little care is needed. In the first case we have the functor CR → CRC that maps (A, ⊢) to (A, ⊢, finA).

Proposition 6 The above functor CR → CRC is left adjoint to the forgetfull functor CRC → CR that maps (A, ⊢, Con) to (A, ⊢).

For the other consistency notion construction we need to restrict to surjective functions. Let CR′ be the subcategory of CR having the same objects as CR but having as maps only those maps of CR that are surjective as functions. Similarily we may define categories CRC′, CS′, etc . . .. The above functor CR → CRC can be restricted to give a functor CR′ → CRC′ which is still a left adjoint to the forgetful functor on CRC′. But we also have another functor CR′ → CRC′ that maps (A, ⊢) to (A, ⊢, Con(A, ⊢)). It is not possible to extend this to CR.

Proposition 7 The latter functor CR′ → CRC′ is right adjoint to the forgetful functor CRC′ → CR′.

So we get a sequence of three functors between CR′ and CRC′ where the first functor in each successive pair is left adjoint to the second.

\begin{aligned}CR′ & → & CRC′ & (A, ⊢) & ↦ & (A, ⊢, finA) \\ CRC′ & → & CR′ & (A, ⊢, Con) & ↦ & (A, ⊢) \\ CR′ & → & CRC′ & (A, ⊢, Con(A, ⊢)) & ↦ & (A, ⊢) \end{aligned}

The isomorphisms

CR ≅ CS and CRC ≅ wCS

induce isomorphisms

CR′ ≅ CS′ and CRC′ ≅ wCS′

and hence give rise to a corresponding sequence of functors between CS′ and wCS′.

\begin{aligned}CS′ & ↪ & wCS′ & (A, M) ↦ (A, M) \\ wCS′ & → & CS′ & (A, M) ↦ (A, M ∪ \{A\}) \\ CS′ & → & wCS′ & (A, M) ↦ (A, \overline{M}). \end{aligned}

where \overline{M} is M −\{A\} if this is a weak closure system and is M otherwise.

There is a close connection between the collections of weak closure systems and Scott domains. But it is too strong to assert that the category Scott of Scott domains and continuous maps is equivalent to the category wCS. We do get an equivalence if we restrict to categories of isomorphisms. To get a better result we can consider the contravariant functor wCS → Scott^{op} which, on objects, maps (A, M) to (A, ⊆_{M}), where ⊆_{M} is the subset relation on M, and, on maps, assigns to each π : (A, M) → (A′, M′) of wCS the inverse image continuous function π^{−1} : (M, ⊆_{M}) → (M′, ⊆_{M′}). This functor is an equivalence if Scott is modified so that only certain continuous functions are allowed as maps.

3 Indexed Consequence

One aspect of a logic is that there is a notion of signature, so that associated with each signature is a set of sentences that can be formed with the signature. So we postulate a category SIG over the category of sets, the functor SIG → Sets being the functor associating with each signature Σ of SIG the set sent(Σ) of sentences of Σ.

As an example first order logic could use the category SIG whose objects consist of sets of individual constant symbols and n-place function and predicate symbols for n > 0. The signature maps of SIG are functions from symbols to symbols that map individual constants to individual constants, n-place function symbols to n-place function symbols and n-place predicate symbols to n-place predicate symbols. Now sent(Σ) can be the set of first order sentences formed in the standard way using the symbols of Σ, logical symbols and individual variables.

Given SIG and SIG → Set we get SIG-indexed notions as functors from SIG over the category Set. For example a SIG-indexed consequence relation is a functor SIG → CR over Set. This is Meseguer’s notion of an entailment system and also the Harper, Sanella and Tarlecki notion of a logical system.

A version of the notion of an institution is a category SIG over Set together with a SIGindexed semantical system SIG → SS over Set.

Let CRS be the full subcategory of ASS consisting of (A, ⊢, Mod, ⊧) in ASS where (A, ⊢) is in CR. Now Meseguer’s notion of a logic is a category SIG over Set together with a SIGindexed consequence relation with semantics SIG → CRS over Set.

4 Schematic Consequence

We wish to capture the schematic aspects of logic. A logic is axiomatised by giving schematic axioms and rules of inference which can be instantiated to get inference steps. Instantiations may themselves be schematic so that we are interested in the notion of a derived rule of inference obtained by composing instances of the axioms and rules. (Note: We need only focus on rules, as an axiom is simply a rule with no premises.)

Substitution

We want a syntax free way of talking about instantiation. We are led to focus on substitution. We will assume that the substitutions on a set A are functions s : A → A that form a submonoid of (A^{A}, id_{A}, ∘). Here A^{A} is the set of all functions A → A, id_{A} : A → A is the identity function of A and if s, s′ : A → A then s ∘ s′ : A → A is their composition. If Sub is such a submonoid then we call (A, Sub) a concrete monoid. The instances of a ∈ A are the elements of A of the form sa for s ∈ Sub.

Concrete monoids form a category CM where a map (π_{1}, π_{2}) : (A, Sub) → (A′, Sub′) consists of a function π_{1} : A → A′ and a monoid homomorphism π_{2} : Sub → Sub′ such that for all a ∈ A, s ∈ Sub

π_{1}(sa) = (π_{2}s)(π_{1}a).

We can now give schematic versions of axiomatic systems, consequence relations etc.

Schematic Axiomatic Systems

A schematic axiomatic system (A, Sub, Φ) consists of a concrete monoid (A, Sub) and an axiomatic system (A, Φ). In an obvious way we get a category SAS of schematic axiomatic system.

Schematic Consequence Relations

A schematic consequence relation (A, Sub, ⊢) is a schematic axiomatic system such that (A, ⊢) is a consequence relation and for all s ∈ Sub

s : (A, ⊢) → (A, ⊢) in CR;

i.e.

Γ ⊢ θ ⇒ sΓ ⊢ sθ.

We can now let SCR be the full subcategory of SAS consisting of schematic consequence relations.

Proposition 8 The inclusion functor SCR ↪ SAS has a left adjoint SAS → SCR which associates with each schematic axiomatic system (A, Sub, Φ) the schematic consequence relation (A, Sub, ⊢_{Φ}) generated by (A, Sub, Φ); i.e. the least relation including Φ such that (A, Sub, ⊢_{Φ}) is a schematic consequence relation, or alternatively

Γ ⊢_{Φ} θ ⟺ θ is in the smallest SubΦ-closed set including Γ

where

SubΦ = {(sΓ, sθ) | s ∈ Sub and (Γ, θ) ∈ Φ}.

If Γ ⊢_{Φ} θ then (Γ, θ) is a derived rule of Φ (relative to (A, Sub)).

Schematic Truth Systems

A schematic truth system (A, Sub, M) consists of a concrete monoid (A, Sub) and a truth system (A, M) such that s : (A, M) → (A, M) in T S for all s ∈ Sub; i.e.

X ∈ M ⇒ s^{−1}X ∈ M

for all s ∈ Sub.

ST S is the category of schematic truth systems, with the obvious notion of map. With each schematic axiomatic system (A, Sub, Φ) we may associate the schematic truth system (A, Sub, cl(SubΦ)).

Proposition 9 (A, Sub, Φ) ↦ (A, Sub, cl(SubΦ)) can be made into a functor SAS → ST S which factorises SAS → SCR → ST S. Moreover SCR → ST S has a right adjoint ST S → SCR which associates with each schematic truth system (A, Sub, M) the consequence relation (A, Sub, ⊧_{M}) where ⊧_{M} is obtained from M as in T S → CR.

References

[Avron, 1991] Axiomatic Systems, Deduction and Implication, Tech. Report 203/91, Institute of Computer Sciences, Tel-Aviv University.

[Barwise, 1974] Axioms for Abstract Model Theory, Annals of Mathematical Logic, 7 (1974) 221-265.

[Goguen and Burstall, 1990] Institutions: Abstract Model Theory for Specification and Programming, Edinburgh LFCS Report 90-106.

[Harper, Sannella and Tarlecki, 1989] Structure and Representation in LF, A version appeared in the proceedings of the 4th LICS meeting, 1989.

[Harper, Honsell and Plotkin, 1987] A Framework for defining logics In Proc. LICS 87.

[Meseguer,1989] General Logics, Proc. Logic Colloquium ’87, edited by H.D. Ebbinghaus et al., North Holland, 1989.

[Scott, 1982] Domains for Denotational Semantics, in the proceedings of ICALP, Springer Lecture Notes in Computer Science 140 (1982).

CC^{+} : an extension of the Calculus of Constructions with fixpoints

Philippe Audebaud

LaBRI - Université Bordeaux I - FRANCE email : audebaud@labri.greco-prog.fr, paudebau@lip.ens-lyon.fr

August ‘92

Abstract We follow an original idea suggested by Constable and Smith [CoSm87, CoSm88] providing a way for reasoning about non terminating computations in a typed framework. This work has been initiated within NuPrl by Smith [Smi88]. However its adaptation to the Calculus of Constructions (CC) has showed to be easy. We get a conservative extension of CC, denoted CC^{+}, where strong normalisation for β-reductions is preserved. We recover the alternate “recursive” coding for integers (already) introduced in AF2 by Parigot [Par88, Par92] ; thus the computational behaviour for the codes of integers is improved. Moreover, as expected, all partial recursive functions are definable. The proposition asserting that every term satisfies the principle of induction remains with no proof but trivial ones. All these results easily generalize to all the usual data structures.

1 Motivations

The initial Curry-Howard isomorphism has been greatly extended in the past decade, leading to powerful type systems. The correspondance between logic and functional programming within a typed framework forces both proofs and programs to be identified with strong normalizing lambda-terms.

Even if we may content ourselves with such a strong result from a pure logical point of view, its seems clear enough that type systems miss the point as far as they are intended to be considered as development systems for correct programs. For instance, treatment of exceptions, unbounded loops or recursive definitions are widely used in all programming languages in current use.

So, connections between logic and programming need to be refined, maybe even beyond Curry-Howard correspondance. Griffin’s original paper [Gri90] emphasizes the interactions between continuations (in Scheme) and absurd reasoning. This is the starting point of studies undertaken, among other people, by Murthy [Mur90] and Krivine [Kri90a], leading to a somewhat different approach of the relation between the two domains.

From an other point of view, unbounded loops and recursives definitions seem to require the consideration of lambda-terms no longer normalisable. Starting from the the thesis that recursive structures can be coded by fixpoints, this paper is concerned with the study of an extension of a typed framework with a fixpoint constructor allowing us to examine more deeply how it should be possible to develop type systems where to reason with non terminating programs or other recusive program scheme. Our study, restrited to CC, actually develops in the same way as Parigot’s study of recusive integers in the AF2 framework, but independantly since originated by Constable and Smith papers and Paulin-Mohring’s thesis [PaMo89c]. Moreover, most of the work remains to be done in order to answer the question whether or not such a solution catch most of the spirit beyond “recusive” features in current use in functional programming languages.

This paper develops as follow : in a first part we give a short overview of different possible solutions for the introduction of partial terms and we describe how to make the last of these solution fit with the Calculus of Constructions. Then, the extension CC^{+} is presented and examined with its main metamathematical properties. The second part is devoted to the study of different internal codings for intergers in our framework ; there, computational and logical expressivity are the case in point.

2 Partial objects in a typed framework

From now on, we rely on the thesis that “recursive” structures can be coded through fixpoint constructs. Let T be any type system ; we assume at least the → constructor is available in T . The main property we should expect from a type system is its logical consistency : there exists at least one type inhabited by no term.

2.1 A first attempt

Let P be any type and 0 an empty type. A fixpoint constructor, say fix(), given a term f : P → P, provides a new term fix(f) : P. One step of computation obviously consists in an unfolding step

[βfix]  fix(f) ⟶ f(fix(f))

Now, observe that, we can always form λx.x : P → P ; hence fix(λx.x) : P. In particuliar, the type 0 can no longer remains a empty type. Consistency is lost.

2.2 A refinement

We may wonder whether it is possible to avoid this phenomenon by allowing such a new term to be formed only in case P is already an inhabited type. Although there is no general answer to such a question, this refinement fails, for example in the Intuitionnistic Type Theories (ITT). Per Martin-Löf observed that the base type N is now provided with a fixpoint for the successor function. But then the axiom ∀n n ≠ n + 1 is no longer valid.

2.3 A general solution

In [CoSm87, CoSm88], Constable and Smith suggested a simple and elegant solution which avoids the difficulties encountered. Moreover, it seems to fit with most of the type systems.

Starting from a type system T , we build an extension T′ where the same rules are allowed at the level of types and terms as well. However a new feature is now available. Each type P is associated a new bar type : \overline{P}. This type is intended to be the type of the computations over terms belonging to P ; these computations, when converging (having a value) denote terms from P. Thus the fundamental rule, from the authors’ point of view, is :

[bar]  a ∈ \overline{A} ⟺ (a↓⇒ a ∈ A)

where t↓ is an internal predicate asserting the convergence of t. Let us give some examples.

A → \overline{A} the type for partial functions over A.

\overline{A → A} the type for terms which, if they converge, are total functions.

\overline{\overline{A} → \overline{A}} which corresponds to the type of all partial functions over A in a lazy programming language.

These examples suggest that we can expect to work in a very expressive type theory, from the point of view of the degrees of partiality that can be expressed.

As expected, the introduction of fixpoints is now allowed over bar types only :

[fix]  If f ∈ \overline{A} → \overline{A} then fix(f) ∈ \overline{A}

Some examples are provided in [CoSm87, CoSm88] and in [Smi88] where a consequent study of this kind of extended type system is done in the NuPrl framework. We devote our attention to the adaptation of this idea to a somewhat different type system.

2.4 Adaptation to the Calculus of Constructions

Although the adaptation from NuPrl to CC followed a more sinuous way, it is possible to explain the translation shortly. We are about to work with terms for which termination can be guaranteed no longer. This is what we want at the level of programs. Nevertheless, up to now, logical proofs and programs are all identified with the same objects, the same typed terms in the system. But we do want to consider that a logical proof must be “complete” so as to say. So, from the logical point of view, strong normalisation is the property required.

It seems clear for us that logical proofs and programs can no longer be identified. The notion of “value” is different from the two points of view. It is actually the case that the introduction of bar types proceeds from this analysis, even if the justification has not be given this way by Constable and Smith. So we have to find the right way to split the system into two parts : the first being semantically taken as the logical system, and the second one as the programming language. Now we already know how to do the job. In [PaMo89c], Paulin-Mohring introduced a new constant Spec (Set elsewhere) in order to distinguish between terms with or without any informative contents. The explanation, given explicitly, was to separate proofs from programs. And such a trick does the job, since then, terms are unambigous correspondance with one of the two constants P rop and Spec (or Set). Hence, the solution follows the same idea : we introduce a new constant, named \overline{P rop}, in order to mark terms to be considered as partial terms. Here is for the construction of bar types in the Calculus of Constructions. Now, partial programs and partial schema are easily formed through a single new constructor, in the CC-like style.

At least, we can accept a logical proof as soon as there is a proof for its termination. This last point is taken into account through the predicate of convergence within NuPrl. However we consider that this predicate cannot be put in the system ; but rather belongs to a metalevel with respect to CC system. So this part will be dropped out from our extension.

3 Presentation of CC^{+} ; main results

Although we need only the new constant \overline{P rop}, the use of the additional symbol \overline{T ype} will ease presentation. However, \overline{T ype} and T ype can be confuse in any implementation of our extension.

3.1 Terms

The set of terms of CC^{+}, denoted Λ^{+}, is the least set of terms containing the constants P rop and \overline{P rop}, a denumerable set V of variables, and close for the following constructs :

application (M N)
abstraction [x : M]N
fixpoint ⟨x : M⟩N
product (x : M)N

where M, N ∈ Λ^{+} and x ∈ V.

3.2 Positive occurrences of a variable

The necessity of a restriction on the recusive schema is obvious, if we expect to keep the calculus as well behaved as possible. Otherwise, for instance, the proposition

Λ ≡ ⟨X : \overline{P rop}⟩(C : \overline{P rop})((X → X) → C) → C

will collect all pure lambda-terms !

Let M ∈ Λ^{+} and x ∈ V a fixed variable. The predicates P os_{X}(·) and Neg_{X}(·) are given a mutually recursive definition as follow :

• if X ∉ F V (M) then P os_{X}(M) and Neg_{X}(M) ;

• if M ≡ X then P os_{X}(M) ;

• if M ≡ (B A) or [y : A]B then

– P os_{X}(M) if X ∉ F V (A) and P os_{X}(B),

– Neg_{X}(M) if X ∉ F V (A) and Neg_{X}(B).

• if M ≡ (y : A)B then

– P os_{X}(M) if Neg_{X}(A) and P os_{X}(B),

– Neg_{X}(M) if P os_{X}(A) and Neg_{X}(B) ;

• if M ≡ ⟨y : A⟩B then

– P os_{X}(M) and Neg_{X}(M) if X ∉ F V (M).

The case for a fixpoint is justified plainly in the above lines.

3.3 Notions of reduction

Substitution is defined straightforwardly. There are two notions of reduction:

β ([x : M]N L) ⟶_{β} N[x/L]
βfix ⟨x : M⟩N ⟶_{βfix} ([x : M]N ⟨x : M⟩N)

where M, N, L ∈ Λ^{+} and x ∈ V. We let →_{+}^{∗} be the reflexive and transitive closure of + ≡ β∪βfix and =_{+} the congruence generated by it.

Our choice for βfix comes from the fact that if ω is a fixpoint for the function f then we do have ω = f(ω). Choosing βfix as ⟨x : M⟩N ⟶_{βfix} N[x/⟨x : M⟩N] would have hidden the fact that, in the Calculus of Constructions, all the fixpoints we may construct are actually fixpoints of functional terms. Moreover it would have led to a bad reduction behavior. For, dealing with fixpoint computations involves that we must take head reductions as meaningful.

Notice that the condition imposed to a fixpoint, for the positivity of a variable in this fixpoint, can be deduced from the cases for the application and the abstraction. This a strong condition but there is no way to fix a weaker one since we do not know anything on the properties of the calculus. Then, in order to prove good properties on the calculus, we need to fix a condition invariant under reduction, hence under βfix reduction in the present case.

Then, both reduction is substitutive and the reduction + is weakly confluent (weakly Church-Rosser).

3.4 Inference and equality rules

Figures 1 and 2 recall the rules valid in CC. The letter S stands for any constant P rop, T ype … and \overline{P rop}, \overline{T ype} as far as CC^{+} is concerned. Notice the shortcut \{ \} for any of the constructs [ ], ( ) or ⟨ ⟩.

The additional rules required in CC^{+}are given in figure 3.

3.5 Syntax of a well typed term

Any well-formed term M is of one of the following forms (modulo α-conversion):

M ≡ [\overrightarrow{x : P}](\overrightarrow{y : Q})(M′ \overrightarrow{R})

with

M′ ≡ \{ \begin{matrix}([z : T]M_{1} M_{2}) \\ ⟨z : T ⟩M_{1} \\ constant or variable \end{matrix}

Where \overrightarrow{x : M} is for x_{1} : M_{1} … x_{k} : M_{k}, k ≥ 0.

Moreover, if M is a well typed term, of type N say, then we shall say that M is total if either N ≡ T ype or N is of type T ype or P rop. Otherwise such a term is said to be partial. We denote CC_{tot}^{+} and CC_{par}^{+} the two sets of the partition of well typed terms in CC^{+}. It is easily checked that this definition does not depend on N, hence providing a new invariant for the (well typed) terms, as expected from the section 2.4.

empty  \overline{[] is valid}
var-intro  \frac{Δ ⊢ M ∈ K x ∈ V x ∉ Δ}{Δ, x : M is valid}
hypothesis  \frac{Δ ⊢ x ∈ V(Δ)}{Δ ⊢ x ∈ Δ(x)}
Prop-intro  \frac{Δ ⊢}{Δ ⊢ P rop ∈ T ype}
prod-intro  \frac{Δ, x : P ⊢ M ∈ S}{Δ ⊢ (x : P)M ∈ S}
abs-intro  \frac{Δ, x : P ⊢ M ∈ N}{Δ ⊢ [x : P]M ∈ (x : P)N}
appl  \frac{Δ ⊢ M ∈ (x : P)N Δ ⊢ R ∈ Q Δ ⊢ P = Q}{Δ ⊢ (M R) ∈ N[x/R]}
type-conv  \frac{Δ ⊢ M ∈ N Δ ⊢ N = N′}{Δ ⊢ M ∈ N′}

Figure 1: Rules of inference for CC

refl  \frac{Δ ⊢ M ∈ P}{Δ ⊢ M = M}
sym  \frac{Δ ⊢ M = N}{Δ ⊢ N = M}
trans  \frac{Δ ⊢ M = N Δ ⊢ N = P}{Δ ⊢ M = P}
cons  \frac{Δ ⊢ P = Q Δ, x : P ⊢ M = N}{Δ ⊢ \{x : P \}M = \{x : Q\}N}
eqapp  \frac{Δ ⊢ (M N) ∈ P Δ ⊢ M = M′ Δ ⊢ N = N′}{Δ ⊢ (M N) = (M′ N′)}
β  \frac{Δ, x : P ⊢ M ∈ N Δ ⊢ R ∈ P′ Δ ⊢ P = P′}{Δ ⊢ ([x : P]M R) = M[x/R]}

Figure 2: Equality rules for CC

\overline{Prop}-intro  \frac{Δ ⊢}{Δ ⊢ \overline{P rop} ∈ \overline{T ype}}

fix-intro-\overline{P rop}  \frac{Δ ⊢ P ∈ \overline{P rop} Δ, x : P ⊢ M ∈ Q Δ ⊢ P = Q}{Δ ⊢ ⟨x : P ⟩M ∈ P}

fix-intro-\overline{T ype}  \frac{Δ ⊢ P ∈ \overline{T ype} Δ, x : P ⊢ M ∈ P such thatsuch that P os_{x}(M)}{Δ ⊢ ⟨x : P ⟩M ∈ P}

β-fix  \frac{Δ, x : P ⊢ M ∈ P}{Δ ⊢ ⟨x : P ⟩M = ([x : P]M ⟨x : P ⟩M)}

Figure 3: Additional rules of inference and equality for CC^{+}

3.6 Main results

conservativity CC^{+} is a conservative extension of CC, hence is consistent. (Hint : there is an obvious extraction function from CC_{tot}^{+} to CC.)

uniform properties The following properties are true over the set of well typed terms :

• Confluence for the reduction + = β ∪ βfix ;

• Strong normalisation for β reduction ;

• Finiteness of developments and standardisation theorems.

For hints see [Aud91] ; for a complete treatment see [Aud92, Aud93].

3.7 Terms “almost in normal form”

The set of normal forms (NF) is too much restrictive since, for example, the term [x : P]x where P ≡ ⟨X : \overline{P rop}⟩(C : \overline{P rop})(X → C) → C, or any other fixpoint, would be excluded otherwise. However, the type information provided by the “abstraction” parts of a term has no computational meaning ; it is dropped down in the pure lambda-term obtained through the erasure function.

Then we can define a weaker notion of normal form, well suited with an environment of partial terms. The set ANF of terms almost in normal form is defined as the least class of well-formed terms containing the constants P rop and \overline{P rop}, the set V of variables and closed by

M ANF ⇒ [x : P]M ANF

M ANF ⇒ (x : P)M ANF
N_{1} ⋯ N_{k} ANF ⇒ (x N_{1} ⋯ N_{k}) ANF

Where P ∈ Λ^{+} being any type and x is any constant or variable.

We get the obvious facts :

• any propositional type is an ANF ;

• NF ⊆ ANF ⊆ HNF.

The terms ANF will play the same rôle as NF terms in CC, say, as will now be seen through the different codings for integers in the extension CC^{+}.

4 Internal codings for integers

This part is devoted to the question how both computational and logical expressivity are possibly improved in CC^{+}. The main originality of this extension is the ability to give an alternate coding for integers. A complete treatment is already given in [Aud91, Aud92] for CC^{+}, and in [Par88, Par92] for AF2. So we would rather like giving a somewhat informal presentation for to major codings : integers as iterators and as selectors. We emphasize our presentation does not claim to be rigorous. However, we expect this approach to show how the computational behavior of (codes of) integers uniquely depends upon a more or less immediate proof of mathematical equality.

4.1 Primitive recursion over integers

Given a ∈ A and h ∈ N × A → A, the primitive recursion schema says there exists a (unique) solution g ∈ N → A such that :

g(0) = a and ∀n ∈ N g(n + 1) = h(n, g(n))

Informally :

[figure: a; 1; 0; ⟨f, g⟩; N × A; N × A; ⟨π_{1} ∘ s, h⟩; N; N; s; ⟨f, g⟩]

As a consequence, f : N → N must satisfy :

f(0) = 0 and f ∘ s = s ∘ f

Thus, in any cartesian closed category with N as a natural number object (nno), we can conclude f = id_{N}. It works since N is precisely an initial object 1 →^{0} N →^{s} N in the category of diagrams 1 →^{x} C →^{f} C.

4.2 Integers as iterators

In CC (in system F already), integers are internally coded in such a way we collect Church’s integers as normal forms through the proposition :

Nat^{i} ≡ (C : P rop)C → (C → C) → C ∈ P rop

Thus this representation mimics as well as possible the position of Nat^{i} as nno in the type system. Let 0^{i} and S^{i} be the closed terms which code zero and the successor function. Then the “regular integers” are coded through the set {((S^{i})^{k} 0^{i})k ∈ N}. The induction principle is :

Ind^{i} ≡ [n : Nat^{i}](P : Nat^{i} → P rop)(P 0^{i}) → ((n : Nat^{i})(P n) → (P (S^{i} n))) → (P n)

This principle expresses that any property is true for an integer, as soon as it is true on the set of codes of regular integers.

Two major problems are carried out by such a representation :

• No proof exists for (n : Nat^{i})(Ind^{i} n). As noticed in [PaMo89a, PaMo89c], we need the fact that (n Nat^{i} 0^{i} S^{i}) equals n. But this property means precisely that every n : Nat^{i} is actually the code for a regular integer. n being a variable, this is obviously impossible to know. However this equality holds for closed terms, at the meta level. Here is for the structural point of view, as far as logical expressivity is concerned.

• Now, let us have a look at the computational expressivity. A solution to primitive recursion schema is provided in CC, through the recursor term rec^{i}, by

g ≡ [n : Nat^{i}](rec^{i} n A a h)

Nevertheless the equality f = id_{Nat}^{i} can only be proved for regular integers, that is to say terms satisfying the induction principle. We need the same property : “n is zero or the successor of another term”, but at the level of programs now ; this is a non dependent version for the former problem (see [PaMo89c, section 4.4.1]). So let us considerer we are dealing with those well built integers. We want to consider the simplest of all primitive recursion schema

p(0) = 0  and  p(n + 1) = n

giving the predecessor function. From the computational point of view, we get the following diagram

[figure: ⟨f(n), p(n)⟩; ⟨f(n + 1), n⟩; n; n + 1]

Hence computation of p(n + 1) forces that of f ∘ s(n), so the computation of s ∘ f(n) too. Eventually, the effective computation of that term will have force that of s ∘ f(n), …, s^{n} ∘ f(0), even though we already know the result will be n. Thus this computation takes a number of β-réductions in ◯(n). This simple example makes it apparent the evaluation mecanism linked to the very nature of Church’s integers : there are iterators. And, at the level of programs, their imperfection lies in that character.

How far is it possible to improve these two points ? In [CoPa89] Coquand and Paulin-Mohring gave a solution through an extension of CC with inductive types. We restrict our attention to CC^{+}.

4.3 Integers as selectors

In a cartesian closed category, any nno N satisfies another diagram :

[figure: C; x; 1; N; 0; [x, f]; N; N; s; f]

Let us consider the predecessor function. We note that C ≡ N, f ≡ id_{N} and x ≡ 0. Then we get :

[id, 0](0) = 0 and [id, 0](n + 1) = n

Clearly, [id, 0] is the predecessor function over N. Moreover its computation is now immediate.

Although Nat^{i} satisfies this kind of diagram too, at least as far as we restrict ourselves to the set of well built terms. But then we get rather the existence of two terms such that : Nat^{i} ⇌_{in}^{out} (C : P rop)C → (Nat^{i} → C) → C with in ∘ out = id and out ∘ in = id.

Now, through fixpoint construction, we are able to define Nat^{r} such that

Nat^{r} = (C : P rop)C → (Nat^{r} → C) → C

It suffices to define

Nat^{r} ≡ ⟨N : \overline{P rop}⟩(C : \overline{P rop})C → (N → C) → C

Notice that we must work over \overline{P rop}. Then we get

0^{r} ≡ [C : \overline{P rop}][x : C][f : Nat^{r} → C]x
S^{r} ≡ [n : Nat^{r}][C : \overline{P rop}][x : C][f : Nat^{r} → C](f n)
P^{r} ≡ [n : Nat^{r}](n Nat^{r} 0 id_{Nat}^{r})

where P^{r} is the predecessor function.

More generally, a solution to any primitive recursion schema is easily found using fixpoint at the level of programs :

g = [n : Nat^{r}](n A a [p : Nat^{r}](h p (g p)))

This point clearly shows that introduction of fixpoints is a good way to improve the computational behaviour of integers. Moreover fixpoints provide more programs, that is more realizations for specifications of programs ; indeed we are not forced to give a solution g as a fixpoint. Nevertheless they are required in order to give a solution for μ-recursion schema : given f : N → N, find the least integer n such that f(n) = 0. If we did not know there is such an integer, no solution exists in CC, since any computation terminates. In CC^{+} the solution is obvious : take g(0) where

g(k) = (f(k) Nat k [p : Nat]g(p + 1))

in a informal syntax.

Main results

Let us the give here the main results about the “recursive” solution Nat^{r}. In the following lines, \underline{n} is for the code of the nth integer.

• ∀n ∈ N (P^{r} (S^{r} n)) →^{∗} n (in a fixed number of step indeed) ;

• The set of closed anf terms of type Nat^{r} is the set \{\underline{n} | n ∈ N\} ;

• All partial recursive functions over integers are definable in CC^{+}. (Hint : the proof follows the same lines as Barendregt’s in ??)

Logical expressivity

There remains the question whether or not CC^{+} provides an improvement at the structural level. We pointed out Nat^{i} behaves as well as a nno provided it is restricted to the subset of well built terms. Since then Nat^{i} satisfies the second diagram, there must exist a correspondance between Nat^{i} and Nat^{r}. And it is actually the case through the terms :

i ≡ [n : Nat^{i}](n Nat^{r} 0^{r} S^{r})
∈ Nat^{i} → Nat^{r}
r ≡ [n : Nat^{r}](n Nat^{i} 0^{i} [p : Nat^{r}](S^{i} (r p)))
∈ Nat^{r} → Nat^{i}

Precisely, these two terms give a one-to-one correspondance between codes of regular integers in both of the types. But the fact Nat^{i} satisfies the same diagram as Nat^{r} says more. If it were to exist a proof for (n : Nat^{r})(Ind^{r} n) then, inevitably, (n : Nat^{i})(Ind^{i} n) would be provable too. The converse is true of course. And indeed we can prove :

(i) (n : Nat^{i})(Ind^{i} n) → (Ind^{r} (i n))

(ii) (n : Nat^{r})(Ind^{r} n) → (Ind^{i} (r n))

(iii) (n : Nat^{i})(Ind^{i} n) → n = (r ∘ i n)

(iv) (n : Nat^{r})(Ind^{r} n) → n = (i ∘ r n)

Of course, the very reason why it works is easy to understand. The induction principle, when satisfied, fills the gap between the subset of regular integers and all integers.

We are allowed to conclude the study of integers we took as an example, shows that our extension cannot be expected to improve the logical expressivity of the Calculus of Constructions.

5 Further developments

The study briefly undertaken in the case of the integers through various internal codings can be followed in its main lines as far as we restrict ourselves to the usual data structures such that lists or trees. Actually, close connections have been established between “simple (concrete) types” as described in [PaMo89c] and their recusive counterpart in CC^{+} : see [Aud92]. Such an equivalence emphasizes the main result that introduction of fixpoints, the way it is done in CC^{+} at least, does not improve the logical power of CC but rather gives the user the ability of realizing more programs and more specificationss.

The better that kind of “limitation” is understood, the more we are able to simplify, to relax the rules previously given for the introduction of fixpoints. For example, Ch. Paulin-Mohring suggests to allow fixpoints within P rop (hence dropping out \overline{P rop}) and, at the same time, to remove fixpoints at the level of proofs. This idea, and other variations, clearly deserve further attention.

As a matter of temporary conclusion let us focus the attention on a major theme, from our own point of view. Where mathematical reasoning usually contents itself with equalities, programming practice, thus usage of proof development systems as well, is mostly concerned with the way mathematical objects are computed. This dynamic point of view seems to belong to the core of this domain of research, if to be considered really as a science. Hence, we think that this difficulty should not be avoided. To give just one concrete example, fixpoints are allowed in CC^{+} exactly where syntactic transformations already exist in CC. We got the feeling, a posteriori, that no fixpoint over schema would have been even conceivable otherwise. And, in that case, working with recursive schema means forcing the corresponding transformation to be taken as the identity function (cœrcion) ; at least this is true as far as we restrict ourselves to the set of “well built” terms within a simple type : see [PaMo89c].

References

[Aud91] Audebaud P. (1991) Partial Objects in the Calculus of Constructions. In 6nd Conf. on Logic in Comp. Science. IEEE, 1991. Available through anonymous ftp to geocub.greco-prog.fr in /pub/Papers/Audebaud repertory.

[Aud92] Audebaud P. (1992) Extension du Calcul des Constructions par points fixes. Thèse, Université Bordeaux I, 1992. Available through anonymous ftp to geocub.grecoprog.fr in /pub/Papers/Audebaud repertory.

[Aud93] Audebaud P. (1993) Uniform properties in the Calculus of Constructions. submitted to TLCA‘93.

[Bar84] Barendregt H.P. (1984) The Lambda-calculus: its syntax and semantics. 2nd ed. Norh-Holland. Amsterdam.

[CoPa89] Th. Coquand and C. Paulin-Mohring. Inductively defined types. In P. Martin-Löf and G. Mints, editors, Proceedings of Colog’88. LNCS 417, Springer Verlag 1990.

[CoSm87] Constable R.L. and Smith S.F. (1987) Partial objects in constructive type theory. In 2nd Conf. on Logic in Comp. Science. IEEE, 1987.

[CoSm88] Constable R.L. and Smith S.F. (1988) Computational foundations of basic recursive function theory. In 3nd Conf. on Logic in Comp. Science. IEEE, 1988.

[CoMe85] Constable R.L. and Mendler N.P. (1985) Recursive definitions in Type Theory. In Logics of Programs. Parikh R. editor. LNCS 193, Springer Verlag, 1985.

[Gri90] Griffin T. 1990. A formulæ-as-types notion of control. In Conference Record of the Seventeenth Annual ACM Synposium on Principles of Programming Languages, 1990.

[Kri90a] Krivine J.-L. 1990. Opérateurs de Mise en Mémoire et Traduction de Gödel. Rapport technique de l’Equipe de Logique. Université Paris VII. Janv. 1990.

[Kri90b] Krivine J.-L. 1990. Lambda-calcul, évaluation paresseuse et mise en mémoire. A paraître dans Informatique Théorique et Applications, RAIRO.

[Luo90] Luo Z. (1990) ECC, an Extended Calculus of Constructions. In Information and Computation.

[Mend87] Mendler N. (1987) Recursive Types and type Constraints in Second-Order Lambda Calculus. In 2nd Conf. on Logic in Comp. Science. IEEE, 1987.

[Mur90] Murthy C. 1990. Extracting Constructive Content from Classical Proofs. Ph.D. Cornell University, 1990.

[Par88] Parigot M. (1988) Programming with proofs: a second order type theory. Proceedings of ESOP ‘88 (ed. H. Ganziger) Lectures Notes in Comp. Science 300. Springer Verlag. Berlin.

[Par92] Parigot M. 1992. Recursive Programming with Proofs. Theoretical Computer Science 94 (1992) p.335-356.

[PaMo89a] Paulin-Mohring Ch. (1989) Extracting F ω programs from proofs in the Calculus of Constructions. In Proceedings of 16th ACM Symposium on Principles of Programming Languages. ACM, New-York.

[PaMo89b] Paulin-Mohring Ch. (1989) Inductive definitions in the Calculus of Constructions. (draft) In The Calculus of Constructions Rapport technique INRIA 110.

[PaMo89c] Paulin-Mohring Ch. (1989) Extraction de programmes dans le Calcul des Constructions. Thèse Paris 7, 1989.

[Smi88] Smith S.F. (1988) Partial Objects in Type Theory. Ph.D. Dissertation. Cornell University.

Continuations and Simple Types: a Strong Normalization Result

Franco Barbanera Torino

Abstract

We present a work in which we study the termination problem for a typed lambdacalculus with continuations. We do not bound ourselves to study a particular reduction strategy, like call-by-value or call-by-name. Reductions may be applied to any part of any term in any order. Our main result is that every reduction sequence in the system terminates.

Game theory and Program extraction.

Stefano Berardi Torino

Abstract

We interpret each classical formula P as a game G(P) between two players (A and B). Player A is committed to show that P is true and player B that P is false. We interpret a proof as a recursive winning strategy for G(P). This work is inspired by Coquand’s last work, differing from it in three aspects :

– we interpret linear logic first

– we use perfect information games

– we prove cut elimination in a purely intuitionistic way.

Deliverables: a categorical approach to program development in type theory

Rod Burstall and James McKinna^{∗} Laboratory for the Foundations of Computer Science University of Edinburgh^{†}

August 11, 1992

1 Introduction

This paper outlines a method for constructing a program together with a proof of its correctness with respect to a given specification. The technology used is type theory, in fact an extended version of Calculus of Constructions Luo’s ECC [22] as implemented in Pollack’s ‘Lego’ system [24]; here program means a primitive recursive description of a function using simply typed lambda calculus with higher order functions and data types such as numbers and lists.

Given a precondition and a postcondition we consider pairs consisting of

• a program

• a proof that the program satisfies the postcondition given the precondition.

We call such a pair together with the pre- and postconditions a deliverable, since it is what a software house should ideally deliver to its client instead of just a program.

Now we observe that various operations, composition, pairing, iteration and so on, can be used to combine deliverables, and that these operations can be implemented in ECC. Consider for example composition. If (f, p) is a deliverable from pre to post and (f′, p′) is a deliverable from post to post′ then their composition is a deliverable from pre to post′ thus

• f ∘ f′, the composition of the functions

• a proof using p and p′ that f ∘ f′ satisfies post′ given pre.

In fact the combining operations (excluding iteration) are exactly those of a cartesian closed category whose objects are the pre- and postconditions and whose arrows are deliverables. This is comforting since it assures us that we have a complete set of combinators. They enable us to build a complicated program together with its correctness proof. Since the resulting expression of the calculus denotes a pair we can extract the program trivially by evaluating the first element of the pair.

∗The authors are gratefully for the support of the EC Logical Frameworks BRA and the SERC

†J.C.M.B., King’s Buildings, Mayfield Rd., Edinburgh EH9 3JZ, UK;

e-mail rb@dcs.ed.ac.uk, jhm@dcs.ed.ac.uk

We have used the Lego system to define these combinators and use them to create the deliverables for several programs as examples.

However in many cases a precondition and a postcondition do not satisfactorily specify a desired program. For example when developing a sorting program the precondition might ask for an arbitrary list and the postcondition demand that the result be a sorted list. But we would get little thanks for a program which always returned the nil list, even though this is sorted. We need to specify that the output list should also be a permutation of the input one.

If we try to replace the pre- and postconditions by a single statement specifying a relation between input and output there do not seem to be convenient combination operators; so we discard that approach. Thinking syntactically, we could allow the pre- and postconditions to share a free variable. For example using a free variable l for lists

pre(x) = x = l
post(y) = isP ermutation(y, l)

This ties the pre- and postconditions together, but such free variables should have a definite scope.

We can think, more semantically, that l satisfies some base condition (it must be a list) and the pre- and post conditions are relations whose first argument is l. Thus we can talk of preand post conditions relative to l. Now a deliverable relative to l is a program which takes the precondition to the postcondition for all l. We will refer to these as second order specifications and deliverables in contrast to the original first order ones.

How should we represent specifications and deliverables in type theory? We choose the following.

A first order specification is a predicate over a type thus

• a type, s

• a function, S, from s to P rop (the type of propositions)

and a first order deliverable from specification (s, S) to specification (t, T) is a program with proof thus

• a function , f : s → t

• a proof, ϕ : ∀x : s.Sx → T (fx) where ∀ is the ∏ quantifier on propositions.

Now we can generalise these to work relative to a first order specification (u, U), which corresponds to the free variable l in our example. Call u the base type; now the second order specification becomes a relation over the base type and another type, and the second order deliverable must respect the pre- and postrelations. We leave the details to the body of the paper.

We might try to characterise the first order deliverables as a cartesian closed category whose objects are specifications and whose arrows are deliverables; this is almost correct, but we have to modify the CCC to a semi-cartesian closed category, a mild generalisation due to Hayashi [12]. The second order deliverables are then characterised using a fibration whose fibres are categories of first order deliverables. In fact this structure constitutes a model of type theory.

The paper includes some illustrative examples of program development using deliverables and brief mention of others, of which the most substantial is an algorithm for the Chinese Remainder theorem.

We also discuss the relation to earlier work on extracting programs from proofs, particularly the work of Martin-Löf as developed by Nördström, Petersson and Smith [29]. They define a translation from a type theory, say S, to an underlying type theory U such that the types in S correspond to our specifications and the unary terms in S correspond to our deliverables. A somewhat similar approach is taken by Paulin-Mohring [30] in her program extraction using the realisability interpretation.

The virtue of our method is that it can quite easily be coded up in an existing system, and there is no difficulty about extracting the program from the proof, since they are built together but as separate components of a pair; normalising the first component gives us the program. We have mentioned operations for combining deliverables, and this might suggest a bottom-up approach; but we can just as well start with a specification of the desired program and derive the corresponding deliverable top-down by refinement in Lego.

The weakness of our method is that we have to use a combinatory notation which is less perspicuous than the usual λ notation of type theory. Since deliverables form a model of type theory, this might possibly be rectified by extending ECC with an extra kind whose types would be specifications and whose terms would be deliverables, thus following the insight of Martin-Löf; but we have not yet worked out this approach.

The basic approach was proposed in an unpublished talk by Burstall at the Båstad Workshop on type theory in 1988. A brief account by the present authors appeared as [4], and a full treatment of work so far is in McKinna’s thesis [25].

2 Review of ECC and a simple example

Luo’s Extended Calculus of Constructions, ECC, [21, 22] is a rich type theory containing Coquand and Huet’s Calculus of Constructions [6, 7] as a subsystem, together with strong Σ-types and a cumulative hierarchy of predicative universes, much as in the systems considered by Martin-Löf and his collaborators [26, 27, 29]. In Martin-Löf systems, all types may be read as propositions, and in Coquand and Huet’s original system, all propositions may be read as types. ECC avoids this blurring of distinctions, giving us access to full intuitionistic higher-order logic at a propositional level, together with a predicative environment for computation and abstract mathematics. It is precisely this ability to distinguish propositional from computational information within a single framework which underlies our approach to program development.

ECC is built out of a calculus of terms with the following official syntax

T ::= κ | V |
ΠV:T.T | λV:T.T | T T |
ΣV:T.T | pair_{T} (T, T) | π_{1}(T) | π_{2}(T)

where V ranges over some infinite collection of variables, and κ ranges over Prop and Type_{i} (i ∈ ω), the so-called kinds of ECC. Prop is an impredicative universe, as in Coquand and Huet’s original systems [6], intended to contain propositions, while the Type_{i} are predicative universes much like a set-theoretic hierarchy (and very similar to the U_{i} of some versions of Martin-Löf’s theories [29, 27]). Substitution for free occurrences of variables is defined in the usual way. Terms are identified up to renaming of bound variables. The basic conversion relation ≃_{β} is defined on all terms, and as usual is the congruence closure of the familiar reductions:

(β) (λx:A.M)N ⊳ M[N/x], and

{V:T}T corresponds to  Πx: T. T,
[V:T]T  to  λx:T. T,
<V:T>T  to  ΣV:T.T,
(T,T)  to  pair_{Σx:A.B}(T, T),
T.1  to  π_{1}(T),
and T.2  to  π_{2}(T).

Table 1: Comparison between syntax of LEGO and ECC

(σ) π_{i}(pair_{T} (M_{1}, M_{2})) ⊳ M_{i}(i = 1, 2).

LEGO is Pollack’s implementation of a typechecker and refinement proof system for ECC and a number of related systems, based on earlier ideas of Huet, de Bruijn and others [3, 6].

The LEGO syntax for terms in the language of ECC is given by

T ::= Prop | Type(i) (i ∈ ω) | V
     {V:T}T | [V:T]T | TT |

     <V:T>T | (T,T) | T.1 | T.2

where the correspondence with the official syntax is given in Table 1. As usual, the nondependent Π-types is denoted by an infix →.

The syntax has recently been extended to provide arbitrary extensions to the conversion relation. As an example, we may add a type of natural numbers, by declaring appropriate constants in an initial context

Γ_{nat} = nat:Type_{0}, 0:nat, S:nat → nat,

natrecd^{1}:ΠC:nat → Type. (C0) → (Πk:nat. (Ck) → (C(Sk))) → Πn:nat. Cn

together with reductions

natrecd C z s 0 ⊳ z
natrecd C z s (Sk) ⊳ s k (natrecd C z s k)

for C, z, s, k of the appropriate types.

In this context, we may derive the following term

Γ_{nat}, n:nat ⊢ ∀Φ:nat → Prop.Φ(0) ⇒ (∀k:nat.Φ(k) ⇒ Φ(S(Sk))) ⇒ Φ(n) : Prop

which represents impredicatively the (informal) proposition that n is an even natural number. That is, we define even numbers to be those n which satisfy all predicates satisfied by 0 and closed under successor of successor (the impredicativity, of course, lies in the fact that “evenness” is just such a predicate). Moreover, in this representation

Γ_{nat} ⊢ λΦ:nat → Prop.
λz:Φ(0) .
λs:∀k:nat . Φ(k) ⇒ Φ(S(Sk)) .
z
: ∀Φ:nat → Prop.Φ(0) ⇒ (∀k:nat.Φ(k) ⇒ Φ(S(Sk))) ⇒ Φ(0)

1“d” for dependent.

is a term representing a proof that 0 is even.

Example In the same way, one could define a predicate representing “oddness”,

Odd =def λn:nat. ∀Φ:nat → Prop.Φ(S0) ⇒ (∀k:nat.Φ(k) ⇒ Φ(S(Sk))) ⇒ Φ(n)

being one such representation. One might then show that the successor function S transforms even numbers into odds, and odds to evens, yielding terms sEO of type ∀n:nat. Even(n) → Odd(Sn) and sOE of type ∀n:nat. Odd(n) → Even(Sn) (the patient reader may care to experiment with the system by doing just such a thing).

What is the behaviour of the composite function x ↦ x + 2? We may use the proofs sEO and sOE, together with modus ponens, to derive a term ssEE of type ∀n:nat. Even(n) → Even(n + 2).

Now the Σ-types of the calculus allow us to pair together these fragments of code with their associated proof terms, for example

(S, sEO) : Σf:nat → nat. ∀n:nat. Even(n) → Odd(fn)

and we may see the pair (λn:nat. n + 2, ssEE) arising as a composite construction from the pairs (S, sEO) and (S, sOE).

The pair (λn:nat. n + 2, ssEE) of type

Σf:nat → nat. ∀n:nat. Even(n) → Even(fn)

is a very simple instance of the general idea below of a first-order deliverable, in this case from (nat, Even) to (nat, Even).

3 Definition of first-order deliverables

We work relative to some well-formed context Γ in ECC.

Definition 3.1 specification A specification is a pair of terms s, S such that Γ ⊢ s : Type, and Γ, x:s ⊢ Sx : Prop.

We typically write S, T , U for specifications, and understand s, t, u (respectively S, T, U) as referring to their underlying type (resp. predicate). Formally, there is a type of specifications, namely SP EC_{1} =def Σs:Type.s → Prop, so that we may consider operations which construct specifications entirely within the framework of ECC (cf. the account of specifications and refinements in [23]).

We will consider a category whose objects are the specifications. Specifications defined by logically equivalent predicates in general define distinct objects. The appropriate notion of morphism between specifications consists of a pair (f, ϕ), where f is a function between the underlying types, and ϕ is a proof that f respects the predicates. We call these morphisms first-order deliverables.

Definition 3.2 first-order deliverable Given specifications S = (s, S), T = (t, T), a first-order deliverable is a term F such that

Γ ⊢ F : Σf : s ⟶ t.∀x : s.Sx ⟹ T (fx).

The motivation for such a definition goes right back to Hoare’s original paper on axiomatic semantics [14], and, like the logic of triples which bears his name, expresses in a formal system the informal notion of a program, together with a certificate of some specified input/output behaviour. Of course, we are concerned with a functional language, rather than an imperative one, so there is no confusion over program variables and logical variables. In this framework, moreover, the proof and the program are linked as a pair. This definition uses the Σ-types in an essential way to capture this idea. We may use all the features of ECC to construct such pairs, but based on our intuitions about computational vs. propositional information, we insist upon a trivial extraction process: first projection π_{1} from the Σ-type yields the underlying algorithm f. Indeed this accounts for the name “deliverables”: they are what a software house should deliver to its customers, a program plus a proof in a box with the specification printed on the lid (the Σ-type). The customer can independently check the proof and then run the program, without the need for a complicated extraction process which may yield an unusual algorithm. Indeed, we propose this method as a style for developing programs in the first place. We usually have a reasonable idea of the algorithm in advance, as opposed to its proof of termination, or even correctness, and we would like an understanding, which reflects our intuitions, of how to build up these deliverables from smaller ones, for example by refinement and composition, possibly with machine assistance.

In terms of LEGO, we define a predicate Del_{1} and a type constructor del_{1} which describe first-order deliverables within ECC (compare Definition 3.2 above):

Lego> Del1;
value = [s,t|Type][S:Pred s][T:Pred t][f:s->t]{x|s}(S x)->T (f x)
type  = {s,t|Type}(Pred s)->(Pred t)->(s->t)->Prop
Lego> del1;
value = [s,t|Type][S:Pred s][T:Pred t]<f:s->t>Del1 S T f
type  = {s,t|Type}(Pred s)->(Pred t)->Type

(This is the output from the typechecker after giving the definitions). We have exploited the implicit syntax to enable us to suppress the argument types^{2} in the predicate Del1 and the type

del1.

With an eye to the categorical aspects of this definition, we typically write

S F ; \overline{}T ∈ del_{1} or (s, S) (f, ϕ) ; \overline{}(t, T) ∈ del_{1}

when Γ ⊢ f : s ⟶ t, and Γ ⊢ ϕ : Del_{1} S T f. Since s, t may be inferred by the typechecker, and we are in general not interested in ϕ, save to know that it exists, we may even abuse our notation and write

S f ; \overline{}T ∈ del_{1}.

At this stage, we need not have used the Σ-types to present these definitions. However, internalising the mathematical pair in a Σ-type allows us to represent operations which produce such function-proof pairs within the calculus. This gives us the possibility of developing a structure on these morphisms.

2This accounts for our choice of notation: since the types s,t may be inferred from S,T, we relegate them notationally to the lower case.

Definition 3.3 equality of specifications Given specifications (s, S), (t, T), we say (s, S) = (t, T) if

s ≃_{βδ} t and λx:s. S x ≃_{βδ} λx:t. T x.

Definition 3.4 equality of deliverables Given

[figure: (s, S); \overline{(f, ϕ)} ; \overline{(g, ψ)}; (t, T) ∈ del_{1},]

we say (f, ϕ) = (g, ψ) if

λx:s. fx ≃_{βδ} λx:s. gx

and

λx:s. λh:S x. ϕxh ≃_{βδ} λx:s. λh:S x. ψxh.

This definition of equality of deliverables seems to be the minimal extension of the basic conversion relation which ensures good categorical properties.

3.1 Semi-structure in categories

The use of cartesian closed categories to give models of the simply-typed λ-calculus is by now familiar in computer science [8, 20, for example], as are various equational presentations of the structure of a cartesian closed category. The basic type and term constructors are defined by adjunctions. In this analysis, the unit and counit of the adjunction defining the arrow type correspond, loosely, to η and β conversion, respectively (and similarly for the product type constructor). The absence of η-conversion and surjective pairing in ECC forces some extra technical difficulty upon us. However, models of various typed λ-calculi without η-conversion and surjective pairing can be given a rigorous semantic account in terms of semi-adjunctions, introduced by Hayashi in [12]. Essentially, the equations defining an adjunction are relaxed sufficiently that, under suitable conditions, there is a notion of counit which corresponds appropriately to β-conversion, without a unit corresponding to η-conversion. A detailed treatment is given in the thesis [25].

Definition 3.5 Semi-functor Given two categories C, D, a semi-functor between them is “a functor which need not preserve identities”: that is to say, we are given an assignment F of objects of D to objects of C, and an assignment, also called F, of arrows of D to arrows of C, such that

[figure: A; \overline{f}; B ∈ C; implies; F A; \overline{F f}; F B ∈ D]

and

[figure: F (A; \overline{f}; B; \overline{g}; C) = F A; \overline{F f}; F B; \overline{F g}; F C ∈ D.]

In a semi-adjunction, we replace the usual natural bijection on homsets with a pair of maps, which need not be mutual inverses. However, we still require them to behave “naturally”. The beauty of this idea lies in the following lemma.

Lemma 3.1 (Hayashi) Suppose F, G above are in fact functors. Then a semi-adjunction between F and G yields an adjunction between F and G.

So this concept subsumes the whole of our ordinary understanding of adjunctions, and hence all the constructions of universal gadgets defined by adjunctions^{3}. In particular, in a category C, we may define the notions of semi-terminal object,semi-product and semi-exponential exactly by analogy with the usual cartesian closed structure. If C has all the above structure, we say C is a semi-cartesian closed category, or semi-ccc. Hayashi’s development leads to the following main results, generalising previous accounts of models of the λ-calculus with β-conversion only.

Proposition 3.1 Semi-cccs are sound and complete for interpretations of the λβ-calculus.

Proposition 3.2 Semi-cccs can be presented algebraically.

In [25], the second author used LEGO to prove the following theorem:

Theorem 3.1 del_{1} is semi-cartesian closed.

We sketch some of the ideas in the discussion below.

3.2 Identities and composition

By considering our slight modification of the underlying conversion on the terms of ECC, to remedy the failure of surjective pairing and η-conversion in the calculus, we fixed a notion of equality on arrows. With this definition, it is now trivial to establish that specifications, together with first-order deliverables as morphisms, form a category, denoted by del_{1}.

The identities are given simply by

(s, S) (λx:s. x, λx:s. λh:Sx. h) ; \overline{}(s, S) ∈ del_{1};

in LEGO, we have

Lego> id_del1;
value = [s|Type][S:Pred s]([x:s]x,[x|s][p:S x]p)
type  = {s|Type}{S:Pred s}del1 S S .

Composition is given by

S (f, ϕ) ; \overline{}T (g, ψ) ; \overline{}U = S (λx:s. g(fx), λx:s. λh:Sx. ψ(fx)(ϕxh)) ; \overline{}U;

We may now verify that these definitions do indeed yield the structure of a category on del_{1}^{4}.

3.3 Semi-Terminal object

Unit =def (unit, λu : unit.u = ()^{5}) : SP EC_{1}

defines a trivial specification, where we postulate the existence of a unit type in the same way as other inductive types. We then obtain, for any specification (s, S) the deliverable

!_{(s,S)} =def (λx:s. (), λx:s. λp:S x. reflEQ()) : del_{1} S Unit.

3However, by contrast with adjunctions, structure defined by a semi-adjunction is not in general unique.

4Indeed, we only need the modified equality to prove the identity laws. The conversion relation is sufficient to establish associativity of composition.

5Here, () is the unique term of type unit. We write void in LEGO.

3.4 Binary semi-products

To obtain semi-products, we use the non-dependent Σ-type as the underlying type, with conjunction at the predicate level:

S × T =def (s × t, λp:s × t. (S(π_{1}p)) ∧ (T (π_{2}p)).

That we indeed have a semi-product structure now follows straightforwardly from this definition.

3.5 Semi-exponentials

The notion of first-order deliverable is based on the predicate Del_{1} on terms of arrow type. Precisely this predicate defines the specification which yields a semi-exponential object in del_{1}. λ-abstraction and evaluation then follow from those operations in the underlying type theory on values, and implication introduction and elimination at the level of proofs.

S ⟹ T =def (s → t, λf:s → t. Del_{1} S T f)

3.6 Trivial deliverables

Every function — that is to say a term of arrow type — gives rise to a deliverable, very much in the manner of the assignment rule of Hoare logic [14] or Dijkstra’s predicate transformer for assignment[9]. Namely, for

f : s ⟶ t, P : t ⟶ Prop

we obtain

(f, λx:s.λh:f^{⋆}P.h):del_{1} f^{⋆}P P, where f^{⋆}P =def λx:s.P (fx).

We call these deliverables trivial, since they come with vacuous proofs of correctness.

3.7 A consequence rule

Logical implication induces a pointwise ordering ⊂ on predicates, for which we have the following consequence rule, in the manner of Hoare logic:

\frac{S ⊂ S′ S′ (f, ϕ′) ; \overline{}T′ T′ ⊂ T}{S \overline{} ; (f, ϕ) T}

In fact, this rule is subsumed by composition, since any logical entailment gives rise to a deliverable whose function component is the identity.

3.8 Pointwise construction

A basic combinator in the theory of deliverables constructs a function-proof pair from a function which returns value-proof pairs^{6}. Mendler, in his thesis [28], calls such gadgets “pointwise designs”: for each argument value x, the pointwise existence of a value y (of type t) satisfying some property T v, yields a deliverable with codomain (t, T). In detail,

6This just corresponds to Howard’s observation that, given a strong interpretation of the existential quantifier as Σ-type, the axiom of choice becomes constructively valid [15].

\frac{F: Πx:s. Σy:t. (Sx) ⟶ (T y)}{S ^{(f,ϕ)} T}

where f =def λx:s. π_{1}(Fx), and ϕ =def λx:s. λh:Sx. π_{2}(Fx)h.

3.9 Inductively defined types

Provided we accept a weak definition of inductive type, it is relatively straightforward to add inductive types to the categorical structure developed so far. Categorical accounts of inductive types, via initial algebras, impose extra equalities on the iterator, due to the uniqueness clause in the definition of initial algebra. As with the semi-structures above, we only have existence, and not uniqueness, of the relevant universal arrows.

The basic idea is very simple: we add inductive types at the Type level, with a strong^{7} elimination rule, yielding a simply typed recursor at the Type level, and the usual induction principle at the Prop level. This type is then paired with the identically true predicate. The elimination rule for first-order deliverables is easily derived, by packaging primitive recursion at the type level with induction at the predicate level. We illustrate this general idea by considering the case of natural numbers and lists.

3.9.1 Natural numbers

Recall from Section 2 that we may postulate the existence of a type of natural numbers, with two constructors, zero and successor. This yields the well-formed context

nat:Type, 0:nat, S:nat ⟶ nat

We typically abbreviate S to “+1” in informal mathematical language. We extend this context with a dependent elimination constant natrecd,

natrecd:ΠC:nat ⟶ Type. Πz:C0. Πs:(Πk:nat. Πih:Ck. C(k + 1)). Πn:nat. Cn

together with reduction rules defining the δ-redexes^{8} (in some context where C, z, s, n have the appropriate types):

• natrecd C z s 0 ⊳ z ;

• natrecd C z s (n + 1) ⊳ s n (natrecd C z s n) .

This is precisely expressed in LEGO as follows:

[nat:Type(0)];
[zero:nat];
[succ:nat -> nat];
[natrecd:{C:nat->Type}

7Strong, that is, because we can eliminate over types, and not merely propositions.

8cf. Martin-Löf type theory, or Gödel’s earlier system T of functionals [37]. We essentially use this language of primitive recursion in all finite types as our programming language.

         {z:C zero}{s:{k:nat}{ih:C k}C (succ k)}{n:nat}C n];
[[n:nat][C:nat->Type][z:C zero][s:{k:nat}{ih:C k}C (succ k)]
   natrecd C z s zero ==> d
|| natrecd  C z s (succ n) ==> s n (natrecd C z s n)].

This yields a derived iterator and primitive recursor

natiter :Πα:Type. α ⟶ (α ⟶ α) ⟶ α

and

natrec:Πα:Type. α ⟶ (nat ⟶ α ⟶ α) ⟶ α

where^{9}

natiter z s 0 =def z
natiter z s (n + 1) =def s (natiter z s n)
natrec z s 0 =def z
natrec z s (n + 1) =def s n (natrec z s n),

and an induction principle

natind :ΠΦ:nat ⟶ Type. Πz:Φ(0). Πs:(Πk:nat. Πih:Φ(k). Φ(k + 1)). Πn:nat. Φn.

Our methodology suggests we examine derived induction principles for the iterator and recursor, since we are interested in programs, in this case of the form natiter z s or natrec z s, together with proven propositions about them. For the iterator, we obtain

\frac{Φ(z) ∀y:α. Φ(y) ⟹ Φ(s y)}{∀n:nat. Φ(natiter z s n)} [z:α, s:α ⟶ α]

and for the recursor

\frac{Φ(z) ∀k:nat. ∀y:α. Φ(k) ⟹ Φ(s k y)}{∀n:nat. Φ(natrec z s n)} [z:α, s:nat ⟶ α ⟶ α].

Since we are interested in building new deliverables from less complex ones, we could of course use the dependent eliminator natrecd to construct terms of type del_{1}, but in doing so we violate the separation of proofs from programs which distinguishes our approach. So we package recursion at the Type level with induction at the Prop level in a pair.

We introduce the predicate Nat =def λn:nat. true on the natural numbers. For each constructor of the type, we obtain a corresponding deliverable:

Zero =def (λu:unit. 0, λu:unit. λh:Unit u. ⊤^{10}):Unit Nat

Succ =def (λn:nat. S n, λn:nat. λh:Nat n. ⊤):Nat Nat

9The type α is, of course, inferred by the typechecker.

For the iterator, we obtain

\frac{[figure: Unit; (z, Z); (t, T); (t, T); (s, S); (t, T)]}{Natiter (z, Z) (s, S):(nat, Nat) \overline{}(t, T)}

and the recursor Natrec analogously, where the function component of Natiter (z, Z) (s, S) (respectively Natrec) is natiter (z()) s (respectively natrec), and the proof component is obtained from the appropriate derived induction principle above.

These terms are easily obtained by refinement in LEGO. For example, here is the significant structure of Natiter, with the uninformative details of the proof component suppressed:

Lego> natiter_del1;
value = [t|Type][T|Pred t][ZZ:del1 Unit T][SS:del1 T T]
        [z=ZZ.1 void][Z=ZZ.2][s=SS.1][S=SS.2]
        (natiter z s,
         natind ([m:nat](Nat m)->T (natiter z s m)) ... )
type  = {t|Type}{T|Pred t}(del1 Unit T)->(del1 T T)->del1 Nat T

Example As an example of the use of these combinators, we present a correctness proof of a doubling function, given by

double =def λn:nat. natiter 0 (λk:nat. k + 2) n.

Suppose we wish to show that double n is even for all natural numbers n. Posed in terms of deliverables, we seek a term of type del_{1} Nat Even, whose function component is double.

Using the rule for Natiter above, the problem reduces to finding:

base case Unit ^{(z,Z)} (nat, Even). We take z =def λu:unit. 0, and use the proof that 0 is even from Section 2;

step case (nat, Even) ^{(s,S)} (nat, Even). We simply use the first-order deliverable which we constructed by composition at the end of Section 2, namely (λn:nat. n + 2, ssEE).

We thus obtain a non-trivial recursive first-order deliverable.

3.9.2 Lists

In much the same way as above, we may define combinators for deliverables over a type of lists. As before, we extend the context with a type constructor, in this case list:Type_{0} ⟶ Type_{0}, together with constructors the usual nil and cons, and a dependent eliminator listrecd. Again we derive an iterator listiter, a primitive recursor listrec and an induction combinator listind.

When it comes to considering the derived induction principles for the iterator and recursor, however, we now have the freedom to specify recursions over lists of elements satisfying some predicate, rather than over all lists of the parameter type a. That is, given some specification (a, A), we obtain a derived specification List (a, A) =def (list a, Listof A), where

10Here, ⊤ is the term corresponding to true-introduction,

⊤ =def λϕ:Prop. λp:ϕ. p of type true =def Πϕ:Prop. ϕ ⇒ ϕ.

Listof A (nil a) =def true
Listof A (cons x l) =def (A x) ∧ (Listof A l)

defines Listof A by primitive recursion.

We may then proceed in the same way as above, obtaining constructors

Nil =def (λu:unit. nil a, λu:unit. λh:Unit u. ⊤):Unit Listof A

and

Cons:A (Listof A)Listof A

with function component,

λx:a. λl:list a. cons x l

and proof component

λx:a. λp:A x. λl:list a. λq:Listof A l. pair p q.

Likewise, we package together recursion and an appropriate derived induction principle, to obtain the following rules for constructing deliverables: an iterator,

\frac{[figure: Unit; (n, N); (t, T); (a, A); (c, C); (t, T)(t, T)]}{Listiter (n, N) (c, C): (list a, Listof A) \overline{}(t, T)};

and analogously a recursor.

4 Second-order deliverables

The system which we have described above amounts to a functional version of the well known invariants used in proofs of imperative programs. Unfortunately the specification makes no connection between the input and the output of the function. All we say is that if the input satisfies property S then the output satisfies property T, but there is no relation between them. Recalling the example in the introduction, we might specify that a sorting function takes lists to ordered lists, but we cannot specify that the output is a permutation of the input. The function might always produce the empty list, which is indeed sorted, but not very interesting. As a matter of fact the classical invariant proofs have the same weakness, masked by the tacit assumption that some variable which is carried through the computation does not change its value. To enforce the constraint that the output bear some relation to the input, we need to develop a compositional theory in which relations are the basic objects of study, with a notion of arrow which respects relations, rather than predicates. This gives us a categorical explanation of the idea that the pre- and postconditions are linked by having a free variahle in common, that is they are over the same context.

4.1 A thought experiment

Suppose we are given some specification ∀x:s. ∃z:u. R(x, z), and we wish to find some function f:s ⟶ u which satisfies it. In what sense may we refine such specifications by composition? Suppose we wish to instantiate f via the composition f = g; h of two functions

[figure: s; \overline{g}; t; \overline{h}; u]

where t is some intermediate type. Then, following our intuition in the case of predicates, we anticipate some intermediate specification Q(x, y) [x:s , y:t], such that g solves

∀x:s. ∃y:t. Q(x, y),

and h solves

∀x:s. (∃y:t. Q(x, y)) ⟹ ∃z:u. R(x, z).

This last is logically equivalent to

∀x:s. ∀y:t. Q(x, y) ⟹ ∃z:u. R(x, z).

But now we are left in something of a quandary: h, our intended solution, makes no reference to the intermediate value of y. Also, we have introduced an asymmetry between the rôles of g and h. A remedy, which underlies the definitions 4.2, and 4.3 below, is to separate the rôles of the independent parameter x and the dependent variables y, z.

We consider relations such as Q, R as the objects of study, for a fixed type s, but allowing the types t, u to vary. The following provides an appropriate notion of morphism which reestablishes a symmetry between Q and R.

Definition 4.1 An arrow from Q(x, y) [x:s , y:t] to R(x, z) [x:s , z:u] consists of the following data:

• a function f:s ⟶ t ⟶ u, that is to say a function of two arguments — this recovers the missing dependence we observed above;

• a proof ϕ:∀x:s. ∀y:t. Q(x, y) ⟹ R(x, (f x y)).

The composition of two such arrows

[figure: P (x, w); (g, ψ); Q(x, y); (h, χ); R(x, z)]

is definable as

(λx, w:s, r. h x (g x w), λx, w:s, r. λp:P (x, w). ψ x (g x w) (ϕ x w p)).

We have now established a definition which respects the symmetry of source and target in our previous analysis of the decomposition of the specification ∀x:s. ∃z:u. R(x, z). In so doing, we have generalised the notion of specification, and our old specification corresponds in this new setting to choosing r =def unit, P (x, w) =def true, and f_{old} =def λx:s. f_{new} x ().

4.2 Basic definitions

In view of the above discussion, we relativise specifications and first-order deliverables to depend on some input type s. Indeed, by observing that we may uniformly impose some condition S on the input parameter x:s, without affecting the notion of composition, we arrive at the definition of a “second-order” deliverable.

Definition 4.2 relativised specification Suppose Γ ⊢ s : Type, Γ ⊢ S : s ⟶ Prop. Then a relativised specification with respect to (s, S) is given by a pair of terms t, R, such that

• Γ ⊢ t : Type, and

• Γ ⊢ R : s ⟶ t ⟶ Prop.

Definition 4.3 second-order deliverable Suppose Γ ⊢ s : Type, Γ ⊢ S : s ⟶ Prop. Given two relativised specifications (t, Q) and (u, R), a second-order deliverable over (s, S) is a term F such that

Γ ⊢ F : Σf : s ⟶ t ⟶ u.∀x : s.S(x) ⟹ ∀y : t.Q(x, y) ⟹ R(x, (fxy)).

We define Del_{2} S Q R to be the predicate

λf:s ⟶ t ⟶ u. ∀x : s.Sx ⟹ ∀y : t.Q(x, y) ⟹ R(x, (fxy)).

Definition 4.3 embodies the idea that, for each x:s such that Sx holds, (fx, ϕx) is a first-order deliverable from Qx to Rx, where F =def (f, ϕ). This suggests that the study of secondorder deliverables amounts to the study of first-order deliverables in an extended context. In particular we expect to obtain, for a given specification S =def (s, S), a category structure on the second-order deliverables over S. We make a similar definition of equality on second-order deliverables to that given in Section 3 above, the details of which are left to the reader. Then we can indeed define identities and composition, given by

Identities The identity morphism from (t, Q) to itself over (s, S) is given by

(λx:s. λy:t. y, λx:s. λh:S x. λy:t. λq:Q x y. q)

Composition This is defined much as in the thought experiment above (4.1): the composition of

[figure: P (x, w); (f, ϕ); Q(x, y); (g, ψ); R(x, z)]

over (s, S) is definable as

(λx:s. λw:r. g x (f x w), λx:s. λh:S x. λw:r. λp:P x w). ψ x h (f x w) (ϕ x h w p)).

This gives us a category del_{2}S.

If (f, ϕ) is a second-order deliverable over (s, S), we typically write

(t, Q) (f, ϕ) ; \overline{}(u, R) [(s, S)] , or even Q (f, ϕ) ; \overline{}R [S],

since, as usual, the types s, t, u may be inferred by the typechecker. Our notation is intended to indicate that we are considering deliverables relative to some assumption defined by the specification (s, S). This notation is deliberately intended to echo the style of contexts in Martin-Löf type theory.

4.3 Each del_{2}S is a semi-ccc

As in Section 3, we work relative to some context Γ. We have seen how a second-order deliverable (f, ϕ) over (s, S) in context Γ may be viewed as arising from a first-order deliverable in the extended context Γ, x:s, h:Sx. The conditions of definitions 4.2, and 4.3 are intended to enforce a hierarchy of dependencies in this extended context. The type t must not depend on x or h. The relation R, considered as a predicate on t in context Γ, x:s does not depend on h. The function component f may not depend on h, but the proof component ϕ may do so.

Given these conditions, we may lift the structure in del_{1}, by observing that the various constructions of Section 3 respect this hierarchy of dependencies. The predicates concerned need to be modified to include an explicit hypothesis Sx. We arrive at the following result.

Theorem 4.1 For each specification S, del_{2}S has the structure of a semi-ccc.

Proof We merely sketch some of the constructions, on the basis of the above informal intuition. Full details are in [25].

Semi-terminal object This is given by the relativised specification

1_{S} =def (unit, λx:s. λu:unit. true).

The map !_{(t,Q)}, from some relativised specification (t, Q) to 1_{S}, has function component λx:s. λy:t. (), and proof component

λx:s.λh:Sx.λy:t.λp:P x w. ⊤.

Semi-products Suppose we are given two relativised specifications (t, Q), (u, R). Then we may form the relativised specification

(t, Q) × (u, R) =def (t × u, λx:s. λp:t × u. (Qx(π_{1}p)) ∧ (Rx(π_{2}p)))

This defines a semi-product object in del_{2}(s, S). The pairing map is given by

\frac{P (f, ϕ) ; \overline{}Q [S] P (g, ψ) ; \overline{}R [S]}{P \overline{} ; (< f, g >, < ϕ, ψ >) Q × R [S]}

where < f, g > and < ϕ, ψ > are appropriate pairing operations on values and proofs respectively. Projections are similarly straightforward to define.

Semi-exponentials Just as the predicate Del_{1} defined a semi-exponential object in the category del_{1}, we may define a semi-exponential object in del_{2} (s, S), using the relativised specification to which Del_{2} gives rise. More precisely, suppose (r, P), (t, Q), (u, R) are relativised specifications. We obtain a relativised specification

RQ =def (t ⟶ u, λx:s. λf:t ⟶ u. ∀y:t.Q x y ⟹ R x (fy)).

If Γ ⊢ f : s ⟶ t ⟶ u, and Γ ⊢ ϕ : Del_{2} S Q R f, then Γ, x:s ⊢ ϕx : RQ fx. Moreover, given

P × Q F ; \overline{}R [S]

we obtain

P Λ(F) ; \overline{}RQ [S]

by currying in the obvious way: if F =def (f, ϕ), then Λ(F) =def (f̂, ϕ̂), where f̂ and ϕ̂ are appropriate currying operations on values and proofs respectively. We may similarly define an evaluation map, details of which are left to the imaginative reader: it is rather less taxing to develop this construction by refinement in LEGO. Likewise, the proofs that these data meet Hayashi’s conditions for a semi-exponential are best dealt with by refinement.

■

4.4 del_{2}: an indexed category over del_{1}

The categorically minded reader now asks herself what relationships exist between the various categories {del_{2}S|S ∈ SP EC_{1}}, and to what extent we may elaborate upon the structure of this collection. In particular, she may ask what is the relationship between del_{2}S and del_{2}T , given a first-order deliverable from S to T . A moment’s pause should convince her that composition in del_{1} should induce an operation on second-order deliverables, since they somehow are no more than first-order deliverables, except that they are defined in an extended context. In other words, we are groping towards the following theorem:

Theorem 4.2 del_{2} is an indexed category [19, 1] over del_{1}, whose fibres are semi-cccs, with semi-cc structure strictly preserved by reindexing along arrows in del_{1}.

4.5 Pullback functors

The above theorem depends on the existence of pullback functors, which translate, or reindex, data between the categories del_{2}S. The obvious definition works, and moreover trivially respects the equality of objects and arrows, so we do indeed have pullback functors — and they are functors, not merely semi-functors, since identities and composition are preserved. It is then a straightforward, and tedious, task to verify that these operations compose, and strictly preserve the structure in each fibre.

Definition 4.4 pullback along a first-order deliverable

Suppose we are given specifications S, T , and a first-order deliverable S \begin{matrix}(k,K) \\ T \end{matrix} . We define an

operation of pullback along (k, K), where we abuse notation in the standard way by employing the same symbol for the operation on objects and arrows, as follows: given a relativised specification Q =def (u, Q) with respect to T , let

(k, K)^{⋆}Q =def λx:s. λz:u. Q (kx) z;

moreover, given a relativised specification R =def (v, R), and a second-order deliverable

Q (f, ϕ) ; \overline{}R [T ]

we define (k, K)^{⋆}(f, ϕ) to be the pair

(λx:s. λz:u. f (k x) z, λx:s. λh:Sx. λz:u. λp:Q (k x) z. ϕ (k x) (K x h) z p).

Lemma 4.1 (k, K)^{⋆}Q is a relativised specification with respect to S. Moreover, (k, K)^{⋆}(f, ϕ) is a second-order deliverable from (k, K)^{⋆}Q to (k, K)^{⋆}R.

Lemma 4.2 (k, K)^{⋆} preserves identities and composition.

So, indeed, we do have the the existence of functors between the fibres del_{2}. That they are a satisfactory notion of reindexing requires us to show that they obey the condition H^{⋆}; K^{⋆} ≅ (K; H)^{⋆}. In fact, more is true. We have the following:

Lemma 4.3 The reindexing is strict, in the sense that

H^{⋆}; K^{⋆} = (K; H)^{⋆}.

We now turn to the remainder of Theorem 4.2, namely that the pullback functors preserve the structure of a semi-ccc in each fibre. As above, we find that the structure is preserved strictly. We examine only the case of exponentials, the cases of products and terminal object being exactly similar, and rather easier.

Lemma 4.4 In the notation of Theorem 4.1 above, with V \begin{matrix}K \\ S \end{matrix} , we have

K^{⋆}(RQ) = (K^{⋆}R)K^{⋆}Q.

Proposition 4.1 Suppose (r, P), (t, Q), (u, R) are relativised specifications with respect to S. Given

P × Q F ; \overline{}R [S] and V K ; \overline{}S

we have Λ(K^{⋆}F) ≡ K^{⋆}∗(F).

4.6 Second-order deliverables for natural numbers and lists

In the context of second-order deliverables, the situation regarding inductive types is less well understood. We do not regard this section as giving a definitive account, but the examples we have considered suggest that we have a usable set of combinators for reasoning about recursive programs.

We take as our guiding motivation the derived induction principles of the last section. Since we now work in the relativised case, these will be subtly altered by the presence of the induction variable.

This means, for the case of natural numbers, that we now examine proofs of statements of the form^{11}:

∀n:nat. R n (natrec z s n)

where, for some type t, z:t and s:nat ⟶ t ⟶ t. A proof of this, by induction, yields

R 0 z and ∀k:nat. ∀y:t. R k y ⟹ R (k + 1) (s k y)

as the requisite hypotheses in the base and step cases. We may now recognise the second hypothesis as the logical component of some second-order deliverable, whose function component is s.

11We only consider natrec, since natiter is a degenerate instance of it.

The question arises as to how to view the first hypothesis R 0 z. Do we regard it as part of some first or second-order deliverable? In a sense, neither, in the choice we have made in the current version of deliverables. If we examine the derived rule of induction again, but this time rephrased as

\frac{∀k:nat. ∀y:t. R k y ⟹ R (k + 1) (s k y)}{∀n:nat. ∀z:t. R 0 z ⟹ R n (natrec z s n)}

this isolates how we currently view recursions at the second-order level. Namely, we see the function which recursively applies s to an arbitrary initial value z as the function component of some second-order deliverable, whose proof component is the proof by induction of the conclusion

∀n:nat. ∀z:t. R 0 z ⟹ R n (natrec z s n).

As observed above, the hypothesis in the step case of induction arises as the proof component of a second-order deliverable

R (s, S) ; \overline{}(+1)^{⋆}R [1nat]

where (+1)^{⋆}R, otherwise written R[n + 1/n], is the relation

λn:nat. λy:t. R (n + 1) y.

In like manner, we write 0^{⋆}R, or R[0/n], for the relation

λn:nat. λy:t. R 0 y.

We thus obtain the second-order deliverable constructor for nat recursions as the following derived rule

\frac{R (s, S) ; \overline{}(+1)^{⋆}R [1nat]}{Natrec_{2} (s, S):0^{⋆}R \overline{}R [1nat]}

where Natrec_{2} has function component

λn:nat. λz:t. natrec z s n.

The principle reason for making this choice of representation is a pragmatic one, based partly on experience, and on the behaviour of unification in the typechecker. If we were to mimic the construction of first-order deliverables by induction, we would expect some rule with one hypothesis for each constructor of the datatype, such as for example

\frac{1 (z, Z) ; \overline{}0^{⋆}R [1nat] R (s, S) ; \overline{}(+1)^{⋆}R [1nat]}{Natrec′_{2} (z, Z) (s, S):1 \overline{}R [1]} .

We would typically apply such a rule in a top-down proof, to a subgoal of the form

del2 ?n ?m R

In a top-down development, where we may construct deliverables using all the constructions described above, we would like the instantiation of ?m to be both as general as possible, to allow for subsequent development, and yet to allow unification to constrain ?m to make the application valid. Our choice of the above rule for Natrec_{2} seems to achieve this. We do not regard this choice as necessarily definitive, however: it merely represents our present view.

4.7 Lists

We may extend this analysis to the case of lists, where, as in the case of first-order deliverables, we find the richer structure of lists reflected in a richer collection of predicates and relations.

Firstly, if we work in the fibre del_{2} 1_{list a}, then we obtain in exactly the same way as above, the following derived rule:

\frac{Πx:a. R F ; \overline{}(cons x)^{⋆}R [1_{list a}]}{Listrec_{2} F:(nil)^{⋆}R \overline{}R [1_{list a}]}

where

(cons x)^{⋆}R =def λl:list a. λy:t. R (cons x l) y

and

(nil)^{⋆}R =def λl:list a. λy:t. R (nil a) y.

But already in this rule we find something new: the outermost Π binding. That is to say, the rule has as its premise a dependent family of second-order deliverables. This phenomenon arises from the parameter type a of the lists in question. The rule is susceptible to the same criticisms as the rule for Natrec_{2} above, but also the criticism that we have accorded a different status to the parameter type. In particular, it does not seem to be constrained by any predicate A we might impose on a. Our justification, as above, is essentially pragmatic. We have found this rule to be a useful construction, as in the example of minimum finding in a list.

We can obtain forms of this rule in which the input list is further constrained. We may, for example, consider the predicate Listof A, for some predicate A on a. In fact, since we are now considering second-order deliverables, where we can take into account relations which depend on both the input variable and the result of some computation step, we may extend this predicate to a dependent version, which we call depListof A, defined as follows:

depListof Φ (nil a) =def true
depListof Φ (cons x l) =def (Φ x l) ∧ (depListof Φ l)

Here Φ is some relation between values of the variable x varying over the parameter type a, and lists over a. An example is the predicate Sorted, for which we take Φ x l =def x ⪯ l, the relation that x is less than each element of the list l. This crops up in the example of an insert sort in the next section.

This introduces an extra hypothesis into the induction scheme we must consider. Suppose we wish to prove

∀l:list a. (depListof Φ l) ⟹ R l (listrec n c l)

where n:t, c:a ⟶ t ⟶ t. A proof by induction generates the following hypotheses for each constructor.

base case true ⟹ R nil n, which reduces logically to R nil n. As with the rules for Natrec_{2}, we shall fold this assumption into the rule as the initial relation in the second-order deliverable we eventually derive.

step case Formally, we obtain

∀x:a. ∀l:list a. ((depListof Φ l) ⇒ R l (listrec n c l)) ⟹

((depListof Φ (x :: l)) ⇒ R (x :: l) (c x l (listrec n c l))).

Two simplifications present themselves. The first is to replace the explicit mention of (listrec n c l) by an additional universally quantified parameter y. The second is to observe that depListof Φ (cons x l) ⟹ depListof Φ l. Combining these, we obtain as an induction hypothesis in the step case

∀x:a. ∀l:list a. ∀y:t. (depListof Φ (x :: l)) ⟹ R l y ⟹ R (x :: l) (c x l y).

In this form, we see the logical part of a second-order deliverable emerge.

We thus obtain the following derived rule, which yields a second-order deliverable with function component listrec from a dependent family of second-order deliverables:

\frac{F:Πx:a. R \overline{}(cons x)^{⋆}R [(cons x)^{⋆}depListof Φ]}{depListrec_{2} F:nil^{⋆}R \overline{}R [depListof Φ]}

5 Examples

In his thesis [25], the second author considered a number of example developments using the methodology outlined above, culminating in a machine-checked proof of the Chinese remainder theorem. This last example is too long to include here, although it perhaps best exhibits some of the strengths of our approach. We hope to discuss it in a forthcoming paper.

To illustrate the discussion of the previous sections, we give two examples of the use of deliverables in small-scale program development. The use of deliverables may seem heavy-handed and even counter-productive for these smaller examples. The discussion is taken from [25], where detailed accounts in LEGO of the derivations may be found.

5.1 Finding the minimum of a list

An example which is treated several times in the literature [30, 35]. In our case, it involves a somewhat unnatural reperesentation, which makes non-trivial use of the semi-cartesian closed structure in the fibres del_{2}.

5.2 The mathematical specification

Suppose R is a decidable total order on some type α, which for the purposes of this example contains a maximal element a_{0} (this avoids having to consider exceptions for the case of the nil list). We distinguish between R, a boolean valued function, and the relation λa, b:α. R a b = tt, denoted ≤_{R}. Then we may specify the minimum of a list as follows:

∀l:listα.l ≠ nil ⇒ ∃m:α.m ∈ l ∧ (∀a:α.a ∈ l ⇒ m ≤_{R} a).

We abbreviate the second conjunct to m ⪯_{R} l. We may easily express a solution to this specification in SML as follows (:: adds an element to a list):

fun min a b = if (R a b) then a else b;
fun minelemaux nil = (fn a => a) |
    minelemaux (b::l) = (fn a => (min a (minelemaux l b));
fun minelem nil = a_0 |
    minelem (a::l) = minelemaux l a;

We have explicitly curried the function definition of [35]^{12}

fun minelem (a::nil) = a
 |  minelem(a::b::l) = min a (minelem (b::l));

since the type system of ECC is too strict to allow such a definition based on pattern matching. Our definition is by recursion on the first argument l of minelemaux; the corresponding proof is by induction on l. We seek to verify that minelemaux meets the following specification:

∀l:list α. ∃f:α → α. ∀a:α. fa ∈ a :: l ∧ fa ⪯_{R} a :: l;

The proof for minelem follows by composition with a (suitably relativised) deliverable for application.

5.3 The correctness proof

We just consider the verification of minelemaux. As indicated, the proof is by induction.

Base case

∃f:α → α. ∀a:α. fa ∈ a :: nil ∧ fa ⪯_{R} a :: nil.

The condition fa ∈ a :: nil forces us to choose f =def λa:α. a. For a reflexive R, the second conjunct is then satisfied.

Step case Suppose

∃f:α → α. ∀a:α. fa ∈ a :: k ∧ fa ⪯_{R} a :: k.

Then for b ∈ α, taking g =def λa:α. min a (f b), we obtain for all a ∈ α, by cases on R a (f b):

• R a (f b) = true, and hence min a (f b) = a. Now a ∈ a :: b :: k, and a ⪯_{R} a :: b :: k, since a ≤_{R} a, and a ≤_{R} (f b) ⪯_{R} b :: k, by hypothesis, and the transitivity of ≤_{R}.

• R a (f b) = false, and hence min a (f b) = f b. We have fb ∈ b :: k, by hypothesis, and hence fb ∈ a :: b :: k. Again, by hypothesis, f b ⪯_{R} b :: k, and fb ≤_{R} a. Hence

fb ⪯_{R} a :: b :: k, and we are done.

5.4 The development in terms of deliverables

We give an outline of the proof in the style of a derivation tree, indicating the combinators used to resolve significant subgoals.

Let

MinAuxSpec =def λl:listα. λf:α ⟶ α. ∀a:α. fa ∈ a :: l ∧ fa ⪯_{R} a :: l.

Abbreviating the trivial specifications λl:listα. true and λl:listα. λu:unit. true to 1 (since they are terminal objects, respectively in del_{1}, and del_{2} (listα, 1)), we seek

1 minelemaux_{\overline{}}MinAuxSpec [1]

12Sannella in fact treats the maximum of the list.

We use composition to enable us to exploit our recursion combinator for second-order deliverables over lists of Section 4.6, to package up the proof by induction:

\frac{1 base_{\overline{}}?1 [1] ?1 step_{\overline{}}MinAuxSpec [1]}{1 minelemaux_{\overline{}}MinAuxSpec [1]} (compose)

and

\frac{Πa:α. MinAuxSpec Fstep ; \overline{}(cons a)^{⋆}MinAuxSpec [1_{list α}]}{?1 step_{\overline{}}MinAuxSpec [1]}(Listrec_{2})

which instantiates subgoal ?1 with the specification nil^{⋆}MinAuxSpec.

We resolve the base case of our induction using a pointwise construction, and thereafter exactly the informal reasoning above. This is sufficient to allow us to completely close this branch of the derivation.

\frac{value = λa:α. a proof : a ∈ [a] ∧ a ⪯_{R} [a]}{1 base_{\overline{}}nil^{⋆}MinAuxSpec [1]}(pointwise)

This leaves the step case. We extend the context with a free variable b of type α, and then conclude with another pointwise construction. The proof follows the informal argument above.

\frac{value = λa:α. min a (f b) proof : …}{MinAuxSpec Fstep b ; \overline{}(cons b)^{⋆}MinAuxSpec [1]}(pointwise)

5.5 Insert sort

We chose insert sort, since it is expressible naturally within primitive recursion, as opposed to more efficient algorithms such as Hoare’s quicksort, which has a natural expression only in terms of general recursion.

5.6 The mathematical specification

Informally, this is straightforward enough. For every list l, over some type α which carries a decidable linear ordering, there exists a sorted list m which is a permutation of l. In a formal treatment, we must give explicit representations of the notions of “sortedness” and “permutation”. We used an impredicative definition of the permutation relation, which we do not discuss here. The predicate Sorted was defined by recursion:

\overline{Sorted(nil)} \frac{Sorted (l) a ⪯ l}{Sorted (a :: l)} [a:α, l:list α]

where

\overline{a ⪯ nil [a:α]} \frac{a ⪯ l a ≤ b}{a ⪯ b :: l} [a, b:α, l:list α]

As we observed in the section on dependent list recursion, Sorted may be seen as an instance of the depListof constructor, while the predicate λl:list α. a ⪯ l, for a:α, is just an instance of Listof .

5.7 A correctness proof for insert sort

Here is the ML prototype for the sort that we wrote, with a view to proving correct:

fun listrec n c l = fold ( fn (a,m) => c a m) l n;
val swapcons = fn b => (fn p =>
                        let val (c,m) = p
                         in  (max(c,b), (min(c,b):: m))
                          end);
fun scons a l = let val (b,m) = listrec (a,nil) swapcons  l
                 in b::m
                  end;
val sort = listrec nil scons;

and here is its translation into LEGO code:

[swapcons = [A|Type][b:A][p:A # (list A)]
            ((min p.1 p.2),cons (max p.1 p.2) m)];
[scons = [A|Type][a:A][l:list A]
         [p = listrec (a,nil) swapcons  l](cons p.1 p.2)];
[sort = listrec nil scons];

We anticipate two levels of induction in the correctness proof for this function, since sort is defined by nested recursion. We recall the derived induction principles for recursive program phrases which we used to explain recursive deliverables:

for ϕ:(list α) ⟶ β ⟶ Prop, n:β, c:α ⟶ (list α) ⟶ β ⟶ β

\frac{⌈ϕ l b [a:α, l:list α, b:β]⌉ ; ⋮ ; ϕ nil n ϕ (a::l) (c a l b)}{∀l:list α.ϕ l (listrec n c l)}

a consequence of which is the following induction principle for sorted lists, which is just the proof component of an instance of the depListrec_{2} combinator we considered above:

for ϕ:(list α) ⟶ β ⟶ Prop, n:β, c:α ⟶ (list α) ⟶ β ⟶ β

\frac{⌈Sorted (a::l), ϕ l b [a:α, l:list α, b:β]⌉ ⋮ ϕ nil n  ϕ (a::l) (c a l b)}{∀l:list α. Sorted l ⟹ ϕ l (listrec n c l)} Sorted List Induction

This induction principle exemplifies the motivation for second-order deliverables: namely that a relation ϕ between lists holds, only on the condition that one of them is sorted.

The correctness proof proceeds by application of the first induction principle, for the outermost recursion: this produces as subgoals

(a) Sorted(nil), nil ∼ nil

(b) ∀a : α.∀l, m:list α. (Sorted (m) ∧ l ∼ m) ⟹ (Sorted (scons a m) ∧ a :: l ∼ (scons a m)).

Now (a) is immediate, and (b) reduces to

∀a : α.∀m:list α.Sorted (m) ⟹ (Sorted (scons a m) ∧ a :: m ∼ (scons a m))

∀-introduction extends the context with the assumption [a:α], and in this extended context we define the relativised specification

ψ_{a} ≡ λm, n:list α.Sorted (n) ∧ a :: m ∼ n.

Now we may apply Sorted List Induction to yield the following subgoals in the new context:

(c) a :: nil ∼ a :: nil ∧ Sorted (a :: nil)

(d) ∀b : α.∀m, n:list α. Sorted (b :: m) ∧ ψ_{a}mn ⟹ ψ_{a}(b :: m)(swapcons b m).

(c) is trivial, and (d) reduces to

∀b, c : α.∀m, n:list α.Sorted (b :: m) ∧ Sorted (c :: n) ∧ a :: m ∼ c :: n ⟹

Sorted (min (b, c) :: max (b, c) :: n) ∧ a :: b :: m ∼ min (b, c) :: max (b, c) :: n

This last goal rests, apart from some trivial properties of ∼, on the following:

Lemma 5.1 Suppose a, b, c ∈ α, and m, n ∈ list α such that:

• Sorted (c :: n);

• c :: n ∼ a :: m;

• b ⪯ m.

Then max (b, c) ⪯ n.

5.8 The proof recast in terms of deliverables

We have a double recursion in the definition of our program, which translates into a nested list recursion at the level of deliverables. The base case of each induction is resolved with a simple pointwise construction. So too is the inner step case for the verification of the swapcons function, with some additional propositional reasoning.

However, there is a point of considerable delicacy in the course of this proof. There is a stage at which we must shift from a second-order deliverable over 1, the identically true predicate on lists, defined by the outermost recursion, to the inner recursion on second-order deliverables defined over the predicate Sorted. It appears that we must eliminate the input parameter l using the permutation relation, which moves the condition Sorted(m) from being a condition on a result to being a condition on the input to scons. This is the reduction in case (b) above, from

∀a : α.∀l, m:list α.(Sorted (m) ∧ l ∼ m) ⟹ (Sorted (scons a m) ∧ a :: l ∼ (scons a m)

to

∀a : α.∀m:list α.Sorted (m) ⟹ (Sorted (scons a m) ∧ a :: m ∼ (scons a m)

This shift allows us to apply the principle of Sorted List Induction.

This is rather inconvenient, and moreover it seems that only ad hoc solutions exist to resolve the difficulty. Rather than attempt a detailed exposition here, we merely remark on the rather unsatisfactory nature of this step in our derivation. The details are in [25].

We outline the significant refinement steps in the derivation.

We seek, as a top-level goal

1 insertsort_{\overline{}}SortSpec [1]

where SortSpec l m =def Sorted(m) ∧ l ∼ m.

The outermost recursion uses the Listrec_{2} combinator, which we apply after splitting the initial goal with the composition operator.

\frac{1 base_{\overline{}}?1 [1] ?1 step_{\overline{}}SortSpec [1]}{1 insertsort_{\overline{}}SortSpec [1]} (compose)

\frac{Πa:α. SortSpec Fstep ; \overline{}(cons a)^{⋆}SortSpec [1_{list α}]}{?1 step_{\overline{}}SortSpec [1]}(Listrec_{2})

instantiates subgoal ?1 with the specification nil^{⋆}SortSpec.

The base case of this recursion/induction is resolved by a pointwise construction. Moreover, we can prove that any permutation of the nil list must be equal to nil, and the nil list is trivially sorted. Hence we obtain the correct instantiation

\frac{value = nil proof : Sorted(nil) ∧ nil ∼ nil}{1 base_{\overline{}}nil^{⋆}SortSpec [1]} (pointwise)

The step case is a little more complicated. We first introduce the parameter a : α in the Listrec_{2} rule. Recall that the algorithm we considered above contains a let construct.

fun scons a l = let val (b,m) = listrec (a,nil) swapcons  l
                 in b::m
                  end;

Now composition of deliverables explicates the let construct. For the second component of this composition, we just use the second-order deliverable analogue of the trivial construction of Section 3. We then fold this function into a relativised specification, with which we pursue the inner recursion/induction:

\frac{SortSpec \overline{}SortSpec′ [1] \frac{function = λp:α × listα. π_{1}(p) :: π_{2}(p)}{SortSpec′ \overline{}(cons a)^{⋆}SortSpec [1]} (functional)}{SortSpec Fstep a ; \overline{}cons a^{⋆}SortSpec [1]} (compose)

where SortSpec′ =def (λp:α × listα. π_{1}(p) :: π_{2}(p))^{⋆}(cons a)^{⋆}SortSpec

Eliding the details, we massage the goal SortSpec \overline{}SortSpec′ [1] into a form in which we may exploit the principle of Sorted List Induction. It turns out that the target specification remains as SortSpec′:

\frac{\frac{1 \overline{}SortSpec′ [Sorted]}{⋯}}{SortSpec \overline{}SortSpec′ [1]}

As indicated above, we are now in a position to use the depListrec_{2} combinator. Again, we preface its application with an appeal to composition.

\frac{1 base′_{\overline{}}? [Sorted] ? step′_{\overline{}}SortSpec [Sorted]}{1 \overline{}SortSpec [Sorted]} (compose)

\frac{Πb:α. SortSpec′ Gstep′ ; \overline{}(cons b)^{⋆}SortSpec′ [(cons b)^{⋆}Sorted]}{? \overline{}SortSpec′ [Sorted]}(depListrec_{2})

endlegolist The proof concludes by considering a pointwise construction in the base case of the induction,

\frac{value = (a, nil) proof : Sorted([a]) ∧ [a] ∼ [a]}{1 base′_{\overline{}}nil^{⋆}(SortSpec′) [Sorted]}(pointwise)

and then an account of the verification of the swapcons function in the step′ case. We omit the details, which exploit the informal argument of Lemma 5.1.

6 A set-theoretic model

In the foregoing discussion, our emphasis lay on using and constructing deliverables in the context of a particular type theory and its machine implementation. However, the idea of deliverables need not be restricted to this particular seeting. We observed that one could model deliverables in the framework of elementary set theory. The thesis [25] gives a detailed categorical account of this model, showing how it supports the interpretation of a subtheory of ECC. Indeed, the model is parametric in the choice of an underlying topos(categorical model of set theory). We sketch the main ideas. We refer the reader to [25] for a complete account.

In this interpretation, a (closed) type is given by a pair of sets (A, A′), with A′ ⊆ A. In particular, the type Prop of propositions, is given by the pair (Ω, Ω), where Ω is the subobject classifier. A morphism between such objects is given by the obvious abstract notion of firstorder deliverable, i.e. an arrow on the underlying sets which respects the distinguished subsets. This data gives us an interpretation of contexts and morphisms between them.

Types in a given context Γ = (X_{0}, X_{1}) are given by the relativised specifications, i.e. pairs of sets (A, R), where now R ⊆ X_{0} × A. Without going into further detail, this structure gives rise to a fibration, whose fibres essentially consist of the second-order deliverables described above. Moreover, this fibration has sums, products and a small subfibration and thus supports an interpretation of the “Prop:Type_{0}:Type_{1}′′ fragment of ECC. In the presence of set-theoretic universes, given for example by inaccesible cardinals, we may model the whole of ECC.

7 Related work

Two approaches to a logical account of formal program development are well known. The first relies on annotating programs with logical formulae, and expressing the correctness of a program in terms of logical deductions. This has its origins in the work of Floyd, Hoare and others in the ’Sixties [14, for example]. The idea of a deliverable clearly has echoes of this idea, but brought into the functional setting. It also avoids the defect of the Floyd/Hoare style in having object language and meta-logical variables on the same footing as object variables of our chosen type theory.

The second approach, based on various intuitionistic type theories, has been to develop constructive proofs, and use realisability techniques to extract algorithmic information. Both Martin-Löf type theory [5, 29] and the Calculus of Constructions [6, 30, 31] have been used in this style. Our work uses ideas from both these schools. Most influential has been the theory of subsets in Martin-Löf type theory. This has been given an eloquent treatment in [29, Chapter 18], to which the reader is referred for a detailed discussion. The central problem in using constructive proofs as a programming discipline is that proofs contain redundant information. Dependent types allow us to express logical predicates as types, but do not permit the representation of any more recursive functions. For the Calculus of Constructions, this has a precise statement in the result of Berardi and Mohring [30, 2]: Theorem CC is conservative over F_{ω}. Consequently, CC can represent, in the standard (Church) representation of functions on inductive types, no more functions than F_{ω}. The proof is based on a syntactic mapping, the so-called Berardi-Mohring projection. Mohring used this mapping as an extraction function, which, coupled with the associated realisability predicate, allows a powerful and flexible approach to program development from proofs. Under this interpretation, an arbitrary type is interpreted as a type, together with a predicate (the realisability predicate) defined over it.

The approach taken in [29] is to separate computationally relevant proofs from the purely logical, via a translation of the judgments of the basic formal system into multiple judgments. This translation permits the formation of a “subset type” {x ∈ A|B(x)}, for which a reasonable elimination rule may be given. An attempt to equip the basic theory with such a type (which may be used to precisely hide the information of the precise nature of a proof that predicate B(x) holds) yields very unsatisfactory results [33, 34, 29].

Given the basic theory of types and terms in Martin-Löf type theory, the first step is to extend the theory with a notion of proposition and a judgment P true for propositions. This is very straightforward, using propositions as types. A proposition is just a type in the basic theory. A proposition is true if there is some element inhabiting it, again in the basic theory. This seemingly innocent proof-irrelevance gives the subset theory its power.

The subset theory now interprets the basic judgment

A set

of Martin-Löf type theory as two judgments in the underlying theory, prescribing

• a set A′ in the basic theory, and

• a family of propositions A′′(x) prop [x ∈ A′], again in the basic theory.

This corresponds to our definition of specification in Section 3.

Equality of sets A, B is based on equality of the underlying sets A′, B′, but uses logical equivalence of the families A′′, B′′. We rejected such a choice, in favour of the decidable relation of convertibility in ECC.

The membership judgment a ∈ A is interpreted in the obvious way: we may derive a ∈ A if we can derive a ∈ A′ and A′′(a) true in the basic theory. This captures the essential idea, that the judgments A set and a ∈ A should describe subsets of the terms in A′ in the underlying theory. In this way, the proofs of the propositions A′′(a) are systematically suppressed. It is then relatively straightforward to see how this allows the interpretation of a subset-type constructor.

How does this compare with our approach? The resulting expressions for the various type constructors are very similar, compare for example the definition of exponential for second-order deliverables with the Π-type in the subset interpretation. We consider explicit proofs of the propositional parts of our specifications, whereas we need only know that some proof may be derived in the subset theory. However, this seems to be one of the limitations of their approach, in that we only know that certain derivations in the subset theory arise from certain other derivations. Our use of Σ-types, by contrast, means that we can represent the derivations of deliverables as actual terms within ECC, using the definable combinators which code up the explicit translation. The price we pay seems to be that we have to work with a rather clumsy language for these terms, as opposed to the conceptual elegance of reusing the basic language of types and terms in the subset theory.

The NuPrl system, developed by Constable and his co-workers [5], is based on early versions of Martin-Löf’s type theory. In particular, the underlying term calculus is untyped, and the system has extensional equality types. This has the advantage of suppressing some irrelevant information in proofs. It also overcomes the limitations on the use of an explicit subset-type constructor in a theory with intensional equality, exposed in [33, 34]. The sovereign disadvantage is that the basic judgments of the theory become undecidable, coupled with a proliferation of well-formedness conditions in the application of the rules.

Recently, Hayashi has also proposed a system based on realisability, which abandons the usual type constructors Π, Σ, on which most work to date on type theory has been based, in favour of a more set-theoretic style, with union, intersection and singleton types [13]. The system he considers is, however, ingenious enough to represent dependent products and dependent sums. At the same time, the typing rules for union and intersection hide information. This allows a simple translation or extraction into a programming language with a polymorphic type discipline. Singleton types seem essential in achieving this harmony between the type system and the underlying untyped terms.

Pavlovič, in his thesis [32], elaborates in categorical terms a theory of constructions in which programs do not depend on proofs of logical propositions. As with the models of Constructions considered by Hyland and Pitts [18], the emphasis is on extensional systems, rather than the intensional system we work with here. Proof-theoretic properties seem to be regarded as something “… an implementation would have to answer” [32, p.8].

8 Conclusions

We have described a proof development method which takes as its basic entity a program plus its correctness proof. If the programs are functional these program proof-pairs admit exactly the same combination operators as do functions. We have studied the mathematical theory of such program proof-pairs and the operations which combine them, and we have considered the case where the pre- and postconditions are contextually linked to express a relationship between input and output. The combination operations have been coded within the Lego proof system; a number of examples have been developed in Lego, and some metatheoretic results about the operations have been proved in Lego.

Acknowledgements

We would like to thank Randy Pollack for the Lego system and Zhaohui Luo for his contribution to its theoretical underpinning. We also thank our colleagues in the Lego Club for friendly comments and stimulation. We thank Per Martin-Löf, Gordon Plotkin and Susumu Hayashi for helpful comments on presentations of this work.

References

[1] J.Bénabou, Fibred categories and the foundations of naïve category theory, JSL, 1985.

[2] S. Berardi, Type Dependence and Constructive Mathematics, Ph.D. thesis, Dipartimento di Informatica, Torino, Italy 1990.

[3] N.G. de Bruijn, A survey of the project AUTOMATH , in: [36].

[4] R.M.Burstall and J.H.McKinna, Deliverables: an approach to program development in Constructions, in [17], also available as a University of Edinburgh technical report ECS-LFCS-91-133.

[5] R.Constable et al., Implementing Mathematics with the NuPrl Proof Development System, Prentice-Hall, New Jersey, 1986.

[6] T.Coquand and G.Huet, Constructions: a Higher-order Proof system for mechanizing mathematics, in: Proceedings EUROCAL ’85, LNCS 203, Springer-Verlag, 1985.

[7] T.Coquand, Metamathematical Investigations of a Calculus of Constructions, in: [16].

[8] P-L.Curien, Categorical Combinators, Sequential Algorithms and Functional Programming, Pitman Research Notes in Theoretical Computer Science, Pitman, London, 1986.

[9] E.W.Dijkstra, Guarded Commands, Nondeterminacy and Formal Derivation of Programs, in: Communications of the ACM, Vol. 18, 1975.

[10] J-Y.Girard, Interpretation fonctionelle et élimination des coupures dans l’arithmétique de l’ordre supérieure, thesis, University of Paris VII, 1972.

[11] R.Harper and R.A.Pollack, Type checking with universes, in: Theoretical Computer Science, Vol. 89, North-Holland, Amsterdam, 1991.

[12] S.Hayashi, Adjunction of semifunctors: categorical structures in nonextensional lambda calculus, in Theoretical Computer Science, Vol. 41, North-Holland, Amsterdam, 1985.

[13] S.Hayashi, Singleton, Union and Intersection Types for Program Extraction, in: Proceedings of TACS ’91, Sendai, Japan, Springer LNCS 526, Springer-Verlag, 1991.

[14] C.A.R.Hoare, An axiomatic basis for computer programming, in: Communications of the ACM, Vol. 12, 1969.

[15] W.A.Howard, The “formulae-as-types” notion of construction, in: [36].

[16] G.Huet, T.Coquand, C.Paulin-Mohring et al., The Calculus of Constructions, Version 4.10, Documentation and user’s manual, Rapports Techniques no.110, Projet Formel, INRIA-Rocquencourt, Paris, August 1989.

[17] G.Huet and G.Plotkin, eds. Electronic Proceedings of the First Annual BRA Workshop on Logical Frameworks, Antibes, May 1990,, distributed electronically to participating BRA sites, January 1991.

[18] J.M.E.Hyland and A.M.Pitts, The Theory of Constructions: Categorical Semantics and Topos-theoretic models, in: Proceedings of the AMS Conference on Categories in Computer Science, Boulder, Colorado, 1986.

[19] P.T.Johnstone and R.Paré, eds., Indexed Categories and their Applications, Springer LNM 661, Springer-Verlag, 1978.

[20] J.Lambek and P.J.Scott, An Introduction to Higher-Order Categorical Logic, Cambridge Studies in Advanced Mathematics no. 7, Cambridge University Press, Cambridge, England, 1986.

[21] Z.Luo, ECC, an Extended Calculus of Constructions, in: Proceedings of the Fourth IEEE Conference on Logic in Computer Science, Asilomar, California, 1989.

[22] Z.Luo, An Extended Calculus of Constructions, Ph.D. Thesis, Department of Computer Science, University of Edinburgh, June 1990.

[23] Z.Luo, Program Specification and Data Refinement in Type Theory, Technical Report ECS-LFCS-90-131, Department of Computer Science, University of Edinburgh, January 1991.

[24] Z.Luo and R.Pollack, LEGO Proof Development System: User’s Manual, LFCS Technical Report ECS–LFCS–92-211, 1992.

[25] J.H.McKinna, Deliverables: a categorical approach to program development in type theory, Ph.D. thesis, University of Edinburgh, 1992.

[26] P.Martin-Löf, An Intuitionistic Theory of Types: Predicative part, in: Logic Colloquium 73, North-Holland, Amsterdam, 1975.

[27] P.Martin-Löf, Constructive Mathematics and Computer Programming, in: proceedings of the Conference on Logic, Philosophy and Methodology of Science VI, 1979, North-Holland, Amsterdam, 1982.

[28] M.Mendler, The Logic of Design, Ph.D. thesis, University of Edinburgh, forthcoming, 1992.

[29] B.Nordström, K.Petersson, and J.Smith, Programming in Martin-Löf’s type theory, Oxford University Press, 1990.

[30] C.Paulin-Mohring, Extracting F_{ω}’s programs from proofs in the Calculus of Constructions, in: Proceedings POPL89, ACM, 1989.

[31] C.Paulin-Mohring and B.Werner, Extracting and Executing Programs developed in the Inductive Constructions System: a Progress Report, in: [17].

[32] D.Pavlovič, Predicates and Fibrations, proefschrift, University of Utrecht, 1990.

[33] A.Salvesen and J.Smith, On the strength of the subset type in Martin-Löf’s type theory, in: Proceedings of the Third LICS Symposium, IEEE, 1988.

[34] A.Salvesen, On Information Discharging and Retrieval in Martin-Löf’s type theory, Ph.D. thesis, Institute of Informatics, University of Oslo, 1989.

[35] D.Sannella, Formal specification of ML programs, LFCS technical report ECS-LFCS-86-15, Dept. of Computer Science, University of Edinburgh, 1986.

[36] J.P.Seldin and J.R.Hindley, eds., To H.B.Curry, essays in Combinatory Logic, λ-calculus and Formalism, Academic Press, 1980.

[37] S.Stenlund, Combinators, λ-calculus and Proof Theory, D.Reidel, Dordrecht, 1972.

Pattern Matching with Dependent Types

Thierry Coquand^{∗} Chalmers University

Preliminary version, June 1992

Introduction

This note deals with notation in type theory. The definition of a function by pattern matching is by now common, and quite important in practice, in functional programming languages (see for instance [1]). We try here to introduce such definitions by pattern matching in Martin-Löf’s logical framework.

1 Statement of the Problem

1.1 A Short Presentation of Martin-Löf’s Logical Framework

For a more complete presentation of Martin-Löf’s logical framework, which is implemented in ALF, we refer to the book “Programming in Martin-Löf’s Type Theory” [16], chapter 19 and 20. We recall that each type T is of the form (x_{1} : A_{1}, …, x_{n} : A_{n})A where A is Set or of the form El(a). If A is of the form El(a), we say that T is an small type, and it is a large type otherwise if A is Set. If a type of a term is of the form (x_{1} : A_{1}, …, x_{n} : A_{n})A, we say that n is the arity of this term. An instance of a term u of arity n is a term definitionally equal to a term of the form u(v_{1}, …, v_{n}).

A context is a list of type declaration Γ = x_{1} : A_{1}, …, x_{n} : A_{n}. As in [19], we relativize all judgements of type theory with respect to a context. An interpretation or contextual mapping between two contexts Γ = x_{1} : A_{1}, …, x_{n} : A_{n} and Δ = y_{1} : B_{1}, …, y_{m} : B_{m} is a simulateneous substitution S = {y_{1} := v_{1}, …, y_{m} := v_{m}} such that

v_{1} : B_{1} (Γ), v_{2} : B_{2}[v_{1}] (Γ), …, v_{m} : B_{m}[v_{1}, …, v_{m−1}] (Γ)^{1}.

We write in this case S : Γ → Δ. If M is an open expression in Δ, we write by simple juxtaposition MS the result of the substitution S to M. Notice that if A is a type in Δ then AS is a type in Γ, and if a : A (Δ), then aS : AS (Γ).

If T_{1} : Γ_{1} → Γ and T_{2} : Γ_{2} → Γ_{1} we write T_{2}; T_{1} : Γ_{2} → Γ the composition of T_{1} and T_{2}.

Martin-Löf’s logical framework is an open framework: the user can add new constants and new computation rules.

∗coquand@cs.chalmers.se

1If v_{i} is definitionally equal to y_{i}, we omit y_{i} := v_{i} in the writing of the interpretation; thus, {x := 0} is a contextual mapping from y : N to x : N, y : N meaning {x := 0, y := y}.

For instance, we get the Σ sets by declaring the constants ^{2}:

Σ : (X : Set, (X)Set) Set
pair : (X : Set, Y : (X)Set) (x : X, Y (x)) Σ(X, Y)

split :

(X : Set, Y : (X)Set) (Z : (Σ(X, Y))Set)

((x : X, y : Y (x))Z(pair(X, Y, x, y)))
(w : Σ(X, Y))
Z(w)

and asserting the equality (which can be read as a computation rule):

split(A, B, Z, z, pair(A, B, a, b)) = z(a, b) : Z(pair(A, B, x, y))

where

A : Set,
B : (A) Set,
Z : (Σ(A, B)) Set
a : A,
b : B(a)
z : (x : A, y : B(x)) Z(pair(A, B, a, b))

The usual cartesian product is defined by

A × B = Σ(A, (x)B) : Set [A : Set, B : Set]

The set of natural numbers is introduced by declaring the constants:

N : Set
0 : N
succ : (N) N
natrec : (C : (x : N) Set, C(0), (x : N, y : C(x) C(succ(x)), n : N)C(n)

and the equalities (which can be read as computation rules): natrec(C, x, z, 0) = x : C(0)

natrec(C, x, z, succ(a)) = z(a, natrec(C, x, z, a))

where

C : (x : N) Set
x : C(0)
z : (x : N, y : C(x)) C(succ(x))

The computation rules generate the definitional equality between terms.

2We allow ourselves to write in general A instead of El(A).

Quite important is the distinction between canonical and non-canonical constants. In the examples above, Σ, pair N, 0 and succ are canonical constants, but split, natrec and × are non canonical.

If the type of a canonical constant C is of the form (x_{1} : A_{1}, …, x_{n} : A_{n})Set, we say that C is a connective. The meaning of a connective C is given by a set of canonical constants of types of the form (y_{1} : B_{1}, …, y_{m} : B_{m})El(C(a_{1}, …, a_{n})), that are called constructors of C. (In the case of mutual inductive definitions, we can have a set of connectives that are simultaneously defined by a set of canonical constants.) By extension, we consider also that connectives are constructors of the type Set.

A canonical constant whose type is a small type is considered to be a primitive notion, that is self-justifying. In the example above, 0 and succ are considered to be primitive notions, and the canonical set N is defined by its set of constructors 0 and succ.

We say that a term is in constructor form iff it is definitionally equal to a term of the form c(u_{1}, …, u_{n}) where c is a constructor of arity n. The constructor c is then uniquely determined. We say that a term t is directly structurally smaller than a term u iff

• both u and v are of small types and of arity 0,

• u is of constructor form c(a_{1}, …, a_{n}) and t is definitionally equal to one a_{j} of arity 0 or one instance of one a_{j} of arity > 0.

Being structurally smaller is defined by taking the transitive closure of this relation.

We use in an essential way the “no confusion” property of constructors. This covers two properties. The first is that a definitional equality between two terms of the form a(u_{1}, …, u_{n}) and b(v_{1}, …, v_{m}) if a and b are two distinct constructors, cannot hold. The second is that, if c is a constructor of type (x_{1} : A_{1}, …, x_{n} : A_{n})A, then the equality c(u_{1}, …, u_{n}) = c(v_{1}, …, v_{n}) : A[u_{1}, …, u_{n}] implies

u_{1} = v_{1} : A_{1}, …, u_{n} = v_{n} : A_{n}[u_{1}, …, u_{n−1}].

The non canonical constant × is explicitely defined in term of split.

The definitions of split and natrec are not explicit, and we refer to these constants as implicitely defined constants. The meaning of implicitely defined constants is given by their computation rules.

It is an important problem to give some criteria that ensure the correctness of the addition of new constants and computation rules. We try here to analyse this problem using the pattern matching notation introduced in functional languages (see for instance [1]).

1.2 Inductively defined connectives

We shall consider only connectives that are inductively defined The relation of being structurally smaller is then expected to be well-founded. We shall take this well-foundness property as a fundamental assumption on the constructors, without trying to analyse it further here. We simply mention that the constructors presented in [7, 8] satisfy this well-foundness property.

Here are two counter-examples.

The set

V : Set,

with one constructor

Λ : ((A : Set)(A)A)V.

The polymorphic identity (A, x)x is of type (A : Set)(A)A, and hence the term Λ((A, x)x) is of type V. This term is structurally smaller than itself. It follows that the relation of being structurally smaller is not well-founded.

Likewise, the set

U : Set,

with one constructor

c : (Set)U,

has to be rejected. The reason is however more subtle than for the previous counter-example. We notice first that, were this set accepted, so would be T : (U)Set by T (c(X)) = X : Set. We could then introduce a set W : Set with only one constructor sup : (x : U)((T (x))W)W (which is inductively defined given U, T). But then sup(c(W), (x)x) is structurally smaller than itself.

The first example, suggested by a remark of Per Martin-Löf, shows that the well-foundness requirement on the relation of being structurally smaller is a stronger requirement than mere normalisation. Indeed the set V is defined by a second-order quantification, and it can be shown, by the usual reducibility method, that its addition to inductively defined sets preserves the normalisation property.

1.3 Some difficulties with the usual elimination schemas

It is known how to associate to any inductively defined connective an elimination constant, together with its computation rules. This is described for instance in [6]. One can check that all the examples of implicitely defined constants and computations rules described in [16] are of this form. A first criteria for ensuring the correctness of the addition of new constants and computation rules is to allow only the addition of such elimination constants. Experiments with restricting the addition of implicitely defined constants to be elimination constants have shown some drawbacks of this approach.

One first drawback is that we do not quite get the expected computational behaviour. If we define for instance add : (N; N)N by add(x, y) = natrec(y, x, (u, v)succ(v)), then add(x, succ(y)) reduces to succ(natrec(y, x, (u, v)succ(v)) and one needs to fold back this expression to get the expected succ(add(x, y)).

One second drawback is readability. For instance, we want to consider an object such as half : (N)N defined by

half(0) = 0, half(succ(0)) = 0, half(succ(succ(x))) = succ(half(x)),

as given directly by these equations, rather than being given by an explicit definition which is a “coding” of this object in term of natrec.

The second drawback is in practice quite important. The pattern matching notation is essential in functional programming languages^{3}.

The next anomaly is the necessity to consider higher “sets” for defining naturally a function such as inf : (N; N)N. It is quite surprising that, in order to justify the equations

inf(0, y) = 0, inf(succ(x), 0) = 0, inf(succ(x), succ(y)) = succ(inf(x, y)),

one needs to introduce the set of numerical functions.

Another problem appeared for inductively defined families. Given a connective with an arity > 1, there are several possible elimination constants depending on what arguments are considered to be parameters. For instance, there are two different elimination constants for the connective Id : (A : Set, x, y : A)Set of unique constructor refl : (A : Set; x : A)Id(A, x, x). In this case, it is yet unknown if these two elimination constants are equivalent.

The first and, in particular, second drawbacks are strong motivations for allowing the introduction of implicitely defined constants defined by computation rules that are pattern matching equations. This seems to solve in general the third anomaly. In an unexpected way, this seems to have some bearing on the fourth problem, as we will try to explain below.

2 A General Presentation of Pattern Matching

There are two independent requirements for the correctness of the introduction of one implicitely defined constant together with its computation rules. These requirements are only sufficient in ensuring that the constant does define a total function on the underlying datatype.

The first is the requirement that all definitions, that may be recursive, are well-founded. The second is that the equations cover all possible cases of the arguments and do not

introduce ambiguities in the computation. We ensure this by imposing the definitions to be exhaustive and mutually disjoint.

2.1 Well-founded Definitions

A simple condition ensures the fact that all definitions are well-founded, and seem furthermore sufficient in practice. Let n be the arity of the implicitely defined constant f to be defined. The condition is that there exists an index i ≤ n such that, for all equations f(u_{1}, …, u_{n}) = e, and all recursive call f(v_{1}, …, v_{n}) of f in e, the constant f does not occur in v_{1}, …, v_{n} and the term v_{i} is structurally smaller than the term u_{i}.

It would be possible to give a less restrictive condition, by considering instead a lexicographic extension of the structural ordering. However, this restriction suffices to recover the usual elimination schemas. It is also quite simple to ensure that this condition holds.

Notice that this condition provides more general equations than the ones provided by the usual primitive recursive schema. In the usual primitive recursive schema indeed, the parameters cannot vary in recursive calls. This is not required here.

3The earliest, to our knowledge, mention of this notation appears in [2]. A proposal of extending functional language with an “inductive” case expression, which hence ensures termination, is presented in [3].

For instance, this will justify directly the following kind of definitions of a a function f : (N, N)N.

f(0, m) = g(m), f(succ(n), m) = h(n, m, f(n, k(n, m))),

where g : (N)N, h : (N, N, N)N and k : (N, N)N are previously defined functions. Notice that the parameter m changes to k(n, m) in the recursive call of f. This can be done only using the set of numerical function if we restrict ourselves the usual schema of primitive recursion (see [4]).

2.2 Covering

To analyse further the condition that the definitions are exhaustive and mutually disjoint, we introduce one notion reminiscent of a notion used in Per Martin-Löf’s representation of choice sequences in type theory.

Let us motivate briefly what follows. We want to add a new implicitely defined constant f of type (x_{1} : A_{1}, …, x_{n} : A_{n})A, together with a set of computation rules. Let Δ be the context x_{1} : A_{1}, …, x_{n} : A_{n} of arguments of f. We only consider computation rules for f of the form

f(a_{1}, …, a_{n}) = e : A[a_{1}, …, a_{n}] (Γ),

with a_{1} : A_{1}, …, a_{n} : A_{n}[a_{1}, …, a_{n−1}]. We can think of a_{1}, …, a_{n} as defining a contextual mapping S : Γ → Δ, and this suggests to introduce the notation f(S) = e : AS (Γ) for such a computation rule.

With this notation, the conditions on a system of computation rules f(S_{j}) = e_{j} : AS_{j} (Γ_{j}) will be expressed as conditions on a system of contextual mappings S_{j} : Γ_{j} → Δ. We want to express that such a system defines a “partition of the space defined by Δ.”

We are going to analyse this problem in the same way that pattern matching in ordinary functional languages is reduced to a succession of case expressions over a variable (see [1]).

We say first that a system of contextual mapping S_{1} : Γ_{1} → Δ, …, S_{m} : Γ_{m} → Δ over a common context Δ = x_{1} : A_{1}, …, x_{n} : A_{n} is an elementary covering of Δ iff there exists an index i ≤ n such that

• all terms x_{i}S_{j} : A_{i}S_{j} (Γ_{j}), for j ≤ m, are in constructor form,

• if S : Γ → Δ is a contextual mapping such that x_{i}S is in constructor form, then there exists one and only one j ≤ m and T : Γ → Γ_{j} such that S = T; S_{j}.

This definition may look complicated but it is a possible way of specifying what is a case expression over the ith argument. In the case of a context with only non dependent types, we recover the usual notion of case expression as in [1]. In the general case however, we cannot keep the same notion of patterns of [1] (as the examples below will show, we need for instance to consider non linear patterns), and our abstract definition seems necessary.

An instance is the elementary covering defined by x = 0 and x = succ(y) (y : N) of the context x : N.

A second example is the empty set of contextual maps over the context

Δ = p : Id(N, 0, succ(0)).

This is an elementary covering. Indeed, the only constructor of the connective Id is refl, and a term of the form refl(A, u) cannot be of type Id(N, 0, succ(0)). Otherwise, we would have

Id(N, 0, succ(0)) = Id(A, u, u),

and hence, because Id is a constructor, 0 = u : N and succ(0) = u : N. But this implies 0 = succ(0) : N, which does not hold, because 0 and succ are different constructors.

A more elaborate example is for the context

Δ = x, y : N; p, q : Id(N, x, y).

It can be checked that, if we define

Γ = x : N, p : Id(N, x, x),

then the unique contextual mapping

{y := x, q := refl(N, x)} : Γ → Δ,

defines an elementary covering of Δ. Indeed, this follows from the fact that refl is the only constructor of Id and that if refl(N, u) is of type Id(N, v, w), we have

Id(N, u, u) = Id(N, v, w) : Set,

and hence, since Id is a constructor, we have u = v : N and u = w : N.

We define now what it means for a system of contextual mapping S_{i} : Δ_{i} → Δ into a common context Δ to be a covering of Δ :

• the identity interpretation Δ → Δ is a covering of Δ,

• if S_{i} : Δ_{i} → Δ, for i ≤ p is an elementary covering of Δ and T_{ij} : Δ_{ij} → Δ_{i}, for j ≤ q_{i}, is a covering of Δ_{i}, then T_{ij}; S_{i} : Δ_{ij} → Δ is a covering of Δ.

For instance x = 0, together with x = succ(0) and x = succ(succ(y)) (y : N) define a covering of x : N.

An example of covering of the context Δ = x : N, y : N is given by

• {x := 0} : (y : N) → Δ,

• {x := succ(x_{1}), y := 0} : (x_{1} : N) → Δ and

• {x := succ(x_{1}), y := succ(y_{1})} : (x_{1} : N, y_{1} : N) → Δ.

If we take again our last example of an elementary covering, it can be checked that the unique contextual mapping

{p := refl(N, x)} : (x : N) → Γ,

is an elementary covering of Γ. Hence, the unique contextual mapping

{y := x, p := refl(N, x), q := refl(N, x)} : (x : N) → Δ,

is a covering of Δ = x, y : N; p, q : Id(N, x, y).

Following Per Martin-Löf’s terminology, we call neighbourhood of a context any contextual map that is part of a covering of this context. The collection of neighbourhoods of a covering of a context can be thought of as defining a partition of the “space” defined by this context. This notion of neighbourhood corresponds to the notion of patterns used in functional programming languages: in the case of a context with only non dependent types, we recover exactly the notion of pattern matching described in [3, 1].

2.3 Sufficient Conditions For Correctness

The sufficient conditions ensuring the correctness of the addition of a new implicitely defined constant f of type (x_{1} : A_{1}, …, x_{n} : A_{n})A, of argument context Δ = x_{1} : A_{1}, …, x_{n} : A_{n} and of computation rules of the form f(S_{j}) = e_{j} : AS_{j} (Γ_{j}) are that:

• there is no nested occurence of f in e_{j}, and all recursive call of f are done on structurally smaller arguments than the lefthandside arguments (which can be ensured as described above),

• the system of contextual maps S_{j} : Γ_{j} → Δ is a covering of Δ.

2.4 Some comments on this method

The method followed here can be described as follows. When justifying a rule

f : (x_{1} : A_{1}, …, x_{n} : A_{n})A,

we analyse exhaustively the possible forms S of the arguments of f, and in each possible case S, we build a term e_{S} of type AS, using constructors and already defined constants.

We allow recursive calls of the constant we are defining, provided these calls are on structurally smaller arguments.

Naturally associated to this justification of an implicitely defined constant

f : (x_{1} : A_{1}, …, x_{n} : A_{n})

is the following computation rule for f. If a given argument (a_{1}, …, a_{n}) is an instance of the case S, then the value of f(a_{1}, …, a_{n}) is the value of the corresponding instance of e_{S}. Otherwise, the argument list of f is not “instantiated enough”, and f(a_{1}, …, a_{n}) cannot be head reduced.

2.5 Some Examples

The function inf : (N, N)N which is defined implicitely by:

inf(0, y) = 0, inf(succ(x), 0) = 0, inf(succ(x), succ(y)) = succ(inf(x, y)).

The recursive call is justified by the fact that it is structurally smaller on the first (or the second) argument.

It is standard how to reduce such a definition to the usual elimination rules over the type N, by using the set of numerical functions.

By contrast, it is not clear how to represent the following computation rule in term of the usual elimination rules^{4}. We have seen that the unique contextual mapping

{y := x, p := refl(N, x), q := refl(N, x)} : (x : N) → Δ,

is a covering of Δ = x, y : N; p, q : Id(N, x, y). It follows that it is correct to add a new constant f : (x, y : N; p, q : Id(N, x, y))Id(Id(N, x, y), p, q) together with the computation rule

f(x, x, refl(N, x), refl(N, x)) = refl(Id(N, x, x), refl(N, x)) (x : N)

The next example still concerns the connective Id. As we said before, there are two possible elimination rules over this connective, depending on what arguments are considered to be paramaters.

The first one, with the first argument is a parameter, is

F

:

(A : Set; C : (x, y : A; Id(A, x, y))Set;
d : (x : A)C(x, x, refl(A, x)); a, b : A; c : Id(A, a, b))
C(a, b, c)

of computation rule

F (A, C, d, a, a, refl(A, a)) = d(a) : C(a, a, refl(A, a)),

where

A : Set, C : (x, y : A; Id(A, x, y))Set, d : (x : A)C(x, x, refl(A, x)), a : A.

The second one, with the first two arguments are parameters, is

G

:

(A : Set; a : A; C : (y : A; Id(A, a, y))Set;
d : C(a, refl(A, a)); b : A; c : Id(A, a, b))
C(b, c)

of computation rule

G(A, a, C, d, a, refl(A, a)) = d : C(a, refl(A, a)),

where

A : Set, a : A, C : (y : A; Id(A, a, y))Set, d : C(a, refl(A, a)).

It can be checked that both constants satisfy the sufficient conditions for correctness given above. Only the covering condition has to be checked, because there is no recursive call.

The last example is the well-founded set connective:

W : (A : Set, B : (A)Set)Set,

of unique constructor

sup : (A : Set, B : (A)Set, a : A, u : (B(a))W(A, B))W(A, B).

4This problem has been independently suggested by Thomas Streicher.

We can introduce the implicitely defined constant

wrec :

(A : Set, B : (A)Set, C : (W(A, B))Set,

f : (a : A, u : (B(a))W(A, B), (x : B(a))C(u(x)))C(sup(A, B, u)), t : W(A, B))C(t)

with the computation rule

wrec(A, B, C, f, sup(A, B, a, u)) = f(a, u, (x)wrec(A, B, C, f, u(x))),

where

A : Set, B : (A)Set, C : (W(A, B))Set, f : (a : A, u : (B(a))W(A, B), (x : B(a))C(u(x))).

This is justified since u(x) is structurally smaller than sup(A, B, a, u).

3 How to build coverings

3.1 Unification Problem

If Δ is a context, A a type in Δ, and u, v two terms in Δ of type A, we define a solution of the unification problem

u = v : A (Δ)

to be a finite system of contextual mappings S_{j} : Γ_{j} → Δ such that

• for all j, we have uS_{j} = vS_{j} : AS_{j} (Γ_{j}), and

• if S : Γ → Δ is a contextual mapping such that uS = vS : AS (Γ), then there exists one and only one j and T : Γ → Γ_{j} such that T; S_{j} = S.

For a description of the unification problem with dependent types, see [18] and [9]. Since this problem contains already the similar problem for simply typed lambda-calculus, described in [13], we cannot expect to have a general algorithm to solve it. It is however possible to describe a simple algorithm^{5}, that has three possible outputs

• the system with no contextual mapping (this ensures that the unification problem has no solution),

• a system with exactly one contextual mapping (this ensures that the unification problem has a most general solution),

• the algorithm fails (which corresponds to a difficult unification problem).

5This algorithm is similar to the first-order unification algorithm, using the fundamental fact that constructors are one-to-one function.

3.2 Splitting Contexts

We give first a way to build elementary coverings, as it is implemented in ALF. We cannot ensure that this generates all possible elementary coverings, but it is not clear yet how to extend this algorithm, and whether such an extension is needed or not in practice.

Given a context

Δ = x_{1} : A_{1}, …, x_{n} : A_{n},

and an index i ≤ n such that A_{i} is a small type, we describe an operation called splitting the context Δ along i. This is an algorithm that tries to produce an elementary covering of Δ :

• if A_{i} is of arity > 0, or if A_{i} is not in constructor form, then the algorithm fails to produce any covering,

• otherwise, A_{i} is of the form El(C(u_{1}, …, u_{n})) and we can list all the constructors of the connectives C. For each such constructor c of type (y_{1} : B_{1}, …, y_{m} : B_{m})El(C(v_{1}, …, v_{m})), we apply the previous unification algorithm for the equation

C(u_{1}, …, u_{n}) = C(v_{1}, …, v_{n}) : Set (x_{1} : A_{1}, …, x_{i−1} : A_{i−1}, y_{1} : B_{1}, …, y_{m} : B_{m}),

and we collect all the solutions.

Given the fundamental “no confusion” property of constructor, this produces in case of success an elementary covering of Δ.

3.3 General Coverings

General coverings can now be built interactively. Given a context Δ, the user chooses an index i and tries to split Δ along i. If the system answers by giving an elementary covering, the user can then choose to split some of the new produced contexts, and so on, until the user stops eventually producing by composition a covering of Δ.

This interactive way of building coverings has been implemented in ALF, and seems in practice to be quite convenient for the user in ensuring that no cases have been forgotten during the definition of a function by pattern matching. This is in contrast with the usual presentation in functional languages, where one should write the possible cases, and the compiler warns the user that some cases have been forgotten.

The following is a semi-algorithm that checks whether or not a system of contextual mappings S_{j} : Γ_{j} → Δ is a covering^{6} (thanks to G. Huet).

First, the system with only the identity mapping is a covering. Otherwise, choose an index i such that all x_{i}S_{j} are in constructor form. Then, if possible, split Δ along i. If the answer is an elementary covering T_{i} : Δ_{i} → Δ of Δ, this induces a partition of the original system S_{j} : Γ_{j} → Δ into a system of mappings Γ_{j} → Δ_{i}. We then recursively check that each of these systems is a covering.

6If we think of a covering as a collection of disjoint “pieces” that form a partition of a space, this semialgorithm solves a typical “puzzle” problem. We are given some “pieces” of a space (contextual mapping), and we try to see whether or not they form a partition of this space.

4 Addition of Subsets

Kent Petersson, and independently A. Salvesen, suggested the following notion of subsets which seems to fit nicely with the present notion of implicitely defined constants. We limit here ourselves to the description of a simple example.

The meaning of a connective, such as N : Set, is given by the set of its constructors

0 : N, succ : (N)N.

It is quite natural to allow the introduction of (direct) subsets of N, that we get simply by selecting a subset of this set of constructors. For instance, we can introduce the subset ISZERO : Set with the only constructor 0, and the subset POS : Set with the only constructor succ.

This notion of subsets fits well with the present way of defining a function by pattern matching, where one important step is to list the constructors of a given connective.

For instance, the unique computation rule defines then correctly an implicitely defined function p : (POS)N.

p(succ(x_{1})) = x_{1} (x_{1} : N),

because the context x : POS is covered by the contextual mapping x = succ(x_{1}) : N (x_{1} : N).

We can dually allow the introduction of (direct) supersets of N, that we get by adding new constructors. Typically, the set of ordinals Ord : Set extends the set N by the addition of one constructor

lim : ((N)Ord)Ord.

The following computation rules define then correctly an implicitely defined function g : (Ord)N.

g(0) = 0, g(succ(x)) = succ(x), g(lim(u)) = g(u(0)).

This definition is justified since u(0) is structurally smaller than lim(u).

We can then define a general inclusion relation between connectives, by taking the transitive closure of the direct inclusion relation defined by the introduction of subsets and supersets. This is a decidable relation.

As the last example shows, the addition of subsets and supersets introduces some overloading facilities. These do not however compromise the decidability of the following problems:

• is the expression A a correct type in the context Γ?

• given a type A in the context Γ, is the expression a a correct term of type A in the context Γ?

as we can convince ourselves by noting that the usual algorithm for these problems apply almost without changes (using the decidability of the inclusion relation between connectives).

It is hoped that, with these new operations, one can represent rather faithfully the example presented in [15].

A more elaborate notion of subtypings appears in [11].

Conclusion

As an experiment of using pattern matching, we have done in ALF the Gilbreath Trick, presented by G. Huet last year [17], which is a non trivial inductive proof. This example shows well the gain in readibility that brings the pattern matching notation. While doing other experiments, it appeared that a quite useful extension of the system would be the introduction of case expressions for proofs, where the case is over a term that may not be in variable form. More generally, the goal seems to be to develop nice enough notations that will hopefully help the analysis of inductive arguments.

The method we follow here has some similarities with Lars Hallnäs notion of partial inductive definitions (see [12, 10]), and with the way proofs are represented in Elf [17]. What we do seems to correspond to a suggestion of [12] to use this notion as a “basis for a logical framework”. These connections have to be precised.

In the present analysis of pattern matching, a crucial rôle is played by the “no confusion” property of constructors. In “Language and Philosophical Problems,” [20], p. 163 - 167, S. Stenlund emphasizes from a philosophical perspective the importance of this property.

From a proof-theoretic viewpoint, our treatment can be characterized as fixing the meanings of the logical constants by the introduction rules. This possibility is discussed in [5], and constrasted to the dual possibility, which is to fix the meanings of logical constants by the elimination rules.

References

[1] Augustsson, L. “Compiling Pattern Matching.” In Compiling Lazy Functional Languages Part II, Ph. D. Thesis, Chalmers, 1987.

[2] Burstall, R.M. “Proving properties of programs by structural induction.” Computer Journal 12(1), p. 41 – 48, 1969.

[3] Burstall, R.M. “Inductively Defined Functions in Functional Programming Languages.” Journal of Computer and System Sciences, vol. 34, p. 409 – 421, 1987.

[4] Colson, L. “About Primitive Recursive Algorithms.” LNCS 372, p. 194 – 206, 1989.

[5] Dummett, M. (1991) The Logical Basis of Metaphysics. Duckworth ed.

[6] Dybjer, P. “Inductive Sets and Families in Martin-Löf’s Type Theory” Chalmers Report 62, also p. 280-306 in Logical Frameworks, eds. G. Huet and G. Plotkin, Cambridge University Press, 1991.

[7] Dybjer, P. “An inversion principle for Martin-Löf ’s type theory.” Proceedings of the Workshop on Programming Logic in Bastad, May 1989, Programming Methodology Group Report 54, p. 177-190.

[8] Dybjer, P. “Universes and a General Notion of Simultaneous Inductive-Recursive Definition in Type Theory.” in these proceedings.

[9] Elliott, C. M. “Higher-Order Unification with Dependent Function Types.” p. 121 – 136, Proc. Rewriting Techniques and Applications

[10] Eriksson, L.H. “A Finitary Version of the Calculus of Partial Inductive Definitions.” SICS research report, also to be published in LNCS, Proceedings of the Second Workshop on Extensions of Logic Programming.

[11] Freeman, T. and Pfenning, F. “Refinement Types for ML.” to appear in ACM SIGPLAN 1991, Conference on Programming Language Design and Implementation.

[12] Hallnäs, L. “Partial Inductive Definitions.” Theoretical Computer Science 87, 1991, p. 115 - 142.

[13] Huet, G. “A unification algorithm for typed λ-calculus.” Theoretical Computer Science, p. 27 – 57, 1975.

[14] Huet, G. “The Gilbreath Trick: A Case Study in Axiomatization and Proof Development in the COQ Proof Assistant.” Technical Report 1511, INRIA, September, 1991.

[15] Kahn, G. “Natural Semantics.” INRIA Technical report, 601, 1987.

[16] Nordström B., Petersson K., Smith. J. M. (1990), Programming in Martin-Löf Type Theory. Oxford Science Publications, Clarendon Press, Oxford.

[17] Pfenning, F. “Logic Programming in the LF logical framework” in G.Huet and G. Plotkin, Logical Frameworks, Cambridge University Press.

[18] Pym, D. Proofs, Search and Computation in General Logic. Thesis, University of Edinburgh, November 1990.

[19] Ranta. A. (1988), “Constructing possible worlds,” Mimeographed, University of Stockholm, to appear in Theoria.

[20] Stenlund, S. (1991), Language and Philosophical Problems. Routledge ed.

A proof of normalization for simply typed lambda calculus written in ALF

Catarina Coquand^{∗}

Preliminary version, august 1992

Abstract

We will in an semantic way define a normalization function by sructural induction for simply typed lambda calculus. First we write a function that evaluates the semantics of a term and then we define a coding that gives a term on normal form back. The work has been done in a fragment of type theory using the pattern matching of ALF[5][3].

Keywords and Phrases: Type Theory, Normalization, Proof Theory, Lambda Calculus.

1 Introduction

One aim of this work has been to show completely formally a proof of normalization of simply typed lambda calculus in such a way that it can, hopefully, be extended to type theory with dependent types. Another aim has been to gain experience in working in ALF and for example has this work suggested the pattern matching now implemented in ALF[3].

We will in this paper present a function by structural induction that computes the normal form of a term. This function is build up by two functions, one that evaluates the semantics of a term and one that from the semantics gives an eta-expanded term on normal form back. The idea that one could write an evaluation function like this was pointed out to me by Th. Coquand and P. Dybjer and Th. Coquand also pointed out that it was possible to write the coding back function.

The definitions below are all as in the implementation in ALF but the monomorphic type information has been taken away when this improves the readability. In ALF as it stands now there is no control that the functions are defined by structural induction, but it should be clear from the definitions that this is the case. It should also be clear that the definitions follows the schema presented in [4].

2 The theory

The theory used is Martin Löf’s type theory with intensional identity (Id), product (× with the pairing constructor < a, b >), one element set (T with constructor tt) and cartesian product of dependent types (Π with constructor λ.). For a full description of this see [NPS90]. Observe that we do not define the elimination rules instead we will use the pattern matching of ALF.

∗Programming Methodology Group. Department of Computer Sciences. Chalmers University of Technology and University of Göteborg. S-412 96 Göteborg, Sweden e-mail catarina@cs.chalmers.se

We will overload the notation Π and λ in the text below, in fact we define a Π each for the number of abstractions we make Π_{n}(A_{1}, … A_{n}, B). We will also write t ≡ t′ instead of Id(A, t, t′).

3 The syntax

The syntax of the lambda terms are standard except for that we have explicit substitution on the terms. Having explicit substitution is not essential in this paper but is probably usefull for future extensions.

3.1 Definitions of types

The types we have are base type and function type. The set of types

T ype : Set^{1}

is introduced by:

\overline{o : T ype}  \frac{A, B : T ype}{A→B : T ype}

Types will be named A, B, . . ..

3.2 Definition of contexts

A context is a list of types and the set of context

Context : Set

is introduced by:

\overline{[] : Context}  \frac{Γ : Context  A : T ype}{Γ.A : Context}

Context will be named Γ and Δ in the text below.

We also define the relation of extensions between contexts

≥: (Context; Context) Set

with the constructors:

\overline{ext_{0} : Γ ≥ Γ}  \frac{e : Γ ≥ Δ  A : T ype}{ext_{1}(e) : Γ.A ≥ Δ}  \frac{e : Γ ≥ Δ  A : T ype}{ext_{2}(e) : Γ.A ≥ Δ.A}

1Please, do not be confused by this

Notice how the third constructor simplifies the definition of shift below. Extensions will be named e below.

We will now define the transitivity function (or, if one wants, show the transitivity of ≥)

trans : (e_{1} : Γ_{1} ≥ Γ_{2}; e_{2} : Γ_{2} ≥ Γ_{3}) Γ_{1} ≥ Γ_{3}

The definition (or proof) is done by induction first on e_{1} and in the case ext_{2} by induction on e_{2}.

trans(ext_{0}, e) = e
trans(ext_{1}(e_{1}), e_{2}) = ext_{1}(trans(e_{1}, e_{2}))
trans(ext_{2}(e_{1}), ext_{0}) = ext_{2}(e)
trans(ext_{2}(e_{1}), ext_{1}(e_{2})) = ext_{1}(trans(e_{1}, e_{2}))
trans(ext_{2}(e_{1}), ext_{2}(e_{2})) = ext_{2}(trans(e_{1}, e_{2}))

We have that trans is associative, ie.

trans(e_{1}, trans(e_{2}, e_{3})) ≡ trans(trans(e1, e2), e3)

we also have that

trans(e, ext_{0}) ≡ e

3.3 Definition of variables, terms and substitutions

As said above the terms are defined in a standard way except for the explicit substitution. A substitution from a context Δ to a context Γ (denoted Subst(Δ, Γ)) is inuitively a list that associates to each variable of type A in Γ a term of type A in Δ. The substitutions we will have are the empty, updating, identity, composition, monotonicity and projection substitution. Variables are defined in a deBruijn-index style.

We will define the sets of variables, terms and substitutions

V ar : (T ype; Context) Set
T erm : (T ype; Context) Set
Subst : (Context; Context) Set

where the constructors of V ar are

\overline{var_{0} : V ar(A, Γ.A)}  \frac{v : V ar(A, Γ)}{var_{1}(v) : V ar(A, Γ.B)}

and the constructors of T erm are

\frac{t : T erm(A, Γ)  e : Δ ≥ Γ}{mon(t, e) : T erm(A, Δ)}  \overline{c : T erm(o, Γ)}

\frac{v : V ar(A, Γ)}{var(v) : T erm(A, Γ)}  \frac{t : T erm(B, Γ.A)}{lam(t) : T erm(A→B, Γ)}

\frac{t_{1} : T erm(A→B, Γ)  t_{2} : T erm(A, Γ)}{apply(t_{1}, t_{2}) : T erm(B, Γ)}  \frac{t : T erm(A, Γ)  s : Subst(Δ, Γ)}{subst(t, s) : T erm(A, Δ)}

and the constructors of Subst are

\overline{none : Subst(Γ, [])}  \frac{s : Subst(Δ, Γ)  t : T erm(A, Δ)}{\{s, t\} : Subst(Δ, Γ.A)}

\overline{s id : Subst(Γ, Γ)}  \frac{s_{1} : Subst(Γ_{1}, Γ_{2})  s_{2} : Subst(Γ_{2}, Γ_{3})}{s comp(s_{1}, s_{2}) : Subst(Γ_{1}, Γ_{3})}

\frac{s : Subst(Γ, Δ)  e : Γ′ ≥ Γ}{s mon(s, e) : Subst(Γ′, Δ)}  \frac{s : Subst(Γ, Δ)  e : Δ ≥ Δ′}{s proj(s, e) : Subst(Γ′, Δ′)}

Variables, terms and substitutions will benamed v, t, s respectively.

3.4 Definition of normal terms.

We will now define the set of normal terms. Simultaneously we define the set of applicative terms, that is, terms on the form apply^{n}(t, t_{1}, …, t_{n}) where t is a variable or a constant and t_{1}, …, t_{n} are normal and the set of normal terms where a normal term of base type is an applicative term and normal term of function type is lam(t) where t normal.

NF′ : (T ype; Context) Set
NF : (T ype; Context) Set

with the constructors:

\overline{nf c : NF′(o, Γ)}  \frac{v : V ar(A, Γ)}{nf var(v) : NF′(A, Γ)}

\frac{t1 : NF′(A→B, Γ) t2 : NF (A, Γ)}{nf apply(t1, t2) : NF′(B, Γ)}

\frac{NF′(o, Γ)}{nf o : NF (o, Γ)}  \frac{t : NF (B, Γ.A)}{nf lam(t) : NF (A→B, Γ)}

It is easy to see that there are a direct injection from the normal terms to the ordinary terms. (Here one would have liked a notion of subsets, but this does not exist in ALF … yet.)

We will now define a “shift” - function on normal terms. Roughly “shift” on a variable takes v : V ar(A, Γ) to var_{1}^{n}(v) : V ar(A, Γ.A_{1} … A_{n}).

shift var : (V ar(A, Γ); Δ ≥ Γ)) V ar(A, Δ)
shift′ : (NF′(A, Γ); Δ ≥ Γ) NF′(A, Δ)
shift : (NF (A, Γ); Δ ≥ Γ) NF (A, Δ)

In the definition below we will overload shift, it should be clear from the typing which is which. Notice in the last case of lam the crucial role of ext_{2}

shift(v, ext_{0}) = v
shift(v, ext_{1}(e)) = var_{1}(shift(v, e))
shift(var_{0}(A, Γ), ext_{2}(Γ, Δ, e)) = var_{0}(A, Δ)
shift(var_{1}(v), ext_{2}(e)) = var_{1}(shift(v, e))
shift(nf c(Γ), e) = nf c(Δ)
shift(nf var(v), e) = nf var(shift var(v, e))
shift(nf apply(t_{1}, t_{2}), e) = nf apply(shift(t_{1}, e), shift(t_{2}, e))
shift(nf o(t), e) = nf o(shift(t, e))
shift(nf lam(t), e) = nf lam(shift(t, ext_{2}(e)))

We have

shift(shift(t, e1), e2) ≡ shift(t, trans(e1, e2))

and

shift(t, ext_{0}) ≡ t

4 Semantics

The semantics of a term of base type is a term on normal form; for a term of function type it is for any extension of the context to take a value in the bigger context to a value in the bigger context. This definition is inspired by Kripke semantics seeing contexts with the relation of extension as possible worlds [2].

V : (T ype; Context) Set

V(o, Δ) = NF (o, Δ)
V(A→B, Δ) = Π Γ ≥ Δ. V(A, Γ) ⇒ V(B, Γ)

We will name values by v and u below.

We define an environment in which a term will be evaluated. The environment associates a value for each variable in a context.

E : (Context; Context) Set

E([], Δ) = ⊤
E(Γ.A, Δ) = E(Γ, Δ) × V(A, Δ)

Environments will be named ρ below.

We define a function that takes a value in Γ to a value in an extension of the context.

mon_{V} : (A ∈ T ype; V(A, Δ); Γ ≥ Δ) V(A, Γ)

The function is defined by induction on the type.

mon_{V} (o, t, e) = shift(t, e)
mon_{V} (A→B, λ(f), e) = λ e′ ∈ Δ′ ≥ Δ, v ∈ V(A, Δ′).f(trans(e′, e), v)

In the second case we obtained λ(f) by pattern matching on the value that for the function type is a Π.

We have a corresponding function for the environment, defined by induction on the first context.

mon_{E} : ( E(Γ, Δ); Δ′ ≥ Δ) E(Γ, Δ′)
mon_{E}([], e, ρ) = tt
mon_{E}(Γ.A, e, < ρ, u >) = < mon_{E}(Γ, e, ρ), u >

In the second case we obtained < ρ, u > by pattern matching since the environment is of type E(Γ.A, Δ) which is defined as a product.

We define the projection of a context that takes out a part of the environment.

proj_{E} : ( E(Γ, Δ); Γ ≥ Γ′) E(Γ′, Δ)

proj_{E}(ext_{0}, ρ) = ρ
proj_{E}(ext1(e), < ρ, u >) = proj_{E}(e, ρ)
proj_{E}(ext2(e), < ρ, u >) = < proj_{E}(e, ρ), u >

Now we are ready to define the semantics of a variable, term and substitution.

[[]]_{V ar} : (V ar(A, Γ); E(Γ, Δ)) V(A, Δ)
[[]]_{T erm} : (T erm(A, Γ); E(Γ, Δ)) V(A, Δ)
[[]]_{Subst} : (Subst(Γ, Γ′); E(Γ, Δ)) E(Γ′, Δ)

We will only use [[]] below, it should be clear from the typing which is which.

The semantics of a variable is its value in the environment. The semantics of a substitution is a new environment, where we intuitivaly have that if {t_{1}, … t_{n}} is a substitution from Γ to [A_{1} … A_{n}] and ρ an environment of type E(Γ, Δ) then we get the new environment < [[t_{1}]]ρ, …, [[t_{n}]]ρ >. The semantics of a term should be clear from the definition below.

In the definitions below ρ has the type E(Γ, Δ).

[[var_{0}]] < ρ, u > = u
[[var_{1}(v)]] < ρ, u > = [[v]]ρ
[[mon(t, e)]]ρ = [[t]]proj_{E}(e, ρ)
[[c(Γ)]]ρ = nf o(nf c(Δ))
[[var(v)]]ρ = [[v]]ρ
[[lam(t)]]ρ = λ e ∈ Δ′ ≥ Δ, v ∈ V(A, Δ′).[[t]] < mon_{E}(e, ρ), v >
[[apply(t_{1}, t_{2})]]ρ = ([[t_{1}]]ρ ext_{0} [[t_{2}]]ρ))
[[subst(t, s)]]ρ = [[t]][[s]]ρ

[[none]]ρ = tt
[[{s, t}]]ρ = < [[s]]ρ, [[t]]ρ >
[[s id]]ρ = ρ
[[s comp(s_{1}, s_{2})]]ρ = [[s2]][[s1]]ρ
[[s mon(s, e)]]ρ = [[s]]proj_{E}(e, ρ)
[[s proj(s, e)]]ρ = proj_{E}(e, [[s]]ρ)

We will now define the coding back function get term that takes a value and returns a term on normal form. We will simultaneously define a function get val that takes an applicative term to a value. Intuitively get term gives back a term that is eta-expanded on a syntactical level and get val gives back a value that is eta-expanded on a meta level.

get term : (A ∈ T ype; Γ ∈ Context; V(A, Γ)) NF (A, Γ)
get val : (A ∈ T ype; Γ ∈ Context; NF′(A, Γ)) V(A, Γ)

Both are defined by induction on the type.

get term_{o}(Γ, u) = u
get val_{o}(Γ, t) = t
get term_{A→B}(Γ, λ(f)) = nf lam(get term_{B}(Γ.A, f(ext_{1}(ext_{0}(Γ)),
get val_{A}(Γ.A, nf var(var_{0})))))
get val_{A→B}(Γ, t) = λ e ∈ Δ ≥ Γ, v ∈ V(A, Δ). get val_{B}(Δ,
nf apply(shift(t, e), get term_{A}(Δ, v)))

We are now ready to define the function that computes a term to its normal form. For this we define the identity environment

id_{E} : (Γ ∈ Context) E(Γ, Γ)

that for each variable in the context give its value which we compute with the get val function above.

id_{E}([]) = tt
id_{E}(Γ.A) = < mon_{E}(ext_{1}(ext_{0}(Γ)), id_{E}(Γ)),
get val_{A}(Γ.A, nf var(var_{0})) >

To compute the normal form

nf : (T erm(A, Γ)) NF (A, Γ)

is now only to compute the semantics of the term in the identity environment and then code the result back.

nf_{A}(Γ, t) = get term_{A}(Γ, [[t]]id_{E}(Γ))

5 Conclusions

We have defined a normalization function by structural induction using the pattern matching of ALF. I feel that using the pattern matching has been essential for the practical possibility to do this kind of proofs. What I would have liked to have is a notion of subsets and pattern matching inside an expression, ie some kind of case statement. Ovarloading of names would have been nice but not essential.

5.1 Future work

We will define a conversion on terms and show that a term converts to the injection of its normal form. We also want to show that if two terms converts then their semantical values are extensionally equal and that their normal forms are identical thereby getting a decision algorithm for conversion (just check that their normal forms are identical).

It might also be intresting to change this proof to use named variables.

6 Acknowledgements

I want to thank Thierry Coquand for giving me the idea of this work and for patiently answering all my questions.

References

[1] U. Berger and H. Schwichtenberg An inverse of the evaluation functional for typed λ-calculus. Proceedings of LICS 91

[2] Th. Coquand and J. Gallier, A proof of strong normalization for the theory of constructions using a Kripke-like interpretation. Proceedings of the first workshop in Logical Frameworks.

[3] Th. Coquand Pattern Matching with Dependent Types. In this proceedings.

[4] P. Dybjer An inversion principle for Martin-Löf ’s type theory. Proceedings of the Workshop on Programming Logic in Bastad, May 1989, Programming Methodology Group Report 54, p. 177-190.

[5] L. Magnusson The new implementation of ALF. In this proceedings.

[6] B. Nordström, K. Petersson and J. Smith. Programming in Martin-Löf’s Type Theory. An Introduction. Oxford University Press, 1990.

Virtual reduction

Vincent Danos, Laurent Regnier, Paris7

Abstract

We present a reduction of graphs whose edges are labelled by coefficients in the dynamical algebra Lambda *, the so-called virtual reduction. We show that the virtual reduction enjoys the Church-Rosser property. We give a semantic of the virtual reduction by applying the execution formula of Girard.

We then apply the preceding results to the case of pure-nets and introduce the notion of virtual cut. We end by relating the virtual cut elimination procedure with the family reduction of lambda-terms in the sense of Levy.

Natural Semantics in Coq. First experiments. - DRAFT -

Joëlle Despeyroux INRIA, Sophia-Antipolis André Hirschowitz University of Nice

August 7, 1992

Abstract In this paper, we discuss a possible implementation of a Natural Semantics of Mini-Ml into the Coq system. The aim of this experiment was to study to which point the Coq theorem prover is well suited to perform proofs in Natural Semantics. To represent our semantics, we have used the LF encoding of logics, which do not always meets the Coq requirements for definitions of inductive types. We propose here a possible solution to that problem, which will be developped in the final version of the paper.

1 Introduction

In a generic programming environment such as Centaur [BCD^{+}88], there is a need for a powerful theorem prover to be used for describing and for reasoning on object languages and programs. In the current version of Centaur, the available theorem prover, Theo [Des92], is first-order and not powerful enough for many standard tasks. As benchmarks, let us ask for mechanical proofs of both the subject reduction theorem for Mini-Ml and the translation from Mini-Ml to cam. A natural tool to consider for such tasks is the programming language Elf [Pfe89], based on the logical framework LF [AHM87]. Indeed, the implementation of mini- ml in Elf has been carefully studied in [MP91], where a corresponding proof of the subject reduction theorem has been given. However, this proof relies on an induction principle which is defined at the meta-level. A natural tool to consider then is the theorem prover Coq [DFH^{+}91], based on the Calculus of Constructions (CoC) enriched with inductively defined types. Indeed, on one hand Coq fully encompasses LF, and on the second hand, it offers a powerful notion of inductive type, hence it should be able to provide for instance a fully mechanical proof of the subject reduction theorem for Mini-Ml. In this context, we raise three questions:

1. Is coq powerful enough to perform for instance the benchmarks mentioned above?

2. What could be an efficient programming style for the implementation of natural semantics in coq?

3. Which tools or facilities should be coined and added to coq (or build over it) in order to make it more suitable for semantics of programming languages, more precisely to make it available in Centaur as a privileged, efficient and user-friendly theorem prover to be used for describing and for reasoning on languages and programs?

In this paper, we report on our first attempt to derive under coq a fully mechanical proof of the subject reduction theorem for Mini-Ml.

This attempt is based on an implementation of Mini-Ml directly translated from the one given in LF in [MP91]. The main feature of this implementation is that the chosen syntax is higher- order.

Let us describe the outcome of this first attempt in terms of the questions listed above:

1. We have produced under coq a fairly simple proof of the subject reduction theorem for Mini-Ml, relying upon two sets of axioms. The first one expresses that equality for terms of the object language is of a syntactic nature. The second one expresses the ”only if” part of our semantic definition, in other words it inverts our definition. We were not able to prove these axioms, because the chosen higher-order syntax cannot be defined as an inductive type, which deprives us the suitable induction principle and the corresponding match constructor. Hence coq will be powerful enough for the above mentioned goal when we will solve the following puzzle: inside coq, we shall provide our higher- order syntax with some kind of induction principle (over the structure of the terms) and with a match constructor and this raises three problems: -what is the ”right” induction principle in this case is not evident. - any match constructor will enlarge the syntax with new terms which should be excluded through an appropriate selection process. - once designed, the induction principle, the match constructor and the selection process have to be legitimated and packed in a user-friendly way. We propose below the basis of a unified solution for this puzzle.

2. As for programming style, the main choice we have considered concerns syntax. There are clearly two different approaches: -higher-order syntax, as we have experienced. Here, the higher-order features of the object language are directly implemented as such in the meta-language; hence, and this is the main advantage of this approach, the semantic rules are very simple. The main drawback for this approach is that some of the various objects we wish to define (for instance exp or type of) are not inductively defined in coq’s sense. While this doesn’t affect the simplicity of semantic rules, it affects seriously, as explained above, the way proofs concerning the object language can be built. Our current conclusion here is this: for a user- friendly study of languages described by a higher-order syntax, coq at least need both an extension of the induction principle to some class, to be introduced, of ”weakly-inductive” definitions and the automatic (lazy?) generation of some standard consequences of this stronger induction principle.

-first-order syntax: this is the opposite choice. Its main advantage is that it allows the object language to be introduced as an inductive type, so that we can express the semantics through recursive definitions and build our proofs uniformly by recursion on the subject. Here, the problem is no more with proofs but with the description of the semantics. The natural solution seems to be through a suitable coercion of first-order terms, once introduced as an inductive type, to higher-order. Our conclusion here is the need for such a generic coercion. We do not explore further this approach since the next seems simpler in any respect.

We propose a new, intermediate approach, which we call middle-order syntax. In firstorder syntax, object lambda-expressions are of type say (exp → exp → exp), while in higher-order syntax, they are of type ((exp → exp) → exp), and this rules the type exp out of inductive types. Our intermediate solution here is to type object lambda-expressions with ((ident → exp) → exp). In this approach, the type exp is still inductive, hence it shares the advantage of the first-order syntax with respect to proofs. As for the description of the semantics, it still needs a (generic) coercion to higher- order but this coercion is much easier since bindings are already understood by middle-order syntax. Indeed, here we only need to transform terms of type (ident → exp) into the corresponding terms of type (exp → exp). This is the basis of our solution for the above mentioned puzzle.

3. The solution sketched above is far from reaching the current standards of user-friendliness under Centaur. Hence it seems necessary to build a top-level over coq, designed for the above mentioned tasks. We now list some of the features which would be welcome for this top-level.

• at first we mention man-machine interface issues: the top-level should integrate current progress performed in our team on man-machine interface for theorem provers: proofs pretty-printed in english, and search directed from this pretty-printed proof through the mouse.

• next the top-level should accept higher-order syntax and generate the corresponding middle-order syntax together with the associated induction principle, match operator and selection process. The middle-order syntax and the selection process should be hidden to the user.

• moreover, for each syntactic definition, a ‘unicity package’ of rules should be generated expressing that equality for terms of the defined type is of a syntactic nature.

• finally, for each definition, an ‘inverse package’ of rules should be generated expressing the ”only if” part of the definition. This program raises corresponding theoretical issues,namely:

• generic translation of higher-order to middle-order.

The rest of the paper is organized as follows: Section 2 is devoted to our proof of our subject reduction theorem. Section 3 is devoted to middle-order syntax. In section 4, we develop the discussion started above on the planned top-level.

2 A first experiment

2.1 The Mini-Ml language

Mini-ML [CDDK86] consists in the purely applicative part of ML, more precisely a simply typed λ-calculus with polymorphism, constants, products, conditionals, and recursive function definitions. We consider here the slight variation of Mini-Ml defined in [MP91], where patterns are replaced with explicit projections.

Simple programs in Mini-ML are for example, in concrete syntax:

\begin{matrix}let u = λx.x \\ in (u u) \end{matrix}

or the following simultaneous recursive definition:

letrec (even, odd) = (λx.if x = 0 then true else odd (x − 1),

λx.if x = 0 then false else even (x − 1))

in even 3 The abstract syntax of Mini-Ml is as follows (identifiers and naturals are predefined sorts):

sorts  exp, ident
subsorts  exp ⊃ ident

constructors

id  : identifiers  → ident
number  : naturals  → exp
true, false  :  → exp
null, fst, snd : exp  → exp
apply, mlpair : exp × exp  → exp
lambda : ident × exp → exp
let, letrec  : ident × exp × exp → exp
if  : exp × exp × exp → exp

Numerous descriptions of the semantics -both static and dynamic semantics- of Mini-Ml can be found in the litterature. The type inference system of Mini-Ml has been first described by Damas and Milner [DM82]. In [Har90], R. Harper consider several presentations of this type system, together with their encoding in LF. An implementation of both static and dynamic semantics of Mini-Ml has been given both in the first-order language Typol, in [CDDK86], and in the higher-order language Elf, in [MP91].

2.2 The Mini-Ml implementation in Elf

Since our Coq implementation is based on the Elf implementation, we very briefly review this Elf implementation [MP91] in this subsection. The Coq implementation is described in the next subsection. Both implementations will be given in annex in the final version of the paper.

2.2.1 Higher-order abstract syntax

The Elf implementation of Mini-Ml describes the Mini-Ml language, using higher-order abstract syntax. The idea of this approach is to use meta-level variables to represent the objectlevel variables. The meta-level λ-binder is then naturally used to represent the object-level binding operators. This could seem non-natural at first sight, but has decisive advantages. The user can use the meta-level application to implement substitutions. The user can avoid the problem of α-conversion, that the meta-language has solved for him, once for all.

The syntax of Mini-ML is implemented in Elf by the following higher-order abstract syntax:

exp  : type.
true : exp.
false : exp.
zero : exp.
succ : exp → exp.
If  : exp → exp → exp → exp.
null  : exp.
lam  : (exp → exp) → exp.
app  : exp → exp → exp.
mlpair : exp → exp → exp.
fst  : exp → exp.
snd  : exp → exp.
let  : exp → (exp → exp) → exp.
letrec : (exp → exp) → (exp → exp) → exp.
fix  : (exp → exp) → exp.

In the case of Mini-Ml, we can mechanically translate a program from the Mini-Ml syntax to the Elf syntax. The two examples given above will become, in the Elf implementation (a λ-expression is denoted in Elf as [ ] ):

let (lam([x]x), [u](app u u))

and:

letrec

([even odd] (lam ([x] if (x = 0, true, (app (app (snd even odd)) (x − 1)))),

lam ([x] if (x = 0, false, (app (app (fst even odd)) (x − 1))))),

[even odd]

2.2.2 The type inference system in Elf

[...]

2.2.3 The evaluation rules in Elf

[...]

2.3 A Mini-Ml implementation in Coq

It is now well known (Henk Barendregt. GTS) that the Edinburgh Logical Framework can be viewed as a sub-system of the Calculus of Constructions. Since we shall use it in this subsection, let us call ( )^{∗} the injection from Elf to Coq, that is induced by this view. The implementation we consider here is this natural translation from the Elf implementation, into Coq, except, maybe, for boolean and natural expressions. All the propositions written in this subsection should be more formally stated, and proved, in the final version of the paper.

2.3.1 Syntax

Let us first translate the Elf syntax into Coq, without ‘changing’ it. In the definition of the constructor lam : (exp → exp) → exp, the first occurrence of exp is negative. Such kind of type is not allowed in Coq as an inductive type. We must ‘define’ the type exp by a list of ‘Parameters’. We obtain the following syntax, from which we only give here the first lines:

Parameter exp : Set.
Parameter true : exp.
Parameter false : exp.
Parameter zero : exp.
Parameter succ : exp → exp.
Parameter lam : (exp → exp) → exp.
Parameter app : exp → exp → exp.
...

The following informal proposition states that this Coq implementation of the Mini-Ml syntax is adequate with respect to the corresponding Elf implementation given above.

Proposition 1. For all closed normal term t in Elf such that ⊢_{Elf} t : exp, we have ⊢_{Coq} t^{∗} : exp^{∗}. For all closed normal term t′ in Coq such that ⊢_{Coq} t′ : exp^{∗}, there exists a term t in Elf, with t′ = t^{∗}, such that ⊢_{Elf} t : exp.

Now, it seems more convenient to use the predefined Coq inductive set bool and nat to represent the Mini-Ml boolean and natural expressions, rather than redefining them. Here is the implementation that we have chosen:

Parameter exp  : Set.
Parameter mlbool : bool → exp.
Parameter mlnat : nat → exp.
Parameter lam  : (exp → exp) → exp.
Parameter app  : exp → exp → exp.
...

The variation introduced is not a minor variation. vThe term (lam (succ zero)), for example, is an expression accepted by the first syntax, and refused by the second syntax. On the contrary, induction on booleans, and/or on naturals, is allowed by the second syntax, and not allowed by the first syntax. Another adequacy proposition, of the new syntax, with respect to the original language, is necessary.

2.3.2 The type inference system

Mini-Ml types are represented as first order terms, which are exactly the same terms as in the Elf implementation:

Inductive Set mltype

= tbool : mltype | tnat : mltype | arrow : mltype → mltype → mltype | cross : mltype → mltype → mltype.

Our type-inference rules of Mini-Ml only differ from the Elf version in the treatment of the booleans and naturals. The rules are as follows:

Parameter type :  exp → mltype → Prop.
Parameter type bool :  (e : bool)(type(mlbool e) tbool).
Parameter type nat :  (e : nat)(type(mlnat e) tnat).
Parameter type If :  (e, e_{1}, e_{2} : exp)(t : mltype)

(type e tbool) → (type e_{1} t) → (type e_{2} t) → (type (If e e_{1} e_{2}) t).

Parameter type null :  (type null (arrow tnat tbool)).
Parameter type lam :  (E : exp → exp)(t_{1}, t_{2} : mltype)

((x : exp)(type x t_{1}) → (type (E x) t_{2})) → (type (lam E) (arrow t_{1} t_{2})).

Parameter type app :  (e_{1}, e_{2} : exp)(t_{1}, t_{2} : mltype)

(type e_{1} (arrow t_{2} t_{1})) → (type e_{2} t_{2}) → (type (app e_{1} e_{2}) t_{1}).

Parameter type mlpair : (e_{1}, e_{2} : exp)(t_{1}, t_{2} : mltype)

(type e_{1} t_{1}) → (type e_{2} t_{2}) → (type (mlpair e_{1} e_{2}) (cross t_{1} t_{2})).

Parameter type fst :  (e : exp)(t_{1}, t_{2} : mltype)

(type e (cross t_{1} t_{2})) → (type (fst e) t_{1}).

Parameter type snd :  (e : exp)(t_{1}, t_{2} : mltype)

(type e (cross t_{1} t_{2})) → (type (snd e) t_{2}).

Parameter type let :  (e_{1} : exp)(E : exp → exp)(t0, t : mltype)

(type e_{1} t0) → ((x : exp)((t_{1} : mltype)(type e_{1} t_{1}) → (type x t_{1})) → (type (E x) t)) → (type (let e_{1} E) t).

Parameter type letrec : (E_{1}, E : exp → exp)(t0, t : mltype)

(type (fix E_{1}) t0) → ((x : exp)((t_{1} : mltype)(type (fix E_{1}) t_{1}) → (type x t_{1})) → (type (E x) t)) → (type (letrec E_{1} E) t).

Parameter type fix :  (E : exp → exp)(t : mltype)

((x : exp)(type x t) → (type (E x) t)) → (type (fix E) t).

Rules type lam, type let, type letrec and type fix both contain an occurrence of type in a negative position that forbids us to define the judgement type as an inductive type.

Proposition 2. For all closed normal terms e and t in Elf such that ⊢_{Elf} e : exp and ⊢_{Elf} t : mltype, we have ⊢_{Elf} (type e t) ⇒ ⊢_{Coq} (type^{∗} e^{∗} t^{∗}). For all closed normal terms e′ and t′ in Coq such that ⊢_{Coq} e′ : exp^{∗}, ⊢_{Coq} t′ : mltype^{∗}, and ⊢_{Coq} (type^{∗} e′ t′), there exist two terms e and t in Elf such that e′ = e^{∗}, t′ = t^{∗}, and ⊢_{Elf} (type e t).

2.3.3 The evaluation rules in Coq

Here again, our definitions of both the semantic values of Mini-Ml, and the evaluation rules for Mini-Ml, only differs from the Elf definition, on the booleans and naturals.

Inductive Definition value : exp → Prop

= val bool : (e : bool)(value (mlbool e)) | val nat : (e : nat)(value (mlnat e)) | val null : (value null) | val lam : (E : exp → exp)(value (lam E)) | val mlpair : (E_{1}, E_{2} : exp)(value E_{1}) → (value E_{2}) → (value (mlpair E_{1} E_{2})).

The evaluation rules for Mini-Ml are as follows:

Inductive Definition eval : exp → exp → Prop

= eval bool : (e : bool)(eval (mlbool e)(mlbool e)) | eval nat : (e : nat)(eval (mlnat e) (mlnat e)) | eval If t : (e, e_{1}, e_{2}, v_{1} : exp)

(eval e (mlbool true)) → (eval e_{1} v_{1}) → (eval (If e e_{1} e_{2}) v_{1}) | eval If f : (e, e_{1}, e_{2}, v_{2} : exp)

(eval e (mlbool false)) → (eval e_{2} v_{2}) → (eval (If e e_{1} e_{2}) v_{2}) | eval null : (eval null null) | eval lam : (E : exp → exp)(eval (lam E) (lam E)) | eval app : (E : exp → exp)(e_{1}, e_{2}, v, v_{2} : exp)

(eval e_{1} (lam E)) → (eval e_{2} v_{2}) → (eval (E v_{2}) v) → (eval (app e_{1} e_{2}) v) | eval app null t : (e_{1}, e_{2} : exp)

(eval e_{1} null) → (eval e_{2} (mlnat O)) → (eval (app e_{1} e_{2}) (mlbool true)) | eval app null f : (e_{1}, e_{2} : exp)(n : nat)

(eval e_{1} null) → (eval e_{2} (mlnat (S n))) → (eval (app e_{1} e_{2})(mlbool false)) | eval mlpair : (e_{1}, e_{2}, v_{1}, v_{2} : exp)

(eval e_{1} v_{1}) → (eval e_{2} v_{2}) → (eval (mlpair e_{1} e_{2}) (mlpair v_{1} v_{2})) | eval fst : (e, v_{1}, v_{2} : exp)

(eval e (mlpair v_{1} v_{2})) → (eval (fst e) v_{1}) | eval snd : (e, v_{1}, v_{2} : exp)

(eval e (mlpair v_{1} v_{2})) → (eval (snd e) v_{2}) | eval let : (e_{1}, v_{1}, v : exp)(E : exp → exp)

(eval e_{1} v_{1}) → (eval (E v_{1}) v) → (eval (let e_{1} E) v) | eval letrec : (v_{1}, v : exp)(E_{1}, E : exp → exp)

(eval (fix E_{1}) v_{1}) → (eval (E v_{1}) v) → (eval (letrec E_{1} E) v) | eval fix : (v : exp)(E : exp → exp)

(eval (E (fix E)) v) → (eval (fix E) v).

Proposition 3. For all closed normal terms e and v in Elf such that ⊢_{Elf} e : exp and ⊢_{Elf} v : exp, we have ⊢_{Elf} (eval e v) ⇒ ⊢_{Coq} (eval^{∗} e^{∗} v^{∗}). For all closed normal terms e′ and v′ in Coq such that ⊢_{Coq} e′ : exp^{∗}, ⊢_{Coq} v′ : exp^{∗}, and ⊢_{Coq} (eval e′ v′), there exist two terms e and v in Elf such that e′ = e^{∗}, v′ = v^{∗}, and ⊢_{Elf} (eval^{∗} e v).

2.4 Proof of the subject reduction theorem

The Subject Reduction Theorem for our Mini-Ml example can be stated as follows:

Theorem: (e, v : exp)(eval e v) → (t : mltype)(type e t) → (type v t)

The complete proof of the theorem is given in annexB. It proceeds by induction on the definition of eval. It uses both the unicity axioms on exp presented later on in the section ‘top-level’, and the inversion of the type definition presented as axioms in annexB.

2.4.1 Comparaison with the Elf proof

[...]

3 Middle-order implementation of mini-ml

3.1 Syntax

Our syntax uses the empty type for bound variables.

Inductive Set empty = .

This type has no value, but it has an identity [x : empty]x. More generally, it has a natural morphism towards any Set:

Definition init : (T : Set)(empty → T)
= [T : Set][x : empty] < T > Match x with.

Further examples of functions related to the empty type are:

Definition pr_{2.1} = [x1 : empty][x2 : empty]x1
Definition pr_{2.2} = [x1 : empty][x2 : empty]x2

Our middle-order syntax for the Mini-Ml language is as follows:

Inductive Set mexp
= mlbool : bool → mexp
|mlnat : nat → mexp
|lam : (empty → mexp) → mexp
|app : mexp → mexp → mexp
|let : mexp → (empty → mexp) → mexp
| ⋯

For instance the term let u = λx.x in (u u) is encoded as (let ((init mexp), [x : empty](app x x))). In order to express that our syntax is correct, we need the type, denoted (list t n), of lists of length n of terms of a given type t, together with the corresponding cons, car and cdr operators.

Now our syntax is correct in the following sense: there is a unique natural collection of bijections (bij n) between (list exp n) → exp and (list empty n) → mexp. This proposition would be false for a lam operator of type:

lam : (id → mexp) → mexp

This collection of bijections is ‘natural’ in the sense that the following properties hold (we only give here only one of these properties):

\begin{matrix}(f : (list exp (S n)) → exp)((bij n, [x : (list exp n)](lam [y : exp] (f (cons y x)))) \\ = [x : (list empty n)](lam [y : empty](bij (S n) (f (cons y x)))) \end{matrix}

The bijection (bij 0) is the desired bijection between exp and mexp. This is the first instance where in order to understand higher-order syntax, we enlarge our scope to terms depending on a list of variables. This feature is recurrent in our work.

3.2 Coercion

Thus, the middle-order syntax is adequate but not suited for semantics. In order to express the semantics for the term, for instance, (app (lam u) v), it is desirable to have u being of type mexp → mexp. For u of type empty → mexp, we would like to define, inside coq, the corresponding (coer u) of type (mexp → mexp). More generally, we look for a coq term coer of type

(n : nat)((list empty n) → mexp) → ((list mexp n) → mexp)

We were not able to construct this term because the Match operator is not powerful enough. Fortunately, we were able to construct the inverse coercion, which is sufficient for our purposes, thanks to higher-order unification.

Now, we would like higher-order unification to operate smoothly when asked for a solution of the equation < (list empty n) → mexp > (coer X) = f, namely we would like it to find the single ‘natural’ solution, the only one which does not use (more than f) the Match constructor. For that, the only way seems to define a predicate restr which rules out the non-natural solutions. The predicate (restr f) means that f has no Match operator except possibly in its subtrees of type nat or bool.

[...]

3.3 Semantics

We define here the corresponding type inference rules and evaluation rules of Mini-Ml, using the new middle-order syntax. [...]

4 Top-level

We discuss here some features of the top-level we plan to built over Coq.

4.1 Unicity package. Inverse package

Coq proofs in Natural Semantics seem to be relatively short terms, provided that two ‘tools’ are given. The first tool we need is the ability to generate some ‘intuitive’ facts about an -inductive or not- definition of a syntax, in the case where the user asks for them. The intuitive facts about the exp syntax simply say that the type exp define trees. With the help of a Match on exp, we could easily prove those facts. But, since in our example, exp is not an inductive definition, we must give them as axioms:

Axiom uniq mlpair : (x, y, x′, y′ : exp)(⟨exp⟩(mlpair x y) = (mlpair x′ y′))
→ ((⟨exp⟩x = x′) ∧ (⟨exp⟩y = y′)).
Axiom uniq arrow : (x, y, x′, y′ : mltype)(⟨mltype⟩(arrow x y) = (arrow x′ y′))
→ ((⟨mltype⟩x = x′) ∧ (⟨mltype⟩y = y′)).
Axiom lam mlpair : (E : exp → exp)(x, y : exp)(⟨exp⟩(lam E) ≠ (mlpair x y)).
Axiom bool mlpair : (e : bool)(x, y : exp)(⟨exp⟩(mlbool e) ≠ (mlpair x y)).
Axiom nat mlpair : (e : nat)(x, y : exp)(⟨exp⟩(mlnat e) ≠ (mlpair x y)).
Axiom null mlpair : (x, y : exp)(⟨exp⟩null ≠ (mlpair x y)).

The second tool we need is the compilation of the ‘inversion’ of a set of inference rules, declared as an -inductive or not- definition. In the case of an inductive definition, there is work in progress in the Formel team at Inria-Rocquencourt (Samuel Boutin). The simplest example is the inversion of the value judgment, which reduces to the inversion of rule val mlpair:

Theorem value inv mlpair : (e1, e2 : exp)(value (mlpair e1 e2)) → ((value e1) ∧ (value e2))

As an example, we give in Annex A a proof of the above inversion rule. As another example, the inversion of the Mini-Ml type definition is given in AnnexB.

4.2 Proofs in english

Pretty-print from Coq proof terms into proofs written in english, in a more conventional mathematical style. [...]

As an example, let us give a short proof in Coq. Given the previous semantic definitions, we can prove that ‘the evaluation of a Mini-Ml expression returns a value’:

(E, V : exp)(eval E V) → (value V)

The proof proceeds by induction on the length of the proof of (eval E V). It uses both the unicity and the inverse packages given as an example in the previous subsection.

Goal (E,V:exp) (eval E V) → (value V). Induction 1. Intro; Apply val bool. Intro; Apply val nat. Trivial. Trivial. Apply val null. Intro; Apply val lam. Trivial. Intros; Apply val bool. Intros; Apply val bool. Intros; Apply val mlpair.Assumption.Assumption. Intros; Apply proj1 with (value v2); Apply value inv mlpair; Assumption. Intros; Apply proj2 with (value v1); Apply value inv mlpair; Assumption. Trivial. Save ml eval returns value. [...]

4.3 From higher-order to middle-order and the selection process

Generalisation of the work done on the Mini-Ml example. [...]

4.4 Induction, Match operator

In the definition of the constructor lam : (exp → exp) → exp, the first occurrence of exp is negative. Such kind of type is not allowed in Coq as an inductive type. The reason for that is that, whenever the user define an inductive type, Coq generates an iteration operator Match on that type, together with an induction principle for that type, in a framework which does not naturally extend to that case.

The problem concerning the Match function is that exp → exp define all functions from exp to exp, including those that use a Match. With the help of a Match function, we could build a non-normalisable term, or at least a term which has no counter-part in the model we have in mind. In the case of exp, we could write for example an analogue of Δ (which was given to us by Christine Paulin):

d = (lam[x : exp] (match x with ⋯ (lam f) → (f x) ⋯))

where (d d) rewrites to (d d)

The problem concerning the induction is that an induction principle is not derivable from such definition, at least in the usual sense. A straightforward induction principle for exp might be written as:

∀P : exp → P rop
(∀a, b : exp (P a) → (P b) → (P (app a b)))
→ (∀f : exp → exp (∀a : exp (P a) → (P (f a))) → (P (lam f)))
→ ⋯
→ ∀x : exp (P x).

This principle can be written in Coq, but it seems difficult to use it in Coq, because of the ‘non-denotational’ lam case.

We propose here a less readable but more usable principle. This principle originates in the remark that a Mini-Ml expression depends on n variables. The principle is thus defined on an expression depending on a list of expressions of length n (denoted as (exp n)):

∀n : nat, ∀P : ((expn) → exp) → P rop

(∀n : nat, ∀a, b : ((expn) → exp) (P n a) → (P n b) → (P n λx.(app (a x) (b x))))

→ (∀n : nat, ∀f : (((expn) → exp) → ((expn) → exp))

(P (S n) f) → (P n λy. (lam λx. (f (cons x y)))))

→ ⋯

→ ∀x : ((expn) → exp) (P x).

We have discussed here the problem of induction on the type exp example. The discussion naturally extends to the case of a type representing a judgment. [...]

5 Conclusion

To implement our logical systems in the Calculus of Constructions, we have chosen the encoding defined in the LF framework. However, as it is pointed out in [PMP89], we know that in some cases, as for example the cases from our Mini-Ml example, or simply the ⊃I rule of first order logic:

⊃ I : [A, B : term]((true A) → (true B)) → (true (A ⊃ B))

this encoding cannot be directly used in an inductive definition. Despite that fact, as in the Elf implementation of Mini-Ml, we would like to use this LF encoding, which seems very natural to us.

Our first idea has been to write a top-level to Coq -or an ‘interface’ for Coq, rather than modifying it. The basis of this top-level is a new programming style for syntax, which we call middle-order syntax. This style is sufficiently higher-order for handling bindings and nevertheless defines object syntaxes as inductive types. The cost for that is that, since the match operator enlarges the syntax with new terms which have to be excluded, we have to write an appropriate selection process. We hope this to be hidden in the top-level. This idea will be developped in the final version of the paper.

Another idea is to add a new operator in the Coq language, called a restrictive arrow, that we denote here ↪. Roughly speaking, exp ↪ exp will denote those functions from exp to exp that are only built from the constructors of exp. Similarly, (true A) ↪ (true B) will denote those proofs that are only built from the constructors of true. There is work in progress on that subject by Joëlle Despeyroux, Chet Murphy and Frank Pfenning.

In the future, we would like to build proofs in Coq, for example, under Centaur. An interface for Coq is under development in our team. Our aim is to write Natural Semantics definitions in an extended Typol, so as to translate them into Coq terms. A natural continuation of this work will be to see proofs as proof trees in Natural Semantics as well as proof terms in the Calculus of Constructions.

6 Annex A: Proof of an inversion rule

We give here the proof of the following theorem:

Theorem value inv mlpair : (e_{1}, e2 : exp)(value (mlpair e_{1} e2)) → ((value e_{1}) ∧ (value e2))

In this proof, we follow the method suggested in the Coq’s user’s manual. We first define a suitable constant. Then we prove a general property, from which the desired inversion rules will be derivable as simple proofs, or even just instanciations.

Definition inv = [e,e1,e2:exp] (⟨ exp ⟩e=(mlpair e1 e2)) → ((value e1) ∧ (value e2)).

Goal (e,e1,e2:exp) (value e) → (inv e e1 e2). Induction 1. Intro; Red; Intro; Absurd (⟨ exp ⟩(mlbool e0)=(mlpair e1 e2)). Apply bool mlpair. Assumption. Intro; Red; Intro; Absurd (⟨ exp ⟩(mlnat e0)=(mlpair e1 e2)). Apply nat mlpair. Assumption. Red. Intro. Absurd (⟨ exp ⟩null=(mlpair e1 e2)). Apply null mlpair. Assumption. Intro; Red. Intro; Absurd (⟨ exp ⟩(lam E)=(mlpair e1 e2)). Apply lam mlpair; Assumption. Assumption. Intros; Red; Intro; Cut ((⟨ exp ⟩E1=e1) ∧ (⟨ exp ⟩E2=e2)). Intro; Apply conj. Replace e1 with E1. Assumption. Apply proj1 with ⟨ exp ⟩E2=e2; Assumption. Replace e2 with E2. Assumption. Apply proj2 with ⟨ exp ⟩E1=e1; Assumption. Apply uniq mlpair; Assumption. Save value inv.

Goal (e1,e2:exp)(value (mlpair e1 e2))→((value e1) ∧ (value e2)). Intros. Cut (⟨ exp ⟩(mlpair e1 e2)=(mlpair e1 e2)). Change (inv (mlpair e1 e2) e1 e2). Apply value inv; Assumption. Trivial. Save value inv mlpair.

7 Annex B: Proof of the Subject Reduction Theorem

We first give the inverse definition of type, that we need for the proof of our theorem. The listing of the proof itself follows.

Axiom type inv bool :  (e : bool)(t : mltype)(type (mlbool e) t) → ⟨mltype⟩t = tbool.
Axiom type inv bool_{1} :  (e : bool)(t : mltype)(⟨mltype⟩t = tbool) → (type (mlbool e) t).
Axiom type inv nat :  (e : nat)(t : mltype)(type (mlnat e) t) → ⟨mltype⟩t = tnat.
Axiom type inv If :  (e, e_{1}, e_{2} : exp)(t : mltype)(type (If e e_{1} e_{2}) t)

→ ((type etbool) ∧ (type e_{1} t) ∧ (type e_{2} t)).

Axiom type inv null :  (t : mltype)(type null t) → ⟨mltype⟩t = (arrow tnat tbool).
Axiom type inv lam :  (E : exp → exp)(t_{1}, t_{2} : mltype)(type (lam E) (arrow t_{1} t_{2}))

→ ((x : exp)(type x t_{1}) → (type (E x) t_{2})).

Axiom type inv lam_{0} :  (E : exp → exp)(t : mltype)(type (lam E) t)

→ ⟨mltype⟩Ex([t_{1} : mltype] ⟨mltype⟩Ex([t_{2} : mltype](⟨mltype⟩t = (arrow t_{1} t_{2})))).

Axiom type inv app :  (e_{1}, e_{2} : exp)(t_{1} : mltype)(type (app e_{1} e_{2}) t_{1})

→ ⟨mltype⟩Ex([t_{2} : mltype](type e_{1} (arrow t_{2} t_{1})) ∧ (type e_{2} t_{2})).

Axiom type inv mlpair : (e_{1}, e_{2} : exp)(t_{1}, t_{2} : mltype)(type (mlpair e_{1} e_{2}) (cross t_{1} t_{2}))

→ ((type e_{1} t_{1}) ∧ (type e_{2} t_{2})).

Axiom type inv mlpair_{0} : (e_{1}, e_{2} : exp)(t : mltype)(type (mlpair e_{1} e_{2}) t)

→ ⟨mltype⟩Ex([t_{1} : mltype] ⟨mltype⟩Ex([t_{2} : mltype](⟨mltype⟩t = (cross t_{1} t_{2})))).

Axiom type inv fst :  (e : exp)(t_{1} : mltype)(type (fst e) t_{1})

→ ⟨mltype⟩Ex([t_{2} : mltype](type e (cross t_{1} t_{2}))).

Axiom type inv snd :  (e : exp)(t_{2} : mltype)(type (snd e) t_{2})

→ ⟨mltype⟩Ex([t_{1} : mltype](type e (cross t_{1} t_{2}))).

Axiom type inv let :  (e_{1} : exp)(E : exp → exp)(t : mltype)(type (let e_{1} E) t)

→ (⟨mltype⟩Ex([t0 : mltype](type e_{1} t0)) ∧(x : exp)((t_{1} : mltype)(type e_{1} t_{1}) → (type x t_{1})) → (type (E x) t)).

Axiom type inv letrec : (E_{1}, E : exp → exp)(t : mltype)(type (letrec E_{1} E) t)

→ (⟨mltype⟩Ex([t0 : mltype](type (fix E_{1}) t0)) ∧(x : exp)((t_{1} : mltype)(type (fix E_{1}) t_{1}) → (type x t_{1})) → (type (E x) t)).

Axiom type inv fix :  (E : exp → exp)(t : mltype)(type (fix E)t)

→ ((x : exp)(type x t) → (type (E x) t)).

Goal (e,v:exp)(eval e v) → (t:mltype)(type e t)→(type v t). Induction 1. Trivial. Trivial. Do 4 Intro; Intros ve0 te0 ve1 te1 t tIf; Apply te1; Apply proj1 with (type e2 t); Apply proj2 with (type e0 tbool); Apply type inv If; Assumption. Do 4 Intro; Intros ve0 te0 ve2 te2 t tIf; Apply te2; Apply proj2 with (type e1 t); Apply proj2 with (type e0 tbool); Apply type inv If; Assumption. Trivial. Trivial. Do 5 Intro; Intros vlam tlam ve2 te2 vApp tApp t tapp; Apply tApp; Cut ⟨ mltype ⟩Ex([t2:mltype](type e1 (arrow t2 t))∧(type e2 t2)). Intro Ext2; Elim Ext2; Intro t2; Intro tE1tE2; Apply type inv lam with t2. Apply tlam; Apply proj1 with (type e2 t2); Assumption. Apply te2; Apply proj2 with (type e1 (arrow t2 t)); Assumption. Apply type inv app; Assumption. Do 3 Intro; Intro te1; Do 3 Intro; Intro tapp; Cut ⟨ mltype ⟩Ex([t2:mltype](type e1 (arrow t2 t))∧(type e2 t2)). Intro Ext2; Elim Ext2; Intro t2; Intro te1e2; Apply type inv bool1; Apply proj2 with ⟨ mltype ⟩t2=tnat; Apply uniq arrow; Apply type inv null; Apply te1; Apply proj1 with (type e2 t2); Assumption. Apply type inv app; Assumption. Do 4 Intro; Intro te1; Do 3 Intro; Intro tapp; Cut ⟨ mltype ⟩Ex([t2:mltype](type e1 (arrow t2 t))∧(type e2 t2)). Intro Ext2; Elim Ext2; Intro t2; Intro te2e1; Apply type inv bool1; Apply proj2 with ⟨ mltype ⟩t2=tnat; Apply uniq arrow; Apply type inv null; Apply te1; Apply proj1 with (type e2 t2); Assumption. Apply type inv app; Assumption. Do 4 Intro; Intros ve1 te1 ve2 te2 t te1e2; Cut ⟨ mltype ⟩Ex([t1:mltype]⟨ mltype ⟩Ex([t2:mltype](⟨ mltype ⟩t=(cross t1 t2)))). Intro Ext1; Elim Ext1; Intro t1; Intro Ext2; Elim Ext2; Intro t2; Intro tc; Replace t with (cross t1 t2). Apply type mlpair. Apply te1;Apply proj1 with (type e2 t2);Apply type inv mlpair; Elim tc; Apply te1e2. Apply te2;Apply proj2 with (type e1 t1);Apply type inv mlpair; Elim tc; Apply te1e2. Apply type inv mlpair0 with e1 e2; Assumption. Do 3 Intro; Intros ve0 te0 t tf; Cut ⟨ mltype ⟩Ex([t2:mltype](type e0 (cross t t2))). Intro Ext2; Elim Ext2; Intros t2 te0c; Apply proj1 with (type v2 t2); Apply type inv mlpair;Apply te0;Assumption. Apply type inv fst; Assumption. Do 3 Intro; Intros ve0 te0 t ts; Cut ⟨ mltype ⟩Ex([t1:mltype](type e0 (cross t1 t))). Intro Ext1; Elim Ext1; Intros t1 te0c; Apply proj2 with (type v1 t1); Apply type inv mlpair;Apply te0;Assumption. Apply type inv snd; Assumption. Do 4 Intro; Intros ve1 te1 vApp tApp t tlet; Apply tApp; Cut ⟨ mltype ⟩Ex([t0:mltype](type e1 t0))∧ (v1:exp)((t1:mltype)(type e1 t1)→(type v1 t1))→(type (E v1) t). Intro A;Elim A;Intro;Intro B;Apply B;Do 2 Intro;Apply te1;Assumption. Apply type inv let; Assumption. Do 4 Intro; Intros vfix tfix vApp tApp t tletrec; Apply tApp; Cut ⟨ mltype ⟩Ex([t0:mltype](type (fix E1) t0))∧ (v1:exp)((t1:mltype)(type (fix E1) t1)→(type v1 t1))→(type (E v1) t). Intro A;Elim A;Intro;Intro B;Apply B;Do 2 Intro;Apply tfix;Assumption. Apply type inv letrec; Assumption. Do 2 Intro; Intros vApp tApp t tfix; Apply tApp; Apply type inv fix; Assumption. Save ml subject red.

References

[AHM87] A. Avron, F. Honsell, and A. Mason. Using typed λ-calculus to implement formal systems on a machine. Technical Report ECS-LFCS-87-31, Edinburgh University, Edinburgh, July 1987.

[BCD^{+}88] P. Borras, D. Clement, T. Despeyroux, J. Incerpi, G. Kahn, B. Lang, and V. Pascual. Centaur: the system. In Proceedings of the 3rd Symp. on Software Development Environments, November 1988, Boston, USA, 1988. also available as a Technical Report 777, Inria-Sophia-Antipolis, France, December 1987.

[CDDK86] D. Clement, J. Despeyroux, Th. Despeyroux, and G. Kahn. A simple applicative language: Mini-ml. In Proceedings of the Symposium on Lisp and Functional Programming, 1986.

[Des92] J. Despeyroux. Theo: an interactive proof development system. Scandinavian Journal on Computer Science and Numerical Analysis (BIT), special issue on ‘Programming Logic’, containing the Proceedings of the Workshop on Programming Logic, Bastad, Sweden, May 21-26 1989, 32:15–29, 1992. a preliminary version is available as a Research Report RR-887, Inria-Sophia-Antipolis, France, August 1988.

[DFH^{+}91] G. Dowek, A. Felty, H. Herbelin, G. Huet, Ch. Paulin, and B. Werner. The coq proof assistant user’s guide, version 5.6. Technical Report 134, Inria, Rocquencourt, France, December 1991.

[DM82] L. Damas and R. Milner. Principal type-schemes for functional programs. In Proceedings of the POPL ACM Conference on Principles of Programming Languages, pages 207–212, 1982.

[Har90] R. Harper. Systems of polymorphic type assignment in LF. Technical Report CMU-CS-90-144, Carnegie Mellon University, Pittsburgh, Pennsylvania, June 1990.

[MP91] S. Michaylov and F. Pfenning. Natural semantics and some of its meta-theory in elf. In Lars Halln”as, editor, Proceedings of the Second Workshop on Extentions of Logic Programming, Springer-Verlag LNCS, 1991. also available as a Technical Report MPI–I–91–211, Max-Planck-Institute for Computer Science,Saarbrucken, Germany, August 1991.

[Pfe89] F. Pfenning. Elf: A language for logic definition and verified metaprogramming. In Proceedings of the fourth ACM-IEEE Symp. on Logic In Computer Science, Asilomar, California, USA, June 1989.

[PMP89] Ch. Paulin-Mohring and F. Pfenning. Inductively defined types in the calculus of constructions. In Proceedings of the Fith International Conf. Mathematical Foundations of Programming Semantics, New Orleans, Luisiana, USA, pages 209–228, 1989.

Universes and a General Notion of Simultaneous Inductive-Recursive Definition in Type Theory (Draft)

Peter Dybjer^{∗} Chalmers University of Technology

August 1992

Abstract

In Martin-Löf’s type theory we may define new sets (and families of sets) inductively, and new functions by recursion on the way the elements of these sets are generated. The schema for such definitions that we considered before includes all the standard set formers of type theory with the exception of universes.

Here we give an extended schema which also covers universes à la Tarski. These consist of simultaneous inductive definitions of sets of codes for small sets and recursive definitions of decoding functions. This extension is a small modification of the old schema and includes a general formulation of the notion of a simultaneous inductive-recursive definition.

There are several interesting applications of this extension. Here we show how to obtain an external universe hierarchy, where each level in the hierarchy faithfully reflects the previous level. We also show how to obtain the universe constructions of Griffor and Palmgren. These include an internal unfaithful universe hierarchy and a super universe.

Other examples are the construction of Frege structures in type theory, and various constructions relevant to the formalization of type theory inside type theory.

1 Introduction

The first universe à la Tarski [11] consists of the simultaneous inductive definition of the set U_{0} of codes for small sets and the recursive definitions of the decoding function T_{0}. We have the following rules of formation (using Martin-Löf’s term)

U_{0} : set,
T_{0} : (U_{0})set.

We also have introduction and equality rules for constructors reflecting Π- and Eq-formation:

π_{0} : (u : U_{0})(u′ : (x : T_{0}(u))U_{0})U_{0},
T_{0}(π_{0}(u, u′)) = Π(T_{0}(u), (x)T_{0}(u′(x))),

eq_{0} : (u : U_{0})(b, b′ : T_{0}(u))U_{0},

∗peterd@cs.chalmers.se

T_{0}(eq_{0}(u, b, b′)) = Eq(T_{0}(u), b, b′).

This definition does not fit the schema for inductive and recursive definition in Dybjer [5], since T_{0} appears in the introduction rules for U_{0}. Note that it even appears negatively in the rule for π_{0}.

In spite of this simultaneity we can argue that it is a predicative definition. For example, the rules for π_{0} stipulate the following way of constructing new elements of U_{0}.

At a certain stage we may have constructed the element u. Since T_{0} is defined by U_{0}- recursion, we immediately construct the set T_{0}(u). Hence it is possible to construct a function u′ with domain T_{0}(u) and range (the presently constructed elements of) U_{0}. Hence it makes sense to construct an element π_{0}(u, u′). Moreover, we can define the T_{0}(π_{0}(u, u′)) in terms of the already constructed sets T_{0}(u) and T_{0}(u′(x)) for x : T_{0}(u).

For similar reasons we shall accept a certain general notion of simultaneous inductiverecursive definition. The formulation of this notion will appear as a minor modification of the schema for inductive and recursive definitions in type theory which was presented in Dybjer [5]. The main change is that we allow the simultaneous inductive definition of a family of sets P and the P -recursive definition of a function f.

The idea to consider such a general notion was inspired by Nax Mendler’s paper [12] on the category-theoretic semantics of universes in type theory.

Note that this generalization is only possible if we adopt a schematic approach to recursive definitions, since elimination rules only apply to recursive definitions on a previously defined set. For example, T_{0} is defined by a recursive schema and not in terms of U_{0}-elimination.

Moreover, it is also essential that we do not require functions defined by recursion to take their values in a particular set (as in the traditional elimination rules) but allow them to take their values in an arbitrary type. For example, the values may be in the type of sets itself, so we have recursively defined families of sets.

So the conceptual priority of certain concepts have been reversed as compared to the standard formulations of Martin-Löf [10, 11]:

elimination rules  ⟷ recursion schemata
type-valued recursion ⟷ universes

Martin-Löf [9] has previously considered a formulation of type theory in terms of recursion schemata. Other arguments for viewing recursive definitions schematically (and allowing more general forms of pattern matching) can be found in Thierry Coquand’s paper in this volume [2].

The idea to obtain type-valued recursion in Martin-Löf’s type theory by formulating typedvalued (“large”) elimination rules rather than by using the ordinary elimination rules in conjunction with universes is due to Bengt Nordström. Smith [9] gave an interpretation of a theory with such large elimination rules in a theory with ordinary elimination rules and universes.

2 Schema for simultaneous inductive-recursive definitions

The reader is referred to Dybjer [5] for a presentation of the old schema, which uses Martin-Löf’s theory of logical types. (Alternative presentations can be found in Dybjer [3] of a schema for Martin-Löf’s type theory which does not use the theory of logical types, and Coquand and Paulin [2] of a schema for the Calculus of Constructions.) I have tried to use similar notation in order to highlight the similarity between the new and old schemas. In particular there is the notation a :: α, meaning that a is a sequence of objects fitting the sequence (relative context, telescope) α of dependent types. The notion of an s-type (set-like type) is also essential: it is a type which is built up by the function type construction from base types which are sets. The reason for requiring that certain types occurring in the schema are s-types rather than sets is to cover Martin-Löf’s [11, preface] rules for Π.

I present the case with one inductive and one recursive definition simultaneously. There are obvious generalizations to the case with several such simultaneous definitions. Furthermore, I assume that there are no parameters, but the discussion of these in Dybjer [5] can be extended in a straightforward way.

A definition is always relative to a theory containing the rules for previously defined concepts. Thus the requirements on the different parts of the definitions (α, ψ, β, ξ, p, q below) are always judgements with respect to that theory.

2.1 Formation rules

Consider introducing a family of sets P together with a function f defined by P -recursion:

P : (a :: α)set,
f : (a :: α)(c : P (a))ψ[a].

Here we require that α is a sequence of s-types and ψ[a] type (a :: α).

2.2 Introduction rules

A premise of an introduction rule is either non-recursive or recursive.

• A non-recursive premise has the form

b : β,

where β s-type depending on the previous premises (see below).

• A recursive premise has the form

u : (x :: ξ)P (p[x]),

where ξ is a sequence of s-types, and p[x] :: α (x :: ξ) depending on the previous premises (see below). If ξ is empty the premise is ordinary and otherwise generalized (as in ordinary and generalized induction).

The type of the conclusion of the introduction rule has the form

P (q),

where q :: α depending on the previous premises (see below).

We write β = β[…, b′, …, u′, …], etc. to indicate explicitly the dependence on previous non-recursive premise b′ : β′ and recursive premises u′ : (x′ :: ξ′)P (p′[x′]). (This notation is not intended to indicate that non-recursive premises always come before recursive premises.)

We require that

β[…, b′, …, u′, …] = β̂[…, b′, …, (x′)f(p′[x′], u′(x′)), …],

where β̂[…, b′, …, v′, …] s-type (…, b′ : β′, …, v′ : (x′ :: ξ′)ψ[p′[x′]], …). Note that the context of β̂ is obtained from the context (list of previous premises) of β by replacing each recursive premise of the form u′ : (x′ :: ξ′)P (p′[x′]) by v′ : (x′ :: ξ′)ψ[p′[x′]].

The dependence of ξ, p, and q on previous premises are obtained in the same way as for β.

2.3 Equality rules for the simultaneously defined function

Let intro be a constructor constant and b : β indicate a typical non-recursive premise and u : (x :: ξ)P (p[x]) indicate a typical non-recursive premise of the corresponding introduction rule. The form of the equality rule for f and intro is:

f(q, intro(…, b, …, u, …)) = e(…, b, …, (x)f(p[x], u(x)), …),

where e(…, b, …, v, …) : ψ[q] (…, b : β, …, v : (x :: ξ)ψ[p[x]], …).

2.4 The analogue of universe elimination

Universe elimination expresses definition by U_{0}-recursion after U_{0} and T_{0} are defined.

We express this schematically for the general case. Let P and f be defined by a simultaneous inductive-recursive definition as above. We may then define a new function

f′ : (a :: α)(c : P (a))ψ′[a, c],

by P -recursion after P and f have been defined. Here we require that ψ′[a, c] (a :: α, c : P (a)). The equality rule has the form

f′(q, intro(…, b, …, u, …)) = e′(…, b, …, u, (x)f′(p[x], u(x)), …)

where

e′(…, b, …, u, v, …) : ψ′[q, intro(…, b, …, u, …)]
(…, b : β, …, u : (x :: ξ)P (p[x]), v : (x :: ξ)ψ′[p[x], u(x)], …).

Note that, in contrast to ψ and e in the schema for f, ψ′ depends on c as well as on a and e′ on u as well as on v in the schema for f′.

3 A simple example: lists with distinct elements

The following example illustrates how the schema can be used. It is a simplification of an example of a simultaneous inductive-recursive definition used by Catarina Coquand in her work (in progress) on formalizing the typed λ-calculus in type theory. She defined the notion of a correct context and the notion of a fresh variable in this way.

Let

A : set,
# : (A)(A)set

be parameters to this definition. A is the set from which the elements of the list are taken and # is an arbitrary relation, which we interpret as “distinctness”.

We then simultaneously define the set Dlist of lists with distinct elements and the relation Fresh, which expresses that a new element is distinct from all elements in a list.

3.1 Formation rules

Dlist : set,
Fresh : (c : Dlist)(a : A)set.

We see that this is an instance of the schema with α empty and ψ = (a : A)set.

3.2 Introduction and equality rules

nil : Dlist,
Fresh(nil) = (a)⊤,

cons : (b : A)(u : Dlist)(b′ : Fresh(u, b))Dlist,

Fresh(cons(b, u)) = (a)(b#a ∧ Fresh(u, a)).

Let us describe in detail how to obtain the rule for cons from the schema.

The first premise b : A is non-recursive with β = A which is a set and hence an s-type. The second premise is recursive but ordinary, so there is nothing to check. The third premise is non-recursive with

β[b, u] = Fresh(u, b) = β̂[b, F resh(u)],

where β̂[b, v] = v(b), which is a set and hence an s-type in the context (b : A, v : (a : A)set). Note that here we have a dependency of a non-recursive premise on the previous (both non-recursive and recursive) premises.

The conclusion has the right form: since α is empty there is nothing more to check.

3.3 A function defined by the analogue of universe elimination

We can define a function which computes the length of a Dlist by using an instance of the general schema corresponding to universe elimination:

length : (c : Dlist)N.

Here ψ′ = N.

The equality rules are

length(nil) = 0,
length(cons(b, u, b′)) = s(length(u)),

which easily can be seen to be instances of the general schema.

4 Universes à la Tarski - faithful reflection

4.1 The first universe

We return to the first universe and show how it is obtained by instantiating the schema. The formation rules are

U_{0} : set,
T_{0} : (U_{0})set.

Here α is empty and ψ = set.

The introduction rule reflecting Π-formation is

π_{0} : (u : U_{0})(u′ : (x : T_{0}(u))U_{0})U_{0}.

It has a first ordinary recursive premise, and a second generalized recursive premise with ξ = T_{0}(u). Thus we have an example where a recursive premise depends on an earlier recursive premise.

The corresponding equality rule is

T_{0}(π_{0}(u, u′)) = Π(T_{0}(u), (x)T_{0}(u′(x))).

The introduction rule reflecting Eq-formation is

eq_{0} : (u : U_{0})(b, b′ : T_{0}(u))U_{0}.

It has a first ordinary recursive premise, and a second and third non-recursive premise with β = T_{0}(u). Thus we have another example when a non-recursive premise depends on an earlier recursive premise.

The corresponding equality rule is

T_{0}(eq_{0}(u, b, b′)) = Eq(T_{0}(u), b, b′).

4.2 The second universe

The formation rules are

U_{1} : set,
T_{1} : (U_{1})set.

Here α is empty and ψ = set.

There are analogous rules for the constructors π_{1} and eq_{1} to those of the first universe for reflecting Π and Eq-formation respectively. There is also a rule reflecting U_{0}-formation.

u_{01} : U_{1}.

It has no premise.

The corresponding equality rule is

T_{1}(u_{01}) = U_{0}

Since T_{0} is defined by U_{0}-recursion, it is natural to reflect it as a function

t_{01} : (U_{0})U_{1},

which is defined by U_{0}-recursion:

t_{01}(π_{0}(u, u′)) = π_{1}(t_{01}(u), (x)t_{01}(u′(x))),
t_{01}(eq_{0}(u, b, b′)) = eq_{1}(t_{01}(u), b, b′).

This definition comes after the definition of U_{0} and T_{0}, so it is an instance of the schema corresponding to universe-elimination.

This is the “first version” of the universe hierarchy in the paper on “Transfinite hierarchies of universes” in Palmgren [13], since t_{01} is not a constructor. Palmgren motivates the recursion equations for t_{01} by the principle that T_{1}(a) = T_{1}(b) should imply that a = b, which is also the reason for calling it “faithful reflection”.

4.3 Higher universes

We can continue in an analogous way and define U_{2} and T_{2}, U_{3} and T_{3}, etc. Thus for each set A definable in a theory T, there is an extension of T which contains a universe U_{n}, which contains a code for A. So we get an external universe hierarchy.

5 Unfaithful reflection and its internalization

5.1 The second universe

The “second version” of the second universe in Palmgren [13] treats the code

t_{01} : (U_{0})U_{1}

for T_{0} as a constructor instead of a recursively defined function. Hence we need an extra equality rule for T_{1}:

T_{1}(t_{01}(b)) = T_{0}(b)

This makes the reflection unfaithful, since in this case different codes may denote the same set.

5.2 The next universe construction

Griffor and Palmgren showed that the “second version” of the construction of U_{n+1} from U_{n} can be internalized. We introduce the new set formers Nextu and Nextt, such that U_{s(n)} = Nextu(U_{n}, T_{n}) and T_{s(n)} = Nextt(U_{n}, T_{n}). This construction also falls under the schema in section 2.

Let

U : set,
T : (U)set

be parameters of the definition: we need to construct a universe on top of an arbitrary family U, T.

Formation and typing

Nextu : set,
Nextt : (Nextu)set.

Introduction and equality rules correspond to those of the first universe, but we also need to reflect the code set U as

∗ : Nextu,
Nextt(∗) = U

and the decoding function T as

t : (b : U)Nextu,
Nextt(t(b)) = T (b).

5.3 The super universe

The super universe in Palmgren [13] (this idea was also originally presented in unpublished work together with Ed Griffor) is obtained by reflecting the next-universe construction, viewed as the set formers

Nextu : (U : set)(T : (U)set)set,
Nextt : (U : set)(T : (U)set)(Nextu(U, T))set

as well. This super universe also falls under the schema in section 2.

Formation and typing rules

U_{∞} : set,
T_{∞} : (U_{∞})set.

Introduction and equality rules correspond to those for the first universe, but we also need to reflect the first universe U_{0}

u_{0} : U_{∞},
T_{∞}(u_{0}) = U_{0}

and the next-universe construction Nextu

nextu : (u : U_{∞})(u′ : (x : T_{∞}(u))U_{∞})U_{∞},
T_{∞}(nextu(u, u′)) = Nextu(T_{∞}(u), (x)T_{∞}(u′(x)))

as constructors for U_{∞}.

As before there is a choice as to reflect T_{0} and Nextt either faithfully as recursively defined functions or unfaithfully as constructors. The details are similar to the situation for U_{1} presented above.

6 Other applications

Other notions which seem to be obtainable by a simultaneous inductive-recursive definition are the following.

• The propositions and truths in a Frege structure [1]. In Dybjer [7] this method is used for constructing a Frege structure inside Martin-Löf’s type theory.

• The computability predicates for types and terms in a theory with dependent types [8].

• The generalization of logical relations to the case of dependent types [3].

The details of the two latter constructions are not yet developed.

References

[1] P. Aczel. Frege Structures and the Notions of Proposition, Truth, and Set, pages 31–59 in The Kleene Volume. North-Holland, 1980.

[2] T. Coquand. Pattern matching with dependent types. This volume.

[3] T. Coquand. An Algorithm for Testing Conversion in Type Theory, pages 255–279 in Logical Frameworks. Cambridge University Press, 1991.

[4] T. Coquand and C. Paulin. Inductively defined types, preliminary version. In LNCS 417, COLOG ’88, International Conference on Computer Logic. Springer-Verlag, 1990.

[5] P. Dybjer. An inversion principle for Martin-Löf’s type theory. In Proceedings of the Workshop on Programming Logic. Programming Methodology Group Report 54, Chalmers University of Technology and University of Göteborg”, May 1989.

[6] P. Dybjer. Inductive sets and families in Martin-Löf’s Type Theory and their set-theoretic semantics, pages 280–306 in Logical Frameworks. Cambridge University Press, 1991.

[7] P. Dybjer. Constructing a Frege structure in predicative type theory. Draft paper, 1992.

[8] P. Martin-Löf. An intuitionistic theory of types. Unpublished report, 1972.

[9] P. Martin-Löf. An intuitionistic theory of types: Predicative part. In Logic Colloquium ‘73, pages 73–118. North-Holland, 1975.

[10] P. Martin-Löf. Constructive mathematics and computer programming. In Logic, Methodology and Philosophy of Science, VI, 1979, pages 153–175. North-Holland, 1982.

[11] P. Martin-Löf. Intuitionistic Type Theory. Bibliopolis, 1984.

[12] P. F. Mendler. Predicative type universes and primitive recursion. In Proceedings Sixth Annual Synposium on Logic in Computer Science. IEEE Computer Society Press, 1991.

[13] E. Palmgren. On Fixed Point Operators, Inductive Definitions and Universes in Martin-Löf’s Type Theory. PhD thesis, Uppsala University, 1991.

[14] J. Smith. Propositional functions and families of types. Notre Dame Journal of Formal Logic, 30(3):442–458, 1989.

Formalizing Properties of Well-Quasi Ordered Sets in ALF

DRAFT

Daniel Fridlender^{∗} University of Göteborg and Chalmers University of Technology

June 1992

Abstract

To prove termination of an algorithm taken from polynomial ideal theory, some general properties of ordered sets must be proved. With the aim of deriving this algorithm in ALF, constructive proofs of these properties and their formalization in ALF are presented.

Introduction

This paper presents some preliminary work on the line of completely formalizing in ALF a constructive proof of a proposition taken from polynomial ideal theory. In the classical proof of this proposition, a classical argument is used to prove the unexistence of infinite sequences of tuples of natural numbers

(t_{1}^{1}, …, t_{n}^{1}), …, (t_{1}^{m}, …, t_{n}^{m}), …

such that

∀i, j ∈ N .i < j ⟹ ∃k ∈ 1 … n.t_{k}^{i} ≰ t_{k}^{j}.  (1)

Next section explains the proposition taken from polynomial ideal theory and the role this classical argument plays in the classical proof. The following section formulates ways of expressing the unexistence of such infinite sequences in a constructive setting. After that, the formalization of two constructive arguments is described. To conclude, we discuss some problems that arose with the formalization and show how they may be solved with the pattern-matching facility of ALF described in [4].

Motivation

The proposition taken from polynomial ideal theory states the existence of Gröbner bases for finitely generated polynomial ideals over discrete fields. More precisely, the proposition says that

given a field K with decidable equality, a natural number n, an admissible order ≺ over N^{n} and a finitely generated polynomial ideal I, there exist polynomials g_{1}, …, g_{s} such that {g_{1}, …, g_{s}} is a Gröbner basis of I with respect to ≺.

∗frito@cs.chalmers.se

The field K is the set from which the coefficients of the polynomials are taken. The number n is the number of indeterminates for the polynomials and so, N^{n} is the set of exponents. Given an exponent e ∈ N^{n} and i ∈ 1 … n, e_{i} is the i-th coordinate of e. We define d(e) = e_{1}+…+e_{n}. The notions of admissible order and Gröbner basis involved in the proposition are introduced below. After that, we briefly explain how the need of proving the unexistence of infinite sequences satisfying (1) arises.

The reader is referred to [1] and [6] for detailed descriptions of the proposition, and to [2] and [1] for its applications.

Admissible orders

When dealing with polynomials with only one indeterminate, the way to write them is very natural: we use the usual order < over natural numbers and we write the monomials in decreasing order of their exponents. It might be irrelevant when we just want to write them, but it turns out to be important when we want to write a procedure to divide a polynomial by another because it grants the procedure to terminate.

There is not such a natural way (or may be there are many) when we speak of polynomials with many indeterminates. For instance the lexicographical order between tuples

e ≺_{l} f ⟺ ∃j ∈ 1 … n.(e_{j} < f_{j} ∧ ∀i ∈ 1 … (j − 1).e_{i} = f_{i})

or the degree lexicographical order

e ≺_{d} f ⟺ d(e) < d(f) ∨ (d(e) = d(f) ∧ e ≺_{l} f)

or the reverse order

\begin{aligned}e ≺_{r} f & ⟺ & d(e) < d(f) ∨ \\ & & ∨ (d(e) = d(f) ∧ ∃j ∈ 1 … n.(e_{j} > f_{j} ∧ ∀i ∈ (j + 1) … n.e_{i} = f_{i})) \end{aligned}

are “suitable” ways of determining this “way of writing” polynomials. By suitable we mean that procedures like the division will terminate.

We precise the notion of being “suitable” by defining admissible orders. A total order ≺ over N^{n} is admissible iff

• ∀e ∈ N^{n}.(0, …, 0) ⪯ e

• ∀e, f, g ∈ N^{n}.e ≺ f ⟹ e +^{n} g ≺ f +^{n} g

where +^{n} is the componentwise addition.

Gröbner bases

Consider the case of polynomials with only one indeterminate. To compute the remainder of the division of f by g = a_{n}X^{n} + a_{n−1}X^{n−1} + … + a_{0} (where a_{n} is a nonzero element in the field K) we can consider g as a rewriting rule

a_{n}X^{n} ⟶ −a_{n−1}X^{n−1} − … − a_{0}

which transforms polynomials of the form

f_{1} = p + b_{m+n}X^{m+n} + … + b_{m}X^{m} + q

into

f_{2} = p + (b_{m+n−1} − \frac{b_{m+n}}{a_{n}} a_{n−1})X^{m+n−1} + … + (b_{m} − \frac{b_{m+n}}{a_{n}} a_{0})X^{m} + q,

where

\begin{aligned}p & = & b_{m+n+o}X^{m+n+o} + … + b_{m+n+1}X^{m+n+1} \\ q & = & b_{m−1}X^{m−1} + … + b_{0}. \end{aligned}

The usual algorithm to compute the remainder r of the division of f by g consists of a sequence of such transformations. It can be seen that any sequence f_{1}, …, f_{t} such that

• f = f_{1},

• ∀i ∈ 2 … t, f_{i−1} is transformed to f_{i}, and

• f_{t} can not be further transformed,

produces the remainder of the division of f by g, which is f_{t}.

Once we have an admissible order this can be generalized to the case of n indeterminates. Given a nonzero polynomial g we define e_{≺}(g) to be the greatest exponent of g with respect to ≺, c_{≺}(g) the coefficient with which it appears in g and m_{≺}(g) the monomial c_{≺}(g)X^{e_{≺}(g)}. Notice that we use the notation cX^{e} for cX_{1}^{e_{1}} … X_{n}^{e_{n}}. We can look at g as a rewriting rule

m_{≺}(g) ⟶ m_{≺}(g) − g.

If a polynomial f_{1} has no monomial m with exponent e such that e_{≺}(g) ≤^{n} e we say that f_{1} is in normal form with respect to g and ≺. In the case that f_{1} has a monomial cX^{e} such that e_{≺}(g) ≤^{n} e we say that f_{1} reduces to f_{2} by g and ≺ using the monomial of exponent e and we write it f_{1} ⟶^{e,g,≺} f_{2}, where

\begin{aligned}f_{2} & = & f_{1} − \frac{cX^{e}}{m_{≺}(g)}g \\ & = & f_{1} − \frac{c}{c_{≺}(g)}X^{e−^{n}e_{≺}(g)}g. \end{aligned}

where −^{n} is the componentwise subtraction.

Now, we can think of having a set of polynomials or rules G = {g_{1}, …, g_{s}}. By f_{1} ⟶^{G,≺} f_{2} we mean that there is some e ∈ N^{n} and some g ∈ G such that f_{1} ⟶^{e,g,≺} f_{2}, and we say that f_{1} reduces to f_{2} by G and ≺. The polynomial f is in normal form with respect to G and ≺ if for all g ∈ G it is in normal form with respect to g and ≺.

Again we can think of several steps of ⟶^{G,≺} as a division of a polynomial f by a set of polynomials G. The fact of being ≺ an admissible order grants the procedure to terminate. But the difference is that now there is not such a unique remainder because in each step we have many possible rules to apply and in general, ⟶^{G,≺} is not confluent. A set G of polynomials is called a Gröbner basis with respect to ≺ iff ⟶^{G,≺} is confluent.

There are many other characterizations of Gröbner bases (see [1] and [6]).

Notice that the notion of being a Gröbner basis depends on the admissible order ≺ and so, a set may not be a Gröbner basis with respect to an admissible order in spite of being a Gröbner basis with respect to another admissible order.

We say that G is a Gröbner basis of an ideal I with respect to ≺ iff it is a Gröbner basis with respect to ≺ and the ideal generated by G is I.

Classical Proof

The classical proof of the proposition (see [3], [6] and [1]) and consists of:

• A procedure that computes a sequence g_{1}, …, g_{s}, … of polynomials.

• A proof of absurdity from the assumption that the sequence of polynomials computed by the procedure is infinite, that is, a classical proof of termination.

To look at the classical proof with more detail, we define the relation <^{n} over N^{n} by

e ≤^{n} f ⟺ ∀i ∈ 1 … n.e_{i} ≤ f_{i}

With this the classical proof consists of:

• A procedure that computes a sequence g_{1}, …, g_{s}, … of nonzero polynomials with greatest exponents e^{1}, …, e^{s}, … (i.e., e_{i} = e_{≺}(g_{i})) such that

∀i, j ∈ N .i < j ⟹ e^{i} ≰^{n} e^{j}.  (2)

• A proof of absurdity from the assumption that an infinite sequence of exponents satisfying (2) exists.

The second point, which is the classical proof of termination, states exactly the unexistence of an infinite sequence satisfying (1), because of the equivalence between (1) and (2). A sequence e^{1}, …, e^{s}, … (finite or infinite) satisfying (2) is called a bad sequence.

Thus, in what follows, we will formalize constructive proofs of the unexistence of infinite bad sequences.

Constructive Formulations

Two approaches have been taken to express termination in a constructive way.

The first one was inspired in the fact that the infinite sequence e^{1}, …, e^{s}, … is bad iff the finite sequences [], [e^{1}], …, [e^{1}, …, e^{s}], … are all bad sequences. Thus, instead of speaking of the unexistence of infinite bad sequences, we can speak of the well-foundedness of the relation ⊏ on finite bad sequences defined by

[e^{1}, …, e^{s_{1}}] ⊏ [f^{1}, …, f^{s_{2}}] ⟺ s_{1} = s_{2} + 1 ∧ ∀i ∈ 1 … s_{2}.e^{i} = f^{i}.

The second approach is dual to this one and is essentially the one chosen in [7]. A sequence e^{1}, …, e^{s}, … is good iff there exist i, j ∈ N such that i < j and e^{i} ≤^{n} e^{j}. The decidability of ≤^{n} implies that the sets B and G of all the finite bad and good sequences respectively, form a partition of the set of finite sequences. Thus, instead of speaking of the unexistence of infinite bad sequences, we can speak of the existence of a good initial segment of any infinite sequence. We follow [9] expressing this universal quantification over infinite sequences by means of bar induction.

Thus, given a set A and a relation < on it, we will have two different definitions of the predicate well^{1}. According to the first one, < is well iff the relation ⊏ defined by

[a_{1}, …, a_{n}] ⊏ [b_{1}, …, b_{m}] ⟺ n = m + 1 ∧ ∀i ∈ 1 … m.a_{i} = b_{i}

1The properties we are interested in, hold for any well relation. This is why we define the notion of well instead of the more known notion of well quasi-order suggested by the title of this paper

is well-founded on the set of finite bad sequences (of elements of A). According to the second one, < is well iff the predicate to be good, on finite sequences of elements of A, is a bar.

In both approaches the strategy taken was to prove as a lemma that if <_{A} and <_{B} are well on A and B respectively, so is <_{A×B} on A × B, where

(a, b) ≤_{A×B} (c, d) ⟺ a ≤_{A} c ∧ b ≤_{B} d.

This, together with a proof that < (the usual order on natural numbers) is well will give a proof that <^{2} is well on N^{2}, and by induction, that <^{n} is well on N^{n} for any natural number n.

Thus, in spite of being interested only in the relation <^{n}, we proved the lemmas in a more general level involving any relation on any set.

Formalizations

The formalizetions were done in ALF (see [8]). The new features for making definitions in contexts were used extensively. We briefly show the syntax for dealing with contexts and substitutions.

To give a name to a context:

                               name = context

To make definitions in a context we show as an example the definition of tsil (lists in reverse order) where the context is [A:Set]:

                   tsil  : Set  [A : Set]
                   []  : tsil  [A : Set]
                   .  : (tsil; A)tsil  [A : Set]
                   tsilrec : (P : (tsil)Set;

P([]);

                              (l : tsil; a : A; P(l))P(l.a);

                              l : tsil)P(l)  [A : Set]
                  tsilrec(P, d, e, []) = d
                  tsilrec(P, d, e, l.a) = e(l, a, tsilrec(P, d, e, l))

Substitutions can also be given a name:

                      name = {x_{1} := t_{1}, . . . , x_{n} := t_{n}} C_{1}   C_{2}

where the context C_{1} contains a typing for x_{1}, …, x_{n} and the free variables in t_{1}, …, t_{n} are typed in the context C_{2}. The syntax of the application of a substitution σ to a term t is t{σ}.

In the definitions that follow we use contexts to represent the structure we work with: a relation on a set.

First Approach

With the definition of tsil above, we say that an order < on a set A is well iff the relation ⊏ defined by

l ⊏ k ⟺ ∃a ∈ A.l = k.a

is well-founded on the subset of the bad tsils. Thus, the definition of well-foundedness must be defined not just for a relation, but for a relation on a subset.

In the proof that <_{A×B} is well on A × B provided that <_{A} and <_{B} are well on A and B respectively, we followed [10] where this result is proved for well quasi-orders (well relations that are quasi-orders). The main lemma in [10] is that < is well on A iff for all a ∈ A its restriction is well on A[a], which is defined there as a subset of A.

These arguments led us to define relations with a context having the relation itself, the set on which it is defined and the subset on which the behavior of the relation is interesting:

                      REL = [A : Set; As : (A)Set; <: (A; A)Set] .

We define for a relation to be well-founded, as it is frequently done in constructive mathematics. We define the accessible part of a set by a relation, slightly modified here to consider the case of a relation on a subset:

       acc : (A)Set                                                 REL
       acc_{I} : (a : A; As(a); (b : A; As(b); b < a)acc(b))acc(a)  REL
       acc_{E} : (P : (a : A; acc(a))Set;

(a : A;

               as : As(a);
               q : (b : A; As(b); b < a)acc(b);
               (b : A; bs : As(b); r : b < a)P(b, q(b, bs, r)))P(a, acc_{I}(a, as, q));
               a : A;

               p : acc(a))P(a, p)  REL
         acc_{E}(P, d, a, acc_{I}(a, as, q)) = d(a, as, q, [b, bs, r]acc_{E}(P, d, b, q(b, bs, r)))

Finally, a relation is well-founded if all the elements of the subset are in the accessible part:

                     wf = ∀a ∈ A.As(a) ⊃ acc(a) : Set  REL

We informally said that a relation is well iff the relation ⊏ defined above, is well-founded on the subset of bad tsils:

                well = wf{A := tsil; As := bad; <:=⊏} : Set  REL

The set tsil was already defined. To define the subset (or predicate) bad a more elementary notion seems to be necessary: the one of being a bad element for a tsil. Given a relation < on A, a tsil [a_{1}, …, a_{s}] and a ∈ A, a is a bad element for [a_{1}, …, a_{s}] iff

∀i ∈ 1 … s.a_{i} ≰ a

where ≤ is the reflexive closure of < and not = [A]A ⊃ ⊥ : (Set)Set.

Two possible definitions of bad element have been analized: by an inductive definition, or by an implicit definition. We have chosen the latter, because the former, though being more elegant and clear, seems not to be strong enough to prove some properties. Some comments on this are presented in the last part of this paper.

                          badelem : (tsil; A)Set  REL

                     badelem([], a) = As(a)
                     badelem(l.b, a) = badelem(l, a) ∧ b ≰ a

The same arguments led us to use implicit definitions to define bad and ⊏:

                             bad : (tsil)Set  REL

bad([]) = ⊤

                        bad(l.a) = bad(l) ∧ badelem(l, a)
                            ⊏ : (tsil; tsil)Set  REL

[] ⊏ l = ⊥

                              l.b ⊏ l′ = l =_{tsil} l′

In [10] given a relation < on A and a finite sequence [a_{1}, …, a_{n}] the subset of A, A[a_{1}, …, a_{s}] is defined by

A[a_{1}, …, a_{s}] = {a ∈ A|∀i ∈ 1 … s.a_{i} ≰ a}.

The main lemma there is that < is well on A iff for all a ∈ A, it is well on A[a]. This is stated in ALF with two lemmas:

             lemma_{1} = ? : (well; l : tsil)well{As := badelem(l)} REL
             lemma_{2} = ? : ((a : A)well{As := badelem([].a)})well   REL

being lemma 1 a more general statement than the “only if” part of the main lemma.

What follows presents a formalization of the statements proved in [10]. Lemma 3 states that if a relation is well on a subset, it is also well on a subset of it; lemma 4, that if a relation is well on two subsets, it is well on their union.

       lemma_{3} = ? : (Bs : (A)Set; (a : A; Bs(a))As(a); well)well{As := Bs} REL
       lemma_{4} = ? : (Bs : (A)Set;

                       well;

                       well{As := Bs})well{As := [a]As(a) ∨ Bs(a)}  REL

The theorem, saying that if < is a decidable relation well on A and ≺ is well on B, <_{A×B} is well on A × B.

       theorem = ? : ((a, b : A)a < b ∨ a ≮ b; well; well_{B})well{σ} REL + REL_{B}

where the substitution σ is

σ = {A := A ∧ B; As := [p]As(fst(p)) ∧ Bs(snd(p)); <:= [p, q] <_{A×B} (fst(p), snd(p), fst(q), snd(q))} : REL REL + REL_{B} .

and

        REL_{B} = [B : Set; Bs : (B)Set; ≺: (B; B)Set]
        well_{B} = well{A := B; As := Bs; <:=≺}  : Set          REL_{B}

<_{A×B} = [a, b, c, d](a < c ∧ b =_{B} d)
∨ (a =_{A} c ∧ b ≺ d)

                  ∨ (a < c ∧ b ≺ d)  : (A; B; A; B)Set  REL + REL_{B}

The formal proof follows the arguments in [10]. The formalization is not difficult but has many details that make it laborious.

Second Approach

Contrary to what happened in the first approach, now there is no need to consider subsets. The notion of well is now defined as a property that the whole set of tsils has to satisfy, which is, that the predicate good is a bar. Thus, the structure we need is represented by the context:

                          REL = [A : Set; <: (A; A)Set] .

We define the dual notion to bad, to be good, which uses a previous notion of being a good element. Given a relation < on A, a tsil [a_{1}, …, a_{s}] and a ∈ A, a is a good element for [a_{1}, …, a_{s}] iff

∃i ∈ 1 … s.a_{i} ≤ a

This time we chose an inductive definition because at the time this proof was done, the new facilities with pattern-matching were already under development and they solved the weakness of this definition:

        goodelem : (tsil; A)Set                                    REL
        goodelem_{I1} : (l : tsil; a, b : A; a ≤ b)goodelem(l.a, b)  REL
        goodelem_{I2} : (l : tsil; a, b : A; goodelem(l, b))goodelem(l.a, b)  REL
        goodelem_{E} : (b : A;

                      P : (l : tsil; goodelem(l, b))Set;
                      (l : tsil; a : A; r : a ≤ b)P(l.a, goodelem_{I1}(l, a, b, r));
                      (l : tsil;
                      a : A;
                      g : goodelem(l, b);
                      P(l, g))P(l.a, goodelem_{I2}(l, a, b, g));
                      l : tsil;

                      g : goodelem(l, b))P(l, g)  REL
    goodelem_{E}(b, P, d, e, l.a, goodelem_{I1}(l, a, b, r)) = d(l, a, r)
    goodelem_{E}(b, P, d, e, l.a, goodelem_{I2}(l, a, b, g)) = e(l, a, g, goodelem_{E}(b, P, d, e, l, g))

The same argument led us to use inductive definitions for the predicate good.

         good : (tsil)Set                                        REL
         good_{I1} : (l : tsil; a : A; goodelem(l, a))good(l.a)  REL
         good_{I2} : (l : tsil; a : A; good(l))good(l.a)  REL
         good_{E} : (P : (l : tsil; good(l))Set;

                  (l : tsil; a : A; g : goodelem(l, a))P(l.a, good_{I1}(l, a, g));
                  (l : tsil; a : A; g : good(l); P(l, g))P(l.a, good_{I2}(l, a, g));
                  l : tsil;

                  g : good(l))P(l, g)  REL
            good_{E}(P, d, e, l.a, good_{I1}(l, a, g)) = d(l, a, g)
            good_{E}(P, d, e, l.a, good_{I2}(l, a, g)) = e(l, a, g, good_{E}(P, d, e, l, g))

With this approach we express the unexistence of infinite bad sequences by saying that every infinite sequence has an initial segment which is good. Following [9] we express this universal quentification over infinite sequences through the notion of being a bar. We say that a predicate P on tsils bars a tsil l, either when P(l) holds or when for all a in A it bars l.a. For an analysis of bar induction as a constructive principle, we refer to [5].

This is formalized in ALF by the inductive definition:

          bar : ((tsil)Set; tsil)Set  [A : Set]
          bar_{I1} : (P : (tsil)Set; l : tsil; P(l))bar(P, l)  [A : Set]
          bar_{I2} : (P : (tsil)Set; l : tsil; (a : A)bar(P, l.a))bar(P, l) [A : Set]
          bar_{E} : (P : (tsil)Set;

                  Q : (l : tsil; bar(P, l))Set;
                  (l : tsil; p : P(l))Q(l, bar_{I1}(P, l, p))
                   (l : tsil;
                   q : (a : A)bar(P, l.a);

(a : A)Q(l.a, q(a)))Q(l, bar_{I2}(P, l, q));

                  l : tsil;

                  p : bar(P, l))Q(l, p)  [A : Set]
          bar_{E}(P, Q, d, e, l, bar_{I1}(P, l, p)) = d(l, p)
          bar_{E}(P, Q, d, e, l, bar_{I2}(P, l, p)) = e(l, p, [a]bar_{E}(P, Q, d, e, l.a, p(a))))

With this, we say that a relation is well when good bars the empty tsil:

                           well = bar(good, []) REL

The proof that if two relation < and ≺ are well on A and B respectively, so is their product on A × B proceeds by defining a 3-ary predicate P whose arguments are tsils of elements of A, B and A × B respectively. Informally, we define P by

P(([a_{1}, …, a_{n}], [b_{1}, …, b_{m}], [(c_{1}, d_{1}), …, (c_{l}, d_{l})])
⟺
good([a_{1}, …, a_{n}]) ∨ ∃i ∈ 1 … n.∃j ∈ 1 … l.a_{i} ≤ c_{j} ∨
∨ good{σ_{B}}([b_{1}, …, b_{m}]) ∨ ∃i ∈ 1 … m.∃j ∈ 1 … l.b_{i} ⪯ d_{j} ∨
∨ good{σ}([(c_{1}, d_{1}), …, (c_{l}, d_{l})])

where the definition of σ and σ_{B} are the intuitive ones.

With this, what is proved is that if < and ≺ are well on A and B respectively, P([], []) is a bar (on the sequences of pairs). What remains to prove is that good([]) does not hold.

Some Comments on the Formalizations

In both approaches some inductive definitions seemed to be too weak for our purposes. In the first one, an inductive definition of bad element would not allow us to prove a ≰ b from the fact of being b a bad element for a sequence whose last element is a, which is intuitive from the informal definition of being a bad element. The difficulty comes from the impossibility of defining the function last on tsils (or head on lists). An analogous problem arises in the second approach, in which an inductive definition of good is not strong enough to prove that the empty tsil is not good.

In both problems, the difficulty comes from having to consider in the proofs, while using the elimination rule of the inductive definition, impossible cases. The pattern-matching feature presented in [4] eliminates from the case analysis these impossible cases.

References

[1] Bruno Buchberger. Gröbner Bases: An Algorithmic Method in Polynomial Ideal Theory. In N.K.Bose, editor, Multidimensional Systems Theory, pages 184-232. D.Reidel Publishing Company. Dordrecht-Boston-Lancaster, 1985.

[2] Bruno Buchberger. Applications of Gröbner Bases in Non-linear Computational Geometry. In Proc. Workshop on Scientific Software, IMA, Minneapolis, USA. Springer, 1987.

[3] Bruno Buchberger. Ein algorithmus zum Auffinden der Basiselemente des Restklasseringes nach einem nulldimensionalen Polynomideal. Ph. D. Thesis, Univ. Innsbruck, 1965.

[4] Thierry Coquand. Pattern-matching with dependent types. These Proceedings.

[5] Michael Dummett. Elements of Intuitionism. Oxford, 1977.

[6] Monique Lejeune-Jalabert. Effectivité de calculs polynomiaux. D.E.A. Thesis, Inst. Fourier, Univ. Grenoble I, 1985.

[7] Carl Jacobsson, Clas Löfwall. Standard bases for general coefficient rings and a new constructive proof of Hilbert’s basis theorem. Journal of Symbolic Computation 1991, Vol 12, pg. 337 - 371.

[8] Lena Magnusson. These Proceedings.

[9] Per Martin-Löf. Notes on Constructive Mathematics. Almqvist & Wiksell, Stockholm, 1968.

[10] Fred Richman and Gabriel Stolzenberg. Well Quasi-Ordered Sets. To appear in Advances in Mathematics.

Formal Proofs of Combinatorial Completeness

Veronica Gaspes^{∗} University of Gothemburg and Chalmers University of Technology

June 1992

Abstract

Formal proofs of the combinatorial completeness of two combinator calculi are presented. The formal language used to write the calculi and the proofs in is Martin-Löf’s set theory. The formalization was machine checked in Alf (Another Logical Framework) where the set theory and the notions involved in the proofs were implemented. The first proof concerns untyped combinators where unrestricted combinatorial completeness holds. The presentation of the calculus as well as the proof of combinatorial completeness are from Curry and Feys’ book Combinatory Logic [CF58]. The second proof concerns simply typed combinators where a typed restricted version of combinatorial completeness holds.

An appendix is attached with the implementation in Alf of the formalization.

1 Introduction

This paper describes formalization of proofs of some theorems involving combinators. The theorems state the ability of combinators to describe functions without the use of variables. To express these statements, known as combinatorial completeness, the notion of intuitive function is formulated so that it can be stated that any such function can be defined by means of the combinators. First an untyped version of the combinators is considered, taken from Curry and Feys’ book Combinatory Logic [CF58]; the definitions and the proofs follow the ones presented there and have been formalized in Martin-Löf’s set theory and machine checked using the Alf system. Next a typed version, with types formed from arbitrary atoms by →, is presented and a type restricted version of the combinatorial completeness is proved. Two approaches to the typed calculus are analyzed. Curry’s one, where arbitrary combinators may be formed which are then assigned types; and Church’s one where combinators are defined as belonging to some type (this approach is used in the papers by Tait [Tai67] and Sanchís [San67]).

The work was intended as an exercise in developing a concrete example in Martin-Löf’s set theory. A description of this theory may be found in the book Programming in Martin-Löf’s Type Theory by Nordström, Petersson and Smith [NPS90], from which we borrow the notational conventions. The implementation of the logical framework provided by Alf was of crucial importance in actually completing this development. It provides a straightfoward implementation of the set theory and the sets that are added for the particular problem, and, in checking the definitions and proofs, it helps you by keeping track of a lot of information. A description of an earlier version of Alf may be found in [ACN90]. The set theory was used by defining new sets that correspond to this particular problem. These definitions usualy introduce new primitive notions which are provided by making an inductive definition, but there are also some abbreviations which are stated using definitional equality.

∗vero@cs.chalmers.se

All the informal definitions, statements and proofs are to be found in the literature. They are presented here only as an introduction to the formalization, which then is interleaved with the text and is presented as soon as the notions are introduced. The paper begins with some references to the presentation of formal systems as given in the first chapters of [CF58], emphasizing the relation of that approach to the formalization of theories in Martin-Löf’s set theory.

1.1 Formal Systems

The aim of this section is to show some connections between the way formal systems are analyzed in chapters 1 and 2 in [CF58] and the way one formalizes theories in Martin-Löf’s set theory. In [CF58] a language, the U-language, and a theory, the epi-theory, are described which are assumed to be understood and are used to comunicate notions and to prove statements. In this context, the description of a formal system consists of extending the U-language in a particular way which also extends the theory in the sense that it provides it with more principles of proof.

A formal system is described by a collection of sets: a set of objects introduced by the formal system, a set of statements or formulae formulated by the formal system (called the elementary statements which could be understood as the forms of judgement introduced by the formal system) and a set of theorems proved by the formal system (called the elementary theorems which may be understood as the evident judgements). The U-language is thus enriched with the new objects and predicate formers. All these sets are introduced by inductive definitions, and hence the epi-theory is enriched with principles of proof by induction over these sets. The principles that arise from different inductive definitions are carefully explained in [CF58].

It is required that the epi-theory is constructive, so that proofs of elementary theorems or construction of elementary objects can be produced from the proof of an epi-theorem stating their existence. If one understands the epi-theory and the U-language as Martin-Löf’s set theory, then the description of a formal system consists of extending the set theory with some sets. The extended theory may be used to prove elementary statements, i.e. to use the formal system defined; or epi-statements, i.e. to prove statements about the formal system defined. The sets that characterize the formal system are given by inductive definitions; there are rules to introduce the elements of each set and an elimination rule that expresses the principle of proof or definition by induction over that set. The explanation of the induction techniques in [CF58] may be used as a justification of the elimination rules. Most of the epi-theorems in the book are then proved by induction which can easily be expressed in set theory.

This approach differs from the more usual one in the presentation of formal systems [Kle52], described as more syntactical in [CF58]. For this other view, the first step in the setting of a formal system consists of defining a new language, as formed by the strings over a certain alphabet. This new language is then called the object language and is never used. The language in which the formulation is made is called the metalanguage where there are names for the expressions of the object language. All the use that is done of the formal system introduced is through the metalanguage. In the more abstract approach above, objects are introduced by an inductive definition thus being formed through specific constructors, not merely by sequencing of characters. This approach is followed also in the definition of the forms of judgements and the set of theorems, where the constructors correspond to the axioms and rules of inference. In this case the objects introduced are used, thus constituting an extension of the used language.

This corresponds exactly to the way one introduces new sets in Martin-Löf’s set theory, one has then an extended language and theory to use.

1.2 Variables

When considering the definition of a formal system as extending a language and a theory with some constants and rules, it remains to be said how variables are to be handled. The original, primitive language will contain variables, in [CF58] called the intuitive variables, which, in setting up a formal system, are used to express generality, for instance when describing a schematic rule or stating some epi-theorems. It may be the case that the formal system introduced needs to describe functional objects. This is usually done by introducing a category of objects, the formal variables, for which a rule of substitution is formulated. These special objects are then introduced as new constants that extend the primitive language. The aim of combinatory logic is to provide a formal system that analyzes the role of variables and substitution in such a way that it may be used in the presentation of other formal systems when describing functional objects. Hence, once combinatory logic has been introduced, neither variables nor substitution rules need to be considered.

The theory of combinators itself does not contain variables. It will be the case, however, that to state the theorems about the combinatorial completeness (epi-theorems concerning the formal systems we will present for the combinators), we will have to consider formal systems which do contain variables, namely extensions with variables of the original theory. In these extensions the objects will be understood as functions from objects of the original theory to objects of the original theory. These variables added in the extensions will be introduced by only saying that they are objects, no rule of substitution will be stated for them nor will they take part of any statement but as arbitrary objects. In [CF58] these formal variables are called indeterminates. They have the property that they may be replaced by an arbitrary object and thus, the statements involving them are equally valid as general epi-statements using an intuitive variable instead. The theories for combinators will be formalized in Martin-Löf’s set theory by defining new sets for the objects, statements and theorems; the variables of an extension will be implemented by a particular set.

2 Untyped Combinators

The theory of combinators provides an analysis of the process of substitution through the notions of function and application. In Schönfinkel’s original paper [Sch24], a theory of functional objects is introduced to represent incomplete objects without using variables to indicate the places for the argument. These functional objects, called combinators, are obtained from certain atomic combinators by means of application as the only operation. Substitution is represented by application and there are rules that say which object results when the substitution is performed. The atomic combinators and the rules that define them express the basic ways of building expressions which contain holes, namely, building an arbitrary constant expression (not depending in what is provided as argument) and the incomplete expression resulting from application of an incomplete expression to another.

Following [CF58], the theory of combinators, called H, is defined as a formal system in the sense above, by inductively defining the objects, the statements and the theorems. The objects are formed from the atoms K, to express constant functions, and S, to express the function which results from the application of a function to another one. Application will be denoted by juxtaposition fa, associating to the left. The statements are of the form f ∼ g, where f and g are arbitrary objects. The theorems are defined by the following axioms and rules

\begin{matrix}Kab ∼ a & (K) \\ Sfga ∼ fa(ga) & (S) \\ f ∼ f & (ρ) \\ {f ∼ g \atop g ∼ f} & (σ) \\ \begin{matrix}f ∼ g & g ∼ h \\ f ∼ h \end{matrix} & (τ) \\ {f ∼ g \atop fa ∼ ga} & (μ) \\ {a ∼ b \atop fa ∼ fb} & (ν) \end{matrix}

As an example of an object of this theory, consider SKK, which, according to the rules, behaves like the identity function, i.e. the function representing the incomplete object which when completed with any other object as argument produces the same object as result: let x be an arbitray object, then

SKKx ∼ Kx(Kx) ∼ x

The result we will analyze is the ability of this calculus of functions to describe as an object any intuitive incomplete object. These incomplete objects are understood to be described as a combination of previously defined functions and variables. It will be shown that any such object is already present as an object (a function) of the calculus. This property is known as combinatorial completeness and we need to introduce some way of describing the intuitive incomplete objects in order to state it more precisely. This result makes it possible to work with this calculus, instead of using variables and introducing substitution, when defining other formal systems. We will follow Curry’s formulation of intuitive incomplete objects and of what it means for them to be described by a function in the calculus.

A possible way of understanding the intuitively definable functions from objects to objects is by considering combinations formed not only from K and S but involving also certain arguments x_{1}, …, x_{n}. This may be done by considering a theory similar to the original one where certain unspecified objects x_{1}, …, x_{n} have been added. If we let H’ be the theory that results by adjoining the indeterminates x_{1}, …, x_{n} to H, then an object h′ in H’ can be understood as an incomplete object which when completed with objects a_{1}, …, a_{n} of H yields an object of H. Thus, what must be shown is that for every h′ an object h of H may be defined so that it represents the incomplete object h′ as a function from objects in H to objects in H. The way of proving that this term h represents h′ as a function is done by showing that

hx_{1} … x_{n} ∼ h′

is a theorem of H’. This means, because h does not contain any of the indeterminates x_{1}, …, x_{n}, that for every tuple a_{1}, …, a_{n} of objects of H, the application ha_{1} … a_{n} is equal to the object that results by replacing the indeterminates in h′ by a_{1}, …, a_{n}. Before showing how to define h in H from h′ in H’, we will show how to formalize, in Martin-Löf’s set theory, the theory H and its extensions.

To proceed, the notion of extension by adjoining indeterminates must be formulated more precisely. While a theory is characterized by the set of objects, the set of statements and the set of theorems, an extension is defined by the set of indeterminates adjoined. Thus, a theory and its extensions may be described as a family of theories indexed by the sets of indeterminates, i.e. by a family of objects, a family of statements and a family of theorems, all indexed by the sets of indeterminates. All theories in the family are different, however there is a natural way of identifying an arbitrary object of a theory with the one built in the same way in an extension. This is made explicit by injections of a theory to an extended one. When considering this, the statement about hx_{1} … x_{n}∼h′ must be formulated more precisely considering these injections: because h is a term in H it must be injected into H’ for the application to x_{1}, …, x_{n} to be an element in the corresponding set of objects and the statement to make sense.

The formalization consists of defining sets and families of sets in the set theory to represent the notions being formalized. The following is a presentation of such a formalization for the families of theories of combinators above:

• Each set of indeterminates is a finite set, hence it will be represented by the finite sets of Martin-Löf’s theory N_{n}. These sets will be defined as a family indexed by the length n. The introduction rules for this family correspond to a finite set being formed by injecting all the elements in the previous one and putting one element more. There is no introduction rule for the finite set of length 0.

IS-formation

IS(n) Set [n ∈ N]

IS-introduction-1

{n ∈ N \atop put(n) ∈ IS(s(n))}

IS-introduction-2

n ∈ N x ∈ IS(n)
inject(n, x) ∈ IS(s(n))

An elimination rule is given for each set IS(n) which allows proof of statements under the assumption of having an element in the corresponding segment. The set IS(0) has no introduction rule, thus its elimination looks like ⊥-elimination:

IS-elimination-0

P (x) Set [x ∈ IS(0)] p ∈ IS(0)
IS0E(P, p) ∈ P (p)

The IS(s(n)) has the two introduction rules above, thus, IS-elimination-s

n ∈ N
P (x) Set [x ∈ IS(s(n))]
e ∈ P (put(n))
d(q) ∈ P (inject(n, q)) [q ∈ IS(n)]
p ∈ IS(s(n))
ISsE(n, P, e, d, p) ∈ P (p)

This constant is defined by the equalities ISsE(n, P, e, d, put(n)) = e

ISsE(n, P, e, d, Inject(n, q)) = d(q)

• The family Ob indexed by the sizes of the initial segments represents the family of objects indexed by the extensions: Ob-formation

Ob(n) Set [n ∈ N]

The introduction rules correspond to the formation of the objects in an extension with n indeterminates: Ob-introduction-1

{n ∈ N \atop K(n) ∈ Ob(n)}

Ob-introduction-2

{n ∈ N \atop S(n) ∈ Ob(n)}

Ob-introduction-3

n ∈ N x ∈ IS(n)
Var(x, n) ∈ Ob(n)

(corresponding to the variable x in an extension with n variables) Ob-introduction-4

n ∈ N f, a ∈ Ob(n)
App(f, a, n) ∈ Ob(n)

There is an elimination rule for the set of objects in each extension: Ob-elimination

n ∈ N P (x) Set [x ∈ Ob(n)] k ∈ P (K(n)) s ∈ P (S(n)) v(y) ∈ P (Var(y, n)) [y ∈ IS(n)] a(h, z, ih, iz) ∈ P (App(h, z, n)) [h, z ∈ Ob(n), ih ∈ P (h), iz ∈ P (z)] o ∈ Ob(n)

ObE(n, P, k, s, v, a, o) ∈ P (o)

This constant is defined by the equalities ObE(n, P, k, s, v, a, K(n)) = k ObE(n, P, k, s, v, a, S(n)) = s ObE(n, P, k, s, v, a, Var(y, n)) = v(y)

ObE(n, P, k, s, v, a, (App(h, z, n)) = a(h, z,

ObE(n, P, k, s, v, a, h), ObE(n, P, k, s, v, a, z))

• The family Form of the statements or formulae: Form-formation

Form(n) Set [n ∈ N]

There is only one kind of statement, equality between objects: Form-introduction

\begin{matrix}n ∈ N & a, b ∈ Ob(n) \\ a ∼_{n} b ∈ Form(n) \end{matrix}

Form-elimination

n ∈ N
P (x) Set [x ∈ Form(n)]
e(a, b) ∈ P (a ∼_{n} b) [a, b ∈ Ob(n)]
f ∈ Form(n)
FormE(n, P, e, f) ∈ P (f)

FormE(n, P, e, a ∼_{n} b) = e(a, b)

• The family ⊢ of the theorems:

⊢-formation

⊢_{n} f Set [n ∈ N, f ∈ Form(n)]

The introduction rules correspond to the axioms and inference rules for asserting equality between terms. Only some of them are exhibited here, the ones corresponding to (K), (ρ) and (μ); the rest are coded in the same way.

⊢-introduction-K

n ∈ N a, b ∈ Ob(n)
kk(a, b, n) ∈ ⊢_{n} App(App(K, a, n), b, n) ∼_{n} a

⊢-introduction-ρ

\begin{matrix}n ∈ N & a ∈ Ob(n) \\ ρ(a, n) ∈ ⊢_{n} a ∼_{n} a \end{matrix}

⊢-introduction-μ

n ∈ N f, g, a ∈ Ob(n) p ∈ ⊢_{n} f ∼_{n} g
μ(f, g, a, n, p) ∈ ⊢_{n} App(f, a, n) ∼_{n} App(g, a, n)

We have thus defined the sets that describe a family of theories, each set of each theory defined inductively. The elimination rules which close the definitions are used whenever definition by recursion or proof by induction on a given set is required.

There is a natural way of understanding an object of a theory as an object of an extension, built in the same way but in the extended theory. When formalizing the theorem about combinatorial completeness this injection is required and thus must be stated formally. This is done by means of a function

O ∈ (Πm, n ∈ N)(m ≤ n) ⊃ Ob(m) ⊃ Ob(n)

which given m, n with m ≤ n will take an object in an extension with m indeterminates into “itself” in an extension with n indeterminates. The definition of O is based on the injection of an initial segment of length m into the one of length n. To implement this definitions ≤ will be defined by first defining < as follows:

<-formation

m < n Set [m, n ∈ N]

The introduction rules state that < is the transitive closure of the relation that a number is less than its succesor:

<-introduction-1

n ∈ N

OneStep(n) ∈ n < s(n)

<-introduction-2

\begin{matrix}m, n, o ∈ N & m < n & n < o \\ τ(m, n, o) ∈ m < o \end{matrix}

The elimination rule closes the definition by stating the principle of proof or definition which allows us to use the knowledge that a number is less than another one according to this definition:

<-elimination

P (x, y, z) Set [x, y ∈ N, z ∈ m < n] e(x) ∈ P (x, s(x), OneStep(x)) [x ∈ N]

d(s, t, u, q, r, i, h) ∈ P (s, u, τ(s, t, u)) [ \begin{matrix}s, t, u ∈ N, \\ q ∈ s < t, \\ r ∈ t < u, \\ i ∈ P (s, t, q), \\ h ∈ P (t, u, r) \end{matrix} ]

m, n ∈ N p ∈ m < n

<E(P, e, d, m, n, p) ∈ P (m, n, p)

<E(P, e, d, m, s(m), OneStep(m)) = e(m)

<E(P, e, d, m, o, τ(m, n, o, q, r)) = d(m, n, o, q, r, < E(P, e, d, m, n, q), < E(P, e, d, n, o, r))

With this, the definition of O is by cases on m ≤ n ≡ m = n ∨ m < n. If m = n it is the identity. If m < n it follows by induction on this fact, by using the elimination rule for the set <. The two cases that must be considered are

n is the succesor of m. By induction on Ob(m) each case of object formation is considered and translated to the corresponding element in Ob(n),

there is a number o such that m < o and o < n. O is defined to be the composition of the functions the induction hypothesis yields for m < o and o < n.

In a similar way the formulae of a theory may be injected as formulae of an extension by means of a function

F ∈ (Πm, n ∈ N)(m ≤ n) ⊃ Form(m) ⊃ Form(n)

which is defined in the same way as O.

2.1 Definition of Abstraction

We now define, for any object h′ in H’, an object h in H that represents it as a function from objects in H to objects in H, and prove this fact. The definition and the proof are by induction on the size of the extension, the inductive step being based on the definition and proof corresponding to passing from a theory with at least one indeterminate to one with the extra indeterminate removed. In order to describe the definition we will use the notation of bracket abstraction for the object defined: if h′ is an object in H’, we shall write [x_{1}, …, x_{n}]h′ for the h in H. With this notation the induction step in the definition may be expressed as

[x_{1}, …, x_{n}, x]h′ ≡ [x_{1}, …, x_{n}] ([x] h′)

The definition of [x]h′ is by induction on h′. For each way of building objects in an extension containing x, it is analyzed what function of x is intended and so an object which represents such a function in a theory without x is defined. The following cases arise:

• h′ is K. When thought of as a function of x from objects of H to objects of H, it is the constant function with value K. Thus we define [x]K to be KK.

• h′ is S. With the same argument as for K we define [x]S to be KS.

• h′ is a variable of the extension. Then there are two cases to consider; either the variable is x or some other variable y. In the case it is y, the same argument as for K and S, yields the definition of [x]y to be Ky. In the case it is x the definition is such that the function is the identity function. This is because x is the identity function when considered a function of x. Thus, for this case we define [x]x to be SKK which was shown above to behave as the identity.

• h′ is an application fg. Both f and g may contain x and thus are to be considered as functions of x. The induction hypothesis yields the definitions of the two functions [x]f and [x]g. The object that results when performing the substitution of an object of H for x in fg may be analyzed as formed by the application of the object that results from performing the substitution in f to the one that results from performing it in g. In terms of [x]f and [x]g this is expressed by the application of ([x]f)o to ([x]g)o where o is the object substituted for x. We thus define [x](fg) to be S ([x]f) ([x]g).

The formalization of these definitions proceeds by first defining [x]h′ by induction on the construction of h′, an object in a theory that contains at least one variable, i.e. by applying the elimination rule for Ob to h′∈ Ob(s(n)) for some natural number n. Thus, by assuming that one has such an h′, an object in Ob(n) is defined as the abstraction of the extra variable from h′. The cases that arise in the induction on h′ are the following:

• h′ is K(s(n)). Then define the abstraction as the constant function with value K in Ob(n): App(K(n), K(n), n).

• h′ is S(s(n)). Then define the abstraction to be the constant function with value S in Ob(n): App(K(n), S(n), n).

• h′ is Var(x, s(n)) where x ∈ IS(s(n)). Then one must analyze whether x is the variable to be abstracted (the variable that extends the theory from n to s(n)) or any other variable (already present in the theory for n). This is realized by making an induction on x, i.e. by applying the elimination rule for IS to x ∈ IS(s(n)). The two cases that arise are

– x is put(n). Then define the abstraction to be the identity function in Ob(n): App(App(S(n), K(n), n)K(n), n).

– x is inject(y, n) where y is in IS(n). Then define the abstraction to be the constant function with value y in Ob(n): App(K(n), Var(y, n), n).

• h′ is an application App(f, a, s(n)). Then the induction hypothesis yields a value for f in Ob(n), say fh, and a value for a in Ob(n), say ah, then define the abstraction to be App(App(S(n), fh, n), ah, n).

We have thus defined an element in Ob(n) assuming n ∈ N and h′ in Ob(s(n)). We will now define, by induction on n, an element in Ob(0) from an element h′ in an extension with n indeterminates, the abstraction of all the variables in the extension. Using induction on n two cases arise

• If n is 0, then h′ is already an element in Ob(0).

• If n is the succesor of some natural number t, the induction hypothesis yields a method for defining an element in Ob(0) for every h in Ob(t). Then take the element in Ob(t) which results from appliyng the definition above and finally apply the method yielded by the induction hypothesis to this element.

One must now prove that the abstractions so defined behave as planned, i.e. that hx_{1} … x_{n}∼ h′. This proof follows the same lines as the definition of h; again it is carried out by induction on n, the crucial case being the proof that ([x]h′)x∼ h′, which again is an induction on the construction of h′:

• h′ is K, S, or a variable y different from x (the definition of [x]h′ is the same for these three cases, Kh′). Then we have ([x]h′) x ≡ Kh′x∼ h′.

• h′ is the variable x. Then we have ([x]x)x ≡ SKKx∼ x.

• h′ is the application fg. Then we have

([x](fg))x ≡ S ([x]f) ([x]g) x ∼ (([x]f)x) (([x]g)x)

The induction hypothesis yields ([x]f)x ∼ f and ([x]g)x ∼ g and hence, by application of the rules μ, ν and τ,

(([x]f)x) (([x]g)x) ∼ fg

With the definitions for the theories of combinators above, and letting h′ be the object in an extension with n indeterminates and h be [x_{1} … x_{n}]h′ in the original theory (an extension with no indeterminates), the fact that h represents h′ as a function is formalized by:

⊢_{n} app^{∗}(O(h), n) ∼_{n} h′

where app^{∗}(x, n) is defined by induction on n as the application of x ∈ Ob(n) to all the indeterminates of the extension. The injection of h into the extension with n indeterminates is needed for the application to x_{1}, …, x_{n} to make sense. As in the informal proof above this is shown by induction on n, the induction step being based on the proof of

⊢_{s(n)} App(O(h), put(n), n) ∼_{s(n)} h′

where h′ is an object in an extension with s(n) indeterminates and h is the corresponding [x]h′ in an extension with n indeterminates, the abstracted variable being the last element of the initial segment IS(s(n)), i.e. put(n). The induction on h′ used in the informal proof is implemented by an application of the elimination rule for Ob(n). The ≡ that are said to hold in the informal proof hold by definitional equality, while the ∼ require the application of the rules that define ⊢_{n}.

The definition of [x_{1} … x_{n}]h′ together with the proof of ⊢_{n} app^{∗}(O(h), n) ∼_{n} h′ constitute a proof of

(Πn ∈ N)(Πh′ ∈ Ob(n))(Σh ∈ Ob(0)). ⊢_{n} app^{∗}(O(h), n) ∼_{n} h′

which formalizes the combinatorial completeness for untyped combinators. This formalization of the theories and the proofs was edited in Alf, the code of this implementation is attached as an appendix.

3 Typed Combinators

In this section we shall introduce a theory of typed combinators and show that a restricted version of combinatorial completeness holds. After a short motivation for the introduction of types, the theory and the notion of extension by adjoining indeterminates will be presented together with a formalization in Martin-Löf’s set theory. Next, a typed version of the combinatorial completeness will be proved, followed by the corresponding formalization.

Different analysis of combinatory logic as a formalism to express the process of substitution in formalized theories end in the introduction of types to classify combinators in different categories. In Curry and Feys [CF58] the types are associated with semantical categories. The coding of propositional logic as an extension of combinatory logic with a constant P for forming implication (P fg codes f ⊃ g), a new statement constructor ⟼ for derivability (⟼ f codes f is derivable) and rules for proving that certain objects are derivable (⟼ P f(P gf) codes the axiom f ⊃ g ⊃ f) results in an inconsistent theory in the sense that for every object f, it is a theorem that ⟼ f. This inconsistency is avoided by restricting the arguments of ⟼ to be propositions. This implies classifying the objects to isolate the category of propositions. This gives rise to the theory of functionality presented in [CF58] where, from the type of propositions, a functional hierarchy is built. Martin-Löf presents an argument for classifying the combinators in syntactical categories. The untyped combinators are rejected as a basis for the presentation of formal systems due to the fact that equality between them is not decidable and thus cannot be used as definitional equality; and that abbreviations may not be eliminable (consider the term SII(SII)). The solution comes from analyzing expressions into saturated and unsaturated as Frege [Fre84] did. This is expressed by means of types, starting from a type for saturated expressions and building a functional hierarchy from it for the unsaturated expressions according to the kind of argument they expect. This system is presented in chapter 3 of [NPS90] for the λ-calculus.

Different notions of meaningfullness led Curry and Church to different ways of considering the typed versions of their calculi. Curry’s approach consists of assigning types to the untyped objects while Church’s consists of designing a new calculus where only typed objects are formed. We will consider the typed version of the combinatorial completeness statement in both approaches.

In Curry’s approach a new set of objects is defined, namely the types, and a new judgement form, that a combinator has a type. There are axioms and rules defining the provable judgments of this form. Thus, the notions and theorems involving the combinators are left as they were, and new theorems are stated involving the types. In the case of the combinatorial completeness, it is said that, if after assigning types to the variables of the etension an object can be assigned a type, then the abstraction of that object (defined for untyped combinators) can be assigned a type, namely the function type from the types of the variables to the type of the original object.

Following Church’s approach, everything must be done again from the very begining. Once the types are defined, for each type it is said which are the combinators of that type; hence, instead of a set of combinators there is a family of sets, indexed by the types. The equality judgement is then stated for typed combinators. The extensions considered in order to define abstraction are extensions with typed variables and the abstraction is defined among typed combinators.

What follows presents the formalization of the definitions of abstraction and the proofs that it behaves as intended for the simply typed combinators following both approaches. Church’s version is presented first in full detail, while Curry’s approach is only sketched. Both were checked in Alf and the appendix contains the Alf implementation for Church’s version.

3.1 Types a la Church

The types are formed from arbitrary atomic types by means of the function arrow →. The objects are not introduced as a single set but as a family indexed by the types so there is a set of objects for each type. The elementary statements are equalities between objects of the same type. The restricted version of combinatorial completeness that can be proved takes the types of the incomplete object and the variable to be abstracted into account and forms a function of the adequate type. In order to describe the incomplete objects we must again consider extensions of the original theory by adjoining indeterminates, in this case typed indeterminates.

In the following definition of the theory of typed combinators, let α, β, γ, … be variables of the epi-theory ranging over types. The objects of each type are defined from typed versions of K, S and application: For all types α, β, there is a constant

K_{α,β} : α → β → α

For all types α, β, γ there is a constant

S_{α,β,γ} : (α → β → γ) → (α → β) → α → γ

And for all types α, β there is an operation of application

\begin{matrix}M : α → β & N : α \\ (MN) : β \end{matrix}

The formulae are equalities between objects belonging to the same type, so if f and g are objects in the same type α, then f ∼_{α} g is an elementary formula. The theorems are characterized by essentially the same rules as in the untyped theory but also considering the typing of the objects involved:

\begin{matrix}K_{α,β}ab ∼_{α} a & (K) \\ S_{α,β,γ}fga ∼_{γ} fa(ga) & (S) \\ f ∼_{α} f & (ρ) \\ {f ∼_{α} g \atop g ∼_{α} f} & (σ) \\ \begin{matrix}f ∼_{α} g & g ∼_{α} h \\ f ∼_{α} h \end{matrix} & (τ) \\ {f ∼_{α→β} g \atop fa ∼_{β} ga} & (μ) \\ {a ∼_{α} b \atop fa ∼_{β} fb} & (ν) \end{matrix}

As an example of the objects definable in this theory, consider S_{α,α→α,α}K_{α,α→α}K_{α,α} : α → α, the typed identity function: let x be any object of type α, then

S_{α,α→α,α}K_{α,α→α}K_{α,α}x ∼_{α} K_{α,α→α}x(K_{α,α}x) ∼_{α} x

We will have to consider extensions of this theory by adjoining indeterminates to express the intuitive incomplete objects. In order for an indeterminate to be adjoined, it must be introduced as an object of some type, and thus must have a type associated to it. We will use the notation x^{α} for an indeterminate x which has been assigned type α. In an extension with the indeterminates x_{1}^{α_{1}}, …, x_{n}^{α_{n}} the objects of a given type are built as above with the addition of letting variables of type α be objects of type α. An extension is then no longer a finite set, but a finite set together with an assignment of types to each of the elements of this set.

The formalization in set theory proceeds by considering that each theory consists of a family (not only a set as in the untyped case) of objects, formulae and theorems, and by considering a family of such theories indexed by extensions. Again the notion of extension must be made precise, in this case to take into account that there is no longer a set of objects to which indeterminates are adjoined, but a family of them. An extension of the theory of typed combinators may be characterized by a set of indeterminates together with a way of adjoining them to some sets of objects, thas is, together with a way of assigning types to them. Thus, not only the sets of indeterminates must be formalized (by the initial segments of the natural numbers) but also the type assignments to these sets. These will be formalized by finite sequences of types of length n for the type assignements for the initial segment of length n. The formalization, which is roughly as for the untyped case, requires the definition of the following sets:

• A set Type for the types of the combinators

Type-formation

Type Set

The set Type is inductively generated and there are two introduction rules; one for the atomic types, that is, the type variables, and one for function types. We let the type variables be indexed by some given set Atom:

Type-introduction 1

\frac{α ∈ Atom}{var(α) ∈ Type}

Type-introduction 2

α ∈ Type β ∈ Type
α → β ∈ Type

Type-elimination

P (t) Set [t ∈ Type]
b(at) ∈ P (var(at))[at ∈ Atom]
i(α, β, I_{α}, I_{β}) ∈ P (α → β)[α, β ∈ Type, I_{α} ∈ P (α), I_{β} ∈ P (β)]
α ∈ Type
TypeRec(P, b, i, α) ∈ P (t)

TypeRec(P, b, i, var(at)) = b(at)
TypeRec(P, b, i, α → β) = i(α, β, TypeRec(P, b, i, α), TypeRec(P, b, i, β))

• IS(n) Set [n ∈ N] The finite sets (the sets of indeterminates). The same sets as for the untyped case.

• A family TA for the type assignements to the sets of indeterminates:

TA-Formation

TA(n) Set [n ∈ N]

Each element in TA(n) formalizes a type assignement for IS(n) as a sequence of length n of elements of Type:

TA-introduction-1

Nil ∈ TA(0)

TA-introduction-2

n ∈ N ta ∈ TA(n) α ∈ Type
Cons(n, ta, α) ∈ TA(s(n))

TA-elimination

P (x, y) Set [x ∈ N, y ∈ TA(x)]
e ∈ P (0, Nil)
d(m, t, α, i) ∈ P (s(m), Cons(m, t, α))[m ∈ N, t ∈ TA(m), α ∈ Type, i ∈ P (m, t)]
n ∈ N
ta ∈ TA(n)
TAE(P, e, d, n, ta) ∈ P (n, ta)

TAE(P, e, d, 0, Nil) = e
TAE(P, e, d, s(n), Cons(n, t, α)) = d(n, t, α, TAE(P, e, d, n, t))

• The family of objects of each type in each extension is defined by means of Ob. The set Ob(n, ta, α) defines the set of objects of type α in an extension with n variables and a type assignement ta to the indeterminates of the extension. The introduction rules correspond to the formation of the terms:

Ob-formation

Ob(n, ta, α) Set [n ∈ N, ta ∈ TA(n), α ∈ Type]

Ob-introduction-1

n ∈ N ta ∈ TA(n) α, β ∈ Type
K(n, ta, α, β) ∈ Ob(n, ta, α → β → α)

Ob-introduction-2

n ∈ N ta ∈ TA(n) α, β, γ ∈ Type
S(n, ta, α, β, γ) ∈ Ob(n, ta, (α → β → γ) → (α → β) → α → γ))

Ob-introduction-3

n ∈ N ta ∈ TA(n) α ∈ Type x ∈ IS(n) p ∈ VarType(n, ta, x, α)
Var(n, ta, α, x, p) ∈ Ob(n, ta, α)

In this last rule, which corresponds to introducing an indeterminate as an object of type α when the extension is given by n and ta, the premise p ∈ VarType(n, ta, x, α) corresponds to a proof that the indeterminate x (an element in IS(n)) has the type α in ta. The set VarType, which formalizes this statement, is defined bellow.

Ob-introduction-4

n ∈ N ta ∈ TA(n) α, β ∈ Type f ∈ Ob(n, ta, α → β) a ∈ Ob(n, ta, α)
App(n, ta, α, β, f, a) ∈ Ob(n, ta, β)

Ob-elimination n ∈ N ta ∈ TA(n) P (x, y) Set [x ∈ Type, y ∈ Ob(n, ta, x)] k(u, v) ∈ P (u → v → u, K(n, ta, u, v)) [u, v ∈ Type] s(u, v, w) ∈ P ((u→v →w)→(u→v)→u→w, S(n, ta, u, v, w)) [u, v, w ∈ Type] v(u, v, w) ∈ P (u, Var(n, ta, u, v, w)) [u ∈ Type, v ∈ IS(n), w ∈ VarType(n, ta, v, u)]

a(u, v, w, x, iw, ix) ∈ P (v, App(n, ta, u, v, w, x)) [ \begin{matrix}u, v ∈ Type, \\ w ∈ Ob(n, ta, u → v), \\ x ∈ Ob(n, ta, u), \\ iw ∈ P (u → v, w), \\ ix ∈ P (u, x) \end{matrix} ]

α ∈ Type p ∈ Ob(n, ta, α)

obE(n, ta, P, k, s, v, a, α, t) ∈ P (α, t)

obE(n, ta, P, k, s, v, a, α → β → α, K(n, ta, α, β)) = k(α, β)

\begin{matrix}obE(n, ta, P, k, s, v, a, (α → β → γ) → (α → β) → α → γ, & S(n, ta, α, β, γ)) \\ = s(α, β, γ) \end{matrix}

obE(n, ta, P, k, s, v, a, α, Var(n, ta, α, x, p)) = v(α, x, p)

obE(n, ta, P, k, s, v, a, β, App(n, ta, α, β, f, x)) = a(α, β, f, x,

obE(n, ta, P, k, s, v, a, α → β, f), obE(n, ta, P, k, s, v, a, α, x))

• In order to formalize the variable x^{α} we will define a set of proofs of a variable (an element in some IS) being assigned a type by a type assignement, i.e. a set that formalizes that the type of the i-th element in an initial segment is assigned the type in the i-th possition of the type assignment. VarType(n, ta, x, α) defines the predicate stating that the type assigned to x by the type assignement ta is α.

VarType-formation

VarType(n, ta, x, α) Set [n ∈ N, ta ∈ TA, x ∈ IS(n), α ∈ Type]

VarType-introduction-1

n ∈ N ta ∈ TA(n) α ∈ Type
PutType(n, ta, α) ∈ VarType(s(n), Cons(n, ta, α), put(n), α)

VarType-introduction-2

n ∈ N ta ∈ TA(n) α, β ∈ Type y ∈ IS(n) p ∈ VarType(n, ta, α, y)
InjectType(n, ta, α, β, y, p) ∈ VarType(s(n), Cons(n, ta, β), inject(n, y), α)

The first introduction rule states that the type assigned to the last variable in an initial segment of length n is the last type in a type assignement of this length. The second one states that the type of a variable present already in the previous initial segment has the type given to it in the corresponding shorter type assignment.

VarType-elimination

n ∈ N ta ∈ TA(n)

P (x, y, z, t) Set [ \begin{matrix}x ∈ IS(s(n)), \\ y, z ∈ Type, \\ t ∈ VarType(s(n), Cons(n, ta, z), x, y) \end{matrix} ]

e(x) ∈ P (put(n), x, x, PutType(n, ta, x)) [x ∈ Type]

d(x, y, z, t) ∈ P (inject(n, z), x, y, InjectType(n, ta, x, y, z, t)) [\begin{matrix}x, y ∈ Type, \\ z ∈ IS(n), \\ t ∈ VarType(n, ta, z, x) \end{matrix}]

i ∈ IS(s(n)) α, β ∈ Type p ∈ VarType(s(n), Cons(n, ta, β), i, α)

VarTypeE(n, ta, P, e, d, i, α, β, p) ∈ P (i, α, β, p)

VarTypeE(n, ta, P, e, d, put, α, α, PutType(n, ta, α)) = e(α)

VarTypeE(n, ta, P, e, d, inject(n, x), α, β, InjectType(n, ta, α, β, x, p)) = d(α, β, x, p)

• There is a set which formalizes the formulae of the typed combinators, with only one introduction rule, corresponding to the only way of building formulae, i.e. equality between objects of the same type in a given extension:

Form-formation

Form(n, ta, α) Set [n ∈ N, ta ∈ TA(n), α ∈ Type]

Form-introduction

n ∈ N ta ∈ TA(n) α ∈ Type f, g ∈ Ob(n, ta, α)
f ∼_{n,ta} g ∈ Form(n, ta, α)

• Finally, there is a set describing the theorems, i.e. the provable equalities. The introduction rules correspond to the axioms and inference rules. As in the untyped case we shall only present some of them, the ones corresponding to (K), (ρ) and (μ).

⊢-formation

⊢_{n,ta} f Set [n ∈ N, ta ∈ TA(n), α ∈ Type, f ∈ Form(n, ta, α)]

⊢-introduction-K

n ∈ N ta ∈ TA(n) α, β ∈ Type a ∈ Ob(n, ta, α), b ∈ Ob(n, ta, β)

kk(n, ta, α, β, a, b) ∈ ⊢_{n,ta} App(App(n, ta, α, β → α, K, a), n, ta, β, alpha, b) ∼_{n,ta} a

⊢-introduction-ρ

n ∈ N ta ∈ TA(n) α ∈ Type a ∈ Ob(n, ta, α)
ρ(n, ta, α, a) ∈ ⊢_{n,ta} a ∼_{n,ta} a

⊢-introduction-μ

n ∈ N
ta ∈ TA(n)
α, β ∈ Type
f, g ∈ Ob(n, ta, α → β)
a ∈ Ob(n, ta, α)
p ∈ ⊢_{n,ta} f ∼_{n,ta} g
μ(n, ta, α, β, f, g, a, p) ∈ ⊢_{n,ta} App(n, ta, α, β, f, a) ∼_{n,ta} App(n, ta, α, β, g, a)

As for the untyped case, there is a natural way of thinking of an object in a theory as an object in an extension, as built up in the same way. This is made explicit by a function O (as before) which takes an object in a theory and builds up the corresponding one in the extension. For this typed theory, we will only consider the abstraction of one variable, the induction on n required to abstract all the n variables of an extension is essentially the same as for the untyped theory. Thus we will only require the injection of a theory into the next one, which is provided by the function

O ∈ (Πn ∈ N)(Πta ∈ TA(n))(Πα, β ∈ Type)(Ob(n, ta, β)) ⊃ Ob(s(n), Cons(n, ta, α), β)

The function O takes a natural number n, a type assignment ta of length n, a type α to extend the type assignment and a type β which is the type of the object in question. It then takes an object of type β in an extension with n indeterminates which are assigned types by ta and produces an object of type β built in the same way in a theory with s(n) indeterminates assigned types by Cons(n, ta, α). The definition is by induction on Ob(n, ta, β), formally by application of the elimination rule for this set.

This concludes the formalization of the theory of simply typed combinators, the next section considers the definition of the typed version of abstraction.

3.1.1 Typed Abstraction

Consider an extension with n indeterminates x_{1}^{α_{1}}, …, x_{n}^{α_{n}}. By adding one more indeterminate x^{α}, the objects h′ : β in this new theory are such that when replacing an object of type α for x^{α} in them, they yield an object of type β. We will show that these objects were already present in the theory without x^{α} as functions h : α → β. This will be done by definining for each h′ : β an object [x^{α}]h′ : α → β and then showing that

([x^{α}]h′)x^{α} ∼_{s(n),β} h′

Both the definition of [x^{α}]h′ and the proof of ([x^{α}]h′)x^{α} ∼_{s(n),β} h′ are by induction on h′ being an object of type β in the extension with x_{1}^{α_{1}}, …, x_{n}^{α_{n}}, x^{α}. Except for the type information involved, the definition proceeds in the same way as for the untyped case in all cases but the one for the variable. In the untyped case, the analysis of which variable is considered is by induction on the definition of being in the corresponding initial segment, which alone characterizes the extension. In the typed case, the analysis is an induction on the definition of which type is assigned to the variable in the extension, because it is this definition which follows the construction of the extension, it takes into account both the initial segment and the type assignement. The definition of [x^{α}]h′ will be done by analyzing what function of x^{α} h′ is for each of the forms of constructing h′:

• h′ : β is K_{γ_{1},γ_{2}} (β is γ_{1} → γ_{2} → γ_{1}). When thought of as a function of x^{α} it is the constant function with value K_{γ_{1},γ_{2}}. Thus we define [x^{α}]K_{γ_{1},γ_{2}} : α → (γ_{1} → γ_{2} → γ_{1}) to be K_{γ_{1}→γ_{2}→γ_{1},α}K_{γ_{1},γ_{2}}.

• h′ : β is S_{γ_{1},γ_{2},γ_{3}} (β is (γ_{1} → γ_{2} → γ_{3}) → (γ_{1} → γ_{2}) → γ_{1} → γ_{3}). With the same argument as for K_{γ_{1},γ_{2}} we define [x^{α}]S_{γ_{1},γ_{2},γ_{3}} : α → ((γ_{1} → γ_{2} → γ_{3}) → (γ_{1} → γ_{2}) → γ_{1} → γ_{3}) to be K_{(γ_{1}→γ_{2}→γ_{3})→(γ_{1}→γ_{2})→γ_{1}→γ_{3},α}S_{γ_{1},γ_{2},γ_{3}}.

• h′ : β is a variable of the extension. Then there are two cases to consider according to whether the variable is x^{α} (β is α) or some other variable y^{γ} (β is γ). In the case it is y^{γ}, by the same argument as for K_{γ_{1},γ_{2}} and S_{γ_{1},γ_{2},γ_{3}}, the definition of [x^{α}]y^{γ} : α → γ is K_{γ,α}y^{γ}. In the case it is x^{α} the definition is such that the function is the identity function, as x^{α} is when considered a function of x^{α}. Thus, for this case we define [x^{α}]x^{α} : α → α to be S_{α,α→α,α}K_{α,α→α}K_{α,α} which was shown above to behave as the identity.

• h′ : β is an application fg where both f : γ_{1} → γ_{2} and g : γ_{1} may contain x^{α} and thus are to be considered as functions of x^{α}. The induction hypothesis yields the definitions of the two functions [x^{α}]f : α → γ_{1} → γ_{2} and [x^{α}]g : α → γ_{1}. The object that results when performing the substitution of an object of type α for x^{α} in fg may be analyzed as formed by the application of the object that results from performing the substitution in f to the one that results from performing it in g. In terms of [x^{α}]f and [x^{α}]g this is expressed by the application of ([x^{α}]f)o to ([x^{α}]g)o, where o is the object substituted for x^{α}. We thus define [x^{α}](fg) : α → γ_{2} to be S_{α→γ_{1}→γ_{2},α→γ_{1},α} ([x^{α}]f)([x^{α}]g).

The formalization of this definition is as follows. Given n ∈ N, ta ∈ TA(n), α ∈ Type and h′ ∈ Ob(s(n), Cons(n, ta, α), β), i.e. an object of type β in an extension with s(n) indeterminates, the last of which is assigned type α; apply the elimination rule for Ob to h′ to find an element in Ob(n, ta, α → β) according to the definition above. The premises of this rule yield the following cases:

• h′ is K(s(n), Cons(n, ta, α), γ_{1}, γ_{2}). Then define the abstraction to be the constant function with value K in Ob(n, ta, α → (γ_{1} → γ_{2} → γ_{1}):

App(n, ta, K(n, ta, γ_{1} → γ_{2} → γ_{1}, α), K(n, ta, γ_{1}, γ_{2}))

(note that we did not write the type parameters of App. They may be restored by looking at the types of the arguments. We will continue with this convention along this definition).

• h′ is S(s(n), Cons(n, ta, α), γ_{1}, γ_{2}, γ_{3}). Then define the abstraction to be the constant function with value S in Ob(n, ta, α → (γ_{1} → γ_{2} → γ_{3}) → (γ_{1} → γ_{2}) → γ_{1} → γ_{3}):

App(n, ta, K(n, ta, (γ_{1} → γ_{2} → γ_{3}) → (γ_{1} → γ_{2}) → γ_{1} → γ_{3}, α), S(n, ta, γ_{1}, γ_{2}, γ_{3}))

• h′ is Var(s(n), Cons(n, ta, α), γ, x, p), where x ∈ IS(s(n)), and

p ∈ VarType(s(n), Cons(n, ta, α), x, γ)

is a proof that the type assigned to x in the extension is γ. Then one must analyze whether x is the variable to be abstracted (the variable that extends the theory from n to s(n)) or any other variable (already present in the theory for n). This is done by making an induction on p, i.e. by applying the elimination rule for

VarType(s(n), Cons(n, ta, α), x, γ)

on p. The two cases that arise correspond to whether x is the last variable of the extension, the one we are abstracting, or some other:

– p is PutType(n, ta, α). Then define the abstraction to be the identity function in Ob(n, ta, α → α):

App(n, ta, App(n, ta, S(n, ta, α, α → α, α), K(n, ta, α, α → α))K(n, ta, α, α))

– p is InjectType(n, ta, δ, α, y, q) where y is in IS(n) (a variable already present in the extension with only n variables) and q ∈ VarType(n, ta, y, δ) is a proof that the type assigned to y in this theory is δ. Then define the abstraction to be the constant function with value y in Ob(n, ta, α → δ):

App(n, ta, K(n, ta, δ, α), Var(n, ta, δ, y, q)).

• h′ is an application App(s(n), Cons(n, ta, α), γ_{1}, γ_{2}, f, a), where

f ∈ Ob(s(n), Cons(n, ta, α), γ_{1} → γ_{2})
a ∈ Ob(s(n), Cons(n, ta, α), γ_{1})

In this case the elimination rule provides also induction hypothesis for f and a which for this definition yield that both the abstraction for f and a are defined, say fh ∈ Ob(n, ta, α → γ_{1} → γ_{2}) and ah ∈ Ob(n, ta, α → γ_{1}). Then the corresponding object for the application is

App(n, ta, App(n, ta, S(n, ta, α → γ_{1} → γ_{2}, α → γ_{1}, α)), fh), ah).

The next step is to prove that the defined function has the intended behaviour, i.e. that ([x^{α}]h′)x^{α} ∼_{s(n),β} h′. This proof is again by induction on h′ : β and as for the untyped case follows the definition of ([x^{α}]h′). It is formalized by an application of the elimination rule for Ob(s(n), Cons(n, ta, α), β) and also follows the definition of the function. From both the definition of the function and the proof about its behaviour we obtain a proof of

(Πn∈ N)(Πta ∈ TA(n))(Πα, β ∈ Type)(Πh′ ∈ Ob(s(n), Cons(n, ta, α), β))
(Σh ∈ Ob(n, ta, α → β))App(O(h), put(n, ta, PutType(n, ta, α))) ∼_{s(n),β} h′

where put(n, ta, PutType(n, ta, α)) is the variable added with type α.

The formalization of this proof, as it was edited and checked with the Alf system may be found in the appendix.

3.2 Types a la Curry

This approach is based on analysing which (untyped) combinators may be assigned a type. Consider the theory of untyped combinators and define a set for the types as in the previous section. A new judgement form is introduced, M : α where M is an (untyped) combinator and α is a type. The axioms and rules defining the provable judgments of this form are:

For any types α, β, it is provable that

K : α → β → α

For any types α, β, γ, it is provable that

S : (α → β → γ) → (α → β) → α → γ

For any types α, β,

\begin{matrix}M : α → β & N : α \\ MN : β \end{matrix}

As opposed to the system a la Church where there is a different constant K_{α,β} for each different types α, β, here there is only one constant K which may be assigned many types.

The extensions and the definition of abstraction are the ones for the untyped combinators. It remains to be said when a combinator in an extension with indeterminates x_{1}, …, x_{n}may be assigned a type. To do this, we consider again type asignments to the indeterminates and extend the notion of having a type to having a type in an extension given a type assignment. The formalization proceeds by defining the set TypeOf:

TypeOf-formation

TypeOf(n, ta, M, α) Set [n ∈ N, ta ∈ TA(n), M ∈ Ob(n), α ∈ Type

TypeOf-introduction-1

n ∈ N ta ∈ TA(n) α, β ∈ Type
Kt(n, ta, α, β) ∈ TypeOf(n, ta, K, α → β → α)

TypeOf-introduction-2

n ∈ N ta ∈ TA(n) α, β, γ ∈ Type
St(n, ta, α, β, γ) ∈ TypeOf(n, ta, S, (α → β → γ) → (α → β) → α → γ)

TypeOf-introduction-3

n ∈ N ta ∈ TA(n) x ∈ IS(n) α ∈ Type p ∈ VarType(n, ta, x, α)
vart(n, ta, x, α, p) ∈ TypeOf(n, ta, var(n, x), α)

TypeOf-introduction-4

n ∈ N
ta ∈ TA(n)
f, a ∈ Ob(n)
α, β ∈ Type
p ∈ TypeOf(n, ta, f, α → β)
q ∈ TypeOf(n, ta, a, α)
appt(n, ta, α, β, f, a, p, q) ∈ TypeOf(n, ta, App(n, f, a), β)

That abstraction behaved as intended was already shown for the untyped combinators; it is shown now that it also behaves adequately with respect to the types. We show that if M is a combinator in an extension with indeterminates x_{1}, …, x_{n} then, if given a type assignment α_{1}, …, α_{n} it is the case that M : β, then it is the case that [x_{1}, …, x_{n}]M : α_{1} → … α_{n} → β. This is proved by induction on n based on the proof that if M is a combinator in an extension with indeterminates x_{1}, …, x_{n}, x which can be assigned type β under the type assignment α_{1}, …, α_{n}, α, then [x]M is assigned type α → β in the extension x_{1}, …, x_{n} under the type assignment α_{1}, …, α_{n}. This, in turn, is proved by induction on TypeOf(s(n), Cons(n, ta, α), M, β). This theorem stating the well behaviour of abstraction with respect to types is a specialization of Curry’s stratification theorem as presented in [CF58].

3.3 Remarks

The typed combinators constitute the Curry-Howard interpretation of minimal logic as presented in the Hilbert style. The types are interpreted as the propositions (the arrow corresponds to implication) and the terms as codes for the proofs in the system. Thus the constants K_{α,β} and S_{α,β,γ} code the proofs of the axioms given by their types; and application codes a proof formed using modus monens. The indeterminates in an extension should then be interpreted as proofs of assumptions which are given by the type assigned to them. The theorem about the restricted combinatorial completeness can be read under this interpretation as stating the deductive completeness of the logical system. It states that if there is a proof of proposition β under the assumption of proposition α then there is a proof of the proposition α ⊃ β. The argument above for the typed combinators may be seen as a proof of this statement by providing a proof for α ⊃ β given the hypothetical proof of β.

There is a much simpler way (suggested by several people) to formalize the typed extensions when following Church’s approach. An extension is charachterized by a list of types; then, a variable of a given type in such an extension is identified with the proof that that type is in a given position in the list. This approach was also verified in Alf. The formalization is based in changing all definitions so that the parameter charachterizing the extension is only one, a list of types.

Acknowledgments

I am most grateful to Bengt Nordström and Jan Smith for their guidance, encouragement and good disposition. I also owe thanks to Daniel Fridlender and Nora Szasz for many helpful ideas and the careful reading of this work, and to the Programming Methodology Group for providing a very stimulating environment.

References

[ACN90] L. Augustsson, T. Coquand, and B. Nordström. A short description of Another Logical Framework. In Proceedings of the First Workshop on Logical Frameworks, Antibes, pages 39–42, 1990.

[CF58] H. B. Curry and R. Feys. Combinatory Logic, volume I. North-Holland, 1958.

[Fre84] G. Frege. Function and Concept. In B. McGuinness, editor, Gottlob Frege, Collected Papers on Mathematics, Logic, and Philosophy, pages 137–156. Basil Blackwell, 1984.

[Kle52] S. C. Kleene. Introduction to Metamathematics. North-Holland, Amsterdam, 1952.

[NPS90] Bengt Nordström, Kent Petersson, and Jan M. Smith. Programming in Martin-Löf’s Type Theory. An Introduction. Oxford University Press, 1990.

[San67] L. E. Sanchís. Functionals defined by Recursion. Notre Dame Journal of Formal Logic, 8, 1967.

[Sch24] M. Schönfinkel. Über die Bausteine der Mathematischen Logik. Mathematische Annalen, 92:305, 1924.

[Tai67] W. W. Tait. Intensional interpretation of functionals of finite type I. Journal of Symbolic Logic, 32(2):198–212, 1967.

Appendix

This appendix contains the result of editing in Alf the formalizations of the untyped and typed combinators and the proof of combinatorial completeness for them. In Alf there is a basic type of sets Set and it is possible to form function types by means of the construction (x : A)B where B may depend on x. The elements of such types are formed by abstraction, [x]b is a term in (x : A)B for b : B under the assumption that x : A. These elements may be used by application f(a).

The implementation in Alf consists of declaring a new constant of type Set for every set former, or of a function type with values in Set for every family former. Then, corresponding to each introduction and elimination rule, a constant is declared with its type corresponding to the type of functions from the types corresponding premisses to the type corresponding to the conclusion. The definitional equalities are introduced as equalities in Alf.

In Martin-Löf’s set theory there is the type of sets and then for every set there is type of elements of that set. Alf provides an implementation of this by letting every constant of type Set to be a type.

The code for the proof in Alf for both the untyped and typed combinators begins with the code for the basic sets of Martin-Löf’s set theory.

Basic Sets

The set ⊥ for absurdity

⊥ : Set
⊥_{e} : (P : (x : ⊥)Set)(bott : ⊥)P (bott)

The set of natural numbers

N : Set

0 : N

s : (N)N

natrec : (P : (N)Set)(b : P (0))(i : (x : N)(P (x))P (s(x)))(n : N)P (n)

natrec(P, b, i, 0) = b

natrec(P, b, i, s(n)) = i(n, natrec(P, b, i, n))

The set < for the order relation between natural numbers

<: (N)(N)Set

OneStep : (n : N) n < s(n)

MoreSteps : (m : N)(n : N)(o : N)(m < n )(n < o ) m < o

<_{e} : (P : (m : N)(n : N)(l : m < n )Set)
(e : (n : N)P (n, s(n), OneStep(n)))
(d : (m : N)(n : N)(o : N)
(lmn : m < n )
(lno : n < o )
(imn : P (m, n, lmn))
(ino : P (n, o, lno))

P (m, o, MoreSteps(m, n, o, lmn, lno)))

(x : N)
(y : N)
(lxy : x < y )
P (x, y, lxy)

<_{e}(P, e, d, x, s(x), OneStep(x)) = e(x)

<_{e}(P, e, d, x, z, MoreSteps(x, y, z, l_{1}, l_{2})) =

d(x, y, z, l_{1}, l_{2}, <_{e}(P, e, d, x, y, l_{1}), <_{e}(P, e, d, y, z, l_{2}))

The set corresponding to disjunction ∨ : (Set)(Set)Set inl : (A : Set)(B : Set)(a : A)A ∨ B inr : (A : Set)(B : Set)(b : B)A ∨ B

∨_{e} : (A : Set)
(B : Set)
(P : (A ∨ B)Set)
(el : (a : A)P (inl(A, B, a)))
(er : (b : B)P (inr(A, B, b)))
(p : A ∨ B)
P (p)

∨_{e}(A, B, P, el, er, inl(A, B, a)) = el(a) ∨_{e}(A, B, P, el, er, inr(A, B, b)) = er(b)

Note that ∨ is used as infix, A ∨ B is an abbreviation for ∨(A, B). The same is done for the conjunction and the implication. The set corresponding to the universal quantifier

Π : (A : Set)(B : (A)Set)Set Λ : (A : Set)(B : (A)Set)(f : (x : A)B(x))Π(A, B) Π_{e} : (A : Set)(B : (A)Set)(f : Π(A, B))(a : A)B(a) Π_{e}(A, B, Λ(A, B, f), a) = f(a)

The set of functions corresponding to implication ⊃: (A : Set)(B : Set)Set λ : (A : Set)(B : Set)(f : (A)B)A ⊃ B ⊃_{e} : (A : Set)(B : Set)(f : A ⊃ B)(a : A)B ⊃_{e}(A, B, λ(A, B, f), a) = f(a)

The set for propositional equality =: (A : Set; a, b : A)Set id : (A : Set; x : A)x =_{A} x J : (A : Set; C : (x : A)(y : A)(z : x =_{A} y)Set; d : (x : A)C(x, x, id(A, x)); a, b : A; p : a =_{A} b)C(a, b, p) J(A, C, d, a, a, id(A, a)) = d(a)

where we use a =_{A} b as an abreviation for = (A, a, b). The initial segments of natural numbers

IS : (N)Set put : (n : N)IS(s(n)) inject : (n : N)(i : IS(n))IS(s(n))

IS_{e} : (n : N)
(P : (IS(s(n)))Set)
(e : P (put(n)))
(d : (i : IS(n))P (inject(n, i)))
(p : IS(s(n)))
P (p)

IS_{e}(n, P, e, d, put(n)) = e IS_{e}(n, P, e, d, inject(n, i)) = d(i)

The proof that an initial segment may be injected into one of greater length: ISInjection : (m : N)(n : N)(p : m < n ∨ m =_{N} n)IS(m) ⊃ IS(n)

ISInjection = [m, n, p]∨_{e}(m < n ,
m =_{N} n,
[p_{1}]IS(m) ⊃ IS(n),
[a]<_{e}([m, n, a]IS(m) ⊃ IS(n),
[n_{1}]λ(IS(n_{1}), IS(s(n_{1})), [h]inject(n_{1}, h)),
[m_{1},n_{1}, o, lmn, lno, hlmn, hlno]
λ(IS(m_{1}), IS(o),
[h_{1}]⊃_{e}(IS(n_{1}),
IS(o),
hlno,
⊃_{e}(IS(m_{1}), IS(n_{1}), hlmn, h_{1}))),
m,
n,
a),
[b]J(N, [x, y, p]IS(x) ⊃ IS(y), [x_{1}]λ(IS(x_{1}), IS(x_{1}), [h]h), m, n, b),
p)

Untyped Combinators

The objects Ob : (n : N)Set K : (n : N)Ob(n) S : (n : N)Ob(n) var : (n : N; a : IS(n))Ob(n) app : (n : N; f, a : Ob(n))Ob(n)

Ob_{e} : (n : N)
(P : (x : Ob(n))Set)
(e : P (K(n)))
(f : P (S(n)))
(g : (x : IS(n))P (var(n, x)))

(h : (x : Ob(n))(y : Ob(n))(z : P (x))(t : P (y))P (app(n, x, y)))

(o : Ob(n))
P (o)

Ob_{e}(n, P, e, f, g, h, K(n)) = e Ob_{e}(n, P, e, f, g, h, S(n)) = f Ob_{e}(n, P, e, f, g, h, var(n, a)) = g(a) Ob_{e}(n, P, e, f, g, h, app(n, a, b)) = h(a, b, Ob_{e}(n, P, e, f, g, h, a), Ob_{e}(n, P, e, f, g, h, b))

The term that codes the Identity: I = [n]app(n, app(n, S(n), K(n)), K(n)) : (n : N)Ob(n)

The formulae form : (n : N)Set ∼: (n : N; f, g : Ob(n))form(n)

form_{e} :(n : N)
(P : (form(n))Set)
(e : (x : Ob(n))(y : Ob(n))P (x ∼_{n} y))
(f : form(n))
P (f)

form_{e}(n, P, e, f ∼_{n} g) = e(f, g) Where we use a ∼_{n} b as an abreviation for ∼ (n, a, b). The theorems

⊢: (n : N)(f : form(n))Set Keq : (n : N)(M, P : Ob(n))⊢_{n} app(n, app(n, K(n), M), P) ∼_{n} M

Seq :(n : N)(M, P, O : Ob(n))

⊢_{n} app(n, app(n, app(n, S(n), M), P), O) ∼_{n} app(n, app(n, M, O), app(n, P, O)) μ : (n : N)(M, O, P : Ob(n))(p : ⊢_{n} M ∼_{n} O)⊢_{n} app(n, M, P) ∼_{n} app(n, O, P) ν : (n : N)(M, O, P : Ob(n))(p : ⊢_{n} M ∼_{n} O)⊢_{n} app(n, P, M) ∼_{n} app(n, P, O) ρ : (n : N)(M : Ob(n))⊢_{n} M ∼_{n} M σ : (n : N)(M, O : Ob(n))(p : ⊢_{n} M ∼_{n} O)⊢_{n} O ∼_{n} M τ : (n : N)(M, O, P : Ob(n))(p : ⊢_{n} M ∼_{n} O)(q : ⊢_{n} O ∼_{n} P)⊢_{n} M ∼_{n} P

⊢_{e} :(n : N)

(C : (x : form(n))(y : ⊢_{n} x)Set) (ek : (x : Ob(n))(y : Ob(n))C(n ∼_{(},app(n, app(n, K(n), x), y), x), Keq(n, x, y)))

(es :(x : Ob(n))
(y : Ob(n))
(z : Ob(n))
C(app(n, app(n, app(n, S(n), x), y), z) ∼_{n} app(n, app(n, x, z), app(n, y, z)),
Seq(n, x, y, z)))
(emu :(x : Ob(n))
(y : Ob(n))
(z : Ob(n))
(t : ⊢_{n} x ∼_{n} y)
(u : C(x ∼_{n} y), t))
C(app(n, x, z) ∼_{n} app(n, y, z), μ(n, x, y, z, t)))
(enu :(x : Ob(n))
(y : Ob(n))
(z : Ob(n))
(t : ⊢_{n} x ∼_{n} y)
(u : C(x ∼_{n} y, t))
C(app(n, z, x) ∼_{n} app(n, z, y), ν(n, x, y, z, t)))

(ero : (x : Ob(n))C(n ∼_{(},x, x), ρ(n, x)))

(esigma :(x : Ob(n))
(y : Ob(n))
(z : ⊢_{n} x ∼_{n} y)
(t : C(x ∼_{n} y, z))
C(y ∼_{n} x, σ(n, x, y, z)))
(etau :(x : Ob(n))
(y : Ob(n))
(z : Ob(n))
(t : ⊢_{n} x ∼_{n} y)
(u : ⊢_{n} y ∼_{n} z)
(v : C(x ∼_{n} y, t))
(w : C(y ∼_{n} z, u))
C(x ∼_{n} z, τ(n, x, y, z, t, u)))

(f : form(n)) (p : ⊢_{n} f) C(f, p)

⊢_{e}(n, C, ek, es, emu, enu, ero, esigma, etau,

app(n, app(n, K(n), x), y) ∼_{n} x, Keq(n, x, y)) = ek(x, y)

⊢_{e}(n, C, ek, es, emu, enu, ero, esigma, etau,

app(n, app(n, app(n, S(n), x), y), z) ∼_{n} app(n, app(n, x, z), app(n, y, z)), Seq(n, x, y, z)) = es(x, y, z)

\begin{matrix}⊢_{e}( & n, C, ek, es, emu, enu, ero, esigma, etau, app(n, x, z) ∼_{n} app(n, y, z), μ(n, x, y, z, t)) \\ = emu(x, y, z, t, ⊢_{e}(n, C, ek, es, emu, enu, ero, esigma, etau, x ∼_{n} y, t)) \end{matrix}

\begin{matrix}⊢_{e}( & n, C, ek, es, emu, enu, ero, esigma, etau, app(n, z, x) ∼_{n} app(n, z, y), ν(n, x, y, z, t)) \\ = enu(x, y, z, t, ⊢_{e}(n, C, ek, es, emu, enu, ero, esigma, etau, x ∼_{n} y, t)) \end{matrix}

⊢_{e}(n, C, ek, es, emu, enu, ero, esigma, etau, x ∼_{n} x, ρ(n, x)) = ero(x)

\begin{matrix}⊢_{e}( & n, C, ek, es, emu, enu, ero, esigma, etau, y ∼_{n} x, σ(n, x, y, z)) \\ = esigma(x, y, z, ⊢_{e}(n, C, ek, es, emu, enu, ero, esigma, etau, x ∼_{n} y, z)) \end{matrix}

⊢_{e}(n, C, ek, es, emu, enu, ero, esigma, etau, x ∼_{n} z, τ(n, x, y, z, t, u)) ; \begin{matrix}= etau( & x, y, z, t, u, \\ ⊢_{e}(n, C, ek, es, emu, enu, ero, esigma, etau, x ∼_{n} y, t), \\ ⊢_{e}(n, C, ek, es, emu, enu, ero, esigma, etau, y ∼_{n} z, u)) \end{matrix}

The following two derived rules were proved:

Ieq : (n : N)(x : Ob(n))⊢_{n} app(n, I(n), x) ∼_{n} x

Ieq = [n, x]τ(n,
app(n, I(n), x),
app(n, app(n, K(n), x), app(n, K(n), x)),
x,
Seq(n, K(n), K(n), x),
Keq(n, x, app(n, K(n), x)))

μν : (n : N)(f, g, a, b : Ob(n))(⊢_{n} f ∼_{n} g)(⊢_{n} a ∼_{n} b)⊢_{n} app(n, f, a) ∼_{n} app(n, g, b)

μν = [n, f, g, a, b, h, h_{1}]τ(n,
app(n, f, a),
app(n, g, a),
app(n, g, b),
μ(n, f, g, a, h),
ν(n, a, b, g, h1))

The injection of a theory into an extension

O : (m : N)(n : N)(p : m < n ∨ m =_{N} n)(f : Ob(m))Ob(n)

O = [m,n, p, f]
Ob_{e}(m,
[x]Ob(n),
K(n),
S(n),
[x]var(n, ⊃_{e}(IS(m), IS(n), ISInjection (m, n, p), x)),
[x, y, hx, hy]app(n, hx, hy),
f)

F : (m : N)(n : N)(p : m < n ∨ m =_{N} n)(f : form(m))form(n)

F = [m,n, p, f]
form_{e}(m, [f]form(n), [x, y]O(m, n, p, x) ∼_{n} O(m, n, p, y), f)

T : (m : N)(n : N)(p : m < n ∨ m =_{N} n)(f : form(m))(⊢_{m} f)⊢_{n} F(m, n, p, f)

T = [m,n, p, f, h] ; \begin{matrix}⊢_{e}( & m, \\ [f_{1}, h]⊢_{n} F(m, n, p, f_{1}), \\ [x, y]Keq(n, O(m, n, p, x), O(m, n, p, y)), \\ [x, y, z]Seq(n, O(m, n, p, x), O(m, n, p, y), O(m, n, p, z)), \\ [x, y, z, t, h_{1}]μ(n, O(m, n, p, x), O(m, n, p, y), O(m, n, p, z), h_{1}), \\ [x, y, z, t, h_{1}]ν(n, O(m, n, p, x), O(m, n, p, y), O(m, n, p, z), h_{1}), \\ [x]ρ(n, O(m, n, p, x)), \\ [x, y, z, h_{1}]σ(n, O(m, n, p, x), O(m, n, p, y), h_{1}), \\ [x, y, z, t, u, h_{1}, h_{2}]τ(n, O(m, n, p, x), O(m, n, p, y), O(m, n, p, z), h_{1}, h_{2}), \\ f, \\ h) \end{matrix}

The definition of abstraction of one variable

The definition consists of an application of the rule Ob_{e}. We first show the terms that correspond to the premises of that rule and then plug them into it to build the definition.

KAbstAlg : (n : N)Ob(n)

KAbstAlg = [n]app(n, K(n), K(n))

SAbstAlg : (n : N)Ob(n)

SAbstAlg = [n]app(n, K(n), S(n))

varAbstAlg : (n : N)(x : IS(s(n)))Ob(n)

varAbstAlg = [n, x]IS_{e}(n, [x]Ob(n), I(n), [i]app(n, K(n), var(n, i)), x)

appAbstAlg : (n : N)(x : Ob(s(n)))(y : Ob(s(n)))(Ob(n))(Ob(n))Ob(n)

appAbstAlg = [n, x, y, h_{1}, h_{2}]app(n, app(n, S(n), h_{1}), h_{2})

AbstAlg : (n : N)(Ob(s(n)))Ob(n)

AbstAlg = [n, h]Ob_{e}(s(n),

[h_{1}]Ob(n), KAbstAlg(n), SAbstAlg(n), [x]varAbstAlg(n, x), [x, y, h_{1}, h_{2}]appAbstAlg(n, x, y, h_{1}, h_{2}), h)

The proof of the combinatorial completeness

We first abbreviate the statement with the set CombComp and then prove it using Ob_{e}. As in the definition of AbstAlg we prove all the cases corresponding to the premises and then plug them into the rule. We will not write all the arguments to the injections of a theory into another one, we will only keep what is injected and the extensions involved. Thus, O(m, n, p, f) will be abbreviated with O(m, n, f).

CombComp : (n : N)(X : Ob(s(n)))Set CombComp = [n, X]⊢_{s(n)} app(s(n), O(n, s(n), AbstAlg(n, X)), var(s(n), put(n))) ∼_{s(n)} X KCombComp : (n : N)CombComp(n, K(s(n))) KCombComp = [n]Keq(s(n), K(s(n)), var(s(n), put(n))) SCombComp : (n : N)CombComp(n, S(s(n))) SCombComp = [n]Keq(s(n), S(s(n)), var(s(n), put(n))) varCombComp : (n : N)(x : IS(s(n)))CombComp(n, var(s(n), x))

varCombComp = [n, x]IS_{e}(n,
[h]CombComp(n, var(s(n), h)),
Ieq(s(n), var(s(n), put(n))),

[i]Keq(s(n), var(s(n), inject(n, i)), var(s(n), put(n))),

x)
appCombComp : (n : N)
(f : Ob(s(n)))
(g : Ob(s(n)))
(fh : CombComp(n, f))
(gh : CombComp(n, g))
CombComp(n, app(s(n), f, g))
appCombComp = [n, f, g, fh, gh]τ(s(n),
app(s(n),

O(n, s(n), AbstAlg(n, app(s(n), f, g))),

var(s(n), put(n))),
app(s(n),

app(s(n), O(n, s(n), AbstAlg(n, f)), var(s(n), put(n))), app(s(n), O(n, s(n), AbstAlg(n, g)), var(s(n), put(n)))),

app(s(n), f, g),
Seq(s(n),

O(n, s(n), AbstAlg(n, f)), O(n, s(n), AbstAlg(n, g)),

var(s(n), put(n))),
μν(s(n),
app(Succ(n),

O(n, Succ(n), AbstAlg(n, f)), var(s(n), put(n))),

f,

app(s(n), O(n, s(n), AbstAlg(n, g)), var(s(n), put(n))),

g,
fh,
gh))

ObCC : (n : N)(X : Ob(s(n)))CombComp(n, X)

ObCC = [n, X]Ob_{e}(s(n),

[X]CombComp(n, X), KCombComp(n), SCombComp(n), [x]varCombComp(n, x), [x, y, h_{1}, h_{2}]appCombComp(n, x, y, h_{1}, h_{2}), X)

The abstraction of all the variables of an extension EAbstAlg : (n : N)Ob(n) ⊃ Ob(0)

EAbstAlg = [n]natrec([n]Ob(n) ⊃ Ob(0),
λ(Ob(0), Ob(0), [h]h),

[x, h]λ(Ob(s(x)), Ob(0), [h_{1}]⊃_{e}(Ob(x), Ob(0), h, AbstAlg(x, h_{1}))),

n)

We need the definition of the application to all the indeterminates of an extension Eapp : (n : N)Ob(0) ⊃ Ob(n)

Eapp = [n]natrec([n]Ob(0) ⊃ Ob(n),
λ(Ob(0), Ob(0), [h]h),
[x, h]λ(Ob(0), Ob(s(x)), [h_{1}]app(s(x),
O(x, s(x), ⊃_{e}(Ob(0), Ob(x), h, h_{1})),
var(s(x), put(x)))),
n)

the two following terms make the proof more readable:

app^{∗} : (n : N)(Ob(0))Ob(n) app^{∗} = [n, h]⊃_{e}(Ob(0), Ob(n), Eapp(n), h) AbstAlg^{∗} : (n : N)(Ob(n))Ob(0) AbstAlg^{∗} = [n, h]⊃_{e}(Ob(n), Ob(0), EAbstAlg(n), h) ObCC^{∗} : (n : N)Π(Ob(n), [X]⊢_{n} app^{∗}(n, AbstAlg^{∗}(n, X)) ∼_{n} X)

ObCC^{∗} = [n]natrec([n]Π(Ob(n), [X]⊢_{n} app^{∗}(n, AbstAlg^{∗}(n, X)) ∼_{n} X),

Λ(Ob(0), [h_{0}]⊢0 app^{∗}(0, AbstAlg^{∗}(0, h_{0})) ∼0 h_{0}, [x_{1}]ρ(0, x_{1})),

[x, h]Λ(Ob(s(x)),
[h_{0}]⊢_{s(x)} app^{∗}(s(x), AbstAlg^{∗}(s(x), h_{0})) ∼_{s(x)} h_{0},
[x_{1}]τ(s(x),
app(s(x),
O(x, s(x), app^{∗}(x, AbstAlg^{∗}(s(x), x_{1}))),
var(s(x), put(x))),
app(s(x),
O(x, s(x), AbstAlg(x, x_{1})),
var(s(x), put(x))),
x_{1},
μ(s(x),
O(x, s(x), app^{∗}(x, AbstAlg^{∗}(s(x), x_{1}))),
O(x, s(x), AbstAlg(x, x_{1})),
var(s(x), put(x)),
T (x,
s(x),
app^{∗}(x, AbstAlg^{∗}(x,AbstAlg(x, x_{1})))
∼_{x} AbstAlg(x, x_{1}),
Π_{e}(Ob(x),
[X]⊢_{x} app^{∗}(x, AbstAlg^{∗}(x, X)) ∼_{x} X,
h,
AbstAlg(x, x_{1})))),
ObCC(x, x_{1}))),

n)

Typed Combinators

Types types : Set atoms : Set at : (a : atoms)types →: (α : types)(β : types)types

types_{e} : (P : (types)Set)

(atc : (a : atoms)P (at(a)))

(arrc : (α : types)(β : types)(α_{h} : P (α))(β_{h} : P (β))P (α → β))

(α : types)
P (α)

Type assignments TA : (N)Set nil : TA(0) cons : (n : N)(ta : TA(n))(α : types)TA(s(n))

TA_{e} : (P : (n : N)(TA(n))Set)

(nilc : P (0, nil)) (consc : (n : N)(ta : TA(n))(α : types)(P (n, ta))P (s(n), cons(n, ta, α))) (n : N) (ta : TA(n)) P (n, ta)

The typing of a variable

The sets corresponding to the typed combinators. First the set coding the typing of a variable in a type assignement:

VarType : (n : N)(ta : TA(n))(x : IS(n))(α : types)Set

PutType : (n : N)(ta : TA(n))(α : types)VarType(s(n), cons(n, ta, α), put(n), α)

InjectType : (n : N)

(ta : TA(n)) (α : types) (β : types) (y : IS(n)) (p : VarType(n, ta, y, α)) VarType(s(n), cons(n, ta, β), inject(n, y), α)

VarType_{e} : (n : N)

(ta : TA(n))

(P : (x : IS(s(n)))

(α : types) (β : types) (p : VarType(s(n), cons(n, ta, β), x, α)) Set)

(e : (α : types)P (put(n), α, α, PutType(n, ta, α)))

(d : (α : types)
(β : types)
(y : IS(n))
(p : VarType(n, ta, y, α))

P (inject(n, y), α, β, InjectType(n, ta, α, β, y, p))) (x : IS(s(n))) (α : types) (β : types) (p : VarType(s(n), cons(n, ta, β), x, α)) P (x, α, β, p)

VarType_{e}(n, ta, P, e, d, put(n), α, α, PutType(n, ta, α)) = e(α)

VarType_{e}(n, ta, P, e, d, inject(n, y), α, β, InjectType(n, ta, α, β, y, p)) = d(α, β, y, p)

The objects ob : (n : N)(ta : TA(n))(α : types)Set

K : (n : N)(ta : TA(n))(α : types)(β : types)

ob(n, ta, α → β → α)

S : (n : N)(ta : TA(n))(α : types)(β : types)(γ : types)

ob(n, ta, (α → β → γ) → (α → β) → α → γ)

var : (n : N)(ta : TA(n))(α : types)(x : IS(n))(p : VarType(n, ta, x, α))

ob(n, ta, α)

app : (n : N)(ta : TA(n))(α : types)(β : types)(f : ob(n, ta, α → β))(a : ob(n, ta, α))

ob(n, ta, β)

ob_{e} : (n : N)

(ta : TA(n))

(P : (α : types)(ob(n, ta, α))Set)

(kc : (α : types)(β : types)P (α → β → α), K(n, ta, α, β)))

(\begin{matrix}sc & : & (α : types)(β : types)(γ : types) \\ & & P ((α → β → γ) → (α → β) → α → γ, S(n, ta, α, β, γ))) \end{matrix}

(varc : (α : types)(x : IS(n))(p : VarType(n, ta, x, α))P (α, V ar(n, ta, α, x, p)))

(\begin{matrix}appc & : & (α : types)(β : types) \\ & & (f : ob(n, ta, α → β)) \\ & & (a : ob(n, ta, α)) \\ & & (fh : P (α → β, f)) \\ & & (ah : P (α, a))P (β, app(n, ta, α, β, f, a))) \end{matrix}

(γ : types) (t : ob(n, ta, γ)) P (γ, t)

ob_{e}(n, ta, P, kc, sc, varc, appc, α → β → α, K(n, ta, α, β)) = kc(α, β)

\begin{matrix}ob_{e}(n, ta, P, kc, sc, varc, appc, (α → β → γ) → (α → β) → α → γ, S(n, ta, α, β, γ)) \\ = sc(α, β, γ) \end{matrix}

ob_{e}(n, ta, P, kc, sc, varc, appc, α, var(n, ta, α, x, p)) = varc(α, x, p) ob_{e}(n, ta, P, kc, sc, varc, appc, β, app(n, ta, α, β, f, a)) =

appc(α, β, f, a,
ob_{e}(n, ta, P, kc, sc, varc, appc, α → β, f),
ob_{e}(n, ta, P, kc, sc, varc, appc, α, a))

We define the identity combinator: I : (α : types)ob(n, ta, α → α)

I = [α]app( n,

ta, α → α → α, α → α,

app( n,

ta, α → α → α → α, α → α → α → α → α, S(n, ta, α, α → α, α), K(n, ta, α, α → α)),

K(n, ta, α, α))

The injection of objects The Injection of the objects of one theory into an extension with one more variable is realized by the term:

ObInj : (n : N; ta : TA(n); γ : types; δ : types; t : ob(n, ta, γ))ob(s(n), cons(n, ta, δ), γ) which is defined as:

ObInj = [n, ta, γ, δ, t]ob_{e}( n,

ta, [γ_{1}, t_{1}]ob(s(n), cons(n, ta, delta), γ_{1}), [α_{1}, β_{1}]K(s(n), cons(n, ta, δ), α_{1}, β_{1}),

[α_{1}, β_{1}, γ_{1}]S( s(n),
cons(n, ta, δ),
α_{1},
β_{1},
γ_{1}),
[α_{1}, x_{1}, p_{1}]var( s(n),
cons(n, ta, δ),
α_{1},
inject(n, x_{1}),

InjectType(n, ta, α_{1}, δ, x_{1}, p_{1})),

[α_{1}, β_{1}, f_{1}, a_{1}, h, h_{1}]app(s(n), cons(n, ta, δ), α_{1}, β_{1}, h, h_{1}), γ, t)

The formulae form : (n : N)(ta : TA(n))(α : types)Set ∼: (n : N)(ta : TA(n))(α : types)(t : ob(n, ta, α))(u : ob(n, ta, α))form(n, ta, α)

The theorems ⊢: (n : N)(ta : TA(n))(α : types)(eq : form(n, ta, α))Set In what follows we will use t ∼_{n,ta} u for ∼ (n, ta, α, t, u) and ⊢_{n,ta} eq for ⊢ (n, ta, α, eq) as abbreviations.

Keq : (n : N)
(ta : TA(n))
(α : types)
(β : types)
(a : ob(n, ta, α))
(b : ob(n, ta, β))
⊢_{n,ta} app(n, ta, β, α, app(n, ta, α, β → α, K(n, ta, α, β), a), b) ∼_{n,ta} a
Seq : (n : N)
(ta : TA(n))
(α : types)
(β : types)
(γ : types)
(f : ob(n, ta, α → β → γ))
(g : ob(n, ta, α → β))
(a : ob(n, ta, α))
⊢_{n,ta} app(app(app(S(n, ta, α, β, γ), f), g), a) ∼_{n,ta} app(app(f, a), app(g, a))

where I have removed all the type and context information from the applications to make it more readable, but it can be restored by looking at the rules of object formation.

μ : (n : N)
(ta : TA(n))
(α : types)
(β : types)
(f : ob(n, ta, α → β))
(g : ob(n, ta, α → β))
(a : ob(n, ta, α))
(⊢_{n,ta} f ∼_{n,ta} g)
⊢_{n,ta} app(n, ta, α, β, f, a) ∼_{n,ta} app(n, ta, α, β, g, a)
ν : (n : N)
(ta : TA(n))
(α : types)
(β : types)
(a : ob(n, ta, α))
(b : ob(n, ta, α))
(f : ob(n, ta, α → β))
(⊢_{n,ta} a ∼_{n,ta} b)
⊢_{n,ta} app(n, ta, α, β, f, a) ∼_{n,ta} app(n, ta, α, β, f, b)

ρ : (n : N)(ta : TA(n))(α : types)(t : ob(n, ta, α))⊢_{n,ta} t ∼_{n,ta} t

σ : (n : N)(ta : TA(n))(α : types)(t : ob(n, ta, α))(u : ob(n, ta, α))
(⊢_{n,ta} t ∼_{n,ta} u)⊢_{n,ta} u ∼_{n,ta} t
τ : (n : N)(ta : TA(n))(α : types)(t : ob(n, ta, α))(u : ob(n, ta, α))(v : ob(n, ta, α))
(⊢_{n,ta} t ∼_{n,ta} u)(⊢_{n,ta} u ∼_{n,ta} v)⊢_{n,ta} t ∼_{n,ta} v

The following derived rules were proved, which are then used in the proof of combinatorial completeness:

μν : ( n : N; ta : TA(n);

α : types; β : types; f : ob(n, ta, α → β); g : ob(n, ta, α → β); a : ob(n, ta, α); b : ob(n, ta, α); ⊢_{n,ta} f ∼_{n,ta} g; ⊢_{n,ta} a ∼_{n,ta} b) ⊢_{n,ta} app(n, ta, α, β, f, a) ∼_{n,ta} app(n, ta, α, β, g, b)

μν = [n, ta, α, β, f, g, a, b, h, h1]τ(n,
ta,
β,
app(n, ta, α, β, f, a),
app(n, ta, α, β, g, a),
app(n, ta, α, β, g, b),

μ(n, ta, α, β, f, g, a, h), ν(n, ta, α, β, a, b, g, h1))

IdEq : (n : N; ta : TA(n); α : types; a : ob(n, ta, α))

⊢_{n,ta} app(n, ta, α, α, I(n, ta, α), a) ∼_{n,ta} a

IdEq = [n, ta, α, a]τ(n,
ta,
α,
app(n, ta, α, α, I(n, ta, α), a),
app( n, ta, α → α, α,
app(n, ta, α, α → α → α, K(n, ta, α, α → α), a),
app(n, ta, α, (→ α, α), K(n, ta, α, α), a)),
a,
Seq(n, ta, α, α → α, α, K(n, ta, α, α → α), K(n, ta, α, α), a),
Keq(n, ta, α, α → α, a, app(n, ta, α, α → α, K(n, ta, α, α), a)))

Definition of Abstraction

The definition is by using the elimination rule for objects of a given type in a given extension. We define separately each of the premisses of this rule and then plug these definitions into the main one. The typings of these terms are:

KAbstAlg : (n : N)(ta : TA(n))(α : types)(γ : types)(δ : types)
ob(n, ta, α → γ → δ → γ)
SAbstAlg : (n : N)(ta : TA(n))(α : types)(γ : types)(δ : types)(κ : types)
ob(n, ta, α → (γ → δ → κ) → (γ → δ) → γ → κ)

VarAbstAlg : (n : N)(ta : TA(n))(α : types)(β : types)

(x : IS(s(n))) (p : VarType(s(n), cons(n, ta, α), x, β)) ob(n, ta, α → β)

AppAbstAlg : (n : N)(ta : TA(n))(α : types)(γ : types)(δ : types)

(f : ob(s(n), cons(n, ta, α), γ → δ)) (a : ob(s(n), cons(n, ta, α), γ)) (fh : ob(n, ta, α → γ → δ)) (ah : ob(n, ta, α → γ)) ob(n, ta, α → δ)

And the typing of the abstraction algorithm:

AbstAlg : (n : N)(ta : TA(n))(α : types)(β : types)

(X : ob(s(n), cons(n, ta, α), β)) ob(n, ta, α → β)

Now the terms that define these constants:

KAbstAlg = [n, ta, α, γ, δ]app(n,

ta, γ → δ → γ, α → γ → δ → γ, K(n, ta, γ → δ → γ, α), K(n, ta, γ, δ))

SAbstAlg = [n, ta, α, γ, δ, κ]app(n,

ta, (γ → δ → κ) → (γ → δ) → γ → κ, α → (γ → δ → κ) → (γ → δ) → γ → κ, K(n, ta, (γ → δ → κ) → (γ → δ) → γ → κ, α), S(n, ta, γ, δ, κ))

VarAbstAlg = [n, ta, α, β, x, p]VarType_{e}(n,

ta, [x_{1}, α_{1}, α_{2}, p_{1}]ob(n, ta, α_{2} → α_{1}), [α_{1}]I(α_{1})

[α_{1}, β_{1}, y_{1}, p_{1}]app( n,
ta,
α_{1},
β_{1} → α_{1},
K(n, ta, α_{1}, β_{1}),
var(n, ta, α_{1}, y_{1}, p_{1})),

x, β, α, p)

AppAbstAlg = [n, ta, α, γ, δ, f, a, fh, ah]app(n,
ta,
α → γ,
α → δ,
app( n,
ta,
α → γ → δ,
α → γ → α → δ,
S(n, ta, α, γ, δ),
fh),
ah)

And the term for the abstraction algorithm, which uses the terms above:

AbstAlg = [n, ta, α, β, X]ob_{e}(s(n),

cons(n, ta, α), [β_{1}, X_{1}]ob(n, ta, α → β_{1}), [α_{1}, β_{1}]KAbstAlg(n, ta, α, α_{1}, β_{1}), [α_{1}, β_{1}, γ_{1}]SAbstAlg(n, ta, α, α_{1}, β_{1}, γ_{1}), [α_{1}, x_{1}, p_{1}]VarAbstAlg(n, ta, α, α_{1}, x_{1}, p_{1}), [α_{1}, β_{1}, f_{1}, a_{1}, h, h_{1}]AppAbstAlg(n, ta, α, α_{1}, β_{1}, f_{1}, a_{1}, h, h_{1}), β, X)

The combinatorial completeness

CombComp(n, ta, α, β, X) = ⊢_{s(n),cons(n,ta,α)} app(ObInj(AbstAlg(X)),var(α, put(n), PutType(n, ta, α))) ∼_{s(n),cons(n,ta,α)} X

where n : N, ta : TA(n), α, β : types, X : ob(s(n), cons(n, ta, α), β). Some arguments were removed from the app,ObInj and AbstAlg. As with the definition of AbstAlg the term proving this statement is formed with ob_{e}, so we will prove the premisses of the rule before combining them. The terms have the following typing:

KCombComp : (n : N; ta : TA(n); α : types; β_{1} : types; β_{2} : types)

CombComp(n, ta, α, β_{1} → β_{2} → β_{1}, K(s(n), cons(n, ta, α), β_{1}, β_{2}))

SCombComp : (n : N; ta : TA(n); α : types; β_{1} : types; β_{2} : types; β_{3} : types)
CombComp(n, ta, α, (β_{1} → β_{2} → β_{3}) → (β_{1} → β_{2}) → β_{1} → β_{3},

S(s(n), cons(n, ta, α), β_{1}, β_{2}, β_{3}))

VarCombComp : (n : N;

ta : TA(n); α : types; β : types; x : IS(s(n)); p : VarType(s(n), cons(n, ta, α), x, β)) CombComp(n, ta, α, β, var(s(n), cons(n, ta, α), β, x, p))

AppCombComp : ( n : N; ta : TA(n); α : types; β_{1} : types; β_{2} : types;
f : ob(s(n), cons(n, ta, α), β_{1} → β_{2});
a : ob(s(n), cons(n, ta, α), β_{1});
fh : CombComp(n, ta, α, β_{1} → β_{2}, f);
ah : CombComp(n, ta, α, β_{1}, a))

CombComp(n, ta, α, β_{2}, app(s(n), cons(n, ta, α), β_{1}, β_{2}, f, a))

The corresponding terms are:

KCombComp = [n, ta, α, β_{1}, β_{2}]Keq(s(n),
cons(n, ta, α),
β_{1} → β_{2} → β_{1},
α,
K(s(n), cons(n, ta, α), β_{1}, β_{2}),
var(s(n), cons(n, ta, α), α, put(n), PutType(n, ta, α)))
SCombComp = [n, ta, α, β_{1}, β_{2}, β_{3}]Keq(s(n),
cons(n, ta, α),
(β_{1} → β_{2} → β_{3}) → (β_{1} → β_{2}) → β_{1} → β_{3},
α,
S(s(n), cons(n, ta, α), β_{1}, β_{2}, β_{3}),
var(s(n), cons(n, ta, α), α, put(n), PutType(n, ta, α)))
VarCombComp =[n, ta, α, β, x, p]
VarType_{e}(n,
ta,
[x_{1}, β_{1}, α_{1}, p_{1}]CombComp(n, ta, α_{1}, β_{1},
var(s(n), cons(n, ta, α_{1}), β_{1}, x_{1}, p_{1})),
[α_{1}]IdEq(s(n), cons(n, ta, α_{1}), α_{1},
var(s(n), cons(n, ta, α_{1}), α_{1}, put(n), PutType(n, ta, α_{1}))),
[α_{1},β_{1}, y_{1}, p_{1}]
Keq(s(n), cons(n, ta, β_{1}), α_{1}, β_{1},
var(s(n), cons(n, ta, β_{1}), α_{1},
inject(n, y), InjectType(n, ta, α_{1}, β_{1}, y_{1}, p_{1})),
var(s(n), cons(n, ta, β_{1}), β_{1}, put(n), PutType(n, ta, β_{1}))),
x,
β,
α,
p)

The case for application requires some definitions that make it more readable:

fAbst(n, ta, α, β_{1}, β_{2}, f) : ob(n, ta, α → β_{1} → β_{2}) fAbst(n, ta, α, β_{1}, β_{2}, f) = AbstAlg(n, ta, α, β_{1} → β_{2}, f)

aAbst(n, ta, α, β, a) : ob(n, ta, α → β) aAbst(n, ta, α, β, a) = AbstAlg(n, ta, α, β, a)

fAbstInj(n, ta, α, β_{1}, β_{2}, f) : ob(s(n), cons(n, ta, α), α → β_{1} → β_{2}) fAbstInj(n, ta, α, β_{1}, β_{2}, f) = ObInj(n, ta, α → β_{1} → β_{2}, α, fAbst(n, ta, α, β_{1}, β_{2}, f)) aAbstInj(n, ta, α, β, a) : ob(s(n), cons(n, ta, α), α → β) aAbstInj(n, ta, α, β, a) = ObInj(n, ta, α → β, α, aAbst(n, ta, α, β, a))

AppCombComp = [n, ta, α, β_{1}, β_{2}, f, a, fh, ah]
τ(s(n),cons(n, ta, α), β_{2},
app(s(n), cons(n, ta, α), α, β_{2},
ObInj(n, ta, α → β_{2}, α,
AbstAlg(n, ta, α, β_{2},

app(s(n), cons(n, ta, α), β_{1}, β_{2}, f, a))),

var(s(n), cons(n, ta, α), α, put(n), PutType(n, ta, α))),

app(s(n), cons(n, ta, α), β_{1}, β_{2},
app(s(n), cons(n, ta, α), α, β_{1} → β_{2},

fAbstInj,

var(s(n), cons(n, ta, α), α, put(n), PutType(n, ta, α))),

app(s(n), cons(n, ta, α), α, β_{1},

aAbstInj,

var(s(n), cons(n, ta, α), α, put(n), PutType(n, ta, α)))), app(s(n), cons(n, ta, α), β_{1}, β_{2}, f, a),

Seq(s(n), cons(n, ta, α), α, β_{1}, β_{2},

fAbstInj,

aAbstInj,

var(s(n), cons(n, ta, α), α, put(n), PutType(n, ta, α))),

μν(s(n), cons(n, ta, α), β_{1}, β_{2},
app(s(n), cons(n, ta, α), α, β_{1} → β_{2},

fAbstInj,

var(s(n), cons(n, ta, α), α, put(n), PutType(n, ta, α))), f,

app(s(n), cons(n, ta, α), α, β_{1},

aAbstInj,

var(s(n), cons(n, ta, α), α, put(n), PutType(n, ta, α))), a, fh, ah))

ObCC :(n : N)(ta : TA(n))(α : types)(β : types)

(X : ob(s(n), cons(n, ta, α), β)) CombComp(n, ta, α, β, X)

ObCC = [n, ta, α, β, X]ob_{e}(s(n),

cons(n, ta, α), [β_{1}, X_{1}]CombComp(n, ta, α, β_{1}, X_{1}), [α_{1}, β_{1}]KCombComp(n, ta, α, α_{1}, β_{1}), [α_{1}, β_{1}, γ_{1}]SCombComp(n, ta, α, α_{1}, β_{1}, γ_{1}), [α_{1}, x, p]VarCombComp(n, ta, α, α_{1}, x, p), [α_{1}, β_{1}, f, a, h, h_{1}]AppCombComp(n, ta, α, α_{1}, β_{1}, f, a, h, h_{1}), β, X)

Machine Checked Normalization Proofs for Typed Combinator Calculi

draft

Veronica Gaspes^{∗} Jan M. Smith^{†} University of Göteborg and Chalmers University of Technology

June 1992

1 Introduction

In this paper we will present formalized normalization proofs of two calculi: simply typed combinators and a combinator formulation of Gödel’s T. The proofs are based on Tait’s computability method [10] and are formalized in Martin-Löf’s set theory [6, NPS90]. The motivation for doing these formalizations is to obtain machine checked normalization proofs. The proofs in this paper have been checked using the Alf-system [ACN90]; in fact, given proofs on the level of formalization presented here, it is a simple and straightforward task to have them verified in the set theory implementation in Alf.

The first theory we will discuss, the simply typed combinators, is chosen because of its simplicity: we want a machine checked proof which avoids as much as possible syntactical problems and concentrates on the computability method, which has become a standard tool in normalization proofs for typed theories.

Tait [10] treated a combinator formulation of Gödel’s system T [4]. Although that is a much more powerful theory than the simply typed combinators, the normalization proof for Gödel’s T is, from the formal point of view, a straightforward extension of that for the simply typed combinators.

The proofs are done in Martin-Löf’s set theory with the possibility of introducing families of sets by induction. All the inductive definitions we use are strictly positive and given the introduction rules for such an inductively defined family, an elimination rule, expressing a structural induction rule over the set introduced, can be obtained mechanically [2, 3]. However, the implementation of Martin-Löf’s set theory that we have used neither checks the strictly positiveness of the introduction rules, nor the correctness of the elimination rules.

∗vero@cs.chalmers.se

†smith@cs.chalmers.se

2 The Simply Typed Combinators

The combinator calculus we will use is the one obtained by the Curry-Howard interpration of positive implicational calculus, formulated in the Hilbert style with the axioms

A ⊃ B ⊃ A
(A ⊃ B ⊃ C) ⊃ (A ⊃ B) ⊃ A ⊃ C

and with modus ponens as the only derivation rule. So the types will be built up from type variables and the function arrow:

• X, Y, Z, … are types.

• If α and β are types, then α → β is a type.

Corresponding to the axioms, we have, for arbitrary types α, β and γ, constants K_{α,β} and S_{α,β,γ} with typings

K_{α,β} : α → β → α
S_{α,β,γ} : (α → β → γ) → (α → β) → α → γ

Modus ponens corresponds to application:

\frac{M : α → β N : α}{MN : β}

We have the usual contraction rules, in which we assume that all terms are of appropriate types,

K_{α,β} MN ≻ M
S_{α,β,γ} MNO ≻ (MO)(NO)

We will normalize a term by head reduction. So we add the rule

\frac{M ≻ N}{MO ≻ NO}

and define inductively what it means for a term to be normalizable:

• K_{α,β} is normalizable.

• S_{α,β,γ} is normalizable.

• K_{α,β} M is normalizable provided M is normalizable.

• S_{α,β,γ} M is normalizable provided M is normalizable.

• S_{α,β,γ} MN is normalizable provided M and N are normalizable.

• If M ≻ N and N is normalizable, then M is normalizable.

Intuitively, it is clear that if a term is normalizable then it reduces to a term on normal form, that is, to a term which does not contain any subterm of the form K_{α,β} MN or S_{α,β,γ} MNO. This can be rigorously proved by defining the reduction ≻^{⋆} as the transitive and symmetric closure of the relation obtained by adding to the above conversion rules

\frac{M ≻^{⋆}N}{K_{α,β} M ≻^{⋆}K_{α,β} N} \frac{M ≻^{⋆}N}{S_{α,β,γ} M ≻^{⋆}S_{α,β,γ} N} \frac{M ≻^{⋆}N}{S_{α,β,γ} MO ≻^{⋆}S_{α,β,γ} NO} \frac{M ≻^{⋆}N}{S_{α,β,γ} OM ≻^{⋆}S_{α,β,γ} ON}

and by defining the normal forms inductively by

• K_{α,β} is on normal form.

• S_{α,β,γ} is on normal form.

• K_{α,β} M is on normal form provided M is on normal form.

• S_{α,β,γ} M is on normal form provided M is on normal form.

• S_{α,β,γ} MN is on normal form provided M and N are on normal form.

The idea of defining normalizability directly by induction is due to Martin-Löf [5].

2.1 Normalization Theorem for the Simply Typed Combinators

The proof of the normalization theorem, that is, that every typable term is normalizable, is by Tait’s computability method. The idea of this method is that the normalizability of a term M of type α is proved by induction on the derivation of M : α using a stronger induction hypothesis, namely that M is a computable term of type α. For the simply typed combinators the set of computable terms of a type is inductively defined over the types by

• There are no computable terms of a type variable.

• A term M : α → β is computable if

– M is normalizable and

– MN is computable of type β provided N is computable of type α.

Note that, from this definition it follows that a computable term is normalizable. Hence, the normalizability theorem is an immediate corollary to the following theorem.

Theorem 1 If M : α then M is computable of type α.

In the proof we need the following lemma, which is easily proved by induction on the type α.

Lemma 1 Let M and N be of type α. If M ≻ N and N is computable of type α, then M is computable of type α.

The proof of the theorem is by induction on the derivation of M : α. We then have the following cases.

• K_{α,β} : α → β → α.

Since K_{α,β} is a term of an arrow type we have to prove, by the definition of computability, that (i) K_{α,β} is normalizable and that (ii) K_{α,β} M is computable of type β → α for all computable M of type α. (i) follows from the definition of being normalizable. For the proof of (ii) let M be a computable term of type α. We have to show that K_{α,β} M is normalizable and that K_{α,β} MN is computable of type α for all computable N of type β. Since M is computable, M is normalizable, hence, by definition, K_{α,β} M is normalizable. Since K_{α,β} MN ≻ M and M is assumed to be computable, lemma 1 gives that K_{α,β} MN is computable.

• S_{α,β,γ} : (α → β → γ) → (α → β) → α → γ. The argument is similar to that for K_{α,β}. Let M, N and O be arbitrary computable terms of type α → β → γ, α → β and α, respectively. The definition of computability gives that MO and NO are computable terms of types β → γ and β, respectively. By the definition of computability MO(NO) is computable of type γ; since S_{α,β,γ}MNO ≻ MO(NO), lemma 1 gives that S_{α,β,γ} is computable.

• Application

\frac{M : α → β N : α}{(MN) : β}

By the induction hypothesis M is computable of type α → β and N is computable of type α. The definition of computability for terms of type α → β then gives that MN is computable of type β.

2.2 Formalization of the normalization proof

The formalization of the normalization proof in Martin-Löf’s set theory requires representations of the typed combinators, the relation of contraction of a head redex and of the predicates of normalizability and computability. All these are defined as sets, either by introducing a new set by an inductive definition or, in the case of the computability predicate, by recursion on the type structure of the combinators, using the universe of Martin-Löf’s set theory.

The simply typed combinators are introduced by a set Type for the types and a family Term of sets over Type such that the elements in Term(α) are the terms of type α. The contraction of the head redex is expressed by a family of sets OneStepHead(α, M, N) where M and N are terms of type α such that N is obtained by contracting the head redex of M.

We follow the notation in [NPS90].

2.2.1 The set of types

We first declare Type to be a set.

Type-formation

Type : Set

The set Type is inductively generated and there are two introduction rules; one for the atomic sets, that is, the type variables, and one for the function types. We let the type variables be indexed by some given set Atom which could, for instance, be the set of natural numbers.

Type-introduction 1

\frac{a : Atom}{var(a) : Type}

Type-introduction 2

\frac{α : Type β : Type}{α → β : Type}

The elimination rule expresses structural induction on the set Type.

Type-elimination

P (u) Set [u : Type]
b : P (var(a)) [a : Atom]
i(α, β, I_{α}, I_{β}) : P (α → β) [α, β : Type, I_{α} : P (α), I_{β} : P (β)]
α : Type
TypeRec(P, b, i, α) : P (α)

A step in the informal proof by induction on the types will be formalized by an application of Type-elimination.

2.2.2 The family of sets of terms

Term is declared to be a family of sets over the types.

Term-formation

Term(α) : Set [α : Type]

The family is defined inductively by introduction rules which correspond to the formation of the typed combinators.

Term-introduction 1

α, β : Type
K(α, β) : Term(α → β)

Term-introduction 2

α, β, γ : Type
S(α, β, γ) : Term((α → β → γ) → (α → β) → α → γ)

Term-introduction 3

α, β : Type
M : Term(α → β)
N : Term(α)
App(α, β, M, N) : Term(β)

In the sequel we will often omit the type arguments in the constructor App since they can be obtained from the types of the other arguments. The elimination rule completes the definition by expressing structural induction on the family Term.

Term-elimination P (u, v) : Set [u : Type, v : Term(u)] k(x, y) : P (x → y → z, K(x, y)) [x, y : Type] s(x, y, z) : P ((x → y → z) → (x → y) → x → z, S(x, y, z)) [x, y, z : Type]

ap(x, y, u, v, I_{u}, I_{v}) : P (y, App(u, v)) [ \begin{matrix}x, y : Type, \\ u : Term(x → y), \\ v : Term(x) \\ I_{u} : P (x → y, u), \\ I_{v} : P (x, v) \end{matrix} ]

α : Type M : Term(α)

TermRec(P, k, s, ap, α, M) : P (α, M)

When informally a statement is proved by induction on the derivation of t : α, the formal proof is by an application of Term-elimination.

2.2.3 The family of sets expressing head contraction OneStepHead is declared to be a family of sets over types and terms.

OneStepHead-formation

OneStepHead(α, M, N) : Set [α : Type, M, N : Term(α)]

The set OneStepHead(α, M, N) expresses that N results from contracting the head redex of M; thus it is defined by the following introduction rules.

OneStepHead-introduction 1

α, β : Type M : Term(α) M : Term(β)
kk(α, β, M, N) : OneStepHead(α, App(App(K(α, β), M), N), M)

OneStepHead-introduction 2

α, β, γ : Type M : Term(α → β → γ) N : Term(α → β) O : Term(α)
ss(α, β, M,N, O) :

OneStepHead(γ, App(App(App(S(α, β, γ), M), N), O), App(App(M, O), App(N, O)))

OneStepHead-introduction 3

α, β : Type M, N : Term(α → β) O : Term(α) p : OneStepHead(α → β, M, N)
μ(α, β, M, N, O, p) : OneStepHead(β, App(M, O), App(N, O))

The elimination rule for this inductive definition of OneStepHead will not be used in the normalization proof and we refrain from formulating it.

2.2.4 The family of sets formalizing normalizability The family Norm is introduced for the proofs that a term of a given type is normalizable.

Norm-formation

Norm(α, M) : Set [α : Type, M : Term(α)]

The introduction rules correspond to the clauses in the inductive definition of the set of normalizable terms of a given type.

Norm-introduction 1

α, β : Type
kn(α, β) : Norm(α → β → α, K(α, β))

Norm-introduction 2

α, β, γ : Type
sn(α, β, γ) : Norm((α → β → γ) → (α → β) → α → γ, S(α, β, γ))

Norm-introduction 3

α, β : Type M : Term(α) M_{n} : Norm(α, M)
kan(α, β, M, M_{n}) : Norm(β → α, App(K, M))

Norm-introduction 4

α, β, γ : Type M : Term(α → β → γ) M_{n} : Norm(α → β → γ, M)
sfn(α, β, γ, M, M_{n}) : Norm((α → β) → α → γ, App(S, M))

Norm-introduction 5

α, β, γ : Type
M : Term(α → β → γ)
N : Term(α → β)
M_{n} : Norm(α → β → γ, M)
N_{n} : Norm(α → β, N)
sfgn(α, β, γ, M, N, M_{n}, N_{n}) : Norm(α → γ, App(App(S, M), N))

Norm-introduction 6

α : Type M, N : Term(α) p : OneStepHead(α, M, N) N_{n} : Norm(α, N)
mrn(α, M, N, p, N_{n}) : Norm(α, M)

The elimination rule for Norm will not be used in the proof. 2.2.5 The family of sets for the computability predicate The computability predicate

Comp(α, M) : Set [α : Type, M : Term(α)]

should satisfy the equations

Comp(var(a), M) = ⊥ [a : Atom, M : Term(var(a))]

Comp(α→β, M) = Norm(α→β, M) ∧ (ΠN : Term(α))Comp(α, N) ⊃ Comp(β, App(M, N)) The definition of Comp is by recursion on the type structure either by using a universe or directly by set valued recursion [9]. Using the notation in [NPS90] the definition of Comp using a universe would be

Comp(α) = Set({ \atop Comp}(α))

where

{ \atop Comp}(α) = TypeRec([v]Term(v)⇒U, [at]BaseCase(at), [γ, δ, I_{γ}, I_{δ}]ArrowCase(γ, δ, I_{γ}, I_{δ}))

BaseCase(at) ≡ λM. ˆ⊥

ArrowCase(γ, δ, I_{γ}, I_{δ}) ≡ λM.{ \atop Norm}(M)ˆ∧(Π̂N ∈ { \atop Term}(γ))(I_{γ}(N)ˆ⇒I_{δ}(App(M, N)))

The definition of the computability predicate using the approach in [9] would be the same except that no coding would be involved. In fact, in the implementation of the proof in Alf, we wrote the two defining equations for Comp directly, using pattern matching; in fact this approach makes the equations for the computability predicate definitional.

2.2.6 The formal normalization proof

The proposition expressing that every typable term is normalizable can now be formulated in Martin-Löf’s set theory by

(Πα : Type)(Πt : Term(α))Norm(α, t)

The formalization of the proof of the normalization theorem consists in deriving an element in this set. Such an element is built up by applying a proof of

(Πα : Type)(Πt : Term(α))(Comp(α, t) ⊃ Norm(α, t))

to a proof of (Πα : Type)(Πt : Term(α))Comp(α, t)

The first of these statements, which in the informal presentation of the proof was assumed to be a direct consequence of the definition of computability, requires an explicit proof in the formalization; the proof is by induction on the type α, i.e. by Type-elimination.

The second statement is proved by induction on the derivation of t : Term(α), i.e. by Term-elimination, using the lemmata

(Πα : Type)(Πt, u : Term(α))OneStepHead(α, t, u) ⊃ Comp(α, u) ⊃ Comp(α, t)

and

(Πα, β : Type)(Πf ∈ Term(α → β))(Πa : Term(α))
Comp(α → β, f) ⊃ Comp(α, a) ⊃ Comp(β, App(f, a))

The first lemma was proved by induction on α and the second is an immediate consequence of the definition of Comp(α → β, f).

Instead of presenting the proofs in the tree like fashion that results from the natural deduction style used above when formulating the inference rules, we will express these rules in the logical framework as functions. For example, the introduction rule for normalizability

α : Type M, N : Term(α) p : OneStepHead(α, M, N) N_{n} : Norm(α, N)
mrn(α, M, N, p, N_{n}) : Norm(α, M)

is expressed by the function

mrn : (α : Type)(M, N : Term(α))(p : OneStepHead(α, M, N))(N_{n} : Norm(α, N))Norm(α, M)

We refer to [NPS90] for expressing rules in the logical framework.

Formally, the normalization theorem is proved by the term

AllNorm : (α : Type)(t : Term(α))Norm(α, t)

AllNorm(α, t) = apply(Comp(α, t),
Norm(α, t),
apply(Term(α),
[a]Comp(α, a) ⊃ Norm(α, a),
lemma(α),
t),
AllComp(α, t))

Removing all set parameters, this term becomes

AllNorm(α, t) = apply(apply(lemma(α), t), AllComp(α, t))

We will often use this convention of hiding the set parameters of the constants.

The term AllComp proves that every term is computable (by induction on the definition of being a term in a given type) and the term lemma proves that every computable term is normalizable (by induction on the types):

lemma : (α : Type)Π(Term(α), [t]Comp(α, t) ⊃ Norm(α, t))

lemma(α) = TypeRec([a]Π(Term(a), [t]Comp(a, t) ⊃ Norm(a, t)),

[at]λ([x]λ([cx]⊥_{e}([v]Norm(var(at), x), cx))),

[β, γ, h_{β}, h_{γ}]λ([f]λ([cf]fst(cf))),
α)

AllComp : (α : Type)(t : Term(α))Comp(α, t)

AllComp(α, t) = TermRec([γ, u]Comp(γ, u),
[β_{1}, β_{2}]Kcomp(β_{1}, β_{2}),
[β_{1}, β_{2}, β_{3}]Scomp(β_{1}, β_{2}, β_{3}),
[β_{1}, β_{2}, f, b, h_{f}, h_{b}]Appcomp(β_{1}, β_{2}, f, b, h_{f}, h_{b}),
α,
t)

The definition of AllComp requires the definitions of Kcomp, Scomp and Appcomp which, respectively, prove that K, S, and App(f, a) are computable. We will here only give the definition of Appcomp; the definitions of the other two are somewhat longer, reflecting that the proofs of the computability of K and S are slightly more complicated.

Appcomp : (α, β : Type)
(f : Term(α → β))
(a : Term(α))
(cf : Comp(α → β, f))
(ca : Comp(α, a))
Comp(β, App(α, β, f, a))
Appcomp = [α, β, f, a, cf, ca]apply(apply(snd(cf), a), ca)

2.2.7 An example

As an illustration of the computational content of the formal proof, we will show the proof object for the normalizability of the combinator I_{ι→ι}(I_{ι→ι}I_{ι}), where I_{α} is the identity function on the type α and ι is an atomic type. Omitting the type information in the combinators K_{α,β} and S_{α,β,γ} the identity function is defined by

I_{α} = SKK

and the head reduction to normal form of I_{ι→ι}(I_{ι→ι}I_{ι}) is

SKK((SKK)(SKK)) ≻ (K((SKK)(SKK)))(K((SKK)(SKK))) ≻ (SKK)(SKK) ≻ (K(SKK))(K(SKK)) ≻ SKK = I_{ι} This reduction sequence will appear in the proof term.

For the formal proof we need an element i : Atom and the define ι to be var(i). The combinators I_{ι}, I_{ι→ι} and I_{ι→ι}(I_{ι→ι}I_{ι}) are introduced by the explicit definitions

I_{ι} : Term(ι → ι)
I_{ι} = App(App(S(ι, ι → ι, ι), K(ι, ι → ι)), K(ι, ι)),

I_{ι→ι} : Term((ι → ι) → ι → ι)
I_{ι→ι} = App(App(S(ι → ι, (ι → ι) → ι → ι, ι → ι),
K(ι → ι, (ι → ι) → ι → ι)),
K(ι → ι, ι → ι))

and

I_{ι→ι}(I_{ι→ι}I_{ι}) : Term(ι → ι)
I_{ι→ι}(I_{ι→ι}I_{ι}) = App(ι → ι, ι → ι, I_{ι→ι}, I_{ι→ι}I_{ι})

respectively. Both in these definitions and in the proof term below many type arguments of the constants have been removed for the sake of readability.

The proof of the normalizability of I_{ι→ι}(I_{ι→ι}I_{ι}) is by showing that the terms to which I_{ι→ι}(I_{ι→ι}I_{ι}) head reduces are normalizable; hence, the proof consists of the series of terms in the reduction together with proofs of these reductions and proofs that the corresponding terms are normalizable.

Substituting ι → ι and I_{ι→ι}(I_{ι→ι}I_{ι}) for α and t, respectively, in AllNorm(α, t) and unfolding definitions, we obtain

AllNorm(ι → ι, I_{ι→ι}I_{ι→ι}I_{ι}) : Norm(ι → ι, I_{ι→ι}I_{ι→ι}I_{ι})
AllNorm(ι → ι, I_{ι→ι}I_{ι→ι}I_{ι}) =
mrn(I_{ι→ι}I_{ι→ι}I_{ι},
App(App(K(ι → ι, (ι → ι) → ι → ι), I_{ι→ι}I_{ι}), App(K(ι → ι, ι → ι), I_{ι→ι}I_{ι})),
ss(K(ι → ι, (ι → ι) → ι → ι), K(ι → ι, ι → ι), I_{ι→ι}I_{ι}),
mrn(App(App(K(ι → ι, (ι → ι) → ι → ι), I_{ι→ι}I_{ι}), App(K(ι → ι, ι → ι), I_{ι→ι}I_{ι})),
I_{ι→ι}I_{ι},
kk(I_{ι→ι}I_{ι}, App(K(ι → ι, ι → ι), I_{ι→ι}I_{ι})),
mrn(I_{ι→ι}I_{ι},
App(App(K(ι → ι, (ι → ι) → ι → ι), I_{ι}), App(K(ι → ι, ι → ι), I_{ι})),
ss(K(ι → ι, (ι → ι) → ι → ι), K(ι → ι, ι → ι), I_{ι}),
mrn(App(App(K(ι → ι, (ι → ι) → ι → ι), I_{ι}), App(K(ι → ι, ι → ι), I_{ι})),
I_{ι},
kk(I_{ι}, App(K(ι → ι, ι → ι), I_{ι})),
sfgn(K(ι, ι → ι), K(ι, ι), kn, kn)))))

2.2.8 Extracting the normal form from the proof

In the above example, we have seen that when the proof of the normalizability theorem is applied on a combinator, the normal form appears in the proof. We will now define a function

extraction : (α : Type)(t : Term(α))(p : Norm(α, t))Term(α)

that from a proof p of the normalizability of a given combinator extracts the the normal form of the combinator. The function will be defined by induction on the normalizability of the term. The cases that correspond to the definition by elimination of the set Norm applied to p are:

extraction(α → β → α, K(α, β), kn(α, β)) = K(α, β)
extraction((α → β → γ) → (α → β) → α → γ, S(α, β, γ), sn(α, β, γ)) = S(α, β, γ)
extraction(β → α, App(K(α, β), a), kan(α, β, a, p)) =
App(K(α, β), extraction(α, a, p))
extraction((α → β) → α → γ,

App(S(α, β, γ), f), sfn(α, β, γ, f, p)) = App(S(α, β, γ), extraction(α → β → γ, f, p))

extraction(α → γ,

App(App(S(α, β, γ), f), g), sfgn(α, β, γ, f, g, p, q)) = App(App(S(α, β, γ), extraction(α → β → γ, f, p)), extraction(α → β, g, q))

extraction(α, t, mrn(α, t, u, p, q)) = extraction(α, u, q)

This extraction function may then be applied to the proof AllNorm of the normalizability of all terms, thus we obtain an algorithm that computes the normal form of a term:

nf = [α, t]extraction(α, t, AllNorm(α, t)) : (α : Type)(t : Term(α))Term(α)

3 Gödel’s System T

A combinator formulation Gödel’s system T of computable functionals [8, 10] is obtained from the theory of the simply type combinators by replacing the type variables by the set N of natural numbers. The terms are then obtained by deleting the type variables and adding

0 : N

s : N→N

R_{α} : α→(α→N→α)→N→α

The contraction relation is extended by the rules of the recursion operator:

R_{α}MN 0 ≻ M
R_{α}MN (sT) ≻ N (R_{α}MNT) T

\frac{O ≻ P}{R_{α}MNO ≻ R_{α}MNP}

To the definition of the set of normalizable terms we add the following clauses:

• 0 is normalizable.

• s is normalizable.

• sM is normalizable provided M is normalizable.

• R_{α} is normalizable.

• R_{α} M is normalizable provided M is normalizable.

• R_{α} MN is normalizable provided M and N are normalizable.

3.1 Normalization Theorem for Gödel’s System T

To obtain a proof of the normalizability theorem for Gödel’s T from the proof for the simply typed combinators, we have to change the definition of the computability predicate in the atomic case. For the simply typed combinators the atomic case was empty; now it is the set of computable natural numbers:

• 0 is computable of type N.

• sM is computable of type N provided M is computable of type N.

• If M ≻ N and N is computable of type N, then M is computable. Formally, the set of computable natural numbers is introduced by inductively defined family CompN:

CompN Formation

CompN(M) Set[M ∈ Term(N)]

CompN Introduction zComp∈ CompN(0)

M : Term(N) p : CompN(M)

sComp(M) : CompN(s(M))

M, N : Term(N) p : OneStepHead(M, N, N) q : CompN(N)

mrComp(M, N, p, q) : CompN(M)

CompN Elimination

P (u, v) : Set [u : Term(N), v : CompN(u)]

zz : P (0, zComp)

ss(x, y, z) : P (s(x), sComp(x)) [x : Term(N), y : CompN(x), z : P (x, y)]

mrc(x, y, u, v, I_{y}) : P (x, mrComp(x, y, u, v)) [ \begin{matrix}x, y : Term(N), \\ u : OneStepHead(x, y, N), \\ v : CompN(y) \\ I_{y} : P (y, v) \end{matrix} ]

M : Term(N) cn : CompN(n)

CompNRec(P, zz, ss, mrc, M, cm) : P (n, cm)

Similarly to the case of the simply typed combinators, the computability predicate is defined so that it satisfies the equations

Comp(N, M) = CompN(M) [M : Term(N)]

Comp(α → β, M) =
Norm(α → β, M) ∧ (ΠN : Term(α))Comp(α, N) ⊃ Comp(β, App(M, N))

To the proof that every simply typed combinator is computable, we must add the cases:

• 0∈ N, which is computable outright.

• s∈ N→N. Since s is in an arrow type, we must show that (i) s is normalizable, which follows immediately from the definition of normalizability, and that (ii) sM is computable of type N for an arbitrary computable M of type N, which follows from one of the clauses defining computability of type N.

• R_{α} : α→(α→N→α)→N→α. Since R_{α} is in a function type we must be show that (i) R_{α} is normalizable, which it is by definition of normalizability, and that (ii) R_{α}M is computable of type (α→N→α)→N→α for arbitrary computable M of type α. The proof of (ii) is by taking an arbitrary M computable of type α and showing that (iii) R_{α}M is normalizable, which follows from the computability of M, and (iv) R_{α}MN is computable in N→α for arbitrary N computable of type α→N→α. Again, the proof is by taking an arbitrary computable N of type α→N→α and show that (v) R_{α}MN is normalizable, which it is because both M and N are computable, and (vi) R_{α}MNO is computable of type α for arbitrary O computable of type N. The proof of (vi) is by induction on the computability of type N of O; thus it has to be proved that

– R_{α}MN0 is computable of type α, which follows from R_{α}MN0 ≻ M.

– R_{α}MN(sP) is computable of type α, which is a consequence of

R_{α}MN(sP) ≻ N(R_{α}MNP)P

, where the computability of N(R_{α}MNP)P follows from the induction hypothesis and the computability of N and P.

– R_{α}MNP is computable of type α where P ≻ Q and Q is computable of type N. The induction hypothesis gives that R_{α}MNQ is computable of type α; hence R_{α}MNP ≻ R_{α}MNQ gives the result.

Let R be the formal constant expressing the recursion operator; let Rn, Ran and Rain be the constants introduced in the inductive definition of normalizability; let Rzr, Rsr and Rtn be the constants introduced in the inductive definition of one step head reduction. The following is the formal proof that R is computable:

RComp : (α : Type)Comp(α → (α → N → α) → N → α, R(α))

RComp(α) =

pair(Rn(α),
λ([a]λ([ca]pair(Ran(α, a, lemma_{1}(α, a, ca)),
λ([i]λ([ci]pair(Rain(α, a, i, lemma_{1}(α, a, ca), lemma_{1}(α→N→α, i, ci)),
λ([n]λ([cn]RComp′)

where RComp′, which is introduced only for the sake of readability, is the term which realizes the induction on cn, i.e. the computability of n:

CompNRec([t, ct]Comp(α, App(App(App(R(α), a), i), t)),

lemma_{2}(α, App(App(App(R(α), a), i), 0), a, Rzr(α, a, i), ca),

[t, ct, h]lemma_{2}(α,
App(App(App(R(α), a), i), App(s, t)),
App(App(i, App(App(App(R(α), a), i), t)), t),
Rsr(α, a, i, t),
lemma_{3}(α, a, i, t, ci, ct, h)),
[t, u, mr, ct, h]lemma_{2}(α,
App(App(App(R(α), a), i), u),
App(App(App(R(α), a), i), t),
Rtn(α, a, i, t, u, mr),
h),

n,

cn))))))))))

In the proof, the terms lemma_{1}, lemma_{2}, lemma_{3} are proofs, which are the same as for the simply typed calculus, of

lemma_{1} : (α : Type)(a : Term(α))(ca : Comp(α, a))Norm(α, a)

lemma_{2} :(α : Type)

(t : Term(α)) (u : Term(α)) (OneStepHead(α, t, u)) (Comp(α, u)) Comp(α, t)

lemma_{3} :(α : Type)

(a : Term(α)) (i : Term(α → N → α)) (t : Term(N)) (ci : Comp(α → N → α, i)) (ct : Comp(N, t)) (h : Comp(α, App(App(App(R(α), a), i), t))) Comp(α, App(App(i, App(App(App(R(α), a), i), t)), t))

[1] L. Augustsson, T. Coquand, and B. Nordström. A short description of Another Logical Framework. In Proceedings of the First Workshop on Logical Frameworks, Antibes, pages 39–42, 1990.

[2] Thierry Coquand and Christine Paulin. Inductively defined types. In Proceedings of COLOG-88, number 417 in Lecture Notes in Computer Science. Springer-Verlag, 1990.

[3] Peter Dybjer. Inductive sets and families in Martin-Löf’s type theory and their set-theoretic semantics. In G. Huet and G. Plotkin, editors, Informal Proceedings of the First Workshop on Logical Frameworks, pages 213–230. Esprit Basic Research Action 3245, May 1990. To appear in G. Huet and G. Plotkin, editors, Logical Frameworks.

[4] Kurt Gödel. Über eine bisher noch nicht benutze erweitrung des finiten standpunktes. Dialectica, 12, 1958.

[5] Per Martin-Löf. Hauptsatz for the Intuitionistic Theory of Iterated Inductive Definitions. In J. E. Fenstad, editor, Proceedings of the Second Scandinavian Logic Symposium, pages 179–216. North-Holland Publishing Company, 1971.

[6] Per Martin-Löf. Intuitionistic Type Theory. Bibliopolis, Napoli, 1984.

[7] Bengt Nordström, Kent Petersson, and Jan M. Smith. Programming in Martin-Löf’s Type Theory. An Introduction. Oxford University Press, 1990.

[8] L. Sanchis. Functionals defined by recursion. Notre Dame Journal of Formal Logic, (8):161– 174, 1967.

[9] Jan M. Smith. Propositional Functions and Families of Types. Notre Dame Journal of Formal Logic, 30(3), 1989.

[10] W. W. Tait. Intensional interpretation of functionals of finite type I. Journal of Symbolic Logic, 32(2):198–212, 1967.

Inductive and Coinductive types with Iteration and Recursion^{∗}

Herman Geuvers^{†}, Faculty of Mathematics and Computer Science, University of Nijmegen, Toernooiveld 1, 6525 ED Nijmegen, The Netherlands

July 1992

Abstract

We study (extensions of) simply and polymorphically typed lambda calculus from a point of view of how iterative and recursive functions on inductive types are represented. The inductive types can usually be understood as initial algebras in a certain category and then recursion can be defined in terms of iteration. However, in the syntax we often have only weak initiality, which makes the definition of recursion in terms of iteration inefficient or just impossible. We propose a categorical notion of (primitive) recursion which can easily be added as computation rule to a typed lambda calculus and gives us a clear view on what the dual of recursion, corecursion, on coinductive types is. (The same notion has, independently, been proposed by [Mendler 1991].) We look at how these syntactic notions work out in the simply typed lambda calculus and the polymorphic lambda calculus. It will turn out that in the syntax, recursion can be defined in terms of corecursion and vice versa using polymorphism: Polymorphic lambda calculus with a scheme for either recursion or corecursion suffices to be able to define the other. We compare our syntax for recursion and corecursion with that of Mendler ([Mendler 1987]) and use the latter to obtain meta properties as confluence and normalization.

1 Introduction

In this paper we want to look at formalizations of inductive and coinductive types in different typed lambda calculi, mainly extensions of the polymorphic lambda calculus. It is wellknown that in polymorphic lambda calculus, many inductive data types can be defined (see e.g.[Böhm and Berarducci 1985] and [Girard et al. 1989]). In this paper we want to look at how functions on inductive types can be represented. Therefore, two ways of using the inductive building up of a type to define functions on that type are being distinguished, the iterative way and the recursive way. An iterative function is defined by induction on the building up of the type by defining the function value in terms of the previous values. A recursive function is also defined by induction, but now by defining the function value in terms of the previous values and the previous inputs. For functions on the natural numbers that is h : Nat → A, with h(0) = c, h(n + 1) = f(h(n)) (for c : A, f : A → A) is iterative and h : Nat → A, with h(0) = c, h(n + 1) = g(h(n), n) (for c : A, g : A × Nat → A) is recursive. If one has pairing, the recursive functions can be defined using just iteration, which was essentially already shown by [Kleene 1936]. But if we work in a typed lambda calculus where pairing is not surjective, this translation of recursion in terms of iteration becomes inefficient and sometimes impossible. Moreover, if the calculus also incorporates some predicate logic, one would like to use the inductivity in doing proofs, which is not always straightforward (or just impossible.) We shall not go into the latter topic here; there is still a lot of work to be done in relating the work presented here to systems like AF2 by Krivine and Parigot (connections may be found in [Parigot 1992]) and Coq ([Dowek e.a. 1991].)

∗Extended notes of a talk given at the BRA-LF meeting in Edinburgh, May 1991 †herman@cs.kun.nl

This asks for an explicit scheme for recursion in typed lambda calculus, which yields for, say, the natural numbers the scheme of Gödels T. To see how this can be done in general for inductive types, we are going to define a categorical notion of recursion (just like ‘initial algebra’ categorically represents the notion of iteration). One of the trade-offs is that we can dualize all this to get a notion of corecursion on coinductive types. These categorical notions of recursion and corecursion have independently been found by Mendler (see [Mendler 1991]) who treats these constructions in Martin-Löf type theory with predicative universes. What we define as (co)recursive (co)algebras are what Mendler calls ‘(co)algebras that admit simple primitive recursion’. We shall always use the term ‘recursion’, because, although the function-definition-scheme has a strong flavour of primitive recursion, one can define many more functions in polymorphic lambda calculus then just the primitive recursive ones. Coinductive types were first described in [Hagino 1987a] and [Hagino 1987b], with only a scheme for coiteration and without corecursion. Here we give a quite straightforward extension of simply typed lambda calculus with recursive and corecursive types.

A very surprising result is that in a polymorphic framework, if we have a notion of recursive types which reflects our notion of recursive algebra, then we can define corecursive types that correspond to corecursive coalgebras. By duality, this also works the other way around. This result will be given here syntactically: We define a polymorphic lambda calculus with recursive and corecursive types (that straightforwardly represents the categorical notions of recursive algebra and corecursive coalgebra) and show that the scheme for recursive types can be defined from the scheme for corecursive types and vice versa. We also look at a system of recursive and corecursive types defined by [Mendler 1987] and show that with either the scheme for recursive types or the scheme for corecursive types, there is a recursive Φ-algebra and a corecursive Φcoalgebra in the syntax for every syntactic functor Φ (where syntactic functors are positive type schemes.)

2 The categorical perspective

As said, we shall get our intuitions about inductive and coinductive types from the field of category theory. The main notions in category theory related to this issue come from [Lambek 1968].

Definition 2.1 Let C be a category, T a functor from C to C.

1. A T -algebra in C is a pair (A, f), with A an object and f : T A → A.

2. If (A, f) and (B, g) are T -algebra’s, a morphism from (A, f) to (B, g) is a morphism h : A → B such that the following diagram commutes.

\begin{aligned}T A & \overline{f} & \overline{>} & A \\ T h∨ & = & ∨ & h \\ T B & \overline{g} & \overline{>} & B \end{aligned}

3. A T -algebra (A, f) is initial if it is initial in the category of T -algebras, i.e. for every T -algebra (B, g) there’s a unique h which makes the above diagram commute.

In a category with products, coproducts and terminal object, the initial algebra of the functor T X = 1 + X is the natural numbers object, for which we write (Nat, [Z, S]). The initial algebra of T X = 1+(A×X) is the object of finite lists over A, (List_{A}, [Nil, Cons]). In this paper our pet-example of an initial algebra will be (Nat, [Z, S]), which will be used to illustrate the properties we are interested in. First take a look at how the iterative and recursive functions can be defined on Nat. (The example immediately generalizes to arbitrary initial algebras.)

Example 2.2 1. For g : 1+B → B we write g_{1} for g∘in_{1} : 1 → B and g_{2} for g∘in_{2} : B → B. The iteratively defined morphism from g_{1}, g_{2}, Elimg_{1}g_{2}, is defined as the unique morphism h which makes the diagram commute, i.e. h ∘ Z = g_{1} and h ∘ S = g_{2} ∘ h.

2. For g_{1} : 1 → B, g_{2} : B × Nat → B, the recursively defined morphism from g_{1} and g_{2} is constructed as follows. There exists a unique h which makes the diagram

1 + Nat  \overline{[Z, S]}  \overline{>} Nat
id + h∨  =  ∨h
1 + (B × Nat) \overline{⟨[g_{1}, g_{2}], [Z, S ∘ π_{2}]⟩}\overline{>} B × Nat

commute. That is h ∘ [Z, S] = ⟨[g_{1}, g_{2}], [Z, S ∘ π_{2}]⟩ ∘ id + h. If we write h_{1} = π_{1} ∘ h and h_{2} = π_{2} ∘ h we have the equalities

h_{1} ∘ Z = g_{1},
h_{1} ∘ S = g_{2} ∘ h,
h_{2} ∘ Z = Z,
h_{2} ∘ S = S ∘ h_{2}.

Now h_{2} = id_{Nat} by uniqueness and also h = ⟨h_{1}, h_{2}⟩, so

h_{1} ∘ Z = g_{1},
h_{1} ∘ S = g_{2} ∘ ⟨h_{1}, id⟩.

So h_{1} satisfies the recursion equalities and we define

Recg_{1}g_{2} := h_{1}.

Definition 2.3 Let C be a category, T a functor from C to C.

1. A T -coalgebra in C is a pair (A, f), with A an object and f : A → T A.

2. If (A, f) and (B, g) are T -coalgebras, a morphism from (B, g) to (A, f) is a morphism h : B → A such that the following diagram commutes.

\begin{aligned}B & \overline{g} & \overline{>} & T B \\ h∨ & = & ∨ & T h \\ A & \overline{f} & \overline{>} & T A \end{aligned}

3. A T -coalgebra (A, f) is terminal if it is terminal in the category of T -coalgebras, i.e. for every coalgebra (B, g) there’s a unique h which makes the above diagram commute.

Our pet example for terminal coalgebras is the one for T X = Nat × X, the object of infinite lists of natural numbers, for which we write (Stream, ⟨H, T⟩). We shall dualize the notions of iterative and recursive function to get coiterative and corecursive functions to Stream. (Again this example easily generalizes to the case for arbitrary terminal coalgebras.)

Example 2.4 1. For g : B → Nat×B, write g_{1} for π_{1}∘g : B → Nat and g_{2} for π_{2}∘g : B → B. The coiteratively defined morphism from g_{1} and g_{2}, Introg_{1}g_{2} : B → Stream is the (unique) morphism h for which the diagram commutes. That is, H ∘ h = g_{1} and T ∘ h = h ∘ g_{2}. If j is a morphism from Nat to Nat, one can define the morphism from Stream to Stream which applies f to every point in the stream as Intro(j ∘ H)T. Note that it is not so straightforward to define (coiteratively) a morphism which replaces the head of a stream by, say, zero. This, however, can easily be done using corecursion.

2. For g_{1} : B → Nat, g_{2} : B → B + Stream, the corecursively defined morphism from g_{1} and g_{2}, Corecg_{1}g_{2} is defined by h ∘ in_{1}, where h is the (unique) morphism which makes the diagram

B + Stream \overline{[⟨g_{1}, g_{2}⟩, ⟨H, in_{2} ∘ T⟩]}\overline{>} Nat × (B + Stream)
h∨  =  ∨id × h
Stream  \overline{⟨H, T⟩}  \overline{>} Nat × Stream

commute. If we write h_{1} = h ∘ in_{1}, h_{2} = h ∘ in_{2}, then we have for h the following equations

H ∘ h_{2} = H,
T ∘ h_{2} = h_{2} ∘ T,
H ∘ h_{1} = g_{1},
T ∘ h_{1} = h ∘ g_{2}.

Now h_{2} = id by uniqueness and also h = [h_{1}, h_{2}], so

H ∘ h_{1} = g_{1},
T ∘ h_{1} = [h_{1}, id] ∘ g_{2}.

These are the equations for corecursion; if g_{1} : B → Nat and g_{2} : B → B + Stream, then j : B → Stream is corecursively defined from g_{1} and g_{2} if H ∘ j = g_{1} and T ∘ j = [j, id] ∘ g_{2}. The function ZeroH : Stream → Stream which changes the head of a stream into zero can now be defined as ZeroH := Corec(Z∘!)(in_{2} ∘ T), where ! is the unique morphism from Stream to 1. (Informally, Z∘! is of course just λs : Stream.0.)

As usual in categorical definitions, the definitions of initial algebra and terminal coalgebra split up in two parts, the ‘existence part’ (there’s an h such that...) and the ‘uniqueness part’ (the h is unique.) In the following we shall sometimes refer to these two parts of the definition as the existence property and the uniqueness property.

In the typed lambda calculi that we shall consider, the inductive and coinductive types will not exactly represent initial algebras and terminal coalgebras. What the systems are lacking is the uniqueness property for the morphism h in 2.1, respectively 2.3. Algebras, respectively coalgebras, which only satisfy the existence property are called weakly initial, respectively weakly terminal.

Definition 2.5 For T an endofunctor in a category C, The T -algebra, respectively T -coalgebra, (A, f) is weakly initial, respectively weakly terminal, if for every T -algebra, respectively T - coalgebra, (B, g) there exists an arrow h that makes the diagram in 2.1, respectively 2.3, commute.

Remark 2.6 The notion of weakly initial algebra is really weaker than that of initial algebra. For example in the category Set, (2ω, [Z, S]) is a weakly initial (λX.1 + X)-algebra, but also (2ω, [Z, S′]), with S′(n) = S(n), S′(ω + n) = n is. (On weakly initial algebras, the behaviour of morphisms is only determined on the standard part of the algebra, that is in settheoretic terms, those elements that are constructed by finitely many times applying the constructor f. Initiality says that the algebra is standard.)

As we made serious use of the uniqueness property in constructing the recursive and corecursive functions, it’s interesting to see how much we can do in weak initial algebras and weak terminal coalgebras. The construction of the iterative and coiterative functions of examples 2.2 and 2.4 can be done in the same way; we only loose the uniqueness property of the iteratively defined function. The construction of recursive and corecursive functions in a weak framework is not so straightforward. We shall study again the examples of natural numbers and streams of natural numbers. Fix a category C, which has weak products and coproducts. (So we do have e.g. π_{1} ∘ ⟨t_{1}, t_{2}⟩ = t_{1} and [t_{1}, t_{2}] ∘ in_{1} = t_{1}, but not ⟨π_{1} ∘ t, π_{2} ∘ t⟩ = t and [t ∘ in_{1}, t ∘ in_{2}] = t.) It will turn out that weak products and coproducts will cause some extra restrictions on the definability of functions. Therefore we shall also study what happens if product and coproduct are semi, that is for products ⟨f, g⟩∘h = ⟨f ∘h, g ∘h⟩ and for coproducts h∘[f, g] = [h∘f, h∘g]. The reason for not considering the strong products and coproducts in these examples is that in the syntax of typed lambda calculi product and coproduct are usually weak or semi. (The notions of semi product and semi coproduct are taken from [Hayashi 1985].)

Example 2.7 (Recursion on a weak natural numbers object) Let Nat be a weakly initial λX.1+ X-algebra. Consider the diagram in 2.2, where we defined recursion in terms of iteration and let h : Nat → B × Nat be some morphism that makes the diagram commute, i.e.

h ∘ [Z, S] = ⟨[g_{1}, g_{2}], [Z, S ∘ π_{2}]⟩ ∘ id + h.

Applying projections to the left and injections to the right of the equation we obtain the following equalities (where h_{1} = π_{1} ∘ h and h_{2} = π_{2} ∘ h).

h_{1} ∘ Z = g_{1},
h_{1} ∘ S = g_{2} ∘ h,
h_{2} ∘ Z = Z,
h_{2} ∘ S = S ∘ h_{2}.

Nat doesn’t satisfy the uniqueness properties, so not necessarily h_{2} = id_{Nat}but only

h_{2} ∘ S^{n} ∘ Z = S^{n} ∘ Z

for every n ∈ N, where S^{n} denotes an n-fold composition of S. Now we would like to deduce

h_{1} ∘ Z = g_{1},
h_{1} ∘ S^{n+1} ∘ Z = g_{2} ∘ ⟨h_{1}, id⟩ ∘ S^{n} ∘ Z,

which says that h_{1} satisfies the recusion equations for the ‘standard’ natural numbers.

• For weak products this conclusion is only valid if g_{2} = k ∘ π_{i} for some k : B → B or k : Nat → B. (Note that if g_{2} = k ∘ π_{1} for some k : B → B, then h_{1} is just iteratively defined from g_{1} and k, so only the case for g_{2} = k ∘ π_{2} gives us really new functions, for instance the predecessor.)

• For semi products this conclusion is only valid for g_{2} = k ∘⟨π_{1}, π_{2}⟩ for some k : B ×Nat → B, which is not a serious restriction: Just replace g_{2} by g_{2} ∘ ⟨π_{1}, π_{2}⟩.

Example 2.8 (Corecursion on a weak stream object) Let Stream be a weakly terminal λX.Nat× X-coalgebra. Consider the diagram in 2.4, where we defined corecursion in terms of coiteration and let h : (B + Stream) → Stream be some morphism that makes the diagram commute. Write h_{1} = h ∘ in_{1} and h_{2} = h ∘ in_{2}. We have the following equalities.

H ∘ h_{2} = H,
T ∘ h_{2} = h_{2} ∘ T,
H ∘ h_{1} = g_{1},
T ∘ h_{1} = h ∘ g_{2}.

Now we can not conclude h ∘ in_{2} = id, because we don’t have uniqueness, but we do have

H ∘ T^{n} ∘ h_{2} = H ∘ T^{n},

that is h_{2} is the identity on the ‘standard’ part of the stream (those points that can be obtained by finitely many applications of H or T.) Again we would like to conclude

H ∘ h_{1} = g_{1},
H ∘ T^{n+1} ∘ h_{1} = H ∘ T^{n} ∘ [h_{1}, id] ∘ g_{2},

that is h_{1} satisfies the corecursion equations for the ‘standard’ part of the stream.

• For weak coproducts this conclusion is only valid if g_{2} = in_{i} ∘ k for some k : B → B or k : B → Stream. (Note that if g_{2} = in_{1} ∘k for some k : B → B, then h_{1} is just coiteratively defined from g_{1} and k, so only the case for g_{2} = in_{2} ∘ k gives us really new functions, like for instance the function ZeroH.)

• For semi coproducts this conclusion is only valid if g_{2} = [in_{1}, in_{2}] ∘ k for some k : B → B + Stream. again this is not a serious restriction: Just replace g_{2} by [in_{1}, in_{2}] ∘ g_{2}.

For the morphism ZeroH : Stream → Stream which replaces the head by zero, defined in 2.4 by Corec(Z∘!)(in_{2} ∘ T), we now have (for either weak or semi coproducts)

H ∘ ZeroH = Z,
H ∘ T^{n+1} ∘ ZeroH = H ∘ T^{n+1},

so ZeroH works fine on the standard part of the stream. That one can not, in general, define a morphism ZeroH such that T ∘ ZeroH = T will be shown later, when we look at these examples in polymorphic lambda calculus which is an instance of a category with weakly initial algebras and weakly terminal coalgebras, semi products and weak coproducts.

Remark 2.9 With strong products and coproducts we would have similar problems in defining recursion and corecursion. The recursion equations would only be valid for the standard natural numbers and the corecursion equations would only be valid for the standard part of streams. The only advantage would be that the g_{2} : B × Nat → B, respectively the g_{2} : B → B + Stream can be taken arbitrarily.

In Section 4 the polymorphic lambda calculus will be considered in which inductive and coinductive types can be defined which correspond to weakly initial algebras and weakly terminal coalgebras. It will be shown that recursion in that calculus is problematic from a point of view of efficiency. One solution could be to strengthen the reduction rules to get a stronger (extensional) equality. However, it’s not possible to add some relatively easy reduction rules to the syntax to obtain the uniqueness property of initiality and terminality. (We can’t say in an easy way that the only objects of a structure are the standard ones.) This is because the equality of (primitive) recursive functions can not be decided by an easy (decidable) equality. We can do something different, namely say that our functions should behave on the non-standard part as they behave on the standard part. Categorically, this can be obtained by strengthening the notion of weakly initial algebra and weakly terminal coalgebra a little bit, such that recursion ‘works’. (That is for N, for c : A, g : A×Nat → A there is a function h : Nat → A, with h(0) = c and h(n + 1) = g(h(n), n).) These new notions will be called recursive algebra and corecursive coalgebra. The definitions are not difficult if one understands what makes it possible to define (co)recursion, in terms of (co)iteration.

Let in the following C be a category with weak products and weak coproducts and T a functor from C to C.

Definition 2.10 (A, f) is a recursive T -algebra if (A, f) is a T -algebra and for every g : T (X × A) → X there exists an h : A → X such that the following diagram commutes.

\begin{aligned}T A & \overline{f} & \overline{>} & A \\ T (⟨h, id⟩)∨ & = & ∨ & h \\ T (X × A) & \overline{g} & \overline{>} & X \end{aligned}

Notice that this is the same as saying that (A, f) is weakly initial and that moreover, in the diagram for defining recursion in terms of iteration, h_{2} = id. (See 2.2)

Definition 2.11 (A, f) is a corecursive T -coalgebra if (A, f) is a T -coalgebra and for every g : X → T (X + A) there exists an h : X → A such that the following diagram commutes.

\begin{aligned}X & \overline{g} & \overline{>} & T (X + A) \\ h∨ & = & ∨ & T ([h, id]) \\ A & \overline{f} & \overline{>} & T A \end{aligned}

Again this is the same as saying that (A, f) is a weakly terminal T -coalgebra and that moreover, in the diagram for defining corecursion in terms of coiteration, h_{2} = id. (See 2.4)

When talking about weakly initial or recursive T -algebras and weakly terminal or corecursive T -coalgebras, it is convenient to denote the h that makes the diagram commute as a function of g. So we shall denote a weakly initial T -algebra by (A, f, Elim), where Elimg denotes a morphism h in 2.5 that makes the diagram commute. Similarly, we write (A, f, Intro) for a weakly terminal T -coalgebra, (A, f, Rec) for a recursive T -algebra and (A, f, Corec) for a corecursive T -coalgebra.

Examples 2.12 1. If (Nat, [Z, S], Rec) is a recursive λX.1 + X-algebra, Rec is a recursor on Nat: For [g_{1}, g_{2}] : 1 + (X × Nat) → X,

Rec[g_{1}, g_{2}] ∘ Z = g_{1},
Rec[g_{1}, g_{2}] ∘ S = g_{2} ∘ ⟨Rec[g_{1}, g_{2}], id⟩,

so Rec[g_{1}, g_{2}] is the recursively defined function from g_{1} and g_{2}. We can define P := Rec[Z, π_{2}] and we have

P ∘ Z = Z,
P ∘ S = id.

2. If (Stream, ⟨H, T⟩, Corec) is a corecursive λX.Nat × X-coalgebra. Then for ⟨g_{1}, g_{2}⟩ : X → Nat × (X + Stream), the function Corec⟨g_{1}, g_{2}⟩ satisfies

H ∘ Corec⟨g_{1}, g_{2}⟩ = g_{1},
T ∘ Corec⟨g_{1}, g_{2}⟩ = [Corec⟨g_{1}, g_{2}⟩, id] ∘ g_{2},

so Corec⟨g_{1}, g_{2}⟩ is the corecursively defined function from g_{1} and g_{2}. We can define

ZeroH := Corec⟨Z∘!, in_{2} ∘ T⟩

with

H ∘ ZeroH = Z∘!,
T ∘ ZeroH = T.

3 Extending simply typed lambda calculus with inductive and coinductive types

In his thesis ([Hagino 1987a]) Hagino derives from the notions of initial algebra and terminal coalgebra an extension of simply typed lambda calculus, which he calls categorical data types. This amounts to adding two schemes for defining a new type from a covariant functor from types to types. (In the notation of these schemes below we follow [Wraith 1989].) These new types come together with some constants and reduction rules. A covariant functor from types to types in λ → is a positive type scheme Φ(α), that is a type Φ in which the free variable α occurs positively. (The type variable α occurs positively in the type Φ if α ∉ FV(Φ), Φ ≡ α or if Φ ≡ Φ_{1}→Φ_{2} and α occurs negatively in Φ_{1}, positively in Φ_{2}. The type variable α occurs negatively in Φ if α ∉ FV(Φ), Φ ≡ α or if Φ ≡ Φ_{1}→Φ_{2} and α occurs negatively in Φ_{2}, positively in Φ_{1}.) If Φ(α) is a type scheme, with Φ(τ) we mean the type Φ with τ substituted for α. If there’s no ambiguity to which type variable α we’re referring, we just write Φ in stead of Φ(α).

A positive, respectively negative type scheme Φ can be applied to a function f:τ→ρ, obtaining Φ(f):Φ(ρ)→Φ(τ), respectively Φ(f):Φ(τ)→Φ(ρ) by lifting: α(f) ≡ f, if α ∉ FV(Φ), Φ(f) ≡ id_{Φ} and if α occurs negatively in Φ_{1}, positively in Φ_{2} then

(Φ_{1}→Φ_{2})(f) ≡ λx:Φ_{1}(ρ)→Φ_{2}(ρ).λy:Φ_{1}(τ).Φ_{2}(f)(x(Φ_{1}(f)y)),
(Φ_{2}→Φ_{1})(f) ≡ λx:Φ_{2}(τ)→Φ_{1}(τ).λy:Φ_{2}(ρ).Φ_{1}(f)(x(Φ_{2}(f)y)).

Definition 3.1 Let Φ_{1}, Φ_{2}, …, Φ_{n} be types in the simply typed lambda calculus in which the typevariable α occurs positively. The sum scheme for constructing data types is the following. σ = sum α with constructors

c_{1} : Φ_{1}→α
c_{2} : Φ_{2}→α
⋮
c_{n} : Φ_{n}→α

end A declaration of a type σ using this sum scheme gives rise to an extension of the language of λ → with

1. a closed type σ

2. constants c_{i}:Φ_{i}(σ)→σ for 1 ≤ i ≤ n,

3. for every type τ, Elim_{τ}:(Φ_{1}(τ)→τ)→(Φ_{2}(τ)→τ)→ … →(Φ_{n}(τ)→τ)→σ→τ.

The reduction relation is extended with the rule

Elim_{τ}M_{1}M_{2} … M_{n}(c_{i}t) ⟶ M_{i}(Φ_{i}(Elim_{τ}M_{1} … M_{n})t)

An easy example of a type defined by the sum scheme is σ+τ (for σ and τ types), representing the the disjoint sum of σ and τ. σ + τ = sum α with constructors

inl : σ→α
inr : τ→α

end with inl : σ→σ + τ, inr : τ→σ + τ and for M_{1}:σ→ρ, M_{2}:τ→ρ, [M_{1}, M_{2}] : σ + τ→ρ.

The sequence of type schemes in the sum scheme can also be empty, allowing us to define the unit type by 1 = sum α with constructors

∗ : α

end We have ∗ : 1 and for any t : τ, !(t) : 1→τ with !(t)(∗) ⟶ t.

Definition 3.2 Let Φ_{1}, Φ_{2}, …, Φ_{n} be types in the simply typed lambda calculus in which the typevariable α occurs positively. The product scheme for constructing new data types is the following. σ = product α with destructors

d_{1} : α→Φ_{1}
d_{2} : α→Φ_{2}
⋮
d_{n} : α→Φ_{n}

end A declaration of a type σ using this product scheme gives rise to an extension of the language of λ → with

1. a closed type σ,

2. constants d_{i}:σ→Φ_{i}(σ), for 1 ≤ i ≤ n,

3. for every type τ, Intro_{τ}:(τ→Φ_{1}(τ))→(τ→Φ_{2}(τ))→ … →(τ→Φ_{n}(τ))→τ→σ.

The reduction relation is extended with the rule

d_{i}(Intro_{τ}M_{1}M_{2} … M_{n}t) ⟶ Φ_{i}(Intro_{τ}M_{1} … M_{n})(M_{i}t)

The straightforward example of a type defined by the product scheme is σ × τ (for σ and τ types), representing the the product of σ and τ. σ × τ = product α with destructors

fst : α→σ
snd : α→τ

end with fst : σ × τ→σ, snd : σ × τ→τ and for M_{1}:ρ→σ, M_{2}:ρ→τ, <M_{1}, M_{2}> : ρ→σ × τ.

Remark 3.3 The type σ defined by the sum scheme from Φ_{1}(α), … Φ_{n}(α), will be denoted by μα.(Φ_{1}(α) + … + Φ_{n}(α)). The type σ defined by the product scheme from Φ_{1}(α), … Φ_{n}(α), will be denoted by να.(Φ_{1}(α) × … × Φ_{n}(α)). This is also how these types should be read: as (weakly) initial algebras of T X = Φ_{1}(X) + … + Φ_{n}(X) and (weakly) terminal coalgebras of T X = Φ_{1}(X) × … × Φ_{n}(X), respectively. (So dualising is of course not the same as reversing all the arrows in a sum scheme to obtain a product scheme!)

Definition 3.4 λ →^{ind} is the simply typed lambda calculus extended with sum scheme and product scheme.

Example 3.5 The iterative functions on an inductive type can be straightforwardly defined by the Elim construct. Write Nat for μα.1 + α, then for c:τ and f:τ→τ, Elim(λz.c)f:Nat→τ is the iteratively defined function from c and f. The recursive functions can be defined by translating recursion in terms of iteration as is done in 2.2. For c:τ, g:τ→Nat→τ, define Reccg := fst ∘ Elim(λz.⟨c, 0⟩)(⟨λx.g(fstx)(sndx), S ∘ snd⟩) and we have

Reccg0 ⟶ ⟶ c,
Reccg(S^{n+1}(0)) ⟶ ⟶ g(Reccg(S^{n}0))(snd(Elim(λz.⟨c, 0⟩)(⟨λx.g(fstx)(sndx), S ∘ snd⟩)(S^{n}(0)))).

This recursor only works for terms of type Nat which are of the form S^{n}0, but moreover, it is quite inefficient (compared to, for instance, the recursor in Gödels T).

Proposition 3.6 The predecessor function of type Nat→Nat, defined in terms of iteration in λ →^{ind} computes the predecessor of a numeral n + 1 in 3n + 2 steps.

Proof The predecessor function P is the βη-normal form of Rec0(λxy.y), so

P ≡ fst ∘ Elim_{Nat×Nat}(λz.⟨0, 0⟩)(⟨snd, S ∘ snd⟩).

Now

P (S^{n+1}0) ⟶ ⟶_{2} snd(Elim(λz.⟨0, 0⟩)(⟨snd, S ∘ snd⟩)(S^{n}(0))),
snd(Elim(λz.⟨0, 0⟩)(⟨snd, S ∘ snd⟩)(0)) ⟶ ⟶_{3} 0

and with induction one proves that

snd(Elim(λz.⟨0, 0⟩)(⟨snd, S∘snd⟩)(S^{n+1}(0))) ⟶ ⟶_{3} S(snd(Elim(λz.⟨0, 0⟩)(⟨snd, S∘snd⟩)(S^{n}(0)))).

Proposition 3.7 In λ →^{ind} there is no term P:Nat→Nat with

P (S0) = 0 and
P (Sx) = x

for x a variable of type Nat.

Proof This follows by the Church-Rosser property for reduction in λ →^{ind}. (See [Hagino 1987b].) If P (Sx) = x, then P (Sx) ⟶ ⟶ x. Analyzing the possible structure of P one can conclude that if P (Sx) ⟶ ⟶ x, then not at the same time P (S0) ⟶ ⟶ 0. This proposition is also an immediate corollary of the same proposition for system F in 4.

If one tries to do corecursion on the coinductive types in λ →^{ind}, a similar situation occurs. For Stream := να.Nat × α, one can define ZeroH:Stream→Stream which replaces the head by 0 using the definable corecursion in weakly terminal coalgebras. We do not have T (ZeroHs) = T s, for s a Stream, but just H(ZeroHs) = 0 and H(T^{n+1}(ZeroHs)) = H(T^{n+1}s). One can also show that there can be no term ZeroH:Stream→Stream such that T (ZeroHs) = s for a variable s:Stream. (Using the Church-Rosser property or as a corollary of the same proposition for system F.)

There are of course ways to strengthen the equalities of the sum and product scheme to get real recursion and corecursion. The initiality can be restored totally by adding the conditional rewrite rule

If h(c_{i}t) = M_{i}(σ_{i}[h]t) for 1 ≤ i ≤ n and M_{i} and t of appropriate type, then h ⟶ Elim_{τ}M_{1} … M_{n}.

However, conditional rewrite rules are metatheoretically very complicated (the rewriting depends on the typing and on the previously generated equality.) Another alternative, which restores part of the unicity is to add a rewrite rule

Elim_{σ}c_{1} … c_{n} ⟶ Id_{σ},

for σ = sum α with constructors

c_{1} : Φ_{1}→α
c_{2} : Φ_{2}→α
⋮
c_{n} : Φ_{n}→α

end This is not enough to obtain a recursive algebra, because the Elim constructor doesn’t automatically commute with pairing. One has to add

snd ∘ Elim_{τ×σ}⟨g_{1}, c_{1} ∘ Φ_{1}(snd)⟩, …, ⟨g_{n}, c_{n} ∘ Φ_{n}(snd)⟩ ⟶ Elim_{σ}c_{1} … c_{n}.

In the proof of Proposition 3.6, we then have that Rec0(λxy.y)(S^{n+1}0) ⟶ ⟶ S^{N}(0) in a constant number of steps. In this case it is of course better to take × (and + if we add similar rules for the product scheme) as primitive type constructors. The new reduction rule is not a very pretty one.

We can also follow the categorical definitions of recursion and corecursion and strengthen the sum and product schemes themselves. (Again it is best to take × and + as primitives.) For the sum scheme this would lead to the type σ with the same constructors and further

1. for every type τ, Rec_{τ}:(σ_{1}(τ × σ)→τ)→(σ_{2}(τ × σ)→τ)→ … (σ_{n}(τ × σ)→τ)→σ→τ,

2. the reduction rule Rec_{τ}M_{1}M_{2} … M_{n}(c_{i}t) ⟶ M_{i}(σ_{i}[⟨Rec_{τ}M_{1} … M_{n}, id⟩]t)

For the product scheme we would also get the same type σ with the same destructors and further

1. for every type τ, Corec_{τ}:(τ→σ_{1}(τ + σ))→(τ→σ_{2}(τ + σ))→ … (τ→σ_{n}(τ + σ))→τ→σ,

2. the reduction rule d_{i}(Corec_{τ}M_{1}M_{2} … M_{n}t) ⟶ σ_{i}[[id, Corec_{τ}M_{1} … M_{n}]](M_{i}t).

Call the system λ →^{ind} with modified sum and product scheme as above λ →^{rec}. Without proof we give the following proposition.

Proposition 3.8 In the system λ →^{rec} the inductive types are recursive algebras and the coinductive types are corecursive coalgebras. (For the appropriate functors.)

4 The polymorphic lambda calculus

We just give the rules to fix our notation and shall not go into the system further, assuming it is familiar. We write × and + for the definable weak product and coproduct: σ × τ ≡ ∀α.(σ→τ→α)→α and σ + τ ≡ ∀α.(σ→α)→(τ→α)→α.) We could also have added × and + as new type constructors with extra rules turning them into a weak product and coproduct. This however is inconvenient: The added × and + would not be functorial (e.g. × : Types × Types→Types does not preserve identities and composition), whereas the definable × and + are functorial by construction if we assume an η-reduction rule. (See Definition 4.2 and the discussion.)

Definition 4.1 1. The set of types of F, T, is defined by the following abstract syntax.

T ::= TypVar | T→T | ∀TypVar.T

2. The expressions of F, T, are defined by the following abstract syntax.

T ::= Var | T T | T T |λVar:T.T | ΛT ypV ar.T

3. A context is a sequence of declarations x:σ (x ∈ Var and σ ∈ T), where it is assumed that if x:σ and y:τ are different declarations in the same context, then x ≢ y.

4. The typing rules for deriving judgements of the form Γ ⊢ M:σ for Γ a context, M an expression and σ a type, are the following.

• If x:σ is in Γ, then Γ ⊢ x:σ,

• {Γ ⊢ M:σ→τ Γ ⊢ N:σ \atop Γ ⊢ MN:τ}  {Γ, x:σ ⊢ M:τ \atop Γ ⊢ λx:σ.M:σ→τ}

• {Γ ⊢ M:∀α.σ \atop Γ ⊢ Mτ:σ[τ/α]} if τ ∈ T. {Γ ⊢ M:σ \atop Γ ⊢ Λα.M:∀α.σ} if α ∉ FTV(Γ).

FTV denotes the set of free type variables (TypVar.)

5. The one step reduction rules are the following.

• (λx:σ.M)N ⟶_{β} M[N/x],

• λx:σ.Mx ⟶_{η} M if x ∉ FV(M),

• (Λα.M)τ ⟶_{β} M[τ/α],

• Λα.Mα ⟶_{η} M if α ∉ FTV(M).

FV denotes the free term variables (Var.) One step reduction, ⟶, is defined as the union of ⟶_{β} and ⟶_{η}. The relations ⟶ ⟶ and = are respectively defined as the transitive, reflexive and the transitive, reflexive, symmetric closure of ⟶.

Here, t′[t/u] denotes the substitution of t for the variable u in t′. Substitution is done with the usual care, renaming bound variables such that no free variable becomes bound after substitution.

Type variables will be denoted by the lower case Greek characters α, β and γ, term variables will be denoted by lower case Roman characters. The set of expressions typable in the context Γ with type σ is denoted by Term(σ, Γ).

We want to discuss categorical notions like weak initiality in the syntax and therefore define need a syntactic notion of functor. This will be covered by the (well-known) notion of positive or negative type scheme.

Definition 4.2 1. A type scheme in F is a type Φ(α) where α marks all occurrences (possibly none) of α.

2. A type scheme Φ(α) can be positive or negative (but also none of the both), which is defined by induction on the structure of Φ(α) as follows.

(a) If α ∉ FTV(Φ(α)), then Φ(α) is positive and negative,

(b) if Φ(α) ≡ α then Φ(α) is positive,

(c) if Φ(α) ≡ Φ_{1}(α)→Φ_{2}(α), then Φ(α) is positive if Φ_{1}(α) is negative and Φ_{2}(α) is positive, Φ(α) is negative if Φ_{1}(α) is positive and Φ_{2}(α) is negative,

(d) if Φ(α) ≡ ∀β.Φ′(α) then Φ(α) ≡ ∀β.Φ′(α) is positive (resp. negative) if Φ′(α) is positive (resp. negative) .

3. A positive (resp. negative) type scheme Φ(α) works covariantly (resp. contravariantly) on a term f:σ→τ, obtaining a term Φ(f) of type Φ(σ)→Φ(τ) (resp. Φ(τ)→Φ(σ)), by lifting, defined inductively as follows. (Let f:σ→τ.)

(a) If α ∉ FTV(Φ(α)), then Φ(f) := id_{Φ(α)},

(b) if Φ(α) ≡ α then Φ(f) := f,

(c) if Φ(α) ≡ Φ_{1}(α)→Φ_{2}(α), then, if Φ(α) is positive,

Φ(f) := λx:Φ_{1}(σ)→Φ_{2}(σ).λy:Φ_{1}(τ).Φ_{2}(f)(x(Φ_{1}(f)y))), if Φ(α) is negative,
Φ(f) := λx:Φ_{2}(τ)→Φ_{1}(τ).λy:Φ_{2}(σ).Φ_{1}(f)(x(Φ_{2}(f)y))),

(d) if Φ(α) ≡ ∀β.Φ′(α), then, if Φ(α) is positive, Φ(f) := λx:Φ(σ).λβ.Φ′(f)(xβ), if Φ(α)

is negative, then Φ(f) := λx:Φ(τ).λβ.Φ′(f)(xβ).

It is easy to check that the lifting preserves identity and composition: Φ(id) = id and if Φ(α) is positive then Φ(f ∘ g) = Φ(f) ∘ Φ(g), if Φ(α) is negative then Φ(f ∘ g) = Φ(g) ∘ Φ(f). This also works for type schemes containing × or +, if we interpret × and + as the definable weak product and coproduct:

σ × τ =: ∀α.(σ→τ→α)→α,
fst := λx:σ × τ.xσ(λy:σ.λz:τ.y),
snd := λx:σ × τ.xτ(λy:σ.λz:τ.z),
<f, g> := λz:ρ.λα.λk:σ→τ→ρ.k(fz)(gz),
for f:σ→ρ, g:τ→ρ,
σ + τ =: ∀α.(σ→α)→(τ→α)→α,
inl := λx:σ.λα.λf : σ→α.λg:τ→α.fx,
inr := λx:σ.λα.λf : σ→α.λg:τ→α.gx,
[f, g] := λz:σ + τ.zρfg,
for f:ρ→σ, g:ρ→τ.

It should be remarked here that if one lifts f:σ→τ via a type scheme Φ(α) ≡ Φ_{1}(α) × Φ_{2}(α) (respectively Φ(α) ≡ Φ_{1}(α) + Φ_{2}(α)) according to Definition 4.2, this does not give the (expected) result Φ(f) = λx:Φ(σ).<Φ_{1}(f)(fstx), Φ_{2}(f)(sndx)> (respectively Φ(f) = [inl ∘ Φ_{1}(f), inr ∘ Φ_{2}(f)].) If we take the latter definition for lifting a function via a product or sum, this doesn’t yield functoriality of × and +. We introduce some new notation to denote this lifting via × and +.

Definition 4.3 Let f:σ→τ, g:μ→ρ.

1. timesfg : σ × μ→τ × ρ is defined by

timesfg := λz:σ × μ.λβ.λy:τ→ρ→β.zβ(λp:σ.λq:μ.y(fp)(gq)).

2. plusfg : σ + μ→τ + ρ is defined by

plusfg := λz:σ + μ.λβ.λy_{1}:τ→β.y_{2}:ρ→β.zβ(y_{1} ∘ f)(y_{2} ∘ g).

Now for f:σ→τ, if Φ(α) = Φ_{1}(α) × Φ_{2}(α) then Φ(f) = times(Φ_{1}(f))(Φ_{2}(f)) and if Ψ(α) = Ψ_{1}(α) + Ψ_{2}(α) then Ψ(f) = plus(Ψ_{1}(f))(Ψ_{2}(f)). Let’s state some more easy facts about times and plus, some of which will be used later.

Fact 4.4 For f, g, h and k of the right type we have.

1. plusfg ∘ inl = inl ∘ f,

2. plusfg ∘ inr = inr ∘ g,

3. plusfg ∘ plushk = plus(f ∘ h)(g ∘ k),

4. timesfg ∘ timeshk = times(f ∘ h)(g ∘ k),

5. [f, g] ∘ plushk = [f ∘ h, g ∘ k],

6. plushk ∘ <f, g> = <h ∘ f, k ∘ g>.

(In general we don’t have fst ∘ timesfg = f ∘ fst or snd ∘ timesfg = g ∘ snd.)

Positive (negative) type schemes can really be viewed as (contravariant) functors in the syntax of polymorphic lambda calculus. (Consider a syntax with countably many variables of every type and view types as objects and terms of type σ→τ as morphisms from σ to τ.) The positive type schemes are a syntactic version of covariant functors. Similarly we also have syntactic versions of weakly initial (terminal) (co)algebras and (co)recursive (co)algebras.

Definition 4.5 Suppose we work in (an extension of) polymorphic lambda calculus where we have fixed a notation for weak products and coproducts (e.g. the second order definable ones.) Let Φ(α) be a positive type scheme.

1. The triple (σ_{0}, M_{0}, Elim) is a syntactic weakly initial Φ-algebra if

(a) σ_{0} ∈ T,

(b) ⊢ M_{0}:Φ(σ_{0})→σ_{0}, (c) ⊢ Elim:∀β.(Φ(β)→β)→σ_{0}→β, such that

Elimτg ∘ M_{0} = g ∘ Φ(Elimτg)

for any τ ∈ T and Γ ⊢ g:Φ(τ)→τ.

2. The triple (σ_{1}, M_{1}, Intro) is a syntactic weakly terminal Φ-coalgebra if (a) σ_{1} ∈ T,

(b) ⊢ f_{1}:σ_{1}→Φ(σ_{1}),

(c) ⊢ Intro:∀β.(β→Φ(β))→β→σ_{1}, such that

M_{1} ∘ Introτg = Φ(Introτg) ∘ g

for any τ ∈ T and Γ ⊢ g:τ→Φ(τ).

3. The triple (σ_{0}, M_{0}, Rec) is a syntactic recursive Φ-algebra if (a) σ_{0} ∈ T,

(b) ⊢ M_{0}:Φ(σ_{0})→σ_{0},

(c) ⊢ Rec:∀β.(Φ(β × σ_{0})→β)→σ_{0}→β, such that

Recτg ∘ M_{0} = g ∘ Φ(<Recτg, id>)

for any τ ∈ T and Γ ⊢ g:Φ(τ × σ_{0})→τ.

4. The triple (σ_{1}, M_{1}, Corec) is a syntactic corecursive Φ-coalgebra if (a) σ_{1} ∈ T,

(b) ⊢ f_{1}:σ_{1}→Φ(σ_{1}),

(c) ⊢ Corec:∀β.(β→Φ(β + σ_{1}))→β→σ_{1}, such that

M_{1} ∘ Corecτg = Φ([Corecτg, id]) ∘ g

for any τ ∈ T and Γ ⊢ g:τ→Φ(τ + σ_{1}). We have the following proposition, of which the first part is a syntactic version of a result

in [Reynolds and Plotkin 1990] and the second part is a result of [Wraith 1989]. In fact, the first part of the proposition says that the algebraic inductive data types can be represented in F, which result originally goes back to [Böhm and Berarducci 1985]. Here we just want to give these representations in short; for further details one may consult [Böhm and Berarducci 1985], [Leivant 1989] or [Girard et al. 1989]. Proposition 4.6 We work in the system F. Let Φ(α) be a positive type scheme. Then

1. There is a syntactic weakly initial Φ-algebra.

2. There is a syntactic weakly terminal Φ-coalgebra.

Proof Let Φ(α) be a positive type scheme.

1. Define σ_{0} := ∀α.(Φ(α)→α)→α, M_{0} := λx:Φ(σ).λα.λg:Φ(α)→α.g(Φ(Elimαg)x), and Elim := λα.λg:Φ(α)→α.λy:σ.yαg. Now (σ_{0}, M_{0}, Elim) is a syntactic weakly initial Φ-algebra.

2. Define σ_{1} := ∀α.(∀β.(β→Φ(β))→β→α)→α, M_{1} := λx:σ.x(Φ(σ))(λβ.λg:β→Φ(β).λz:β.Φ(Introβg)(gx)), and Intro := λα.λg:α→Φ(α).λy:α.λβ.λh:∀γ.(γ→Φ(γ))→γ→β.hαgy. Now (σ_{1}, M_{1}, Intro) is a syntactic weakly terminal Φ-coalgebra.

We don’t know whether there are syntactic recursive algebras or syntactic corecursive coalgebras in F. The answer seems to be negative. The well-known definitions of algebraic data-types in F (which are almost the ones defined in the proof above) do in general not allow recursion or corecursion, as will be illustrated by looking at the examples of natural numbers and streams of natural numbers. This means that recursion and corecursion have to be defined in terms of iteration and coiteration, using the techniques discussed in the Examples 2.7 and 2.8. As was noticed there, it makes a difference whether product and coproduct are weak or semi, so let’s note the following fact.

Fact 4.7 The definable coproduct in F is a weak coproduct, but the definable product in F is a semi product. (That is, <f, g> ∘ h = <f ∘ h, g ∘ h>, but not h ∘ [f, g] = [h ∘ f, h ∘ g])

Example 4.8 (See also Example 3.5 and Proposition 3.6.)We define recursive functions on the weak initial algebra of natural numbers. Let (Nat, M_{0}, Elim) be the syntactic weak initial algebra of Φ(α) = 1 + α, as given in the proof of 4.6, where 1 and + are the second order definable ones. (One can also take the well-known polymorphic Church numerals, which is a slight modification of our type Nat. The exposition is not essentially different, but we want to use our categorical understanding of recursion of 2.7.) So Nat = ∀α((1 + α)→α)→α, M_{0} = λx:1 + Nat.λα.λg.g((id + Elimαg)x) and Elim = λα.λg.λy:Nat.yαg. Now we first define Z := M_{0} ∘ inl and S := M_{0} ∘ inr. Following Example 2.7, we now define Recg = fst ∘ Elim(τ × Nat)(<g, [Z, S ∘ snd]>), for g:1 + τ × Nat→τ. If

g = [g_{1}, k ∘ <fst, snd>]

for some k:τ × Nat→τ, we obtain the recursion equalities for Recg:

Recg ∘ Z = g_{1},
Recg ∘ S^{n+1} ∘ Z = k ∘ <Recg, id> ∘ S^{n} ∘ Z.

(See 2.7 for the restriction on the form of g; the product is semi here.) The predecessor is now defined by taking g = [Z, snd], so P := fst ∘ Elim(τ × Nat)(<[Z, snd], [Z, S ∘ snd]>). Notice that P (St) = t only for standard natural numbers, i.e. for t = S^{n}(Z∗), with ∗ the unique (closed) term of type 1. Also notice that P computes the predecessor of a natural number n in a number of steps of order n.

Example 4.9 We define corecursive functions on streams of natural numbers. Take for Stream the syntactic weakly terminal Φ-coalgebra as in the proof of 4.6, for Φ(α) = Nat × α. So Stream = ∀α.(∀β.(β→(Nat × β))→β→α)→α, M_{1} = λx:Stream.x(Nat × σ)(λβ.λg:β→Nat × β.λz:β.(id × Introβg)(gx)), and Intro = λα.λg:α→Nat × α.λy:α.λβ.λh:∀γ.(γ→Nat × γ)→γ→β.hαgy. We can define head and tail functions by taking H := fst ∘ M_{1} and T := snd ∘ M_{1}. Following Example 2.8, we now define for g:τ→Nat × (τ + Stream) Corecg := Intro(τ + Stream)([g, <H, inr ∘ T>]) ∘ inl. As the coproduct is not semi, but weak (see 2.8), we find that only for g = <g_{1}, in ∘ k> for in is inr or inl and some k:Stream→B or k:Stream→Stream we obtain the corecursion equations.

H ∘ Corecg = g_{1},
T ∘ Corecg = [Corecg, id] ∘ snd ∘ g.

The function that replaces the head of a stream by zero is now defined by ZeroH := Corec<Z, inr∘ T>

It is really impossible to define a ‘global’ predecessor on the weakly initial natural numbers as described above (and similarly for the polymorphic Church numerals.) Also it is impossible to define a global ZeroH-function on the weakly terminal streams as described above. This is shown in the following proposition.

Proposition 4.10 1. For Nat = ∀α((1 + α)→α)→α, there is no closed term P:Nat→Nat such that P (Sx) = x for x a variable.

2. For Stream := ∀β.(∀γ.(γ→Nat)→(γ→γ)→γ→β)→β there is no closed term ZeroH:Stream→Stream such that T(ZeroHy) = Ty and H(ZeroHy) = 0 for y a variable.

Proof Both cases immediately by the Church-Rosser property for the system F.

One can show in general that the (co)inductive types in system F as defined above do not allow (co)recursion, i.e. they are weakly initial (terminal) (co)algebras.

5 Recursive algebras and corecursive coalgebras and polymorphism

We define an extension of F which includes a syntactic formalization of recursive algebras and corecursive coalgebras. Then we show the remarkable fact that in this system one can define recursive algebras in terms of corecursive coalgebras and vice versa, so one of the two is enough to be able to define the other. This fact has a counterpart in semantics in the form that every K-model of polymorphic lambda calculus that has a recursive T -algebras for every expressible functor T, also has a corecursive T -coalgebra for every expressible functor T and vice versa. (The notion of K-model is in [Reynolds and Plotkin 1990]; it is a syntax dependent notion of model for F, described by giving a set of constraints that a structure and an interpretation function should satisfy in order to be a model. As it covers a lot of known models it serves well as a framework for stating this property semantically. Also the notion of expressible functor comes from [Reynolds and Plotkin 1990]; roughly speaking, a functor is expressible if there is a type scheme whose interpretation in the model (as a function of the free type variable) is a the functor.) We then want to relate our extension of F with recursive (and corecursive) types to a system described by [Mendler 1987]. The latter system has a different scheme for recursive (and corecursive) types, the syntax of which is a bit too weak to define one in terms of the other.

We can, however, interpret our system with recursive and corecursive types in Mendler’s (with either recursive or corecursive types.) This is done by showing that the system has syntactic recursive Φ-algebras and syntactic corecursive Φ-coalgebras for every positive type scheme Φ. (See Definition 4.5.)

Definition 5.1 The system F_{(co)rec} is the system F extended with the following.

1. The set of types T is extended with μα.Φ(α) and να.Φ(α), for Φ(α) a positive type scheme.

2. For μα.Φ(α) and να.Φ(α) we have the extra constants

In_{μ} : Φ(μ)→μ Rec_{μ} : ∀α.(Φ(α × μ)→α)→μ→α,
Out_{ν} : ν→Φ(ν) Corec_{ν} : ∀α.(α→Φ(α + ν))→α→ν.

3. Reduction rules for μ and ν:

Recτg(Inx) ⟶_{μ} g(Φ(<Recτg, id>)x),
Out(Corecτgx) ⟶_{ν} Φ([Corecτg, id])(gx).

(μ abbreviates μα.Φ(α) and ν abbreviates να.Φ(α).)

We now have the following theorem, stating that in polymorphic lambda calculus, if one has recursive types the corecursive types can be defined and vice versa.

Theorem 5.2 In F we can define ν, Out and Corec in terms of μ, In and Rec and vice versa.

Proof Suppose we only have the rules for μ, In and Rec and let Φ be a positive type scheme. Define

Θ(α) := ∀γ.(∀β.(β→Φ(β + α) × β)→γ)→γ,
σ := μα.Θ(α),
Corec := λα.λg:α→Φ(α + σ).λx:α.In_{σ}(λγ.λh:∀β.(β→Φ(β + σ) × β)→γ.hα<g, x>),
Out := Rec_{σ}(Φ(σ))(λz:Θ(Φ(σ) × σ).z(Φ(σ))(λγ.λp.Φ([Corecγ(Φ(plus(id)(snd)) ∘ p_{1}), snd])(p_{1}p_{2}))),

where p_{1} and p_{2} abbreviate fstp and sndp (the type of p is (γ→Φ(γ + (Φ(σ) × σ))) × σ.) We have

Rec_{σ}τg(In_{σ}x) ⟶_{μ} g(Θ(<Rec_{σ}τg, id>)x),

for any g and x of appropriate types and we want to show

Out(Corecτgx) ⟶ ⟶ Φ([Corecτg, id])(gx))

for g:τ→Φ(τ + σ) and x:τ.

To make things easier to read we omit the type information in lambda abstractions. Let τ be a type, g:τ→Φ(τ + σ) and x:τ and abbreviate F ≡ λγp.Φ([Corecγ(Φ(plus(id)(snd)) ∘ p_{1}), snd])(p_{1}p_{2}). The lifting of an f via Θ is defined as (following 4.2)

Θ(f) ≡ λtγk.tγ(λβz.kβ(times(λyx.plus(id)f(yx))(id)z).

Now

Out(Corecτgx) ⟶ ⟶ Rec_{σ}(Φ(σ))(λz.z(Φ(σ))F)(In_{σ}(λγh.hτ<g, x>))
⟶ ⟶ Θ(<Rec_{σ}(Φ(σ))(λz.z(Φ(σ))F), id>)(λγh.hτ<g, x>)(Φ(σ))F
⟶ ⟶ (λβz.F β(times(λyx.Φ(plus(id)F)(yx)(id)z))τ<g, x>
⟶ ⟶ Φ([Corecτ(Φ(plus(id)(snd)) ∘ Φ(plus(id)F) ∘ g, snd])(Φ(plus(id)F)(gx))
⟶ ⟶ Φ([Corecτg, snd] ∘ plus(id)F))(gx)
⟶ ⟶ Φ([Corecτg, id])(gx).

The other way around, suppose we only have rules for ν, Out and Corec and let Φ be a positive type scheme. Define

Θ(α) = ∀β.(Φ(β × α)→β)→β,
σ := να.Θ(α),
Rec := λαλg:Φ(α × σ)→α.λx:σ.Out_{σ}xαg,
In := Corec_{σ}(Φ(σ))(λz:Φ(σ).λβ.λh:Φ(β × Φ(σ))→β.h(Φ(<Recβ(h ∘ Φ(id × inr)), inr>)z)).

We have

Out_{σ}(Corec_{σ}τgx) ⟶ ⟶ Θ([Corec_{σ}τg, id])(gx))

and we want to prove

Recτg(Inx) ⟶ ⟶ g(Φ(<Recτg, id>)x).

We omit again type information in lambda abstractions and abbreviate F ≡ λzβh.h(Φ(<Recβ(h∘ Φ(id × inr)), inr>)z). According to Definition 4.2,

Θ(f) ≡ λtβk.tβ(λz.k(Φ(times(id)f)z)).

Now

Recτg(Inx) ⟶ ⟶ Out_{σ}(Corec_{σ}(Φ(σ))F x)τg
⟶ ⟶ Θ([Corec_{σ}(Φ(σ))F, id])(λβh.h(Φ(<Recβ(h ∘ Φ(id × inr)), inr>)x)τg
⟶ ⟶ (λβh.h(Φ(<Recβ(h ∘ Φ(id × inr)), inr>)x)τ(λz.g(Φ(times(id)F)z))
⟶ ⟶ g(Φ(times(id)F)(Φ(<Recτ(λz.g(Φ(times(id)F)z) ∘ Φ(times(id)(inr)), inr>)x)
⟶ ⟶ g(Φ(<Recτ(g ∘ Φ(times(id)F) ∘ Φ(times(id)(inr), id>)x)
⟶ ⟶ g(Φ(<Recτg, id>)x)

We now want to look at the system of recursive types, as defined by [Mendler 1987], let’s call it F_{(CO)REC}. (The system also has corecursive types.)

Definition 5.3 ([Mendler 1987]) The system F_{(CO)REC} is defined by adding to the polymorphic lambda calculus the following.

1. The set of types T is extended with μα.Φ(α) and να.Φ(α), for Φ(α) a positive type scheme.

2. For μα.Φ(α) and να.Φ(α) we have the extra constants

in_{μ} : Φ(μ)→μ R_{μ} : ∀β.(∀γ.(γ→μ)→(γ→β)→Φ(γ)→β)→μ→β,
out_{ν} : ν→Φ(ν) Ω_{ν} : ∀β.(∀γ.(ν→γ)→(β→γ)→β→Φ(γ))→β→ν.

3. Reduction rules for μ and ν:

R_{μ}τg(in_{μ}x) ⟶_{μ} gμ(id_{μ})(R_{μ}τg)x,
out_{ν}(Ω_{ν}τgx) ⟶_{ν} gν(id_{ν})(Ω_{ν}τg)x.

(μ abbreviates μα.Φ(α) and ν abbreviates να.Φ(α).)

In [Mendler 1987] it is shown that this system satisfies a lot of nice meta-properties, like strong normalization and confluence of the reduction relation.

Definition 5.4 The system F_{(CO)REC} with only the rules for μ will be called F_{REC} and similarly, F_{(CO)REC} with only the rules for ν will be called F_{COREC}.

We show that the system F_{(co)rec} can be defined in both F_{REC} and F_{COREC}, so both systems have all syntactic recursive algebras and all syntactic corecursive coalgebras.

Proposition 5.5 1. The μ-types of F_{(co)rec} can be defined in F_{REC}.

2. The ν-types of F_{(co)rec} can be defined in F_{COREC}.

Proof Let Φ(α) be a positive type scheme.

1. Write μ for μα.Φ(α) and take In = in, Rec_{μ} = λβ.λg:Φ(β×μ)→β.R_{μ}β(λα.λf:α→μ.λk:α→β.g∘Φ(<k, f>)). Then μ, In and Rec_{μ} together define the μ-type of F_{(co)rec} in the sense that Rec_{μ}τg(Inx) = g(Φ(<Rec_{μ}τg, id>)x).

2. Write ν for να.Φ(α) and take Out = out, Corec_{ν} = λβ.λg:β→Φ(β + ν).Ωβ(λα.λf:ν→α.λk:β→α.Φ([k, f]) ∘ g). Then ν, Out and Corec_{ν} together define the ν-type of F_{(co)rec} because Out(Corec_{ν}τgx) = Φ([Corec_{ν}τg, id])(gx).

Corollary 5.6 1. F_{(co)rec} can be defined in both F_{REC} and F_{COREC}.

2. For every positive type scheme Φ(α) both F_{REC} and F_{COREC} have a syntactic recursive Φ-algebra and a syntactic corecursive Φ-coalgebra.

Proof Both immediately by the proposition and Theorem 5.2.

As a corollary of the translation of F_{(co)rec} in to F_{(CO)REC} we find that F_{(co)rec} is strongly normalizing.

Proposition 5.7 The reduction relation of the system F_{(co)rec} is strongly normalizing and confluent.

Proof In order to prove strong normalization we define a mapping [−] from the terms of F_{(co)rec} to the term of F_{(CO)REC} that preserves infinite reduction paths. Then F_{(co)rec} is strongly normalizing by the fact that F_{(CO)REC} is strongly normalizing (see [Mendler 1987].) One easily verifies that the system is weakly confluent (i.e. if M ⟶ N and M ⟶P, then ∃Q[N ⟶ ⟶ Q&P ⟶ ⟶ Q].) The confluence then follows from Newman’s lemma ([Newman 1942]), stating that strong normalization and weak confluence together imply confluence.

The definition of [−] is very similar to the mapping defined in the proof of Proposition 5.5. (As the types do not in any way interfere with the reduction process we omit the types in abstractions.) Define [−] by

[Rec_{μ}] := λβg.R_{μ}β(λαfk.g ∘ Φ(<k, f>)),
[Rec_{μ}τ] := λg.R_{μ}τ(λαfk.g ∘ Φ(<k, f>)),
[Rec_{μ}τg] := R_{μ}τ(λαfk.g ∘ Φ(<k, f>)),
[In] := in,
[Corec_{ν}] := λβg.Ωβ(λαfk.Φ([k, f]) ∘ g),
[Corec_{ν}τ] := λg.Ωτ(λαfk.Φ([k, f]) ∘ g),
[Corec_{ν}τg] := Ωτ(λαfk.Φ([k, f]) ∘ g),
[Out] := out,

and further by induction on the structure of the terms. Then

M ⟶_{β} N ⇒ [M] ⟶ ⟶_{β}^{+} [N],
M ⟶_{η} N ⇒ [M] ⟶ ⟶_{η} [N],
M ⟶_{μ} N ⇒ [M] ⟶_{μ} [N],
M ⟶_{ν} N ⇒ [M] ⟶_{ν} [N],

where ⟶ ⟶_{β}^{+} denotes a reduction in at least one step. As there is no infinite η-reduction in F_{(co)rec}, the mapping [−] maps an infinite reduction path in F_{(co)rec} to an infinite reduction path in F_{(CO)REC}, so we are done.

It doesn’t seem possible to define the μ-types in terms of the ν-types in F_{(CO)REC}, nor to define the system F_{COREC} in the system F_{corec}. When one attempts to do so, some extra equalities seem to be required.

6 Discussion

As pointed out by Christine Paulin ([Paulin 1992]) the technique in the proof of Theorem 5.2 also applies to a polymorphic lambda calculus with a kind of ‘retract types’ that we shall describe now. We give the syntax as it has been communicated to us by Christine Paulin; it is implicit in papers by Parigot ([Parigot 1988] and [Parigot 1992]), where extensions of the system AF2 with recursive types are studied. (AF2 is a system of second oder predicate logic with an interpretation of proofs as untyped lambda terms.) The connections between our system with recursive types and the (extensions) of AF2 is a subject which needs further investigation; we feel that this is not the place to do so.

Definition 6.1 The system F_{ret} is the extension of system F with the following.

1. The set of types T is extended with ρα.Φ(α), for Φ(α) a positive type scheme.

2. For ρα.Φ(α) we have the extra constants

i_{ρ} : Φ(ρ)→ρ, o_{ρ} : ρ→Φ(ρ).

3. Reduction rule for ρ:

o_{ρ}(i_{ρ}x) ⟶_{ρ} x.

(ρ abbreviates ρα.Φ(α).)

In this system one can construct for Φ(α) a positive type scheme a type ρ with Φ(ρ) < ρ (Φ(ρ) is a retract of ρ.) As pointed out to us by [Paulin 1992], the technique of 5.2 can be applied to obtain that both the systems F_{rec} and F_{corec} can be defined in F_{ret}. Also the reverse holds: F_{ret} can be defined in both F_{rec} and F_{corec}. It would be an interesting subject for further investigations to see how the retract types relate to the recursive and corecursive types on the categorical level.

Theorem 6.2 The systems F_{rec} and F_{corec} can be defined in F_{ret} and vice versa.

Proof To define F_{rec} in F_{ret} take

μα.Φ(α) := ρα.∀γ.(Φ(γ × α)→α)→α,
Rec_{μ} := λγ.λf:Φ(γ × μ)→γ.λx:μ.oxγf,
In_{μ} := λx:Φ(μ).i(λγ.λf:Φ(γ × μ)→μ.f(Φ(<Rec_{μ}γf, id>))x)),

and Rec_{μ}τg(In_{μ}x) ⟶ ⟶ g(Φ(<Rec_{μ}τg, id>)x) easily follows. To define F_{corec} in F_{ret} take

να.Φ(α) := ρα.∃γ.(γ→Φ(γ + α))→γ),
Corec_{ν} := λγ.λf:γ→Φ(γ + ν).λx:γ.i(λβλk.kγ<f, x>),
Out_{ν} := λx:ν.ox(Φ(ν))(λγ.λf:γ→Φ(γ + ν) × ν.Φ([Corec_{ν}γ(fstf), id])(fstf(sndf))),

and Out_{ν}(Corec_{ν}τg) ⟶ ⟶ Φ([Corec_{ν}τg, id])(gx) easily follows.

To define F_{ret} in terms of F_{rec} or F_{corec}, take respectively

ρα.Φ(α) := μα.Φ(α),
i := In_{μ},
o := Rec_{μ}Φ(μ)(Φ(snd))

(so o(ix) ⟶ ⟶ x) and

ρα.Φ(α) := να.Φ(α),
o := Out_{ν},
i := Corec_{μ}Φ(ν)(Φ(inr))

(so again, o(ix) ⟶ ⟶ x.)

We can collect the results from Theorems 5.2 and 6.2 and Corollary 5.6 in a picture as follows. (An arrow from A to B means that the system A can be translated in the system B.)

F_{ret}
[figure]
[figure: F_{rec}; −; F_{corec}]
[figure]
F_{REC}  F_{COREC}

If we translate in F_{rec} the type μα.Φ(α) in terms of the ρ-type, which is defined in terms of the μ-type, we obtain the type μα.∀γ.(Φ(γ × α)→γ)→γ. A similar situation occurs if we translate in F_{ret} a ρ-type in terms of a μ-type, which is defined in terms of the ρ-type: ρα.Φ(α) becomes ρα.∀γ.(Φ(γ ×α)→γ)→γ. Using these double translations, we can deduce the following facts about the systems F_{rec}, F_{corec} and F_{ret} themselves.

Fact 6.3 1. For ρ a retract type of Ψ(α) ≡ ∀γ.(Φ(γ ×α)→γ)→γ or of Ψ(α) ≡ ∃γ.(γ→Φ(γ + α)) × γ, ρ is also a retract type of Φ.

2. For μ a recursive type of Ψ(α) ≡ ∀γ.(Φ(γ × α)→γ)→γ, μ is also a recursive type of Φ.

3. For ν a corecursive type of Ψ(α) ≡ ∃γ.(γ→Φ(γ + α)) × γ, ν is also a corecursive type of Φ.

We can also compose the translations to obtain new interpretations of μ-types in ν-types and vice versa:

Fact 6.4 1. For Φ(α) a positive type scheme, we can interpret ν-types in F_{rec} by taking να.Φ(α) and Corec_{ν} as in 5.2 and

Out_{ν} :≡ λx.Rec_{ν}(Θ(ν))(Θ(snd))x(Φ(ν))(λγf.Φ([Corecγ(fstf), id])(fstf(sndf))).

2. For Φ(α) a positive type scheme, we can interpret μ-types in F_{corec} by taking μα.Φ(α) and Rec_{μ} as in 5.2 and

In_{μ} :≡ λx.Corec_{μ}(Θ(μ))(Θ(inr))(λγf.f(Φ(<Recγf, id>)x)).

References

[Böhm and Berarducci 1985] C. Böhm and A. Berarducci, Automatic synthesis of typed Λ-programs on term algebras Theor. Comput. Science, 39, pp 135-154.

[Coquand and Huet 1988] Th. Coquand and G. Huet, The calculus of constructions, Information and Computation, 76, pp 95-120.

[Coquand and Mohring 1990] Inductively defined types, In P. Martin-Löf and G. Mints editors. COLOG-88 : International conference on computer logic, LNCS 417.

[Dowek e.a. 1991] G. Dowek, A. Felty, H. Herbelin, G. Huet, C. Paulin-Mohring, B. Werner, The Coq proof assistant version 5.6, user’s guide. INRIA Rocquencourt - CNRS ENS Lyon.

[Girard et al. 1989] J.Y. Girard, Y. Lafont and P. Taylor, Proofs and types, Camb. Tracts in Theoretical Computer Science 7, Cambridge University Press.

[Hagino 1987a] T. Hagino, A categorical programming language, Ph. D. thesis, University of Edinburgh.

[Hagino 1987b] T. Hagino, A typed lambda calculus with categorical type constructions. In D.H. Pitt, A. Poigné and D.E. Rydeheard, editors. Category Theory and Computer Science, LNCS 283 pp 140-157.

[Hayashi 1985] S. Hayashi, Adjunction of semifunctors: categorical structures in nonextensional lambda calculus. Theor. Comp. Sc. 41, pp 95-104.

[Kleene 1936] S.C. Kleene, λ-definability and recursiveness. Duke Math. J. 2, pp 340-353.

[Lambek 1968] J. Lambek, A fixed point theorem for complete categories. Mathematisches Zeitschrift 103 pp 151-161.

[Leivant 1989] D. Leivant, Contracting proofs to programs. In P. Odifreddi, editor. Logic in Computer Science, Academic Press, pp 279-327.

[Mendler 1987] N.P. Mendler, Inductive types and type constraints in second-order lambda calculus. Proceedings of the Second Symposium of Logic in Computer Science. Ithaca, N.Y., IEEE, pp 30-36.

[Mendler 1991] N.P. Mendler, Predicative type universes and primitive recursion. Proceedings of the Sixth Annual IEEE Symposium on Logic in Computer Science. Amsterdam, The Netherlands, IEEE, pp 173-184

[Newman 1942] M.H.A. Newman, On theories with a combinatorial definition of “equivalence”. Ann. of Math. (2) 43, pp 223-243.

[Paulin 1992] Ch. Paulin-Mohring, private communication.

[Parigot 1988] M. Parigot, Programming with proofs: a second order type theory. ESOP ’88, LNCS 300, pp 145-159.

[Parigot 1992] M. Parigot, Recursive programming with proofs. Theor. Comp. Science 94, pp 335-356.

[Reynolds and Plotkin 1990] J.C. Reynolds and G.D. Plotkin, On functors expressible in the polymorphic lambda calculus. In G. Huet, editor. Logical Foundations of Functional Programming, In ‘The UT Year of Programming Series’, Austin, Texas, pp 127-152.

[Wraith 1989] G.C. Wraith, A note on categorical datatypes In D.H. Pitt, A. Poigné and D.E. Rydeheard, editors. Category Theory and Computer Science, LNCS 389 pp 118-127.

Girard’s Paradox in lambda U

Leen Helmink, Eindhoven

Abstract

The presentation discusses a computer assisted construction of a proof of Girard’s paradox in lambda U. Theoretical as well as practical issues will be addressed.

Computable interpretation of cross-cuts procedure

Hugo Herbelin (INRIA Rocquencourt and ENS Lyon)

Abstract

In the symmetric sequent calculus of Gentzen, several ways of eliminating cuts are possible. One of them, known as the cross-cut procedure, enjoys properties of symmetry. We will give an interpretation of this procedure in computable terms, in the paradigm of proofs as programs and cuts as communications between these programs. We will show from chosen examples that this sometimes gives more natural programs than the actually known interpretations of classical sequent calculus for arithmetic, such as LC or T. Coquand’s interpretation in terms of games.

Typing in Pure Type Systems

Bert Jutting Nijmegen

Abstract

In the theory of Pure Type Systems (PTS’s) it is (to my knowledge) an open question whether Expansion Postponement holds. That is: Let ⊢ denote derivability in a PTS and ⊢′ derivability in the same PTS where the rule:

conv:  \frac{c ⊢ a : A,  c ⊢ B : s,  A = B}{c ⊢ a : B}

has been replaced by the rule

red:  \frac{c ⊢′ a : A, A > B}{c ⊢′ a : B}

Is it true that c ⊢ a : A ⇒ c ⊢′ a : B for some B with A > B?

Expansion Postponement is, among other things, important for proving correctness of typing algorithms.

In the talk I will propose an alternative definition giving rise to a different derivability relation ⊢′′ satisfying:

c ⊢ a : A ⇔ c ⊢′′ a : A and (A = s or c ⊢′′ A : s)

The importance of ⊢′′ is stressed by the following properties:

1. For ⊢′′ Expansion Postponement holds.

2. For ⊢′′ an easy proof of strengthening is possible, which carries over to ⊢ .

3. A straightforward typing algorithm for ⊢ can be derived from ⊢′′ .

Relating Logic Programming and Propositions-as-Types: A Logical Compilation

summary

James Lipton Dept. of Mathematics University of Pennsylvania

Aug. 15, 1992

Abstract

We analyze logic programs (Horn Clause programs and extensions) informally as specifications or types in the sense of the Curry-Howard isomorphism, rather than as programs. Using a realizability interpretation we develop a translation of these clauses to equational specifications. These give rise to various ways of associating non-deterministic terms or computations with this type that satisfy the logic program as a specification. By adapting a 1956 result of Nerode, (generalizing Herbrand-Gödel computability to term models) we are able to solve the equational specification directly over the term-model, and produce a (multivalued) Turing-machine index for the solution. We also define a realizability semantics in a partial applicative structure over the Herbrand Universe, and consider a non-deterministic or disjunctive λ-calculus. All interpretations are independent of any choice of logic programming interpreter. Rather, they transfer control and implementation features of proof search to control and implementation features of the recursion theorem. Completeness of the former is mapped to correctness of the latter.

Our translation provides a framework for integrating logic programming directly into a typed or untyped functional programming environment in a way that preserves the Curry-Howard content of typing. Our interpretations also provide new completeness theorems for various classes of logic programs. The results apply to Horn Logic Programs, and the Miller-Scedrov-Nadathur Uniform logic programming languages.

1 Introduction: Logic Programming as a specification Language

The results in this paper come from exploiting a largely unused uniformity that is present in most logic programming paradigms: the extraction of a witness to a query is uniform in the parameters and predicates in the program. By explicitly rewriting a logic program as a realizability goal, we search not for a specific witness, but a function that returns this witness for every choice of parameters. This reformulation is done first in the framework of an abstract form of the recursion theorem, adapted from [34], and then in terms of realizability over Feferman’s partial applicative structures, where we can formalize logic programming languages, and where we are guaranteed the existence of the required partial recursive function via the appropriate fix-point theorem as in [1].

What we obtain is a compilation of logic programs into an equational specification of functional code via a generalized logic programming paradigm. The logic program is treated as a type, the computation process as one of finding a uniform inhabitant for the type. The entire development is implementation independent: we obtain not a particular evaluation strategy but a specification which gives different functional solutions according to different evaluation sequences. We also define a multivalued realizability which captures the nondeterminism of the declarative program directly. In this outline we develop one of these paradigms in detail, with an example, and give a quick sketch of the remaining ones.

1.1 Towards a Realizability Semantics for Logic Programs

In this section we develop an informal notion of realizability for logic programs. We begin with a logic program P decorated with abstract realizers α, which are taken as atomic evidence that the clauses are true (because the programmer says so). We first consider the first-order case: Horn or First Order Hereditarily Harrop logic programs, whose syntax is defined as follows. Let

q ::= ⊤ a q_{1} ∧ q_{2} q_{1} ∨ q_{2} ∃xq
h ::= a q → a h_{1} ∧ h_{2} ∀xh
g ::= ⊤ a g_{1} ∧ g_{2} g_{1} ∨ g_{2} ∃xg ∀xg f → g
f ::= a g → a f_{1} ∧ f_{2} ∀xf

where a stands for an atomic formula. Then a Horn clause program is a finite set of closed h-formulas, and a query (or goal) for such a program is a q-formula (or a finite set of them). A First Order Harrop program is a finite set of closed f-formulas, and a query (or goal) for such a program is a g-formula (or a finite set thereof).

In the first part of this paper we will be considering an arbitrary Horn or FOHH program

α_{1} : h_{1}(s_{1}) ⟵ T_{1}(t_{1})  (1)
⋮
α_{m} : h_{m}(s_{m}) ⟵ T_{m}(t_{m})

where, s_{i} and t_{i} are -tuples of terms and where each clause is “decorated” with (abstract) realizers α_{1}, ⋯, α_{n}. These realizers supply atomic evidence that the corresponding clauses are being considered true.

Realizability over the Herbrand Universe Our first approach to extracting functional content from the program P defined above in (1) together with a query Q[u⃗, v⃗] where the u⃗ are parameters and the v⃗ are variables, is to inhabit the Horn Clause specification directly with a realizer over the Herbrand Universe. This means finding a term e from a suitable partial combinatory structure E(H) defined over the Herbrand universe of the program satisfying

e : ∀u⃗∃v⃗ [ P ⟶ Q(u⃗, v⃗).]  (2)

As will be shown below, this entails finding a function ê which, on a suitable domain D, satisfies the specification

(∀u⃗) ( P ⟶ Q[u⃗, ê(u⃗)]).

We show how to produce a series of recursion equations specifying ê from (2). Variants of Kleene’s [19] and Nerode’s [34] recursion theorem guarantee the existence of a solution in the set of partial recursive functions. We start with an example that shows how we obtain a specification for a multivalued function which captures the full non-determinism of the original declarative program seen independently of any choice of an interpreter.

1.1.1 An non-deterministic Example

We consider the realizability interpretation and the induced translations for the following Horn clause program, P, equipped with “dummy realizers”:

α : add(0, X, X).  (3)
β : add(s(X), Y, s(Z)) : − add(X, Y, Z).  (4)

Which means (see realizability definitions (2.5), below)

(∀x) αx : add(0, x, x)  (5)
(∀x)(y)(z)(f)f : add(x, y, z) → (βxyz)f : add(s(x), y, s(z))  (6)

We trace through the compilation of this program to a specification of the non-deterministic function f : N → N × N satisfying

f(x)_{0} + f(x)_{1} = x

First, we translate this program to the following realizability goal, assigning what we will call below a ⟨001⟩ template to the predicate add, that is to say, the character of an input to the third variable, and of an output to the first two:

∃e (e : ∀u∃v∃w P → add(v, w, u))

Unravelling this according to the definitions of realizability given below (with the notation \underline{e} and ê for left and right projections of e),

(∀u)[\underline{e}u : P → add(ê_{0}u, ê_{1}u, u)]

i.e.

(∀u)(∀γ)(γ : P → \underline{e}uγ : add(ê_{0}u, ê_{1}u, u))

Taking γ to be ⟨α, β⟩ from (5) and (6) above, we have

\underline{e}u⟨α, β⟩ : add(ê_{0}u, ê_{1}u, u)  (7)

Now, unifying (7) on the third variable (that is to say, unifying on the template ⟨001⟩) with the first clause of the original program (5), we have:

αu : add(0, u, u)  (8)
\underline{e}u⟨α, β⟩ : add(ê_{0}u, ê_{1}u, u)  (9)

which has a solution ê if we choose:

ê_{0}u = 0  and  ê_{1}u = u  (10)

as well as \underline{e}u⟨α, β⟩ = αu. Now, assuming an e exists satisfying (7) we have, by applying the second clause (5) of the original program:

∀u : β[ê_{0}u][ê_{1}u][u][\underline{e}u⟨α, β⟩] : add(s(ê_{0}u), ê_{1}u, s(u))  (11)

and applying (7) to s(u)

∀u \underline{e}s(u)⟨α, β⟩ : add(ê_{0}s(u), ê_{1}s(u), s(u))  (12)

where the choice of argument in (11) and (12) is dictated by unifying (7) and (6) on the last variable. Now (12) has a solution if ê satisfies the recursive equations

ê_{0}(s(u)) = s(ê_{0}u)  and  ê_{1}(s(u)) = ê_{1}u.  (13)

as well as the corresponding condition \underline{e}(su)⟨α, β⟩ = β[ê_{0}u][ê_{1}u][u][\underline{e}u⟨α, β⟩] for \underline{e}. Leaving aside for the moment the requirements for the evidence \underline{e}, we have the following conditions for ê:

\begin{aligned}ê_{0}u & = & 0 \\ ê_{1}u & = & u \\ ê_{0}(s(u)) & = & s(ê_{0}u) \\ ê_{1}(s(u)) & = & ê_{1}u \end{aligned}  (14)

We must be carreful about how we deal with the multivalued character of these equations. Taken at face value they logically imply the collapse of the underlying Herbrand Universe, since, for every u, we have 0 = ê_{0}u = u.

For this reason, we interpret different conditions for ê_{0} and ê_{1} disjunctively. Before delving into our formalized treatment below, we give an informal treatment. Using [ ] for (nondeterministic) disjunction, we can write this specification somewhat in the style of ML as:

fun ê 0 = ⟨0, 0⟩  (15)
ê su = [⟨0, su⟩ ⟨s(ê_{0}u), ê_{1}u⟩]  (16)

There is a natural execution model for this specification corresponding to every complete proof search strategy for the original program, for example a breadth-first traversal of the induced computation tree, until a leaf is found in normal form.

We also obtain a solution to this which captures the non-determinism of the specification itself by lifting the solution ê to a set-valued function ẽ (i.e. to the non-deterministic monad [31]) in the obvious way. Let set be the canonical lifting of functions f : D → D to maps set(f) : ℘(D) → ℘(D) between the power sets, given by:

set(f)(X) = {f(x) : x ∈ X}.

Then ẽ: D → ℘(D) is given by

ẽ 0 = {⟨0, 0⟩}  (17)
ẽ su = set([λx.⟨0, su⟩ λx.⟨s(p_{0}x), p_{1}x⟩])(ẽu)  (18)
= set(λx.⟨0, su⟩)(ẽu) ∪ set(λx.⟨s(p_{0}x), p_{1}x⟩)(ẽu)

where p_{0} and p_{1} are left and right components of the pairs in ẽu.

These approaches suggest several computational and realizability formalisations, each with its own fixpoint- or recursion theorem. We sketch one below adapted from Nerode’s 1956 dissertation, which is in some sense independent of implementation (i.e. developed in terms of indices). Several concrete developments of the lambda calculus along these lines are sketched in the appendix.

1.2 Nerode-Kleene computability over term-algebras

The following development, adapted from Nerode’s dissertation, provides an immediately applicable framework for generating and solving equations along the lines of the example studied above.

Definition 1.1 A recursion calculus (a finite-signature one-sorted equational calculus) is a triple e = (V, F, C) where V is a set of variables, and F and C are finite, nonempty sets of functions and constant symbols, respectively. We will also call (F,C) the e-signature.

The word e-algebra W_{e} is the Herbrand Universe of ground terms for the recursion calculus e. A finite set A of equations in the recursion calculus e′ = (V, F′, C) is said to overlay the word e-algebra W if e = (V, F, C) and F ⊆ F′. We say such a set of equations distinguishes W if for any w_{1}, w_{2} ∈ W,

A ⊢ w_{1} ≡ w_{2}  ⇒  W ⊧ w_{1} ≡ w_{2}

We say A is complete for W if for any function letter f ∈ F′ of arity k and any w_{1}, …, w_{k} ∈ W there is a w_{k+1} ∈ W such that

A ⊢ f(w_{1}, …, w_{k}) = w_{k+1}

We say A is a partial definition over W if A overlays and distinguishes W. A is a definition if in addition it is complete.

Definition 1.2 If A is a (partial) definition over the word algebra W and f is a k-ary function symbol in A, we define the (partial) function

[[f ]]_{A} : W^{k} → W

by [[f ]]_{A}(w_{1}, …, w_{k}) = w_{k+1} ⇔ A ⊢ f(w_{1}, …, w_{k}) = w_{k+1}.

It is easy to see that if A is a partial definition then [[f ]]_{A} is well-defined, and is total if A is complete over W.

Definition 1.3 The (partial) function g : W^{k} → W is definable if there is a (partial) definition A with a function symbol f of arity k such that [[f ]]_{A} = g.

We now extend the notion of recursive function to a term algebra in a completely straightforward manner:

Definition 1.4 Let e = (F, C) be a finite signature, where F and C are ordered sets. Then the similarity type of e is a finite-support sequence of natural numbers τ with τ(n) = m iff there are m function symbols of -arity n. We define a Gödel numbering of the term algebra W_{e} (in fact the Gödel numbering induced by any encoding of sequences in N and by the ordering of F and C) to be a function # : W → N given by the standard ecoding #f(t_{1}, ⋯, t_{n}) = Seq(o(f), #t_{1}, ⋯, #t_{n}). A numbering of W_{e} is a bijection I : N → W_{e} such that such that there are recursive bijections α and β with β ∘ # = I^{−1} and α ∘ I^{−1} = #.

Definition 1.5 Let I be a numbering of the word-algebra W. The (partial) function g : W^{k} → W is recursive over W if there is a recursive (partial) function f : N^{k} → N such that the following diagram commutes:

[figure: N^{k}; f; N; g; I^{k}; I; W^{k}; W]

We then have the following theorem, proven in [34]:

Theorem 1.6 The (partial) function g : W^{k} → W is definable iff it is recursive over W.

The proof also shows that (an index for) the associated partial function f : N → N can be uniformly effectively computed from (codes for) the equations in a way similar to Kleene’s original development of Herbrand-Gödel computability for partial recursive functions.

1.3 A nondeterministic term-model extension

Let e be a recursion calculus, and W_{e} its term model. Then the term model W_{p} of the calculus e_{p} = (F ∪{par}, C∪{fail}) obtained by adding one distinguished binary function symbol par and the constant fail is called the par-extension of W_{e}. We call the set of equations A overlaying W_{e} a par-extension theory if the signature of A includes the function symbol par and the constant symbol fail, and if A includes the following equations.

1. (associativity of par)

par(par(x, y), z) = par(x, par(y, z))

2. (failure)

par(fail, x) = par(x, fail) = par(x, x)

3. (lifting) for each f ∈ F̂ other than par of -arity n > 0

\begin{matrix}f(x_{1}, …, x_{j−1}, par(y, z), x_{j+1}, …, x_{n}) = \\ par(f(x_{1}, …, x_{j−1}, y, x_{j+1}, …, x_{n}), f(x_{1}, …, x_{j−1}, z, x_{j+1}, …, x_{n})) \end{matrix}

Remark: A slight reformulation of the above will give us a syntactic variant of the non-determinism triple or monad construction (e.g. [31]). Let C_{e} be the category of (partial) e-algebras and algebra homomorphisms. Observe that if B is an e-algebra then so is the algebra B_{a} whose carrier |B_{a}| is given by the set of terms

{par(a_{1}, ⋯, a_{m}) : a_{i} ∈|B| ∪{fail} }

where par(a_{1}, ⋯, a_{m}) is shorthand for par(a_{1}, par(a_{2}, ⋯, par(a_{m−1}, a_{m}) )). The algebra operations are induced by lifting (as given in the equations above), with constants a interpreted as par(a, a). Let T : C_{e} → C_{e} be a functor defined by T (B) = B_{a}, with T ’s action on morphisms induced by the corresponding notion of lifting. Then let μ(B) : T^{2}(B) → T (B) be given by

par(par(a_{1}, ⋯, a_{m}), b) ↦ par(a_{1}, ⋯, a_{m}, b)

and η(B) : B → T (B) by a ↦ par(a, a) or par(a, fail). Then (T, η, μ) is a monad.

The aim of this term-model construction is to reformulate equations of the sort produced in the example above (e.g. 14) which failed to distinguish the program signature, i.e. led to a collapse of the underlying Herbrand universe, as equations over a par-extension which constitute a legitimate partial definition over that extension. All that needs to be shown is that all the necessary definitions used in theorem 1.6 lift to the new structure.

Lemma 1.7 Let I be a numbering of an e-term algebra W_{e}. Then there is a numbering I_{p} of its associated par-extension and a pair of recursive injections α and β from N to N such that for all a in W_{e}

I^{−1}(a) = αI_{p}^{−1}(a)  and  I_{p}^{−1}(a) = βI^{−1}(a)

Since the par-extension of W_{e} is just another term-algebra, the main theorem 1.6 states that a function is definable over the par-extension of W_{e} iff it is partial recursive.

1.3.1 Multivalued Turing Machines

In the next section we define a procedure which when applied to a logic program and uniform query P → Q produces a set of equations A which give partial definition over the par-extension of the Herbrand universe of P. By the main theorem of this section, every A -defined function f has an associated Turing-machine index e_{f} in the sense of definition (1.5). We now define the associated multivalued Turing machine R_{f} in the obvious way:

R_{f}(n) = par set(e_{f}(n))

where

par set(n) = {I^{−1}(a) : a ε I_{p}(n)}

and where the relation ε is given by

x ε par(y, z) ⇔ x = y ∨ xεz.

Our development is not particularly different than defining r.e. set valued recursive functions by associating, with any partial recursive f : N → N, the function F : N → ℜ given by F (x) = S_{e} where S_{e} is the domain of the e-th Turing machine. The only significant difference is that the numbering of sets is more natural since it is induced by (Gödel numbering of) terms used to defined sets of values. generic variables

We must also deal with fresh constants or variables introduced by the generic step for SLDRcomputation (see below) or by equations induced by unbalanced programs: those with occurrences of a free variable in the head of a clause that does not also occur in the tail. Thus, we may need to generate equations of the form e.g.

ea = y  (19)

where a is a constant, or a term in which y is not free. In order to solve these over par-extensions we must include special generic-variable terms gen(c_{i}) (i > 0) where the c_{i} are fresh constants. Then equations like (19) are rewritten

ea = gen(c_{i})

where c_{i} is the first such constant not already used. When we lift the partial recursive functions computed via theorem (1.6) to nondeterministic functions, we interpret gen(c_{i}) as the set of all terms over the original Herbrand model. These generic variables appear as uppercase logic variables in the lambda calculi introduced in the appendix.

1.3.2 Term-models with choice operators

A useful variant of the term-model construction just given, is the introduction of ternary function symbols

cho(σ, a, b)

in lieu of par(a, b), with σ an “unspecified” choice index ∈ {0, 1}. cho satisfies the additional equations

cho(0, a, b) = a cho(1, a, b) = b

This indexing device can also be added to the disjunctive lambda calculus (see appendix) to preserve unrestricted β-reduction and the Church-Rosser property. For convenience, we can extend this in the obvious way to terms

cho(σ, a_{1}, ⋯, a_{n})

where σ is in {0, 1, ⋯, n − 1} and e.g. cho(1, a, cho(1, b, c)) = cho(2, a, b, c). We will call an assignment of specific values to all σ in a choice term-model an instantiation of the model, and by abuse of language, we will also call them instantiations of the associated par-terms in the par-extension. With such instantiations, the multivalued functions computed above now become single valued functions over the Herbrand Universe. These are also called instances of the corresponding par- or multi-valued functions.

2 SLDR-computation of Equations

We now describe the SLDR-computation algorithm for generating equations ovber the parextension of the Herbrand Universe (or a generic extension).

Definition 2.1 (F - unification) Let Σ be a signature and F a set of function symbols disjoint from those in Σ. Let s and t be terms over the signature Σ ∪ F . A term s over this signature is called a Σ-term (or just a pure term) if no symbol in F occurs in s, otherwise it is called an F -term. An F -term s is said to be rigid, or in head form if s is e(t_{1}, · · · .t_{n}) for some e ∈ F .

The set C (s, t) of F -unification constraints for ⟨s, t⟩ is a finite set set of equations defined according to the structure of s and t as follows:

Case 1. s and t pure: then C (s, t) is the equational representation of the most general unifier of s and t: namely a finite set of basic equations, i.e.a set of equations of the form {⋯ x_{i} = τ_{i} ⋯} where the x_{i} are variables not occurring in any of the terms τ_{j}, representing the substitution x_{i} ↦ τ_{i}.

Case 2. s or t F -terms: If either s or t is rigid, C (s, t) ≡ {s = t}. Otherwise we consider the usual cases found in first-order unification:

• s = f(s_{1}, ⋯, s_{n}) and t = a or t = g(t_{1}, ⋯, t_{m}) where a, f, g are in Σ and f is distinct from g: then C (s, t) = {s = fail, t = fail}.

• s = f(s_{1}, ⋯, s_{n}) and t = f(t_{1}, ⋯, t_{n}) where f ∈ Σ : then C (s, t) = ⋃ C (s_{i}, t_{i}) (with the proviso that if fail occurs in C (s, t) then this is equivalent to C (s, t) = {fail}).

any basic equations in C (s, t) contributed as a result of case (1) will be called pure unification constraints.

Scheduling We do not go into the details of scheduling here. Since the compilation procedure below always terminates, bad scheduling cannot cause divergence. Let us remark, however that the development is in the style of constraint logic programming, so that failure of unification may not be noticed unless the generated equations are periodically analyzed for consistency with respect to the (decidable) first order theory of equality over the Herbrand Universe. (Identities involving introduced function symbols never introduce inconsistencies). For example, an attempt to unify Q(f(x)) and Q(y) in the presence of the constraint {y = g(a)} may result in success followed by the expansion of the constraint set to {y = g(a), y = f(x)} which must eventually generate failure. In prolog, this happens at unification time, and there is no reason why this could not be done with SLDR-resolution. Then we must modify the definitions above appropriately to include F - C - unification of s and t, i.e. unification in the presence of constraints C. We just apply C to s and t prior to carrying out F -unification.

We now describe the SLDR-computation process. First a few conventions regarding introduction of function symbols and scheduling.

Introduction of function symbols: We make the following assumptions on the predicates, to facilitate their functional interpretation: all unary predicates P (a) are treated as predicates in two variables,of 2 variables P (a, true) so that the associated function e_{P} satisfies e_{P} (a) = true when P (a). 0-ary predicates are just treated as Boolean constants. n-ary predicates Q(t_{1}, ⋯, t_{n}) are assigned an input-output template: a binary string of length n defining some slots as inputs, and the remaining ones as outputs, i.e., as components of the associated function value. Because of the inherently relational nature of the induced multivalued equations, there is no need to consider more than one template per predicate and (with the exception of the top-level query) no reason to pick one over another. The equations generated by the SLDRprocedure below will work for any choice. For efficiency in solving these equations and ease of representation, it may prove useful to introduce more than one function for a given predicate corresponding to different templates, (e.g. to associate subtraction with add(in_{1}, out, in_{2}) and addition with add(in_{1}, in_{2}, out)), but this can be done at the time of solving the equations, and it is not required for the theoretical development or the results below.

In what follows, we will describe the local state of a program α : P with distinguished clause C, current goals τ_{1} : Q_{1}, …, τ_{n} : Q_{n}, equations C as a node on the SLDR tree with the notation

⟨ C , α: P , C ⊢ Q_{1}, …, Q_{n}⟩

and we show how to develop the subsequent nodes of the tree by induction on the structure of the current query Q_{1}.

Definition 2.2 Let P be a first-order program with assigned realizer α̂, and suppose one of the clauses of P is

β : T (t) → Q[r, s]

where [r, s] is any breakdown and rearrangement of the predicate Q(t_{1}, ⋯, t_{n}) (e.g. Q(a, b, c) with x = b and y = (a, c)). Further suppose that the current query is Q[x, y] i.e. the current state is

⟨ C , α: P , β : T (t) → Q(v, s) ⊢ Q[x, y]⟩

and that the predicate letter Q has not already occurred as a goal. Then, we introduce a function symbol e (or e_{Q}), rewrite the current state of the program as

⟨ C , α: P , β : T (t) → Q(v, s) ⊢ \underline{e}α̂ : Q[u, êu]⟩

Then the following is the SLDR-reduction step backchain:

⟨ C , α : P , β : T (t) → Q[v, s] ⊢ \underline{e}α′ : Q[u, êu]⟩
↓
⟨ C ∪ \{μ, ê(u) = s, \underline{e}α′ = β\}, α : P ⊢ γ : T (t)⟩

where μ is the set of pure unification constraints (as defined above in 2.1) generated by F - unification of Q[v, s] and Q[u, êu].

For the sake of thoroughness we have shown how to process the evidence (e.g. \underline{e} above) along with the witnesses. As remarked above, for self-realizing classes of formulas there is no point to carrying along this extra information, so we omit these terms in the remaining proof steps^{1}

We assume that the program is written in such a way that there is never more than one clause with a given predicate occurring in the head. Any logic program can be so rewritten by the use of disjunction in the tail of a clause, and the possible addition of equational goals. For example

(Q(s) ⟵ S) ∧ (Q(t) ⟵ T)

can be rewritten to

Q(x) ⟵ ([x = s, S] ∨ [x = t, T]).

for a fresh (vector) variable x.

1their sole purpose here, other than to give another motivation for considering hereditarilky self-realizing classes of formulas a logic programming languages, is to make possible the treatment of more general classes via the generation of realizability constraints. If the program is not self-realizing, it is only true in the induced realizability model. But this will be taken up elsewhere!

Definition 2.3 Let P be as above and suppose a goal is of the form S(s) ∨ T (t). The following is the SLDR-reduction step co-satisfy

⟨ C , P ⊢ S ∨ T ⟩

↙ ↘

⟨ C , P ⊢ S⟩  ⟨ C , P ⊢ T ⟩

The steps corresponding to all the remaining ones in e.g. FOHH logic programming, e.g. augment and generic in [24] remain unchanged. augment is

⟨ C , P ⊢ A → B⟩
↓
⟨ C , P , A ⊢ B⟩

and generic

⟨ C , P ⊢ ∀xA⟩
↓
⟨ C , P ⊢ A(c)⟩

where c is a fresh constant. The most important step in the SLDR derivation of equations is the recursion step, which occurs every time a goal, e.g. Q(t_{1}, ⋯, t_{n+m}) occurs for a second time on the same path of an SLDR-tree. Then a witnessing function e_{Q} has already been introduced for it, with the condition

∀Q(x_{1}, ⋯, x_{n}, (e_{Q}(x_{1}, ⋯, x_{n}))_{1}, ⋯, (e_{Q}(x_{1}, ⋯, x_{n}))_{m})

so the goal is immediately satisfied, with the corresponding F -unification equations added to C:

recursion

⟨ C , P , ⊢ Q(t_{1}, ⋯, t_{n+m})⟩
↓

⟨ C ∪ (⋃_{i=1}^{n} C (x_{i}, t_{i})) ∪ ( ⋃_{j=1}^{m} C ((e_{Q}(x_{1}, ⋯, x_{n}))_{j}, t_{j})) P , ⊢ ⟩

The search terminates when every goal on the right of the turnstile has a set of recursion equations specifying the corresponding realizer in C. Termination depends only on the predicate letters occurring in (a first-order) program. Call a predicate letter A active if it has not yet recurred in the sense of the recursion step above. Then, a give predicate B can only occur on the right of a turnstile if:

• it has never occurred before, • it recurs on some path for the first time

• it is recurring again on some path because it is a subgoal associated with an active goal A (e.g. ⟵ B, C_{1}, ⋯, C_{n} ⊢ A), for if A were recurrent we would satisfy it using recursion rather than backchain.

Thus the number of recurrences of an inactive letter is bounded by 1+ the total number of predicate letters in the program. We omit the straightforward (but tedious) details in this summary.

In particular, termination is guaranteed irrespective of termination of SLD resolution, even if the original program never halts for any input!, in which case a solution will be a code or term denoting the totally divergent function, e.g. a least-fix-point solution to the equation e = e.

We also leave for a fuller development of this paper a description of the compilation of the multivalued equations for all introduced function variables. Essentially, the equations on different paths through a node of an SLDR-tree are processed separately and then merged via disjunctive expressions

êx = [t_{1} ⋯ t_{n}]

or using the formal terms in a par-extension of the Herbrand Universe. The particular par-terms that arise are clearly determined by the order in which the equations on different branches are processed.

2.1 Semantics and correctness

Formalizing Realizability and computation over a Herbrand Universe

We will let L = L ( P) denote the language of the logic program. Then define H_{P} to be the Herbrand Universe of the program (the set of ground terms over L). We now build a partial applicative theory around H_{P} or its associated par-extension along lines similar to e.g. ( [1], [40] ). We will take Beeson’s formulation of Feferman’s theory APP (which Beeson calls PCA+), with a primitive unary postfix predicate ↓ for “terms that denote”, together with the standard partial combinators s and k, pairing and unpairing, a unary integer sort N and a 4-ary definition by integer cases ^{2} operator d. The key results we will need here about APP are that it satisfies combinatory completeness (admits lambda abstraction), and Kleene’s (single and double) recursion theorems, admits “strong” definition by cases, and satisfies the numerical and term existence property. See ([1],or [40]) for details.

Definition 2.4 Let P be a (Horn or FOHH) logic program decorated with abstract realizers α̂ = ⟨α_{1}, …, α⟩. Then we define the associated applicative theory E(H_{P}) extending APP to include the following:

• constants c, f for every constant c and n-ary function symbol f in L. We call these “symbols imported from L ”, and also denote them (c)^{∗} and (f)^{∗}. We also include the abstract realizers α_{i} directly as constants.

• constants t for every ground term t from L. This means that e.g. for constants a, b, c and function symbols f, g imported from L the terms f(a,g(b,c) and

((((fa)g)b)c) ≡^{def} App(App(App(App(f, a), g), b), c)

2dxyzw ≡ if x = y then z else w

are syntactically distinct objects in E(H_{P}) , (although they are identified via new axioms below).

• A unary predicate H denoting the universe of the interpretation.

• for every term t and function symbol f imported into APP from H_{P} , and for each abstract realizer α_{i}, the axioms

t ↓,  H(t),  f ↓  α_{i} ↓  (1 ≤ i ≤ n)

and for each n-ary function symbol f and terms t_{1}, …, t_{n} imported from L,

(ft_{1}) ↓,  (ft_{1})t_{2}, ↓  ⋯  ft_{1} ⋯ t_{n} = (f(t_{1}, …, t_{n}))^{∗}

• The constant fail together with the axiom fail ↓.

• All schemas in APP are to be extended to the new terms (e.g. t ↓ ∧ ∀x A(x) → A(t) for each term t ).

We extend the ∗-embedding of terms to formulas in the obvious way: p(t_{1}, …, t_{n})^{∗} = p((t_{1})^{∗}, …, (t_{n})^{∗}), (φ ∗ θ)^{∗} = (φ)^{∗} ∗ (θ)^{∗} for ∗^{∈}{→, ∧ , ∨}, etc. We define ^{∈}to be E(H_{P}) together with the embedded program itself (i.e. in the form {(theta)^{∗} : θ^{∈} P }) as a set of nonlogical axioms.

We now develop realizability style semantics over the applicative theories just defined in a manner analogous to e.g. [9, 1, 40], but restricting ourselves to interpreted formulas from the language of the original program. Although we have carried out this interpretation in order to have one theory to discuss both program and evidence, one should perhaps think of this also as a realizability with a distinct object language, namely that of the program, and a realizing metalanguage, namely E(H_{P}) or E(P) .

Definition 2.5 (Syntactic Realizability over E(H_{P}) ) For a term t of E(H_{P}) and a formula θ over the language of the original program L, we define the binary relation t : θ, (t realizes θ) by cases and by induction on the structure of θ as follows:

α_{i} : θ  if θ is the i-th clause of the program
t : θ ∧ φ ≡^{def} p_{0}t : θ ∧ p_{1} : φ
t : θ ∨ φ ≡^{def} N(p_{0}t) ∧ (p_{0}t = 0 → p_{1}t : θ) ∧ (p_{0}t ≠ 0 → p_{1}t : φ)
t : θ → φ ≡^{def} (∀ξ)[ξ : θ → tξ : φ]
t : (∃_{x∈D})θ(x) ≡^{def} D(p_{0}t) ∧ p_{1}t : θ[x/p_{0}t]
t : (∀_{x∈D})θ(x) ≡^{def} ∀u D(u) → tu ↓ ∧ tu : θ([x/u])

We now can state our main representation theorem for first-order logic programs. We use the following notational convention. If t is a term in E(H_{P}) , we write t = ⟨t_{1}, …, t_{n}⟩ to denote iterated pairing with association to the right. Thus p_{0}t = t_{1}, p_{0}(p_{1}t) = t_{2}, etc.

Theorem 2.6 Let P be a first-order program, with generic query θ[u, v]. Then 1. Any instance e of a SLDR-computed term e in E(H_{P}) provably realizes the program in

the sense that for some D definable in E(H_{P}) :

E(H_{P}) ⊢ e : (∀u⃗^{∈}D)(∃v⃗^{∈}D)( P → θ[u⃗; v⃗])

2. In particular, there is a term t = ⟨t_{1}, …, t_{n}⟩ in E(H_{P}) which is (the *-image of) an instance of an SLDR computed term and which maximally satisfies the program as a specification in the sense that for any input u in H for which

P ⊢ ∃v⃗θ[u⃗; v⃗]

we have

E(H_{P}) ⊢ ( P → θ[u⃗; tu⃗])

Such a witnessing term t is faithful to the program in that

• whenever (t_{i}u_{1} ⋯ u_{m}) ↓ the values (t_{i}u_{1} ⋯ u_{m}) are (modulo the *-translation between language and metalanguage) correct answers for the original program H.

• whenever values v_{1}, …, v_{n} exist for a set of inputs u_{1}, …, u_{m}, we have (t_{i}u_{1} ⋯ u_{m}) ↓.

The theorem follows from the fact that all logic programming languages considered here are self-realizing classes of formulas( see e.g. [1, 40]). Thus whenever

( P → θ[u_{1}, …, u_{m}; (t_{1}u_{1} ⋯ t_{1}u_{m}), …, (t_{n}u_{1} ⋯ t_{n}u_{m}).])

is realized provably in E(H_{P}) , it is provable, and conversely. It is shown in e.g. [1] that all the key properties of APP are preserved in extensions by self-realizing theories, including the soundness of most realizability notions (in particular, ours), the existence property, and the recursion theorem.

It is clear that the structure of SLDR-computation is geared towards preserving the computational content of the logic programs without selecting an arbitrary evaluation strategy. To make this precise we need to compare proof search strategies (selection and branching rules) with evaluation strategies of the resulting terms. The notational machinery for this is cumbersome and is omitted here, although the results and ideas are straightforward.

Corollary 2.7 Suppose terms e and t from the theorem above are instances of Nerode-Kleene solutions to a finite set of equational constraints C over the disjunctive term calculus obtained by SLDR-computation. Then these terms preserve the computational content of the logic program in the sense that every fair evaluation instantiation strategy for the resulting terms in a choiceextension of the Herbrand model corresponds to a complete proof search strategy for the logic program.

3 Other realizability interpretations

3.1 Adding a Domain or Type variable: Constraint Logic programming

We provide a brief sketch of the way a modified realizability enables us to capture constraint logic programming and at the same time ensure a total realizability witness, by constraining the domain of the computed realizer. The idea is to formally add an existentially quantified domain variable D when formulating the realizability goal for P:

e : ∃D(∀u^{∈}D)(∃v^{∈}D)( P → Q(u, v)).

This formulation does not require a partial applicative structure, and can be developed in total type theoretic frameworks such as, e.g. Martin-Löf type theory [5, 40, 1, 28]. It can also be developed using Kreisel-Troelstra realizability over HAS or IZF (see e.g. [25]). In this case constraints are added to the list of goals to be solved, and determine the instantiation of the variable D.

3.2 A Kripke model for first-order logic programs

We can capture the notion of partial realizability of logic programs formalized directly over the Herbrand model using Nerode-Kleene computability by considering pairs (e, D) where D is a subset of the Herbrand Universe on which e converges as follows. We define a Kripke model K with the following carrier set:

K = ⋃ K_{x⃗,y⃗} where K_{x⃗,y⃗} = {(e, D, x⃗, y⃗) : ∀u⃗^{∈}D eu⃗ ↓}

where x⃗, y⃗ range over all tuples of variables x_{1}, …, x_{k} and x_{k+1}, …, x_{k+m} (n, m > 0) and with order given by (e, D, x⃗, y⃗) ≤ (e′, D′, x⃗, y⃗) if e extends e′ (i.e. ∀xe′(x) ↓→ ex ↓ ∧ e′(x) = ex) and D is a subset of D. Nodes (e, D, x⃗, y⃗) may only force atomic formulas with free variables matching the tuples x⃗, y⃗. Atomic forcing is given by

(e, D, x⃗, y⃗) ∥−A[x⃗, y⃗]  ⇔  ∀u⃗ ∈ D P ⊢ A[u⃗, eu⃗]

where eu⃗ is a tuple of length equal to y⃗ . We introduce the following notion of cover: The set S ⊆ K is a cover of (e, D, x⃗, y⃗) if for every (e′, D′, x⃗, y⃗) in S, (e′, D′) is above S and D ⊆ ⋃_{D′∈S}. Then we define forcing of disjunctions via covers (see e.g. [40]) and obtain a model in which for all first-order goals A

(e, D, x⃗, y⃗) ∥−A[x⃗, y⃗]  ⇔  ∀u⃗ ∈ D P ⊢ A[u⃗, eu⃗]

Using this semantics we obtain another completeness theorem for ther SLDR translation (provide(1 27 16 1) d P is assumed to be Horn or Hereditarily Harrop): every node (e, D, x⃗, y⃗) in K forcing a query Q[x⃗y⃗] is extended by some instance of an SLDR-computed term e′, and every SLDR-computed term occurs in a node of K .

3.3 Realizability by multivalued functions

As we illustrated by example above, we can also choose constructive set theory (IZF) as our metatheory, with an applicative structure embedded in it, as in e.g. McCarty’s ([25]). We are then able to construct the realizability interpretation of IZF as a basic model, (also known as the realizability universe, or –with some variation–the effective topos, see e.g. [16]). Our realizers live in this model, but will not be the terms of the formalized applicative structure. They are sets and multivalued functions definable in IZF, with the following possible realizability definitions induced by term realizability : over the logic program, which we call strong and weak realizability ( s ∼ and w ∼). Strong realizability by sets of realizers is just

e s ∼ θ ≡^{def} (∀x^{∈}e)(x : θ)

Weak realizability is as follows. Conjunction and implication and existence are as before. The interesting clause is disjunction.

e w ∼ θ ∨ φ ≡^{def} (∀x^{∈}e)[(x : θ) ∨ (x : φ)]

and

e : ∃xθ(x) ≡^{def} (∀ξ^{∈}e)(ξ_{0} : θ(ξ_{1})).

Towards a non-deterministic realizability of logic programs

If we use the more syntactic formulations of multivalued functions described above and in the appendix, then order of the terms, and the possible presence of a fail token suggest more complex definitions, to capture negation as failure

[t_{1} t_{2}] : θ ∨ φ ≡^{def} t_{1} : θ_{⊥} ∧ t_{2} : φ_{⊥} ∧ (t_{1} = fail → t_{2} : φ) ∧ (t_{2} = fail → t_{1} : φ)

where

t : (θ)_{⊥} ≡^{def} t : θ ∨ t = fail

and where for any predicate Q(x_{1}, ⋯, x_{n}), Q[x_{i}/fail] is true. We are able to obtain an analogue of theorem 2.6 for multivalued realizability, discussed in the [21].

4 Conclusion

Using realizability interpretations of logic programs we can translate them into disjunctive terms that (weakly) inhabit these programs as types, or specifications in the Curry-Howard sense. These translations maintain the declarative meaning of the program while leaving control features untouched. These are tranferred to the evaluation-control problems: the way in which the recursion theorem and disjunctive branching conditions are evaluated in the target model. This points to the possibility of studying control features of logic programming in the context of functional programming with nonlocal control operators. It also gives a natural way of associating domain-theoretic interpretations to logic programs. Our translations also transform logic programs into first and higher order constraints over various kinds of applicative structures. This also permits the formalization within logic programming itself of constraint solving in a new way. Many new questions need to be addressed here: which constraints generated by logic programs in the style discussed here have solutions over different typed calculi. Can we identify a (typed) logic programming language corresponding to various subrecursive classes? How can we modify our realizability calculus to capture non-local control more efficiently and clearly? Perhaps most importantly of all, our work suggests that a major task ahead of us is to understand equation and constraint-solving (together with feasibility questions) over applicative structures along the lines initiated by Statman and Tronci ([38, 39]). This work must combine type inference and simultaneous constraint solving. This issue is discussed in more depth in [21].

In particular, higher order programming is likely to require the simultaneous solution of domain equations and constraint sets over continuous or computable functions on the indicated domain.

Appendix

The disjunctive calculus

Following the example computed earlier, we can extend the term structure of the lambda calculus or of a partial combinatory calculus such as APP to include disjunctive terms [t_{1} t_{2}]. We also consider the addition of generic or logic variables X (which can also be thought of as labelled contexts) standing for all possible (non-disjunctive) instances. We consider two developments here: pure disjunctive calculus

t ::= x X (t_{1}t_{2}) λx.t [t_{1} t_{2}]

indexed disjunctive calculus

t ::= x (X)^{σ} (t_{1}t_{2}) λx.t [t_{1} _{σ} t_{2}]

The second calculus allows us to reason about disjunctive lambda terms with a “generic” evaluation index σ which is assumed to select one of the disjuncts, which admits full-blown β reduction. In the pure calculus we must lift disjunctions to the top (using rule 22 and rule 30 prior to beta reducing with rule 23. We now give reduction rules for both calculi. The optional rules are included to better handle the simplification of functions computed from logic programs, but do not seem eessential for the lambda calculi themselves.^{3}

pure disjunctive calculus

[s t] u ⇝ [su tu]  (20)
(λx.s)u ⇝ s[x/u] u non-disjunctive (21)
λx. [s t] ⇝ [λx.s λx.t]  (22)
(λx.s) [u v] ⇝ [(λx.s)u (λx.s)v]  (23)
⟨ [u v] , z⟩ ⇝ [⟨u, z⟩ ⟨v, z⟩]  (24)
⟨z, [u v] ⟩ ⇝ [⟨z, u⟩ ⟨z, v⟩]  (25)

indexed disjunctive calculus

[s _{σ} t] u ⇝ [su _{σ} tu]  (26)
(λx.s)u ⇝ s[x/u]  (27)
⟨ [u _{σ} v] , z⟩ ⇝ [⟨u, z⟩ _{σ} ⟨v, z⟩]  (28)
⟨z, [u _{σ} v] ⟩ ⇝ [⟨z, u⟩ _{σ} ⟨z, v⟩]  (29)

3The author has recently learned of substantial work in disjunctive calculi by Piperno, Liguori, and Dezani, among others, which may provide a better framework for nondeterministic term extraction from logic programs.

optional rules

f [u v] ⇝ [fu fv]  (30)
[u fail] ⇝ u  (31)
[fail u] ⇝ u  (32)
[u u] ⇝ u  (33)

References

[1] Beeson, M. J. [1985a], Foundations of Constructive Mathematics, Springer-Verlag, Berlin.

[2] Beeson, M. J. [1985b], “Proving programs and programming proofs”, in Logic, Methodology, and Philosophy of Science VII, North-Holland, Amsterdam.

[3] Cerrito, Serenella, [1992], “A linear axiomatization of negation as failure”, in the Journal of Logic Programming, 12, 1-24, Elsevier.

[4] Constable, R. L. and Howe, D. J., [1990], “Implementing Metamathematics as an Approach to Automatic Theorem Proving”, in Formal Techniques in Artificial Intelligence, R. Banerji, ed., North-Holland.

[5] Constable, R. L., et al [1986], Implementing Mathematics with the NUPRL Development System, Prentice-Hall, N.J.

[6] Constable, R. L. [1983], “Programs as proofs”, Information Processing Letters, 16(3), 105-112.

[7] Coquand, T. [1990], “On the analogy between propositions and types”, in: Logic Foundations of Functional Programming, Addison-Wesley, Reading, MA.

[8] Coquand, T. and G. Huet [1985a], “Constructions: A higher order proof system for mechanizing mathematics”, EUROCAL 85, Linz, Austria.

[9] Feferman, S. [1975], “A language and axioms for explicit mathematics”, in: Algebra and Logic, Lecture Notes in Mathematics No. 450, pp. 87-139, Springer, Berlin.

[10] Amy Felty and Dale Miller. Specifying theorem provers in a higher-order logic programming language. In Ninth International Conference on Automated Deduction, pages 61 – 80, Springer-Verlag, Argonne, IL, May 1988.

[11] Fitting, M. [1983], Proof Methods for Modal and Intuitionistic Logics, D. Reidel, Dordrecht, The Netherlands.

[12] Griffin, T [1990], “The Formulas-as-Types notion of control”, in the proceedings of the 17th POPL conference.

[13] Harper, R., MacQueen, D., Milner, R., [1986], Standard ML, Technical Report, LFCS-86-2, Laboratory for the Foundations of Computer Science, University of Edinburgh.

[14] Hayashi, S.and H. Nakano [1989], PX: A Computational Logic, The MIT Press, Cambridge.

[15] Howard, W. A. [1980], “The Formulae-as-types notion of construction”, in: Seldin, J.P. and J. R. Hindley (eds.), To H. B. Curry: Essays in Combinatory Logic, Lambda Calculus and Formalism, Academic Press, New York, 479-490.

[16] Hyland, J. M. E. [1982], “The effective topos”. in: Troelstra, A. S. and D. S. van Dalen (eds.), L.E.J. Brouwer Centenary Symposium, North-Holland, Amsterdam.

[17] Huet, G., [1990], ed. Logic Foundations of Functional Programming Languages, proceedings of a symposium from the Year of Programming at the University of Texas at Austin, 1986, Addison-Wesley, Reading, MA.

[18] J. Jaffar and J.-L. Lassez. Constraint logic programming. In Proceedings of the 14th ACM Symposium on the Principles of Programming Languages, 1987.

[19] Kleene, S. C. [1952] Introduction to Metamathematics, North Holland.

[20] Lipton, J., [1991], “Constructive Kripke Semantics and Realizability”, in the proceedings of the Logic for Computer Science conference held at the Math. Sci. Research Institute, Berkeley, Nov. 1989.

[21] Lipton, J. [1992], “Relating Logic Programming and Propositions-as-Types”, full version of this summary, to appear as a technical report, University of Pennsylvania.

[22] Lloyd, J. W., [1987], Foundations of Logic Programming, second ed., Springer-Verlag.

[23] Dale Miller and Gopalan Nadathur. λProlog Version 2.7. July 1988. Distribution in C-Prolog and Quintus sources.

[24] Dale Miller, Gopalan Nadathur, Frank Pfenning, and Andre Scedrov. Uniform proofs as a foundation for logic programming. 1988. To appear in the Annals of Pure and Applied Logic.

[25] McCarty, D. C. [1986], “Realizability and recursive set theory”, Annals of Pure and Applied Logic 32, 11-194.

[26] van Dalen, D. [1986], “Intuitionistic logic”, in The Handbook of Philosophical Logic, Vol. III, 225-339, D. Reidel, Dordrecht.

[27] Martin-Löf, P. [1982], “Constructive Mathematics and Computer Programming”, in Logic, Methodology and Philosophy of Science IV, North Holland, Amsterdam.

[28] Martin-Löf, P. [1984], Intuitionistic Type Theory, Studies in Proof Theory Lecture Notes, BIB-LIOPOLIS, Napoli, Italy.

[29] Mitchell, J. and E. Moggi [1987], “Kripke-style models for typed lambda calculus”, Proceedings from Symposium on Logic in Computer Science, Cornell University, June 1987, IEEE, Washington, D.C.

[30] Moggi, E. [1989] “Computational Lambda Calculus and Monads” in Proc. 4th IEEE Symposium on Logic in Computer Science, Asilomar.

[31] Moggi, E. [1990] “Notions of computation and monads”. technical report, University of Edinburgh.

[32] Murthy, C., [1990], “Extracting Constructive Content from Classical Proofs: Compilation and the Foundations of Mathematics”, Ph. D. dissertation, Cornell University.

[33] Murthy, C., [1990], “An Evaluation Semantics for Classical Proofs” 1991 LICS Proceedings.

[34] Nerode, A, [1956], Composita, Equations, and Recursive Definitions, Ph. D. Dissertation, University of Chicago.

[35] Nerode, A. and Shore, R. [1992], Logic and Logic Programming, to appear.

[36] Odifreddi, G. [1989], Classical Recursion Theory, North-Holland, Amsterdam.

[37] Robinson, J. A. [1965], “A machine-oriented logic based on the resolution principle”, Journal of the ACM, V.12, 23-41.

[38] Statman, R., [1982], “Completeness, Invariance and lambda-definability”, JSL.

[39] Tronci, E, [1991], “Equational Programming in Lambda Calculus”, 6th LICS proceedings.

[40] Troelstra, A. S. and D. van Dalen [1988], Constructivism in Mathematics: An Introduction, Vol. II, Studies in Logic and the Foundations of Mathematics, Vol. 123, North-Holland, Amsterdam.

[41] Troelstra, A. S. [1973], Metamathematical Investigation of Intuitionistic Arithmetic and Analysis, Mathematical Lecture Notes 344, Springer-Verlag, Berlin.

Programming with Streams in Coq A case study : the Sieve of Eratosthenes

François Leclerc^{∗} CRIN URA CNRS 262 BP 239 54506 Vandoeuvre-les-Nancy cedex, France Christine Paulin-Mohring^{†} LIP-IMAG URA CNRS 1398 ENS Lyon, 46 Allée d’Italie 69364 Lyon cedex 07, France

August 92

Abstract

A parallel dataflow program can be seen as a network of functional transformers over infinite lists (also called streams). G. Kahn and D. MacQueen [6, 7] proposed this paradigm in order to apply standard technics of semantics for proving the correctness of concurrent programs. On the other hand, type theory and the paradigm of proofs as programs has proved to be useful for the justification of functional programs. We investigate the programmation with infinite lists in strongly typed lambda-calculus by studying the example of the sieve of Eratosthenes. We develop this example both in system F and in the Calculus of Constructions where certified programs are extracted from constructive proofs. This study suggests suitable representations for the type of Streams in the system Coq [2].

1 Introduction

1.1 Programming with proofs

Usual programs involve inductive structures as natural numbers, lists or trees. We know quit well how to systematically represent these structures in strongly typed lambda-calculus as Girard’s system F. We also know which induction principles are needed to reason about these programs in a system like Coq for instance.

An alternative possibility in Coq is to use realisability to extract correct programs from intuitionistic proofs of existential statements. From a proof of ∀x.P (x) ⇒ ∃y.Q(x, y) the system Coq will extract a functional program f (written in a ML like language). We know from the metatheory that ∀x.P (x) ⇒ Q(x, f(x)) holds and consequently the program f is certified. Proving interactively ∀x.P (x) ⇒ ∃y.Q(x, y) is like developing simultaneously the program and its proof of correctness.

∗Francois.Leclerc@loria.fr

†cpaulin@lip.ens-lyon.fr

This research was partly supported by ESPRIT Basic Research Action “Logical Frameworks” and by MRT Programme de Recherche Coordonnées “Programmation avancée et Outils pour l’Intelligence Artificielle”. It started during F. Leclerc’s DEA practical period at LIP in spring 91.

1.2 Programming with coinductive types

The representation of coinductive types in strongly typed lambda-calculus has been less investigated. However an infinite list can be represented as a process for generating infinitely many elements. Such infinite lists, also called streams can be used to model concurrency in a functional way making the proofs of correctness easier to achieve.

A program which acts as a stream transformer can be written in a ML-like language with a lazy evaluation of constructors. In a language with full polymorphism like system F or the Calculus of Constructions, it is possible to internally represent the type of streams. We experiment these systems by applying the paradigm of proofs as programs to the construction of streams. This paper presents a complete development of various versions of the sieve of Eratosthenes in Coq.

1.3 Notations

Our aim is to give the main ideas for the constructions of the programs. We will not be too formal but the examples were developed completely formally in the Coq system.

We shall use terms either from the system F or from the Calculus of Constructions, with the following notations. Quantification is written as ∀x : M.N, implication is written M → N which associates to the right. The lambda-abstraction is written as λx : M.N or ΛX : K.M for an abstraction over types variables, the application of term M to term N is written (M N), it associates to the left, we shall sometimes omit the external parentheses. The type annotation after the “:” in quantification or abstraction will be omitted when it is clear from the context. We shall write M ≃ N when the terms M and N are convertible.

The same names will be used for different constructions but in that case also the ambiguity can be solved from the context.

2 Representing Streams

In typed functional programming languages as ML, infinite lists are represented using a possible lazy evaluation of the arguments of the constructors. A value of type infinite list will be a pair with a value (the head of the list) as the first component and an arbitrary program of type infinite list (representing the tail of the list) as the second component. We can write a program which evaluates the first n elements of an infinite sequence. This program can possibly fail or loop.

It may seem impossible to represent streams in a strongly typed programming language where all programs are strongly terminating. However a possible concrete representation of lists in a language like system F will be as a process generating infinitely many objects.

We investigate possible representations of the type of streams in both system F and the Calculus of Constructions. The type of streams is a particular case of a coinductive type, namely a greatest fixpoint of a monotonic operator. We first recall the general scheme to represent coinductive types in system F.

2.1 Coinductive types in System F

The representation of inductive data types like integers or lists in system F can be seen as an encoding of smallest fixpoints of monotonic operators. A general presentation of this can be found in [1] or [4]. The case of coinductive types is less known but was studied by G. Wraith [11].

The representation of fixpoints of monotonic operators can be seen as an application of Tarski general fixpoint theorem. A coinductive type is the greatest fixpoint of a monotonic operator A(X) which is computed as the least upper bound of the X such that X < A(X). The order is just inclusion which is encoded via implication. The least upper bound is the union which is encoded via an existential type. This existential type is not a primitive notion in system F but can itself be encoded using a second-order quantification over types.

2.1.1 Basic definitions

In system F, the types in which a variable X occurs positively are generated by the entry Pos of the following syntax :

Pos ::= M | X | ∀Y.Pos | Neg → Pos
Neg ::= M | ∀Y.Neg | Pos → Neg

with the restriction that X does not occur in M.

Let A(X) be a correct type in which X occurs positively, let Y be a type variable and f a variable of type X → Y then it is possible to build a term A[f] of type A(Y) by induction over A(X).

Let A(X) be a correct type of system F in which X occurs positively. We can define both μ and ν the smallest and the greatest fixpoint of this operator. We outline in the following table the main constructions associated to both types.

Inductive types Coinductive types

\begin{aligned}μ & ≡ & ⋂_{X} A(X) ⊂ X \\ & ≡ & ∀X.(A(X) → X) → X \end{aligned}  \begin{aligned}ν & ≡ & ⋃_{X} X ⊂ A(X) \\ & ≡ & ∃X.(X → A(X)) ∧ X \\ & ≡ & ∀C.(∀X.(X → A(X)) → X → C) → C \end{aligned}
iter : ∀X.(A(X) → X) → μ → X
≡ ΛX.λf.λm.(m X f)
in : A(μ) → μ
≡ λa.ΛX.λf.(f (A[iter X f] a))

build : ∀X.(X → A(X)) → X → ν
≡ ΛX.λf.λx.ΛC.λH.(H X f x)
out : ν → A(ν)
≡ λm.(m A(ν) ΛX.λf.λx.(A[build X f] (f x)))
iter X F (in m) → F (A[iter X F] m)  out (build X F x) → A[build X F] (F x)

2.1.2 Natural numbers and Streams

The typical example of an inductive definition is the type of natural numbers. It is the smallest fixpoint of the operator 1 + X which can be encoded in system F as ∀C.C → (X → C) → C. The typical example of a coinductive definition is the type of streams of elements of a type A. It is the greatest fixpoint of the operator A ∗ X which can be encoded as ∀C.(A → X → C) → C. In both cases, we can find more direct encoding than the one presented above. We outline the main constructions in the following table.

Natural numbers

Streams

\begin{aligned}Nat & ↔ & 1 + Nat \\ & ≡ & ∀X.X → (X → X) → X \end{aligned}  \begin{aligned}Str & ↔ & A ∗ Str \\ & ≡ & ∃X.(X → A) ∧ (X → X) ∧ X \\ & ≡ & ∀C.(∀X.(X → A) → (X → X) → X → C) → C \end{aligned}
iter : ∀X.X → (X → X) → Nat → X
≡ ΛX.λx.λf.λn.(n X x f)
0 : Nat
≡ ΛX.λx.λf.x
S : Nat → Nat
≡ λn.ΛX.λx.λf.(f (n X x f))

build : ∀X.(X → A) → (X → X) → X → Str
≡ ΛX.λh.λt.λx.ΛC.λH.(H X h t x)
hd : Str → A
≡ λs.(s A ΛX.λh.λt.λx.(h x))
tl : Str → Str
≡ λs.(s Str ΛX.λh.λt.λx.(build X h t (t x)))
g : T h : T → T g : T → A h : T → T
f : Nat → T ≡ (iter T g h)  f : T → Str ≡ (build T g h)
\begin{aligned}f 0 & ≃ & g \\ f (S n) & ≃ & (h (f n)) \end{aligned}  \begin{aligned}hd (f x) & ≃ & (g x) \\ tl (f x) & ≃ & f (h x) \end{aligned}

2.1.3 Examples

The nth element of a stream. To compute the nth element of a stream is done by induction on n. We define a function nth which has type Nat → Str → A. We want it to satisfy the following equations :

nth 0 s ≃ hd s nth (S n) s ≃ nth n (tl s)

This is achieved by the following definition :

nth ≡ (iter Str → A hd λH : Str → A.λs : Str.(H (tl s)))

This is an example of an iterative definition over an higher-order type (Str → A).

Stream of natural numbers starting from n. We can represent the stream of natural numbers (n n + 1 n + 2 …). We define a function Enu which has type Nat → Str. We want it to satisfy the following equations :

hd (Enu n) ≃ n tl (Enu n) ≃ (Enu (S n))

This is achieved with the definition : Enu ≡ (build Nat λx.x S).

Following the same pattern we can represent the constant stream which only contains the value n as :

Con ≡ (build One λx.n λx.x o)

with One a type (for instance ∀X.X → X) with at least one element o.

2.1.4 Properties of streams

A “canonical element” of type streams will be a quadruple (X, H, T, x) with X a type, H a function of type X → A, T a function of type X → X and x a term of type X. Such a stream is obtained by (build X H T x). Its head will be (H x) and its tail a quadruple (X, H, T, (T x)). The nth element of this stream is (H (T^{n} x)) where (T^{0} x) = x and (T^{n+1} x) = (T^{n} (T x)).

The stream (X, H, T, x) can be seen as an abstract representation of a process build on a type X, a current state x and functions H and T that computes the output of the stream and the modification of the state.

We can say that this representation is abstract because when we have an element of type stream, we cannot access its particular implementation.

Of course an infinite list can be implemented as many different objects of type streams. For instance, if s is a stream then (build Str hd tl s) and (build Nat λn : Nat.(nth n s) S) are also streams which produce the same elements.

A natural question to ask is whether a close object of type Str is convertible to a term of the form (build X H T x). This is not true because of the impredicative representation of the existential type. For instance the constant stream can be represented as :

\begin{matrix}ΛC.λH : ∀X.(X → Nat) → (X → X) → X → C. \\ (H C → C λx : C → C.n λx : C → C.x λx : C.x) \end{matrix}

This sort of problem was also mentioned for inductive types in [10] although the representation of inductive types is adequate for some “simple” types as natural numbers. This problem will disappear in the system Coq if we use the general primitive notion of so-called inductive definitions (but which can be used also for non-inductive concrete definitions as existential, pairs or disjunctions). With this encoding of the existential type, a close normal term of type ∃X.A(X) will be a pair (X, H) with a close type X and a close term H of type A(X).

Iterative versus primitive recursive definitions. The impredicative encoding of natural numbers gives naturally the definition of functions using an iterative scheme (f (S n)) = (h (f n)). The more general scheme of primitive recursive definition (f (S n)) = (h n (f n)) is obtained using iteration and pairing. It is well known that this encoding is not satisfactory because (f (S n)) reduces to (h n (f n)) only if n is a close natural numbers and also the number of reduction steps will be proportional to n. There is of course an analogous problem for streams. The basic iterative scheme of definition is (tl (f x)) = (f (h x)). With this only scheme, it is not direct to program a function for the concatenation of an element a at the head of a stream s. The equations for such a definition will be :

(hd (conc a s)) = a (tl (conc a s)) = s

More generally we would like to program a stream as some process (X, h, t, x) which at some step becomes a new given stream. We write X + Str ≡ ∀C.(X → C) → (Str → C) → C the type representing the disjunct union of X and Str. We call inl (resp. inr) the left (resp. right) injection of type X → X + Str (resp. Str → X + Str). The analogous of primitive recursion will be an operation build pr of type :

∀X.(X → A) → (X → (X + Str)) → X → Str.

We would like the following equalities to hold :

hd (build pr X h t x) = (h x)
tl (build pr X h t x) = build pr X h t y if (t x) = (inl y)
tl (build pr X h t x) = s  if (t x) = (inr s)

If f is of type X → Y and g of type Str → Y, we write [f, g] the function of type (X + Str) → Y such that [f, g] (inl x) ≃ (f x) and [f, g] (inr y) ≃ (g y). We can mimic the behavior of build pr by taking :

build pr ≡ ΛX.λh : X → A.λt : X → (X + Str).λx : X. (build X + Str [h, hd] [t, λs : Str.(inr (tl s))] (inl x))

The equalities hd (build pr X h t x) = (h x) and tl (build pr X h t x) = (build pr X h t y) if (t x) = (inl y) will be satisfied as convertibility rules. But if (t x) = (inr s), the streams tl (build pr X h t x) and s will not be convertible but will only have the same behavior.

Using build pr, the stream (conc a s) can be defined as :

(build pr One λx.a λx.(inr s) o)

The definition of the analogous of primitive recursion for coinductive types in typed lambdacalculus is presented in [8, 3]. We will not need it in our development of the sieve of Eratosthenes.

Termination properties. In system F, every program terminates. If s is a stream, it implies that for each n, nth n s has a value. So an element of type Str define a total function from Nat to A.

2.2 Streams in the system Coq

The system Coq extends the Calculus of Constructions with a primitive mechanism for inductive definitions. It contains system F and the above representation of Streams can consequently be used. We do not use the extension with primitive inductive definitions for the encoding of streams but we shall use it for the type of natural numbers in order to make available the corresponding induction principle.

The Calculus of Constructions contains dependent types like equality or the existential type. This allows to reason about these streams. For instance we may state and prove properties like :

∀n.(nth n (Enu 0)) = n

this will be done by proving more generally by induction over n :

∀n, m : Nat.(nth n (Enu m)) = n + m

But this is an external point of view where we first write a program (in that case a stream) and then prove its properties. We are looking for a method where we build at the same time the stream and its proof of correctness. One first possibility is to use for the type A of the elements of the stream a type which contains some logical information. For instance the constant stream with only n which was specified as a stream with elements of type Nat can in the Calculus of Constructions be specified as a stream with elements in the type ∃p : Nat.p = n of natural numbers which are equal to n. But this is clear that this kind of constant specification will not be very useful and it seems necessary to be able to parameterize the specification depending on the position of the element in the stream. We shall investigate a new definition of the type of streams with a type of output depending on the range of the element in the stream.

2.2.1 Indexed Streams

We can define a type for streams using dependent types that will allow an internal parameterization of streams with the index. A stream in system F gives for each n an element in a type A. Using dependent types, we can more generally in the Calculus of Constructions define a new type of streams that will give for each n a proof of a property (A n). The main constructions related to such a stream are listed in the following table.

Str ≡ λn : Nat.∃P : Nat → Set.(∀m.(P m) → (A m)) ∧ (∀m.(P m) → (P (S m))) ∧ (P n)
: Nat → Set
≡ λn : Nat.∀C : Set.

(∀P : Nat → Set.(∀m.(P m) → (A m)) → (∀m.(P m) → (P (S m))) → (P n) → C)

→ C
build : ∀n : Nat.∀P : Nat → Set.
(∀m.(P m) → (A m)) → (∀m.(P m) → (P (S m))) → (P n) → (Str n)
≡ λn.ΛP.λh.λt.λx.ΛC.λH.(H P h t x)
hd : ∀m.(Str m) → (A m)
≡ λm.λs.(s (A m) ΛP.λh.λt.λx.(h m x))
tl : ∀m.(Str m) → (Str (S m))
≡ λm.λs.(s (Str (S m)) ΛP.λh.λt.λx.(build (S m) P h t (t m x)))

The functions defined above satisfy the following convertibility rules with m, P, h, t and x of the appropriate types :

hd m (build m P h t x) ≃ h m x
tl m (build m P h t x) ≃ build (S m) P h t (t m x)

We can now prove the following property by induction over n.

∀n.∀m : Nat.(Str m) → (A (n + m))

We call this proof nth. We can check that its computational behavior is similar to the one of the nth function in system F.

2.2.2 Examples

The example of the stream which contains successive numbers can be seen as an indexed stream. The specification of the output will be that for each n it gives a number p equal to n. This is represented in Coq as λn : Nat.∃p : Nat.p = n. Let us call A this specification. Because there exists obvious proofs h of ∀m.(A m) → (A m), t of ∀m.(A m) → (A (S m)), and for each n an object x of type ∃p : Nat.p = n, we can define a stream on the specification A indexed by n as :

(build n A h t x)

2.2.3 Computational interpretation

There exists a computational interpretation of the proofs of the Calculus of Constructions as programs of F_{ω} which is described in [9, 10]. If we perform this interpretation on indexed streams, we do not endup with the system F representation of streams but with a slightly heaviest representation :

∃X.(Nat → X → A) ∧ (Nat → X → X) ∧ X

More or less this representation of streams contains an extra state of type Nat with the index stored in it.

We may avoid this problem if we introduce an extra notation for variables that will not be used for computations. These notations are λλx.t and ∀∀x.P. The precise rules and interpretation for this extension are in the spirit of what Hayashi did in the system AT T [5]. They have still to be written and are not the purpose of this paper but intuitively the ideas are the following :

The extraction of λλx.t is just the extraction of t, if t is of type ∀∀x.P then the extraction of (t u) is the extraction of t. A program p will be correct with respect to the specification ∀∀x.P if for all x, the program p is correct for P (usually we say that p is correct with respect to ∀x.P if for all x, the result of the program p applied to x is correct for P.) We can statically check that a variable x is not used in a computational part which makes sure that the extraction process is correct.

With the following definitions for the type of indexed streams, we shall have as extracted terms exactly the system F analogous constructions.

Str ≡ λn : Nat.∃P : Nat → Set.(∀∀m.(P m) → (A m)) ∧ (∀∀m.(P m) → (P (S m))) ∧ (P n)
: Nat → Set
≡ λn : Nat.∀C : Set.

(∀P : Nat → Set.(∀∀m.(P m) → (A m)) → (∀∀m.(P m) → (P (S m))) → (P n) → C)

→ C
build : ∀∀n : Nat.∀P : Nat → Set.
(∀∀m.(P m) → (A m)) → (∀∀m.(P m) → (P (S m))) → (P n) → (Str n)
≡ λλn.ΛP.λh.λt.λx.ΛC.λH.(H P h t x)
hd : ∀∀m.(Str m) → (A m)
≡ λλm.λs.(s (A m) ΛP.λh.λt.λx.(h m x))
tl : ∀∀m.(Str m) → (Str (S m))
≡ λλm.λs.(s (Str (S m)) ΛP.λh.λt.λx.(build (S m) P h t (t m x)))

2.3 General parameterized Streams

In general the stream can be parameterized by an arbitrary sequence of objects in a given type U. The specification of the output will be a relation on U namely A of type U → U → Set. A stream parameterized by p of type U will give as an output a new parameter q, a proof of (A p q) and its tail part will be a stream parameterized with q.

We do not give all the precise definitions for such a type of streams. It will be done in a particular case for the development of the partial version of the sieve of Eratosthenes.

3 The sieve of Eratosthenes in system F

We are now interested in the development of the sieve of Eratosthenes in system F.

3.1 Description of the algorithm

The algorithm is simple, we describe it equationally.

An auxiliary operation is the sieve function itself which takes a number p and a stream s and gives back the stream of the elements of s which cannot be divided by p. The operation sieve has type Nat → Str → Str. It can be described by the following equation :

(sieve p s) = if div p (hd s) then sieve p (tl s) else conc (hd s) (sieve p (tl s))

The sieve is used in an operation of type Str → Str that we call primes. This operation takes a stream s, keep its head p and applies to the tail of this stream the sieve operation using p. The primes function is characterized by the following equations.

hd (primes s) = (hd s) tl (primes s) = primes (sieve (hd s) (tl s)))

The primes numbers are obtained by applying the primes operation to the stream (Enu 2).

If the scheme for the definition of the stream of prime numbers follows the general pattern of an iterative definition, it is not the case for the sieve function. The head of the stream (sieve s) will be the first element of s which can be divided by p. Nothing in the algorithm makes sure that this search terminates. Starting from a different stream than (Enu 2) we could loop forever. To say that the result of the sieve has type Str implies in particular that there are infinitely many primes numbers. It is not surprising that we cannot just translate this algorithm in system F.

3.2 A total version of the sieve

There are two solutions to avoid this problem. The first one is to introduce an explicit bound (from mathematical results we know how to compute one) for the search of the next number which cannot be divided by p. The second one is not to manipulate streams of natural numbers but streams of a type Nat+ which contains an extra dummy element dum. The output will be a stream with primes numbers separated by the dummy element. Nothing in the type of the output avoids that, from one point, every output will be dummy.

We call this last algorithm, the total version of the sieve of Eratosthenes. We can program in system F a function div+ of type Nat+ → Nat+ → bool, such that (div+ p q) = true when p or q is the dummy element or when p divides q (division on natural numbers is primitive recursive and can be programmed in system F). The operation sieve has type Nat+ → (Str Nat+) → (Str Nat+). It can be described by the following equations :

hd (sieve p S) = if (div+ p (hd S)) then dum else (hd S)
tl (sieve p S) = sieve p (tl S)

This follows an iterative scheme. It is actually just the operation of applying a function f (in that case λq.if (div + p q) then dum else q) to each element of a stream. It can easily be translated into exact code in system F.

map Str

: (A → B) → (Str A) → (Str B)
≡ λf : A → B.(build (Str A) λs : (Str A).(f (hd s)) tl)

The primes operation has type (Str Nat+) → (Str Nat+). The equations are not changed :

hd (primes s) = (hd s) tl (primes s) = primes (sieve (hd s) (tl s)))

The primes numbers are obtained by applying the primes operation to the stream of successive elements in Nat+ starting from 2 namely with inj the injection function from Nat to Nat+.

Si ≡ (build Nat inj S 2)

We may remark that we will also get the stream of primes numbers starting from three by applying the primes operation to the stream of odd numbers starting from three. This stream can be constructed as :

(build Nat inj λn : Nat.(S (S n)) 3)

4 The sieve of Eratosthenes in Coq

We now want to have a proved version of the sieve of Eratosthenes, namely that it gives us all prime numbers.

Instead to do a proof of the previous program we shall build a new one that will give us as an output a natural number and a proof of its primality. Of course the problem will also be to specify that it gives us also all prime numbers.

We first study the proof counterpart of the total sieve which answers for each number if it is prime or not. We shall also gives the constructions corresponding to a stream which only contains the prime numbers.

4.1 Specification

If we analyze the algorithm, we can see that its specification does not concern really primality but can be parameterized by the initial stream the primes operation is applied to.

Let this stream be called Si. We shall denote Si (n) the n-th element of this stream. The output of the sieve program will be the elements of Si which cannot be divided by any of the previous elements in the stream. Of course if Si is the stream of natural numbers starting from two or the stream of odd numbers starting from three, the fact that they cannot be divided by a previous element is equivalent to the fact that they are prime.

This analysis led us to the definition of the relation divinf on natural numbers with the following meaning :

divinf k n ≡ ∃p.(p < k ∧ div Si (p) n)

A few logical lemmas about divinf will be used.

4.2 A total sieve development

We first develop a proved version of the sieve of Eratosthenes which corresponds from the computational viewpoint to the total sieve we studied in system F.

We introduce the predicate divspec of type Nat → Nat → Set. The definition of the specification (divspec k n) is (∃p : Nat.p = Si (n) ∧ ¬(divinf k p)) + (divinf k Si (n)). The computational contents of this specification corresponds to the type Nat+.

The output of the final sieve program will be an indexed stream based on the predicate λn : Nat.(divspec n n). It will indicate for the nth element of the stream whether there exists k < n such that Si (k) divides Si (n).

The function sieve. The sieve transformation itself corresponds to a proof of :

∀p : Nat.∀∀k : Nat.(p = Si (k)) → ∀∀n.(Str (divspec k) n) → (Str (divspec (S k)) n)

Let assume that we have p, k and a proof of p = Si (k). To prove ∀∀n.(Str (divspec k) n) → (Str (divspec (S k)) n) we use build with the predicate (Str (divspec k)) we have to prove the two following lemmas :

∀∀n.(Str (divspec k) n) → (divspec (S k) n)

and ∀∀n.(Str (divspec k) n) → (Str (divspec k) (S n))

This last lemma is just proved by the tl term. For the first one, assuming we have n and an element s in (Str (divspec k) n) we look at the head of the stream. It gives us a proof of (divspec k n) ≡ (∃q : Nat.q = Si (n) ∧ ¬(divinf k q)) + (divinf k Si (n)). We do a case analysis. If there is a proof of (divinf k Si (n)) then there exists a l < k such that Si (l) divides Si (n) so a fortiori (divinf (S k) Si (n)) is satisfied and then there is a proof (divspec (S k) n). In the other case, let q be such that q = Si (n) ∧ ¬(divinf k q), we test whether q can be divided by p. If p divides q then because p = Si (k) and q = Si (n) we conclude that (divinf (S k) Si (n)) is satisfied and then (divspec (S k) n). In the other case from ¬(divinf k q) and ¬(div Si (k) q) we conclude ¬(divinf (S k) q) and finally (divspec (S k) n). This ends the proof of the sieve.

The function primes. The primes function corresponds to a proof of :

∀∀k : Nat.(Str (divspec k) k) → (Str λn : Nat.(divspec n n) k)

It means that starting from a stream indexed by k and which gives for each n if Si (n) can be divided by Si (m) for m < k we can build a “diagonal” stream also indexed by k which gives for each n whether Si (n) can be divided by Si (m) for m < n.

In order to prove this we apply build to the predicate λn : Nat.(Str (divspec n) n). We have to prove the two lemmas :

∀∀n : Nat.(Str (divspec n) n) → (divspec n n)

which is just proved by the hd function. We also have to prove :

∀∀k : Nat.(Str (divspec k) k) → (Str (divspec (S k)) (S k))

Let s be a term of type (Str (divspec k) k) we take the head of this stream. It gives a proof of (divspec k k) ≡ (∃p : Nat.p = Si (k) ∧ ¬(divinf k p)) + (divinf k Si (k)). We do a case analysis. Let p be such that p = Si (k) we apply the sieve program to p, k, (S k) and the tail of s which has type (Str (divspec k) (Sk)). We get the expected proof of (Str (divspec (S k)) (Sk)). If (divinf k Si (k)) we use the only non trivial lemma about divinf which says that if n cannot be divided by any Si (m) with m < k then because Si (k) can be divided by Si (l) with l < k we have that n cannot be divided by Si (k). So (divinf k Si (k)) → ¬(divinf k n) → ¬(divinf (S k) n).

So from ∃q : Nat.q = Si (n) ∧ ¬(divinf k q) we deduce ∃q : Nat.q = Si (n) ∧ ¬(divinf (S k) q). And because we always have (divinf k n) → (divinf (S k) n) we deduce (divspec k n) → (divspec (S k) n). We finally can map this proof on the tail of s to get a proof of (Str (divspec (S k)) (S k)). We may check that this proof which looks a bit complicated acts like identity on streams.

Because we have trivially a proof of ¬(divinf 0 n) we may build the initial stream as a proof of (Str (divspec 0) 0).

This is done using build with the predicate λn : Nat.∃s : Str.s = (tl^{n} Si). We have to prove :

∀∀n.(∃s : Str.s = (tl^{n} Si)) → (divspec 0 n)

and

∀∀n.(∃s : Str.s = (tl^{n} Si)) → ∃s : Str.s = (tl^{(S n)} Si)

Let s be such that s = (tl^{n} Si). For the first lemma, we take its head which is equal to Si (n). It gives us a proof of ∃q : Nat.q = Si (n) ∧ ¬(divinf 0 q) and then a proof of (divspec 0 n). For the second lemma we take the tail of s and check that (tl^{(S n)} Si) = (tl (tl^{n} Si)).

Final program. Applying the primes operation to this initial stream gives us a proof of :

(Str λn : Nat.(divspec n n) 0).

Using the nth function we have a proof of ∀∀n.(divspec n n).

One step that remains to be done is to prove arithmetical lemmas like :

(∀p.Si (p) = p + 2) → ∀n.(divspec n n) → ((is prime n + 2) + ¬(is prime n + 2))

or

(∀p.Si (p) = 2p + 3) → ∀n.(divspec n n) → ((is prime 2n + 3) + ¬(is prime 2n + 3))

4.3 A partial filter development

We are now interested in a program that will only gives as output the numbers that cannot be divided by previous elements.

4.3.1 Specification

It is not easy to specify this problem using the index of this number in the actual stream. A more natural specification will be to relate the output to its index in the initial stream Si and also to the index of the previous element.

For this we use a general parameterized type of streams which is defined as follow. Let A be a specification of type Nat → Nat → Set. We give the type of the build and the out function. In that case the out function gives for a stream parameterized by p, a new parameter q, its head which is a proof of (A p q) and its tail which is a stream parameterized by (S q)^{1}.

Str ≡ λp : Nat.∃P : Nat → Set.(∀∀p.(P p) → ∃∃q : Nat.(A p q) ∧ (P (S q))) ∧ (P p)
: Nat → Set
build : ∀∀p : Nat.∀P : Nat → Set.
(∀∀p.(P p) → ∃∃q : Nat.(A p q) ∧ (P (S q))) → (P p) → (Str p)
out : ∀∀p.(Str p) → ∃∃q : Nat.(A p q) ∧ (Str (S q))

1The general case would have been to give the tail as a stream parameterized by q, but in our case q will alway be equal to (S q′) and the specification can more naturally be written as a relation between p and q′ than as a relation between p and q

We introduce the notation :

between ≡ λn, m : Nat.λP : Nat → Prop.(n ≤ m) ∧ ∀x.(n ≤ x < m) → (P x)

(between n m P) means that n ≤ m and P holds for all x such that n ≤ x < m The specification we shall use is :

ASieve ≡ λk, p, q : Nat.(∃n : Nat.n = Si (q) ∧ ¬(divinf k n)) ∧ (between p q λx.(divinf k Si (x)))

(ASieve k p q) means that we have a number equal to Si (q) which is the first element in Si from Si (p) that cannot be divided by a Si (l) for l < k.

4.3.2 Bounded search

We have to search for an element in the stream which satisfies some property. We know the existence of a bound N for the number of step in the search.

To program this, we use that some order is well-founded. The order depends on the bound N, it is defined as :

n ≺_{N} m ≡ m < n ∧ m < N

It is clear that there cannot be any infinite decreasing chain for ≺_{N} because if … n_{k} ≺_{N} … ≺_{N} n_{1} ≺_{N} n_{0} we have :

n_{0} < n_{1} < … < n_{k} < … < N

We shall use a principle of well-founded induction namely the property WF≺_{N}:

∀P : Nat → Set.(∀n.(∀m.(m ≺_{N} n) → (P m)) → (P n)) → ∀n.(P n)

This property can be proved directly by induction over the bound N. We shall use the fact that ∀n, m : Nat.¬(m ≺_{0} n) and ∀N, n, m : Nat.((S m) ≺_{(S N)} (S n)) → m ≺_{N} n.

For the case N = 0, we assume we have F of type ∀n.(∀m.(m ≺_{0} n) → (P m)) → (P n)) and n of type Nat. We apply F to n, we have to prove ∀m.(m ≺_{0} n) → (P m) which is done by absurdity of m ≺_{0} n.

For the induction step we have a proof HypN of

∀P : Nat → Set.(∀n.(∀m.(m ≺_{N} n) → (P m)) → (P n)) → ∀n.(P n),

a predicate P of type Nat → Set, a proof F of ∀n.(∀m.(m ≺_{(S N)} n) → (P m)) → (P n) and n of type Nat. We apply F to n, we have to prove ∀m.(m ≺_{(S n)} n) → (P m). Let m be such that m ≺_{(S N)} n, we know that m = (S m′). We get the proof of (P (S m′)) using the hypothesis HypN on the predicate λq.(P (S q)) and on m′. We have to prove :

∀n.(∀m.(m ≺_{N} n) → (P (S m))) → (P (S n))

let p be of type Nat and Hp be a proof of ∀m.(m ≺_{N} p) → (P (S m)). We build a proof of (P (S p)) with F applied to (S p). We then have to prove ∀m.(m ≺_{(S N)} (S p)) → (P m). But m ≺_{(S N)} (S p) implies m = (S q) and q ≺_{N} p. We apply Hp to q and get a proof of (P (S q)) which is (P m). This ends up the proof.

The computational content of this proof can be written as a program in a ML like language :

let rec Wfind = function
   0    -> fun  F n -> (F n (fun m -> error))
| S N   -> fun  F n ->
            (F n (fun m -> Wfind N
                                (fun p Hp -> F (S p) (fun m -> Hp (m-1)))
                                (m-1)))

This primitive recursive functional looks slightly more complicated than the general recursive program which do the same task :

let rec Wfrec F n = F n (Wfrec F)

This second program does not make use of the bound N for the search. In Coq, we can choose to use the direct proof of the induction principle ≺_{N} and we will get a strongly normalizable program. We can also just prove that the order we use is well-founded and then use the principle :

∀R.(well founded R) → ∀P : U → Set.(∀n.(∀m.(R m n) → (P m)) → (P n)) → ∀n.(P n)

This axiom is interpreted via a realisability interpretation as the program WFrec. It does not make use of the proof of the well-foundness of the relation.

4.3.3 The sieve program

To be able to write the sieve program we need more information on the stream Si, namely that for each k it contains infinitely many element that cannot be divided by Si (l) for l < k.

We add such an hypothesis : ∀k, n : Nat.∃N : Nat.∃p : Nat.((n ≤ p < N)∧¬(divinf k Si (p))). If we want a program written in a total language we need to explicitly give the bound N, if we only want to develop the program using general fixpoint this property can be non informative and will only be used for proving the well-foundness of the order.

The sieve program will be a proof of :

∀n : Nat.∀∀p, q : Nat. (between p q λx.(divinf p Si (x))) → n = Si (q) → ∀∀r : Nat.(Str (ASieve p) r) → (Str (ASieve (S q)) r)

In order to do that, we assume we have n, p and q natural numbers, and proofs of n = Si (q) and (betweeen p q λx.(divinf p Si (x))). We apply build with the predicate (Str (ASieve p). We have to prove :

∀∀r.(Str (ASieve p) r) → ∃∃t : Nat.(ASieve (S q) r t) ∧ (Str (ASieve p) (S t))

For this, we use the fact that there exists N such that ∃x : Nat.r ≤ x < N ∧¬(divinf (S q) Si (x)) and prove

∀r. (∃x : Nat.r ≤ x < N ∧ ¬(divinf (S q) Si (x))) → (Str (ASieve p) r) → ∃∃t : Nat.(ASieve (S q) r t) ∧ (Str (ASieve p) (S t))

using the well-founded induction over the order ≺_{N}. Our induction hypothesis will be :

∀u : Nat. (u ≺_{N} r) → (∃x : Nat.u ≤ x < N ∧ ¬(divinf (S q) Si (x))) → (Str (ASieve p) u) → ∃∃t : Nat.(ASieve (S q) u t) ∧ (Str (ASieve p) (S t))

Now we assume ∃x : Nat.r ≤ x < N ∧¬(divinf (S q) Si (x)). Let s be of type (Str (ASieve p) r). We apply it an out step. It gives us a parameter t, proof of (ASieve p r t) and a stream stl of type (Str (ASieve p) (S t)). We do an elimination on the proof of (ASieve p r t). It gives us a natural number m and proofs of m = Si (t), ¬(divinf p m) and (between r t λx.(divinf p Si (x))).

Now we look whether n divides m or not.

Case n divides m. If n divides m then we apply the induction hypothesis to (S t). It is easy to check from the hypotheses that :

∀x.r ≤ x < (S t) → (divinf (S q) Si (x))

Consequently from ∃x : Nat.r ≤ x < N ∧ ¬(divinf (S q) Si (x)), we get

∃x : Nat.((S t) ≤ x < N) ∧ ¬(divinf (S q) Si (x)).

We have to show that (S t) ≺_{N} r. ¿From (between r t λx.(divinf p Si (x))), we get r ≤ t and then r < (S t). Also it implies that (S t) < N because otherwise there will be no x between r and N such that ¬(divinf (S q) Si (x)).

The proof of (Str (ASieve p) (S t)) will be just the stream stl (the tail of s). We got a new parameter u and proofs of (ASieve (S q) (S t) u) and (Str (ASieve p) (S u)). It is enough to show from this that the property (ASieve (S q) r u) holds. The only problem is to show (between r u λx.(divinf (S q) Si (x))) but this is a simple consequence of (between r (S t) λx.(divinf (S q) Si (x))), and (between (S t) u λx.(divinf (S q) Si (x))) which comes from (ASieve (S q) (S t) u).

Case n does not divide m. If n does not divide m then the proof of :

∃∃t : Nat.(ASieve (S q) r t) ∧ (Str (ASieve p) (S t))

is done by checking that indeed t satisfies the expected properties.

The proof of (Str (ASieve p) (S t)) is the tail stream stl. To prove (ASieve (S q) r t) we first remark that the property (between r t λx.(divinf (S q) Si (x)) is an easy consequence of (between r t λx.(divinf p Si (x)) and the fact that p ≤ (S q). Because m = Si (t), it is enough to prove ¬(divinf (S q) m). We have a proof of ¬(divinf p m). Let us assume that there exists a < (S q) such that Si (a) divides m and show that it leads to a contradiction. We cannot have a < p because ¬(divinf p m), a = q is not possible because Si (q) = n does not divide m, we cannot have p ≤ a < q because ∀x.p ≤ x < q → (divinf p Si (x)) so we shall have b < p such that Si (b) divides Si (a) and consequently m. This ends the proof of this case and of the sieve program.

4.3.4 The primes function

The primes function is now not really difficult to prove. Its specification is :

∀∀k : Nat.(Str (ASieve k) k) → (Str λn, m : Nat.(ASieve n n m) k)

The proof is done by applying build with the predicate λk : Nat.(Str (ASieve k) k). We have to show that :

∀∀p : Nat.(Str (ASieve p) p) → ∃∃q : Nat.(ASieve p p q) ∧ (Str (ASieve (S q)) (S q))

So let s be of type (Str (ASieve p) p) We apply an out step. It gives us q, a proof of (ASieve p p q) and the tail stream stl of type (Str (ASieve p) (S q)). ¿From this we need to get a proof of (Str (ASieve (S q)) (S q)). ¿From the proof of (ASieve p p q) we get n such that n = Si (q) and (between p q λx.(divinf p Si (x))). So we can apply the sieve lemma to n, p and q also to (S q) and stl. We get the expected proof of (Str (ASieve (S q)) (S q)).

4.3.5 The final step

As previously it is easy to build from Si a proof of (Str (ASieve 0) 0) to which we apply the primes operation. Now if we have a proof of (ASieve p p q), it implies that Si (q) cannot be divided by Si (k) with k < p and ∀x.p ≤ x < q → (divinf p Si (x)) this implies that Si (q) cannot be divided by Si (k) with k < q which is the expected result for testing primality.

5 Conclusion

In this paper we investigated the programmation with infinite lists in strongly typed lambdacalculus by developing the example of the sieve of Eratosthenes. The complete proofs were developed in the system Coq.

It appears when we want to develop programs concerning streams that the methods to indicate in a specification which part will be used for computation is too weak in Coq. If we want to control exactly the computational aspect of the streams which are used, we shall need a method to indicate that a parameter of the problem should not appear as an input of the extracted program.

When trying to develop basic programs (for instance sorting algorithms) in the pure Calculus of Constructions axioms like induction over natural numbers were always needed. In the development of this algorithm on streams we did not need to add any axiom concerning coinductive types to the theory. The only axiom we used is the one concerning well-founded induction for the development of the partial recursive sieve. But it is not surprising because we know it is not possible to write in the Calculus of Constructions a proof of a search which does not make a computational use of a bound for this search.

The main difficulty to carry out this development was first to get the idea of using a parameterized type for streams, second to find the correct predicate to use when we apply the build operation. In general we know from the expected program what is the computational part of this predicate. For the logical part, it corresponds to find a correct invariant for the problem. This is a mathematical difficulty which often appears in the domain of proofs of programs. As soon as we get the right specifications and invariants, the system Coq is of a great help to carry out the whole formal development of the proof.

References

[1] C. Böhm and A. Berarducci. Automatic synthesis of typed λ-programs on term algebras. Theoretical Computer Science, 39, 1985.

[2] G. Dowek et al. The Coq Proof Assistant User’s Guide Version 5.6. Rapport Technique 134, INRIA, December 1991.

[3] H. Geuvers. Inductive and coinductive types with iteration and recursion. Faculty of Mathematics and Informatics, Catholic University Nijmegen, 1990.

[4] J.-Y. Girard, Y. Lafont, and P. Taylor. Proofs and Types. Cambridge Tracts in Theoretical Computer Science 7. Cambridge University Press, 1989.

[5] S. Hayashi. Singleton, union, intersection types for program extraction. In Proceedings of TACS’91, 1991.

[6] G. Kahn. The semantics of a simple language for parallel programming. In Information Processing 74. North-Holland, 1974.

[7] G. Kahn and D. MacQueen. Coroutines and networks of parallel processes. In B. Gilchrist, editor, Information Processing 77. North-Holland, 1977.

[8] N. Mendler. Predicative types universes and primitive recursion. In Sixth Annual IEEE Symposium on Logic in Computer Science, pages 173–184, Amsterdam, The Netherlands, 1991. IEEE Computer Society Press.

[9] C. Paulin-Mohring. Extracting F_{ω}’s programs from proofs in the Calculus of Constructions. In Association for Computing Machinery, editor, Sixteenth Annual ACM Symposium on Principles of Programming Languages, Austin, January 1989.

[10] C. Paulin-Mohring. Extraction de programmes dans¡ le Calcul des Constructions. PhD thesis, Université Paris 7, January 1989.

[11] G. C. Wraith. A note on categorical data types. In D.H. Pitt, D.E. Rydeheard, P. Dybjer, A.M. Pitts, and A. Poigné, editors, Category Theory and Computer Science. Springer-Verlag, 1989. LNCS 389.

Compositional understanding of type theory

Zhaohui Luo, Edinburgh

Abstract

We present a theory of dependent types and discuss several issues concerning its conceptual universe of types, which include the relationship between data types and propositions, intensionality, and compositional understanding.

The new Implementation of ALF

Lena Magnusson^{∗} Department of Computer Science, University of Göteborg/Chalmers

Preliminary version, August 1992

1 Introduction

This paper describes the (completely) new implementation of ALF, which is an interactive proof editing system, still on the experimental stage. The aims are to have a general mechanism for adding and treating definitions in a uniform and powerful way, and to do proof editing as with “scratch paper and pencil”. Theories are represented in the framework as collection of constant declarations, place holders are represented as yet unknown constant definitions and computation rules are defined by pattern matching. The flexibility in proof editing comes from the possibility to have several goals simultaneously, to combine top-down and bottom-up derivation, and to be able to backtrack in a structured way. Many of these features originate in the first ALF-system [ACN90] and an earlier implementation of Martin-Löf’s logical framework [Mag91].

2 System Overview

The proof editing system is based on Martin-Löf’s logical framework [NPS90], with the extension of judgements for contexts and substitutions (local environments) and the notion of explicit substitution applied to terms. The framework provides a general machinery for the theory independent part of the proof derivation system and the possibility of representing theories in the framework. Theories, definitions, proofs and incomplete derivations are all represented as (collections of) constants declared in an environment. Proof editing consists of manipulating the scratch area part of the environment, by adding definitions (new goals and lemmas), refining goals by combining rules from the theory, primitives and lemmas (proved or not), extending the theory with a completed proof, or deleting parts of a proof.

The system consists of three main parts, the environment with theory definitions and scratch area, the checker and the command interpreter. The latter will not be a subject of this paper, and we will refer instead to the system manual, which is under development. The different checking algorithms are all based on rules of the framework, and are parameterized over the environment definitions.

∗lena@cs.chalmers.se

[figure: Window system; Administration; Checker; Environment; add; refine; delete; Scratch area; theory; definitions; User; Commands to; manipulate the; environment; Checking judgements,; definitions and; refinements]

Figure 4: System overview

The framework provides general rules for application, abstraction, substitution and reduction (mainly beta and eta). A theory is represented by a collection of typed constants, where every “constant - type” pair corresponds to giving an axiom (state the proposition without proof). Rules, in a natural deduction style formulation of the theory, are represented as functions from premises to conclusions. Definitions of functions are given with pattern matching in a functional language style.

The environment consists of three parts, the theory, the dictionary and the scratch area. Primitive constants (given without justification) belong to the theory and abbreviations (which can be justified by type checking) are kept in the dictionary. All constants can be declared in a local context, which allows for defining theories and proofs parameterized over the context variables. These generalized (open) theories and proofs can be instantiated to particular (closed) theories and proofs by specializing the free variables of the constants with explicit substitutions.

The idea of the scratch area is that “unsure” parts of proofs can be manipulated in a similar way as on a “scratch paper”. Once completed in a satisfactory way, the proof can be moved to the dictionary part of the environment. To manage backtracking and gluing parts together in a correct way, some book keeping is required. For instance a full dependency graph is kept and updated continuously, to prevent circular definitions. Moreover, a set of constraints are kept, which are requirements concerning unknown notions needed to be satisfied in the future refinements. All this book keeping is the reason for not allowing backtracking in the entire environment.

3 The framework

3.1 Terms and types

Terms in ALF are lambda terms, extended with a notation for explicit substitution and with constants declared in the environment. The syntax of terms is the following

e ::= x | c | [x_{1}, …, x_{n}]e | e(e_{1}, …, e_{n}) | c{x_{1} := e; …; x_{n} := e} for n > 0, where x denotes variables and c constants. Additional restrictions are that 1) in an abstraction [x_{1}, …, x_{n}]e, e is not itself an abstraction,

2) the head e in an application e(e_{1}, …, e_{n}) is not an application and 3) the variables x_{1}, …, x_{n} in an explicit substitution {x_{1} := e; …; x_{n} := e}c must all be declared in the local context of the constant c.

Open terms contain free variables. These terms must be validated in a context, which is a sequence of typings of free variables

[x_{1} : α_{1}, x_{2} : α_{2}, …, x_{n} : α_{n}] (n ≥ 0)

where x_{i}, i = 1, …, n are distinct variables, and the free variables occurring in α_{i} must have been declared earlier in the context. A substitution is a sequence of assignments of terms to variables

{x_{1} := a_{1}, x_{2} := a_{2}, …, x_{n} := a_{n}}

The substitutions are performed simultaneously, instantiating (some of) the free variables of the term. Only open terms (or constants denoting open terms) can be affected by a substitution. The extension of syntax for explicit substitution is especially useful for instantiating variables of yet unknown constants, or for constructing generalized proofs (proofs in a context) which can later be specialized to particular (closed) proofs.

Types are generated from a set of ground types and a dependent function type constructor. A ground type is either the predefined type Set or a term of type Set. The syntax of ground types are

α_{ground} ::= Set | e (provided e : Set)

and for types

α ::= α_{ground} | (δ_{1}, …, δ_{n})α_{ground} for n > 0,

where

δ ::= x : α | x_{1}, …, x_{k} : α | α for n > 0.

We will denote terms by a, b, e or A, B, types by α, β, contexts by Γ, Δ and substitutions by γ. An extension of a context Γ (or substitution γ) is denoted by Γ.[x : α] (or by γ.{x := a}).

3.2 The framework rules

The extensions compared to the original formulation of Martin-Löf’s logical framework are the two judgements concerning contexts and substitutions and that judgements are given relative to contexts.

The basic assertions in the framework logic are the following judgement forms

Γ : Context Γ is a context

γ : Δ Γ γ is a substitution which fits context Δ in the context Γ

α : Type Γ α is a type in the context Γ

α = β : T ype Γ α and β are equal types in the context Γ

a : α Γ a is an object of type α in the context Γ

a = b : α Γ a and b are equal objects of type α in the context Γ 3.2.1 Context rules

A context is either empty or an extension of a proper context:

[ ] : Context  \begin{matrix}Γ : Context \\ α : T ype Γ \\ x ∉ Γ \\ Γ.[x : α] : Context \end{matrix}

A substitution γ fits a context Δ if for every x_{i} := a_{i} in γ, x_{i} is in the context Δ and a_{i} has the type of x_{i}. Also this relation is relative to a context (which will contain the free variables of the a_{i}’s). This is also referred to as a contextual mapping, with the notation γ : Δ → Γ.

\{ \} : [ ] Γ  \begin{matrix}γ : Δ Γ \\ α : T ype Δ \\ a : αγ Γ \\ γ.\{x := a\} : Δ.[x : α] Γ \end{matrix}

3.2.2 Term and Type rules

The new formation rules, concerning contexts are the following

\begin{matrix}γ : Δ Γ \\ α : T ype Δ \\ αγ : T ype Γ \end{matrix}  \begin{matrix}γ : Δ Γ \\ a : α Δ \\ aγ : αγ Γ \end{matrix}

For the other rules, we will have to refer to [NPS90].

3.3 Representing a theory

There are mainly two different kinds of definitions, primitive and defined notions. As mentioned, primitive notions can not be justified inside the system, whereas defined notions can be justified by type checking.

3.4 Primitive notions

The primitive notions are divided into two groups, constructors, which could be either set constructors or element constructors, and implicitly defined constants. Implicit definitions are used for representing rules of theories such as structural induction, or for defining primitive functions on datatypes. These are called implicit since their meaning is given by (usually recursive) equations, which show their computational behavior.

Primitive constant definitions have the following form

name : α Γ where name is a unique identifier

such as N : Set, 0 : N and succ : (N)N. Implicit definitions consist of an additional list of pattern equations, describing the computational behavior of the rule (function). Examples of implicitly defined constants are add : (N; N)N

add(x, 0) = x

add(x, succ(y)) = succ(add(x, y))

natrec : (P : (N)Set; P (0); (x : N; P (x))P (succ(x)); n : N)P (n) natrec(P, d, e, 0) = d

natrec(P, d, e, succ(x)) = e(x, natrec(P, d, e, x))

where patterns are either variables or element constructors (possibly applied to a substitution). The constructors must be applied to the proper number of arguments which are again patterns. A pattern can also be redundant (denoted ) which means that the argument is uniquely determined by type checking, and can therefore be safely omitted. These generalized patterns (compared to functional languages) come from the dependent types. Nonlinear patterns are one example of redundancy, but there are other cases as well. As a simple example, consider the first projection fst : (A, B : Set; p : P rod(A, B))A where pair is the constructor of the product type P rod. The pattern equation should be

fst( , , pair(A, B, a, b)) = a

or equally

fst(A, B, pair( , , a, b)) = a

We require the pattern equations to be non overlapping (or mutually disjoint), which means that at most one pattern can match any term, and there is a way to ensure the pattern equations to be exhaustive, by using a built in feature for generating pattern equations. The pattern matching is described in detail in [Coqb].

3.5 Defined notions

Defined notions are either named terms together with their types and local contexts, or yet unknown notions. There is also a possibility of giving a name to a context or a substitution, and use the name as an abbreviation of the context or substitution, respectively. A yet unknown notion is simply a defined notion where the term is not yet known, but which is intended to be instantiated at a later point. Yet unknown notions are used for place holders. A constant definition is of the following form

c = a : α Γ

where a is a term which may contain free occurrences of the variables in context Γ, or

c =? : α Γ

which denotes that c is yet unknown. The name c must be unique. Contexts can be concatenated (extended), denoted by Γ_{1} + Γ_{2}. Context abbreviations are written as follows

name = Γ_{1} + ⋯ + Γ_{n} n > 0

where Γ_{i} can be either a context or a defined name. Substitution abbreviations are written

name = γ : Δ Γ

Substitutions can also be composed, with γ_{1} ∘ γ_{2} : Γ_{1} Γ_{2} if γ_{1} : Γ_{1} Γ and γ_{2} : Γ Γ_{2}. The abbreviations of contexts and substitutions are simply short hand notations, since whenever needed, the abbreviations are expanded to their definitions.

4 Judgement checking

Judgements usually depend on constants from the current theory and dictionary, which are declared in the environment (denoted Σ), and therefore the checking algorithm is parameterized over Σ. We are not explicitly stating the validity of the environment in the rules below, but it is assumed. the notion of valid environment is described in section 5.

The judgement checking algorithm will proceed in three steps, by checking 1) wellformedness,

2) validity and finally 3) truth of the judgement. The judgement forms presented above, are all decidable (with some minor restrictions), provided that the pattern equations given in the theory will give rise to a confluent rewriting system. This prerequisite is needed since each pattern equation will correspond to a reduction rule (from left to right), and the equality of terms is modulo all reduction equalities. Abbreviations are “reduced” by expansion of their definition, but these are harmless rules, concerning confluence. On the other hand, the incorporation of place holders as yet unknown constant definitions, have the effect that the equality of two terms can be not yet decidable, if the terms contain constants which have no definitions as yet. Therefore, the judgement checking algorithm will not always answer either yes or no, it will sometimes answer “maybe”, meaning that the judgement might become true if the yet unknown constants are instantiated properly (fulfill the constraints). The second step in the algorithm concerns validity of a judgement, which is weaker than a true judgement since it means that the judgement will become true if the additional requirements of the constraints are satisfied. A judgement can be decided to be true or false as soon as there are no yet unknown constants involved (and sometimes refuted before that).

4.1 Constraints

A constraint is a tuple (a_{1}, a_{2}, α, Γ) in which at least one of the terms a_{1} and a_{2} are not complete, where complete means not depending on any yet unknown constants. The meaning of the constraint is that the unknown(s) in the equality is required to be instantiated in such a way that

a_{1} = a_{2} : α Γ

becomes a complete and true judgement.

The judgement checking algorithm produces a set of constraints, restricting the possible instantiations of the yet unknowns, or a special symbol F ail, denoting that the judgement can never become true, for any instantiations of the unknowns.

4.2 Valid judgements

The syntax of a wellformed judgement is as follows

J ::= Γ : Context | γ : Δ Γ | α : T ype | α = β : T ype Γ | a : α Γ | a = b : α Γ The validity of a judgement is computed by the function J, which takes a judgement and computes a set of constraints (the union of all constraints resulting from the premises) or F ail if any of the premises computes to F ail. J is defined in terms of IsContext, F itsContext, IsT ype and IsElem which are the constrained counterparts of the formation rules for contexts, substitutions, types and terms, and of the functions computing conversion of types and terms (T ypeConv and Conv). All constraints originate in the Conv function, since its purpose is to check if two terms are convertible (equal modulo equality rules). First we give the rules of a valid judgement, and then state the additional requirements for a true judgement. We will also describe the conversion algorithm (Conv), but the other functions are directly corresponding to their respective formation rules, and are omitted.

Context : \frac{IsContext(Σ, Γ) ⇒ ξ}{J (Σ, Γ : Context) ⇒ ξ}  Subst : IsContext(Σ, Δ) ⇒ ξ_{1} IsContext(Σ, Γ) ⇒ ξ_{2} F itsContext(Σ, Γ, Δ, γ) ⇒ ξ_{3} J (Σ, γ : Δ Γ) ⇒ ξ_{1} ∪ ξ_{2} ∪ ξ_{3}

Type : \begin{matrix}IsContext(Σ, Γ) ⇒ ξ_{1} \\ IsT ype(Σ, Γ, α) ⇒ ξ_{2} \\ J (Σ, α : T ype Γ) ⇒ ξ_{1} ∪ ξ_{2} \end{matrix}  TypeEq : IsContext(Σ, Γ) ⇒ ξ_{1} IsT ype(Σ, Γ, α) ⇒ ξ_{2} IsT ype(Σ, Γ, β) ⇒ ξ_{3} T ypeConv(Σ, Γ, α, β) ⇒ ξ_{4} J (Σ, α = β : T ype Γ) ⇒ ⋃_{i=1}^{4} ξ_{i}

Elem : IsContext(Σ, Γ) ⇒ ξ_{1} IsT ype(Σ, Γ, α) ⇒ ξ_{2} IsElem(Σ, Γ, α, a) ⇒ ξ_{3} J (Σ, a : α Γ) ⇒ ξ_{1} ∪ ξ_{2} ∪ ξ_{3}  ElemEq : IsContext(Σ, Γ) ⇒ ξ_{1} IsT ype(Σ, Γ, α) ⇒ ξ_{2} IsElem(Σ, Γ, α, a) ⇒ ξ_{3} IsElem(Σ, Γ, α, b) ⇒ ξ_{4} Conv(Σ, Γ, α, a, b) ⇒ ξ_{5} J (Σ, a = b : α Γ) ⇒ ⋃_{i=1}^{5} ξ_{i}

Formally, we define a true judgement to be

Γ ⊢_{Σ} J iff J is complete and J (Σ, J) ⇒ ∅ (empty set of constraints)

and conversely, a judgement is said to be false iff J (Σ, J) ⇒ F ail. The notion of being complete is defined in more detail in section 6.1.

The first step of the conversion algorithm is to reduce the two terms to head normal form, and we will therefore proceed by giving the reduction rules, before the conversion is described.

4.3 Reduction rules

The reduction is performed by applying the one step reduction rules until one of the following cases occur

• the term is on head normal form (the head of the term is a constructor or a variable, or the term is an abstraction)

• the term is irreducible

• the term can not be reduced any further at this point, since there is a not yet defined constant blocking the reduction.

4.3.1 One step reduction rules

The β-reduction is defined by explicit substitution as an “uncurried” version of the usual β-rule, meaning that several bound variables are substituted simultaneously. The δ-expansion is simply unfolding a defined constant (with or without definition) and the last rule is matching against given pattern equalities.

β-reduction

([x_{1}, …, x_{n}]b)(a_{1}, …, a_{k}) ⟶_{β} \{ \begin{matrix}b\{x_{1} = a_{1}, …, x_{n} = a_{n}\} & if n = k \\ [x_{k+1}, …, x_{n}](b\{x_{1} = a_{1}, …, x_{k} = a_{k}\}) & if k < n \\ (b\{x_{1} = a_{1}, …, x_{n} = a_{n}\})(a_{n+1}, …, a_{k}) & if k > n \end{matrix}

δ-expansion

\frac{c = a : α Γ ∈ Σ}{c ⟶_{δ} a}  \frac{c =? : α Γ ∈ Σ}{c ⟶_{δ} Unknown}

Pattern matching Since we require the patterns to be non overlapping, we know that in the list of patterns associated to a given constant, in any position there must be either only pattern variables or only constructors. This means that if a yet unknown constant is found in a position of a constructor, we know that no other pattern can possibly match as yet and the term is not yet reducible and if a local variable is found in a constructor position, we know that no pattern can match at all, and the term is irreducible. Moreover, redundant patterns are only allowed in positions where type correctness guarantees a specific term, and therefore can safely be ignored in the matching. There are three cases

• if c(p_{1}, …, p_{n}) = a ∈ Σ and ∃γ.c(p_{1}γ, …, p_{n}γ) ≡ c(a_{1}, …, a_{n}) then

c(a_{1}, …, a_{n}) ⟶_{M} aγ

• the pattern matching term is not yet reducible

• the pattern matching term is irreducible

4.3.2 Reduction to head normal form

The reason for not always reaching a term on head normal form is either that the term is c(b_{1}, …, b_{n}), where c is an implicitly defined constant and at some position i, where constructors are expected in the patterns, the b_{i} is either a variable or a yet unknown constant or the unknown is in the head position of the term. Therefore the output of the reduction will be a term prefixed with its status of reduction, i.e

Term⟶_{hnf} Hnf(Term) + Irr(Term) + NotYet(Term)

and the reduction proceeds by case analysis on the term structure

Var

x ⟶_{hnf} Hnf(x)

Const c ⟶_{hnf} Hnf(c) if c is a constructor c ⟶_{hnf} NotYet(c) if c is yet unknown c ⟶_{hnf} P (e′) if c ⟶_{δ} e ⟶_{hnf} P (e′), where P ∈ {Hnf, Irr, NotYet}

Abs [x_{1}, …, x_{n}]a ⟶_{hnf} Hnf([x_{1}, …, x_{n}]a)

App Case analysis on the head b of b(a_{1}, …, a_{n}):

b is an abstraction b(a_{1}, …, a_{n}) ⟶_{hnf} P (e′) if b(a_{1}, …, a_{n}) ⟶_{β} e ⟶_{hnf} P (e′)

b is a variable or constructor b(a_{1}, …, a_{n}) ⟶_{hnf} Hnf(b(a_{1}, …, a_{n}))

b is a defined constant c c(a_{1}, …, a_{n}) ⟶_{hnf} NotYet(c(a_{1}, …, a_{n})) if c is yet unknown

c(a_{1}, …, a_{n}) ⟶_{hnf} P (e′) if c ⟶_{δ} e and e(a_{1}, …, a_{n}) ⟶_{hnf} P (e′)

b is a constant defined by pattern matching b(a_{1}, …, a_{n}) ⟶_{hnf} P (e′) if b(a_{1}, …, a_{n}) ⟶_{M} e ⟶_{hnf} P (e′)

4.4 Conversion

The check for conversion is done in three stages. The first stage checks syntactic equality or if either of the terms are yet unknown, the second stage assures that the type of the terms are ground and the last stage performs the reduction to head normal form and then does the (simpler) head conversion check. To compute

Conv(Σ, Γ, α, e_{1}, e_{2})

yielding a set of constraints or F ail, we will proceed as follows

1. if e_{1} ≡ e_{2} then Conv(Σ, Γ, α, e_{1}, e_{2}) ⇒ ∅ (empty set of constraints)

2. if either e_{1} or e_{2} is a yet unknown constant, then Conv(Σ, Γ, α, e_{1}, e_{2}) ⇒ {(e_{1}, e_{2}, α, Γ)}

3. if α ≡ (x_{1} : α_{1}, …, x_{n} : α_{n})β then

e_{1}(y_{1}, …, y_{n}) = e_{2}(y_{1}, …, y_{n}) : β{x_{1} := y_{1}, …, x_{n} := y_{n}}

in the context Γ extended by the new variables y_{1}, …, y_{n}.

This rewriting of the original conversion problem is a combination of performing 1) ηexpansion, 2) α-conversion and 3) removing common abstractions of both terms, but it is done in one step. After this transformation, we know that the type must be ground, which means that when both sides are reduced to head normal form, neither term is an abstraction and in an application, the head is supplied with all its arguments (useful for pattern matching).

4. apply the reduction to head normal form to both terms, and depending on their status of the terms we have the following table

e_{2}\e_{1}  Hnf(e_{1})  Irr(e_{1})  NotYet(e_{1})
Hnf(e_{2}) * see below  F ail  ξ
Irr(e_{2})  F ail  if e_{1} ≡ e_{2} then ∅ else F ail  ξ
NotYet(e_{2})  ξ  ξ  ξ

where ξ = {(e_{1}, e_{2}, α, Γ)}.

* we only have to consider two cases in the head conversion, since we know that e_{1} and e_{2} are on head normal form, and since the type is ground, they are not abstractions. The only possibilities are for the heads to be either variables or constructors, applied to a proper number of arguments.

b(a_{1}, …, a_{n}) and b′(a′_{1}, …, a′_{n}) if b ≡ b′ then

Conv(Σ, Γ, α, a_{1}, a′_{1}) ⇒ ξ_{1}
⋮
Conv(Σ, Γ, α, a_{n}, a′_{n}) ⇒ ξ_{n}
Conv(Σ, Γ, α, b(a_{1}, …, a_{n}), b′(a′_{1}, …, a′_{n})) ⇒ ⋃_{i=1}^{n} ξ_{i}

else F ail (for b ≢ b′).

b and b′

Conv(Σ, Γ, α, b, b′) ⇒ \{ \begin{matrix}∅ & if b ≡ b′ \\ F ail & otherwise \end{matrix}

5 Environment

The environment contains three parts, the theory declarations, the dictionary and the scratch area. The declarations in the theory and dictionary are required to correspond to true judgements, while in the scratch area valid judgements are allowed. This means that the constants in the scratch area can depend on any primitive or defined constant which is declared in the environment, but the other way around is not accepted.

The environment is extended by one declaration at the time, and any kind of definition can be added at any time, provided the new declaration is a valid extension of the current environment. The only operation on the theory and the dictionary is the extension of a new declaration which is explained below. The extension is monotone in the sense that if a judgement is true in an environment, it is also true in any valid extension of that environment. (Note that the monotony property does not include the scratch area definitions). The scratch area and its operations are described in the next two sections.

5.1 Extending the theory

The theory contains both declarations of canonical constants (constructors) and non-canonical constants (implicitly defined constants) which in addition to their type declaration have a set of pattern equations. Therefore the extension is either a named type declaration (canonical or non-canonical constant) or it is an extension of a pattern equation. type declaration

A new primitive constant can be declared, if the type α is valid in the given context Γ with respect to the current environment Σ:

\frac{V alid(Σ)  Γ ⊢_{Σ} α : T ype  c ∉ Σ}{V alid(Σ, c : α Γ)}

pattern equation

A pattern equation is an equality

c(p_{1}, …, p_{n}) = e

where c must be known in the current environment Σ and c must be of arity n. The pattern context (Δ) and the type (β) of c(p_{1}, …, p_{n}) are computed, and e is checked to be of type β (in Δ). Further requirements are that redundant patterns only occur in positions where the term is uniquely determined by type checking, and that the new pattern is non-overlapping with respect to all the other pattern equations associated with c. The non-overlapping property as well as exhaustive pattern equations are ensured if the pattern equation generator is used to create new equations (see section 6.3).

\frac{V alid(Σ)  Γ + Δ ⊢_{Σ} c(p_{1}, …, p_{n}) : β  Γ + Δ ⊢_{Σ} e : β}{V alid(Σ, c(p_{1}, …, p_{n}) = e : β Γ + Δ)}

5.2 Extending the dictionary

The dictionary can be extended by abbreviations for a term, a context or a substitution, which correspond to true judgements. The formal rules are the following

\begin{matrix}V alid(Σ) \\ Γ ⊢_{Σ} e : α \\ c ∉ Σ \\ V alid(Σ, c = e : α Γ) \end{matrix} \begin{matrix}V alid(Σ) \\ ⊢_{Σ} Γ : Context \\ c ∉ Σ \\ V alid(Σ, c = Γ) \end{matrix} V alid(Σ)

Γ ⊢_{Σ} γ : Δ
c ∉ Σ
V alid(Σ, c = γ : Δ Γ)

6 Scratch area

The scratch area is where proof development take place. A goal is represented as a yet unknown constant declaration, c = ? : α Γ, where α is the type corresponding to the proposition to be proven, Γ contains the free variables (or parameters) which are allowed to occur in the proofterm, which is yet to be filled in. c is the name of the proof, or more correctly, an abbreviation of the proofterm. When the proof is completed, i.e. the ? is replaced by a term which can be checked to be of type α (in Γ), the proof can be moved to the dictionary as an abbreviation, and later used as any other abbreviation. New goals can be added to the scratch area at any point, and it is possible to work on any goal one desires, simply be always referring to the name of the goal.

The two main purposes for the scratch area, is to achieve full flexibility of combining top-down proof derivation with bottom-up, as well as being able to backtrack and choose an alternative way of constructing the proof. Here, backtracking means more than “resume at an earlier state of the scratch area”, since what we refer to as backtracking is rather deletion of a subterm of a proof, with the effect that only parts of the proof, structurally depending on the deleted term, will be deleted as well.

The price we have to pay for this flexibility, is that besides the set of constant declarations which are the actual goals and subgoals, we need to keep track of some additional information. Since the declarations in the theory part and dictionary are required to correspond to complete judgements, all the not completed declarations are kept in the scratch area, and therefore the set of constraints restricting the instantiation of the subgoals, is kept here as well. We also need a dependency graph which records all the dependencies between the constants, to prevent circular definitions of constants (recall that abbreviations are not allowed to be recursive). Since the actual order of the declarations in the scratch area is irrelevant (any constant declared in the scratch area can be used anywhere, before or after it is defined), and we sometimes need to sort the declarations in a topological order (dependency order), the dependency graph is very useful for this purpose as well.

To be able to perform backtracking properly, we need to distinguish between constants which are defined by refinement and constants which are instantiated by unification (required by constraints), since these requirements might not be relevant after the backtracking. Therefore we have a backtrack area which contains a copy of the scratch area declarations, but which constants are not instantiated by unification restrictions. The reason for choosing double representation of the same information, instead of performing the instantiations when needed, is that in an interactive system (especially with a window interface) we really want the information to be visible and updated continuously. This would require unnecessary computations to keep the declarations up to date most of the time. Instead, we recompute the scratch area from the backtrack area only after the (hopefully more seldom) operation of backtracking.

Finally, there is a list of waiting patterns, which are patterns generated by ALF, and which are waiting to get their left-hand side of the equation (their definition). A waiting patterns can be connected to a goal, and this provides a way of constructing the term within the scratch area, which is an advantage if the term is large and complicated.

6.1 Dependency graph

The dependency graph is a graph, recording the internal dependencies of the constants declarations in the scratch area. The graph provides answers to the following questions

• which constants the term of c depends on? (denoted TermDep(c))

• which constants the type and context of c depends on? (denoted TypeDep(c))

• all constants that c depends on (denoted Dep(c) ≡ TermDep(c) ∪ TypeDep(c))

• the set of constants which are yet unknown (denoted U)

• the constants which are yet unknown, that c depends on? (DepU(c) ⊆ Dep(c))

The nodes of the graph corresponds to the constants in the current set of declarations, and the pointers between the nodes are either term dependent or type/context dependent. The reason for separating the two kinds of dependency is that a constant which is type/context dependent on c, is not a meaningful declaration without c, while the term dependent constant is still meaningful (with the term removed). We will mainly think of the graph in the term dependent point of view, since it captures the structure of the proofterm, and we will refer to the subgraph of c as being the part of the graph corresponding to c’s (fully expanded) proofterm.

6.2 Backtrack area

The backtrack area contains a set of constant declarations, which as a subset contains the constants in the scratch area, and a dependency graph concerning these constants. The constants also occurring in the scratch area are called visible, whereas the others are invisible. The intuition is that each constant declaration stands for a step in the derivation, the definition of the constant stands for the “rule” applied in that step, and the new constants occurring in the definition correspond to other steps in the derivation. Moreover, the invisible constants stand for intermediate steps in the proof derivation, and the visible constant definitions corresponds to derivations “collapsed” to a few major steps. If we did not instantiate constants at all by unification and also expanded the invisible constants, then the scratch area and backtrack area declarations would be identical.

The correspondence between the scratch and backtrack area can be summarized by the following points:

• All visible constants in the scratch area are also in the backtrack area.

• If a constant is defined in the scratch area, but unknown in the backtrack area, then its definition is forced by unification.

6.3 Waiting patterns

A waiting pattern is a tuple (c(p_{1}, …, p_{n}), α, Δ, Γ), where Δ is the context of the pattern variables, and Γ the local context of c. Waiting patterns are created by the operations create pattern and expand pattern. As an example, consider the implicit constant declaration of add : (x, y : N)N, then create pattern will add the waiting pattern

(add(x, y), N, [x, y : N]) (a pattern with only pattern variables)

to the list of waiting patterns, and expanding that pattern with respect to the variable y would replace the same by

(add(x, 0), N, [x : N]) and (add(x, succ(y′)), N, [x, y′ : N]).

Note that the generation of waiting patterns by the operations create pattern and expand pattern, preserves the the property of the patterns of being exhaustive and non overlapping. Any of these new waiting patterns can again be expanded with respect to another pattern variable. The waiting pattern can be associated with a goal in the scratch area, which means that when that goal is proven, the pattern is completed and can be moved to the theory. A waiting pattern can also be completed by giving the definition directly.

7 Operations on the scratch area

The operations on the scratch area can be divided into three groups, proof construction, proof completion and backtracking (or proof deletion). Proofs are constructed by refining a yet unknown constant, i.e by giving a (partial) proofterm as its definition. The term can contain other constants from the scratch area, constants from the theory or dictionary or variables from the local context of the constant, besides the ordinary λ-term constructions. When a proof is completed in a satisfactory way, it can be moved from the scratch area to the dictionary, and from that point it is no longer possible to modify. On the other hand, as long as the proof is still in the scratch area (completed or not) it can be modified by these operations. There are two different ways of backtracking, by removing the definition of a constant or by removing the entire constant declaration. The former operation can be useful for retrying a (not so successful) attempt of constructing a proof, and the latter when a lemma or subgoal is declared which was found not to be useful.

7.1 Proof construction

For constructing a proof we have the following operations available; extending the scratch area with new goals or lemmas, making a global replacement of a constant with its definition (unfolding), and refining a goal. The refinement of a goal can be done top down - by refining with a constant which generates new subgoals, or bottom up - by explicitly giving the proofterm, or a combination of the two. Each refinement is checked to be admissible, which means that the set of constraints is not violated.

Extending the scratch area The scratch area can be extended with a new constant declaration, a new named context or substitution, or a new waiting pattern. The constant declaration can be yet unknown (new goal) or it can be partially or totally defined. Contexts and substitutions can depend on yet unknown constants as well (and therefore give rise to constraints) but can not be altered. A new waiting pattern can be added, refined, completed, and moved to the theory without changing the rest of the scratch area. To summarize, any extension of the scratch area is allowed at any time, provided that the set of constraints is not violated.

Unfolding a definition If c = e : α Γ is a declaration in the scratch area, then c is replaced everywhere in the set of declarations by e, and the declaration is removed. The dependency graph is updated, which means that each incoming pointer of node c is replaced by the set of outgoing pointers and the node is removed. The set of constraints is not affected by this operation, since all definitions are always expanded as far as possible in the constraints, and the only change in the backtrack area is that c becomes invisible.

Top down and bottom up refinements To refine a constant c with a term e, we need to type check if e is of proper type. But to be able to type check, all constants in e must be known in advance, which means that they must be declared in the environment. Therefore is the term given as a refinement, “preprocessed” before type checking. The preprocess consists of doing the following • if the arity of e is greater than the arity of c, which means that e needs more

arguments to be of proper type, then e is applied to a proper number of system generated new names

• a new name in the term is considered to be a new subgoal, which means that the type and context of such a subgoal is computed, and the new unknown constant declaration is added to the scratch area. The computation of type and context is done as for pattern variables.

• if the symbol is given instead of a new name, the system will generate a unique name. All system generated names become by default invisible constants, whereas user names become visible. The purpose of this setup is to name important subgoals and neglect (by using ) the others.

• all the transformations above are done recursively in the subterms, for partially given terms.

Admissible refinement The algorithm for checking if the refinement of the constant c with the term e is admissible, proceeds with the following three steps, producing a refined scratch area if the refinement is admissible, and a F ail otherwise.

1. Preconditions

• c = ? : α Γ ∈ Σ (c is a yet unknown constant)

• J (Σ, e : α Γ) ⇒ ξ (the type checking does not fail)

• c ∉ DepU(e) (the new definition is not circular, with respect to c)

2. Updating the scratch area

• ? is replaced by e in the declaration of c

• c is replaced by e everywhere in the set of constraints and ξ is added to that set.

• the dependency graph is updated, i.e TermDep(c) = the set of constants occurring in e.

• ? is replaced by e in the backtrack area

• if c is invisible, then c is unfolded and removed (the operation Unfold)

3. Refining the scratch area

• the set of constraints is refined, which means that each constraint (e_{1}, e_{2}, α, Γ)

is rechecked by

J (Σ, e_{1} = e_{2} : α Γ) ⇒ ξ

and replaced by ξ. If J fails, the entire refinement is rejected. The reason for refining the set of constraints is that the replacement of e for c might have created a failure constraint

• if the set of constraints contain a simple constraint, (c′ = e′ : β Δ, whichisnotcircular), then the c′ is updated to e′ in the scratch area, as in (2), except for the replacement in the backtrack area, which remains the same. The reason to keep constraints, which are circular, is that if x = y(x) is the constraint, then the equality will hold if y is instanciated to [z]0, for example.

These two steps are repeated until there are no simple constraints (and the refinement is admissible) or some refined constraint produces a F ail, and the refinement is not admissible.

7.2 Proof completion

This operation consists of two parts, to check that the construction of the constant is completed and if so, move the constant declaration to the dictionary.

A complete proof A precise definition of a complete constant (proof) is that c is complete iff c ∉ U and DepU(c) = ∅. A complete definition or judgement is when all constants occurring in the definition/judgement are complete. A proof can consist of several constant declarations, one main constant (corresponding to the proof), and other minor constant declarations (corresponding to lemmas). All these constants must be in the subgraph of the proof, which means that all lemmas must be used in the proof.

Moving a complete proof to the dictionary To move a proof c from the scratch area to the dictionary the following steps needs to be done

• check that c is complete, and compute the set of constants {c_{1}, …, c_{n}}, which is used in c.

• sort c ∪ {c_{1}, …, c_{n}} in their topological order (c will always be last), and add the constant declarations to the dictionary in this order, which will satisfy the condition of a valid extension.

• the declarations of c and {c_{1}, …, c_{n}} are simply erased from the scratch area (including the backtrack area). There is no problem in erasing the declarations, since the constants are complete and since they are moved and not removed (and can still appear in other declarations). The subgraph of c is removed from the dependency graph, since it only concerns scratch area constants.

7.3 Backtracking

Any deletion of a constant or a constant definition, are proceeded by an allowance check, before the actual deletion is performed in the backtrack area, and finally the new scratch area is computed from the diminished backtrack area. We will proceed by first describing the recomputation of a scratch area, and then the two kinds of deletion procedures are explained. Note that the constant declarations and dependency graph mentioned in these explanations, refer to the backtrack area.

Recompute the scratch area Recomputation of the scratch area is done after any kind of backtracking, since the old scratch area is not of any use at that point. The following steps will compute a scratch area from a backtrack area, which will have the same correspondence between them as described in section 6.2.

• Unfold the definitions of all invisible constant declarations everywhere,

• sort the remaining declarations topologically,

• extend an empty scratch area with the constant declarations in order, yielding a set of constraints,

• and finally, refine the scratch area constraints as in step (3) of the refine operation.

Remove a constant declaration The entire constant declaration c = e : α Γ is removable if there are no other constants depending on any of the constants c, c_{1}, …, c_{n}, where {c_{1}, …, c_{n}} = Dep(c), except internal dependencies between these constants. The reason for this requirement is simple - if there is a declaration in which the type or context depend on, say c, then the same declaration would not make sense if c is removed. Describing that c is removable in terms of dependency graph, is to say that the subgraph of c must be disconnected from the rest of the graph.

Remove the definition of a constant The definition e of a constant declaration c = e : α Γ can be removed (replaced by ?) if the set of constants {c_{1}, …, c_{n}}(≡ DepU(e)), which e depends on, are all removable. The reason we want to remove the constant declarations of c_{1}, …, c_{n} is that they all correspond to steps in the derivation of c, and we want to remove the entire derivation. To be more precise, the definition of c is allowed to be removed if the subgraph of c is only connected externally (to other parts of the graph) via the node c. The actual procedure of removing the definition take place in three steps, by first replacing the definition of c with ?, then removing the constant declarations of c_{1}, …, c_{n} and finally recompute the scratch area from this revised backtrack area. In the dependency graph, the subgraph of c except the node c itself, is deleted.

The only reason for not allowing a removal of a constant or definition is that this operation would remove some constant which is used elsewhere. Sometimes this can be arranged by further removals of constants and/or definitions, but we have taken the stand point not to do any “clever” decisions of what to remove (besides the obvious parts) and instead disallow removals of this kind. Since anything is possible to remove, as long as it is done in the proper order, the restriction seems motivated.

8 Validity of the scratch area - future work

As already mentioned, this is an implementation of experimental nature trying out several ideas simultaneously. The scratch area involves most of these ideas, and this part needs to be described more formally, hopefully reaching at a point where we can state and prove properties such as

• if the constraints concerning a definition is satisfied, then the definition corresponds to a true judgement (this is now given as a definition)

• define the relation between scratch area and backtrack area, and show that the relation is preserved for the different operations on the scratch area • define the partial order of “definedness” concerning the scratch area, and show that back-

tracking will always result in a “less defined” scratch area

9 Conclusion

Since this new implementation is still under developement, we will have to do much more experiments to be able to evaluate the new features. However, a few larger examples are carried out in ALF, such as a normalization proof for simply typed λ calculus [Coqa], another normalization proof for the typed combinator calculus [GS], as well as some properties of wellquasi ordered sets [Fri].

References

[ACN90] L. Augustsson, T. Coquand, and B. Nordström. A short description of Another Logical Framework. In Proceedings of the First Workshop on Logical Frameworks, Antibes, pages 39–42, 1990.

[Coqa] Catarina Coquand. A proof of normalization for simply typed lambda calculus written in alf. In To appear in the informal proceeding from the logical framework workshop at Båstad, June 1992.

[Coqb] Thierry Coquand. Pattern matching with dependent types. In To appear in the informal proceeding from the logical framework workshop at Båstad, June 1992.

[Fri] Daniel Fridlender. Formalizing properties of well-quasi ordered sets in alf. In To appear in the informal proceeding from the logical framework workshop at Båstad, June 1992.

[GS] Veronica Gaspes and Jan M. Smith. Machine checked normalization proofs for typed combinator calculi. In To appear in the informal proceeding from the logical framework workshop at Båstad, June 1992.

[Mag91] Lena Magnusson. An Implementation of Martin-Löf’s Logical Framework. Licentiate Thesis, Chalmers University of Technology and University of Göteborg, Sweden, June 1991.

[NPS90] Bengt Nordström, Kent Petersson, and Jan M. Smith. Programming in Martin-Löf’s Type Theory. An Introduction. Oxford University Press, 1990.

An implementation of Constructive Set Theory, in the Lego system

Nax Paul Mendler Computer Science Department University of Manchester Manchester M13 9PL

August,1992

Remark, by Peter Aczel: This note was written by Nax Mendler, just before he left the LF project in November 1991. My talk at the workshop was a report on his work.

This note contains comments to accompany a file library I wrote for Randy Pollack’s Lego system.

In the paper [1] Peter Aczel described a constructive set theory (CST) and gave an interpretation of it into Martin-lof type theory. I took this paper and implemented this interpretation in the Extended Calculus of Constructions using Lego. The best and perhaps only way to study this Lego file is to read it or enter it into the system as you follow along in the original paper, and I’ve tried to have the Lego file match it as closely as possible.

In Lego I used the Extended Calculus of Constructions theory [2] and extensively used the new facility for adding user-defined combinators and reductions. The most important example of this is the type called V, used to interpret the universe of sets: it is the well-founded type (W x : Type_{0})x, and its induction combinator was used in defining a bisimulation relation which models extensional equality on sets.

The only subtle technical point of the Lego implementation was that, while the original paper assumed the existence of extensional identity types in the type theory, one can rework a few arguments and use definitional equality instead. This is not too surprising: I think it soon becomes clear whether one can or can’t eliminate the use of extensional identity types in a given piece of type theory, and in this case I was lucky.

So, in this Lego library, the propositions-as-types interpretations or translations of the axioms of CST are all “proven.” The intention is that one can then go on to do some set theory in Lego and also be able to execute the constructive content of the proofs. One example that we thought might be of a reasonable size is to define and prove some basic facts about the hereditarily finite sets.

Just a few sentences on what this experiment has taught me about the Lego system. I’ve used Lego before, although this was my first long example using the combinator definition facility. As I’ve come to expect from the system, what it is meant to do it does with style. I already knew the basic definition mechanism and type synthesis would prove useful, and I was pleased with the new user-defined combinator facility. I was happy with how fast the system ran, too. But as for the question of why do any formal theorem proving on computer, I still can not be positive — my example should only be viewed as evidence that it is possible to sit down and enter these sorts of formal proofs, not as an endorsement of the activity.

[1] Peter Aczel. The type theoretic interpretation of constructive set theory: Choice principles. In A.S. Troelstra and D. van Dalen, editors, The LEJ Brouwer Centenary Symposium, pages 1–40. North-Holland, 1982.

[2] Z.Luo. A higher-order calculus and theory abstraction. Information and Control, 90(1):107-137, January 1991.

lambda mu-calculus: an algorithmic interpretation of classical natural deduction

Michel Parigot, Paris 7

Abstract

We present a way of extending the paradigm ”proofs as programs” to classical proofs. The system used is a natural deduction system with multiple conclusions. It has two kinds of reduction rules: logical and structural ones (logical ones correspond exactly to those of intuitionistic natural deduction).

The computation mechanism can be described as a pure calculus, called lambda mucalculus, which extends in a simple manner lambda-calculus (mu looks like a lambda having a potentially infinite number of arguments). Pure lambda mu-calculus satisfies the Church-Rosser property. Typed lambda mu -calculus satisfies also the type preservation and strong normalisation properties.

lambda mu-calculus has a simple abstract environment based machine: the new instructions (in addition of those of lambda-calculus) are ”save the stack” and ”restore the stack”.

Teaching Theory of Programming Languages Using a Logical Framework: an Experience Report

Frank Pfenning, Carnegie Mellon

Abstract

During the Spring’92 semester I taught a graduate course “Computation and Deduction”. This course explored the theory of programming languages using systems of natural deduction. Such systems were used to specify, implement, and verify properties of functional, imperative, and logic programming languages. The deductive approach to the specification of programming languages has become standard practice, and one of the goals of this course was to provide a good working knowledge of how to engineer and prove properties of language descriptions in this style. Throughout the course we used Elf as a meta-language. Elf is a logic programming language based on the LF Logical Framework and was introduced by means of a few extended examples. An implementation of Elf and all the examples were available on-line for experimentation. Overall there were 29 lectures of 1.5 hours each, of which 12 were given by students presenting projects.

The rigorous use of Elf as a metalanguage was seen as a very positive factor. Otherwise dry exercises became programming problems, and the students learned how to employ Elf effectively to implement languages and their meta-theory. Type reconstruction and a few other features of the Elf implementation turned out to be usable and valuable. It was generally felt that the expressive power of the LF logical framework was adequate, although a few extensions emerged as desirable in practice. These were a simple definitional equality, a limited form of subtypes and overloading, and a module system.

In my talk, I will outline the approach and content of the course. Furthermore, I will sketch some initial ideas on how to enhance the expressive power of LF in directions motivated by the course experience.

Typechecking in Pure Type Systems

Randy Pollack LFCS, University of Edinburgh

July 1992

Retraction

At Baastad I claimed a proof of the Expansion Postponment property for functional PTS. Eric Poll of Eindhoven pointed out an error in my claimed proof. As far as I know this problem is still open.

1 Introduction

This work is motivated by two related problems. The first is to find reasonable algorithms for typechecking Pure Type Systems [Bar91] (PTS); the second is a technical question about PTS, the so called Expansion Postponment property (EP), which is tantalizingly simple but remains unsolved.

There are several implementations of formal systems that are either PTS or closely related to PTS. For example, LEGO [LP92] implements the Pure Calculus of Constructions [CH88] (PCC), the Extended Calculus of Constructions [Luo90] and the Edinburgh Logical Framework [HHP87]. ELF [Pfe89] implements LF; CONSTRUCTOR [Hel91] implements arbitrary PTS with finite set of sorts. Are these implementations actually correct? It is not difficult to find a natural efficient algorithm that is provably sound (Section 3), but completeness is more difficult. In fact Jutting has shown typechecking is decidable for all normalizing PTS with a finite set of sorts [vBJ92], but his algorithm, which computes the normal forms of types, is not suitable for practical use.

1.1 The Decision Problems

We consider two problems about PTS. The Type Checking Problem (TCP) is to decide, given Γ, M, and A, whether or not Γ ⊢ M : A is derivable. In implementations we want to enter a term and have the program compute its type in the current context. For PTS with types unique up to conversion, the functional PTS, this Type Synthesis Problem (TSP) is clear: given Γ and M, compute a term A such that Γ ⊢ M : A, or return failure if no such A exists. In general, however, PTS do not have unique types, and an exact statement of TSP involves a notion of type scheme which will be postponed to Section 2.3.

Let s range over {Prop,Type}, the sorts of PCC.

ax  • ⊢ Prop : Type
start  \frac{Γ ⊢ A : s}{Γ[x:A] ⊢ x : A}  x fresh

weak  \frac{Γ ⊢ α : C  Γ ⊢ A : s}{Γ[x:A] ⊢ α : C}  x fresh

pi  \frac{Γ[x:A] ⊢ B : s}{Γ ⊢ \{x:A\}B : s}

lda  \frac{Γ[x:A] ⊢ M : B}{Γ ⊢ [x:A]M : \{x:A\}B}  B ≠ Type

app  \frac{Γ ⊢ M : \{x:A\}B  Γ ⊢ N : A}{Γ ⊢ M N : [N/x]B}

conv  \frac{Γ ⊢ M : A  Γ ⊢ B : s  A ≃ B}{Γ ⊢ M : B}

Table 2: The Pure Calculus of Constructions (PCC)

1.2 An Example: Typechecking Pure Constructions

Without being too precise for the moment Table 2 presents typing rules for the Pure Calculus of Constructions (PCC). Consider the type synthesis problem for PCC: given Γ and M, compute a term A such that Γ ⊢ M : A, or return failure if no such A exists. The natural approach is to look for a derivation of Γ ⊢ M : guided by the shape of the subject, Γ and M. The only flaw in this plan is the rule conv, which may be used at any point in a derivation without changing the shape of the subject. Putting it the other way around, you cannot tell when to use conv in a derivation by looking at the shape of the subject. It is clear we must control the conv rule. In my first typechecker for PCC, coded in 1986, my approach was to compute the normal forms of types. This eliminates the need for conv, and, since PCC is normalizing, leads to a sound and complete algorithm if done correctly. (For example, you must check that a term is well-typed before trying to normalize it!) This approach is terribly slow, and clearly could not be used to check large bodies of mathematics.

In 1987, Gérard Huet showed me a collection of techniques for efficiently typechecking PCC that he collected into an abstract machine called the Constructive Engine [Hue87]. The most important aspect of the Constructive Engine is shown abstractly in Table 3. The correctness lemma for this system is

Lemma 1.1 (1) If Γ ⊢_{ce} M : A then Γ ⊢ M : A.

(2) If Γ ⊢ M : A then there exists A′ such that A ≃ A′ and Γ ⊢_{ce} M : A′

Table 2, because of its non-determinstic use of conv, allows many derivations over a given subject, even deriving structurally different types for a single subject. (It is a property of PCC that all those types are convertible.) In contrast, the system of Table 3 has no conv rule and allows at most one derivation over a given Γ and M, and that derivation uniquely determines Notation: we write Γ ⊢_{ce} M :≥ A for Γ ⊢_{ce} M : A′ and A′ ≥ A, where ≥ is β-reduction and ≥^{wh} is β-weak-head-reduction.

ce-ax  • ⊢_{ce} Prop : Type
ce-start  \frac{Γ ⊢_{ce} A :≥ s}{Γ[x:A] ⊢_{ce} x : A}  x fresh

ce-weak  \frac{Γ ⊢_{ce} α : C  Γ ⊢_{ce} A :≥ s}{Γ[x:A] ⊢_{ce} α : C}  x fresh

ce-pi  \frac{Γ[x:A] ⊢_{ce} B :≥ s}{Γ ⊢_{ce} \{x:A\}B : s}

ce-lda  \frac{Γ[x:A] ⊢_{ce} M : B}{Γ ⊢_{ce} [x:A]M : \{x:A\}B}  B ≠ Type

ce-app  \frac{Γ ⊢_{ce} M :≥^{wh} \{x:A\}B  Γ ⊢_{ce} N : A′  A ≃ A′}{Γ ⊢_{ce} M N : [N/x]B}

Table 3: A Preliminary Constructive Engine: syntax-directed PCC

the type it derives for M in Γ. Consequently Table 2 cannot derive all the structurally different types for M in Γ, but only one representative of the conversion class.

Notice that for correctness we could allow arbitrary reduction sequences where we have written weak-head reduction in ce-app, but the restriction to deterministic weak-head reduction is necessary to make this rule syntax directed; otherwise we wouldn’t know when to stop reducing in the left premiss, and A and B wouldn’t be uniquely determined.

We can think of Lemma 1.1 as saying all uses of conv for expanding a type can be permuted downwards in a derivation through all premisses of all rules, and all uses of conv for reducing a type can be permuted downwards in a derivation through the left premiss of weak and the premiss of lda. The fact that Table 3 is syntax directed is extremely delicate, although we didn’t know this in 1987 because the proof of Lemma 1.1 is quite straightfoward. In PTS it is still unproven that type expansion can always be deferred to the end of derivations, and we know by counterexample (Example 3.2) that type reduction cannot always be permuted through the premiss of lda.

Table 3 can already be thought of as a sound and complete type synthesis algorithm for PCC, but there is one other significant optimization in the Constructive Engine that is worth mentioning, even though it is not delicate, and gives no problems in the case of PTS. In the rules ce-weak and ce-app Γ occurs in two premisses, and its validity must be checked in the subderivations above both premisses. It is much more efficient to assume we start with a valid context, and only check that it remains valid whenever we extend it. This is also more in keeping with the use of actual implementations, where we want to work in a “current context” of mathematical assumptions (and also of definitions and proved theorems, but I do not address definitions in this note). This is shown abstractly in Table 4. The new premisses in ceo-pi and ceo-lda are to check that the extended contexts in the second premisses are valid, assuming that Γ is valid. The correctness lemma for this system is Notation: we write Γ ⊢_{ceo} M :≥ A for Γ ⊢_{ceo} M : A′ and A′ ≥ A.

ceo-valid • Valid  \frac{Γ Valid  Γ ⊢_{ceo} A :≥ s}{Γ[x:A] Valid}  x fresh
ceo-prop Γ ⊢_{ceo} Prop : Type
ceo-var  Γ[x:A]Δ ⊢_{ceo} x : A
ceo-pi  \frac{Γ ⊢_{ceo} A :≥ s′  Γ[x:A] ⊢_{ceo} B :≥ s}{Γ ⊢_{ceo} \{x:A\}B : s}

ceo-lda  \frac{Γ ⊢_{ceo} A :≥ s  Γ[x:A] ⊢_{ceo} M : B}{Γ ⊢_{ceo} [x:A]M : \{x:A\}B}  B ≠ Type

ceo-app  \frac{Γ ⊢_{ceo} M :≥^{wh} \{x:A\}B  Γ ⊢_{ceo} N : A′  A ≃ A′}{Γ ⊢_{ceo} M N : [N/x]B}

Table 4: An Optimised Constructive Engine

Lemma 1.2 (1) If Γ ⊢_{ceo} M : A and Γ Valid then Γ ⊢ M : A.

(2) If Γ ⊢ M : A then there exists A′ such that A ≃ A′ and Γ ⊢_{ceo} M : A′

Setting aside the question of how to test conversion, we consider Table 4 to be a good algorithm for typechecking PCC.

1.3 The remainder of this note

For arbitrary PTS there are several new difficulties. The most troublesome is that we don’t know how to eliminate the conversion rule in favor of a syntax-directed system for arbitrary PTS. The difficulty in following the Constructive Engine approach is discussed in Section 3. In Section 4 we give a syntax-directed presentation of a restricted class of PTS that includes PCC, and the Edinburgh Logical Framework (LF). (Thus, we finally have a proof of an efficient and natural algorithm for typechecking LF.) It may be of interest that the correctness of the syntax-directed system for this class of PTS has been machine checked in LEGO [LP92], except for a few facts about reduction and conversion. This class also has the Expansion Postponment property.

In PCC there are only two sorts, Prop and Type, and PCC has types unique up to conversion. In general a PTS may have infinitely many sorts and fail to have unique types. Even if we have a syntax-directed presentation for a class of PTS, where all derivations over a given subject have the same shape, undecidable and non-deterministic side conditions may complicate an algorithmic interpretation. Such issues are well understood, and I show how to handle them in Section 4.4.

2 Pure Type Systems

In order to fix notation we define PTS and state some well known properties. A PTS, P, is a 4-tuple (Cnst, Sort, Ax, Rule) where • Cnst, a set of constants (ranged over by c)

• Sort ⊆ Cnst, a set of sorts, (ranged over by s)

• Ax ⊆ Cnst × Sort, a set of axioms of the form Ax(c:s)

• Rule ⊆ Sort × Sort × Sort, a set of rules of the form Rule(s_{1}, s_{2}, s_{3})

Syntax Let x range over Var, an infinite set of variables disjoint from Cnst. The raw syntax of terms, contexts and judgements of PTS P = (Cnst, Sort, Ax, Rule) is given by:

atomic terms α ::= x  variable
| c  constant
terms M ::= α atomic
| [x:M]M  lambda
| {x:M}M Pi
| M M  application
contexts Γ ::= • empty
| Γ[x:M]
judgement  J ::= Γ ⊢ M : M

M, N, A, B, C, D, E, a, b range over terms; Γ, Δ over contexts.

FV (M) denotes the free variables of M, defined as usual. If Γ = [x_{1}:A_{1}] … [x_{n}:A_{n}] then V (Γ) is defined as the set {x_{1}, …, x_{n}}, and FV (Γ) as the set ⋃{FV (A_{1}), …, FV (A_{n})}. If Γ = Γ_{1}[x:A]Γ_{2} we say x:A ∈ Γ. Γ ⊆ Δ is defined to mean x:A ∈ Γ implies x:A ∈ Δ.

Reduction Substitution, β-reduction, and β-conversion are defined as usual for such languages. Write [N/x]B for “capture-avoiding substitution of N for free ocurrances of x in B”,

A ≥ B for “A reduces to B”, A ≥^{wh} B for “A weak-head reduces to B” and A ≃ B for “A converts to B”. β-reduction has the Church-Rosser (CR) property. nf (A, B) is the relation “B is the normal form of A”.

Typing The judgements of P are those derivable from the axioms and inference rules of Table 5. As usual we abuse notation by writing Γ ⊢ M : A to mean the judgement is derivable. We say Γ Valid iff there exist M and A with Γ ⊢ M : A.

The cognoscenti will notice that the rule weak in Table 5 is not the usual one. I have restricted weakening to atomic subjects for the purpose of discussing typechecking, since this presentation is more syntax-directed. It is straightfoward to see that the full weakening rule is admissible in this system. In fact this presentation gives a better development of the basic metatheory because no case of the Generation Lemma except start depends on the Thinning Lemma. The basic metatheory of this presentation of PTS has been formalized in LEGO

2.1 Basic Theorems

The basic meta-theoretic properties of PTS are presented in [Bar92, Ber90, GN91, vBJ92]. The ones we will explicitly use are summarized here

Lemma 2.1 (Thinning Lemma) If Γ ⊢ M : A, Γ ⊆ Δ, and Δ Valid, then Δ ⊢ M : A.

ax  • ⊢ c : s  Ax(c:s)
start  \frac{Γ ⊢ A : s}{Γ[x:A] ⊢ x : A}  x fresh

weak  \frac{Γ ⊢ α : C  Γ ⊢ A : s}{Γ[x:A] ⊢ α : C}  x fresh

pi  \frac{Γ ⊢ A : s_{1}  Γ[x:A] ⊢ B : s_{2}}{Γ ⊢ \{x:A\}B : s_{3}}  Rule(s_{1}, s_{2}, s_{3})

lda  \frac{Γ[x:A] ⊢ M : B  Γ ⊢ \{x:A\}B : s}{Γ ⊢ [x:A]M : \{x:A\}B}

app  \frac{Γ ⊢ M : \{x:A\}B  Γ ⊢ N : A}{Γ ⊢ M N : [N/x]B}

conv  \frac{Γ ⊢ M : A  Γ ⊢ B : s  A ≃ B}{Γ ⊢ M : B}

Table 5: The Typing Judgement of a PTS

Lemma 2.2 (Generation Lemma) (1) If Γ ⊢ c : A then there exists s such that Ax(c:s) and A ≃ s.

(2) If Γ ⊢ x : A then there exists A′ such that x:A′ ∈ Γ and A ≃ A′.

(3) If Γ ⊢ {x:B}D : A then there exist s_{1}, s_{2}, s_{3} such that Rule(s_{1}, s_{2}, s_{3}), Γ ⊢ B : s_{1}, Γ[x:B] ⊢ D : s_{2}, and A ≃ s_{3}.

(4) If Γ ⊢ [x:B]d : A then there exist s and D such that Γ[x:B] ⊢ d : D, Γ ⊢ {x:B}D : s, and A ≃ {x:B}D.

(5) If Γ ⊢ b d : A then there exist B, D such that Γ ⊢ b : {x:D}B, Γ ⊢ d : D, and A ≃ [d/x]B.

Lemma 2.3 (Correctness of Types) If Γ ⊢ b : B then there exists s such that B ≃ s or Γ ⊢ B : s.

Lemma 2.4 (Subject and Predicate Reduction) If Γ ⊢ b : B, Γ ≥ Γ′, b ≥ b′, and B ≥ B′, then Γ′ ⊢ b′ : B′.

A PTS is called functional if Ax(c:s) and Ax(c:s′) imply s = s′, and Rule(s_{1}, s_{2}, s_{3}) and Rule(s_{1}, s_{2}, s′_{3}) imply s_{3} = s′_{3}. Functional PTS have types unique up to conversion.

2.2 A First Look at Decidability

We cannot expect to decide typechecking for a PTS whose axioms or rules are not decidable (although none of the basic metatheory mentioned so far uses such an assumption), so from now on assume they are decidable.

At first, blinded by the beauty of the Constructive Engine, I conjectured that all normalizing PTS have decidable TCP. This belief is sadly mistaken:

Example 2.1 Let T(i, n) mean “the i^{th} Turing machine, when started with i on it’s input tape, halts in exactly n steps”. For the PTS

undecidable

Cnst  natural numbers
Sort  natural numbers
Ax  { (i:n) | T(i, n) }
Rule  ∅

we have, for any i, [x:i] ⊢ x : i iff there exists n with Ax(i:n) iff the i^{th} Turing machine halts on input i. This PTS is functional and strongly normalizing (there are no well typed redices), but has undecidable TCP.

2.3 Most General Type Schemes

Is there hope to find systems of syntax-directed derivations for non-functional PTS? Suppose there are judgements of the shape Γ ⊢ b : {x_{1}:B_{1}}s_{1} and Γ ⊢ b : {x_{1}:C_{1}}{x_{2}:C_{2}}s_{2} where the types are in normal form. We wouldn’t expect a derivation determined by the shape of Γ and b to construct both of these types since they have different shapes. In fact this problem doesn’t arise. I believe the following property was first observed by Luo for ECC [Luo90], and independently discovered by Jutting for PTS [vBJ92].

Lemma 2.5 If Γ ⊢ a : A and Γ ⊢ a : B then either (i) A ≃ B, or (ii) there exist s_{A}, s_{B}, n ≥ 0, C_{1}, …, C_{n} such that A ≥ {x_{1}:C_{1}} … {x_{n}:C_{n}}s_{A} and B ≥ {x_{1}:C_{1}} … {x_{n}:C_{n}}s_{B}

As a corollary we have that if Γ ⊢ a : A and Γ ⊢ a : B then there is an A′, obtained by replacing some of the sort occurrences in A by other sorts, such that B ≃ A′. We introduce some machinery to talk about this idea,

Sort Variables and Constraints Let Σ be a new class of sort variables disjoint from Cnst and Var, ranged over by σ. Schematic terms, ranged over by X, Y, Z, U, are terms that may contain sort variables as well as sorts

\begin{aligned}α & ::= & x | c | σ \\ X & ::= & α | [x:X]X | \{x:X\}X | X X \end{aligned}

SV (X) is the set of sort variables occurring in X.

A sort asignment, ranged over by φ, is a partial function assigning sorts to a finite set of sort variables. Dom (φ) is the domain of φ as a function.

Reduction, conversion, and sort assignments are extended to schematic terms in the obvious way. We call φX an instance of X. Notice that φ respects the structure of terms, and respects redices, so can be thought of as a bijection between the reduction sequences from X and the reduction sequences from φX. In particular X has a normal form exactly when φX does.

Most General Type Schemes By Lemma 2.5, if Γ ⊢ M : A then there is an X such that every type for M in Γ converts with an instance of X. The problem is to find just those instances of X that actually are correct types for M in Γ.

A constraint is any formula whose only free variables are sort variables. We have in mind formulas of the form Ax(c:σ), Rule(σ_{1}, σ_{2}, σ_{3}), and σ_{1} = σ_{2}. C, D, E, F, G, range over finite sets of constraints. SV (C) is the set of sort variables occurring in C. A sort assignment satisfies a constraint set, written φ ⊧ C, iff SV (C) ⊆ Dom (φ) and each of the propositions in φC is true. A constraint set is satisfiable, or consistent if there is some sort assignment satisfying it.

Assume we have specified a class of constraints such that the consistency of every set of such constraints is decidable. For example, for a PTS with finite Sort, the class including all formulas of the form Ax(c:σ), Rule(σ_{1}, σ_{2}, σ_{3}), and σ_{1} = σ_{2} is such a class (remember, we are assuming Ax and Rule to be decidable). Let Z be such a class, although we will usually keep this class implicit.

A pair X, C (where C ⊆ Z) is a most general type scheme (mgts) for Γ, M (with respect to Z) iff (i) whenever φ ⊧ C then Γ ⊢ M : φX, and (ii) whenever Γ ⊢ M : A there is a φ ⊧ C such that A ≃ φX.

The Type Synthesis Problem (TSP) for a PTS is, to find a class, Z, and an algorithm that, given Γ and M, computes a most general type scheme, X, C, for Γ, M with respect to Z.

We will now show that, for a given PTS, if TSP is solvable then TCP is also solvable.

Schematic Conversion In order to compute the constraints under which two schematic terms are convertible we need a sort-variables unification algorithm:

σ_{1} =^{{σ_{1}=σ_{2}}} σ_{2}  c_{1} =^{∅} c_{2}  x =^{∅} x
\begin{matrix}X_{1} =^{C} Y_{1} & & X_{2} =^{D} Y_{2} \\ \{x:X_{1}\}X_{2} & =^{C∪D} & \{x:Y_{1}\}Y_{2} \end{matrix}  \begin{matrix}X_{1} =^{C} Y_{1} & & X_{2} =^{D} Y_{2} \\ [x:X_{1}]X_{2} & =^{C∪D} & [x:Y_{1}]Y_{2} \end{matrix}  \begin{matrix}X_{1} =^{C} Y_{1} & & X_{2} =^{D} Y_{2} \\ X_{1} X_{2} & =^{C∪D} & Y_{1} Y_{2} \end{matrix}

Now we have the schematic conversion algorithm:

\frac{nf (X, X′)  nf (Y, Y′)  X′ =^{C} Y′}{X ≃^{C} Y}

Lemma 2.6 For normalizing X and Y (1) if X ≃^{C} Y and φ ⊧ C then φX ≃ φY,

(2) if φX ≃ φY then there exists C such that X ≃^{C} Y and φ ⊧ C,

(3) it is decideable whether or not there exists a C such that X ≃^{C} Y.

This algorithm is not very efficient, and in practice we try to minimize the reduction involved in checking that two terms convert.

TCP Now assume that for a given normalizing PTS we have a solution to TSP, and we want to use that to solve TCP: we are given Γ, M, A, and want to decide whether or not Γ ⊢ M : A. Let X, C be an mgts for Γ, A and Y, D be an mgts for Γ, M. If C is not consistent, then A is not a type in Γ; if D is not consistent, then M has no type in Γ. If both C and D are consistent then A and X are normalizing, so use the schematic conversion algorithm to compute X ≃^{E} A. If C ∪ D ∪ E is consistent then Γ ⊢ M : A is derivable, otherwise not. (Some of the algorithms may return explicit failure which I’m reading as returning an inconsistent constraint set.)

3 Expansion Postponment and Syntax-Directed derivations

Our first goal for finding a Type Synthesis Algorithm for PTS is to find a syntax-directed derivation system equivalent to Table 5 in some way analogous to the Constructive Engine.

er-ax  • ⊢_{er} c : s  Ax(c:s)
er-start  \frac{Γ ⊢_{er} A : s}{Γ[x:A] ⊢_{er} x : A}  x fresh

er-weak  \frac{Γ ⊢_{er} α : C  Γ ⊢_{er} A : s}{Γ[x:A] ⊢_{er} α : C}  x fresh

er-pi  \frac{Γ ⊢_{er} A : s_{1}  Γ[x:A] ⊢_{er} B : s_{2}}{Γ ⊢_{er} \{x:A\}B : s_{3}}  Rule(s_{1}, s_{2}, s_{3})

er-lda  \frac{Γ[x:A] ⊢_{er} M : B  Γ ⊢_{er} \{x:A\}B : s}{Γ ⊢_{er} [x:A]M : \{x:A\}B}

er-app  \frac{Γ ⊢_{er} M : \{x:A\}B  Γ ⊢_{er} N : A}{Γ ⊢_{er} M N : [N/x]B}

er-red  \frac{Γ ⊢_{er} M : A  A ≥ B}{Γ ⊢_{er} M : B}

er-exp  \frac{Γ ⊢ M : A  Γ ⊢ B : s  B ≥ A}{Γ ⊢ M : B}

Table 6: The expansion/reduction type system (ERTS)

The only troublesome rule is conv. The natural generalization of the Constructive Engine, Table 9, does not work, and to clarify the situation we consider some intermediate systems first.

In informally describing the Constructive Engine I suggested we view the conversion rule as two rules, one for expansion and one for reduction. The system ERTS of Table 6 makes this precise.

Lemma 3.1 Γ ⊢ M : A iff Γ ⊢_{er} M : A.

Proof ⇒ By induction on the derivation of Γ ⊢ M : A. Assume the derivation ends with

conv  \frac{Γ ⊢ M : A  Γ ⊢ B : s  A ≃ B}{Γ ⊢ M : B}

By IH Γ ⊢_{er} M : A and Γ ⊢_{er} B : s. By Church-Rosser B and A have a common reduct, B′, so Γ ⊢_{er} M : B′ by red and Γ ⊢_{er} M : B by exp.

⇐ By induction on the derivation of Γ ⊢_{er} M : A. If the derivation ends with er-red, use Predicate Reduction of PTS; if it ends with er-exp, use conv.

Expansion Postponment Continuing by analogy with the Constructive engine, we try to prove that all uses of er-exp can be deferred until the end of a derivation, or equivalently that er-exp can be permuted downwards through all premisses of all rules. Consider the system

r-ax  • ⊢_{r} c : s  Ax(c:s)
r-start  \frac{Γ ⊢_{r} A : s}{Γ[x:A] ⊢_{r} x : A}  x fresh

r-weak  \frac{Γ ⊢_{r} α : C  Γ ⊢_{r} A : s}{Γ[x:A] ⊢_{r} α : C}  x fresh

r-pi  \frac{Γ ⊢_{r} A : s_{1}  Γ[x:A] ⊢_{r} B : s_{2}}{Γ ⊢_{r} \{x:A\}B : s_{3}}  Rule(s_{1}, s_{2}, s_{3})

r-lda  \frac{Γ[x:A] ⊢_{r} M : B  Γ ⊢_{r} \{x:A\}B : s}{Γ ⊢_{r} [x:A]M : \{x:A\}B}

r-app  \frac{Γ ⊢_{r} M : \{x:A\}B  Γ ⊢_{r} N : A}{Γ ⊢_{r} M N : [N/x]B}

r-red  \frac{Γ ⊢_{r} M : A  A ≥ B}{Γ ⊢_{r} M : B}

Table 7: The reduction type system (RTS)

RTS of Table 7. It is trivial that RTS is sound for PTS, i.e. that Γ ⊢_{r} M : A implies Γ ⊢ M : A. However the expansion postponment conjecture, that RTS is complete for PTS

Conjecture 3.1 (Expansion Postponment) If Γ ⊢ M : A then there exists A′ such that A ≥ A′ and Γ ⊢_{r} M : A′

has resisted all attempts to date for any interesting class of PTS. (In Section 4 I show that a class called semi-full, generalizing the full PTS, has this property.)

If we could prove Conjecture 3.1, would we have a syntax directed presentation of PTS? Asking which premisses r-red can be permuted downwards through, we get the system NSDTS of Table 8, which is equivalent to RTS.

Lemma 3.2 (1) If Γ ⊢_{nsd} M : A then Γ ⊢_{r} M : A

(2) If Γ ⊢_{r} M : A then there exists A′ such that Γ ⊢_{nsd} M : A′ and A′ ≥ A

This is straightfoward to prove.

In the Constructive Engine, reduction could be deferred through the premiss of lda. In NSDTS, reduction gets “stuck” at the left premiss of nsd-lda, and for this reason NSDTS is not syntax-directed: we cannot tell from the shape of [a:A]M how much reduction to do to find B. Can we hope to remove this deficiency? Consider system SDTS of Table 9, which is identical to NSDTS except it doesn’t allow reduction after the left premiss of the lambda rule. Clearly Γ ⊢_{sd} M : A implies Γ ⊢_{nsd} M : A, so we have, somewhat inexactly,

SDTS ⇒ NSDTS ⇔ RTS ⇒ ERTS ⇔ PTS

Expansion Postponment is the conjecture that RTS ⇐ ERTS. Now we ask whether SDT S ⇐ NSDT S, i.e. whether EP implies a system of syntax-directed derivation. For nonfunctional PTS this is false.

Notation: we write Γ ⊢_{nsd} M :≥ A for Γ ⊢_{nsd} M : A′ and A′ ≥ A.

nsd-ax • ⊢_{nsd} c : s Ax(c:s)
nsd-start \frac{Γ ⊢_{nsd} A :≥ s}{Γ[x:A] ⊢_{nsd} x : A}  x fresh
nsd-weak \frac{Γ ⊢_{nsd} α : C  Γ ⊢_{nsd} A :≥ s}{Γ[x:A] ⊢_{nsd} α : C}  x fresh
nsd-pi  \frac{Γ ⊢_{nsd} A :≥ s_{1}  Γ[x:A] ⊢_{nsd} B :≥ s_{2}}{Γ ⊢_{nsd} \{x:A\}B : s_{3}}  Rule(s_{1}, s_{2}, s_{3})
nsd-lda  \frac{Γ[x:A] ⊢_{nsd} M :≥ B  Γ ⊢_{nsd} \{x:A\}B : s}{Γ ⊢_{nsd} [x:A]M : \{x:A\}B}
nsd-app  \frac{Γ ⊢_{nsd} M :≥ \{x:A\}B  Γ ⊢_{nsd} N : A′  A ≃ A′}{Γ ⊢_{nsd} M N : [N/x]B}

Table 8: The nearly syntax-directed type system (NSDTS)

Notation: we write Γ ⊢_{nsd} M :≥ A for Γ ⊢_{sd} M : A′ and A′ ≥ A.

sd-ax  • ⊢_{sd} c : s  Ax(c:s)
sd-start  \frac{Γ ⊢_{nsd} A :≥ s}{Γ[x:A] ⊢_{sd} x : A}  x fresh
sd-weak  \frac{Γ ⊢_{sd} α : C  Γ ⊢_{nsd} A :≥ s}{Γ[x:A] ⊢_{sd} α : C}  x fresh
sd-pi  \frac{Γ ⊢_{nsd} A :≥ s_{1}  Γ[x:A] ⊢_{nsd} B :≥ s_{2}}{Γ ⊢_{sd} \{x:A\}B : s_{3}}  Rule(s_{1}, s_{2}, s_{3})
sd-lda  \frac{Γ[x:A] ⊢_{sd} M : B  Γ ⊢_{sd} \{x:A\}B : s}{Γ ⊢_{sd} [x:A]M : \{x:A\}B}
sd-app  \frac{Γ ⊢_{nsd} M :≥ \{x:A\}B  Γ ⊢_{sd} N : A′  A ≃ A′}{Γ ⊢_{sd} M N : [N/x]B}

Table 9: The syntax-directed type system (SDTS)

Example 3.2 We show that NSDTS types terms that SDTS does not type, i.e.SDT S ⇍ NSDT S, by modifying an example that Jutting [vBJ92] uses to show non-functional PTS may not have Subject Expansion.

pathological

Cnst  ∗, △, △′, □
Sort  ∗, △, △′, □
Ax  (∗:△), (∗:△′), (△:□)
Rule  (□, □, □,), (△, △′, □)

Consider A = ([x:△]∗) ∗. To compute all the types SDTS gives A, build the only possible derivation over A (since SDTS is syntax-directed!) and try to fill in any holes left un-determined due to the non-functionality of this pathological PTS. (We will use this technique more uniformly in Section 4.4.)

\frac{\frac{⋮ ; [x:△] ⊢_{sd} ∗ : X \frac{• ⊢_{sd} △ : □ ⋮ ; [x:△] ⊢_{sd} X : Z}{• ⊢_{sd} \{x:△\}X : □}}{• ⊢_{sd} [x:△]∗ : \{x:△\}X}  • ⊢_{sd} ∗ : △  △ ≃ △}{• ⊢_{sd} A : [∗/x]X}

First, Z = □ because only the first rule can be used to type {x:△}X. Now observe that X = △ or X = △′ since these are the only types of ∗. But (△′:□) ∉ Ax so X = △ is the only solution, and we have only • ⊢_{sd} A : △. (In fact, even in PTS this is the only solution. Since • ⊢ A : △, A ≥ ∗, • ⊢ ∗ : △′, but not • ⊢ A : △′, this PTS lacks Subject Expansion.)

Now observe [y:A] ⊢_{nsd} [z:∗]y : {z:∗}∗

\frac{\frac{⋮ ; [y:A] ⊢_{nsd} y : A ⋮ ; [y:A] ⊢_{nsd} ∗ : △}{[y:A][z:∗] ⊢_{nsd} y : A ≥ ∗}  \frac{⋮ ; [y:A] ⊢_{nsd} ∗ : △ ⋮ ; [y:A][z:∗] ⊢_{nsd} ∗ : △′}{[y:A] ⊢_{nsd} \{z:∗\}∗ : □}}{[y:A] ⊢_{nsd} [z:∗]y : \{z:∗\}∗}

but SDTS does not assign any type to [z:∗]y in context [y:A] as we see by trying to construct such a derivation

\frac{⋮ ; [y:A][z:∗] ⊢_{sd} y : A  \frac{⋮ ; [y:A] ⊢_{sd} ∗ : △ ⋮ ; [y:A][z:∗] ⊢_{sd} A : Y}{[y:A] ⊢_{sd} \{z:∗\}A : X}}{[y:A] ⊢_{sd} [z:∗]y : \{z:∗\}A}

By the analysis above, Y = △, but there is no rule for (△, △, ), so there is no X making this a correct derivation.

This PTS is strongly normalizing, as can be seen from the PTS-morphism [Geu90]

∗ ↦ Type(0) △ ↦ Type(1) △′ ↦ Type(1) □ ↦ Type(2)

into a predicative part of ECC. Since this mapping preserves sorts, axioms, and rules, if a term is well-typed in pathological, its image is well-typed in ECC, hence strongly normalizing. But the map also preserves redices, so the original term is strongly normalizing. It is clearly the non-functionality of pathological that is the problem.

What is the Difficulty? The difficulty in proving EP and that in proving SDT S ⇐ NSDT S are similar. In the lda rule, the predicate of the left premiss, B, occurs in the subject of the right premiss, {x:A}B. This is the only rule in which this happens. For any of the systems above without full conversion we cannot derive all types of all terms; the best correctness property we can have allows some extra conversion or reduction after a derivation. In lda, then, the B occurring in the left premiss will be different than the B occurring in the right premiss. If we could prove subject reduction of RTS the proof would go through, but the proof of subject reduction for RTS founders on the same difficulty. We have seen that SDT S ⇐ NSDT S must fail in general. (I don’t know whether it is true for functional PTS.) Is this a hint that EP fails in general? If so, is EP true for functional PTS?

Recently Jutting has been looking at alternative “well-formedness” conditions to replace the right premiss of lda. He has had great sucess in finding syntax-directed systems, which can be made into typechecking algorithms. I do not know whether this sheds any light on EP.

4 Semi-Full PTS and Typechecking

A PTS is full iff for all s_{1}, s_{2} ∈ Sort there exists s_{3} ∈ Sort such that Rule(s_{1}, s_{2}, s_{3}). In full PTS the troublesome right premiss of the lda rule can be simplified. Consider the rule

lda  \frac{Γ[x:A] ⊢ M : B  Γ ⊢ \{x:A\}B : s}{Γ ⊢ [x:A]M : \{x:A\}B}

The right premiss guarantees the type of the lambda being constructed is itself well formed. We know from the left premiss of lda that Γ ⊢ A : s_{A} for some s_{A}. Also, by Correctness of Types applied to the left premiss there is some s_{B} such that either Γ[x:A] ⊢ B : s_{B} or B = s_{B}. In the first case fullness of a PTS guarantees {x:A}B has some type. Thus, for full PTS, we can soundly replace the right premiss of lda with a side condition that B is not identically a sort that itself has no sort. We can generalize this idea somewhat beyond full PTS:

Definition 4.1 A PTS is semi-full iff for all s_{1} ∈ Sort, if there exist s_{2}, s_{3} ∈ Sort such that Rule(s_{1}, s_{2}, s_{3}), then for all s_{2} ∈ Sort there exist s_{3} ∈ Sort such that Rule(s_{1}, s_{2}, s_{3}).

While the Pure Calculus of Constructions, λP ω, and various extensions with Type universes are full, the Edinburgh Logical Framework, λP, is semi-full. Although [HHP92] proves LF is decidable, it gives an algorithm to compute the normal forms of types. The argument below shows why the algorithm actually used in LEGO, and probably in ELF, is both sound and complete.

We will give a syntax-directed derivation system for semi-full PTS, and from it derive an algorithm for typechecking which is a natural generalization of Huet’s Constructive Engine.

4.1 Aside on Topsorts

We begin with a definition and a lemma of Berardi [Ber90].

Definition 4.2 A sort s is a topsort (written s ∈ Sort^{T}) iff for all t ∈ Sort, not Ax(s:t).

Lemma 4.1 If s ∈ Sort^{T} and Γ ⊢ M : A then

(1) s does not occur in M, and

(2) if s occurs in A then s = A.

sf-ax  • ⊢_{sf} c : s  Ax(c:s)
sf-start  \frac{Γ ⊢_{sf} A : s}{Γ[x:A] ⊢_{sf} x : A}  x fresh

sf-weak  \frac{Γ ⊢_{sf} α : C  Γ ⊢_{sf} A : s}{Γ[x:A] ⊢_{sf} α : C}  x fresh

sf-pi  \frac{Γ ⊢_{sf} A : s_{1}  Γ[x:A] ⊢_{sf} B : s_{2}}{Γ ⊢_{sf} \{x:A\}B : s_{3}}  Rule(s_{1}, s_{2}, s_{3})

sf-lda \frac{Γ[x:A] ⊢_{sf} M : B Γ ⊢_{sf} A : s}{Γ ⊢_{sf} [x:A]M : \{x:A\}B} B ∉ Sort^{T} Rule(s, s_{2}, s_{3})

sf-app  \frac{Γ ⊢_{sf} M : \{x:A\}B  Γ ⊢_{sf} N : A}{Γ ⊢_{sf} M N : [N/x]B}

sf-conv  \frac{Γ ⊢_{sf} M : A  Γ ⊢_{sf} B : s  A ≃ B}{Γ ⊢_{sf} M : B}

Table 10: The typing judgement of a semi-full PTS (SFTS)

Prove (1) by straightfoward induction over the derivation of Γ ⊢ M : A. Prove (2) similarly, using (1).

The Correctness of Types lemma for PTS is somewhat unsatisfying: why doesn’t it read “If Γ ⊢ b : B then for some s ∈ Sort Γ ⊢ B : s”? The reason is the existence of topsorts, and we would like to improve Correctness of Types to read “If Γ ⊢ b : B then for some s ∈ Sort Γ ⊢ B : s or (B = s and s ∈ Sort^{T})”. This is not quite right, because even if Ax is decideable, Sort^{T} may not be. Furthermore, topsort is a negative notion; we need the more informative concept

Definition 4.3 (1) A sort, s, is a typedsort (written s ∈ Sort_{T}) iff there exists t ∈ Sort such that Ax(s:t).

(2) A PTS has the decidable typedsort property (DTP) iff for all s ∈ Sort, s ∈ Sort_{T} or s ∉ Sort_{T}.

Lemma 4.2 If a PTS has DTP and Γ ⊢ b : B then ∃s ∈ Sort such that Γ ⊢ B : s or (s ∈ Sort^{T} and B = s).

Proof By the Correctness of Types lemma, Γ ⊢ B : s or B = s. In the first case we are done. In the second case, by DTP, s ∈ Sort_{T} or s ∉ Sort_{T}. In the first case, for some t, Ax(s:t); hence Γ ⊢ B : t. In the second case s ∈ Sort^{T} as required.

4.2 Deriving the Judgement of Semi-Full PTS

For semi-full PTS with DTP, the derivation system SFTS of Table 10 is sound and complete with respect to the system PTS of Table 5.

Lemma 4.3 For a semi-full PTS with DTP

(1) if Γ ⊢ M : A then Γ ⊢_{sf} M : A, and

(2) if Γ ⊢_{sf} M : A then Γ ⊢ M : A.

Proof (1) By induction over the derivation of Γ ⊢ M : A. The only interesting case is lda, so assume the derivation ends with

lda  \frac{⋮ ; Γ[x:A] ⊢ M : B  ⋮ ; Γ ⊢ \{x:A\}B : s}{Γ ⊢ [x:A]M : \{x:A\}B}

By IH Γ[x:A] ⊢_{sf} M : B and Γ ⊢_{sf} {x:A}B : s. By the Generation Lemma for SFTS, there exists s_{A}, s_{B}, s_{3} ∈ Sort such that Γ ⊢_{sf} A : s_{A}, Γ[x:A] ⊢_{sf} B : s_{B}, and Rule(s_{A}, s_{B}, s_{3}). Lemma 4.1 on the right IH shows B ∉ Sort^{T}. Thus, by sf-lda conclude Γ ⊢_{sf} [x:A]M : {x:A}B.

(2) By induction over the derivation of Γ ⊢_{sf} M : A. The only interesting case is sf-lda, so assume the derivation ends with

sf-lda \frac{⋮ ; Γ[x:A] ⊢_{sf} M : B  ⋮ ; Γ ⊢_{sf} A : s}{Γ ⊢_{sf} [x:A]M : \{x:A\}B} B ∉ Sort^{T} Rule(s, s_{2}, s_{3})

By IH Γ[x:A] ⊢ M : B and Γ ⊢ A : s. By Lemma 4.2 on the left IH and the fact that B ∉ Sort^{T}, there is a sort s_{B} such that Γ[x:A] ⊢ B : s_{B}. Since we are in a semi-full PTS, there is a sort t with Rule(s, s_{B}, t). By pi and lda conclude Γ ⊢ [x:A]M : {x:A}B.

4.3 A Syntax-Directed System for Semi-Full PTS

System SFTS is not syntax-directed, but sf-lda does not have the troublesome right premiss. It is now straightfoward to give a syntax-directed system, SDSFTS of Table 11, which is sound and complete for SFTS.

Lemma 4.4 For a semi-full PTS with DTP:

(1) if Γ ⊢_{sdsf} M : A then Γ ⊢_{sf} M : A,

(2) if Γ ⊢_{sf} M : A then there exists A′ s.t. Γ ⊢_{sdsf} M : A′ and A ≃ A′.

Proof (1) By induction over the derivation of Γ ⊢_{sdsf} M : A, noticing that by Lemma 4.3 SFTS has Predicate Reduction for semi-full PTS with DTP. We do the case where the derivation ends with sdsf-app

sdsf-app  \frac{⋮ ; Γ ⊢_{sdsf} M :≥ \{x:A\}B  ⋮ ; Γ ⊢_{sdsf} N : A′  A ≃ A′}{Γ ⊢_{sdsf} M N : [N/x]B}

By IH Γ ⊢_{sf} M : K where K ≥ {x:A}B, and Γ ⊢_{sf} N : A′ where A ≃ A′. By Church-Rosser A and A′ have a common reduct, A′′. Thus K ≥ {x:A′′}B, and by Predicate Reduction Γ ⊢_{sf} M : {x:A′′}B. By sf-app conclude Γ ⊢_{sf} M N : [N/x]B as required.

sdsf-ax  • ⊢_{sdsf} c : s  Ax(c:s)
sdsf-start \frac{Γ ⊢_{sdsf} A :≥ s}{Γ[x:A] ⊢_{sdsf} x : A}  x fresh

sdsf-weak \frac{Γ ⊢_{sdsf} α : C  Γ ⊢_{sdsf} A :≥ s}{Γ[x:A] ⊢_{sdsf} α : C}  x fresh

sdsf-pi  \frac{Γ ⊢_{sdsf} A :≥ s_{1}  Γ[x:A] ⊢_{sdsf} B :≥ s_{2}}{Γ ⊢_{sdsf} \{x:A\}B : s_{3}}  Rule(s_{1}, s_{2}, s_{3})

sdsf-lda \frac{Γ[x:A] ⊢_{sdsf} M : B Γ ⊢_{sdsf} A :≥ s}{Γ ⊢_{sdsf} [x:A]M : \{x:A\}B} B ∉ Sort^{T} Rule(s, s_{2}, s_{3})

sdsf-app  \frac{Γ ⊢_{sdsf} M :≥^{wh} \{x:A\}B  Γ ⊢_{sdsf} N : A′  A ≃ A′}{Γ ⊢_{sdsf} M N : [N/x]B}

Table 11: The syntax-directed semi-full type system (SDSFTS)

(2) By induction over the derivation of Γ ⊢_{sf} M : A. We do one case. Assume the derivation ends with sf-lda

sf-lda \frac{⋮ ; Γ[x:A] ⊢_{sf} M : B  ⋮ ; Γ ⊢_{sf} A : s}{Γ ⊢_{sf} [x:A]M : \{x:A\}B} B ∉ Sort^{T} Rule(s, s_{2}, s_{3})

By IH Γ[x:A] ⊢_{sdsf} M : B′ where B′ ≃ B, and Γ ⊢_{sdsf} A :≥ s. In order to conclude Γ ⊢_{sdsf} [x:A]M : {x:A}B′ by sdsf-lda it remains to show B′ ∉ Sort^{T}. If B′ = t ∈ Sort^{T} then B ≥ t so t occurs in B. Notice that Γ[x:A] ⊢ M : B by Lemma 4.3 (2) applied to the left premiss, hence B = t by Lemma 4.1; but this contradicts the given side condition.

Finally, we could apply the optimization, discussed in Section 1.2, which avoids duplicating the context validity check. Since this is straightfoward I forego this extra step.

4.4 A Typechecking Algorithm for Semi-Full PTS

SDSFTS of Table 11 is syntax directed. In the case of a normalizing, functional PTS with finite Sort we can already view SDSFTS as a type synthesis algorithm in straightfoward generalization of the PCC example of Section 1.2. (Thus, for LF, we are done.) In general two more problems arise: in systems with infinite Sort it may be undecidable if there is an axiom for a given constant c, or a rule for given s_{1}, s_{2}; in non-functional systems we won’t know which of several axioms for c to choose, or which of several rules for s_{1}, s_{2}. These problems are reduced to a decision problem about the sorts, axioms and rules of the PTS by making these decisions schematically and collecting the conditions constraining the schematic choices. This subsection follows [HP91], where more details of a related application of the same ideas can be found. The same technique can be used to derive algorithms from syntax-directed derivation systems for other classes of type theory, such as the systems of Jutting.

Notation: we write Γ ⊢_{ds} M ⇒≥ X, C for Γ ⊢_{ds} M ⇒ X′, C, C consistent, and X′ ≥ X.

ds-ax  • ⊢_{ds} c ⇒ σ, {Ax(c:σ)}  σ fresh
ds-start  \frac{Γ ⊢_{ds} A ⇒≥ σ, C}{Γ[x:A] ⊢_{ds} x ⇒ A, C}  x fresh

ds-weak  \frac{Γ ⊢_{ds} α ⇒ X, C  Γ ⊢_{ds} A ⇒≥ σ, D}{Γ[x:A] ⊢_{ds} α ⇒ X, C ∪ D}  x fresh

ds-pi  \frac{Γ ⊢_{ds} A ⇒≥ σ_{1}, C  Γ[x:A] ⊢_{ds} B ⇒≥ σ_{2}, D}{Γ ⊢_{ds} \{x:A\}B ⇒ σ_{3}, C ∪ D ∪ \{Rule(σ_{1}, σ_{2}, σ_{3})\}}  σ_{3} fresh

ds-lda  \frac{Γ[x:A] ⊢_{ds} M ⇒ X, C  Γ ⊢_{ds} A ⇒≥ σ, D}{Γ ⊢_{ds} [x:A]M ⇒ \{x:A\}B, C ∪ D ∪ \{B ∉ Sort^{T} \} ∪ \{Rule(σ, σ_{2}, σ_{3})\}} σ_{2}, σ_{3} fresh

ds-app  \frac{Γ ⊢_{ds} M ⇒≥^{wh} \{x:X\}Y , C Γ ⊢_{ds} N ⇒ X′, D C ∪ D consistent X ≃^{E} X′}{Γ ⊢_{ds} M N ⇒ [N/x]Y, C ∪ D ∪ E}

Table 12: Derivation schemes for the syntax-directed semi-full type system (SDSFDS)

Recall the discussion of schematic terms in Section 2.3. For our current purposes a constraint is one of the expressions Ax(c:σ), Rule(σ_{1}, σ_{2}, σ_{3}), σ_{1} = σ_{2}, or B ∉ Sort^{T}. We henceforth assume that the consistency of any set of constraints is decidable (notice that this implies DTP). For example, if Sort is finite (as in LF) this is clearly the case; a system such as LF extended with infinitely many stratified universes also has this property.

4.4.1 Schematic Typing

Table 12 is a system for derivation schemes of the system SDSFTS. The judgements of SDSFDS have the shape Γ ⊢_{ds} M ⇒ X, C. All the constraints that must be satisfied for an instance of X to be a correct type of M in Γ are collected in C.

Lemma 4.5 For a semi-full PTS with consistency of constraint sets decidable, if Γ ⊢_{ds} M ⇒ X, C then X, C is a mgts for Γ, M.

SDSFDS has an algorithmic interpretation returning failure if Γ, M has no type, or an mgts for Γ, M

References

[Bar91] Henk Barendregt. Introduction to generalised type systems. J. Functional Programming, 1(2):124–154, April 1991.

[Bar92] Henk Barendregt. Lambda calculii with types. In Gabbai Abramsky and Maibaum, editors, Handbook of Logic in Computer Science, volume II. Oxford University Press, 1992.

[Ber90] Stefano Berardi. Type Dependence and Constructive Mathematics. PhD thesis, Dipartimento di Informatica, Torino, Italy, 1990.

[CH88] Thierry Coquand and Gérard Huet. The calculus of constructions. Information and Computation, 76(2/3):95–120, February/March 1988.

[Geu90] Herman Geuvers. Type systems for higher order logic. 1990.

[GN91] Herman Geuvers and Mark-Jan Nederhof. A modular proof of strong normalization for the calculus of constructions. Journal of Functional Programming, 1(2):155–189, April 1991.

[Hel91] Leen Helmink. Goal directed proof construction in type theory. In Logical Frameworks. Cambridge University Press, 1991.

[HHP87] Robert Harper, Furio Honsell, and Gordon Plotkin. A framework for defining logics. In Proceedings of the Symposium on Logic in Computer Science, pages 194–204, Ithaca, New York, June 1987.

[HHP92] Robert Harper, Furio Honsell, and Gordon Plotkin. A framework for defining logics. Journal of the ACM, 1992. to appear.

[HP91] Robert Harper and Robert Pollack. Type checking with universes. Theoretical Computer Science, 89:107–136, 1991.

[Hue87] Gérard Huet. The constructive engine, March 1987. Invited talk at ESOP’88. Not in proceedings.

[LP92] Zhaohui Luo and Robert Pollack. LEGO proof development system: User’s manual. Technical Report ECS-LFCS-92-211, LFCS, Computer Science Dept., University of Edinburgh, The King’s Buildings, Edinburgh EH9 3JZ, May 1992. Updated version.

[Luo90] Zhaohui Luo. An Extended Calculus of Constructions. PhD thesis, Department of Computer Science, University of Edinburgh, June 1990.

[Pfe89] Frank Pfenning. Elf: A language for logic definition and verified mataprogramming. In Proceedings of the Fourth Annual Symposium on Logic in Computer Science, Asilomar, California, June 1989.

[vBJ92] L.S. van Bentham Jutting. Typing in pure type systems. Information and Computation, 1992. To appear.

A Relevant Analysis of Natural Deduction

David Pym and Gordon Plotkin, Edinburgh

Abstract

We discuss a first-order dependent type theory based on a fragment of intuitionistic linear logic. We discuss the use of this type theory as a framework for the analysis of natural deduction presentations of weak logics.

Fixed point and type systems

Christophe Raffalli, Paris 7

Abstract

We study an extension of AF2 type system (system F + first order + equations). This extension adds two new quantifiers on formulas: least fixpoint (inductive types) and greatest fixpoint (co-inductive types). We denote them respectively by mu and nu.

In this system we prove the following results :

1. We have found conditions on types and proofs which ensure that all typed terms are hereditarily solvable (their Bohm-tree don’t contain any bottom). The surprising fact is that the condition is stronger with least fixpoint (inductive types) than for the system with only greatest fixpoint. The condition for the system with only greatest fixpoint is that there is nowhere in the proof a subformula “nu X.F” where X is strictly positive in F (in particular no “nu X.X” in the proof). Concerning the least fixpoint, the condition concern all subformulas in the proof and have the same complexity than decision of propositional classical logic.

2. We have also found in this system, a representation for inductive and co-inductive data. This types are such that each data has a unique normal representation (in fact a unique Bohm-tree). For instance, this allows a construction of the data-type of streams, ensuring unicity of the representation of each stream.

3. We can build a non-standard representation for natural numbers using the greatest fixpoint, with which one can encode all partial recursive functions.

An Overview of the MIZAR Project

Piotr Rudnicki^{∗} Department of Computing Science University of Alberta Edmonton, Alberta, Canada T6G 2H1

                       e-mail: piotr@cs.ualberta.ca

June 30, 1992

Abstract The Mizar project is a long-term effort aimed at developing software to support a working mathematician in preparing papers. A. Trybulec, the leader of the project, has designed a language for writing formal mathematics. The logical structure of the language is based on a natural deduction system developed by Jaśkowski. The texts written in the language are called Mizar articles and are organized into a data base. The Tarski-Grothendieck set theory forms the basis of doing mathematics in Mizar. The implemented processor of the language checks the articles for logical consistency and correctness of references to other articles.

1 Introduction

The idea that an automatic device should check our logical derivations is by no means new. It can be traced back not only to Pascal and Leibniz, but to Ramon Llull. In recent years, several projects have aimed at providing computer assistance for doing mathematics. Among the better known there are: AUTOMATH [4], EKL [10], QUIP [22], Nuprl [3], THEAX [14], Computational Logic [2], Ontic [11], and the more recent ones such as ALF, ELF, HOL, LEGO and many others (see [6, 7]). The specific goals of these projects vary. However, they have one common feature: the human writes mathematical texts and the machine verifies their correctness.

The project Mizar started almost 20 years ago under the leadership of Andrzej Trybulec at the Płock Scientific Society, Poland. Its original goal was to design and implement a software environment to assist the process of preparing mathematical papers. For lack of a better alternative, the project was based upon the style of doing mathematics used by the mathematicians of the so-called Polish mathematical school. Therefore, the project can be seen as an attempt to develop software environment for writing traditional mathematical papers, where classical logic and set theory form the basis of all future developments.

The logical basis of the system is a “Polish” style of natural deduction. Only after years of using the logic has it been learned that it was the “composite system of logic” developed by Stanisław Jaśkowski, see [8] and [12] for the English translation. Katuzi Ono, [16] described a similar system. Various formalizations of set theory have been tried (Zermelo-Fraenkel, Morse-Kelley) but finally the Tarski-Grothendieck axiomatization has been adopted.

∗This work was supported in part by NSERC Grant OGP9207.

2 A bit of history

The name Mizar^{1} was picked up in 1973 for a different project (a programming environment) that was discontinued, but its name has been recycled.

The first experiments in 1974-75 developed a modest proof-checker for propositional logic. The main concern of A. Trybulec was the input language to the checker, and it turned out to be the main concern for all future years. The proof checker was based on a fixed set of inference rules. The justification of an inference in the input text required the user to state only the premises and the conclusion; the checker searched for a rule or a sequence of rules to validate an inference step. This approach was abandoned, and all future Mizar processors have used model checking.

In 1977 the language and the checker were extended with quantifiers to form Mizar QC which had neither functional notation nor definitional facilities. These were added in subsequent years to form the Mizar FC system, which was used to record a number of larger texts. Among these texts was the initial segment of the book on arithmetics by Grzegorczyk [5]. The book is so rigorous and detailed (the Chinese remainder theorem comes as late as page 67 and its proof takes 6 pages) that the blow-up factor in the translation to Mizar FC was negligible.

At around 1978-1979 the Mizar group started to grow substantially, being anchored at Warsaw University, Białystok^{2} Branch^{3}.

In 1981, a language called Mizar 2 had been designed by A. Trybulec and implemented on an ICL 1900 by Cz. Byliński, H. Oryszczyszyn, P. Rudnicki, and A. Trybulec. The system was written in Pascal and later ported to other computers (mainframe IBM and also to UNIX). Again, the stress was on the input language. The proof checker was rather weak which forced one to write very detailed proofs. The language included the following features: structured types, type hierarchy, comprehensive definitional facilities, built-in fragments of arithmetics, and a built-in variant of set theory. The translations into Mizar 2 included: a number of recent papers in topology, projective geometry, and some text-book algebra. In one of the experiments, the pigeon-hole principle was proven from scratch and compared with the similar development by van Benthem Jutting [28] in AUT-QE (the AUTOMATH project). The Mizar 2 text was about half as long as the AUT-QE text; however, Mizar 2 and AUT-QE were substantially different environments for conducting proofs (logic based vs type based). Among other works with Mizar 2, there were attempts to prove properties of programs [21] and software specifications [20].

In the following years, other Mizar languages and their implementations have been developed but their character was experimental (Mizar 3, Mizar HPF); the systems were not distributed outside the Mizar group in Białystok, with one exception.

1Mizar, ζ Ursae Majoris, is the second magnitude star set in the middle of the Big Dipper’s handle; Mizar (Arabic: veil, cloak, burial grounds) makes a visual binary with the fainter Alcor (Arabic: faint one); each of the visual components is a spectroscopic binary; Mizar is a quadruple star.

Incidentally, Algol (Arabic: daemon, ghoul), β Persei, is an eclipsing visual binary star, spectroscopically a triple, probably a quadruple star as well.

2E. Post was born in Augustów, near Białystok. A. Lindenbaum was last seen in Białystok in 1941.

3Address: Mizar Group, Institute of Mathematics, Warsaw University—Białystok Branch, 15-276 Białystok, Poland.

A subset of Mizar, named Mizar MSE (short for \underline{M}ulti-\underline{S}orted with \underline{E}quality) was implemented in 1982 by R. Matuszewski, P. Rudnicki, and A. Trybulec and has been widely used since then. The system is meant for teaching elementary logic with emphasis on the practical aspects of constructing proofs. The Mizar MSE language encompasses ‘raw’ predicate calculus, multisorted with equality, but the language does not provide functional notation or special notation for definitions. There are numerous implementations of Mizar MSE, see [26, 25, 13, 19, 18, 15].

In 1986, Mizar 4 was implemented as a redesign of Mizar 2 and distributed to several dozen users. Each Mizar 4 article included a preliminaries part where the author could state some axioms that were not checked for validity.

In 1988 the design of the language was completed by A. Trybulec and the final language is named simply Mizar. While articles in previous versions of the language must be self-contained, the final Mizar allows for cross-references among articles. Moreover, an author of a Mizar text is not allowed to introduce new axioms. Only the predefined axioms can be used, everything else must be proved. The two articles that are not checked for validity contain an axiomatics of the Tarski-Grothendieck set theory (see Appendix A) and definitional axioms of the built-in concepts and axioms of strong arithmetics of real numbers (see Appendix B).

Recently, the main effort in the Mizar project has been in building the library of Mizar articles which now numbers almost 300.

The development of Mizar has been driven by “experience, not only doctrine (ENOD for short)”^{4}. In this case it meant that any idea that made sense was first of all implemented and tried by its proponent. However, only after other users approved the idea by actually using its implementation, was the idea included into the state of the project. The ENOD approach has been applied in the development of the Mizar processor, the input language (although it is almost exclusively of A. Trybulec’s creation), and the Mizar library.

Before giving more information about Mizar it may be worthwhile to recall here the Formulaire de mathématiques project of Giuseppe Peano (quoted from Kennedy [9] p. 8):

The end result of this project would be, he hoped, the publication of a collection of all known theorems in the various branches of mathematics. The notions of his mathematical logic were to be used and proofs of the theorems were to be given. There were five editions of the Formulario: the first appeared in 1895, and the last, completed in 1908, contained some 4200 theorems.

The project was based on a formal language. In the introduction to the second volume of Formulaire de mathématiques, Peano writes (quoted from [17], p. 197, vol. II):

Dans le petit livre ≪Arithmetices principia, nova methodo exposita, a. 1889≫, nous avons pour la première fois exposé toute une théorie, théorèmes, définitions et démonstrations, en symboles qui remplacent tout-à-fait le langage ordinaire.

Nous avons donc la solution du problème proposé par Leibniz.

3 Anatomy of a Mizar article

Each Mizar article is written as a text file. The general structure of such an article is as follows:

4The expression has been coined by G. Kreisel, see his contribution in Logic and Computer Science, P. Odifreddi (ed.), Academic Press, pp. 205–278.

             environ

Environment directives

             begin

Text-Proper Section

…

…

             begin

Text-Proper Section

The Text-Proper contains statements of facts with their proofs and definitions of new concepts with justification of their correctness. The Environment directives declare which items of the Mizar library can be referenced from the Text-Proper. The directive

vocabulary Vocabulary-File-Name;

adds the symbols introduced in the Vocabulary-File-Name to the article’s lexicon. Vocabulary files introduce new symbols of Mizar expression constructors. The vocabularies also indicate the binding strength of the introduced symbols for parsing purposes. The authors can use existing vocabularies (there are hundreds of symbols there) and also are free to create new ones. The lexical make-up of new symbols is governed by a small set of quite liberal rules. The authors can freely enhance the zoo of mathematical symbols with new symbols of their own design.

One vocabulary is automatically attached to every Mizar article. It introduces the following symbols: Element, Subset, DOMAIN, Real, Nat, +, <>, ≤, ∈, and the like. The information pertaining to the usage of these symbols is built into the Mizar processor, e.g. ∈ can be used as a binary, infix predicate symbol with both arguments expandable to type set. Similarly, ≤ requires two arguments of type expandable to Element of Real.

Besides vocabularies, there are four kinds of data base directives:

signature Signature-File-Name; definitions Definitions-File-Name; theorems Theorems-File-Name; schemes Schemes-File-Name;

The directive signature informs the Mizar processor that the article is permitted to use the notation (definienda) introduced in article Signature-File-Name.

Any article can define ways in which the symbols contained in vocabularies can be used to form Mizar expressions. Each of the Mizar expression constructors (functor, predicate, mode) can be syntactically defined in a number of formats. These constructors may take various numbers of arguments of various types, and in the case of functors they may return results of various types. This creates a complicated system of overloaded constructors. The information needed for parsing is kept in auxiliary files associated with every article and commonly referred to as the signature of the article.

The remaining three directives allow us to use definitions, theorems, and schemes that are defined or proved in another article.

The Text-Proper is a sequence of sections, each being a sequence of Text-Item. There are the the following kinds of items:

• Reservation is used to reserve identifiers for a type. If a variable has an identifier reserved for a type, and no explicit type is stated for the variable, then the variable type defaults to the type for which its identifier was reserved.

• Definition-Block is used to define (or redefine) constructors of Mizar phrases: term constructors (functions), formula constructors (predicates), and type constructors (modes).

• Structure-Definition introduces new structures. A structure is an entity that consists of a number of fields that are accessed by selectors.

• Theorem announces a proposition that can be referenced from other articles.

• Scheme also announces a proposition, visible from outside. Second order terms can occur in scheme.

• Auxiliary-Item introduces objects that are local to the article in which they occur and are not exported to the library files (e.g. lemmas, definitions of local predicates).

The goal of writing an article is to prove some theorems and schemes or to define some new concepts such that they can be referenced by other authors. Before the theorems and definitions are included into the library they must be proved valid and correct.

4 The PC Mizar

PC Mizar is a Mizar processor implemented on IBM PCs under DOS by Cz. Byliński, A. Trybulec, and S. Żukowski, and now further developed by the first two authors.

The central concept of Mizar is a Mizar article. Such an article can be viewed as an extremely detailed mathematical text written in a fixed formal notation, originally as a text file. There are rather few interesting things that one can prove in a short Mizar article without making references to other articles. Usually, we base our work on the achievements of others.

The power of the Mizar system is in its automatic processing of cross-references among articles contained in the Mizar library. In order to speed up the process of cross reference checking, some internal files, derived from the submitted articles, are maintained. These files (they are not meant to be read by humans) are created in the process of including an article into the Mizar library.

• signature files that for each newly defined constructor of Mizar phrases in the article give information necessary for parsing the constructor occurrences.

• definitions file stores the definiens of every definition in the article, the definiendum is stored in the signature file.

• theorems file stores the theorems proved in the article (without proofs).

• schemes file stores the schemes proved in the article (without proofs).

The Mizar software is a collection of about 50 programs that process Mizar articles.

• The verifier must run in the appropriate environment with access to all the vocabulary and library files referenced in the given article. For efficiency reasons, each checked article obtains a dedicated environment (by a program called accommodator) in order to avoid too many references to different library files.

• Parsing of Mizar texts is relatively complicated mainly because of the rich Mizar syntax, multi-way overloading of names, and new definitions or redefinitions of Mizar phrase constructors and their priorities.

• Checking whether proofs are correctly structured requires some processing as Mizar permits a multitude of proof structures in the spirit of natural deduction proposed by Jaśkowski.

• An inference of the form

premise_{0}, premise_{1}, …, premise_{k} ⊢ conclusion

is transformed into the conjunction

premise_{0} & premise_{1} & … & premise_{k} & not conclusion.

If the checker finds the conjunction contradictory then the original inference is accepted. Unfortunately but inevitably, the checker sometimes does not accept an inference that is logically correct; to get the inference accepted one has to split it into a sequence of ‘smaller’ ones, or possibly use a proof structure. The stress in the inference checker is on the processing speed, not power.

5 The Input Language

Experience has shown that people with even minimal mathematical training develop a good idea about the nature of the Mizar language just by browsing through a sample article. This is not a big surprise as one of the original goals of the project was to build an environment that mimics the traditional ways that mathematicians work. A sample Mizar article is presented in Appendix C.

Because of the richness of the Mizar grammar, even a sketchy presentation of it is far beyond the scope of this text.

6 Mizar abstracts

The source texts of Mizar articles tend to be lengthy as they contain complete proofs in a rather demanding formalism. New articles strongly depend on already existing ones. Therefore, there was a need to provide authors with a quick reference to the already collected articles. The solution was to automatically create an abstract for each Mizar article. Such an abstract includes a presentation of all the items that can be referenced from other articles. The abstract of the article presented in Appendix C is contained in Appendix D. Therefore, there is no need to examine the entire article to make a reference to a single theorem.

To make the abstracts resemble a mathematical paper at least at the lexical level, they are automatically typeset using TEX. The TEXed Mizar abstract from Appendix D is in Appendix E.

The typeset Mizar abstracts are periodically published^{5} by Université Catholique de Louvain as Formalized Mathematics (a computer assisted approach) with R. Matuszewski as editor.

5For more information write to: Fondation Philippe le Hodey, Mizar Users Group, Av. F. Roosevelt 134 (Bte7), 1050 Brussels, Belgium, fax +32 (2) 640 89 68

7 Main Mizar Library

At the beginning of 1989, the Mizar group in Białystok started collecting Mizar articles and organizing them into a library that is distributed to other Mizar users.

The person responsible for the library (E. Woronowicz) requires that authors of contributed articles supply an additional file that describes the bibliographic data such as title, authors’ names and affiliations, and a summary (in English). The bibliographic information is included at the beginning of each typeset abstract.

As of June 19, 1992, the library consisted of 279 Mizar articles authored by some 60 people. 214 theorem files that are referenced from other articles contained 5810 theorems; there were 109903 cross-references among articles. Totally there were about 15 MB of source text files with articles. Although the majority of articles have been authored by people from Białystok, many papers have been written by mathematicians from other universities in Poland, and there are articles written by foreign authors (Canada, Japan, Spain, USA).

The nature of the articles varies. Most of them are Mizar translations of basic mathematics. Few of them contain new results. To get an idea about the contents of the library, look at Table 13 for a sample of article titles.

No. Name  Inclusion date Title  Author(s)

1 BOOLE 6.I.1989 Boolean Properties of Sets Z. Trybulec and H. Świe‘czkowska

17 FUNCT 2 6.IV.1989 Functions from a Set to a Set

Cz. Byliński

33 WELLORD2 26.IV.1989 Zermelo Theorem and Axiom of Choice

G. Bancerek

67 FRAENKEL 7.II.1990 Function Domains and Fraenkel Operator

A. Trybulec

106 TRANSLAC 12.VI.1990 Translations in Affine Planes H. Oryszczyszyn and K. Prażmowski

185 MEASURE1 15.X.1990 The σ-additive Measure Theory

J. Białas

231 ALI2 17.VII.1991 Fix Point Theorem for Compact Spaces

A. de la Cruz

248 HEINE 21.XI.1991 Heine-Borel’s Covering Theorem A. Darmochwał and Y. Nakamura

274 MIDSP 3 28.V.1992 Reper Algebras

M. Muzalewski

Table 13: Sample of titles from Mizar library.

The development of the Mizar library may be perceived as an experiment in the sociology of mathematics. The acceptance criteria are very liberal: every submitted paper that is accepted by the Mizar processor is included into the library. There are some efforts towards having automated reviewers (that looks, for example, for repeated theorems or trivial ones). There is a collection of programs called enhancers and improvers that try to automatically meliorate the submitted articles. The melioration makes changes in the submitted articles, that is, replaces a proof by a one step inference referencing a number of propositions, or replaces a sequence of inferences by a single one, or removes references to the superfluous premises in an inference step.

As the Mizar system evolves, and this includes the input language, there is a need to rewrite pieces of the library articles to mirror the changes. To a large extent, this is done automatically. Sometimes, however, a manual intervention is required.

The people maintaining the library collect statistics about the references across articles. Consideration is given to whether or not the frequently quoted theorems or definition should be built into the Mizar verifier. This was the fate of proposition TARSKI:1 which stated that everything was a set, see Appendix A.

Table 14 contains the list of the 10 most frequently quoted theorems.

No. of % of all Name Statement of the theorem

ref.  ref.

2347 2.1355% BOOLE:11 x ∈ X & X ⊆ Y implies x ∈ Y 1642 1.4940% BOOLE:9 x ∈ X∩Y iff x ∈ X & x ∈ Y 1558 1.4176% TARSKI:3 X = {y} iff for x holds x ∈ X iff x = y 1349 1.2274% BOOLE:8 x ∈ X∪Y iff x ∈ X or x ∈ Y 1252 1.1392% BOOLE:def 1 Z = ∅ iff not ex x st x ∈ Z 1242 1.1301% BOOLE:29 X ⊆ Y & Y ⊆ Z implies X ⊆ Z 964 0.8771% FINSEQ 1:13 k = len p iff Seg k = dom p

922 0.8389% BOOLE:64     (X∪Y)∪Z = X∪(Y∪Z)

848 0.7716% BOOLE:5 X ⊆ Y iff for x holds x ∈ X implies x ∈ Y 792 0.7206% AXIOMS:2 X is Subset of Y iff X ⊆ Y

Table 14: Top 10 theorems of Mizar library.

8 The future

The Mizar language: The logical level of the language has long been fixed. It is the type hierarchy that fuels all the changes. Recently, the development has focused on introducing a mechanism for deriving Mizar structures in the spirit of the object-oriented approach, and on deriving new Mizar modes by adding attributes to existing ones. Both proposed derivation techniques result in Boolean algebras of structures and sets of attributes, respectively. According to A. Trybulec both these changes will have a dramatic impact on the style of doing mathematics in Mizar.

The language still lacks some polymorphic or generic facilities such that one has to prove analogous facts twice, for example, about lower and upper semilattices.

Translations: It is planned to implement the mechanical translation of Mizar texts into other existing systems for doing mathematics, and vice versa. However, H. Barendregt’s optimism on the time frame required for such a work is not commonly shared.

Large data base: A large data base would require a major effort from numerous parties and the administrative problems of such an enterprise should not be neglected. It is estimated that maintenance of a data base 10 times bigger than the current state (i.e. with about 3000 articles by several hundred authors) could stabilize a number of issues whose current solutions tend to be unstable.

Presentation: The usefulness of Formalized Mathematics containing typeset abstracts instigated some thoughts on typesetting entire Mizar articles. Similarly, a need arises to develop some automated techniques for extracting topical monographs from the Mizar library.

Accommodator: The process of preparing a local environment for checking a single article awaits a better solution. The problem here is similar to linking a newly written program with library modules, known to be a challenge in software engineering. An accommodator is expected to speed up the process of checking articles by cutting off the complex data base interaction at a certain level.

Neglected issues: There are some aspects of the Mizar system that draw immediate criticism. To name a few: restriction to IBM PC and compatibles; poor user interface restricted to the text editor level; only textual searches of the data base; weak inference checker. All of them have been recognized as problems to work on but were perceived as second priority issues. Eventually, they have to be addressed.

Hibernation: Freezing the changes in the input language and in the Mizar processor has been a goal for quite a while, yet it seems to move away like the horizon when you try to approach it.

9 How to learn Mizar?

The Mizar language, its processor, and the organization of the Mizar library evolve, and therefore there is not much in the way of written documentation, see [1].

In the face of documentation shortages the best way to learn Mizar is to spend approximately four weeks in Białstok^{6} and co-author a Mizar article with a native user of the system. However, numerous cases are known of Mizar users who that advanced their knowledge of the system by studying the existing texts (and there are 15MB of these).

Acknowledgements

I am indebted to all members of the Mizar development group (which I was a member of years ago) and to all the authors of articles in Mizar Library. Special thanks are to Andrzej Trybulec, Roman Matuszewski, Czesław Byliński, Edmund Woronowicz, Grzegorz Bancerek, and Zbigniew Karno.

This “commercial” has been written with the hope that their work meets with the recognition it deserves.

6Other places include: Łódź and Rzeszów in Poland, Madrid in Spain, and Nagano in Japan.

References

[1] Ewa Bonarska. An Introduction to PC Mizar. Mizar Users Group. Fondation Philippe le Hodey, Brussels, 1990.

[2] R. S. Boyer and J. S. Moore. A Computational Logic Handbook. Academic Press, 1988.

[3] R.L. Constable et al. Implementing Mathematics with the Nuprl Proof Development System. Prentice-Hall, 1986.

[4] N. G. de Bruijn. A survey of the project AUTOMATH. In J. P. Seldin and Hindley J. R., editors, Essays in Combinatory Logic, Lambda Calculus, and Formalism, pages 589–606. Academic Press, 1980.

[5] Andrzej Grzegorczyk. Zarys arytmetyki teoretycznej. PWN Warszawa, 1971.

[6] G. Huet and G. Plotkin, editors. Proceedings of the 1st Workshop on Logical Frameworks. ESPRIT BRA 3245, 1990. Anonymous ftp: nuri.inria.fr.

[7] G. Huet and G. Plotkin, editors. Proceedings of the 2nd Workshop on Logical Frameworks. ESPRIT BRA 3245, 1991. Anonymous ftp: colonsay.dcs.ed.ac.uk.

[8] S. Jaśkowski. On the rules of supposition in formal logic. Studia Logica, 1, 1934.

[9] H. C. Kennedy, editor. Selected works of Giuseppe Peano. University of Toronto Press, 1973.

[10] J. Ketonen. EKL—a mathematically oriented proof checker. In Proceedings of 7th Int. Conf. on Automated Deduction, pages 65–79, Napa, CA, May 1984.

[11] D. A. McAllester. Ontic. The MIT Press, 1989.

[12] S. McCall, editor. Polish Logic in 1920–1939. Clarendon Press, Oxford, 1967.

[13] M. Mostowski and Z. Trybulec. A certain experimental computer aided course of logic in Poland. In Proceedings of World Conference on Computers in Education, Norfolk, VA, 1985.

[14] Y. Nakamura. A language for description of mathematics—THEAX. Technical report, Shinshu University FIE, Nagano City, Japan, 1985. In Japanese.

[15] S. Nieva Soto. The Reasoner of MIZAR/LOG. Computerized Logic Teaching Bulletin, 2(1):22–35, March 1989.

[16] K. Ono. On a practical way of describing formal deductions. Nagoya Mathematical Journal, 21, 1962.

[17] Giuseppe Peano. Opere Scelte. Edizioni Cremonese, Roma, 1958.

[18] K. Prażmowski, P. Rudnicki, et al. Mizar-MSE Primer and User Guide. TR 88-9, The University of Alberta, Department of Computing Science, Edmonton, 1988.

[19] P. Rudnicki. Obvious inferences. Journal of Automated reasoning, 3:383–393, 1987.

[20] P. Rudnicki. What should be proved and tested symbolically in formal specifications? In 4th IEEE International Workshop on Software Specification and Design, pages 190–195, Monterey, Ca., 1987.

[21] P. Rudnicki and W. Drabent. Proving properties of Pascal programs in MIZAR 2. Acta Informatica, 22:311–331, 1985. Erratum pp. 699–707.

[22] R.L. Smith et al. Computer-assisted axiomatic mathematics: Informal rigor. In O. Lecarme and R. Lewis, editors, Computers in Education, pages 803–809. North Holland, 1975.

[23] Alfred Tarski. Über unerreichbare Kardinalzahlen. Fundamenta Mathematicae, 30:68–89, 1938.

[24] Alfred Tarski. On well-ordered subsets of any set. Fundamenta Mathematicae, 32:176–183, 1939.

[25] A. Trybulec and H. Blair. Computer aided reasoning. In R. Parikh, editor, Logic of Programs, LNCS 193. Springer Verlag, 1985.

[26] A. Trybulec and H. Blair. Computer assisted reasoning with Mizar. In Proceedings of the 9th IJCAI, pages 26–28, Los Angeles, Ca., 1985.

[27] Andrzej Trybulec. Tarski Grothendieck Set Theory. Formalized Mathematics, 1:9–11, 1990.

[28] L. S. van Benthem Jutting. The development of a text in AUT-QE. In Proceedings of APLASM’73, Symposium d’Orsay sur la Manipulation des Symboles at d’Utilisation d’APL, Universite Paris XI, 1973.

A Tarski Grothendieck Set Theory

The following is the abstract and the actual article on which the Mizar library is built. For obvious reasons the article has not been checked for validity. Unfortunately for the international audience the comments in text are mainly in Polish. First, the English summary provided by A. Trybulec (author).

This is the first part of the axiomatics of the Mizar system. It includes the axioms of the Tarski Grothendieck set theory. They are: the axiom stating that everything is a set, the extensionality axiom, the definitional axiom of the singleton, the definitional axiom of the pair, the definitional axiom of the union of a family of sets, the definitional axiom of the boolean (the power set) of a set, the regularity axiom, the definitional axiom of the ordered pair, the Tarski’s axiom A introduced in [23] (see also [24]), and the Frænkel scheme. Also, the definition of equinumerosity is introduced.

environ vocabulary EQUI REL, BOOLE, FAM OP;
  :: Andrzej Trybulec
  :: Teoria mnogosci Tarskiego Grothendiecka
begin
 reserve x,y,z,u for Any,
         N,M, X,Y,Z for set;
:: axiom  Tarski:1       ---- wszystko jest zbiorem
                    canceled; :: as obvious:  x is set;
axiom  :: Tarski:2       ---- ekstensjonalnosc zbiorow
                    (for x holds x ∈ X iff x ∈ Y) implies X = Y;
 :: Singletony i pary
                    definition
                      let y; func { y } -> set means
:: TARSKI: def 1
                       x ∈ it iff x = y;
                      let z; func { y, z } -> set means
:: TARSKI: def 2
                       x ∈ it iff x = y or x = z;
                    end;
axiom  :: Tarski:3       ---- definicja singletonu
                    X = { y } iff for x holds x ∈ X iff x = y;
axiom  :: Tarski:4       ---- definicja pary nieuporzadkowanej
                    X = { y,z } iff for x holds x ∈ X iff x = y or x = z;
                    definition let X,Y;
                     pred X c= Y means
:: TARSKI: def 3
                      x ∈ X implies x ∈ Y;
                      reflexivity;
                    end;
                    definition let X;
                       func union X -> set means
:: TARSKI: def 4
                        x ∈ it iff ex Y st x ∈ Y & Y ∈ X;
                    end;
axiom  :: Tarski:5       ---- definicja unii rodziny zbiorow
                    X = union Y iff for x holds x ∈ X iff ex Z st x ∈ Z & Z ∈ Y;
axiom  :: Tarski:6       ---- definicja zbioru potegowego
                    X = bool Y iff for Z holds Z ∈ X iff Z c= Y;

axiom  :: Tarski:7       ---- aksjomat regularnosci
                    x ∈ X implies ex Y st Y ∈ X & not ex x st x ∈ X & x ∈ Y;
 scheme Fraenkel { A()-> set, P[Any, Any] }:
  ex X st for x holds x ∈ X iff ex y st y ∈ A() & P[y,x]
  provided for x,y,z st P[x,y] & P[x,z] holds y = z;
                    definition let x,y;
                     func [x,y] means
:: TARSKI: def 5
                     it = { { x,y }, { x } };
                    end;
axiom  :: Tarski:8       ---- definicja pary uporzadkowanej
                    [ x,y ] = { { x,y }, { x } };
                    definition let X,Y;
                     pred X ≈ Y means
:: TARSKI: def 6
                      ex Z st
                            (for x st x ∈ X ex y st y ∈ Y & [x,y] ∈ Z) &
                            (for y st y ∈ Y ex x st x ∈ X & [x,y] ∈ Z) &
                            for x,y,z,u st [x,y] ∈ Z & [z,u] ∈ Z holds x = z iff y = u;
                    end;
:: Alfred Tarski
:: Ueber unerreichbare Kardinalzahlen,
:: Fundamenta Mathematicae, vol.30 (1938), pp.68-69
:: Axiom A. (Axiom der unerreichbaren Mengen). Zu jeder Menge N gibt es
:: eine Menge M mit folgenden Eigenschaften :
:: A1. N ∈ M;
:: A2. ist X ∈ M und Y c= X, so ist Y ∈ M;
:: A3. ist X ∈ M und ist Z die Menge, die alle Mengen Y c= X und keine
::     andere Dinge als Element enthaelt, so,ist z ∈ M;
:: A4. ist X c= M und sind dabei die Menge X und M nicht gleichmaechtig,
::     so ist X ∈ M.
:: takze
:: Alfred Tarski
:: On Well-ordered Subsets of any Set,
:: Fundamenta Mathematicae, vol.32 (1939), pp.176-183
:: A. For every set N there exists a system M of sets which satisfies
::    the following conditions :
:: (i)    N ∈ M
:: (ii)   if X ∈ M and Y c= X, then Y ∈ M
:: (iii)  if X ∈ M and Z is the system of all subsets of X, then Z ∈ M
:: (iv)   if X c= M and X and M do not have the same potency, then X ∈ M.
axiom :: Tarski:9
                      ex M st N ∈ M &
                        (for X,Y holds X ∈ M & Y c= X implies Y ∈ M) &
                        (for X holds X ∈ M implies bool X ∈ M) &
                        (for X holds X c= M implies X ≈ M or X ∈ M);

B Built-in Concepts

The English summary provided by A. Trybulec (author):

This abstract contains the second part of the axiomatics of the Mizar system (the first part is in abstract [27]). The axioms listed here characterize the Mizar built-in concepts that are automatically attached to every Mizar article. We give definitional axioms of the following concepts: element, subset, Cartesian product, domain (nonempty subset), subdomain (non empty-subset of a domain), set domain (domain consisting of sets). Axioms of strong arithmetics of real numbers are also included.

Numerous axioms that were needed some time ago have been cancelled; they have been built into the processor and they are now obvious to the verifier. The trace of them is required to properly process older articles that made references to the axioms.

Polish comments have been deleted from the text.

 :: Andrzej Trybulec
environ
 vocabulary Boole;    signature Tarski;
begin
  reserve x,y,z for Any,
          X,X1,X2,X3,X4,Y for set;
:: axiom AXIOMS:1  (ex x st x ∈ X) implies (x is Element of X iff x ∈ X);
                  canceled; :: as obvious
axiom :: AXIOMS:2
                  X is Subset of Y iff X c= Y;
axiom :: AXIOMS:3
                  z ∈ [:X,Y:] iff ex x,y st x ∈ X & y ∈ Y & z = [x,y];
axiom :: AXIOMS:4
                  X is non-empty implies ex x st x ∈ X;
axiom :: AXIOMS:5
                  [: X1,X2,X3 :] = [:[:X1,X2:],X3:];
axiom :: AXIOMS:6
                  [: X1,X2,X3,X4 :] = [:[:X1,X2,X3:],X4:];
 reserve D1,D2,D3,D4 for non-empty set;
:: axiom AXIOMS:7  for X being Element of [: D1,D2 :] holds X is TUPLE of D1, D2;
                  canceled; :: as obvious
:: axiom AXIOMS:8  for X being Element of [: D1,D2,D3 :] holds X is TUPLE of D1, D2, D3;
                  canceled; :: as obvious
:: axiom AXIOMS:9  for X being Element of [: D1,D2,D3,D4 :] holds X is TUPLE of D1, D2, D3, D4;
                  canceled; :: as obvious
 reserve D for non-empty set;
axiom :: AXIOMS:10
                  D1 is non-empty Subset of D2 iff D1 c= D2;
:: axiom AXIOMS:11  D is SET DOMAIN;
                  canceled; :: as obvious
 reserve x,y,z for Element of REAL;
axiom :: AXIOMS:12
                  x + y = y + x;
axiom :: AXIOMS:13
                  x + (y + z) = (x + y) + z;
axiom :: AXIOMS:14
                  x + 0 = x;
axiom :: AXIOMS:15

x · y = y · x;
axiom :: AXIOMS:16
x · (y · z) = (x · y) · z;
axiom :: AXIOMS:17
x · 1 = x;
axiom :: AXIOMS:18
x · (y + z) = x · y + x · z;
axiom :: AXIOMS:19
ex y st x + y = 0;
axiom :: AXIOMS:20
x <> 0 implies ex y st x · y = 1;
axiom :: AXIOMS:21
x ≤ y & y ≤ x implies x = y;
axiom :: AXIOMS:22
x ≤ y & y ≤ z implies x ≤ z;
axiom :: AXIOMS:23
x ≤ y or y ≤ x;
axiom :: AXIOMS:24
x ≤ y implies x + z ≤ y + z;
axiom :: AXIOMS:25
x ≤ y & 0 ≤ z implies x · z ≤ y · z;
axiom :: AXIOMS:26
for X,Y being Subset of REAL st
 (ex x st x ∈ X) & (ex x st x ∈ Y) &
  for x,y st x ∈ X & y ∈ Y holds x ≤ y
 ex z st
  for x,y st x ∈ X & y ∈ Y holds x ≤ z & z ≤ y;
:: axiom AXIOMS:27  x is Real;
canceled; :: as obvious
axiom :: AXIOMS:28
x ∈ NAT implies x + 1 ∈ NAT;
axiom :: AXIOMS:29
for A being set of Real
  st 0 ∈ A & for x st x ∈ A holds x + 1 ∈ A holds NAT c= A;
reserve i,j,k for Nat;
axiom :: AXIOMS:30
k = { i: i<k };

C A Mizar article

The following is the text of an article from the Main Mizar Library. This article is unusual—it is shortest in the library. In order to decrease the number of text lines and with hope of improving readability I have manipulated the white space of the original submission. The characters of extended ASCII have been replaced by some symbols available in LaTEX. The Mizar processor restricts the length of input lines to 80 characters. The text below violates this restriction for presentation purposes.

:: Alicia de la Cruz
:: Fix Point Theorem for Compact Spaces
environ
vocabulary METRYKA, SFAMILY, POWER1, FINITE, SEQ1, SEQ2, SEQM, SUB OP, REAL 1,
 TOPCON, PCOMPS, FUNC, TOP2, FAM OP, BOOLE, FINITER2, ALI2, FUNC REL;
signature FINSET 1, METRIC 1, FUNCT 1, FUNCT 2, PRE TOPC, POWER, BOOLE, FUNCOP 1,
TARSKI, COMPTS 1, PCOMPS 1, SETFAM 1, TOPS 1, TOPS 2, SEQ 1, SEQ 2, SEQM 3,
SUBSET 1, REAL 1, NAT 1;
definitions COMPTS 1, TARSKI, TOPS 2, FUNCT 2;
theorems METRIC 1, SUBSET 1, REAL 1, PCOMPS 1, REAL 2, COMPTS 1, POWER, BOOLE, SEQ 2,
SEQ 4, SERIES 1, SEQM 3, AXIOMS, SETFAM 1, TARSKI, SEQ 1, PRE TOPC, TOPS 1,
SQUARE 1, DOMAIN 1, FUNCOP 1, ZFMISC 1;
schemes SETFAM 1, SEQ 1, GROUP 4, FINSET 1, NAT 1;
begin
reserve M for MetrSpace, x, y for Element of the carrier of M;
theorem VIT:
for F being set st F is finite & F <> ∅ &
               for B, C being set st B ∈ F & C ∈ F holds B c= C or C c= B
  ex m being set st m ∈ F & for C being set st C ∈ F holds m c= C
proof    pred P[set] means
$1 <> ∅ implies ex m being set st m ∈ $1 & for C being set st C ∈ $1 holds m c= C;
let F be set such that
Z: F is finite   and   Y: F <> ∅ and
X: for B, C being set st B ∈ F & C ∈ F holds B c= C or C c= B;
A: P[∅];
B: now let x, B be set such that j0: x ∈ F & B c= F & P[B];
now per cases;                         :: we have to prove P[B U{x}]
case j: not ex y being set st y ∈ B & y c=x;
assume B U {x} <> ∅;   take m = x;   x ∈ {x} by TARSKI:def 1;
hence m ∈ B U {x} by BOOLE:8;   let C be set;   assume C ∈ B U {x};   then
  1 : C∈B or C∈{x} by BOOLE:8;   then j1:C∈B or C=x by TARSKI:def 1;
 j2: not C c=x or C=x by j, TARSKI:def 1,  1 ;   C ∈ F by j0, BOOLE:11, j1;
hence m c= C by j0, X, j2;
case ex y being set st y ∈ B & y c=x;   then consider y being set such that
 j5: y ∈ B & y c=x;   assume B U {x} <> ∅;   consider m being set such that
 j3:m ∈ B   and
 j4: for C being set st C ∈ B holds m c= C by j0, j5, BOOLE:def 1;
     m c= y by j4, j5;   then j6:m c= x by j5, BOOLE:29;
take m;   thus m ∈ B U {x} by j3, BOOLE:8;
let C be set;   assume C ∈ B U {x};   then C ∈ B or C ∈ {x} by BOOLE:8;
hence m c= C by j4, j6, TARSKI:def 1;            end;
hence P[B U {x}];        end;
P[F] from Finite(Z, A, B);
hence thesis by Y;  end;

definition   let M be MetrSpace;
mode contraction of M -> Function of  the carrier of M, the carrier of M
  means :DD: ex L being Real st 0<L & L<1 &
                  for x, y being Point of M holds dist(it.x, it.y)≤L·dist(x, y);
existence   proof   consider x being Point of M;
(the carrier of M) --> x is Function of the carrier of M, the carrier of M   proof
thus dom ((the carrier of M) --> x) = the carrier of M by FUNCOP 1:19;
cc:rng ((the carrier of M) --> x) c= {x} by FUNCOP 1:19;
{x} c= the carrier of M by ZFMISC 1:37;
hence rng ((the carrier of M) --> x) c= the carrier of M by BOOLE:29, cc;     end;
then reconsider f = (the carrier of M) --> x
            as  Function of  the carrier of M, the carrier of M;
take f,  1/2; 0<1;   hence aa: 0<1/2 & 1/2<1 by SEQ 2:3, SQUARE 1:3;
let z, y being Point of M;   f.z=x & f.y=x by FUNCOP 1:13;
then bb: dist(f.z, f.y) = 0 by METRIC 1:def 3;   dist(z, y)≥0 by METRIC 1:7;
hence dist(f.z, f.y)≤(1/2)·dist(z, y) by bb, aa, REAL 2:121;      end;
end;
theorem   for f being contraction of M st TopSpaceMetr(M) is compact
      ex c being Point of M st f.c =c &            :: exists a fix point
      for x being Point of M st f.x=x holds x=c    :: exactly 1 fix point
proof
let f be contraction of M;   consider L being Real such that
a1: 0<L & L<1 and
a2: for x, y being Point of M holds dist(f.x, f.y)≤L·dist(x, y) by DD;
assume a7: TopSpaceMetr(M) is compact;   consider x0 being Point of M;   set a=dist(x0, f.x0);
now assume a <> 0;
 consider F being Subset-Family of the carrier of TopSpaceMetr(M) such that
kkk: for B being Subset of the carrier of TopSpaceMetr(M) holds B∈F iff
       ex n being Nat st B = { x where x is Point of M : dist(x, f.x) ≤ a·L to power n }
                                 from SubFamEx;
TopSpaceMetr(M) = TopStruct≪the carrier of M, Family open set(M)≫ by PCOMPS 1:def 6; then
d5: the carrier of M = the carrier of TopSpaceMetr(M);
set B = { x where x is Point of M : dist(x, f.x) ≤ a·L to power (0+1) };
B is Subset of the carrier of M from SubsetD;   then B ∈ F by kkk, d5;   then
d1: F<>∅ by BOOLE:def 1;
a8: F is centered   proof   thus F <> ∅ by d1;
let G be Subset-Family of the carrier of TopSpaceMetr(M) such that
b1: G <> ∅ and   b2: G c= F   and   b3: G is finite;
for B, C being set st B ∈ G & C ∈ G holds B c= C or C c= B   proof
let B, C be set ;   assume h0:B ∈ G & C ∈ G;   then h3: B ∈ F & C ∈ F by b2, BOOLE:11;
    B is Subset of the carrier of TopSpaceMetr(M) by SETFAM 1:43, h0;
    then consider n being Nat such that
h4: B = { x where x is Point of M : dist(x, f.x) ≤ a·L to power n } by kkk, h3;
    C is Subset of the carrier of TopSpaceMetr(M) by SETFAM 1:43, h0;
    then consider m being Nat such that
h5: C = { x where x is Point of M : dist(x, f.x) ≤ a·L to power m } by kkk, h3;
lemma1: for n, m being Nat st n≤m holds L to power m ≤ L to power n   proof
 let n, m being Nat such that iii: n≤m;
  now per cases by iii, REAL 1:def 5;
   case n<m;   then L to power n > L to power m by POWER:45, a1;
    hence L to power n ≥ L to power m by REAL 1:def 5;
   case n=m;   hence L to power n ≥ L to power m;     end;
 hence thesis;         end;
lemma2: for n, m being Nat st n≤m holds a·L to power m ≤ a·L to power n   proof
 let n, m being Nat such that iii: n≤m;
  now per cases;
   case c:  a=0; then a·L to power m = 0 by REAL 1:20 .= a·L to power n by REAL 1:20, c;

      hence a·L to power m ≤ a·L to power n;
     case a<>0;  cc:  a≥0 by METRIC 1:7;  L to power m ≤ L to power n by iii, lemma1;
      hence a·L to power m ≤ a·L to power n by cc, REAL 1:51;     end;
   hence thesis;         end;
  now per cases by AXIOMS:23;
   case i:n≤m;   thus C c= B   proof   let y be Any;   assume y ∈ C;
         then consider x being Point of M  such that
     C1: y = x   and   C2: dist(x, f.x) ≤ a·L to power m by h5;
         a·L to power m ≤ a·L to power n by i, lemma2;    then
         dist(x, f.x) ≤ a·L to power n by AXIOMS:22, C2;
     hence y ∈ B by C1, h4;   end;
   case ii:m≤n;   thus B c= C   proof   let y be Any;   assume y ∈ B;
         then consider x being Point of M  such that
     C1: y = x   and   C2: dist(x, f.x) ≤ a·L to power n by h4;
         a·L to power n ≤ a·L to power m by ii, lemma2;   then
         dist(x, f.x) ≤ a·L to power m by AXIOMS:22, C2;
     hence y ∈ C by C1, h5;   end;         end;
 hence B c= C or C c= B;       end;     then consider  m being set such that
n1: m ∈ G   and   n2: for C being set st C ∈ G holds m c= C by VIT, b1, b3;
n3: m c= meet G by SETFAM 1:6, b1, n2;   n4: m ∈ F by n1, BOOLE:11, b2;
h5: m is Subset of the carrier of TopSpaceMetr(M) by SETFAM 1:43, n1;
CC: L <> 0 by a1;   dist(x0,f.x0) = a·1 by REAL 1:7 .= a·L to power 0 by POWER:29, CC;
    then x0 ∈ { x where x is Point of M : dist(x, f.x) ≤ a·L to power 0 };   then
P: { x where x is Point of M : dist(x,f.x) ≤ a·L to power 0 } <> ∅ by BOOLE:def 1;
P': for k being Nat st {x where x is Point of M : dist(x, f.x) ≤ a·L to power k} <> ∅
                 holds {x where x is Point of M : dist(x,f.x) ≤ a·L to power (k+1)} <> ∅
proof let k be Nat; assume {x where x is Point of M : dist(x,f.x) ≤ a·L to power k} <> ∅;
       then consider z being Any such that
  s1: z∈{ x where x is Point of M : dist(x, f.x) ≤ a·L to power k } by BOOLE:def 1;
      consider y being Point of M such that y=z and s2: dist(y,f.y)≤ a·L to power k by s1;
  L ≥ 0 by a1, REAL 1:def 5; then s4: L·dist(y,f.y) ≤ L·(a·L to power k) by REAL 1:51, s2;
  s3: L·(a·L to power k)  = L·a·L to power k by AXIOMS:16  .= a·L·L to power k by AXIOMS:15
       .= a·(L·L to power k) by AXIOMS:16  .= a·(L to power 1·L to power k) by POWER:30
       .= a·(L to power k·L to power 1) by AXIOMS:15  .= a·L to power (k+1) by POWER:32, a1;
      dist(f.y, f.(f.y)) ≤ L·dist(y, f.y) by a2;   then
      dist(f.y, f.(f.y)) ≤ a·L to power (k+1) by s3, s4, AXIOMS:22;   then
      f.y ∈ { x where x is Point of M : dist(x, f.x) ≤ a·L to power (k+1) };
 hence { x where x is Point of M : dist(x,f.x)≤a·L to power (k+1) } <> ∅ by BOOLE:def 1;
end;
for k being Nat holds { x where x is Point of M : dist(x,f.x) ≤ a·L to power k} <> ∅
                                 from Ind(P, P');   then  m <> ∅ by h5, kkk, n4;
hence  meet G <> ∅ by BOOLE:30, n3;         end;
F is closed   proof   let B being Subset of the carrier of TopSpaceMetr(M);
assume B ∈ F;   then consider n being Nat such that
mm:  B= { x where x is Point of M : dist(x, f.x) ≤ a·L to power n } by kkk;
A1: TopSpaceMetr(M)=TopStruct≪the carrier of M, Family open set(M)≫ by PCOMPS 1: def 6;
    then reconsider V = B` as Subset of the carrier of M;    set B' = B`;
for x being Point of M st x ∈ V ex r being Real st r>0 & Ball(x, r) c= V   proof
 let x be Point of M such that m1: x ∈ V;   take r = (dist(x, f.x)-a·L to power n)/2;
      2<>0;   then 2·r = dist(x, f.x)-a·L to power n by REAL 2:73;   then
  m20: dist(x,f.x)-2·r = a·L to power n by REAL 2:12; not x∈B by m1, SUBSET 1:53; then
      dist(x,f.x)>a·L to power n by mm; then dist(x,f.x)-a·L to power n>0 by REAL 2:108;
 hence r>0 by SEQ 2:3;
 let z be Any;   assume m: z ∈ Ball(x, r);   Ball(x, r) c= the carrier of M by AXIOMS:2;
  then reconsider y=z as Point of M by BOOLE:11, m;   m8: dist(x, y)<r by METRIC 1:19, m;
       dist(x, y) + dist(y, f.y) ≥ dist(x, f.y) by METRIC 1:6;   then
  m13: (dist(x,y)+dist(y,f.y))+dist(f.y,f.x) ≥ dist(x,f.y)+dist(f.y,f.x) by REAL 1:53;
       dist(x, f.y) + dist(f.y, f.x) ≥ dist(x, f.x) by METRIC 1:6;   then

dist(x, y)+dist(y, f.y)+dist(f.y, f.x)≥dist(x, f.x) by m13, AXIOMS:22;   then
dist(y, f.y)+dist(x, y)+dist(f.y, f.x)≥dist(x, f.x) by AXIOMS:12;   then
m6:  dist(y, f.y)+(dist(x, y)+dist(f.y, f.x))≥dist(x, f.x) by AXIOMS:13;
m10: dist(x, y) = dist(y, x) by METRIC 1:5;   m3: dist(f.y, f.x)≤L·dist(y, x) by a2;
dist(y, x)≥0 by METRIC 1:7;   then L·dist(y, x)≤dist(y, x) by REAL 2:147, a1;
then dist(f.y, f.x)≤dist(y, x) by m3, AXIOMS:22;   then
m4:  dist(f.y, f.x)+dist(y, x) ≤ dist(y, x)+dist(y, x) by REAL 1:49;
2>0;   then 2·dist(x, y)<2·r by m8, REAL 1:70;   then
m9:  dist(y, f.y) + 2·dist(x, y)< dist(y, f.y) + 2·r by REAL 1:59;
dist(f.y, f.x)+dist(y, x) ≤ 2·dist(y, x) by m4, SQUARE 1:5;   then
dist(y, x) + dist(f.y, f.x) ≤ 2·dist(y, x) by AXIOMS:12;   then
dist(y,f.y)+(dist(y,x)+dist(f.y,f.x))≤dist(y,f.y)+2·dist(y,x) by REAL 2:103;
then dist(y, f.y)+2·dist(x, y)≥dist(x, f.x) by m6, AXIOMS:22, m10;
then dist(y, f.y)+2·r>dist(x, f.x) by REAL 1:58, m9;   then
not ex x being Point of M st y=x & dist(x,f.x)≤a·L to power n by m20, REAL 1:91;
then m22: not y ∈ B by mm;   the carrier of M <> ∅ by DOMAIN 1:1;
hence z ∈ V by SUBSET 1:50, m22, A1;       end;   then
B` ∈ Family open set(M) by PCOMPS 1:def 5;   then B' is open by A1,  PRE TOPC:def 4;
hence B is closed by TOPS 1:29;
end;   then
meet F<>∅ by COMPTS 1:13,a8,a7; then consider c' being Point of TopSpaceMetr(M) such that
d2: c'∈meet F by SUBSET 1:10;
reconsider c = c' as Point of M by d5;   consider s' being Real Sequence such that
b3: for n being Nat holds s'.n=L to power (n+1) from ExRealSeq;    set s = a □ s';
b6'': s' is convergent & lim s'=0 by a1, SERIES 1:1, b3;   then
b6: s is convergent by SEQ 2:21;
b6': lim s = a·0  by b6'', SEQ 2:22 .= 0 by REAL 1:20;
consider r being Real Sequence such that
b4: for n being Nat holds r.n=dist(c, f.c) from ExRealSeq;
b5: r is constant by SEQM 3: def 5, b4; then b7: r is convergent by SEQ 4:39;
now let n be Nat;   set B = { x where x is Point of M : dist(x, f.x) ≤ a·L to power (n+1)};
B is Subset of the carrier of M from SubsetD;   then B ∈ F by kkk, d5;   then
c∈ B by d1, SETFAM 1:1, d2;   then
d3: ex x being Point of M st c = x & dist(x, f.x) ≤ a·L to power (n+1);
d3': r.n = dist(c, f.c) by b4;   s.n = a·s'.n by SEQ 1:def 5 .= a·L to power (n+1) by b3;
hence r.n ≤ s.n by d3, d3';       end;   then
c1: lim r ≤ lim s by SEQ 2:32, b6, b7;   r.0=dist(c, f.c) by b4;   then
dist(c, f.c)≤0 & dist(c, f.c)≥0 by c1, b6', METRIC 1:7, SEQ 4:40, b5;   then
dist(c, f.c)=0 by AXIOMS:21;
hence ex c being Point of M st dist(c, f.c) = 0;
end;   then consider c being Point of M such that
XX: dist(c, f.c) = 0;
take c;
thus a4: f.c =c by METRIC 1: def 3, XX;
let x be Point of M ; assume a3: f.x=x; assume x<>c; then a6: dist(x,c)<>0 by METRIC 1:def 3;
dist(x, c)≥0 by METRIC 1:7;   then dist(x, c)>0 by REAL 1:def 5, a6;   then
L·dist(x, c)<dist(x, c) by a1, REAL 2:145;
hence contradiction by a3, a4, a2;
end;

D A Mizar abstract

Here is the abstract of the article presented in Appendix C. The abstracts are extracted mechanically from the submitted articles and the reference identification of Mizar items is automatically inserted. If one wants to make a reference to another article, they have to use reference names as presented in the article’s abstract.

:: Alicia de la Cruz
:: Fix Point Theorem for Compact Spaces
environ
 vocabulary METRYKA,SFAMILY,POWER1,FINITE,SEQ1,SEQ2,SEQM,SUB OP,REAL 1,TOPCON,
     PCOMPS,FUNC,TOP2,FAM OP,BOOLE,FINITER2,ALI2,FUNC REL;
 signature FINSET 1,METRIC 1,FUNCT 1,FUNCT 2,PRE TOPC,POWER,BOOLE,FUNCOP 1,
     TARSKI,COMPTS 1,PCOMPS 1,SETFAM 1,TOPS 1,TOPS 2,SEQ 1,SEQ 2,SEQM 3,
     SUBSET 1,REAL 1,NAT 1;
begin
  reserve M for MetrSpace,x,y for Element of the carrier of M;
theorem :: ALI2:1
for F being set st F is finite & F <> ∅ &
 for B,C being set st B ∈ F & C ∈ F holds B c= C or C c= B
 ex m being set st m ∈ F & for C being set st C ∈ F holds m c= C;
definition  let M be MetrSpace;
mode contraction of M -> Function of  the carrier of M , the carrier of M
means :: ALI2:def 1
ex L being Real st 0<L & L<1& for x,y being Point of M holds
dist(it.x,it.y)≤L·dist(x,y);
end;
theorem :: ALI2:2
for f being contraction of M st TopSpaceMetr(M) is compact
ex c being Point of M st f.c =c &            :: exists a fix point
for x being Point of M st f.x=x holds x=c;

E A TEXed Mizar abstract

Mizar abstracts are further mechanically processed, typeset using TEX, and published (see footnote on page 296). Each author of an article accepted to the library must provide a title, the author’s name and address, and a summary (in English) that are included into the typeset abstract.

The next two pages contain a copy of the typeset version of the abstract from Appendix D One can consider the English of the text rather poor, but it should be remembered that this text has been generated mechanically. The process of mechanical translation from Mizar into English is still being worked on.

311 312

Kripke Semantics for a Logical Framework

Alex K. Simpson^{∗} als@dcs.ed.ac.uk

Department of Computer Science, University of Edinburgh, JCMB, The King’s Buildings, Edinburgh, EH9 3JZ

July 1992

Abstract We present a semantic analysis (using Kripke lambda models) of a meta-logic (minimal implicational predicate logic with quantification over all higher types) with emphasis on its use as a logical framework. An object-logic is encoded by a meta-theory axiomatising its consequence relation. Properties of the encoding, such as adequacy, are analysed in terms of corresponding semantic properties. In the case of adequacy we are able to prove the interesting “faithfulness” direction by showing that the meta-theory has a certain kind of model. The semantics is also used to analyse conditions under which the admissibility of an inference rule is provable in the meta-logic.

1 Introduction

The aim of this paper is to give a semantic analysis of the use of a meta-logic as a logical framework.

The meta-logic we consider is a fragment of intuitionistic predicate logic with quantification over all higher types. The idea of using such a logic as a framework goes back to the Edinburgh Logical Framework (LF) [6] (although this was itself partly inspired by de Bruijn’s AUTOMATH [3] and Martin-Löf’s system of arities [11]). Although LF is a dependently-typed lambdacalculus, it can be viewed as a fragment of intuitionistic logic using the propositions as types correspondence. Intuitively, however, it is quite natural to separate types from propositions. For example, the LF type (we follow the notation of [6]):

Πφ:o.Πψ:o.true(φ) → true(φ ∨ ψ)  (1)

can be read naturally as the proposition:

∀φ:o. ∀ψ:o. true(φ) ⊃ true(φ ∨ ψ)  (2)

One is thus replacing the “judgements as types” principle of [6] with some kind of metaaxiomatisation. This separation between propositions and types has been made explicit in the applications of Isabelle and λProlog as logical frameworks (see [12, 4]).

There are a number of advantages to the LF approach. One merit is the obvious simplicity of having a calculus with only one connective (dependent product). Another is that the judgements as types principle enables proofs to be explicitly represented as terms of the framework. With this understanding the type (1) is the natural type for the ∨-introduction rule which, given two formulae φ and ψ together with a proof of φ, constructs a proof of φ ∨ ψ. Finally, the idea of separating propositions and types, though natural in some cases, might be less so in general. The single ontology of LF allows for the maximum flexibility in making encodings.

∗Supported by SERC grant no. 90311820.

Nevertheless there are also good reasons for separating propositions and types. One is that a framework should distinguish between syntax and logical consequence. Syntax will still be represented by terms of appropriate type, but now consequence is expressed by a metaaxiomatisation. However, these kind of separations can also be made to good effect in a wholly type-theoretical setting (see [5]). A second argument is to prefer the meta-logical approach on the grounds that the main benefit offered by the type-theoretic approach, explicit proof representation, is neither important nor desirable. Proof representation is unimportant if one takes the point of view that the feature of a logic of real interest is its consequence relation (see section 4). An argument for the undesirability of proof representation, based on efficiency, is given in [12]. A further argument against the kind of proof representation offered by LF is that it is too crude to capture many interesting proof systems (two sided sequent calculi for example). In fact the numerous examples in [1] testify to LF as being good for representing consequence in the general case, but good for representing proofs only in particularly well-behaved cases.

However, the main reason we are interested in distinguishing propositions and types is that we wish to consider a logical framework as a meta-logic. We want to understand the encoding of the logic as a commitment to certain meta-propositions about the logic (the proposition (2) for example). In order to understand these meta-propositions mathematically, we require a semantics for the meta-logic. Moreover, we want to relate the meta-propositions to the encoded logic. So the semantics should be able to provide links between the encoded logic and its metatheory. These links will turn out to be very concrete. For example, in section 5 we build a model of a meta-theory out of models of the logic it encodes.

The structure of this paper is as follows. In section 2 we introduce the meta-logic. In section 3 we give it a Kripke semantics, proving soundness and completeness. Section 4 is then a necessary preliminary to the rest of the paper. In it we survey various elementary properties of consequence relations. The bulk of the paper is contained sections 5 and 6. In the former we consider how the meta-logic can be used to encode logics. The property we are most interested in is the “adequacy” of an encoding. This is given a semantic characterisation, which is then used to give an example proof of adequacy. Finally, in section 6 we consider a notion of admissible rule for a logic. The semantics is used to analyse under what conditions the admissibility of a rule is provable in the meta-theory representing a logic.

Throughout this paper we consider many different sequent-style judgements with sets for the antecedent. In these we adopt the standard notational conventions of writing “,” for “∪”, omitting set delimiters from singleton sets and omitting explicit mention of the empty set.

2 The meta-logic

The meta-logic is minimal implicational predicate logic with universal quantification over all higher types. It is quite similar to the logics considered in [12, 4].

We use A, B and C to range over (simple) types, M and N to range over terms (of the simply-typed λ-calculus), and Φ and Ψ to range over formulae (lower case Greek letters will be reserved for formulae of the object-logic).

We assume given four countably infinite, disjoint sets: a set of type constants, a set of predicate symbols, a set of term constants and a set of variables. We use P to range over the predicate symbols, c to range over the term constants and x to range over the variables.

A theory is generated by a presentation which is a quadruple, (T , P, Σ, A), where each of T , P, Σ and A are sets as specified below. Mostly (but not exclusively) we consider finite presentations, ie. those in which all four sets are finite.

T is a subset of the set of type constants. Types are generated from this set by the grammar:

A ::= α | A → B

where α ranges over elements of T . As usual, when brackets are omitted, “→” associates to the right. P is a set of predicate declarations of the form P : ⟨A_{1}, …, A_{n}⟩ (where n is possibly zero) such that each predicate symbol, P, appears only once in the set. Σ is a set of constant declarations of the form c:A such that each term constant, c, appears only once in the set. The requirements on A are given below. Henceforth everything will be parameterised over T and P and these sets will usually be left implicit. Thus we often refer to the presentation as (Σ, A).

A context, Γ, is a finite set of variable declarations of the form x:A such that each variable, x, appears only once in the set. The abstract syntax of terms and formulae is given by the following grammar.

M ::= c | x | λx:A. M | M(N)
Φ ::= P (M_{1}, …, M_{n}) | Φ ⊃ Ψ | ∀x:A. Φ

We assume that the reader understands the notion of free and bound variable. We write N[M/x] and Φ[M/x] for the substitution of M for all free occurrences of x in N and Φ respectively. Lambda-terms and quantified formulae are considered identified up to α-equivalence.

The term calculus is just the simply-typed lambda calculus (for which a good reference is [9]). We write Γ ⊳_{Σ} M : A to mean that M is term over Σ with type A in context Γ. We shall only be concerned with βη-equality, =_{βη}, between terms. We note (but shall not use) that equality between terms is decidable. A term, M, such that Γ ⊳_{Σ} M:A is said to be in long-βη normal form (with respect to Γ and Σ) if it has the form:

λx_{1} :A_{1}…. λx_{n}:A_{n}. h(M_{1}) … (M_{m})

where: n, m ≥ 0; h is either a variable or a constant; Γ, x_{1} :A_{1}, …, x_{n}:A_{n} ⊳_{Σ} h(M_{1}) … (M_{m}):α for some type constant α; and each M_{i} (1 ≤ i ≤ m) is in long-βη normal form with respect to Γ, x_{1} :A_{1}, …, x_{n}:A_{n} and Σ. Clearly any M in long-βη normal form with respect to Γ and Σ is also in long-βη normal form with respect to Γ′ ⊇ Γ and Σ′ ⊇ Σ. The crucial property of long-βη normal forms is the following (see [8]): if Γ ⊳_{Σ} M : A then there is a unique term, βη(M), in long-βη normal form (with respect to Γ and Σ) such that M =_{βη} βη(M).

In Figure 5 we give a formal system for deriving judgements of the form Γ ⊳_{Σ} Φ prop. We often write simply Γ ⊳_{Σ} Φ prop to mean that the given judgement is derivable, in which case we say that Φ is well-formed in Γ and Σ. When Γ is the empty set it is omitted from such statements. Σ will only be omitted when it can be understood from the context.

The fourth component of the presentation, A, is a set of formulae, the axioms, such that each formula in A is well-formed in Σ.

Logical consequence for (Σ, A):

Γ; H ⊢_{(Σ,A)} Φ

\underline{Γ ⊳_{Σ} M_{1} :A_{1} … Γ ⊳_{Σ} M_{n}:A_{n} P:⟨A_{1}, …, A_{n}⟩ ∈ P}

Γ ⊳_{Σ} P (M_{1}, …, M_{n}) prop

Γ ⊳_{Σ} Φ prop Γ ⊳_{Σ} Ψ prop

\underline{Γ, x:A ⊳_{Σ} Φ prop}
Γ ⊳_{Σ} Φ ⊃ Ψ prop  Γ ⊳_{Σ} ∀x:A. Φ prop

Figure 5: Well-formedness rules for formulae.

Ax  Φ ∈ A  Ass  Φ ∈ H
\overline{Γ; H ⊢_{(Σ,A)} Φ}  \overline{Γ; H ⊢_{(Σ,A)} Φ}
Sub \underline{Γ; H ⊢_{(Σ,A)} Φ[M/x] M =_{βη} N}

Γ; H ⊢_{(Σ,A)} Φ[N/x]

⊃ I Γ; H, Φ ⊢_{(Σ,A)} Ψ ⊃ E \underline{Γ; H ⊢_{(Σ,A)} Φ ⊃ Ψ Γ; H ⊢_{(Σ,A)} Φ}
\overline{Γ; H ⊢_{(Σ,A)} Φ ⊃ Ψ}  Γ; H ⊢_{(Σ,A)} Ψ
∀I Γ, x:A; H ⊢_{(Σ,A)} Φ ∀E \underline{Γ; H ⊢_{(Σ,A)} ∀x:A. Φ Γ ⊳_{Σ} M:A}
\overline{Γ; H ⊢_{(Σ,A)} ∀x:A. Φ}  Γ; H ⊢_{(Σ,A)} Φ[M/x]

Restriction on ∀I: x does not occur free in H. Figure 6: Rules for meta-logical consequence. relates Γ, H and Φ where H is a set of formulae, the hypotheses, and each formula in H ∪ {Φ} is well-formed in Γ and Σ. This relation is given by the formal system of Figure 6.

In the sequel we shall require the following elementary derived result about consequence.

Lemma 2.1 (weakening) If Γ; H ⊢_{(Σ,A)} Φ and all formulae in H′ are well-formed in Γ ∪ Γ′ then Γ, Γ′; H, H′ ⊢_{(Σ,A)} Φ.

The easy proof, by induction on the structure of derivations, is omitted.

3 Semantics

As the meta-logic is intuitionistic with quantification over all higher types, we seek a semantics in terms of Kripke models in which all typed lambda terms can be interpreted at each world. The Kripke lambda models of Mitchell and Moggi [9] are thus a natural choice. Although we follow their paper quite closely, the reader is advised that some of our notation and terminology differs from that of [9].

An (extensional, Kripke, T -P-)prestructure is a sextuple:

⟨W, ≤, {[[A]]_{w}}, {[[P]]_{w}}, {ϵ_{w}^{AB}}, {i_{ww′}^{A}}⟩

where:

• W is a set of worlds partially orded by ≤.

• {[[A]]_{w}} is a family of sets, [[A]]_{w}, indexed by types, A, and worlds, w.

• {[[P]]_{w}} is a family of relations, [[P]]_{w} ⊆ [[A_{1}]]_{w} ×…×[[A_{n}]]_{w}, indexed by predicate symbols, P, with declarations, P:⟨A_{1}, …, A_{n}⟩, in P and worlds, w.

• {ϵ_{w}^{AB}} is a family of functions, ϵ_{w}^{AB} : [[A → B]]_{w} × [[A]]_{w} ⟶ [[B]]_{w}, indexed by pairs of types, A, B, and worlds, w.

• {i_{ww′}^{A}} is a family of functions, i_{ww′}^{A} : [[A]]_{w} → [[A]]_{w′}, indexed by types, A, and pairs of worlds, w ≤ w′.

subject to the conditions given below. In these (and henceforth) we adopt the following notational conventions. When f ∈ [[A → B]]_{w} and a ∈ [[A]]_{w}, we write f(a) for ϵ_{w}^{AB}(f, a). When a_{w} ∈ [[A]]_{w} and w ≤ w′, we write a_{w′} for i_{ww′}^{A}(a_{w}).

The conditions are:

identity: For all worlds w, i_{ww}^{A} is the identity.

composition: For all w ≤ w′ ≤ w′′, i_{w′w′′}^{A} ∘ i_{ww′}^{A} = i_{ww′′}^{A}.

naturality: For all w ≤ w′, i_{ww′}^{B} ∘ ϵ_{w}^{AB} = ϵ_{w′}^{AB} ∘ (i_{ww′}^{A→B} × i_{ww′}^{A}).

extensionality: If f_{w}, g_{w} ∈ [[A → B]]_{w} and, for all w′ ≥ w, for all a ∈ [[A]]_{w′}:

f_{w′}(a) = g_{w′}(a)

then f_{w} = g_{w}.

persistency: If [[P]]_{w}(a_{1w}, …, a_{nw}) then, for all w′ ≥ w, [[P]]_{w′}(a_{1w′}, …, a_{nw′}).

Thus a prestructure is an “extensional Kripke applicative structure” in the terminology of [9], together with an extra parameter, {[[P]]_{w}}, used for interpreting the predicates of the logic.

A partial element, p, of type A in a prestructure is given by an upper-closed subset dom(p) ⊆ W, its domain, and a family of elements, {p_{w}}, indexed by worlds w ∈ dom(p) such that for all w′ ≥ w ∈ dom(p), p_{w} ∈ [[A]]_{w} and i_{ww′}^{A}(p_{w}) = p_{w′}. Given p_{w} ∈ [[A]]_{w}, we write p for the induced partial element of type A with domain {w′ | w ≤ w′} given by the elements p_{w′} ∈ [[A]]_{w′}. A global element is a partial element, p, for which dom(p) = W.

A structure is an 8-tuple:

⟨W, ≤, {[[A]]_{w}}, {[[P]]_{w}}, {ϵ_{w}^{A_{1}A_{2}}}, {i_{ww′}^{A}}, {K_{w}^{AB}}, {S_{w}^{ABC}}⟩

which is a prestructure extended by {K_{w}^{AB}} and {S_{w}^{ABC}} where:

• K^{AB} is a global element of type A → B → A such that, for all worlds w, for all a ∈ [[A]]_{w}, for all b ∈ [[B]]_{w}, K_{w}^{AB}(a)(b) = a.

• S^{ABC} is a global element of type (A → B → C) → (A → B) → A → C such that, for all worlds w, for all f ∈ [[A → B → C]]_{w}, for all g ∈ [[A → B]]_{w}, for all a ∈ [[A]]_{w}, S_{w}^{ABC}(f)(g)(a) = f(a)(g(a)).

A Σ-structure is a 9-tuple:

⟨W, ≤, {[[A]]_{w}}, {[[P]]_{w}}, {[[c]]_{w}}, {ϵ_{w}^{A_{1}A_{2}}}, {i_{ww′}^{A}}, {K_{w}^{AB}}, {S_{w}^{ABC}}⟩

which is a structure extended by {[[c]]_{w}} where:

• {[[c]]_{w}} is a family of global elements, [[c]], of type A indexed by constants, c, with declarations, c:A, in Σ.

Henceforth we refer to a Σ-structure as (W, ≤) leaving the other components implicit.

An environment, ρ, is a function from variables to partial elements. We say that ρ interprets Γ at w if, for all x: A ∈ Γ, ρ(x) is a partial element of type A with w ∈ dom(ρ(x)). Clearly if ρ interprets Γ at w and w′ ≥ w then ρ interprets Γ at w′ too. Also any environment interprets the empty context at any world. Given an environment ρ and an element a_{w} ∈ [[A]]_{w} we write ρ[x := a] for the environment that agrees with ρ on variables other than x and which assigns the induced partial element a to x. If ρ interprets Γ at w and a_{w} ∈ [[A]]_{w} then clearly ρ[x := a] interprets Γ, x:A at w.

If M has type A in Γ, and ρ interprets Γ at w, then the interpretation, [[M]]_{w}^{ρ} ∈ [[A]]_{w}, of M by ρ at w is defined inductively on the structure of M by:

[[c]]_{w}^{ρ} = [[c]]_{w}
[[x]]_{w}^{ρ} = ρ(x)_{w}
[[λx:A. M]]_{w}^{ρ} = the unique f_{w} ∈ [[A → B]]_{w} (where A → B is the type of
λx:A. M in Γ) such that, for all w′ ≥ w, for all a_{w′} ∈ [[A]]_{w′},
f_{w′}(a_{w′}) = [[M]]_{w′}^{ρ[x:=a]}
[[M(N)]]_{w}^{ρ} = [[M]]_{w}^{ρ}([[N]]_{w}^{ρ})

As in [10], the existence of the f_{w} required in the λx: A. M clause is given by the S and K combinators, and its uniqueness is guaranteed by extensionality. Clearly if M is well-typed in the empty context then the value of [[M]]_{w}^{ρ} is independent of ρ, so we just write [[M]]_{w}.

We now give some lemmas concerning the interpretation of terms in Σ-structures.

Lemma 3.1 If Γ ⊳_{Σ} M:A, ρ interprets Γ at w and w ≤ w′, then i_{ww′}^{A}([[M]]_{w}^{ρ}) = [[M]]_{w′}^{ρ}.

Lemma 3.2 If Γ, x: A ⊳_{Σ} M : B, Γ ⊳_{Σ} N : A and ρ interprets Γ at w, then [[M[N/x]]]_{w}^{ρ} = [[M]]_{w}^{ρ[x:=[[N]]^{ρ}]}.

Lemma 3.3 If Γ ⊳_{Σ} M:A, M =_{βη} N, and ρ interprets Γ at w, then [[M]]_{w}^{ρ} = [[N]]_{w}^{ρ}.

The first two lemmas are proved by straightforward inductions on the structure of M. The third is proved by an induction on derivations (in the usual formal system for βη-equality) of M =_{βη} N, using Lemma 3.2 in the verification β-equality.

If Φ is well-formed in Γ, and ρ interprets Γ at w, then the “forcing” relation w ⊧_{ρ} Φ is defined inductively on the structure of Φ by:

w ⊧_{ρ} P (M_{1}, …, M_{n}) iff [[P]]_{w}([[M_{1}]]_{w}^{ρ}, …, [[M_{n}]]_{w}^{ρ})
w ⊧_{ρ} Φ ⊃ Ψ  iff for all w′ ≥ w, if w′ ⊧_{ρ} Φ then w′ ⊧_{ρ} Ψ
w ⊧_{ρ} ∀x:A. Φ  iff for all w′ ≥ w, for all a_{w′} ∈ [[A]]_{w′}, w′ ⊧_{ρ[x:=a]} Φ

If H is a set of formulae, each well-formed in Γ, and ρ interprets Γ at w then we write w ⊧_{ρ} H to mean that w ⊧_{ρ} Φ, for all Φ ∈ H. If Φ is well-formed in the empty context then whether w ⊧_{ρ} Φ holds or not is independent of ρ, so we write w ⊧ Φ. We write (W, ≤) ⊧ Φ to mean, for all w ∈ W, w ⊧ Φ.

The lemmas below give basic properties of the forcing relation.

Lemma 3.4 If w ⊧_{ρ} Φ and w ≤ w′ then w′ ⊧_{ρ} Φ.

Lemma 3.5 If Γ ⊳_{Σ} M : A and ρ interprets Γ at w, then w ⊧_{ρ} Φ[M/x] if and only if w ⊧_{ρ[x:=[[M]]^{ρ}]} Φ.

Both these lemmas are proved by induction on the structure of Φ. The base case of the first uses Lemma 3.1 together with the persistency property of the structure.

A (Σ, A)-model is a Σ-structure, (W, ≤), such that, for all Φ ∈ A, (W, ≤) ⊧ Φ.

Theorem 3.6 (soundness and completeness) The two statements below are equivalent.

1. Γ; H ⊢_{(Σ,A)} Φ.

2. For all (Σ, A)-models (W, ≤), for all w ∈ W, for all ρ interpreting Γ at w, if w ⊧_{ρ} H then w ⊧_{ρ} Φ.

We devote the rest of this section to an outline of the proof of the theorem.

Soundness (ie. 1. ⟹ 2.) is proved by a straightforward induction on the derivation of Γ; H ⊢_{(Σ,A)} Φ. Lemma 3.5 is used in the verification of both the ∀E rule and (in conjunction with Lemma 3.3) the Sub rule.

To prove completeness we construct a particular model, (W_{(Σ,A)}, ≤_{(Σ,A)}) based on the presentation (Σ, A). The set of worlds is just:

W_{(Σ,A)} = {(Γ, H) | every formula in H is well-formed in Γ}

Its partial order is given by:

(Γ, H) ≤_{(Σ,A)} (Γ′, H′) iff Γ ⊆ Γ′ and H ⊆ H′

The interpretations of the other components of the Σ-structure are:

[[A]]_{(Γ,H)} = {M | Γ ⊳_{Σ} M:A, M is in long-βη normal form}
[[P]]_{(Γ,H)}(M_{1}, …, M_{n}) iff Γ; H ⊢_{(Σ,A)} P (M_{1}, …, M_{n})
[[c]]_{(Γ,H)} = βη(c)
ϵ_{(Γ,H)}^{AB}(M, N) = βη(M(N))
i_{(Γ,H)(Γ′,H′)}^{A}(M) = M
K_{(Γ,H)}^{AB} = βη(λx:A. λy:B. x)
S_{(Γ,H)}^{ABC} = βη(λx:A → B → C. λy:A → B. λz:A. x(z)(y(z)))

Proposition 3.7 (W_{(Σ,A)}, ≤_{(Σ,A)}) is a Σ-structure.

Proof. First, all the components are clearly well-defined, in particular i_{(Γ,H)(Γ′,H′)}^{A} is, because long-βη normal forms are preserved by context extensions. So we need only check the various conditions. Identity, composition and naturality all follow trivially from the definitions of i_{(Γ,H)(Γ′,H′)}^{A} and ϵ_{(Γ,H)}^{AB}. Persistency is an immediate consequence of weakening (Lemma 2.1). To prove extensionality: suppose M, M′ ∈ [[A → B]]_{(Γ,H)} are such that, for all Γ′ ⊇ Γ, for all H′ ⊇ H, for all N ∈ [[A]]_{(Γ′,H′)}, βη(M(N)) = βη(M′(N)). Then in particular, for x ∈ [[A]]_{(Γ∪{x:A},H)} (where x does not appear in Γ), βη(M(x)) = βη(M′(x)), and so M(x) =_{βη} M′(x). But then λx: A. M(x) =_{βη} λx: A. M′(x) and so (by η-equality) M =_{βη} M′. But M and M′ are both in long-βη normal form, so M = M′, proving extensionality. It remains to check that K^{AB} and S^{ABC} satisfy the required equalities, but these follow easily from the β-rule of typed lambdacalculus. □

Given a context Γ we construct a canonical environment ρ(Γ) as follows. If, for some A, x : A ∈ Γ then ρ(Γ)(x) is the partial element with domain {(Γ′, H) | Γ ⊆ Γ′} given by ρ(Γ)(x)_{(Γ′,H)} = βη(x). Otherwise, if there is no A such that x:A ∈ Γ then ρ(Γ)(x) is the trivial partial element with domain ∅. Clearly, for all Γ′ ⊇ Γ, ρ(Γ) interprets Γ at (Γ′, H).

We can now state the basic properties of (W_{(Σ,A)}, ≤_{(Σ,A)}).

Lemma 3.8 If Γ ⊳_{Σ} M:A and Γ ⊆ Γ′ then [[M]]_{(Γ′,H)}^{ρ(Γ)} = βη(M).

Proof. By an easy induction on the structure of M. □

Lemma 3.9 Γ; H ⊢_{(Σ,A)} Φ if and only if (Γ, H) ⊧_{ρ(Γ)} Φ.

Proof. By induction on the structure of Φ. The cases are:

P (M_{1}, …, M_{n}). Immediate from definition of [[P]]_{(Γ,H)}.

Φ ⊃ Ψ. Suppose Γ; H ⊢_{(Σ,A)} Φ ⊃ Ψ. Take any Γ′ ⊇ Γ and H′ ⊇ H such that (Γ′, H′) ⊧_{ρ(Γ)} Φ. Clearly (Γ′, H′) ⊧_{ρ(Γ′)} Φ. So, by the induction hypothesis, Γ′; H′ ⊢_{(Σ,A)} Φ. Now Γ′; H′ ⊢_{(Σ,A)} Φ ⊃ Ψ, so Γ′; H′ ⊢_{(Σ,A)} Ψ. Then, by the induction hypothesis again, (Γ′, H′) ⊧_{ρ(Γ′)} Ψ, so clearly (Γ′, H′) ⊧_{ρ(Γ)} Ψ (all the variables in Ψ are in Γ). Thus we have shown that (Γ, H) ⊧_{ρ(Γ)} Φ ⊃ Ψ as required.

Conversely, suppose (Γ, H) ⊧_{ρ(Γ)} Φ ⊃ Ψ. Now Γ; H, Φ ⊢_{(Σ,A)} Φ, so, by the induction hypothesis, (Γ, H ∪ {Φ}) ⊧_{ρ(Γ)} Φ. But then, by the supposition, (Γ, H ∪ {Φ}) ⊧_{ρ(Γ)} Ψ. So, again by the induction hypothesis, Γ; H, Φ ⊢_{(Σ,A)} Ψ. Thus clearly Γ; H ⊢_{(Σ,A)} Φ ⊃ Ψ.

∀x:A. Φ. Suppose Γ; H ⊢_{(Σ,A)} ∀x: A. Φ. Take any Γ′ ⊇ Γ, H′ ⊇ H and M ∈ [[A]]_{(Γ′,H′)}. Thus Γ′ ⊳_{Σ} M:A and Γ′; H′ ⊢_{(Σ,A)} ∀x:A. Φ, so Γ′; H′ ⊢_{(Σ,A)} Φ[M/x]. Now, by the induction hypothesis, (Γ′, H′) ⊧_{ρ(Γ′)} Φ[M/x], so clearly (Γ′, H′) ⊧_{ρ(Γ)} Φ[M/x]. Thus, by Lemma 3.5, (Γ′, H′) ⊧_{ρ(Γ)[x:=[[M]]^{ρ(Γ)}]} Φ. Then, by Lemma 3.8, (Γ′, H′) ⊧_{ρ(Γ)[x:=M]} Φ (as M is necessarily in long-βη normal form). We have therefore shown that (Γ, H) ⊧_{ρ(Γ)} ∀x:A. Φ as required.

Conversely, suppose (Γ, H) ⊧_{ρ(Γ)} ∀x:A. Φ. Then βη(x) ∈ [[A]]_{(Γ∪{x:A},H)}. So (Γ ∪ {x:A}, H) ⊧_{ρ(Γ∪{x:A})} Φ. Then, by the induction hypothesis, Γ, x:A; H ⊢_{(Σ,A)} Φ. So clearly Γ; H ⊢_{(Σ,A)} ∀x:A. Φ.

□

Corollary 3.10 (W_{(Σ,A)}, ≤_{(Σ,A)}) is a (Σ, A)-model.

Proof. Immediate. □

We now finish the proof of completeness. Suppose that 2. holds. Then in particular (Γ, H) ⊧_{ρ(Γ)} Φ. So, by Lemma 3.9, Γ; H ⊢_{(Σ,A)} Φ as required.

It is worth comparing our use of Kripke lambda models with the use in [9]. In both cases the role of the partial order is to model intuitionistic entailment. But there are differences in emphasis due to the different logical languages considered. In [9], although it is remarked that the models interpret full intuitionistic predicate logic with quantification over all higher types, only the interpretation of equations is given explicitly. This is because their interest is in obtaining a completeness theorem for the usual equational consequence relation of the typed lambda-calculus when empty types are permitted. In this paper we too are not making full use of the scope of the models. We consider only a fragment of the full intuitionistic logic, and we have no equality predicate in the logic. The absence of equality means that the definition of model could be simplified in various ways. For example, it would be possible to insist that the coercions, i_{ww′}^{A}, are injections. However, such restrictions are unnatural (we shall have use for a model in which the coercions are not inclusions). Furthermore, we wish to keep the definition of model in its full generality to allow the logic to be extended with equality (and indeed the other connectives) if desired. Note that a completeness proof for the logic with equality would require a model built out of equivalence classes of terms (as in [9]), for unique long-βη normal forms would no longer be available.

4 Logics as consequence relations

The emphasis of this paper is to be on the use of the meta-logic as a logical framework. In order to investigate this formally, we need to consider what it means to encode a logic. So, as a preliminary step, it is necessary that we establish a precise notion of logic.

We consider a logic to be a pair, (L, ⊢), where L is a countable set (of formulae) and ⊢⊆ ℘(L)×L is a (possibly non-compact) consequence relation. This viewpoint is over simplistic on (at least) two counts. First, there is no analysis of the underlying syntax of formulae. Second, many well-known logics have consequence relations that are not ordinary. One might also criticise on the grounds that proof-theory and semantics ought to be important components in the definition of a logic. But generally the consequence relation really is the fundamental characteristic of a logic. Though one is often interested in many different proof systems and semantics for the same logic, the consequence relation remains invariant. However, it is to be hoped that natural extensions of the above notion of logic, taking syntax, proof-theory and semantics into account, will arise.

Actually, even according to the above approach, semantic issues are not entirely overlooked. It turns out that the consequence relations we consider correspond exactly to the entailment relations of languages with a certain kind of “validity-style” semantics. It is this correspondence that motivates the choice of definition of consequence relation. It is fair to say that the semantic correspondence is not very deep, but this is inevitable when we work with such a superficial notion of syntax.

For the moment we suppose a given L and an arbitrary ⊢ ⊆ ℘(L) × L. We use φ, ψ and θ to range over elements of L, and Δ to range over subsets of L. Every set of formulae, Δ, determines a theory, Th_{⊢}(Δ), defined by:

Th_{⊢}(Δ) = {φ | Δ ⊢ φ}

We define Theories_{⊢} = {Th_{⊢}(Δ) | Δ ⊆ L}, the set of theories of ⊢. Note that L itself may well be a theory (it will be whenever ⊢ is a consequence relation). It will be a recurring theme that the “inconsistent” theory will not be distinguished, thus enabling many definitions to be more uniform. If desired, all definitions could be easily repaired to treat the inconsistent theory separately.

Definition 4.1 (consequence relation) ⊢ is a consequence relation if it satisfies the following two conditions.

CR1 If φ ∈ Δ then Δ ⊢ φ.

CR2 If Δ′ ⊢ φ and, for all φ′ ∈ Δ′, Δ ⊢ φ′ then Δ ⊢ φ.

A consequence relation, ⊢, is said to be compact if, whenever Δ ⊢ φ, there is a finite Δ′ ⊆ Δ such that Δ′ ⊢ φ.

Definition 4.2 (validity-style semantics) A validity-style semantics for ⊢ is a pair, (Mod, ⊧ ), where Mod is a set (of “models”) and ⊧ ⊆ Mod × L is a (“satisfaction”) relation satisfying:

Δ ⊢ φ iff for all M ∈ Mod, if, for all φ′ ∈ Δ, M ⊧ φ′ then M ⊧ φ

Theorem 4.3 The following are equivalent.

1. ⊢ is a consequence relation.

2. Th_{⊢} is a closure operation on ℘(L).

3. ⊢ has a validity-style semantics.

Proof. It is easy to check that 1. is equivalent to 2. and that 3. implies 1.. To see that 1. implies 3., assume that ⊢ is a consequence relation. We now exhibit a validity-style semantics for ⊢. The set of models is:

Mod = ℘(L)

and the satisfaction relation is defined by:

Δ ⊧ φ iff Δ ⊢ φ

It is easy to check that this is indeed a validity-style semantics for ⊢. □

Theorem 4.3 gives the promised correspondence between consequence relations and semantics. One way in which it is rather shallow is that it says nothing about the existence or nature of “interesting” models.

Henceforth we take ⊢ to be a consequence relation over L, and (Mod, ⊧) to be a chosen validity-style semantics for ⊢.

We now fix some notation that we shall use later on. Each set of formulae, Δ, determines a set of models, Mods_{⊧}(Δ), defined by:

Mods_{⊧}(Δ) = {M | for all φ ∈ Δ, M ⊧ φ}

We say that M ∈ Mods_{⊧}(Δ) is a model of Δ. In fact the set of models is determined by the theory of Δ, that is, Mods_{⊧}(Δ) = Mods_{⊧}(Th_{⊢}(Δ)). Note again that the inconsistent theory, L, is not treated specially in that Mods_{⊧}(L) may be non-empty. Conversely, each set of models, S, determines a theory, Th_{⊧}(S), defined by:

Th_{⊧}(S) = {φ | for all M ∈ S, M ⊧ φ}

It is easy to check that Th_{⊧}(S) is indeed a theory.

The definition of consequence relation above is standard except that we do not follow the common practice of assuming compactness. In essence it is equivalent to the relations considered ever since Tarski introduced his consequence operators [15]. There are two reasons for not assuming compactness. One is that many interesting non-compact logics exist. The second is that without compactness we obtain the equivalences of Theorem 4.3. The notion of validitystyle semantics used in the theorem is a familiar one from abstract model theory [2]. The correspondence between consequence relations and semantics is similar to Scott’s truth-valuation motivation for his two-sided consequence relations [14].

5 Encoding logics in the meta-logic

We now consider how the meta-logic can be used to encode the consequence relation of a logic. An encoding of (L, ⊢) is given by a presentation (T , P, Σ, A) containing a distinguished type constant, o ∈ T , and a distinguished predicate, true, with declaration true : ⟨o⟩ ∈ P, together with a bijective function:

(·)^{∗} : L → {M |⊳_{Σ} M:o, M is in long-βη normal form}

mapping formulae of the object-logic to their representing terms in the meta-logic.

For an encoding to be of any use, it must respect the consequence relation of the encoded logic. The encoding is said to be full if:

Δ ⊢ φ implies true(Δ^{∗}) ⊢_{(Σ,A)} true(φ^{∗})

where true(Δ^{∗}) denotes the set {true(ψ^{∗}) | ψ ∈ Δ}. It is said to be faithful if:

true(Δ^{∗}) ⊢_{(Σ,A)} true(φ^{∗}) implies Δ ⊢ φ

An encoding which is both full and faithful is said to be adequate. Adequacy is a minimal correctness condition. Without it there is a mismatch between the consequence relation of the logic and its representation in the meta-logic.

Clearly any logic that has an adequate encoding must be compact (this is because of the evident compactness of meta-logical consequence). In fact the converse holds: any compact logic has an adequate encoding. We do not go into details as the encoding is obtained in a wholly unilluminating way (for example one includes separate term constants for each φ ∈ L) and is in general infinite. A more interesting result might be obtainable by considering some suitable notion of effective consequence relation. The compactness of such a consequence relation ought to follow from an adaptation of the Myhill-Sheperdson theorem of recursive function theory. The desired theorem would be that the notion of effective consequence relation coincides with that of consequence relation with an adequate finite presentation.

The two halves of adequacy each correspond to conditions on the class of (Σ, A)-models. Given a (Σ, A)-model, (W, ≤), define form : W → ℘(L) by:

form(w) = {φ | w ⊧ true(φ^{∗})}

We write form(W) for the set {form(w) | w ∈ W }.

Proposition 5.1 The following are equivalent:

1. The encoding is full.

2. For all (Σ, A)-models (W, ≤), form(W) ⊆ Theories_{⊢}.

Proof. Suppose the encoding is full. Let (W, ≤) be any (Σ, A)-model, and take any w ∈ W. We must show that form(w) ∈ Theories_{⊢}. Suppose then that form(w) ⊢ φ. By fullness, true(form(w)^{∗}) ⊢_{(Σ,A)} true(φ^{∗}). But, by definition of form(w), for all ψ ∈ form(w), w ⊧ true(ψ^{∗}). So, by the soundness of the meta-logic, w ⊧ true(φ^{∗}). But then φ ∈ form(w). So indeed form(w) ∈ Theories_{⊢}.

Conversely, suppose that, for all (Σ, A)-models (W, ≤), form(W) ⊆ Theories_{⊢}. Suppose further that Δ ⊢ φ. We must show that true(Δ^{∗}) ⊢_{(Σ,A)} true(φ^{∗}). For this we use the model, (W_{(Σ,A)}, ≤_{(Σ,A)}), constructed in the proof of completeness in section 3. By Corollary 3.10, we know this is indeed a (Σ, A)-model. Consider the world (∅, true(Δ^{∗})). By the initial supposition, form((∅, true(Δ^{∗}))) ∈ Theories_{⊢}. But clearly Δ^{∗} ⊆ form((∅, true(Δ^{∗}))), so φ ∈ form((∅, true(Δ^{∗}))) (as any theory is closed under consequence). Therefore (∅, true(Δ^{∗})) ⊧ true(φ^{∗}). So, by the definition of (W_{(Σ,A)}, ≤_{(Σ,A)}), true(Δ^{∗}) ⊢_{(Σ,A)} true(φ^{∗}). □

Proposition 5.2 The following are equivalent:

1. The encoding is faithful.

2. There exists a (Σ, A)-model, (W, ≤), such that Theories_{⊢} ⊆ form(W).

Proof. Suppose the encoding is faithful. We will show that the (Σ, A)-model (W_{(Σ,A)}, ≤_{(Σ,A)}) has the required property. Take any T ∈ Theories_{⊢}. We must show that there exists (Γ, H) ∈ W_{(Σ,A)} with form((Γ, H)) = T. For this, we take the world, (∅, true(T^{∗})). Clearly (from the definition of (W_{(Σ,A)}, ≤_{(Σ,A)})) T ⊆ form((∅, true(T^{∗}))). We now show that form((∅, true(T^{∗}))) ⊆ T. Suppose that φ ∈ form((∅, true(T^{∗}))). Then (∅, true(T^{∗})) ⊧ true(φ^{∗}), so true(T^{∗}) ⊢_{(Σ,A)} true(φ^{∗}). Therefore, by faithfulness, T ⊢ φ. Thus indeed φ ∈ T (as T is closed under consequence).

Conversely, suppose there exists a (Σ, A)-model, (W, ≤), such that Theories_{⊢} ⊆ form(W). Suppose further that true(Δ^{∗}) ⊢_{(Σ,A)} true(φ^{∗}). We must show that Δ ⊢ Φ. Let w ∈ W be such that form(w) = Th_{⊢}(Δ) (such a w is guaranteed to exist by the assumed property of (W, ≤)). Clearly, for all ψ ∈ Δ, w ⊧ true(ψ^{∗}). So, by soundness, w ⊧ true(φ^{∗}). But then φ ∈ form(w) so φ ∈ Th_{⊢}(Δ). Thus Δ ⊢ φ as required. □

The above propositions give the basic connections between the semantics of the meta-logic and the use of the meta-logic as a logical framework. Due to the universal quantification over models, Proposition 5.1 is of mainly formal interest. In contrast, Proposition 5.2 is genuinely useful and will provide an important tool in the sequel.

One important use of Proposition 5.2 will be to establish the adequacy of encodings. Proving adequacy is a three stage process. First, it is necessary to define the encoding function and show that it is indeed a bijection as required. This task can only be done syntactically, usually by an easy induction on the long-βη normal forms of appropriate types. Second, it is necessary to establish fullness. Normally the easiest way to do this is to start with a proof system for the encoded logic and map proofs of logical consequence in this system to proofs of the representation of the consequence in the meta-logic. Again this step is usually straightforward. Lastly, faithfulness remains to be proved. The standard technique is to show that the mapping of proofs used in establishing fullness is itself a bijection onto meta-logical proofs in a certain normal form. However, in order to do this it is necessary that the meta-theory does stand in the right relationship to the proof system of the object-logic. Often this will not be the case, either because of the inability of the meta-logic to exactly mimic the proof system or, more positively, because the meta-theory allows other (still valid) inferences not directly avilable in the original proof system (see the next section). No doubt, even in such difficult cases, it is still possible to prove faithfulness by a syntactic argument. However, Proposition 5.2 offers an alternative approach. It is enough to construct a (Σ, A)-model with the requisite property (which is usually apparent). These two approaches to proving faithfulness are analogous to the two standard approaches to proving the underivability of a formula in logic using, on the one hand, a normal-form result for derivations and, on the other, a model refuting the formula.

We conclude this section with an example semantic proof of adequacy. We shall show that the presentation, (T_{A}, P_{A}, Σ_{A}, A_{Q}) (the “A” subscript stands for arithmetic, the “Q” subscript stands for system Q), in Figure 7 gives an adequate encoding of the consequence relation, (L_{A}, ⊢_{Q}), of Robinson’s arithmetic, Q. The language of Q is that of first-order arithmetic, with terms, t, and formulae, φ, in accordance with the grammar below.

t ::= x | 0 | s(t) | t_{1} + t_{2} | t_{1} · t_{2}
φ ::= t_{1} = t_{2} | ¬φ | φ ⇒ ψ | ∀x. φ

For simplicity we just consider two connectives (implication and negation) and one (the universal) quantifier (which is enough as the logic is classical). Again, we assume that the notions of free and bound variable are understood. As usual, a sentence is a formula with no free variables. Although we have been informally referring to L as the formulae of the object-logic, here we take L_{A} to be the sentences of arithmetic. ⊢_{Q} is just classical first-order entailment over L_{A} subject to the validity of the axioms for Q. Note that we are considering Q as a logic, and hence as a consequence relation. This is a slight abuse of terminology, Q should really refer to a particular theory: the sentences φ for which ⊢_{Q} φ. However, we are more interested in the logic than the theory, as (T_{A}, P_{A}, Σ_{A}, A_{Q}) will turn out to be adequate for logical consequence. It is also of practical interest to encode the consequence relation. For example, we might want to consider derivations from true (or even false) unprovable formulae such as Gödel’s sentence or various forms of induction.

T_{A} = {ι, o}
P_{A} = {true:⟨o⟩}
Σ_{A} = {⇒: o → o → o, ¬ : o → o, ∀ : (ι → o) → o, = : ι → ι → o,

0 : ι, s : ι → ι, + : ι → ι → ι, · : ι → ι → ι}

A_{Q} = {∀φ:o. ∀ψ:o. true(φ ⇒ ψ ⇒ φ),

∀φ:o. ∀ψ:o. ∀θ:o. true((φ ⇒ ψ ⇒ θ) ⇒ (φ ⇒ ψ) ⇒ φ ⇒ θ), ∀φ:o. ∀ψ:o. true((¬φ ⇒ ¬ψ) ⇒ ψ ⇒ φ), ∀φ:ι → o. ∀t:ι. true((∀x. φ(x)) ⇒ φ(t)), ∀t:ι. true(t = t), ∀φ:o. ∀ψ:o. true(φ ⇒ ψ) ⊃ true(φ) ⊃ true(ψ), ∀φ:o. ∀ψ:ι → o. (∀x:ι. true(φ ⇒ ψ(x))) ⊃ true(φ ⇒ ∀x. ψ(x)), ∀φ:ι → o. ∀t_{1} :ι. ∀t_{2} :ι. true(t_{1} = t_{2}) ⊃ true(φ(t_{1})) ⊃ true(φ(t_{2})), true(∀x. ∀y. s(x) = s(y) ⇒ x = y), true(∀x. ¬ s(x) = 0), true(∀x. ¬ x = 0 ⇒ ¬ ∀y. ¬ x = s(y)), true(∀x. x + 0 = x), true(∀x. ∀y.x + s(y) = s(x + y)), true(∀x. x · 0 = 0), true(∀x. ∀y. x · s(y) = (x · y) + x)}

Figure 7: A presentation of Robinson’s Q.

Before proving adequacy, we give a brief informal explanation of the presentation in Figure 7. There are two type constants: ι for terms and o for formulae. The term constructors in Σ generate the first-order language for arithmetic. Implication is deliberately distinguished notationally from meta-logical implication, and universal quantification is distinguished from its meta-logic counterpart by a different convention of usage. For readability we write ⇒, =, + and · as infix operators, using standard conventions (for example, ⇒ associates to the right). We also write ∀x.φ for ∀(λx:ι. φ). The axioms of the presentation divide naturally into groups. The first five give axioms for classical first-order logic with equality, and the next three give rules of inference (each of these groups subdivides further into a propositional part, a quantificational part and an equality part). The system presented is a quite standard Hilbert system, though our slavery to Okham’s razor means there is unlikely to be an identical system in the literature. The next seven axioms are just the axioms of Q. These consist of Peano’s six axioms together with the additional axiom, ∀x. ¬ x = 0 ⇒ ¬ ∀y. ¬ x = s(y), necessary in the absence of induction.

Given our notational conventions, it is now a simple matter to define the mapping (·)^{∗} from L_{A} to long-βη normal forms of type o. If φ is a sentence then φ is also (the notation for) a term of the meta-logic. Thus we take (·)^{∗} to be the identity map on notation. To see that this has the correct properties one proves, by an easy induction on the structure of terms and formulae, that if all free variables in t and φ are contained in the finite set X of variables, then {x:ι | x ∈ X} ⊳_{Σ_{A}} t:ι and {x:ι | x ∈ X} ⊳_{Σ_{A}} φ:o, and moreover t and φ are both in long-βη normal form. Further, by induction on the structure of long-βη normal forms of terms of type ι and o in contexts of the form {x:ι | x ∈ X}, one shows that all such terms arise uniquely from a t or a φ respectively. Thus, specialising to the case X = ∅, we have that (·)^{∗} is a bijection as required.

Next we should prove fullness. This step is easy in principle but tedious to carry out in detail, so we give only the general outline. Take any Hilbert system for first-order logic with equality, together with the axioms for Q (note that the Hilbert system chosen does not have to be the same as that implicitly given in A_{Q}). We want to translate derivations of φ from assumptions φ_{1}, …, φ_{n} in the Hilbert system (where all the φ, φ_{1}, …, φ_{n} are sentences) onto proofs of true(φ_{1}), …, true(φ_{n}) ⊢_{(Σ_{A},A_{Q})} true(φ). For this it is necessary to translate derivations of open formulae from open formulae. Suppose then that φ, φ_{1}, …, φ_{n} are formulae with all free variables contained in the finite set X = {x_{1}, …, x_{k}}. We write ∀X:ι. Φ for the meta-formula ∀x_{1} :ι. … ∀x_{k}:ι. Φ. One can now prove, by induction on derivations in the Hilbert system, that if φ follows from φ_{1}, …, φ_{n}, then:

∀X:ι. true(φ_{1}), …, ∀X:ι. true(φ_{n}) ⊢_{(Σ_{A},A_{Q})} ∀X:ι. true(φ)

Again, specialising this to the case X = ∅ gives the desired result.

Only adequacy remains to be proved. To this end we construct a (Σ_{A}, A_{Q})-model satisfying the condition of Proposition 5.2. Let Mod_{Q} be the “set” of all classical models of Q. For each M in Mod_{Q} we distinguish its internal structure as (N_{M}, 0_{M}, s_{M}, +_{M}, ·_{M}). We are going to construct a (Σ_{A}, A_{Q})-model (W_{Q}, ≤_{Q}). The partially ordered set of worlds is given by (W_{Q}, ≤_{Q} ) = (℘(Mod_{Q}), ⊇) (the reader who is bothered by the size problem should make some suitable restriction such as only considering models, M, with domain, N_{M}, contained in a given infinite set). A world is thus a subset S ⊆ Mod_{Q}. Before giving the interpretations of the different components of the Σ_{A}-structure at each world, we first interpret the type structure “pointwise” at each M ∈ Mod_{Q}. The interpretation at S is then given by the S-indexed direct product of the relevant pointwise interpretations.

Let M be any model of Q. The pointwise interpretation of types at M is given by the full type hierarchy:

[[ι]]_{M} = N_{M}
[[o]]_{M} = Ω
[[A → B]]_{M} = [[B]]_{M}^{[[A]]_{M}}

where Ω = {tt, ff}, the set of truth values. Rather than give an exhaustive treatment of the constants in Σ_{A}, we define a representative sample. The interpretation of ¬, ∀, = and + at M will be elements [[¬]]_{M} ∈ Ω^{Ω}, [[∀]]_{M} ∈ Ω^{Ω^{N_{M}}}, [[=]]_{M} ∈ (Ω^{N_{M}})^{N_{M}} and [[+]]_{M} ∈ (N_{M}^{N_{M}})^{N_{M}} respectively. These are defined by:

[[¬]]_{M}(b) = \{ \begin{matrix}tt & if b = ff \\ ff & if b = tt \end{matrix}

[[∀]]_{M}(f) = \{ \begin{matrix}tt & if, for all a ∈ N_{M}, f(a) = tt \\ ff & otherwise \end{matrix}

[[=]]_{M}(a_{1})(a_{2}) = \{ \begin{matrix}tt & if a_{1} = a_{2} \\ ff & otherwise \end{matrix}
[[+]]_{M}(a_{1})(a_{2}) = +_{M}(a_{1}, a_{2})

In short, the constants are interpreted in line with their real world meanings according to the Tarskian semantics of first-order logic.

The combinators K^{AB} and S^{ABC} are given the usual pointwise interpretations. For example, K_{M}^{AB} ∈ ([[A]]_{M}^{[[B]]_{M}})^{[[A]]_{M}} is defined by K_{M}^{AB}(a)(b) = a.

The above interpretations of constants at M can be extended to all well-typed terms just by taking the usual interpretation of the typed lambda calculus in the full type hierarchy. Thus if Γ ⊳_{Σ_{A}} M:A and γ is a environment function mapping each variable x_{i} with declaration x_{i}:A_{i} in Γ to an element of [[A_{i}]]_{M}, then M has an interpretation [[M]]_{M}^{γ} ∈ [[A]]_{M}. When M is closed we just write [[M]]_{M} ∈ [[A]]_{M}. The crucial property of the pointwise interpretation, the mimicry of the Tarskian semantics, is given by the lemma below.

Lemma 5.3 If ⊳_{Σ_{A}} φ:o then [[φ]]_{M} = tt if and only if M ⊧ φ.

Proof. The proof is by induction on the structure of φ. The induction passes through open formulae and terms using the established correspondences between these and long-βη normal forms of appropriate type.

For terms, suppose all variables in t are contained in the set X = {x_{1}, …, x_{k}}. Given γ : X → N_{M} (recall [[ι]]_{M} = N_{M}), one shows by an induction on t (similar to but easier than the induction on φ given below) that [[t]]_{M}^{γ} is just the usual first-order interpretation of t in M according to the environment γ.

Now, for formulae, suppose all free variables in φ are contained in X as above. We show, by induction on φ, that, for all γ as above, [[φ]]_{M}^{γ} = tt if and only if M ⊧_{γ} φ. The four cases are:

t_{1} = t_{2}. [[t_{1} = t_{2}]]_{M}^{γ} = tt if and only if (by definition of [[=]]_{M}) [[t_{1}]]_{M}^{γ} = [[t_{2}]]_{M}^{γ} if and only if (by established result on terms) M ⊧_{γ} t_{1} = t_{2}.

¬φ. [[¬φ]]_{M}^{γ} = tt if and only if (by definition of [[¬]]_{M}) [[φ]]_{M}^{γ} = ff if and only if (by induction hypothesis) M |̸=_{γ} φ if and only if M ⊧_{γ} ¬φ . φ ⇒ ψ. Similar to ¬φ.

∀x. φ. [[∀(λX : ι. φ)]]_{M}^{γ} = tt if and only if (by definition of [[∀]]_{M}), for all a ∈ N_{M}, [[λX : ι. φ]]_{M}^{γ}(a) = tt if and only if, for all a ∈ N_{M}, [[φ]]_{M}^{γ[x:=a]} = tt (using an obvious notation for updating γ) if and only if (by induction hypothesis), for all a ∈ N_{M}, M ⊧_{γ[x:=a]} φ if and only if M ⊧_{γ} ∀x. φ.

The lemma follows by specialising to X = ∅. □

We can now define all the remaining components of the Σ_{A}-structure, (W_{Q}, ≤_{Q}). Types, constants and combinators are interpreted at S by:

[[A]]_{S} = Π_{M∈S}[[A]]_{M}
[[c]]_{S} = {[[c]]_{M}}_{M∈S}
K_{S}^{AB} = {K_{M}^{AB}}_{M∈S}
S_{S}^{ABC} = {S_{M}^{ABC}}_{M∈S}

The only predicate, true, is given the interpretation:

[[true]]_{S}({b_{M}}_{M∈S}) iff for all M ∈ S, b_{M} = tt

Finally, ϵ_{S}^{AB} and i_{SS′}^{A} (where S′ ⊆ S) are defined by:

ϵ_{S}^{AB}({f_{M}}_{M∈S}, {a_{M}}_{M∈S}) = {f_{M}(a_{M})}_{M∈S}
i_{SS′}^{A}({a_{M}}_{M∈S}) = {a_{M}}_{M∈S′}

It is straightforward to check the required conditions showing that the construction above does indeed give a Σ_{A}-structure.

A basic but important property of the defined Σ_{A}-structure relates the interpretation of terms at S to their pointwise interpretations at all M ∈ S.

Lemma 5.4 Suppose Γ ⊳_{Σ_{A}} M : A and ρ interprets Γ at S. Define, for M ∈ S, a function γ_{M}^{ρ} : X → [[A]]_{M} (where X is the set of variables in Γ) by:

γ_{M}^{ρ}(x) = a_{M} where ρ(x)_{S} = {a_{M}}_{M∈S}

Then [[M]]_{S}^{ρ} = {[[M]]_{M}^{γ_{M}^{ρ}}}_{M∈S}.

Proof. By a straightforward induction on the structure on M. □

Finally we are in a position to establish the facts we need to prove the faithfulness of (Σ_{A}, A_{Q}). In the results below we make frequent use of the notation introduced on page 323.

Lemma 5.5 form(S) = Th_{⊧}(S).

Proof. We must show that S ⊧ true(φ) if and only if, for all M ∈ S, M ⊧ φ. But S ⊧ true(φ) if and only if [[φ]]_{S} = {tt}_{M∈S} if and only if (by Lemma 5.4), for all M ∈ S, [[φ]]_{M} = tt if and only if (by Lemma 5.3), for all M ∈ S, M ⊧ φ. □

Proposition 5.6 (W_{Q}, ≤_{Q}) is a (Σ_{A}, A_{Q})-model.

Proof. We must show that, for all Φ ∈ A_{Q}, (W_{Q}, ≤_{Q}) ⊧ Φ. First note that for the last seven axioms of A_{Q} in Figure 7 this follows immediately from Lemma 5.5. Of the other eight meta-axioms we validate three.

1. ∀φ:o. ∀ψ:o. true(φ ⇒ ψ ⇒ φ).

Suppose we have S and ρ with ρ(φ)_{S} = {a_{M}}_{M∈S} and ρ(ψ)_{S} = {b_{M}}_{M∈S}. Then:

[[φ ⇒ ψ ⇒ φ]]_{S}^{ρ} = {[[⇒]]_{M}(a_{M})([[⇒]]_{M}(b_{M})(a_{M}))}_{M∈S} (by Lemma 5.4)
= {tt}_{M∈S}

So S ⊧_{ρ} true(φ ⇒ ψ ⇒ φ) as required.

2. ∀φ:o. ∀ψ:ι → o. (∀x:ι. true(φ ⇒ ψ(x))) ⊃ true(φ ⇒ ∀x. ψ(x)).

Suppose we have S and ρ with ρ(φ)_{S} = {b_{M}}_{M∈S} and ρ(ψ)_{S} = {f_{M}}_{M∈S} such that S ⊧_{ρ} ∀x : ι. true(φ ⇒ ψ(x)). Then for all {a_{M}}_{M∈S} ∈ [[ι]]_{S}, S ⊧_{ρ[x:={a_{M}}]} true(φ ⇒ ψ(x)). So, by Lemma 5.4, for all a_{M} ∈ N_{M}, [[⇒]]_{M}(b_{M})(f_{M}(a_{M})) = tt. But then [[⇒]]_{M}(b_{M})([[∀]]_{M}(f_{M})) = tt (by the usual reasoning). And thus, again by Lemma 5.4, [[φ ⇒ ∀x. ψ(x))]]_{S}^{ρ} = {tt}_{M∈S}. So S ⊧_{ρ} true(φ ⇒ ∀x. ψ(x)) as required.

3. ∀φ:ι → o. ∀t_{1} :ι. ∀t_{2} :ι. true(t_{1} = t_{2}) ⊃ true(φ(t_{1})) ⊃ true(φ(t_{2})).

Suppose we have S and ρ with ρ(φ)_{S} = {f_{M}}_{M∈S}, ρ(t_{1})_{S} = {a_{M}}_{M∈S} and ρ(t_{2})_{S} = {b_{M}}_{M∈S} such that S ⊧_{ρ} true(t_{1} = t_{2}) and S ⊧_{ρ} true(φ(t_{1})). Then, applying Lemma 5.4 as above, it is easy to see that, for all M ∈ S, a_{M} = b_{M} and f_{M}(a_{M}) = tt, so obviously f_{M}(b_{M}) = tt. Now, again by Lemma 5.4, S ⊧_{ρ} true(φ(t_{2})) as required.

The other axioms are validated in a similar way. □

The faithfulness of (Σ_{A}, A_{Q}) now follows easily. We need only show that (W_{Q}, ≤_{Q}) has the property required by Proposition 5.2. Let, T, be a theory of ⊢_{Q}. We must show that T = form(S) for some S ∈ W_{Q}. Define S_{T} = Mods_{⊧}(T). By the completeness theorem for firstorder logic, φ ∈ T if and only if, for all M ∈ S_{T}, M ⊧ φ. So by Lemma 5.5, T = form(S_{T}). Note that the reader who has taken W_{Q} to be defined over models, M, with N_{M} contained in a given infinite set must do a little more work. In this case, S_{T} is defined to be the set of models of T of the appropriate form, so an appropriate weak form of the Löwenheim-Skolem theorem is required to give completeness in terms of the models considered.

Perhaps the above proof of adequacy seems rather long-winded. Indeed, a syntactic proof along the lines of those in [6, 12] would have probably been shorter. However, now that we have constructed the model and established its properties we are free to exploit it without repeating the effort. This we will do on page 338 to establish, very easily, the adequacy of an extension of (Σ_{A}, A_{Q}). Another benefit of the semantic proof is that the model constructed gives us some intuition as to the meaning of meta-logical propositions.

Clearly, the above proof does not rely on any properties particular to Robinson’s Q. In fact analogous methods work for any first-order theory. However, now we confess to why we considered Q in preference to Peano Arithmetic (PA). One would like to axiomatise the induction schema by a single meta-axiom:

∀φ:ι → o. true(φ(0) ⇒ (∀x. φ(x) ⇒ φ(s(x))) ⇒ ∀x.φ(x))

And indeed adding this axiom to A_{Q} (we call the new set A_{PA}) does give an adequate presentation of PA. Unfortately, the Σ_{A}-structure constructed, following the above method, out of models of PA is not a (Σ_{A}, A_{PA})-model. The problem is easy to identify. The axiom giving the induction principle has the full power of the second-order induction axiom in the Σ_{A}-structure. Thus it can not hold at any world (sets of models of PA) that contains a non-standard model of arithmetic. One might try to patch this by restricting the pointwise interpretations of predicate types to arithmetically definable relations. Thus [[ι → o]]_{M} and [[ι → ι → o]]_{M} would be respectively the unary and binary arithmetic relations in M. Unfortunately, this attempted remedy is also doomed. Semantically we must be able to apply any element of [[ι → ι → o]]_{M} to any element of [[ι]]_{M} and obtain an element of [[ι → o]]_{M}. But if we apply a binary arithmetic relation to a non-standard element of N_{M}, the resulting unary relation is no longer arithmetically definable.

One way of avoiding the problem is to take, in place of the above meta-axiom for induction, all instances of the following meta-schema:

true(φ(0) ⇒ (∀x. φ(x) ⇒ φ(s(x))) ⇒ ∀x.φ(x))

(where φ ranges over {φ | ⊳_{Σ_{A}} φ:ι → o, φ is in long-βη normal form}). With this schema the constructed Σ_{A}-structure does indeed give a model. However, this is clearly an unsatisfactory solution. The presentation is infinite whereas (Σ_{A}, A_{PA}) is an finite presentation of PA.

It is possible to prove the adequacy of (Σ_{A}, A_{PA}) by constructing a syntactic model over the lattice of theories of PA. We do not give details, as there is an example of a of similar (but simpler) construction in the next section. A syntactic model could also be used to prove the faithfulness of (Σ_{A}, A_{Q}). However, we preferred to give the above proof to show how, in some cases, an entirely semantic proof is possible.

6 Admissible rules

In this section we develop a simple theory of sequent rules for an arbitrary logic. Given an encoding of the logic, each rule has a corresponding meta-formula expressing its admissibility. We use the semantics to investigate under what conditions the meta-formulae corresponding to admissible rules are theorems in the meta-theory given by an adequate presentation.

Throughout this section (L, ⊢) is an arbitrary consequence relation. When referred to, (Σ, A) is assumed to be a presentation giving, by means of the mapping (·)^{∗}, an adequate encoding of (L, ⊢).

In examples we will often assume that each L has a binary implication connective, ⇒. By this we mean that there is a distinguished injective function from L × L to L, and we write φ ⇒ ψ for the value of this function when applied to φ and ψ. We say that ⊢ satisfies modus ponens if:

for all Δ, φ and ψ, if Δ ⊢ φ ⇒ ψ and Δ ⊢ φ then Δ ⊢ ψ.

We say that ⊢ satisfies the deduction theorem if:

for all Δ, φ and ψ, if Δ, φ ⊢ ψ then Δ ⊢ φ ⇒ ψ.

A sequent is a non-empty finite sequence of formulae (φ_{1}, …, φ_{m}, φ). Normally one would write φ_{1}, …, φ_{m} ⊢ φ. The reason for using such a neutral notation is that the symbols “⊢”, “→”, “⊃” and “⇒” are already tied up. A rule has the form:

\underline{S_{1} … S_{n}} ; S  (3)

where n ≥ 0 and S_{1}, …, S_{n}, S are all sequents. A sequent, (φ_{1}, …, φ_{m}, φ), is said to be Δ-valid if Δ, φ_{1}, …, φ_{m} ⊢ φ. A rule (of the above form) is said to be admissible if:

for all Δ, if, for all i (1 ≤ i ≤ n), S_{i} is Δ-valid then S is Δ-valid.

Thus, for example, the rule:

(φ, ψ) ; \overline{(φ ⇒ ψ)}  (4)

is admissible for all φ and ψ if and only if the deduction theorem holds for ⊢.

Given a sequent S = (φ_{1}, …, φ_{m}, φ), consider the meta-formula, which we call S^{∗}, below.

true(φ_{1}^{∗}) ⊃ … ⊃ true(φ_{m}^{∗}) ⊃ true(φ^{∗})

Intuitively this meta-formula expresses the meta-proposition that φ_{1}, …, φ_{m} ⊢ φ holds. Now given a rule, R, of the general form (3), define its translation, R^{∗}, to be the meta-formula below.

S_{1}^{∗} ⊃ … ⊃ S_{n}^{∗} ⊃ S^{∗}

Intuitively, this meta-formula expresses that the rule is admissible. The above intuitions will be given substance by results below.

It is worth commenting on our notions of rule and admissibility and how these relate to the usual notions. The most common notion of admissible rule is that given by Troelstra [16, §1.11.1] (see also [7, pages 69–70]). However, there the notion of rule is one between formulae rather than sequents and the notion of admissibility is with respect to a fixed theory rather than a consequence relation. For us the consequence relation is of primary interest. It is for this reason that we consider a more general form of rule with sequents for premisses and conclusion. Now the notion of admissibility for a rule of the form (3) depends on how we stipulate that this rule is to be applied. Suppose S_{i} = (φ_{i1}, …, φ_{im_{i}}, ψ_{i}) (1 ≤ i ≤ m) and S = (φ_{1}, …, φ_{m}, φ). One possibility would be to stipulate that the rule is only applicable when, for all 1 ≤ i ≤ n, φ_{i1}, …, φ_{im_{i}} ⊢ ψ_{i}; in which case one deduces that φ_{1}, …, φ_{m} ⊢ φ. Clearly this notion of rule application induces a different notion of admissibility from ours. Our definition of admissibility is motivated instead by the natural-deduction conception of rule application. Written in a more suggestive format, we think of the rule above as:

[φ_{11}, …, φ_{1m_{1}}]  [φ_{n1}, …, φ_{nm_{n}}]
ψ_{1} … ψ_{n} φ_{1} … φ_{m}
φ

So the rule is applicable if, for all 1 ≤ i ≤ n, Δ, φ_{i1}, …, φ_{im_{i}} ⊢ ψ_{i} and, for all 1 ≤ i ≤ m, Δ ⊢ φ_{i}; in which case we deduce Δ ⊢ φ, the formulae in Δ being carried around as unused assumptions. With a little shuffling of the conseqences it is easy to see that our definition of admissibility is now the appropriate one. We remark here that it would be interesting to consider notions of admissibility for the more general higher-order rules of Schroeder-Heister [13]. However, the (second-order) rules we consider include all the natural deduction rules in common usage.

One serious defect in our notion of rule is that each rule is considered only with respect to fixed formulae. Usually rules are schematic. The deduction theorem would normally be considered as just one rule in the shape of (4) schematic over φ and ψ. One would then prefer the following translation (which we henceforth call DT):

∀φ:o. ∀ψ:o. (true(φ) ⊃ true(ψ)) ⊃ true(φ ⇒ ψ)

The problem with this approach is that, in order to make sense of a general notion of schematic rule, we require some theory of propositional connectives in L. Similarly, for DT to be well

T_{m} = {o}
P_{m} = {true:⟨o⟩}
Σ_{m} = {⇒: o → o → o, a : o, b : o}
A_{m} = {∀φ:o. ∀ψ:o. true(φ ⇒ ψ ⇒ φ),

∀φ:o. ∀ψ:o. ∀θ:o. true((φ ⇒ ψ ⇒ θ) ⇒ (φ ⇒ ψ) ⇒ φ ⇒ θ), ∀φ:o. ∀ψ:o. true(φ ⇒ ψ) ⊃ true(φ) ⊃ true(ψ)}

A′_{m} = A_{m} ∪ {((true(a) ⊃ true(b)) ⊃ true(a)) ⊃ true(a)}

Figure 8: Presentations of propositional minimal implicational logic.

formed, we require a consant ⇒: o → o → o in Σ. Further, there would have to be extra conditions on the translation (·)^{∗} ensuring preservation of connectives and compositionality. These are perfectly reasonable requirements (see Σ_{A} for example), but would take us away from the simple-minded notion of logic of section 4. However, when possible, we shall consider DT in the examples that follow.

A first and simple connection between the adequacy of rules and the theoremhood of their meta-logical translations is given by the proposition below. Remember that (Σ, A) is assumed to give an adequate encoding of (L, ⊢).

Lemma 6.1 For all sequents, S, S is Δ-valid if and only if true(Δ^{∗}) ⊢_{(Σ,A)} S^{∗}.

Proof. A sequent, S = (φ_{1}, …, φ_{m}, φ), is Δ-valid if and only if Δ, φ_{1}, …, φ_{m} ⊢ φ if and only if (by adequacy) true(Δ^{∗}), true(φ_{1}^{∗}), …, true(φ_{n}^{∗}) ⊢_{(Σ,A)} true(φ^{∗}) if and only if true(Δ^{∗}) ⊢_{(Σ,A)} S^{∗}. □

Proposition 6.2 For all rules R, if ⊢_{(Σ,A)} R^{∗} then R is admissible.

Proof. Suppose ⊢_{(Σ,A)} S_{1}^{∗} ⊃ … ⊃ S_{n}^{∗} ⊃ S^{∗}. Take an arbitrary Δ such that, for all i (1 ≤ i ≤ n), S_{i} is Δ-valid. We must show that S is Δ-valid. Now, by the lemma, for all i (1 ≤ i ≤ n), true(Δ^{∗}) ⊢_{(Σ,A)} S_{i}^{∗}. So clearly true(Δ^{∗}) ⊢_{(Σ,A)} S^{∗}. But then, again by the lemma, S is Δ-valid as required. □

In [6] it is noted that the meta-logic has no facility for induction, so there is no general way of proving the admissibility of inference rules. However, we are only considering instances of rules rather than quantified schematic rules, so induction can play no part. Nevertheless, as we prove below, the converse of Proposition 6.2 still fails: in general there are admissible rules R such that ⊬_{(Σ,A)} R^{∗}. It is therefore natural to consider extensions of A with unprovable translations of admissible rules. Define Adm_{⊢} = {R^{∗} | R is an admissible rule}. Let R be a subset of Adm_{⊢}. We say that (Σ, A) is safe for R if (Σ, A ∪ R) is adequate. Given that (Σ, A) is adequate and, for each R^{∗} ∈ R, R is admissible, it might be imagined that (Σ, A) is always safe for R. However, this is not the case. It is possible that the addition of the translation of an admissible rule to an adequate signature can result in the loss of adequacy! We now develop an example to show all this.

We first show that the presentation, (T_{m}, P_{m}, Σ_{m}, A′_{m}), in Figure 8 gives an adequate presentation of minimal implicational logic over two propositional constants, (L_{m}, ⊢_{m}). The formulae, φ, in L_{m} are given by the grammar:

φ ::= a | b | φ ⇒ ψ

The consequence relation, ⊢_{m}, is just intuitionistic entailment over L_{m}.

The mapping, (·)^{∗}, from formulae to long-βη normal forms of type o is evident (again it is the identity map on notation so we omit the ^{∗} appendage). Bijectivity is proved by an easy induction on the structure of long-βη normal forms. Similarly, there is an evident mapping from proofs in the usual Hilbert system for ⊢_{m} (see, for example, [7, page 193]) of φ_{1}, …, φ_{n} ⊢ φ to proofs of true(φ_{1}), …, true(φ_{n}) ⊢_{(Σ_{m},A_{m})} true(φ), so the fullness of (Σ_{m}, A_{m}) is easy to establish. The fullness of (Σ_{m}, A′_{m}) follows (as A_{m} ⊆ A′_{m}).

To prove faithfulness we construct a suitable (Σ_{m}, A′_{m})-model. Although such a model could be constructed out of Kripke models of ⊢_{m}, we construct instead a model of the syntactic kind alluded to in the discussion at the end of section 5. The model is defined over the discrete partial order (W_{m}, =) where W_{m} = Theories_{⊢_{m}}. The type structure is the same at each world, and is given by the extensional collapse of the closed terms of Σ_{m}. Thus the interpretation of A is the quotient of {M |⊳_{Σ_{m}} M : A} by an equivalence relation ∼_{A}, where ∼_{A} is inductively defined by setting ∼_{o} to =_{βη} and defining:

M ∼_{A→B} M′ iff for all N, N′, if N ∼_{A} N′ then M(N) ∼_{B} M′(N′)

It is easy to show (by induction on types) that ∼_{A} is a partial equivalence relation. It is also easy to see that c ∼_{A} c for the three constants in Σ_{m}, as they are at worst first-order. Now the reflexivity of ∼_{A}, for all A, follows from the well-known “Basic Lemma” of logical relations (see [9, §3]).

The entire Σ_{m}-structure is defined as follows.

[[A]]_{T} = {M |⊳_{Σ_{m}} M:A}/ ∼_{A}
[[true]]_{T} ([M]) iff βη(M) = φ^{∗} for some φ ∈ T
[[c]]_{T} = [c]
ϵ_{T}^{AB}([M], [N]) = [M(N)]
K_{T}^{AB} = [λx:A. λy:B. x]
S_{T}^{ABC} = [λx:A → B → C. λy:A → B. λz:A. x(z)(y(z))]

There is no need to specify i_{T T′}^{A} as the partial order is discrete, so i_{T T′}^{A} is only defined for T = T′ in which case it must be the identity. Of the various conditions that have to be satisfied for (W_{m}, =) to be a Σ_{m}-structure, the most interesting is extensionality. However, this is easily shown by induction on the structure of types. The other conditions are trivially verified.

It is now possible to prove the adequacy of (Σ_{m}, A′_{m}).

Proposition 6.3 (W_{m}, =) is a (Σ_{m}, A′_{m})-model.

Proof. We must show that, for all Φ ∈ A′_{m}, (W_{Q}, ≤_{Q}) ⊧ Φ.

The three axioms in A_{m} are all validated easily. We consider only the third:

∀φ:o. ∀ψ:o. true(φ ⇒ ψ) ⊃ true(φ) ⊃ true(ψ)

Suppose we have T and ρ with ρ(φ)_{T} = [M], ρ(ψ)_{T} = [N] such that T ⊧_{ρ} true(φ ⇒ ψ) and T ⊧_{ρ} true(φ). But βη(M) and βη(N) must correspond to formulae of L_{m}, φ and ψ say (not to be confused with the meta-variables). But then φ ⇒ ψ ∈ T and φ ∈ T, so by modus ponens ψ ∈ T. Thus clearly T ⊧_{ρ} true(ψ) as required.

For the fourth axiom:

((true(a) ⊃ true(b)) ⊃ true(a)) ⊃ true(a)

Suppose we have T such that T ⊧ (true(a) ⊃ true(b)) ⊃ true(a). Now suppose for contradiction that T |̸= true(a). Then, as the partial order is discrete, it is clear that T ⊧ true(a) ⊃ true(b). So T ⊧ true(a), giving the desired contradiction. □

In this case the property required by Proposition 5.2 is evident. Given T ∈ Theories_{⊢_{m}}, it is immediate from the construction of the model that form(T) = T. So (Σ_{m}, A′_{m}) is indeed faithful and hence adequate. Note that we have also established the adequacy of (Σ_{m}, A_{m}).

We now address the issues raised above, providing a counterexample to the converse of Proposition 6.2 and showing that the stated problem with safety does indeed arise. It is wellknown that ⊢_{m} satisfies the deduction theorem. So setting:

R = {(true(a) ⊃ true(b)) ⊃ true(a ⇒ b),
(true((a ⇒ b) ⇒ a) ⊃ true(a)) ⊃ true(((a ⇒ b) ⇒ a) ⇒ a)}

we have that R ⊆ Adm_{⊢_{m}}. Either of the meta-formulae in R provides a counterexample to the converse of Proposition 6.2. We just show one case.

Proposition 6.4 ⊬_{(Σ_{m},A′_{m})} (true(a) ⊃ true(b)) ⊃ true(a ⇒ b).

Proof. By soundness of the meta-logic it is enough to find a T such that T |̸= (true(a) ⊃ true(b)) ⊃ true(a ⇒ b) in (W_{m}, =). Define T = Th_{⊢_{m}}(∅). Then clearly T ⊧ true(φ) if and only if φ is a theorem of minimal logic. Thus T |̸= true(a) so, as the partial order is discrete, T ⊧ true(a) ⊃ true(b). But also T |̸= true(a ⇒ b), so indeed T |̸= (true(a) ⊃ true(b)) ⊃ true(a ⇒ b). □

The above proposition was also observed by Randy Pollack who proved it syntactically.^{1} The problem with safety is illustrated by the fact that (Σ_{m}, A′_{m} ∪R) is not adequate (hence, incidentally, neither is (Σ_{m}, A′_{m} ∪{DT})). It is easy to show that ⊢_{(Σ_{m},A′_{m}∪R)} true(((a ⇒ b) ⇒ a) ⇒ a), but it is well-known that ⊬_{m} ((a ⇒ b) ⇒ a) ⇒ a. Therefore (Σ_{m}, A′_{m}), though adequate, is not safe for R above.

In the above example, the source of the problem with safety is the axiom:

((true(a) ⊃ true(b)) ⊃ true(a)) ⊃ true(a)  (5)

This is redundant: (Σ_{m}, A_{m}) (which does not contain the axiom) is also adequate. Intuitively,

(5) gives meta-implication an aspect of classical behaviour (it is an instance of Peirce’s Law). (Σ_{m}, A′_{m}) is adequate as there is no need for object-level implication to behave in the same way as meta-implication. However, when R is added the two implications are forced to behave alike in two critical cases, and thus object implication inherits unwanted classical properties.

In view of the problem with safety, it is natural to consider conditions under which (Σ, A) is safe for an arbitrary R ⊆ Adm_{⊢}. Clearly, this is so if and only if (Σ, A) is safe for Adm_{⊢} itself. A semantic condition for (Σ, A) to be safe for Adm_{⊢} is given by Corollary 6.7 below.

Lemma 6.5 If (W, ≤) is a Σ-structure with form(W) ⊆ Theories_{⊢} such that, for all T ⊇ form(w), there exists w′ ≥ w with form(w′) = T then, for all sequents S, for all w ∈ W, w ⊧ S^{∗} if and only if S is form(w)-valid.

1Private communication.

Proof. Let (W, ≤) be any Σ-structure satisfying the stated condition. Take any sequent S = (φ_{1}, …, φ_{m}, φ) and any w ∈ W.

Suppose w ⊧ S^{∗}, ie. w ⊧ true(φ_{1}^{∗}) ⊃ … ⊃ true(φ_{m}^{∗}) ⊃ true(φ^{∗}). Let w′ ≥ w be such that form(w′) = Th_{⊢}(form(w) ∪ {φ_{1}, …, φ_{m}}) (such a w′ is guaranteed to exist by the condition on (W, ≤)). Then w′ ⊧ true(φ_{i}^{∗}) (1 ≤ i ≤ m), so w′ ⊧ true(φ^{∗}). But then φ ∈ form(w′) so form(w), φ_{1}, …, φ_{m} ⊢ φ (by required property of w′). Thus indeed S is form(w)-valid.

Conversely, suppose S is form(w)-valid, ie. form(w), φ_{1}, …, φ_{m} ⊢ φ. Now suppose w′ ≥ w is such that w′ ⊧ true(φ_{i}^{∗}) (1 ≤ i ≤ m). Then form(w) ∪ {φ_{1}, …, φ_{m}} ⊆ form(w′). But form(w′) ∈ Theories_{⊢} (by the condition on (W, ≤)), so φ ∈ form(w′). Thus w′ ⊧ true(φ^{∗}). This shows that w ⊧ true(φ_{1}^{∗}) ⊃ … ⊃ true(φ_{m}^{∗}) ⊃ true(φ^{∗}) as required. □

Proposition 6.6 If (W, ≤) is a Σ-structure with form(W) = Theories_{⊢} such that, for all T ⊇ form(w), there exists w′ ≥ w with form(w′) = T then for all rules, R, (W, ≤) ⊧ R^{∗} if and only if R is admissible.

Proof. Let (W, ≤) be any Σ-structure satisfying the stated condition. Let R be any rule of the general form (3).

Suppose (W, ≤) ⊧ R^{∗}, ie., for all w ∈ W, w ⊧ S_{1}^{∗} ⊃ … ⊃ S_{n}^{∗} ⊃ S^{∗}. Suppose further that all S_{i} (1 ≤ i ≤ n) are Δ-valid. Then clearly all the S_{i} are Th_{⊢}(Δ)-valid. Let w be any world such that form(w) = Th_{⊢}(Δ) (the existence of w is guaranteed by the condition on (W, ≤)). Then, by the lemma above, w ⊧ S_{i}^{∗} (1 ≤ i ≤ n) so clearly w ⊧ S^{∗}. But then, again by the lemma, S is Th_{⊢}(Δ)-valid and hence Δ-valid. Thus R is indeed admissible.

Conversely, suppose R is admissible. Take any w ∈ W such that w ⊧ S_{i}^{∗} (1 ≤ i ≤ n). Then, by the lemma, all S_{i} are form(w)-valid. So, by admissibility, S is form(w)-valid. But then, again by the lemma, w ⊧ S^{∗}. So, for all w ∈ W, w ⊧ S_{1}^{∗} ⊃ … ⊃ S_{n}^{∗} ⊃ S^{∗} as required. □

Corollary 6.7 If (W, ≤) is a (Σ, A)-model with form(W) = Theories_{⊢} such that, for all T ⊇ form(w), there exists w′ ≥ w with form(w′) = T then (Σ, A) is safe for Adm_{⊢}.

Proof. By the proposition (W, ≤) is a (Σ, A ∪ Adm_{⊢})-model. So by Proposition 5.2, (Σ, A ∪ Adm_{⊢}) is faithful and hence adequate. □

Note that by propositions 5.1 and 5.2 we can always find a (Σ, A)-model with form(W) = Theories_{⊢}. Thus the only extra condition to satisfy is that on the relationship between ≤ and ⊆. Intuitively, the only property of a world, w, in which we are interested is the contents of form(w). The condition establishes that form is a “zig-zag morphism” (see [17]) from (W, ≤) to the lattice (Theories_{⊢}, ⊆).

We can now show that (Σ_{m}, A_{m}) is safe for Adm_{⊢_{m}} and thus, unsurprisingly, better behaved than (Σ_{m}, A′_{m}). To this end we construct a (Σ_{m}, A_{m})-model satisfying the condition of Corollary 6.7. This time the model is built over the partial order (W_{m}, ⊆) (where again W_{m} = Theories_{⊢_{m}}). All the components of the model are exactly as in the discrete case above. This time it is necessary to define i_{T T′}^{A} (for T ⊆ T′), but this is simply:

i_{T T′}^{A}([M]) = [M]

It is readily checked that the resulting structure is a a (Σ_{m}, A_{m})-model (the proof goes through exactly as before). It is also easy to see that the conditions of Corollary 6.7 are satisfied as form is the identity morphism from the lattice (Theories_{⊢_{m}}, ⊆) to itself. So indeed (Σ_{m}, A_{m}) is safe for Adm_{⊢_{m}}.

To investigate the applicability of the theory developed in this section we return to the encoding (Σ_{A}, A_{Q}) of Robinson’s Q given in the previous section. First we show that there are admissible rules not provable in (Σ_{A}, A_{Q}). It is well-known that the deduction theorem holds for classical logic, and hence for ⊢_{Q} (remember we are only considering consequence between sentences). Thus every rule of the form (4) is admissible. Let G be any sentence in the language of arithmetic for which neither ⊢_{Q} G nor ⊢_{Q} ¬G (Gödel’s Theorem guarantees the existence of such a G). Now (true(G) ⊃ true(¬ 0 = 1)) ⊃ true(G ⇒ ¬ 0 = 1) is clearly the translation of a rule of the form (4) and thus of an admissible rule. However, ⊬_{(Σ_{A},A_{Q})} (true(G) ⊃ true(¬ 0 = 1)) ⊃ true(G ⇒ ¬ 0 = 1) (and thus ⊬_{(Σ_{A},A_{Q})} DT). This fact can be proved by considering a (Σ_{A}, A_{Q})-model, (W_{Q}, =), defined as (W_{Q}, ≤_{Q}) but with the discrete partial order. We do not go into details, but it is easy to prove that in this model that the world Mod_{Q} refutes the sentence. Proposition 6.11 will show that this fact can not be proved using (W_{Q}, ≤_{Q}).

As there are admissible rules which are unprovable in (Σ_{A}, A_{Q}), we would like to know at least that (Σ_{A}, A_{Q}) is safe for Adm_{⊢_{Q}}. Unfortunately, (W_{Q}, ≤_{Q}) fails the condition of Corollary 6.7. To see this, consider the world (where N is the standard model of arithmetic):

S^{†} = {M | M is model of Q not elementary equivalent to N}

Lemma 6.8 ⊢_{Q} φ if and only if for all M ∈ S^{†}, M ⊧ φ.

Proof. The left-to-right implication is by classical soundness. For the converse suppose the contrary. Then there is a φ such that, for all M ∈ S^{†}, M ⊧ φ, but ⊬_{Q} φ. By classical completeness there exists a model M of Q such that M ⊧ ¬φ. This model cannot be in S^{†}, so it must be elementary equivalent to N. It is now clear that for any true sentence ψ of arithmetic, for all models M of Q, M ⊧ ¬φ ⇒ ψ. Therefore, again by completeness, ⊢_{Q} ¬φ ⇒ ψ. But then Q ∪ {¬φ} gives a finite axiomatisation of the true sentences of arithmetic, which is impossible. □

So Th_{⊢_{Q}}(∅) = Th_{⊧}(S^{†}) = form(S^{†}) (the first equality is by the lemma, the second is by Lemma 5.5). Now let T_{N} be the set of all true sentences of arithmetic. Clearly T_{N} ⊇ form(S^{†}). However, there can be no S with S^{†} ≤_{Q} S such that form(S) = T_{N}. For such an S must be non-empty (as form(∅) = L_{A}), but any M ∈ S must satisfy the negation of some sentence in T_{N}, as it can not be elementary equivalent to N. So the condition of Corollary 6.7 does indeed fail.

One way of showing that (Σ_{A}, A_{Q}) is safe for Adm_{⊢_{Q}} is to modify the definition of (W_{Q}, ≤_{Q}). Redefine:

W_{Q} = {Mods_{⊧}(T) | T ∈ Theories_{⊢_{Q}}}

The rest of the model is constructed as before. This time Corollary 6.7 does apply as form is now an isomorphism from (W_{Q}, ≤_{Q}) to (Theories_{⊢_{Q}}, ⊆). A different and more detailed proof will be given below, exploiting properties of the implication connective.

When a logic has implication and satisfies both modus ponens and the deduction theorem, it turns out that all admissible rules are reducible to instances of these two cases. Suppose then that (L, ⊢) is a logic satisfying these conditions. Thus the following are both subsets of Adm_{⊢}:

MP_{S} = {true(φ ⇒ ψ) ⊃ true(φ) ⊃ true(ψ) | φ, ψ ∈ L}
DT_{S} = {(true(φ) ⊃ true(ψ)) ⊃ true(φ ⇒ ψ) | φ, ψ ∈ L}

Again we assume that (Σ, A) is an adequate encoding of the logic.

Proposition 6.9 If, for all Φ ∈ MP_{S} ∪ DT_{S}, ⊢_{(Σ,A)} Φ then ⊢_{(Σ,A)} R^{∗} if and only if R is admissible.

Proof. The ‘only if’ direction is by Proposition 6.2. For the ‘if’ direction we first define some notation. Given a sequent, S = (φ_{1}, …, φ_{m}, φ) define:

χ(S) = φ_{1} ⇒ … ⇒ φ_{m} ⇒ φ

Now suppose R, of the general form (3), is admissible. Defining Δ = {χ(S_{1}), …, χ(S_{n})}, we have, for all 1 ≤ i ≤ n, that (by m_{i} applications of modus ponens) Δ, φ_{i1}, …, φ_{im_{i}} ⊢ ψ_{i} (where S_{i} = (φ_{i1}, …, φ_{im_{i}}, ψ_{i})). In short, all the S_{i} are Δ-valid. So, by the admissibility of R, Δ, φ_{1}, …, φ_{m} ⊢ φ (where S = (φ_{1}, …, φ_{m}, φ)). Now, by m applications of the deduction theorem, Δ ⊢ φ_{1} ⇒ … ⇒ φ_{m} ⇒ φ, ie. χ(S_{1}), …, χ(S_{n}) ⊢ χ(S). Hence, by adequacy, true(χ(S_{1})), …, true(χ(S_{n})) ⊢_{(Σ,A)} true(χ(S)). But now, using DT_{S} for the left-hand side and MP_{S} for the right, it is easy to see that S_{1}^{∗}, …, S_{n}^{∗} ⊢_{(Σ,A)} S^{∗}. So clearly ⊢_{(Σ,A)} R^{∗}. □

Corollary 6.10 (Σ, A) is safe for Adm_{⊢} if and only if it is safe for MP_{S} ∪ DT_{S}.

Proof. The left-to-right implication is obvious. Suppose then that (Σ, A) is safe for MP_{S}∪DT_{S}. The result follows immediately from the above proposition applied to (Σ, A ∪ MP_{S} ∪ DT_{S}). □

We can now give the promised proof that (Σ_{A}, A_{Q}) is safe for Adm_{⊢_{Q}}. (Σ_{A}, A_{Q}) is a logic with implication satisfying both modus ponens and the deduction theorem. As A_{Q} contains the following axiom:

∀φ:o. ∀ψ:o. true(φ ⇒ ψ) ⊃ true(φ) ⊃ true(ψ)

it is clear that, for all Φ ∈ MP_{S}, ⊢_{(Σ_{A},A_{Q})} Φ. Thus, by Corollary 6.10, it is enough to show that (Σ_{A}, A_{Q}) is safe for DT_{S}. In fact we will show that (Σ_{A}, A_{Q} ∪ {DT}) is adequate.

Proposition 6.11 (W_{Q}, ≤_{Q}) is a (Σ_{A}, A_{Q} ∪ {DT})-model.

Proof. We need only show that, for all S ∈ W_{Q}, S ⊧ DT. Suppose then that we have a world S and an environment ρ with ρ(φ)_{S} = {a_{M}}_{M∈S} and ρ(ψ)_{S} = {b_{M}}_{M∈S} (both these in [[o]]_{S}) such that S ⊧_{ρ} true(φ) ⊃ true(ψ). Let M be any element of S. Clearly S ≤_{Q} {M} so if {M} ⊧_{ρ} true(φ) then {M} ⊧_{ρ} true(ψ). Thus a_{M} = ff or b_{M} = tt. But then, by Lemma 5.4, [[φ ⇒ ψ]]_{S}^{ρ} = {tt}_{M∈S}. So S ⊧_{ρ} true(φ ⇒ ψ) as required. □

We have already shown that (W_{Q}, ≤_{Q}) has the property required by Proposition 5.2, so the faithfulness (and hence adequacy) of (Σ_{A}, A_{Q} ∪ {DT}) is immediate.

It is easy to show that Proposition 6.11 implies, by the soundness of the meta-logic together with Proposition 6.9, that (W_{Q}, ≤_{Q}) ⊧ R^{∗} if and only if R is admissible. As we have shown that (W_{Q}, ≤_{Q}) fails the condition of Proposition 6.6, the condition is seen to be sufficient but not necessary.

It is also clear, using Proposition 6.9 and the established adequacy result, that:

⊢_{(Σ_{A},A_{Q}∪{DT })} R^{∗} iff R is admissible

So this presentation proves all admissible rules.

The rather simple connection of Proposition 6.9, showing that the provable admissibility of any inference rule is reducible to modus ponens and the deduction theorem, is a testimony to the (over-)simplicity of our notion of inference rule. With a reasonable notion of schematic inference rule the situation is likely to be a good deal more interesting. Still, there are enough surprises even with the simpler notion (such as the potential problem with safety) to justify our investigation at this level.

The most natural way of extending this work to deal with more complex notions of rule would be to consider first more elaborate notions of logic. One possible development would be to include language structure in the definition of logic, allowing for both connectives and quantifiers. Another extension would be to consider logics with other notions of consequence (such as multiple judgements). At the logical level these notions are already established (see [5] for example). However, such ideas have yet to be approached using the semantic methods of this paper.

At least, whatever extensions to the notion of logic are considered, the semantics of section 3 is already in place to be applied. However, whether or not the fruitful connections of sections 5 and 6 will generalise remains to be seen.

Acknowledgements

I gratefully acknowledge the support of my supervisors, Gordon Plotkin and David Pym.

References

[1] A. Avron, F. Honsell, and I. Mason. Using typed lambda calculus to implement formal systems on a machine. LFCS Report Series ECS-LFCS-87-31, Laboratory for the Foundations of Computer Science, Computer Science Department, University of Edinburgh, 1987.

[2] J. Barwise. Axioms for abstract model theory. Annals of Mathematical Logic, 7, 1974.

[3] N. G. de Bruijn. A survey of the project automath. In J. P. Seldin and J. R. Hindley, editors, To H. B. Curry: Essays in Combinatory Logic, Lambda Calculus and Formalism, pages 589 – 606. Academic Press, 1980.

[4] A. Felty. Specifying and Implementing Theorem Provers in a Higher-Order Logic Programming Language. PhD theses, University of Pennsylvania, 1989.

[5] P. Gardner. Representing Logics in Type Theory. PhD Thesis, Department of Computer Science, University of Edinburgh, 1992.

[6] R. Harper, F. Honsell, and G. Plotkin. A framework for defining logics. In Proceedings of 2nd Annual Symposium on Logic in Computer Science, pages 194–204, 1987.

[7] J. R. Hindley and J. P. Seldin. Introduction to Combinators and the λ-Calculus. London Mathematical Society, Student Texts 1. Cambridge University Press, 1986.

[8] G. Huet. A unification algorithm for typed λ-calculus. Theoretical Computer Science, 1:27 – 57, 1975.

[9] J. C. Mitchell. Type systems for programming languages. In J. van Leeuwen, editor, Handbook of Theoretical Computer Science, volume II, pages 365 – 458. Elsevier Science Publishers, 1990.

[10] J. C. Mitchell and E. Moggi. Kripke-style models for typed lambda calculus. Journal of Pure and Applied Logic, 51:99–124, 1991.

[11] B. Nordström, K. Petersson, and J. Smith. Programming in Martin-Löf’s Type Theory. Oxford University Press, 1990.

[12] L. Paulson. The foundation of a generic theorem prover. Journal of Automated Reasoning, 5:363–396, 1989.

[13] P. Schroeder-Heister. A natural extension of natural deduction. Journal of Symbolic Logic, 49:1284–1299, 1984.

[14] D. S. Scott. On engendering an illusion of understanding. Journal of Philosophy, 68:787– 807, 1971.

[15] A. Tarski. Logic, Semantics, Metamathematics. Oxford University Press, 1956.

[16] A.S. Troelstra. Metamathematical investigations of intuitionistic arithmetic and analysis. Lecture notes in mathematics, 344, 1973.

[17] J. van Bentham. Correspondence theory. In D. Gabbay and F. Guenther, editors, Handbook of Philosophical Logic, volume II, pages 167 – 47. D. Reidel Publishing Company, 1984.

A Normalization Proof for an Impredicative Type System with Large Elimination over Integers

Benjamin Werner^{∗} INRIA – Rocquencourt

August 1992

Abstract

We prove strong normalization for a type system that includes system F, dependent types, primitive integers and the ability to define types by primitive recursion over integers. We give some applications motivating this feature.

Introduction

The aim of this note is to show how one can prove strong normalization for a type system in which types can be defined by case and by recursion over some inductive structure (here integers), thus setting the bases for a consistency proof of systems like the one implemented in Coq [4]. Let us sketch the technical motivations for these systems.

Need for inductive types

In [3], Coquand and Paulin give a uniform presentation of inductive definitions, which can be added to the Calculus of Constructions (or nearly any other GTS). To simplify, one may say that this definition scheme generalizes the primitive integers of Gödel’s system T [10, 9]. It is well-known that in an impredicative framework, as is the Calculus of Constructions, inductive structures (integers, lists, sums, products) may be defined internally, using encodings like Church’s integers [8, 9, 12]. However, Coquand and Paulin listed some drawbacks of this technique, thus motivating the introduction of their extension; essentially:

• Efficiency: for Church’s integers, the predecessor cannot be calculated in constant time.

• The induction scheme (in the case of integers, Peano’s axiom) cannot be proven internaly. Moreover the induction principle does not correspond to recursion anymore.

• It is impossible to prove 0 ≠ 1 in the system.

In what follows, we are mainly focusing on the third point. Let us try to explicit it: proving 0 ≠ 1 means precisely exhibiting a predicate P over natural numbers, such that one can prove P (0) and the negation of P (1). In the pure Calculus of Constructions there is no hope to define such a predicate, because ultimately, all we can do is quantify over all predicate variables (∀α : Nat→Prop). The right and elegant way to formalize this argument, is to use the erasure map which transforms any type (resp. proof) of the Calculus of Constructions into a type of F_{ω} (resp. a term of F_{ω} inhabiting the corresponding type). Suppose we had a closed proof p of the proposition 0 ≠ 1 ≡ (∀P:Nat→Prop.(P 0)→ (P S(0)))→(∀Q:Prop.Q) then by mapping p into F ω we would get a closed term inhabiting the type:(∀α : ∗.α→α)→(∀β : ∗.β) which, we know, is impossible, as there is no closed term of type ∀α : ∗.α.

∗benjamin.werner@inria.fr

Large elimination schemes

So it is the mechanism for defining dependent types in CoC which appears to be unsatisfactory. Here we want to enhance it, at least in the case of inductive structures like natural numbers. Coquand and Paulin suggest to introduce a second elimination scheme for each inductive structure, which allows to build types through structural recursion over, say, a natural number. Let us illustrate this point. In system T, there exist an elimination scheme rec, with the following corresponding reduction rules: (rec 0 t_{0} t_{S}) ⊳ t_{0} (rec (S t) t_{0} s_{S}) ⊳ (t_{S} t (rec t t_{0} t_{S}))

The natural type of rec in the Calculus of Constructions is precisely Peano’s axiom: ∀n:Nat.∀P:Nat→Prop.(P 0)→(∀m:Nat.(P m)→(P (S m)))→(P n)

Coquand and Paulin’s suggestion can be understood as the introduction of a second elimination scheme Rec, with the same reduction rules, but of the following type:

∀n:Nat.∀T:Nat→Type.(T 0)→(∀m:Nat.(T m)→(T (S m)))→(T n)

This means we can define a type (i.e. an object of type Prop) recursively over an integer. For instance, a predicate trivially verified by 0 and not verified by (S 0) could be: λn:Nat.(Rec n λn:Nat.Prop ∀P:Prop.(P →P) λm:Nat.λq:Prop.∀P:Prop.P)

We will call Rec the Large elimination scheme, by opposition to the usual small elimination scheme rec ^{1}.

Of course, this is generalized to all inductive types ^{2}. The question we try to address here, is the normalization, and hence the consistency, of type systems including such features. In what follows we restrict ourselves to the simplest possible system including such a feature combined with polymorphism.

1 The system

Therefore, the calculus defined below can be seen as the system F enriched by:

• natural numbers ”à la system T”

• dependent types

• the essential novelty which is the Rec operator shown above.

In other words, it is the type system λP 2 with primitive natural numbers and the two elimination schemes. Note that dependent types are not strictly speaking necessary for the definition of the system, but without them, types defined using Rec would have no interesting inhabitants.

1This terminology is, to our knowledge, due to Thorsten Altenkirch.

2Actually all inductive types with only monomorphic constructors, also called “small” inductive types.

We should also mention that Jan Smith proposed to add large elimination over integers to Martin-Löf’s Type Theory. Actually, the system he describes in [14] is quite similar to the one given below, so the idea of our normalization proof should also apply to his extension.

The syntax

In order to simplify as much as possible the normalization proof, we chose a little more complicated syntax than the usual GTS style presentations [7] (and also than the one of the few examples above). We introduce a syntactic distinction between the term variables and the predicate variables. Moreover every predicate variable comes along with its arity or degree: a variable of type Prop will be of degree 0, a variable of type Nat→Prop will be of degree 1, etc. Consequently the inference rules are more numerous and slightly redundant, but the whole construction of interpretating the predicates in terms on reducibility candidates is more straightforward.

We consider as given a set V t of term variables whose elements will generally be written as x, and, for any natural number i, a set V T_{i} of predicate variables of degree i which will denote the symbol α_{i}. All these sets are supposed distinct and the equality over them decidable. the symbol α will be used to designate any element of V T which is defined as ⋃_{i∈ℕ} V T_{i}.

We now define the set of proof-terms (noted as t), the sets of predicates of degree i (written T_{i}) and of kinds of degree i (written K_{i}):

t ::= x | λ^{T_{0}}x.t | (t t) | Λ^{K_{i}}α_{i}.t | (t T_{i}) | 0 | S{t} | rec{t, t, t}
T_{0} ::= α_{0} | Nat | (x : T_{0})T_{0} | (α_{i} : K_{i})T_{0} | (T_{1} t) | Rec{t, T_{0}, α_{0}.T_{1}}
T_{i+1} ::= α_{i+1} | λ^{T_{0}}x.T_{i} | (T_{i+2} t)
K_{0} ::= Prop
K_{i+1} ::= (x : T_{0})K_{i}

Furthermore we will call objects the elements of the union of the sets defined above. The substitution is defined for all kind of variables in the usual way and noted t[x \ t′] (or t[α \ T], etc). A type is a predicate of degree 0. We will not deal with alpha-conversion.

Definition We define the βι-reduction by:

(β_{t1}) (λ^{T} x.t_{1} t_{2}) ↦ t_{1}[x \ t_{2}]
(β_{t2}) (Λ^{K}α.t T) ↦ t[α \ T]
(β_{T}) (λ^{T′}x.T t) ↦ T [x \ t]
(ι_{t0}) rec{0, t_{0}, t_{S}} ↦ t_{0}
(ι_{tS}) rec{S{t}, t_{0}, t_{S}} ↦ (t_{S} t rec{t, t_{0}, t_{S}})
(ι_{T0}) Rec{0, T_{0}, α.T_{1}} ↦ T_{0}
(ι_{TS}) Rec{S{t}, T_{0}, α.T_{1}} ↦ (T_{1}[α \ Rec{t, T_{0}, α.T_{1}}] t)

We will write M ⊳ M′ to say that M rewrites to M′ by βι-reduction of a subterm, M ⊳^{i} M′ designing a sequence of i reductions. The transitive-reflexive closure of ⊳ will denote the symbol ⊳^{∗} and the transitive-symmetrical-reflexive closure will be designed by the infix symbol =_{βι}. Remark The reductions preserve the syntactic class. So we can speak of the arity of an =_{βι} equivalence class.

Lemma 1 The reduction is Church-Rosser in the set of objects.

Proof By the usual Tait–Martin-Löf method.

Definition A context (generally written Γ) is a list of pairs composed either by a term variable and a type (x, T_{0}) or a predicate variable and a kind of the same degree (α_{i}, K_{i}). The empty context is written [].

Type system: specific rules

(Nat) [] ⊢ Nat:Prop  (zero) [] ⊢ 0:Nat  (successor) \frac{Γ ⊢ t:Nat}{Γ ⊢ S\{t\}:Nat}

(rec) \frac{Γ ⊢ t:Nat Γ ⊢ T:Nat→Prop Γ ⊢ t_{0}:(T 0) Γ ⊢ t_{S}:(n:Nat)(T n)→(T S\{n\})}{Γ ⊢ rec\{t, t_{0}, t_{S}\}:(T t)}

(Rec) \frac{Γ ⊢ t:Nat  Γ ⊢ T_{0}:Prop  Γ::(α_{0}, Prop) ⊢ T_{S}:Nat→Prop}{Γ ⊢ Rec\{t, T_{0}, α_{0}.T_{S}\}:Prop}

GTS Rules (λP_{2})

(Prop) [] ⊢ Prop:Type  (Kind) \frac{Γ :: (x, T) ⊢ K : Type}{Γ ⊢ (x : T)K : Type}

(Prod) \frac{Γ ⊢ T_{0}:Prop  Γ::(x, T_{0}) ⊢ T′_{0}:Prop}{Γ ⊢ (x:T_{0})T′_{0}:Prop}  \frac{Γ ⊢ K_{i}:Type  Γ::(α_{i}, K_{i}) ⊢ T_{0}:Prop}{Γ ⊢ (α_{i}:K_{i})T_{0}:Prop}

\frac{Γ ⊢ T_{0}:Prop Γ::(x, T_{0}) ⊢ K_{i}:Type}{Γ ⊢ (x:T_{0})K_{i}:Type}

(Abs) \frac{Γ ⊢ (x:T_{0})T′_{0}:Prop  Γ::(x, T_{0}) ⊢ t:T′_{0}}{Γ ⊢ λ^{T_{0}}x.t : (x:T_{0})T′_{0}}

\frac{Γ ⊢ (x:T_{0})K_{i}:Type Γ::(x, T_{0}) ⊢ T_{i}:K_{i}}{Γ ⊢ λ^{T_{0}}x.T_{i} : (x:T_{0})K_{i}}

\frac{Γ ⊢ (α_{i}:K_{i})T_{0}:Prop Γ::(α_{i}, K_{i}) ⊢ t:T_{0}}{Γ ⊢ Λ^{K_{i}}α_{i}.t : (α_{i}:K_{i})T_{0}}

(App) \frac{Γ ⊢ t:(x : T′_{1})T_{1}  Γ ⊢ t′:T′_{1}}{Γ ⊢ (t t′) : T_{1}[x \ t′]}  \frac{Γ ⊢ t:(α_{i}:K_{i})T_{0}  Γ ⊢ T_{i}:K_{i}}{Γ ⊢ (t T_{i}):T_{0}[α_{i} \ T_{i}]}

\frac{Γ ⊢ T_{i+1}:(x : T_{0})K_{i} Γ ⊢ t:T_{0}}{Γ ⊢ (T_{i+1} t):K_{i}[x \ t]}

(redT) \frac{Γ ⊢ T:Prop  T =_{βι} T′  Γ ⊢ T′:Prop  Γ ⊢ t:T}{Γ ⊢ t:T′}

(redK) \frac{Γ ⊢ K:Type  K =_{βι} K′  Γ ⊢ K′:Type  Γ ⊢ T:K}{Γ ⊢ T:K′}

(weak) \frac{Γ ⊢ V :S Γ ⊢ u:U}{Γ::(a, V) ⊢ u:U} (a, V, S) ∈ (V t × T_{0} × {Prop}) ∪ (V T_{i} × K_{i} × {Type}) and (u, U) ∈ (t × T_{0}) ∪ (T_{i} × K_{i})

(var) \frac{Γ ⊢ u:U  (a, V) in Γ}{Γ ⊢ a:V} {(u, U) ∈ (t × T_{0}) ∪ (T_{i} × K_{i}) \atop and (a, V) ∈ (V t × T_{0}) ∪ (V T_{i} × K_{i})}

2 Pure proof-terms

We define the term algebra Λ by: u ::= x | (u u) | λx.u | 0 | S{u} | rec{u, u, u}

We will call pure terms the elements of Λ. The symbols u, v, u′ etc will be used to denote pure terms.

We define the following map from proof-terms to Λ:

⌈x⌉ ≡ x
⌈λ^{T} x.t⌉ ≡ λx.⌈t⌉
⌈t t′⌉ ≡ (⌈t⌉ ⌈t′⌉)
⌈Λ^{K}α.t⌉ ≡ ⌈t⌉
⌈t T ⌉ ≡ ⌈t⌉
⌈0⌉ ≡ 0
⌈S{t}⌉ ≡ S{⌈t⌉}
⌈rec{t, t_{0}, t_{s}}⌉ ≡ rec{⌈t⌉, ⌈t_{0}⌉, ⌈t_{S}⌉}

We may easily map the reduction defined over proof-terms to reductions over pure terms. We will call N the set of strongly normalizable pure terms.

Lemma 2 The βι-reduction is Church-Rosser in the set of pure terms.

Proof Tait–Martin-Löf method again; it is the usual proof for system T.

The reader familiar with normalization proofs will understand that we will start by proving strong normalization for pure terms. Hence, the proof below has a lot of similarities with the ones found in [11, 7]. There is however a major difference due to the presence of the large elimination scheme: we cannot get rid of the dependent types in the proof. Actually the main originality of our proof is the way we interpret of the types defined by recursion over integers. On the other hand, we should also say that it is perfectly possible to do a similar proof for dependent types without first proving strong normalization for pure terms; for example [2] could very well be adapted for our type system. So the choice between typed or untyped reducibility candidates is still a matter of convenience and taste.

Definition Pure terms of the following forms are said to be neutral: x, (u_{1} u_{2}) and rec{u, u_{0}, u_{S}}.

Definition A predicate interpretation C of degree 0 is a set of pure terms. A predicate interpretation of degree i + 1 is a total function f mapping any pure term to a predicate interpretation of degree i.

Definition An interpretation I is a pair composed of:

• A total function mapping a term to every term variable.

• A total function mapping a predicate interpretation of degree i to every predicate variables of degree i, for any i.

If I = (f, g) we will write I(x) (resp. I(α)) for f(x) (resp. g(α)). The first component of any interpretation straightforwardly defines a substitution over the free variables of any pure term. If u is a pure term, we will write u[I] for the substituted term.

We will write I; x ← u (resp. I; α ← C) for the interpretation which has the same values than I on all points but x for which it will have value u (resp. α for which it will have value C). Note that all variables are substituted in parallel: I; x ← u; y ← u′ = I; y ← u′; x ← u, provided that x ≠ y. A simple but essential property is: u[x \ u′][I] = u[I; x ← u′[I]]. Note also that ⌈t[α\ T]⌉[I] = ⌈t⌉[I] = ⌈t⌉[I; α ← C.

Definition A reducibility candidate of degree 0 is a set of pure terms such that:

• C is closed under βι-reduction.

• Every element of C is strongly normalizable.

• let u be a neutral pure term. If for every term u′ such that u ⊳^{1} u′ we have u′ ∈C, then u ∈C. Note that a reducibility candidate of degree 0 is never empty, since it contains all the term variables.

For n ≥ 1, a reducibility candidate of degree n is a predicate interpretation f of degree n such that for any pure term u, f(u) is a reducibility candidate of degree n − 1 such that if u =_{βι} u′ then f(u) = f(u′).

Definition Let T be any predicate of any degree i. By structural induction over T we define |T |_{I} for any interpretation I. If i = 0 then |T |_{I} is a set of pure terms and a total function from terms to some set otherwise.

• If T = α_{i}, then |T |_{I} ≡ I(α_{i}).

• If T = Nat, then then |T |_{I} ≡ N.

• If T = (x:T′)T′′, then |T |_{I} ≡ {u, ∀u′ ∈ |T′|_{I}.(u u′) ∈ |T′′|_{I;x←u′}}.

• If T = (α_{i} : K_{i})T′, then |T |_{I} ≡ ⋂_{C_{i}} |T′|_{I;α_{i}←C_{i}} where the intersection ranges over all reducibility candidates (not all interpretations) of degree i.

• If T = (T_{i+1} t), then |T |_{I} ≡ |T_{i+1}|_{I}(⌈t⌉[I]).

• If T = λ^{T_{0}}x.T′, then |T |_{I} is the function that to any term u associates |T′|_{I;x←u}.

• If T = Rec{t, T_{0}, α_{0}.T_{1}}, then |T |_{I} is defined by cases on the normalizability ^{3} of ⌈t⌉[I]: – If ⌈t⌉[I] admits no normal form, then |T |_{I} ≡ N.

– If ⌈t⌉[I] (weakly) normalizes ^{4} to u′, we define the set C(v, I, T_{0}, T_{1}, α_{0}) by structural

recursion over the (normal) pure term v: ∗ C(0, I, T_{0}, T_{1}, α_{0}) ≡ |T_{0}|_{I}.

∗ C(S{v′}, I, T_{0}, T_{1}, α_{0}) ≡ |T_{1}|_{I;α_{0}←C(v′,I,T_{0},T_{1},α_{0})}(v′).

∗ C(v, I, T_{0}, T_{1}, α_{0}) ≡ N otherwise. We then may define |T |_{I} ≡ C(u′, I, T_{0}, T_{1}, α_{0}).

Lemma 3 For any x, T, t and I, we have |T [x \ t]|_{I} = |T |_{I;x←⌈t⌉[I]}. Proof By straightforward structural induction over T:

• If T = (y:T′)T′′ with x ≠ y and y not free in t, then T [x \ t] = (y:T′[x \ t])T′′[x \ t]. The induction hypothesis applies for |T′[x \ t]|_{I} and |T′′[x \ t]|_{I;y←u_{0}} for any u_{0}. The result follows immediately.

• If T = (T_{i+1} t_{0}) then

|T [x \ t]|_{I} = |(T_{i+1}[x \ t] t_{0}[x \ t])|_{I}

which by induction hypothesis is equal to

|T_{i+1}|_{I;x←⌈t⌉[I]}(⌈t_{0}⌉[I; x ← ⌈t⌉[I]]) = |T_{i+1}|_{I;x←⌈t⌉[I]}(⌈t_{0}[x \ t]⌉[I]).

The result follows.

• If T = λ^{T_{0}}y.T′ with x ≠ y and y not free in t, then |T [x \ t]|_{I} is the function that to u_{0}

associates |T′[x \ t]|_{I;y←u_{0}} which is equal to

|T′|_{I;y←u_{0};x←⌈t⌉[I;y←u_{0}]} = |T′|_{I;x←⌈t⌉[I];y←u_{0}}.

• If T = Rec{t_{0}, T_{0}, α_{0}.T_{1}} then |T [x \ t]|_{I} is defined by cases over the normalizability of ⌈t_{0}⌉[x\⌈t⌉][I] which is equal to ⌈t_{0}⌉[I; x ← ⌈t⌉[I]]. The result follows with straightforward use of the induction hypothesis in the different cases.

All other cases are immediate. Lemma 4 For any T, α_{i}, T_{i} and I, we have |T [α_{i} \ T_{i}]|_{I} = |T |_{I;α_{i}←|T_{i}|_{I}}.

3This is obviously a classical resonning. It is possible to make this proof constructive, but this would imply to define |T |_{I} provided some well-chosen conditions. We believe the classical proof is simpler and more enlighting.

4We recall that the normal form is unique, as the reduction is Church-Rosser; note that in this proof we do need CR for the pure terms, but not for the annotated proof terms.

Proof Again we proceed by simple structural induction over T. We only detail the Rec case; all the other ones are straightforward.

If T = Rec{t, T_{0}, α_{0}.T_{1}}, we have seen that ⌈t⌉[I] = ⌈t[α_{i} \ T_{i}]⌉ = ⌈t⌉. The case where ⌈t⌉ admits no normal form is thus trivial. Now for the case where ⌈t⌉ does admit a normal form, we prove by induction over the (normal) pure term u that

C(u, I, T_{0}[α_{i} \ T_{i}], T_{1}[α_{i} \ T_{i}], α_{0}) = C(u, I; α_{i} ← |T_{i}|_{I}, T_{0}, T_{1}, α_{0}).

Again, we do not cope with α-conversion, thus admitting that α_{0} is not free in T_{1}.

• If u = 0,

C(0, I, T_{0}[α_{i} \ T_{i}], T_{1}[α_{i} \ T_{i}], α_{0}) = |T_{0}[α_{i} \ T_{i}]|_{I}

which is equal to

|T_{0}|_{I;α_{i}←|T_{i}|_{I}}

because of the (first) induction hypothesis and by definition equal to

C(0, I; α_{i} ← |T_{i}|_{I}, T_{0}, T_{1}, α_{0})

• If u = S{u′}, the (second) induction states that

C(u′, I, T_{0}[α_{i} \ T_{i}], T_{1}[α_{i} \ T_{i}], α_{0}) = C(u′, I; α_{i} ← |T_{i}|_{I}, T_{0}, T_{1}, α_{0})

By definition

C(S{u′}, I, T_{0}[α_{i} \ T_{i}], T_{1}[α_{i} \ T_{i}], α_{0}) = |T_{1}[α_{i} \ T_{i}]|_{I;α_{0}←C(u′,I,T_{0}[α_{i}\T_{i}],T_{1}[α_{i}\T_{i}],α_{0})}

which, because of the equality above, is equal to

\begin{matrix}|T_{1}[α_{i} \ T_{i}]|_{I;α_{0}←C(u′,I;α_{i}←|T_{i}|_{I},T_{0},T_{1},α_{0})} \\ = |T_{1}|_{I;α_{0}←C(u′,I;α_{i}←|T_{i}|_{I},T_{0},T_{1},α_{0});α_{i}←|T_{i}|_{I;α_{0}←C(u′,I;α_{i}←|T_{i}|_{I} ,T_{0},T_{1},α_{0})}} \end{matrix}

But as α_{0} is not free in T_{1}, this last term can be simplified into:

|T_{1}|_{I;α_{i}←|T_{i}|_{I};α_{0}←C(u′,I;α_{i}←|T_{i}|_{I},T_{0},T_{1},α_{0})}

Which is precisely the definition of C(S{u′}, I; α_{i} ← |T_{i}|_{I}, T_{0}, T_{1}, α_{0}).

• The case where u neither reduces to 0 nor to S{u′} is trivial.

Definition An predicate interpretation f of degree i > 0 is said to be βι-invariant if for any u and u′ such that u =_{βι} u′, one has f(u) = f(u′). Furthermore if i > 1 then f(u) has to be βι-invariant also.

An interpretation I is said to be βι-invariant if and only if for any α_{i+1}, I(α_{i+1}) is βιinvariant.

Lemma 5 Let I be a βι-invariant interpretation. Then the following holds:

• For any T of degree at least 1, |T |_{I} is βι-invariant.

• Furthermore, for any T, x u and u′ such that u =_{βι} u′, one has |T |_{I;x←u} = |T |_{I;x←u′}.

Proof By structural induction over T.

• T = α is immediate.

• T = Nat is immediate.

• T = (y : T′)T′′. The second induction hypothesis applies for T′ and T′′. Therefore

\begin{aligned}|T |_{I;x←v} & = & \{u, ∀u′ ∈ |T′|_{I;x←v}.(u u′) ∈ |T′′|_{I;x←v}\} \\ & = & \{u, ∀u′ ∈ |T′|_{I;x←v′}.(u u′) ∈ |T′′|_{I;x←v′}\} \\ & = & |T |_{I;x←v′} \end{aligned} .

• T = (α_{i} : K_{i})T′. for any reducibility candidate Cof degree i, I; α_{i} ← C is βι-invariant because Cis invariant if i > 0. Therefore, by induction hypothesis, |T′|_{I;α_{i}←C} is also βι-invariant. The result follows.

• T = (T_{i+1} t). |T |_{I;x←u} = |T_{i+1}|_{I;x←u} (⌈t⌉[I; x ← u]) which is equal to |T |_{I;x←u′} by the induction hypothesis. Furthermore, if i > 0, |T |_{I} is βι-invariant, because |T_{⊂+1}|_{I} is.

• T = λ^{T_{0}}x.T′ is similar.

• T = Rec{t, T_{0}, α_{0}.T_{1}}. Because of Church-Rosser for pure terms, ⌈t⌉[I; x ← v] has a normal form if and only if ⌈t⌉[I; x ← v′] has. Furthermore if these normal forms exist, they are equal. The result follows by considering the different cases of the definition of |T |_{I}.

Definition An interpretation I is said to be a candidate interpretation if for any α_{i}, I(α_{i}) is a reducibility candidate of degree i.

Lemma 6 For any predicate T and any candidate interpretation I, |T |_{I} is a reducibility candidate of the same degree than T.

Proof Structural induction over T again. Most of the cases reflect what is done in other proofs of the literature. Of course, we use the fact that the previous lemma applies, as I is βι-invariant.

• If T = α_{i}. By definition: I is a candidate interpretation.

• If T = Nat. We have to prove that N is indeed a reducibility candidate. It is easy to see that it is closed under βι-reduction and it is of course contained by itself. Also a term that only reduces to strongly normalizable terms is itself strongly normalizable.

• If T = (x : T′)T′′, then |T′|_{I} and |T′′|_{I;x←u′} are reducibility candidates of degree 0 for any pure term u′, by induction hypothesis. Let u be an element of |T |_{I} and u′ any element of |T′|_{I}. Then as (u u′) is strongly normalizable, so is u. Also if u ⊳ u′′, then (u u′) ⊳ (u′′ u′); thus (u′′ u′) is in |T′′|_{I;x←u′} and hence u′′ is in |T |.

Finally, given any neutral term u_{0} that reduces only to elements of |T |, we may prove by induction over the maximum number of reduction steps of u′ that (u_{0} u′) is indeed element of |T′′|_{I;x←u′}. It is neutral and we show it only reduces to elements of |T′′|_{I;x←u′}:

– (u_{0} u′) ⊳ (u′_{0} u′) but then u′_{0} is element of |T |_{I} and thus (u′_{0} u′) is element of |T′′|_{I;x←u′}.

– (u_{0} u′) ⊳ (u_{0} u′′) but the maximum number of reduction steps inside of u′′ is strictly less than in u′. So we can apply the induction hypothesis and |T′′|_{I;x←u′′} = |T′′|_{I;x;←u′}.

• For the case T = (α_{i} : K_{i})T′, we have to prove that any intersection of reducibility candidates (of degree 0) is still a reducibility candidate. This is done straightforwardly.

• The case T = (T_{i+1} t) is a simple application of the induction hypothesis.

• If T = λ^{T_{0}}x.T_{i}, the induction hypothesis says that for any term u |T_{i}|_{I;x←u} is a reducibility candidate of degree i. The previous lemma ensures that the function |T |_{I} is invariant through βι-conversion of its argument.

• If T = Rec{t, T_{0}, α_{0}.T_{1}}:

If ⌈t⌉[I] admits no normal form, we saw that N was a reducibility candidate.

If ⌈t⌉[I] normalizes to u we prove by induction over u that the set C(u, I, T_{0}, T_{1}, α_{0}) as it is defined in the definition of |T |_{I} is indeed a reducibility candidate.

– if u = 0 then |T_{0}|_{I} is a candidate by induction hypothesis.

– if u = S{u′}, then C(u′, I, T_{0}, T_{1}, α_{0}) is a reducibility candidate by induction hypothesis. Therefore I; α_{0} ← C(u′) is a candidate interpretation, and |T_{1}|_{I;α_{0}←C(u′)} is a reducibility candidate.

– For all other cases we saw that N was a reducibility candidate.

Definition Consider a context Γ. A candidate interpretation I is said to be admissible for Γ if and only if for any (x, T_{0}) of Γ one has I(x) ∈ |T_{0}|_{I}.

Theorem 1 Consider a context Γ and I, an interpretation which is admissible for Γ. Then the following holds:

• for any well-formed judgement Γ ⊢ t : T_{0} we have ⌈t⌉[I] ∈ |T_{0}|_{I}.

• for any well-formed judgement Γ ⊢ T_{i} : K_{i} and for any judgement Γ ⊢ T′_{i}:K_{i}, if T_{i} ⊳ T′_{i} then |T_{i}|_{I} = |T′_{i}|.

Proof Now for the fight. We proceed by structural induction over the derivation of the typing judgement; the different cases to consider are each of the typing rules. In what follows, and if t (resp. t′, t_{1}, etc) is a proof term, then u (resp. u′, u_{1}, etc) is the corresponding substituted pure term ⌈t⌉[I] (resp. ⌈t′⌉[I], ⌈t_{1}⌉[I], etc).

• The rules Nat, zero, successor are trivial.

• The rec rule. ⌈rec{t, t_{0}, t_{S}}⌉[I] is neutral and we show it only reduces to elements of |(T t)|_{I}. As in [9] we reason by induction over ν(u) + ν(u_{0}) + ν(u_{S}) + l(u′) where ν is the maximal number of reduction steps in a term and l(u′) the length (number of symbols) of the normal form u′ of u.

rec{u, u_{0}, u_{S}} may reduce to:

– rec{u′′, u′_{0}, u′_{S}} where … which is element of |(T t′′)|_{I} = |(T t)|_{I} by induction hypothesis.

– u_{0} if u = 0; which is element of |(T 0)|_{I} by induction hypothesis.

– (u_{S} u′′ rec{u′′, u_{0}, u_{S}}) if u = S{u′′}.

By induction hypothesis we know that

rec{u′′, u_{0}, u_{S}} ∈ |(T u′′)|_{I}.

Therefore

(u_{S} u′′) ∈ |(T t′′)→(T S{t′′})|_{I}

and this implies that

(u′_{S} u′′ rec{u′′, u′_{0}, u′_{S}}) ∈ |(T S{t′′})|_{I} = |(T t)|_{I}.

• Formation rule for (t_{1} t_{2}). The induction hypothesis ensures that u_{2} ∈ |T^{2}|_{I} and u_{1} ∈ |(x : T^{2})T^{1}|_{I}. Hence, by definition of |(x : T^{2})T^{1}|_{I} and because of the adequacy lemma, we know that (u_{1} u_{2}) ∈ |T^{1}|_{I;x←u_{2}} = |T^{1}[x \ t_{2}]|_{I}.

• Formation rule for λ^{T_{0}}x.t. The induction Hypothesis ensures that for any term u_{0} ∈ |T_{0}|_{I} we have u[I; x ← u_{0}] ∈ |T′|_{I;x←u_{0}}. To prove that ⌈λ^{T_{0}}x.t⌉[I] = λx.u ∈ |(x: T_{0})T′|_{I}, we have to show that given any term u_{0} ∈ |T_{0}|_{I}, (λx.u u_{0}) ∈ |T′|_{I;x←u_{0}}. We do so by induction over ν(u) + ν(u_{0}). The term (λx.u u_{0}) is neutral; it may reduce to:

– (λx.u′ u′_{0}) where u′ and u′_{0} are respectively reducts of u and u_{0}. This term is element of |T′|_{I;x←u_{0}} because of the last induction hypothesis.

– u[x \ u_{0}]. But this is element of |T′|_{I;x←u_{0}}, as we have seen.

• Formation rule for Λ^{K_{i}}α_{i}.t. We have to prove that ⌈Λ^{K_{i}}α_{i}.t⌉[I] = ⌈t⌉[I] ∈ |(α_{i}:K_{i})T_{0}|_{I}. Let C_{i} be any reducibility candidate of degree i. Then I; α ← C_{i} is admissible for Γ :: (α_{i}, K_{i}) and so u ∈ |T_{0}|_{I;α←C_{i}}.

• Formation rule for (t T). We have ⌈t⌉[I] = u ∈ |(α: K)T_{0}|_{I}, and so ⌈t T ⌉[I] = u ∈ |T_{0}|_{I;α←|T |_{I}} = |T_{0}[α \ T]|_{I}.

• Formation rule for λ^{T_{0}}x.T. λ^{T_{0}}x.T may only reduce to:

– λ^{T_{0}}x.T′ with T ⊳ T′. By induction hypothesis, for any u′, |T |_{I;x←u′} = |T′|_{I;x←u′}. The result follows.

– λ^{T′_{0}}x.T with T_{0} ⊳ T′_{0}. By definition, λ^{T′_{0}}x.T |_{I} = |λ^{T_{0}}x.T |_{I}.

• Formation rule for (T t). If t ⊳ t′, we know that |(T t)|_{I} = |(T t′)|_{I}. If t ⊳ T′, by induction hypothesis, |(T t)|_{I} = |(T′ t)|_{I}. Finally if T = λ^{T_{0}}x.T′, by definition and the adequacy lemma, we have |(T t)|_{I} = |T′[x \ t]|_{I}.

• The Rec rule. T = Rec{t, T_{0}, α.T_{1}} may reduce to:

– Rec{t′, T_{0}, α.T_{1}}, in which case we have already seen that |T |_{I} remains unchanged (the reduction takes place in a proof-subterm).

– Rec{t, T′_{0}, α.T_{1}} or Rec{t, T_{0}, α.T′_{1}}. In which case the induction hypothesis easily enables us to prove that |T |_{I} remains unchanged (by induction over the definition of |T |_{I}).

– T_{0}, if ⌈t⌉[I] = 0. but then we have |T |_{I} = |T_{0}|_{I}.

– (T_{1}[α \ Rec{t′, T_{0}, α.T_{1}}] t′), if ⌈t⌉[I] = S{t′}. But by induction hypothesis, we know that ⌈t⌉[I] is strongly normalizable ^{5}; the desired equality follows.

• The var rule. Immediate, by definition.

• The weak rule. Any interpretation which is admissible for Γ :: (a, V) is also valid for Γ. The result follows.

• The redT rule. All we have to check is that if T and T′ are well-typed and T =_{βι} T′ then there is a path from T to T′ which only goes through well-typed predicates. This is true because subject-reduction holds and because of the Church-Rosser property.

• The RedK rule. Similar.

3 Strong normalization for erased terms implies strong normalization for typed terms

As in [7] we will prove the strong normalization for all the well-typed objects, using a coding. But instead of coding our types as simply typed lambda terms, we will code the well-typed kinds and predicates as proof-terms.

In what follows, o and c_{o} are respectively a fresh type variable, and a fresh term variable. We suppose also that to each predicate variable α we may associate a distinct term variable \overline{α}, which, we will suppose, has not been used before.

Definition. We define the application ρ from kinds to predicates:

• ρ(Prop) = o

• ρ((x : T)K) = (x : T)ρ(K)

Definition For any context Γ, we define the context \overline{Γ} by:

• \overline{[]} = [] :: (o, Prop) :: (c_{o}, o)

• \overline{Γ :: (x, T)} = \overline{Γ} :: (x, T)

• \overline{Γ :: (α, K)} = \overline{Γ} :: (α, K) :: (\overline{α}, ρ(K))

We may also define: DProp ≡ c_{o} D_{(x:T)K} ≡ λ^{T} x.D_{K} which of type ρ(K) in any context in which ρ(K) is well-typed. CProp ≡ o C_{(x:T)K} ≡ λ^{T} x.C_{K} which is of type K in any context in which K is well-typed.

5Note that this is the only case where we use the reducibility property for a proof term inside a predicate.

Now, to any object M (proof-term, predicate or kind) we may associate the following proofterm [M]:

[x] = x
[(t t′)] = ([t] [t′])
[λ^{T} x.t] = λ^{T} x.(λ^{o} .[t] [T])
[λ^{K}α.t] = λ^{K}α.(λ^{o} .[t] [K])
[(t T)] = (λ^{ρ(K)} .[t] [T] T)
[rec{t, t_{0}, t_{S}}] = rec{[t], [t_{0}], [t_{S}]}
[α] = \overline{α}
[(T t)] = ([T] [t])
[λ^{T′}x.T] = λ^{T′}x.(λ^{o} .[T] [T′])
[Rec\{t, T_{0}, α.T_{1}\}] = rec\{[t], [T_{0}], λ^{o}\overline{α}.([T_{1}][α \ o])\}
[(x : T_{1})T_{2}] = (λ^{o} .λ^{T_{1}→o} .c_{o} [T_{1}] (λ^{T_{1}}x.[T_{2}]))
[(α : K)T] = (λ^{ρ(K)}\overline{α}.λ^{K}α.λ^{o} .[T] [K] D_{K} C_{K})
[Prop] = o
[(x : T)K] = (λ^{o} .[K] [T]) .

Lemma 7 If Γ ⊢ t:T then \overline{Γ} ⊢ [t]:T.

Proof By structural induction over the typing judgement. For induction loading, one also proves that if Γ ⊢ T:K then \overline{Γ} ⊢ [T]:ρ(K) and \overline{Γ} ⊢ [K]:o.

Lemma 8 If t ⊳ t′, then ⌈[t]⌉ ⊳^{+} ⌈[t′]⌉.

Proof By induction over t, and because of the facts:

• ⌈[t[x \ t′]]⌉ = ⌈[t]⌉[x \ ⌈[t′]⌉]

• ⌈[t[α \ T]]⌉ = ⌈[t]⌉[\overline{α} \ ⌈[T]⌉]

Theorem 2 Any well-typed object is strongly normalizable.

Proof The lemma above and theorem 1 imply that any well-typed proof-term is strongly normalizable. It is easy to show that this fact also implies the strong normalization of any well-typed kind or predicate.

4 Some remarks about large elimination schemes

Let us try to give some examples of useful or amusing ways to use large elimination schemes. In what follows we do not restrict large elimination schemes to integers. We will also use the notation of the system Coq^{6}. Not all the examples given below can be run in the currently distributed version of the system because no large elimination is provided for computational inductive types at the moment.

6[x:T]t for abstraction and (x:T)T' for quantification.

4.1 Inversion of inductive predicates

In the hitherto developed Coq examples, this is probably the most widely used application of large elimination schemes. Actually it is a generalization of the 0 ≠ 1 proof. We will simply give an example, taken from the proof of sorting algorithms [4]. The problem is to define what it means for a list to be sorted. Lists are defined as usual:

Variable  A:Set.
Inductive Set list = nil : list | cons : A -> list -> list.

Given a binary predicate variable over A, one defines the sorting property as an inductive predicate:

Variable   inf : A -> A -> Prop.
Inductive Definition list_Lowert [a:A] : list -> Prop =
      nil_low : (list_Lowert a nil)
    | cons_low : (b:A)(l:list)(inf a b)->(list_Lowert a (cons b l)).
Inductive Definition sort : list -> Prop =
      nil_sort : (sort nil)
    | cons_sort : (a:A)(l:list)(sort l)->(list_Lowert a l)->(sort (cons a l)).

This definition is quite natural. The problem is that, in practice, one often needs properties like:

   (sort (cons a l))->(list_lowert a l)

or similarly:

   (list_lowert a (cons b l))->(inf a b).

The point is, that this is based on the fact that nil_low cannot be used to prove (sort a l); i.e. it implicitly uses the fact that nil and cons are different. Therefore, in order to prove the properties above, we define two new predicates, using large elimination, which are respectively equivalent de list_lowert and sort:

Definition list_Lowert2 =
   [a:A][l:list](<Prop> Match l with
                    (* nil *) True
               (* cons b l *) [b:A][l:list][H:Prop](inf a b)).
Definition sort_inv
[l:list](<Prop>Match l with
     (* nil *) True
(* cons a l *) [a:A][l:list][H:Prop](sort l)/\(list_Lowert a l)).

It is easy to prove the equivalences, which allows us to get the desired properties:

(sort (cons a l)) is equivalent to (sort_inv (cons a l)) which reduces to

(sort l)/\(list_lowert a l). Similar examples can be found in [5, 13].

4.2 ML dynamics

The original motivation for large elimination schemes was to enhance the system from a logical point of view, i.e. being able to prove new properties. As long as the normalization problem was open, not very much attention was paid to the possibility to use them in the computational part. This example and the ones below are meant to show that large elimination schemes allow to type new interesting programs.

It is easy to define an inductive structure which is trivially isomorphic to the types of simple typed λ-calculus. For example:

Inductive Definition MLtype : Set =
   MLnat : MLtype
 | MLarrow : MLtype -> MLtype -> MLtype.

allows us to represent the types of functions and functionals over natural numbers. Adding other base types, sums, products, etc is of course no problem.

The point is that the large elimination scheme allows us to build the actual simple type out of its representation of type MLtype:

Definition MLtrad = [rT:MLtype]
               (<Set>Match rT with
                  (* MLnat *) nat
                  (* (MLarrow T1 T2) *)
                        [T1:MLtype][S1:Set][T2:MLtype][S2:Set](S1->S2))
    : MLtype -> Set.

The remarkable point is that, say, (MLtrad (MLarrow MLnat MLnat)) will actually reduce (i.e. is syntactically equivalent) to the type nat->nat. This is exactly what we need in order to define Dynamics like in ML [1], but without any extension of the type system. A dynamic is a pair composed of a type representation and an element of the corresponding type:

Inductive Definition MLdyn : Set =
Dyn_intro : (T:MLtype)(MLtrad T)->MLdyn.

Note that this construction can be extended in order to represent, for instance, polymorphic (system F) types and dynamics.

4.3 Polymorphism

One may notice that in order to define dynamics in the paragraph above, we did not make use of polymorphism; hence this construction can be done in a first-order system. On the other hand, the new ability to represent types as first-order objects and then translate them back into types, allows us to define certain polymorphic functions. The point being, that we can quantify over type representations:

Definition Church = (a:MLtype)
                        (MLtrad a)
                             ->((MLtrad a)->(MLtrad a))
                                ->(MLtrad a).
Definition Church0 = [a:MLtype][x:(MLtrad a)][f:(MLtrad a)->(MLtrad a)]x.
Definition ChurchS = [n:Church]
                         [a:MLtype]
                              [x:(MLtrad a)][f:(MLtrad a)->(MLtrad a)]
                                (f (n a x f)).

It is worth noting that this type system:

• is strictly more expressive that ML polymorphism: we can impose that the argument of some function is polymorphic. For instance ChurchS can only be applied to a polymorphic argument.

• does not embed system F: we cannot represent universally quantified type like ∀α.T and hence we cannot apply its representation to some Church integer for instance.

4.4 Mutually recursive types

The large elimination feature offers a possible solution to the problem of mutually recursive types. Again, the idea is best explained through an example. The following definition does not, at first, fit into the framework of [3]:

     expr = Num : nat -> expr
          | closure : expr -> Env -> expr
and env = nil : Env
        | cons : term -> Env -> Env.

We may however define an inductive family of Sets indexed by booleans:

Inductive Definition P : bool -> Set =
  Num : nat -> (P true)
| closure : (P true)->(P false)->(P true)
| nil : (P false)
| cons : (P true)->(P false)->(P false).
Env := (P false)     expr := (P true)

The point is that we may now get the expected recursive elimination schemes thanks to large elimination. For example we can prove:

(Q:Env->Prop)(Q nil)->
   ((E:Env)(Q E)->(t:expr)(Q (cons t E)))->
           (F:Env)(Q F).

Acknowledgements

A lot of the presented material is due to, or has been shown to me by Christine Paulin-Mohring. I would also like to thank Hugo Herbelin and Thorsten Altenkirch for their insightful remarks.

References

[1] M. Abadi, L. Cardelli, B. Pierce, G. Plotkin. “Dynamic Typing in a Statically Typed Language.” Conference version in Proceedings of POPL 1989. Extended version in ACM Transactions on Programming Languages and Systems, vol. 13, pp. 237-268, 1991.

[2] Th. Coquand, J. Gallier. “A Proof of Strong Normalization For the Theory of Constructions Using a Kripke-like Interpretation”. Proceedings of the first BRA workshop on Logical Frameworks, G. Huet and G. Plotkin Eds. Antibes, 1990.

[3] Th. Coquand, Ch. Paulin-Mohring. “Inductively Defined Types”. Proceedings of COLOG-88, P. Martin-Löf and G. Mints Eds. LNCS 417. Tallin, 1988.

[4] G. Dowek, A. Felty, H. Herbelin, G. Huet, Ch. Paulin-Mohring, B. Werner. “The Coq Proof Assistant User’s Guide, Version 5.6.” INRIA, Technical Report 134, 1991.

[5] G. Huet. “The Gildbreath Trick: A case study in axiomatisation and proof development in the Coq proof assistant.” INRIA research report 1511, 1991.

[6] J. Gallier. “On Girard’s Candidats de Réductibilité, Logic and Computer Science, P. Odifreddi (Ed.), Academic Press, pp. 123-203, London, 1990.

[7] H. Geuvers, M.-J. Nederhof. “A Modular Proof of Strong Normalization for the Calculus of Constructions”. Journal of Functional Programming, 1991.

[8] J.-Y. Girard. “Interprétation fonctionnelle et élimination des coupures de l’arithmétique d’ordre supérieur”. Thèse d’Etat, Université Paris VII, 1972.

[9] J.-Y. Girard. “Proofs and Types”. Cambridge University Press, 1989.

[10] K. Gödel. “Uber eine bisher noch nicht benützte Erweiterung des finiten Standpunktes.” Reprinted with English translation in the Collected Works, vol. 2, pp. 240-251, Oxford University Press, 1990. Original paper in Dialectica, Vol. 12, 1958.

[11] J.-L. Krivine. “Lambda-calcul, types et modèles”. Masson, 1990.

[12] Ch. Paulin-Mohring. “Extraction de Programmes dans le Calcul des Constructions.” Thèse de Doctorat, Université Paris VII, 1989.

[13] Ch. Paulin-Mohring, B. Werner. “Synthesis of ML programs in the system Coq.” Submitted to the Journal of Symbolic Computation.

[14] J. Smith. “Propositional Functions and Families of Types.” Notre Dame Journal of Formal Logic, Vol. 30, number 3, 1989.