REASONING IN A LOGIC WITH DEFINITIONS AND INDUCTION

RAYMOND CHARLES MCDOWELL

A DISSERTATION in

COMPUTER AND INFORMATION SCIENCE

Presented to the Faculties of the University of Pennsylvania in Partial Fulfillment of the

Requirements for the Degree of Doctor of Philosophy. 1997

Dale Miller Supervisor of Dissertation

Mark Steedman Graduate Group Chairperson

\begin{matrix}c \\ ◯ \end{matrix} Copyright 1997

by

Raymond Charles McDowell In loving memory of my father and grandfathers:

James E. McDowell  June 6, 1933 – March 11, 1992
Gilford G. Quarles December 24, 1909 – April 27, 1994
Theodore E. McDowell June 9, 1907 – November 21, 1996

Acknowledgements

I appreciate the help that I have received from a number of people in the preparation of this dissertation and in the conduct of the research that it presents. First, I thank Dale Miller, my supervisor, for his encouragement and guidance on both technical and professional matters through all the twists and turns that have been taken by my graduate studies in general and this research project in particular. I have also benefited from the stimulating discussions, probing questions, and enthusiastic interest of Frank Pfenning on a number of occasions. I also appreciate Frank’s invitation to visit Carnegie Mellon University in March, and for the hospitality that he, Carsten Schürmann, and Iliano Cervesato provided during that time. Catuscia Palamidessi has contributed to this work, not only in our joint work presented in Chapter 4, but also through other interactions which led, for example, to the introduction of levels to allow limited use of implication in definitions. Lars-Henrik Eriksson generously made his derivation editor Pi available to me, which has been a great help in this work. The remaining members of my dissertation committee have also been very supportive of me and my work. I especially thank Val Tannen for his encouragement and for his example to me as a scholar-teacher, Carl Gunter for the personal interest he has taken in me, and Jean Gallier for his enthusiasm and sense of humor, as well as his suggestions and pointers to the literature. I also thank Jesus Christ for the assurance he has given me, and particularly for his assistance when I faced several perplexing technical problems. Finally, I am grateful for the patience and supportiveness of Sharon McDowell, my wife, especially during the past several months when so much of my time has been committed to work on this dissertation.

This work has been funded in part by the grants ONR N00014-93-1-1324, NSF CCR-92-09224, NSF CCR-94-00907, and ARO DAAH04-95-1-0092.

Abstract

Reasoning in a Logic with Definitions and Induction

Raymond Charles McDowell Supervisor: Dale Miller

We present a logic for the specification and analysis of deductive systems. This logic is an extension of a simple intuitionistic logic that admits higher-order quantification over simply typed λ-terms. These are key ingredients for higher-order abstract syntax, an elegant and declarative treatment of object-level abstraction and substitution. The logic also supports induction and a notion of definition. The latter concept of definition is a proof-theoretic device that allows certain theories to be treated as “closed” or as defining fixed points. We prove that cut-elimination and consistency results hold for this logic, extending a technique due to Tait and Martin-Löf. We also demonstrate the effectiveness of the logic for encoding meta-level predicates such as bisimulation and for reasoning about judgements encoded using higher-order abstract syntax. The sense of closure in definitions allows us to cleanly express the notions of simulation and bisimulation, and we derive in our logic some highlevel properties about these notions in the context of abstract transition systems. Formal meta-theoretic analysis of higher-order abstract syntax encodings has been inadequately addressed in previous research. We explore the difficulties of this task by considering encodings of intuitionistic and linear logics, and formally derive the admissibility of cut for important subsets of these logics. We then propose an approach to avoid the apparent tradeoff between the benefits of higher-order abstract syntax and the ability to analyze the resulting encodings. We illustrate this approach through examples involving the simple functional and imperative programming languages PCF and PCF_{:=}. We formally derive such properties as unicity of typing, subject reduction, determinacy of evaluation, and the equivalence of transition semantics and natural semantics presentations of evaluation.

Contents

Acknowledgements iv

Abstract v

List of Tables ix

1 Introduction 1 1.1 Outline of the Dissertation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.2 Higher-Order Abstract Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

2 The Logic F Oλ^{ΔIN} 9 2.1 A Description of the Logic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 2.2 Some Simple Definitions and Propositions . . . . . . . . . . . . . . . . . . . . . 18 2.2.1 Natural Numbers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 2.2.2 Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 2.3 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

3 Cut-Elimination for F Oλ^{ΔIN} 37 3.1 Reduction Rules for Derivations . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 3.2 Normalizability and Reducibility . . . . . . . . . . . . . . . . . . . . . . . . . . 49 3.3 Cut-Elimination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 3.4 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

4 Reasoning about Transition Systems in F Oλ^{ΔIN} 61 4.1 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 4.2 Encoding Abstract Transition Systems . . . . . . . . . . . . . . . . . . . . . . . 63 4.3 Encoding Simulation and Bisimulation . . . . . . . . . . . . . . . . . . . . . . . 65 4.3.1 Finite Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 4.3.2 Definitions and Fixed Points . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 4.3.3 Non-Finite Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 4.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 viii CONTENTS

5 Reasoning about Logics in F Oλ^{ΔIN} 75 5.1 Logic Representations for Meta-Theoretic Analysis . . . . . . . . . . . . . . . . 76 5.1.1 Natural Deduction-Style Encoding . . . . . . . . . . . . . . . . . . . . . . . . 76 5.1.2 Sequent-Style Encoding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 5.1.3 Explicit Sequent Encoding . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 5.1.4 Explicit Eigenvariable Encoding . . . . . . . . . . . . . . . . . . . . . . . . . 87 5.1.5 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 5.2 Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 5.2.1 Intuitionistic Logic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 5.2.2 Linear Logic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 5.3 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

6 Reasoning about Programming Languages in F Oλ^{ΔIN} 107 6.1 Motivation from Informal Reasoning . . . . . . . . . . . . . . . . . . . . . . . . 108 6.2 The Language of Untyped λ-Terms . . . . . . . . . . . . . . . . . . . . . . . . . 110 6.3 A Language for Computable Functions . . . . . . . . . . . . . . . . . . . . . . . 115 6.4 A Language with References . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 6.5 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

7 Conclusion and Future Work 143 7.1 Summary of Accomplishments . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 7.2 Future Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

Bibliography 147

List of Tables

2.1 Inference rules for the core of F Oλ^{ΔIN} . . . . . . . . . . . . . . . . . . . . . . . 10 2.2 Definitional clauses for predicates over natural numbers . . . . . . . . . . . . . 19 2.3 Definitional clauses for predicates over lists . . . . . . . . . . . . . . . . . . . . 29

4.1 CCS transition rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 4.2 Indexed definition for simulation and bisimulation . . . . . . . . . . . . . . . . 72

5.1 Natural deduction encoding of intuitionistic logic . . . . . . . . . . . . . . . . . 77 5.2 Sequent calculus encoding of intuitionistic logic . . . . . . . . . . . . . . . . . . 79 5.3 Explicit sequent encoding of intuitionistic logic . . . . . . . . . . . . . . . . . . 82 5.4 Explicit eigenvariable encoding of intuitionistic logic . . . . . . . . . . . . . . . 89 5.5 Encoding of substitution for eigenvariables . . . . . . . . . . . . . . . . . . . . . 90 5.6 Inference rules for a fragment of intuitionistic linear logic . . . . . . . . . . . . 96 5.7 Explicit eigenvariable encoding of lists . . . . . . . . . . . . . . . . . . . . . . . 98 5.8 Explicit eigenvariable encoding of linear logic . . . . . . . . . . . . . . . . . . . 99 5.9 Decoding function for terms, atoms and goal formulas . . . . . . . . . . . . . . 100 5.10 Encoding of eigenvariable operations . . . . . . . . . . . . . . . . . . . . . . . . 103

6.1 Object logic encoding of typing and evaluation of untyped λ-terms . . . . . . . 111 6.2 Object logic encoding of typing for PCF . . . . . . . . . . . . . . . . . . . . . . 116 6.3 Object logic encoding of natural semantics for PCF . . . . . . . . . . . . . . . 117 6.4 Object logic encoding of transition semantics for PCF . . . . . . . . . . . . . . 117 6.5 Natural semantics for PCF_{:=} . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 6.6 Continuation-based natural semantics for PCF_{:=} . . . . . . . . . . . . . . . . . 125 6.7 Object logic encoding of typing for PCF_{:=} terms . . . . . . . . . . . . . . . . . 126 6.8 Object logic encoding of natural semantics for PCF_{:=} (part I) . . . . . . . . . . 128 6.9 Object logic encoding of natural semantics for PCF_{:=} (part II) . . . . . . . . . 129 6.10 Object logic encoding of natural semantics for PCF_{:=} (part III) . . . . . . . . . 130 6.11 Encoding of typing for PCF_{:=} continuations, instructions, and answers . . . . . 132 6.12 Meta-logic predicates for PCF_{:=} stores . . . . . . . . . . . . . . . . . . . . . . . 133

Chapter 1

Introduction

A logical framework is a formal meta-language for specifying deductive systems such as logics, operational semantics, and type systems. Typically the deduction rules for the object system are specified as an axiom system, or theory, of the specification logic. To give a very simple example, membership in the natural numbers might be encoded by the two formulas

nat z ∀x(nat x ⊃ nat (s x)) .

We can then use this theory to derive formulas in the specification logic that indicate that various expressions denote natural numbers. Analogously, we can construct theories to specify operational semantics and type systems so that formulas denoting judgements such as “the term M denotes a program”, “the program M evaluates to the value V ”, and “the program M has type T ” can be derived.

One of the advantages of such formal specifications is that they allow logical and mathematical analyses to be used to prove properties about the specified systems. Given the specification of evaluation for a functional programming language, for example, we may wish to prove that the language is deterministic or that evaluation preserves types. As larger and more complex languages and systems are considered, it becomes desirable to provide automated support for proving these properties. To do this we must make these proofs formal as well, and it thus becomes natural to consider proving such properties within the logical framework.

2 CHAPTER 1. INTRODUCTION

In this dissertation we introduce a new logic F Oλ^{ΔIN} (pronounced “fold-n”) and investigate its use for this purpose. One of the distinctive features of this logic is its notion of definition. Like a theory, a F Oλ^{ΔIN} definition provides a collection of formulas that are available for constructing derivations in the logic. In addition, a definition carries with it a sense of closure or completeness: if a defined proposition holds, it necessarily holds by one of the clauses of the definition. Viewing the sample theory given above as a definition, for example, adds the idea that these two formulas are the only way to establish that the predicate nat holds. The logic then provides a means to perform case analyses on defined concepts; thus given nat y as a hypothesis, we can consider the two cases y = z and y = (s y′) for some y′ such that nat y′. This notion of definition has been investigated in various proof systems in recent years [17, 19, 20, 50]. Since it provides the basis for case analysis of defined concepts, the idea has obvious benefit for a logic used to encode object systems and reason about them.

There is also a more subtle benefit for logical frameworks provided by definitions. To establish a proposition by definition, we need only show that one clause of the definition applies. To show that nat y holds, for example, it is sufficient to show either that y = z or that y = (s y′) for some y′ such that nat y′. This is similar to the idea of may behavior of a concurrent system: “there exists a definitional clause such that … ” can be used to encode “there exists a computation such that … ”. On the other hand, to show something from the hypothesis nat y by case analysis, we need to prove that it holds both for y = z and for y = (s y′), given that nat y′. Thus the sense of closure that definitions provide allows certain forms of must behavior (“all computations...”) to be captured.

Several existing logical frameworks are equipped with a similar notion of definition, but are not suitable for our purposes. The Calculus of Inductive Constructions (implemented in Coq) [43] and FS_{0} [30], for example, contain inductive definition facilities. However, the function type of both of these systems is too strong to naturally support the key representation technique of higher-order abstract syntax. Higher-order abstract syntax is an elegant and declarative encoding of abstraction and substitution. With most approaches to syntactic representation, the details of variable binding and substitution must be carefully addressed throughout a specification, and theorems about substitution and bound variables CHAPTER 1. INTRODUCTION 3

can dominate the system analyses. With higher-order abstract syntax, on the other hand, these features are specified concisely and their basic properties follow immediately from the specification logic.

In contrast to Coq and FS_{0}, the finitary calculus of partial inductive definitions [11] does support the use of higher-order abstract syntax. However, the cut rule is not admissible for this calculus; the class of supported definitions is rich enough to allow inconsistency in the presence of cut. To see how this is possible, consider the formula (a ⊃ ⊥) ⊃ a as a definition for the propositional constant a. It is not hard to derive the sequent a ⟶ ⊥ with this definition: by the hypothesis a holds, and a case analysis on the definition shows that if it holds, it must be because a ⊃ ⊥ holds; the consequent ⊥ then easily follows from the two hypotheses a and a ⊃ ⊥. But from this derivation of a ⟶ ⊥, we can derive ⟶ a ⊃ ⊥, and thus by definition, ⟶ a. We have shown that there are derivations of a ⟶ ⊥ and ⟶ a, so the cut rule would give us a derivation of ⟶ ⊥. The admissibility of cut is important beyond the (fundamental) question of the consistency of the calculus; otherwise we could just use the calculus without a cut rule. Our intent is to reason within the calculus about encoded systems. Using the natural number example again, we would like the derivation of a sequent nat x ⟶ P x, where x is a variable, to represent the idea that the property encoded by P holds for all natural numbers. However, without the cut rule, we do not have any guarantee that for all i such that ⟶ nat i is provable, ⟶ P i is also provable. Thus we need the admissibility of the cut rule.

The logic F Oλ^{ΔIN} can be viewed as a variation of the finitary calculus of partial inductive definitions in which the cut rule is admissible: the class of definitions is restricted and the form of the induction rule is modified. We include only natural number induction in F Oλ^{ΔIN}. This keeps the meta-theory of the logic from becoming overly complex, but is still powerful enough to allow us to derive the other induction principles we need. Because of F Oλ^{ΔIN}’s close relationship with the finitary calculus of partial inductive definitions, we are able to use Eriksson’s derivation editor Pi [13] to construct F Oλ^{ΔIN} derivations. All F Oλ^{ΔIN} derivations mentioned in this dissertation have been created using Pi, which provides us with a much greater degree of confidence in their correctness than would be the case if they were constructed by hand.

1.1 Outline of the Dissertation

The dissertation is organized in the following manner. The remainder of this chapter gives an overview of higher-order abstract syntax. As has been mentioned, support for this representation technique was an important criterion in the design of F Oλ^{ΔIN}, and its use will pervade this dissertation.

Chapter 2 presents the logic F Oλ^{ΔIN}; as suggested by the title of this dissertation, its two key features are the notion of definition sketched above, and induction over natural numbers. To illustrate the use of F Oλ^{ΔIN}, we derive several theorems expressing properties of natural numbers and lists. In Chapter 3 we prove cut-elimination and consistency theorems for the logic. The cut-elimination proof extends a technique due to Tait and Martin-Löf to a sequent calculus setting, and uses the technical notions of normalizability and reducibility.

We proceed in the remaining chapters to explore the use of F Oλ^{ΔIN} for reasoning about various deductive systems. In Chapter 4 we use the correlation between the different quantificational aspects of definitions and the computational notions of may and must behavior to express the rich notions of simulation and bisimulation for abstract transition systems. We capture the largest bisimulation relation — bisimulation equivalence — and explore its meta-theory, proving, for example, that the relation is indeed an equivalence.

The next two chapters develop an approach for formal reasoning about higher-order abstract syntax encodings. In Chapter 5 we consider encodings of intuitionistic and linear logics in F Oλ^{ΔIN} to illustrate some difficulties with reasoning in the specification logic about higher-order abstract syntax and to also demonstrate some strategies to deal with these difficulties. Unfortunately these strategies involve sacrificing some benefits of higherorder abstract syntax in order to gain the ability to perform some meta-theoretic analyses. We avoid this tradeoff in Chapter 6 by taking a different approach to formal reasoning. The key to this approach is to encode the object system in a specification logic that is separate from the logic F Oλ^{ΔIN} in which we perform the reasoning; this specification logic is itself specified in F Oλ^{ΔIN}. This separation of the specification logic and the metalogic allows us to reason formally about specification logic sequents and their derivability, and also reflects the structure of informal reasoning about higher-order abstract syntax 1.2. HIGHER-ORDER ABSTRACT SYNTAX 5

encodings. We illustrate this approach by considering the static and dynamic semantics of small functional and imperative programming languages; we are able to derive in F Oλ^{ΔIN} such properties as the unicity of typing, determinacy of semantics, and type preservation (subject reduction).

We conclude in Chapter 7 with a brief discussion of our accomplishments and possible extensions of this work.

1.2 Higher-Order Abstract Syntax

To set the stage for our work, we provide a brief introduction to higher-order abstract syntax; we refer the reader to [23, 46] for a more comprehensive discussion.

The key idea of higher-order abstract syntax is that variable binding in the object language is represented by λ-abstraction of the meta-language. For example, consider the simple functional language whose terms are described by the following grammar:

M ::= x | λx.M | M M | let x = M in M | μx.M .

To encode these terms, we introduce a type tm and the constants

abs : (tm → tm) → tm  let : tm → (tm → tm) → tm
app : tm → tm → tm  rec : (tm → tm) → tm .

The following function ([ ]) maps an object language term to its representation:

([x]) = x^{∗} : tm  for x a variable
([λx.M]) = (abs λx^{∗}:tm.([M]))
([M N]) = (app ([M]) ([N]))
([let x = M in N]) = (let ([M]) λx^{∗}:tm.([N]))
([μx.M]) = (rec λx^{∗}:tm.([M]) ) ,

where x ↦ x^{∗} defines a bijective mapping of object language variables to meta-language variables of type tm. Variables in the object language are encoded by meta-language variables, and the scope of the object language variable binding is encoded by the scope of the meta-level λ-binding. This representation takes advantage of meta-level α-equivalence to provide α-equivalence for object language terms, i.e. ([M]) =_{α} ([N]) if and only if M 6 CHAPTER 1. INTRODUCTION

and N are α-equivalent. Another benefit is that meta-level β-reduction provides captureavoiding substitution, i.e. (λx^{∗}.([M]))([N]) =_{β} ([M])[([N])/x^{∗}] = ([M[N/x]]).

The type inference rules for our object language will include

x : T, Γ > x : T {y : T, Γ > M[y/x] : U \atop Γ > λx.M : T → U} ,

where in the second rule y is a variable that does not occur in Γ or M. If we let ty be a new type used to represent object language types, arr : ty → ty → ty a constant representing object language function types, and typeof : tm → ty → o a predicate representing object language typing judgements, then these two rules are encoded by the following formula B:

∀n(typeof n T ⊃ typeof (R n) U) ⊃ typeof (abs R) (arr T U) .

To understand this encoding, let us first examine the structure of typing derivations for abstractions. The premise of the typing rule for abstraction renames the variable bound by the abstraction to avoid name conflict. The body of the abstraction is then typed in the typing environment Γ extended with the type assignment y : T. In the typing derivation for the body, the typing rule for variables will be used to infer the type T for y. This can be represented schematically as

y : T, Γ′ > y : T ; ⋮ . ; y : T, Γ > M[y/x] : U ; Γ > λx.M : T → U .

In our encoding, we use assumptions in place of a typing environment. The variable bound by the abstraction is replaced by a new eigenvariable, and the result is typed under the assumption that the eigenvariable has type T. Thus the typing rule for variables is replaced by uses of typing assumptions:

B, typeof n T, Γ′ ⟶ typeof n T ⋮ . B, typeof n T, Γ ⟶ typeof (R n) U B, Γ ⟶ typeof (abs R) (arr T U) .

(To simplify the presentation, we will sometimes combine the application of several rules and display it as the use of a single derived rule. We indicate this by a double line between 1.2. HIGHER-ORDER ABSTRACT SYNTAX 7

the premises and conclusion of the derived rule, as illustrated above.) This reading of the encoding highlights the similarities between typing derivations constructed from the inference rules and derivations of typing judgements from the formula B. However, there are also significant differences. In the derivations constructed from the encodings, the name of the variable bound by the abstraction does not appear, and in fact is irrelevant: the encoding respects the α-equivalence of terms. Also, any derivation of the sequent ⟶ typeof (abs R) (arr T U) must have a subderivation of typeof n T ⟶ typeof (R n) U. Thus the cut rule allows us to conclude that for any N such that typeof N T is derivable, typeof (R N) U is derivable. This is a non-trivial property of the type inference system for the object language. This pattern of reasoning using the cut rule will prove useful as we proceed to formally derive meta-theoretic properties of inference systems.

In this brief introduction we have seen three benefits to higher-order abstract syntax: α-equivalence of object language terms is achieved cleanly via meta-language αequivalence; capture-avoiding substitution for the object language is automatically provided by β-reduction in the meta-language; and the meta-language cut rule becomes a significant tool for meta-theoretic reasoning.

Chapter 2

The Logic F Oλ^{ΔIN}

In this chapter we introduce the logic which we call F Oλ^{ΔIN}, an acronym for “first-order logic for λ with definitions and natural numbers.” We present the logic in the first section, and then proceed in the next with some sample definitions and propositions. The chapter concludes with a discussion of related work on logics with definitions.

2.1 A Description of the Logic

The basic logic is an intuitionistic version of a subset of Church’s Simple Theory of Types [7] in which meta-level formulas will be given the type o. The logical connectives are ⊥, ⊤, ∧, ∨, ⊃, ∀_{τ}, and ∃_{τ}. The quantification types τ (and thus the types of variables) are restricted to not contain o. Thus F Oλ^{ΔIN} supports quantification over higher-order (nonpredicate) types, a crucial feature for higher-order abstract syntax, but has a first-order proof theory, since there is no quantification over predicate types. We will use sequents of the form Γ ⟶ B, where Γ is a finite multiset of formulas and B is a single formula. The basic inference rules for the logic are shown in Table 2.1. In the ∀R and ∃L rules, y is an eigenvariable that is not free in the lower sequent of the rule. The multicut (mc) rule is a generalization of cut due to Slaney [53], and is used to simplify the presentation of the cut-elimination proof of Chapter 3.

We introduce the natural numbers via the constants z : nt for zero and s : nt → nt for successor and the predicate nat : nt → o. The right and left rules for this new predicate 10 CHAPTER 2. THE LOGIC F Oλ^{ΔIN}

Table 2.1: Inference rules for the core of F Oλ^{ΔIN}

⊥, Γ ⟶ B ⊥L  Γ ⟶ ⊤ ⊤R
{B, Γ ⟶ D \atop B ∧ C, Γ ⟶ D} ∧L ^{{C, Γ ⟶ D \atop B ∧ C, Γ ⟶ D} ∧L} ^{{B[t/x], Γ ⟶ C \atop ∀x.B, Γ ⟶ C} ∀L}
\begin{matrix}Γ ⟶ B & Γ ⟶ C \\ Γ ⟶ B ∧ C \end{matrix} ∧R  {Γ ⟶ B[y/x] \atop Γ ⟶ ∀x.B} ∀R
\begin{matrix}B, Γ ⟶ D & C, Γ ⟶ D \\ B ∨ C, Γ ⟶ D \end{matrix} ∨L  ^{{B[y/x], Γ ⟶ C \atop ∃x.B, Γ ⟶ C} ∃L}
{Γ ⟶ B \atop Γ ⟶ B ∨ C} ∨R {Γ ⟶ C \atop Γ ⟶ B ∨ C} ∨R {Γ ⟶ B[t/x] \atop Γ ⟶ ∃x.B} ∃R
\begin{matrix}Γ ⟶ B & C, Γ ⟶ D \\ B ⊃ C, Γ ⟶ D \end{matrix} ⊃ L  {B, Γ ⟶ C \atop Γ ⟶ B ⊃ C} ⊃ R
A, Γ ⟶ A init, where A is atomic  ^{{B, B, Γ ⟶ C \atop B, Γ ⟶ C} cL}
\begin{aligned}Δ_{1} ⟶ B_{1} & ⋯ & Δ_{n} ⟶ B_{n} & B_{1}, …, B_{n}, Γ ⟶ C \\ & Δ_{1}, …, Δ_{n}, Γ ⟶ C \end{aligned} mc, where n ≥ 0

are

Γ ⟶ nat z natR  Γ ⟶ nat I Γ ⟶ nat (s I) natR

\begin{aligned}⟶ B z & B j ⟶ B (s j) & B I, Γ ⟶ C \\ & nat I, Γ ⟶ C \end{aligned} natL .

In the left rule, the predicate B : nt → o represents the property that is proved by induction, and j is an eigenvariable that is not free in B. The third premise of that inference rule witnesses the fact that, in general, B will express a property stronger than (⋀ Γ) ⊃ C.

A definitional clause is written ∀x̄[p t̄ =^{△} B], where p is a predicate constant, every free variable of the formula B is also free in at least one term in the list t̄ of terms, and all variables free in t̄ are contained in the list x̄ of variables. Since all free variables in p t̄ and B are universally quantified, we often leave these quantifiers implicit when displaying definitional clauses. The atomic formula p t̄is called the head of the clause, and the formula B is called the body. The symbol =^{△} is used simply to indicate a definitional clause: it is not a logical connective. A definition is a (perhaps infinite) set of definitional clauses. The same predicate may occur in the head of multiple clauses of a definition: it is best to think of a definition as a mutually recursive definition of the predicates in the heads of the clauses.

We must also restrict the use of implication in the bodies of definitional clauses; otherwise cut-elimination does not hold [49]. Toward that end we assume that each predicate symbol p in the language has associated with it a natural number lvl(p), the level of the predicate. The following definition extends the notion of level to formulas and derivations.

Definition 2.1 Given a formula B, its level lvl(B) is defined as follows:

1. lvl(p t̄) = lvl(p)

2. lvl(⊥) = lvl(⊤) = 0

3. lvl(B ∧ C) = lvl(B ∨ C) = max(lvl(B), lvl(C))

4. lvl(B ⊃ C) = max(lvl(B) + 1, lvl(C))

5. lvl(∀x.B) = lvl(∃x.B) = lvl(B).

Given a derivation Π of Γ ⟶ B, lvl(Π) = lvl(B).

12 CHAPTER 2. THE LOGIC F Oλ^{ΔIN}

We now require that for every definitional clause ∀x̄[p t̄=^{△} B], lvl(B) ≤ lvl(p t̄).

The logic has inference rules for defined atoms; the following relation will be useful for describing these rules.

Definition 2.2 Let the four-place relation dfn(ρ, A, σ, B) be defined to hold for the formulas A and B and the substitutions ρ and σ if there is a clause ∀x̄[A′ =^{△} B] in the given definition such that Aρ = A′σ.

The right and left rules for defined atoms are

{Γ ⟶ Bθ \atop Γ ⟶ A} def R, where dfn(ϵ, A, θ, B)

{\{Bσ, Γρ ⟶ Cρ | dfn(ρ, A, σ, B)\} \atop A, Γ ⟶ C} def L ,

where ϵ is the empty substitution and the bound variables x̄ in the definitional clauses are chosen to be distinct from the variables free in the lower sequent of the rule. Specifying a set of sequents as the premise should be understood to mean that each sequent in the set is a premise of the rule. The right rule corresponds to the logic programming notion of backchaining if we think of =^{△} in definitional clauses as reverse implication. The left rule is similar to definitional reflection [50] (not to be confused with another notion of reflection often considered between a meta-logic and object-logic) and to an inference rule used by Girard in his note on fixed points [17]. Notice that in the def L rule, the free variables of the conclusion can be instantiated in the premises.

The number of premises of the def L rule may be zero or infinite. If the formula A does not unify with the head of any definitional clause, then the number of premises will be zero. In this case, A is an unprovable formula logically equivalent to ⊥, and def L corresponds to the ⊥L rule. If the formula A does unify with the head of a definitional clause, the number of premises will be infinite, since the domains of the substitutions ρ and σ may include variables that are not free in A and B. Any implementation of the logic will necessarily be finitary. In practice we construct only definitions with a finite number of clauses and restrict our uses of the def L rule to those formulas A such that for every definitional clause there is a finite, complete set of unifiers (CSU) [27] of A and the head of the clause. In this case we can implement Eriksson’s rule [11]

{Bθ, Γθ ⟶ Cθ | θ ∈ CSU(A, A′) for some clause ∀x̄[A′ =^{△} B]} A, Γ ⟶ C def L_{CSU} ,

where the variables x̄ are chosen to be distinct from the variables free in the lower sequent of the rule. When the CSUs and definition are finite, this rule will have a finite number of premises.

Proposition 2.3 The rules def L and def L_{CSU} are interadmissible, i.e. if either def L or def L_{CSU} is admissible in a logic, then the other is as well.

Proof Given the set of derivations

\left\{{Π^{θ,B} \atop Bθ, Γθ ⟶ Cθ}\right\}_{θ∈CSU(A,A′) for some clause ∀x̄[A′=^{△}B]} ,

we can construct a derivation of A, Γ ⟶ C using def L as follows. For any definitional clause ∀x̄[A′ =^{△} B] and substitutions ρ and σ such that Aρ = A′σ, the substitution

ρ_{σ}(y) = \begin{cases}σ(y) & if y ∈ F V (A′) \\ ρ(y) & otherwise \end{cases}

will be a unifier of A and A′. Thus for some θ ∈ CSU(A, A′) there is a substitution θ′ such that ρ_{σ} is θ ∘ θ′. We can thus use Π^{θ,B}θ′ as the premise derivation of Bσ, Γρ ⟶ Cρ for def L. (We will formally define what it means to apply a substitution to a derivation in Definition 2.5. For now it is enough to know that it yields a derivation whose endsequent is obtained by applying the substitution to the endsequent of the original derivation.)

Given the set of derivations

\left\{{Π^{ρ,σ,B} \atop Bσ, Γρ ⟶ Cρ}\right\}_{dfn(ρ,A,σ,B)} ,

we can construct a derivation of A, Γ ⟶ C using def L_{CSU} as follows. For any definitional clause ∀x̄[A′ =^{△} B] and substitution θ ∈ CSU(A, A′), dfn(θ, A, θ, B) holds. We can thus use Π^{θ,θ,B} as the premise derivation of Bθ, Γθ ⟶ Cθ for def L.

Observe that several of the rules of F Oλ^{ΔIN} may have variables that are free in the premise but not in the conclusion: this results from the eigenvariable y of ∀R and ∃L, 14 CHAPTER 2. THE LOGIC F Oλ^{ΔIN}

the term t of ∀L and ∃R, the cut formulas B_{1}, …, B_{n} of mc, the induction predicate B of natL, and the substitutions ρ and σ of def L. We view the choice of such variables as arbitrary and identify all derivations that differ only in the choice of variables that are not free in end-sequent.

Although we will show in Chapter 3 that cut-elimination holds for this logic, we do not have the subformula property since the induction predicate B used in the natL rule is not necessarily a subformula of the conclusion of that inference rule. In fact, the following inference rule is derivable from the induction rule:

\begin{matrix}⟶ B & B, Γ ⟶ C \\ nat I, Γ ⟶ C \end{matrix} .

This inference rule resembles the cut rule except that it requires a nat assumption. Although we fail to have the subformula property, the cut-elimination theorem still provides a strong basis for reasoning about proofs in F Oλ^{ΔIN}. Also this formulation of the induction principle is natural and close to the one used in actual mathematical practice: that is, invariants must be, at times, clever inventions that are not simply rearrangements of subformulas. Any automation of F Oλ^{ΔIN} will almost certainly need to be interactive, at least for retrieving instantiations for the invariant B.

We define an ordinal measure which corresponds to the height of a derivation:

Definition 2.4 Given a derivation Π with premise derivations {Π_{i}}, the measure ht(Π) is the least upper bound of {ht(Π_{i}) + 1}.

Substitutions are finite maps from variables to terms. It is common to view substitutions as maps from terms to terms by applying the substitution to all free variables of a term. We can then extend the mapping in turn to formulas and multisets by applying it to every term in a formula and every formula in a multiset. The following definition extends substitutions yet again to apply to derivations. Since we identify derivations that differ only in the choice of variables that are not free in the end-sequent, we will assume that such variables are chosen to be distinct from the variables in the domain of the substitution and from the free variables of the range of the substitution. Thus applying a substitution to a derivation will only affect the variables free in the end-sequent.

2.1. A DESCRIPTION OF THE LOGIC 15

Definition 2.5 If Π is a derivation of Γ ⟶ C and θ is a substitution, then we define the derivation Πθ of Γθ ⟶ Cθ as follows:

1. Suppose Π ends with the def L rule

\begin{matrix}\left\{{Π^{ρ,σ,B} \atop Bσ, Γ′ρ ⟶ Cρ}\right\} & dfn(ρ,A,σ,B) \\ A, Γ′ ⟶ C \end{matrix} def L .

Observe that if dfn(ρ′, Aθ, σ′, B) then dfn(θ ∘ ρ′, A, σ′, B). Thus Πθ is

\begin{matrix}\left\{{Π^{θ∘ρ′,σ′,B} \atop Bσ′, Γ′θρ′ ⟶ Cθρ′}\right\} & dfn(ρ′,Aθ,σ′,B) \\ Aθ, Γ′θ ⟶ Cθ \end{matrix} def L .

2. If Π ends with any other rule and has premise derivations Π_{1}, …, Π_{n}, then Πθ also ends with the same rule and has premise derivations Π_{1}θ, …, Π_{n}θ.

Lemma 2.6 For any substitution θ and derivation Π of Γ ⟶ C, Πθ is a derivation of Γθ ⟶ Cθ.

Proof This lemma states that Definition 2.5 is well-constructed, and follows by induction on μ(Π). Observe that if Π ends with the def R rule

{Π′ \atop Γ ⟶ Bσ} ; Γ ⟶ A def R ,

then dfn(ϵ, A, σ, B), and so it is also true that dfn(ϵ, Aθ, σ ∘ θ, B). Therefore

{Π′θ \atop Γθ ⟶ Bσθ} ; Γθ ⟶ Aθ def R

is a valid derivation.

Lemma 2.7 For any derivation Π and substitution θ, ht(Π) ≥ ht(Πθ).

Proof The proof of this lemma is a simple induction on ht(Π). The measures may not be equal because when the derivations end with the def L rule, some of the premise derivations of Π may not be needed to construct the premise derivations of Πθ.

16 CHAPTER 2. THE LOGIC F Oλ^{ΔIN}

Our logic does not contain a weakening rule; instead we allow extra assumptions in the axioms. The following definition provides meta-level weakening on derivations. Since we identify derivations that differ only in the choice of variables that are not free in the end-sequent, we will assume that such variables are chosen to be distinct from the free variables of the weakening formulas.

Definition 2.8 If Π is a derivation of Γ ⟶ C and Δ is a multiset of formulas, then we define the derivation w(Δ, Π) of Γ, Δ ⟶ C as follows:

1. If Π ends with the def L rule

\begin{matrix}\{ & {Π^{ρ,σ,B} \atop Bσ, Γ′ρ ⟶ Cρ} & \} \\ A, Γ′ ⟶ C \end{matrix} def L ,

then w(Δ, Π) is

\begin{matrix}\{ & {w(Δρ, Π^{ρ,σ,B}) \atop Bσ, Γ′ρ, Δρ ⟶ Cρ} & \} \\ A, Γ′, Δ ⟶ C \end{matrix} def L .

2. If Π ends with the natL rule

{Π_{1} \atop ⟶ B z} {Π_{2} \atop B j ⟶ B (s j)} {Π_{3} \atop B I, Γ ⟶ C} nat I, Γ ⟶ C natL ,

then w(Δ, Π) is

{Π_{1} \atop ⟶ B z} {Π_{2} \atop B j ⟶ B (s j)} {w(Δ, Π_{3}) \atop B I, Γ, Δ ⟶ C} nat I, Γ, Δ ⟶ C natL .

3. If Π ends with the mc rule

{Π_{1} \atop Δ_{1} ⟶ B_{1}} ⋯ {Π_{n} \atop Δ_{n} ⟶ B_{n}} {Π′ \atop B_{1}, …, B_{n}, Γ ⟶ C} Δ_{1}, …, Δ_{n}, Γ ⟶ C mc ,

then w(Δ, Π) is

{Π_{1} \atop Δ_{1} ⟶ B_{1}} ⋯ {Π_{n} \atop Δ_{n} ⟶ B_{n}} {w(Δ, Π′) \atop B_{1}, …, B_{n}, Γ, Δ ⟶ C} Δ_{1}, …, Δ_{n}, Γ, Δ ⟶ C mc .

2.1. A DESCRIPTION OF THE LOGIC 17

4. If Π ends with any other rule and has premise derivations Π_{1}, …, Π_{n}, then w(Δ, Π) also ends with the same rule and has premise derivations w(Δ, Π_{1}), …, w(Δ, Π_{n}).

Lemma 2.9 For any multiset Δ of formulas and derivation Π of Γ ⟶ C, w(Δ, Π) is a derivation of Γ, Δ ⟶ C.

Proof This lemma states that Definition 2.8 is well-constructed, and follows by a simple induction on μ(Π).

Lemma 2.10 For any derivation Π and multiset Δ of formulas,

ht(Π) = ht(w(Δ, Π)) .

Proof The proof of this lemma goes by induction on μ(Π). All cases follow immediately from the induction hypothesis.

Lemma 2.11 For any derivation Π, multiset Δ of formulas, and substitution θ, w(Δ, Π)θ and w(Δθ, Πθ) are the same derivation.

Proof We prove this lemma by induction on ht(Π). The only case that is not straightforward is the one in which Π ends with def L:

If Π is

\begin{matrix}\{ & {Π^{ρ,σ,B} \atop Bσ, Γρ ⟶ Cρ} & \} \\ A, Γ ⟶ C \end{matrix} def L ,

then w(Δ, Π) is

\left\{{w(Δρ, Π^{ρ,σ,B}) \atop Bσ, Γρ, Δρ ⟶ Cρ}\right\}_{dfn(ρ,A,σ,B)}

A, Γ, Δ ⟶ C def L

and w(Δ, Π)θ is

\left\{{w(Δθρ′, Π^{θ∘ρ′,σ′,B}) \atop Bσ′, Γθρ′, Δθρ′ ⟶ Cθρ′}\right\}_{dfn(ρ′,Aθ,σ′,B)} Aθ, Γθ, Δθ ⟶ Cθ def L .

On the other hand, Πθ is

\begin{matrix}\left\{{Π^{θ∘ρ′′,σ′′,B} \atop Bσ′′, Γθρ′′ ⟶ Cθρ′′}\right\} & dfn(ρ′′,Aθ,σ′′,B) \\ Aθ, Γθ ⟶ Cθ \end{matrix} def L

18 CHAPTER 2. THE LOGIC F Oλ^{ΔIN}

and w(Δθ, Πθ) is

\left\{{w(Δθρ′′, Π^{θ∘ρ′′,σ′′,B}) \atop Bσ′′, Γθρ′′, Δθρ′′ ⟶ Cθρ′′}\right\}_{dfn(ρ′′,Aθ,σ′′,B)} Aθ, Γθ, Δθ ⟶ Cθ def L .

Both w(Δ, Π)θ and w(Δθ, Πθ) have a premise derivation for each combination of formula B and substitutions ρ and σ such that dfn(ρ, Aθ, σ, B), and in both cases that premise will be w(Δθρ, Π^{θ∘ρ,σ,B}). Thus these two derivations are the same.

Lemma 2.12 For any derivation Π and multisets Δ and Δ′ of formulas,

w(Δ, w(Δ′, Π)) and w(Δ ∪ Δ′, Π)

are the same derivation.

Proof The proof of this lemma goes by induction on μ(Π). All cases follow immediately from the induction hypothesis.

2.2 Some Simple Definitions and Propositions

In this section we illustrate the use of the logic F Oλ^{ΔIN} with some examples. We first define some predicates over the natural numbers and reason about them. Then we introduce a list type and consider predicates for it. As we prove properties about these types and predicates, we will interleave informal descriptions of the proofs with their realization as derivations in F Oλ^{ΔIN}. The formal derivations are by nature detailed and low-level, breaking down proof principles into small pieces. As a result, what can seem obvious or be described informally in a small number of words may take a number of steps to accomplish in the formal derivation. But it is exactly this nature that makes formal derivations amenable to automation; tools such as proof editors and theorem provers can make the construction of formal derivations more natural as well as more robust.

We will describe derivations in a “bottom-up” manner – that is, we will start with the sequent we wish to derive, apply a rule with that sequent as the conclusion, and continue in this manner with the rule premises. Thus unproved premises represent statements of Table 2.2: Definitional clauses for predicates over natural numbers

I = I =^{△} ⊤  sum z J J =^{△} nat J
sum (s I) J (s K) =^{△} sum I J K
z < (s J) =^{△} nat J  I ≤ I =^{△} ⊤
(s I) < (s J) =^{△} I < J  I ≤ J =^{△} I < J

what remains to be proved to establish the original sequent. Since the formal (F Oλ^{ΔIN}) derivation is presented in pieces, intermixed with descriptive text, pieces that occur later in the text will generally be (partial) derivations of unproved premises from earlier pieces.

2.2.1 Natural Numbers

As described in Section 2.1, F Oλ^{ΔIN} includes a type nt encoding natural numbers and a membership predicate nat. We now introduce predicates representing equality, the lessthan relation, the less-than-or-equal-to relation, and the addition function. The types for these predicates are as follows:

= : nt → nt → o  sum : nt → nt → nt → o < : nt → nt → o  ≤ : nt → nt → o .

The definitional clauses for these predicates are shown in Table 2.2; we shall refer to this set of clauses as D(nat). We define two numbers to be equal if they are unifiable. The clauses for sum indicate that the sum of zero and any other number J is J, and the sum of (s I) and J is the successor of the sum of I and J. Zero is less than the successor of any number, and (s I) is less than (s J) whenever I is less than J. Finally, I ≤ J if I is equal to J or if I is less than J.

We now proceed to reason in the logic F Oλ^{ΔIN} about natural numbers and these predicates over them. As our first example, we derive a case analysis rule for natural numbers. In general the def L rule is used to formalize case analysis, but the predicate nat is not a defined predicate, and so the def L rule does not apply in the case of natural numbers.

20 CHAPTER 2. THE LOGIC F Oλ^{ΔIN}

However, a case analysis may be viewed as an induction in which we do not use the induction hypothesis in the induction step. Thus we can derive a case analysis rule for natural numbers from the induction (natL) rule.

Proposition 2.13 For any formula C : o, predicate B : nt → o, term I : nt, multiset Γ of formulas, and eigenvariable i : nt such that i is not free in B, the following rule is derivable in F Oλ^{ΔIN}:

⟶ B z nat i ⟶ B (s i) B I, Γ ⟶ C nat I, Γ ⟶ C .

Proof This rule expresses the following idea: we want to show that C follows from Γ and the fact that I is a natural number. Since I is a natural number, it must be either zero or the successor of another natural number. Thus if we can show that B holds for zero and for the successor of any natural number (the first two premises), then we know that B holds for I. It then remains to show that C follows from B I and Γ (the third premise).

To derive this rule, we assume that we have derivations of the premises and proceed to prove the conclusion. That is, we construct in F Oλ^{ΔIN} a partial derivation of the sequent nat I, Γ ⟶ C, leaving unproved premises of the form ⟶ B z, nat i ⟶ B (s i), and B I, Γ ⟶ C. This corresponds to working under the assumption that B holds both for zero and for the successor of any number and that B I and Γ imply C. We proceed by induction on I, using (λi.nat i ∧ B i) as our induction predicate. As a result, we must establish three things:

1. the base case: zero is a natural number and B holds for it;

2. the induction step: if i is a natural number and B holds for it, then the same is true for (s i);

3. the relevance of the induction predicate: if I is a natural number and B holds for it, then Γ implies C.

This staging of the problem is representing in F Oλ^{ΔIN} by applying the natL rule:

⟶ nat z ∧ B z nat i ∧ B i ⟶ nat (s i) ∧ B (s i) nat I ∧ B I, Γ ⟶ C nat I, Γ ⟶ C natL .

2.2. SOME SIMPLE DEFINITIONS AND PROPOSITIONS 21

The three premises to the natL rule correspond to the three proof obligations enumerated above.

Let us first consider the relevance of the induction predicate. This is clear, since we are working under the assumption that C follows from B I and Γ. This is formally represented by the partial derivation

{B I, Γ ⟶ C \atop nat I ∧ B I, Γ ⟶ C} ∧L .

The base case is also simple: zero is obviously a natural number, and we are working under the assumption that B holds for zero. This is expressed in F Oλ^{ΔIN} by the partial derivation

⟶ nat z natR ⟶ B z ⟶ nat z ∧ B z ∧R .

It remains to prove the induction step. Since i is a natural number, (s i) is as well. In addition, B holds for (s i) by our working assumption. The formal representation of this reasoning is

nat i ⟶ nat i init nat i ⟶ nat (s i) natR nat i ⟶ B (s i) nat i ⟶ nat (s i) ∧ B (s i) ∧R nat i ∧ B i ⟶ nat (s i) ∧ B (s i) ∧L .

We now use this derived case analysis rule to prove that zero is the smallest natural number.

Proposition 2.14 The formula ∀i(nat i ⊃ z ≤ i) is derivable in F Oλ^{ΔIN} using the definition D(nat).

Proof The proof is a simple case analysis on i. To represent this in F Oλ^{ΔIN}, we apply the ∀R and ⊃ R rules to get

nat i ⟶ z ≤ i ,

and then use the derived rule of Proposition 2.13, which yields the three sequents

⟶ z ≤ z  nat i′ ⟶ z ≤ (s i′)  z ≤ i ⟶ z ≤ i .

In this case, the third premise is immediate:

z ≤ i ⟶ z ≤ i init .

22 CHAPTER 2. THE LOGIC F Oλ^{ΔIN}

If i is zero, then it is immediate that zero is equal to itself and thus less than or equal to itself:

\begin{matrix}⟶ ⊤ & ⊤R \\ ⟶ z ≤ z \end{matrix} ; def R .

If i is the successor of some number i′, then z < (s i′) by definition, and so z ≤ (s i′) also by definition. This is represented formally by the derivation

nat i′ ⟶ nat i′ init nat i′ ⟶ z < (s i′) def R nat i′ ⟶ z ≤ (s i′) def R .

We will now prove a more complicated property, namely that if I is less than (s J), then I ≤ J.

Proposition 2.15 The formula

∀i(nat i ⊃ ∀j(i < (s j) ⊃ i ≤ j))

is derivable in F Oλ^{ΔIN} using the definition D(nat).

Proof To prove this we prove the stronger assertion that for any k greater than i, k is the successor of a number greater than or equal to i, i.e.

∀k(i < k ⊃ ∃k′(k = (s k′) ∧ i ≤ k′)) .

We will prove this by induction on i, so we must prove

1. the base case: the induction predicate holds for zero;

2. the induction step: if the induction predicate is true of i′, then it is true of (s i′);

3. the relevance of the induction predicate: the induction predicate applied to i implies the original proposition.

This staging of the problem is represented in F Oλ^{ΔIN} by applying the ∀R and ⊃ R rules to obtain the sequent

nat i ⟶ ∀j(i < (s j) ⊃ i ≤ j)

and then the natL rule to get the three sequents

⟶ ∀k(z < k ⊃ ∃k′(k = (s k′) ∧ z ≤ k′))

2.2. SOME SIMPLE DEFINITIONS AND PROPOSITIONS 23

∀k(i′ < k ⊃ ∃k′(k = (s k′) ∧ i′ ≤ k′)) ⟶ ∀k((s i′) < k ⊃ ∃k′(k = (s k′) ∧ (s i′) ≤ k′))

∀k(i < k ⊃ ∃k′(k = (s k′) ∧ i ≤ k′)) ⟶ ∀j(i < (s j) ⊃ i ≤ j) .

First consider the relevance of the induction predicate. By assumption (s j) is greater than i, so our induction predicate implies that (s j) is the successor of a number greater than or equal to i. This is represented in F Oλ^{ΔIN} by the partial derivation

i < (s j) ⟶ i < (s j) init ∃k′((s j) = (s k′) ∧ i ≤ k′), i < (s j) ⟶ i ≤ j i < (s j) ⊃ ∃k′((s j) = (s k′) ∧ i ≤ k′), i < (s j) ⟶ i ≤ j ⊃ L ∀k(i < k ⊃ ∃k′(k = (s k′) ∧ i ≤ k′)), i < (s j) ⟶ i ≤ j ∀L ∀k(i < k ⊃ ∃k′(k = (s k′) ∧ i ≤ k′)) ⟶ i < (s j) ⊃ i ≤ j ⊃ R ∀k(i < k ⊃ ∃k′(k = (s k′) ∧ i ≤ k′)) ⟶ ∀j(i < (s j) ⊃ i ≤ j) ∀R .

Of course, (s j) is only the successor of j, so j must be greater than or equal to i:

⊤, i ≤ j, i < (s j) ⟶ i ≤ j init (s j) = (s k′), i ≤ k′, i < (s j) ⟶ i ≤ j def L (s j) = (s k′), (s j) = (s k′) ∧ i ≤ k′, i < (s j) ⟶ i ≤ j ∧L (s j) = (s k′) ∧ i ≤ k′, (s j) = (s k′) ∧ i ≤ k′, i < (s j) ⟶ i ≤ j ∧L (s j) = (s k′) ∧ i ≤ k′, i < (s j) ⟶ i ≤ j cL ∃k′((s j) = (s k′) ∧ i ≤ k′), i < (s j) ⟶ i ≤ j ∃L .

To prove the base case of the induction, we must realize that if k is greater than zero, it must be of the form (s k_{0}) for some number k_{0}. This realization is accomplished formally as follows:

nat k_{0} ⟶ ∃k′((s k_{0}) = (s k′) ∧ z ≤ k′) z < k ⟶ ∃k′(k = (s k′) ∧ z ≤ k′) def L ⟶ z < k ⊃ ∃k′(k = (s k′) ∧ z ≤ k′) ⊃ R ⟶ ∀k(z < k ⊃ ∃k′(k = (s k′) ∧ z ≤ k′)) ∀R .

It is now clear that k′ should be k_{0} and it only remains to prove that k_{0} is greater than or equal to zero:

nat k_{0} ⟶ ⊤ ⊤R nat k_{0} ⟶ (s k_{0}) = (s k_{0}) def R nat k_{0} ⟶ z ≤ k_{0} nat k_{0} ⟶ (s k_{0}) = (s k_{0}) ∧ z ≤ k_{0} ∧R nat k_{0} ⟶ ∃k′((s k_{0}) = (s k′) ∧ z ≤ k′) ∃R .

But any natural number is greater than or equal to zero, as was shown formally above in Proposition 2.14.

24 CHAPTER 2. THE LOGIC F Oλ^{ΔIN}

It now remains to prove the induction step, represented in F Oλ^{ΔIN} by the second premise of the def L rule:

∀k(i < k ⊃ ∃k′(k = (s k′) ∧ i ≤ k′)) ⟶ ∀k((s i) < k ⊃ ∃k′(k = (s k′) ∧ (s i) ≤ k′)) .

Since (s i) < k, by definition k must be of the form (s k_{0}) for some k_{0} such that i < k_{0}:

∀k(i < k ⊃ ∃k′(k = (s k′) ∧ i ≤ k′)), i < k_{0} ⟶ ∃k′((s k_{0}) = (s k′) ∧ (s i) ≤ k′) ∀k(i < k ⊃ ∃k′(k = (s k′) ∧ i ≤ k′)), (s i) < k ⟶ ∃k′(k = (s k′) ∧ (s i) ≤ k′) def L ∀k(i < k ⊃ ∃k′(k = (s k′) ∧ i ≤ k′)) ⟶ (s i) < k ⊃ ∃k′(k = (s k′) ∧ (s i) ≤ k′) ⊃ R ∀k(i < k ⊃ ∃k′(k = (s k′) ∧ i ≤ k′)) ⟶ ∀k((s i) < k ⊃ ∃k′(k = (s k′) ∧ (s i) ≤ k′)) ∀R .

It is now clear that k′ should be k_{0}, so we proceed as in the base case:

\begin{matrix}∀k …, i < k_{0} ⟶ ⊤ & ⊤R \\ ∀k …, i < k_{0} ⟶ (s k_{0}) = (s k_{0}) \end{matrix} def R ∀k …, i < k_{0} ⟶ (s i) ≤ k_{0} ∀k(i < k ⊃ ∃k′(k = (s k′) ∧ i ≤ k′)), i < k_{0} ⟶ (s k_{0}) = (s k_{0}) ∧ (s i) ≤ k_{0} ∧R ∀k(i < k ⊃ ∃k′(k = (s k′) ∧ i ≤ k′)), i < k_{0} ⟶ ∃k′((s k_{0}) = (s k′) ∧ (s i) ≤ k′) ∃R .

Since i < k_{0}, by the induction hypothesis k_{0} is the successor of a number k′_{0} that is greater than or equal to i:

i < k_{0} ⟶ i < k_{0} init {⊤, i ≤ k′_{0}, i < (s k′_{0}) ⟶ (s i) ≤ (s k′_{0}) \atop k_{0} = (s k′_{0}), i ≤ k′_{0}, i < k_{0} ⟶ (s i) ≤ k_{0}} def L ∧L … ∧ …, … ∧ …, i < k_{0} ⟶ (s i) ≤ k_{0} k_{0} = (s k′_{0}) ∧ i ≤ k′_{0}, i < k_{0} ⟶ (s i) ≤ k_{0} cL ∃k′(k_{0} = (s k′) ∧ i ≤ k′), i < k_{0} ⟶ (s i) ≤ k_{0} ∃L i < k_{0} ⊃ ∃k′(k_{0} = (s k′) ∧ i ≤ k′), i < k_{0} ⟶ (s i) ≤ k_{0} ⊃ L ∀k(i < k ⊃ ∃k′(k = (s k′) ∧ i ≤ k′)), i < k_{0} ⟶ (s i) ≤ k_{0} ∀L .

Since i ≤ k′_{0}, either i = k′_{0} or i < k′_{0}. If i = k′_{0}, then (s i) = (s k′_{0}). If i < k′_{0}, then (s i) < (s k′_{0}). In either case, (s i) ≤ (s k′_{0}) by definition. This reasoning is represented formally by the derivation

\begin{matrix}⊤, ⊤, i < (s i) ⟶ ⊤ & ⊤R \\ ⊤, ⊤, i < (s i) ⟶ (s i) ≤ (s i) \end{matrix} def R ⊤, i < k′_{0}, i < (s k′_{0}) ⟶ i < k′_{0} init ⊤, i < k′_{0}, i < (s k′_{0}) ⟶ (s i) < (s k′_{0})def R ⊤, i < k′_{0}, i < (s k′_{0}) ⟶ (s i) ≤ (s k′_{0}) def R ⊤, i ≤ k′_{0}, i < (s k′_{0}) ⟶ (s i) ≤ (s k′_{0}) def L .

As a final example for the predicates over natural numbers, we will derive a rule for complete induction.

Proposition 2.16 For any formula C : o, predicate B : nt → o, term I : nt, and multiset Γ of formulas, the following rule is derivable in F Oλ^{ΔIN} using the definition D(nat):

nat j, ∀k(nat k ⊃ k < j ⊃ B k) ⟶ B j B I, Γ ⟶ C nat I, Γ ⟶ C .

Proof To derive this rule, we construct a partial derivation of the sequent nat I, Γ ⟶ C, leaving unproved premises of the form nat j, ∀k(nat k ⊃ k < j ⊃ B k) ⟶ B j and B I, Γ ⟶ C. This corresponds to proving that C follows from Γ and the fact that I is a natural number under the assumptions

• for any natural number j, if B holds for all numbers less than k, then B holds for j; and

• B I and Γ imply C.

The idea behind the proof is as follows. We want to show that the first working assumption is sufficient to imply that B I holds, and thus (by the second working assumption) that C holds. We do this by induction on I, of course, but instead of using B itself for the induction predicate, we use (λi.nat i ∧ ∀k(nat k ⊃ k < i ⊃ B k)). If this is true of I, then we can combine it with the first working assumption to infer that B I holds. This is all represented formally as follows. We proceed to derive the sequent nat I, Γ ⟶ C by induction on I (via the natL rule), using (λi.nat i ∧ ∀k(nat k ⊃ k < i ⊃ B k)) as the induction predicate. This yields the three sequents

⟶ nat z ∧ ∀k(nat k ⊃ k < z ⊃ B k)

nat j ∧ ∀k(nat k ⊃ k < j ⊃ B k) ⟶ nat (s j) ∧ ∀k(nat k ⊃ k < (s j) ⊃ B k)
nat I ∧ ∀k(nat k ⊃ k < I ⊃ B k), Γ ⟶ C .

The third premise of the natL rule indicates that the induction predicate applied to I implies the conclusion. As described above, this follows from the two premises of the complete induction rule we are deriving. The formalization of this is a cut between the partial derivation

nat I, ∀k(nat k ⊃ k < I ⊃ B k) ⟶ B I

nat I, nat I ∧ ∀k(nat k ⊃ k < I ⊃ B k) ⟶ B I ∧L

nat I ∧ ∀k(nat k ⊃ k < I ⊃ B k), nat I ∧ ∀k(nat k ⊃ k < I ⊃ B k) ⟶ B I ∧L

nat I ∧ ∀k(nat k ⊃ k < I ⊃ B k) ⟶ B I cL

26 CHAPTER 2. THE LOGIC F Oλ^{ΔIN}

and the second premise of the rule we are deriving.

The base case of the induction is represented by the first premise of the natL rule

⟶ nat z ∧ ∀k(nat k ⊃ k < z ⊃ B k) .

The first part, that zero is a natural number, is obvious, and the second part holds vacuously, since there are no natural numbers less than zero. The formal representation of this case is the derivation

⟶ nat z natR nat k, k < z ⟶ B k def L nat k ⟶ k < z ⊃ B k ⊃ R ⟶ nat k ⊃ k < z ⊃ B k ⊃ R ⟶ ∀k(nat k ⊃ k < z ⊃ B k) ∀R ⟶ nat z ∧ ∀k(nat k ⊃ k < z ⊃ B k) ∧R .

It remains to derive the second premise to the natL rule,

nat j ∧ ∀k(nat k ⊃ k < j ⊃ B k) ⟶ nat (s j) ∧ ∀k(nat k ⊃ k < (s j) ⊃ B k) ,

which corresponds to the induction step. Thus given that j is a natural number and that B holds for all numbers less than j, we must show that the same are true for (s j). Formally, we apply the ∧R rule to obtain the two sequents

nat j ∧ ∀k(nat k ⊃ k < j ⊃ B k) ⟶ nat (s j)
nat j ∧ ∀k(nat k ⊃ k < j ⊃ B k) ⟶ ∀k(nat k ⊃ k < (s j) ⊃ B k) .

The first of these, that (s j) is a natural number, follows immediately from the assumption that j is a natural number:

nat j ⟶ nat j init nat j ⟶ nat (s j) def R nat j ∧ ∀k(nat k ⊃ k < j ⊃ B k) ⟶ nat (s j) ∧L .

To derive the second sequent, we must show that B k holds for all numbers k < (s j). To do this, we first deduce k ≤ j from k < (s j):

nat k, k < (s j) ⟶ k ≤ j ∀k(nat k ⊃ k < j ⊃ B k), nat k, k ≤ j ⟶ B k ∀k(nat k ⊃ k < j ⊃ B k), nat k, nat k, k < (s j) ⟶ B k mc ∀k(nat k ⊃ k < j ⊃ B k), nat k, k < (s j) ⟶ B k cL ∀k(nat k ⊃ k < j ⊃ B k), nat k ⟶ k < (s j) ⊃ B k ⊃ R ∀k(nat k ⊃ k < j ⊃ B k) ⟶ nat k ⊃ k < (s j) ⊃ B k ⊃ R ∀k(nat k ⊃ k < j ⊃ B k) ⟶ ∀k(nat k ⊃ k < (s j) ⊃ B k) ∀R nat j ∧ ∀k(nat k ⊃ k < j ⊃ B k) ⟶ ∀k(nat k ⊃ k < (s j) ⊃ B k) ∧L .

The first premise to the multicut rule is derivable according to Proposition 2.15, so we proceed with the second. Since k ≤ j, either k = j or k < j, and we consider these cases separately. We accomplish this formally by applying the def L rule to k ≤ j, yielding the two sequents

∀k(nat k ⊃ k < j ⊃ B k), nat j, ⊤ ⟶ B j
∀k(nat k ⊃ k < j ⊃ B k), nat k, k < j ⟶ B k .

The first sequent above, corresponding to the case when k = j, is a weakening of the first premise of the induction rule we are deriving. We do not have an explicit weakening rule in F Oλ^{ΔIN}, but it suffices here to use the cut rule:

nat j, ⊤ ⟶ nat j init ∀k(nat k ⊃ k < j ⊃ B k), nat j ⟶ B j ∀k(nat k ⊃ k < j ⊃ B k), nat j, ⊤ ⟶ B j mc .

When k < j, B k follows from the induction hypothesis. This is formalized as

nat k, k < j ⟶ nat k init nat k, k < j ⟶ k < j init B k, nat k, k < j ⟶ B k k < j ⊃ B k, nat k, k < j ⟶ B k ⊃ L nat k ⊃ k < j ⊃ B k, nat k, k < j ⟶ B k ⊃ L ∀k(nat k ⊃ k < j ⊃ B k), nat k, k < j ⟶ B k ∀L .

The premise B k, … ⟶ B k is derivable for any predicate B, since the consequent B k follows from the antecedent B k.

The following proposition presents additional properties of natural numbers that we have derived in F Oλ^{ΔIN}, although we do not show the derivations here.

Proposition 2.17 The following formulas are derivable in F Oλ^{ΔIN} using the definition D(nat):

∀i(nat (s i) ⊃ nat i)

28 CHAPTER 2. THE LOGIC F Oλ^{ΔIN}

∀i(nat i ⊃ ∀j(i < j ⊃ nat j))
∀i(nat i ⊃ i < (s i))
∀i(nat i ⊃ ∀j∀k(i < j ⊃ j < k ⊃ i < k))
∀i(nat i ⊃ ∀j(nat j ⊃ ∃k(nat k ∧ i < k ∧ j < k)))
∀i(nat i ⊃ ∀j∀k(sum i (s j) k ⊃ sum (s i) j k))
∀i(nat i ⊃ ∀j(nat j ⊃ ∃k(nat k ∧ sum i j k)))
∀i(nat i ⊃ ∀j∀k(nat j ⊃ sum i j k ⊃ i ≤ k))
∀i(nat i ⊃ ∀j∀k(nat j ⊃ sum (s i) j k ⊃ j < k)) .

2.2.2 Lists

In this section we introduce a type lst for lists over an arbitrary but fixed type τ. The type has two constructors, nil : lst representing the empty list and the infix operator :: of type τ → lst → lst that adds an element to the front of a list. Consider the list predicates

length : lst → nt → o  split : lst → lst → lst → o list : lst → o  permute : lst → lst → o element : τ → lst → o ,

whose definitional clauses are shown in Table 2.3; we shall refer to this set of clauses as D(list(τ)). The predicate length represents the function that returns the length of its list argument. The length of the empty list is zero, and the length of (X :: L) is one more than the length of L. The predicate list indicates that its argument has a finite (natural number) length. We shall find this predicate useful for constructing induction principles over lists. The predicate element indicates that its first argument is a member of its second argument. X is an element of (Y :: L) if X and Y are the same or if X is an element of L. The predicate split holds if its first argument represents a merging of the second and third in which the order of elements in second and third lists is preserved in the first. The empty list can only be split into two empty lists. To split (X::L), we split L and add X to the front of either of the resulting lists. The predicate permute holds if its two arguments Table 2.3: Definitional clauses for predicates over lists

length nil z =^{△} ⊤
length (X::L) (s I) =^{△} length L I
list L =^{△} ∃i(nat i ∧ length L i)
element X (X::L) =^{△} ⊤
element X (Y ::L) =^{△} element X L
split nil nil nil =^{△} ⊤
split (X::L_{1}) (X::L_{2}) L_{3} =^{△} split L_{1} L_{2} L_{3}
split (X::L_{1}) L_{2} (X::L_{3}) =^{△} split L_{1} L_{2} L_{3}
permute nil nil =^{△} ⊤
permute (X::L_{1}) L_{2} =^{△} ∃l_{22}(split L_{2} (X::nil) l_{22} ∧ permute L_{1} l_{22} )

contain the same elements (including repetitions), though not necessarily in the same order. The empty list only permutes to itself. A list (X::L_{1}) permutes to L_{2} if removing X from L_{2} yields a permutation of L_{1}.

We now derive an induction rule for lists from the induction rule for natural numbers (natL) using the length of a list as our measure.

Proposition 2.18 For any formula C : o, predicate B : lst → o, term L : lst, multiset Γ of formulas, and eigenvariable l : lst such that l is not free in B, the following rule is derivable in F Oλ^{ΔIN} using the definition D(list(τ)):

⟶ B nil B l ⟶ B (x::l) B L, Γ ⟶ C list L, Γ ⟶ C .

Proof To derive this rule, we construct a partial derivation of the sequent list L, Γ ⟶ C, leaving unproved premises of the form ⟶ B nil, B l ⟶ B (x::l), and B L, Γ ⟶ C. This corresponds to proving that C follows from Γ and the fact that L is a list under the assumptions

• B holds for nil; 30 CHAPTER 2. THE LOGIC F Oλ^{ΔIN}

• for any x′ and l′, if B holds for l′, then it also holds for (x′::l′);

• B L and Γ imply C.

The proof is by induction on the length of the list L. Since list L holds, by definition L has a length which is a natural number:

nat i, length L i, Γ ⟶ C nat i, nat i ∧ length L i, Γ ⟶ C ∧L nat i ∧ length L i, nat i ∧ length L i, Γ ⟶ C ∧L nat i ∧ length L i, Γ ⟶ C cL ∃i(nat i ∧ length L i), Γ ⟶ C ∃L list L, Γ ⟶ C def L .

We now claim that B holds for lists of any length, and wish to prove this claim by induction on the length of the list. Thus we must prove

1. the base case: B holds for lists of length zero;

2. the induction step: if B holds for lists of length i′, it holds for lists of length (s i′);

3. the relevance of the claim: C follows from Γ, the fact that L has length i, and the fact that B holds for lists of length i.

This is represented in F Oλ^{ΔIN} by applying the natL rule with the induction predicate λi.∀l(length l i ⊃ B l), which yields the three sequents

⟶ ∀l(length l z ⊃ B l)
∀l(length l i′ ⊃ B l) ⟶ ∀l(length l (s i′) ⊃ B l)
∀l(length l i ⊃ B l), length L i, Γ ⟶ C .

Once we have proved that B holds for lists of length i, then we know it holds for L. Thus we know that C follows from Γ, since our third working assumption says that C follows from B L and Γ. This is represented formally by the partial derivation of the third premise of the natL rule:

length L i, Γ ⟶ length L i init B L, length L i, Γ ⟶ C length L i ⊃ B L, length L i, Γ ⟶ C ⊃ L ∀l(length l i ⊃ B l), length L i, Γ ⟶ C ∀L .

2.2. SOME SIMPLE DEFINITIONS AND PROPOSITIONS 31

The unproved premise of this partial derivation is actually a weakening of the third premise of the induction rule we are deriving. We do not have an explicit weakening rule in F Oλ^{ΔIN}, but it suffices here to use the cut rule:

B L, length L i ⟶ B L B L, Γ ⟶ C B L, length L i, Γ ⟶ C mc .

The first premise of the cut rule is derivable for any B and L, since the consequent B L also occurs as an antecedent. The second premise is the desired premise of the rule we are deriving.

In the base case of the induction, we must show that B holds for lists of length zero. Since the only list of length zero is nil, this follows from the first working assumption, which says that B nil holds. This case is formalized in the following partial derivation of the first premise of the natL rule:

⊤ ⟶ B nil length l z ⟶ B l def L ⟶ length l z ⊃ B l ⊃ R ⟶ ∀l(length l z ⊃ B l) ∀R .

The induction step requires us to prove that B holds for all lists of length (s i′), given that it holds for all lists of length i′. Since a list of length (s i′) is constructed by adding an element to the front of a list of length i′, this step follows from the second working assumption, which says that if B holds for a list l, then for any x : τ, B holds for x:: l. This reasoning represented in the partial derivation of the second premise of the natL rule:

length l′ i′ ⟶ length l′ i′ init B l′, length l′ i′ ⟶ B (x′::l′) length l′ i′ ⊃ B l′, length l′ i′ ⟶ B (x′::l′) ⊃ L ∀l(length l i′ ⊃ B l), length l′ i′ ⟶ B (x′::l′) ∀L ∀l(length l i′ ⊃ B l), length l (s i′) ⟶ B l def L ∀l(length l i′ ⊃ B l) ⟶ length l (s i′) ⊃ B l ⊃ R ∀l(length l i′ ⊃ B l) ⟶ ∀l(length l (s i′) ⊃ B l) ∀R .

The unproved premise of this partial derivation is a weakening of the second premise of the induction rule we are deriving. We can achieve this weakening using the cut rule in the same manner as we did for the third premise:

B l′, length l′ i′ ⟶ B l′ B l′ ⟶ B (x′::l′) B l′, length l′ i′ ⟶ B (x′::l′) mc .

32 CHAPTER 2. THE LOGIC F Oλ^{ΔIN}

We will now use this derived induction rule for lists to prove a very simple property, namely that we can split any list L into nil and L.

Proposition 2.19 The formula ∀l(list l ⊃ split l nil l) is derivable in F Oλ^{ΔIN} using the definition D(list(τ)).

Proof We prove this by induction on l; using the right rules for ∀ and ⊃ and the derived rule of Proposition 2.18 with the induction predicate (λl.split l nil l), we get the three sequents

⟶ split nil nil nil

split l′ nil l′ ⟶ split (x′::l′) nil (x′::l′)

split l nil l ⟶ split l nil l .

Since the induction predicate applied to l is the same as the consequent, the relevance of the induction predicate is immediate. Thus the third sequent follows from the init rule.

The base case follows immediately from the definition of split, and so the first sequent is derivable using the def R and ⊤R rules.

The induction step also follows easily from the definition of split:

split l′ nil l′ ⟶ split l′ nil l′ init split l′ nil l′ ⟶ split (x′::l′) nil (x′::l′) def R .

Next we prove that any list is a permutation of itself.

Proposition 2.20 The formula ∀l(list l ⊃ permute l l ) is derivable in F Oλ^{ΔIN} using the definition D(list(τ)).

Proof We prove this by induction on l; applying the ∀R and ⊃ R rules and the derived rule of Proposition 2.18 with the induction predicate (λl.list l ∧ permute l l ) yields the three sequents

⟶ list nil ∧ permute nil nil

list l′ ∧ permute l′ l′ ⟶ list (x′::l′) ∧ permute (x′::l′) (x′::l′)

list l ∧ permute l l ⟶ permute l l .

The third premise, representing the relevance of the induction predicate, is easily derived:

permute l l ⟶ permute l l init list l ∧ permute l l ⟶ permute l l∧L .

The base case, that the empty list is a list and permutes to itself, follows simply from the definitions:

⟶ nat z natR ⟶ ⊤ ⊤R ⟶ length nil z def R ⟶ nat z ∧ length nil z ∧R ⟶ ∃i(nat i ∧ length nil i) ∃R ⟶ list nil def R ⟶ ⊤ ⊤R ⟶ permute nil nil def R ⟶ list nil ∧ permute nil nil ∧R .

For the induction step, we must prove that (x′::l′) is a list and permutes to itself, given that these are true of l′:

list l′, … ⟶ list (x′::l′) list l′, permute l′ l′ ⟶ permute (x′::l′) (x′::l′) list l′, permute l′ l′ ⟶ list (x′::l′) ∧ permute (x′::l′) (x′::l′) ∧R list l′, list l′ ∧ permute l′ l′ ⟶ list (x′::l′) ∧ permute (x′::l′) (x′::l′) ∧L list l′ ∧ permute l′ l′ , list l′ ∧ permute l′ l′ ⟶ … ∧L list l′ ∧ permute l′ l′ ⟶ list (x′::l′) ∧ permute (x′::l′) (x′::l′) cL .

To show that (x′:: l′) is a list, we must provide its length. This is just one more than the length of l′:

nat i ∧ length l′ i, permute l′ l′ ⟶ nat (s i) ∧ length (x′::l′) (s i) nat i ∧ length l′ i, permute l′ l′ ⟶ ∃i(nat i ∧ length (x′::l′) i) ∃R nat i ∧ length l′ i, permute l′ l′ ⟶ list (x′::l′) def R ∃i(nat i ∧ length l′ i), permute l′ l′ ⟶ list (x′::l′) ∃L list l′, permute l′ l′ ⟶ list (x′::l′) def L .

Applying the ∧R rule to the unproved sequent of this partial derivation yields the two sequents:

nat i ∧ length l′ i, permute l′ l′ ⟶ nat (s i)
nat i ∧ length l′ i, permute l′ l′ ⟶ length (x′::l′) (s i) .

34 CHAPTER 2. THE LOGIC F Oλ^{ΔIN}

That (s i) is a natural number follows from the fact that the length i of l′ is a natural number:

nat i, permute l′ l′ ⟶ nat i init nat i ∧ length l′ i, permute l′ l′ ⟶ nat i ∧L nat i ∧ length l′ i, permute l′ l′ ⟶ nat (s i) natR .

That (s i) is the length of (x′::l′) follows by definition from the fact that i is the length of l′:

length l′ i, permute l′ l′ ⟶ length l′ i init nat i ∧ length l′ i, permute l′ l′ ⟶ length l′ i∧L nat i ∧ length l′ i, permute l′ l′ ⟶ length (x′::l′) (s i) def R .

It still remains to prove that (x′::l′) permutes to itself. By the definition of permute, this is true if (x′::l′) splits into (x′::nil) and l′:

list l′, … ⟶ split (x′::l′) (x′::nil) l′ …, permute l′ l′ ⟶ permute l′ l′ init list l′, permute l′ l′ ⟶ split (x′::l′) (x′::nil) l′ ∧ permute l′ l′ ∧R list l′, permute l′ l′ ⟶ ∃l_{22}(split (x′::l′) (x′::nil) l_{22} ∧ permute l′ l_{22} ) ∃R list l′, permute l′ l′ ⟶ permute (x′::l′) (x′::l′) def R .

By the definition of split, (x′::l′) splits into (x′::nil) and l′ if l′ splits into nil and itself:

list l′, permute l′ l′ ⟶ split l′ nil l′ list l′, permute l′ l′ ⟶ split (x′::l′) (x′::nil) l′ def R .

We proved that any list splits into nil and itself in Proposition 2.19, so we are done.

We conclude this section with a proposition that presents additional properties of lists that we have derived in F Oλ^{ΔIN}, though we omit the derivations here.

Proposition 2.21 The following formulas are derivable in F Oλ^{ΔIN} using the definition D(list(τ)):

∀l(list l ⊃ ∀l_{1}∀l_{2}(split l l_{1} l_{2} ⊃ (list l_{1} ∧ list l_{2})))
∀l_{1}(list l_{1} ⊃ ∀l_{2}(list l_{2} ⊃ ∀l(split l l_{1} l_{2} ⊃ list l)))

∀l(list l ⊃ ∀l_{1}∀l_{2}(split l l_{1} l_{2} ⊃ (\begin{matrix}∀x(element x l_{1} ⊃ element x l)∧ \\ ∀x(element x l_{2} ⊃ element x l)))) \end{matrix}

∀l(list l ⊃ ∀l_{1}∀l_{2}(split l l_{1} l_{2} ⊃ split l l_{2} l_{1}))

∀l(list l ⊃ ∀l_{23}∀l_{1}∀l_{2}∀l_{3}(split l l_{1} l_{23} ⊃ split l_{23} l_{2} l_{3} ⊃ ∃l_{12}(split l l_{12} l_{3} ∧ split l_{12} l_{1} l_{2})))

2.3. RELATED WORK 35

∀l(list l ⊃ ∀l_{12}∀l_{1}∀l_{2}∀l_{3}(split l l_{12} l_{3} ⊃ split l_{12} l_{1} l_{2} ⊃ ∃l_{23}(split l l_{1} l_{23} ∧ split l_{23} l_{2} l_{3})))

∀l(list l ⊃ ∀l′(permute l l′ ⊃ list l′))

∀l(list l ⊃ ∀l′∀l_{1}∀l_{2}(\begin{matrix}list l′ ⊃ permute l l′ ⊃ split l l_{1} l_{2} ⊃ \\ ∃l′_{1}∃l′_{2}(permute l_{1} l′_{1} ∧ permute l_{2} l′_{2} ∧ split l′ l′_{1} l′_{2}))) \end{matrix}

∀l(list l ⊃ ∀l′∀l_{1}∀l′_{1}∀l_{2}∀l′_{2}(\begin{matrix}list l′ ⊃ split l l_{1} l_{2} ⊃ split l′ l′_{1} l′_{2} ⊃ \\ permute l_{1} l′_{1} ⊃ permute l_{2} l′_{2} ⊃ permute l l′ )) . \end{matrix}

2.3 Related Work

The logic F Oλ^{ΔIN} is related to the various logics with “definitional reflection” [50]. The key idea behind these logics is that they allow a larger class of definitions than the class of monotone inductive definitions. In particular, implications are allowed to occur in the bodies of definitional clauses. As we have seen in Section 2.2, a rule of definitional reflection such as the def L rule of F Oλ^{ΔIN} allows one to reason about all ways in which a defined atom might hold. Hallnäs introduced these ideas in his calculus of partial inductive definitions [19], a propositional calculus that is infinitary in that it allows conjunctions over infinite sets and definitions with an infinite number of clauses. Hallnäs also worked with Schroeder-Heister to generalize the system to a predicate calculus setting [20]. Eriksson formulated a finitary version of the calculus, enriched the definitional reflection rule, and added an induction principle valid for defined concepts whose definitions fall within the class of monotone inductive definitions [11]. Girard independently constructed a rule similar to Eriksson’s in a linear logic setting [17].

In all of these systems except Girard’s, the cut rule is not admissible and definitions may introduce inconsistencies. Hallnäs and Schroeder-Heister were not concerned with the inadmissibility of the cut rule, since they were using the systems to specify computations in a logic programming sense. Our intent, however, is to use the logic for reasoning about systems. As a result, it is important to us that the cut rule be admissible, and consistency is essential for our purposes. To achieve these we limit the use of implication in definitions by means of the level restriction discussed in Section 2.1. Note that this is a restriction and not a prohibition of the use implication in definitions, and so our class of definitions is 36 CHAPTER 2. THE LOGIC F Oλ^{ΔIN}

still richer than monotone inductive definitions. This is important for our use of F Oλ^{ΔIN} in Chapter 4. We also formulate our induction rule differently than Eriksson (and we also limit it to natural numbers for simplicity). As a result of the restriction on definitions and the formulation of the natL rule, cut-elimination and consistency hold for F Oλ^{ΔIN}, as we prove in Chapter 3.

Chapter 3

Cut-Elimination for F Oλ^{ΔIN}

The purpose of this chapter is to present a proof of cut-elimination for F Oλ^{ΔIN}; the consistency of the logic will be a simple corollary of this. Gentzen’s classic proof of cut-elimination for first-order logic [15] uses an induction on the number of logical connectives in the cut formula. A cut on a compound formula is replaced by cuts on its subformulas, which necessarily contain a lower number of connectives. For example, the derivation

\begin{matrix}{Π_{1} \atop Δ ⟶ B_{1}} & {Π_{2} \atop Δ ⟶ B_{2}} \\ Δ ⟶ B_{1} ∧ B_{2} \end{matrix} ∧R {Π_{3} \atop B_{1}, Γ ⟶ C} ; B_{1} ∧ B_{2}, Γ ⟶ C ∧L

Δ, Γ ⟶ C mc

is reduced to

\begin{matrix}{Π_{1} \atop Δ ⟶ B_{1}} & {Π_{3} \atop B_{1}, Γ ⟶ C} \\ Δ, Γ ⟶ C \end{matrix} mc .

By the induction hypothesis, this cut on B_{1} is eliminable, hence the original cut on B_{1} ∧B_{2} is also eliminable. In first-order logic, when the cut formula is atomic, the cut can easily be removed by permuting the cut up toward the leaves of the proof; eventually an initial rule is reached, at which point the removal of the cut is trivial.

In F Oλ^{ΔIN}, however, the rules for natural numbers and defined concepts act on atoms, so the atomic case is not simple. Consider, for example, the derivation

{Π_{1} \atop Δ ⟶ Bθ} ; Δ ⟶ A def R \begin{matrix}\{ & {Π^{ρ,σ,D} \atop Dσ, Γρ ⟶ Cρ} & \} \\ A, Γ ⟶ C \end{matrix} def L Δ, Γ ⟶ C mc .

38 CHAPTER 3. CUT-ELIMINATION FOR F Oλ^{ΔIN}

The obvious reduction for this is a cut between Π_{1} and the appropriate premise of the def L rule; however, Bθ is a formula of arbitrary complexity, and so will in general have a greater number of connectives than the atom A, which has zero. Thus a different induction measure is needed.

Schroeder-Heister proves cut-elimination for several logics with definitions [49, 50] by including the number of uses of the def L rule in the derivation as part of the induction measure. However, the logics he considers do not contain induction, which complicates things further. The derivation

{Π_{1} \atop Δ ⟶ nat I} Δ ⟶ nat (s I) natR {Π_{2} \atop ⟶ B z} {Π_{3} \atop B j ⟶ B (s j)} {Π_{4} \atop B (s I), Γ ⟶ C} nat (s I), Γ ⟶ C natL

Δ, Γ ⟶ C mc

can be reduced in a number of ways, but the reductions are all variations of the derivation

{Π_{1} \atop Δ ⟶ nat I} {Π_{2} \atop ⟶ B z} {Π_{3} \atop B j ⟶ B (s j)} {Π_{3}[I/j] \atop B I ⟶ B (s I)} nat I ⟶ B (s I) natL Δ ⟶ B (s I) mc {Π_{4} \atop B (s I), Γ ⟶ C} Δ, Γ ⟶ C mc .

Here, the cut on the atomic formula nat (s I) is replaced by two cuts, one on the atom nat I and the other on the formula B (s I). It is not clear what induction measure can be used here. For the first cut, the atom nat I contains no logical connectives, but this is true of the original cut formula nat (s I) as well. The number of natR rules in the right subderivation of the cut has gone down by one, but the duplication of Π_{3} might offset this. For the second cut, the cut formula B (s I) is not related at all to the original cut formula; it certainly can have no fewer connectives than the atom nat (s I). And though its left premise is shorter than the left premise of the original cut, it is unclear how the heights of the right premises compare.

Our proof uses a technique introduced by Tait [54] to prove normal form theorems. Martin-Löf extended the method to apply beyond terms to natural deduction proofs [28], and we use it here in a sequent calculus setting. Rather than associate an induction measure with derivations, we use the derivations themselves as a measure by defining well-founded orderings on derivations, and performing the induction relative to those orderings. The 3.1. REDUCTION RULES FOR DERIVATIONS 39

basis for the orderings is a set of reduction rules, such as those suggested above, that will be used to eliminate applications of the cut rule. We give these reduction rules in Section 3.1. This is followed by a section which discusses two orderings on derivations, a normalizability ordering and a reducibility ordering. The well-foundedness of the normalizability ordering for a derivation implies that the reduction rules can be used to reduce the derivation to a cut-free derivation of the same end-sequent. The reducibility ordering is a superset of the normalizability ordering; thus its well-foundedness implies the well-foundedness of the normalizability ordering. (This notion of reducibility was called convertibility by Tait and computability by Martin-Löf. We prefer to avoid these terms, since they carry other meanings in theoretical computer science, and instead use reducibility after Girard [16].) In Section 3.3 we prove the key lemma: for every derivation, the tree of its successive predecessors in the reducibility relation is well-founded. From this we conclude that the corresponding tree in the normalizability relation is also well-founded, and hence the cut rule can be eliminated from that derivation. Since this holds for every derivation, the consistency of F Oλ^{ΔIN} follows. We conclude with a brief comparison of our work with the work of Martin-Löf and Schroeder-Heister mentioned above.

3.1 Reduction Rules for Derivations

Here we define a reduction relation between derivations, which is an adaptation of the reduction rules used in Gentzen’s original Hauptsatz [15].

Definition 3.1 We define a reduction relation between derivations. The redex is always a derivation Ξ ending with the multicut rule

{Π_{1} \atop Δ_{1} ⟶ B_{1}} ⋯ {Π_{n} \atop Δ_{n} ⟶ B_{n}} {Π \atop B_{1}, …, B_{n}, Γ ⟶ C} Δ_{1}, …, Δ_{n}, Γ ⟶ C mc .

If n = 0, Ξ reduces to the premise derivation Π.

For n > 0 we specify the reduction relation based on the last rule of the premise derivations. If the rightmost premise derivation Π ends with a left rule acting on a cut formula B_{i}, then the last rule of Π_{i} and the last rule of Π together determine the reduction rules that apply. We classify these rules according to the following criteria: we call the rule 40 CHAPTER 3. CUT-ELIMINATION FOR F Oλ^{ΔIN}

an essential case when Π_{i} ends with a right rule; if it ends with a left rule, it is a rightcommutative case; if Π_{i} ends with the init rule, then we have an axiom case; a multicut case arises when it ends with the mc rule. When Π does not end with a left rule acting on a cut formula, then its last rule is alone sufficient to determine the reduction rules that apply. If Π ends in a rule acting on a formula other than a cut formula, then we call this a left-commutative case. A structural case results when Π ends with a contraction on a cut formula. If Π ends with the init rule, this is also an axiom case; similarly a multicut case arises if Π ends in the mc rule. For simplicity of presentation, we always show i = 1.

Essential cases: ∧R/ ∧ L: If Π_{1} and Π are

\begin{matrix}{Π′_{1} \atop Δ_{1} ⟶ B′_{1}} & {Π′′_{1} \atop Δ_{1} ⟶ B′′_{1}} \\ Δ_{1} ⟶ B′_{1} ∧ B′′_{1} \end{matrix} ∧R  {Π′ \atop B′_{1}, B_{2}, …, B_{n}, Γ ⟶ C} ; B′_{1} ∧ B′′_{1}, B_{2}, …, B_{n}, Γ ⟶ C ∧L ,

then Ξ reduces to

{Π′_{1} \atop Δ_{1} ⟶ B′_{1}} {Π_{2} \atop Δ_{2} ⟶ B_{2}} ⋯ {Π_{n} \atop Δ_{n} ⟶ B_{n}} {Π′ \atop B′_{1}, B_{2}, …, B_{n}, Γ ⟶ C} Δ_{1}, …, Δ_{n}, Γ ⟶ C mc .

The case for the other ∧L rule is symmetric.

∨R/ ∨ L: If Π_{1} and Π are

{Π′_{1} \atop Δ_{1} ⟶ B′_{1}} ; Δ_{1} ⟶ B′_{1} ∨ B′′_{1} ∨R \begin{matrix}{Π′ \atop B′_{1}, B_{2}, …, B_{n}, Γ ⟶ C} & {Π′′ \atop B′′_{1}, B_{2}, …, B_{n}, Γ ⟶ C} \\ B′_{1} ∨ B′′_{1}, B_{2}, …, B_{n}, Γ ⟶ C \end{matrix} ∨L ,

then Ξ reduces to

{Π′_{1} \atop Δ_{1} ⟶ B′_{1}} {Π_{2} \atop Δ_{2} ⟶ B_{2}} ⋯ {Π_{n} \atop Δ_{n} ⟶ B_{n}} {Π′ \atop B′_{1}, B_{2}, …, B_{n}, Γ ⟶ C} Δ_{1}, …, Δ_{n}, Γ ⟶ C mc .

The case for the other ∨R rule is symmetric.

⊃ R/ ⊃ L: Suppose Π_{1} and Π are

{Π′_{1} \atop B′_{1}, Δ_{1} ⟶ B′′_{1}} ; Δ_{1} ⟶ B′_{1} ⊃ B′′_{1} ⊃ R \begin{matrix}{Π′ \atop B_{2}, …, B_{n}, Γ ⟶ B′_{1}} & {Π′′ \atop B′′_{1}, B_{2}, …, B_{n}, Γ ⟶ C} \\ B′_{1} ⊃ B′′_{1}, B_{2}, …, B_{n}, Γ ⟶ C \end{matrix} ⊃ L .

Let Ξ_{1} be

\begin{matrix}\left\{{Π_{i} \atop Δ_{i} ⟶ B_{i}}\right\}_{i∈\{2..n\}} & {Π′ \atop B_{2}, …, B_{n}, Γ ⟶ B′_{1}} \\ Δ_{2}, …, Δ_{n}, Γ ⟶ B′_{1} \end{matrix} mc {Π′_{1} \atop B′_{1}, Δ_{1} ⟶ B′′_{1}} Δ_{1}, …, Δ_{n}, Γ ⟶ B′′_{1} mc .

Then Ξ reduces to

{Ξ_{1} \atop … ⟶ B′′_{1}} \left\{{Π_{i} \atop Δ_{i} ⟶ B_{i}}\right\}_{i∈\{2..n\}} {Π′′ \atop B′′_{1}, \{B_{i}\}_{i∈\{2..n\}}, Γ ⟶ C} Δ_{1}, …, Δ_{n}, Γ, Δ_{2}, …, Δ_{n}, Γ ⟶ C mc cL Δ_{1}, …, Δ_{n}, Γ ⟶ C .

We use the double horizontal lines to indicate that the relevant inference rule (in this case, cL) may need to be applied zero or more times.

∀R/∀L: If Π_{1} and Π are

{Π′_{1} \atop Δ_{1} ⟶ B′_{1}[y/x]} ; Δ_{1} ⟶ ∀x.B′_{1} ∀R  {Π′ \atop B′_{1}[t/x], B_{2}, …, B_{n}, Γ ⟶ C} ; ∀x.B′_{1}, B_{2}, …, B_{n}, Γ ⟶ C ∀L ,

then Ξ reduces to

{Π′_{1}[t/y] \atop Δ_{1} ⟶ B′_{1}[t/x]} \left\{{Π_{i} \atop Δ_{i} ⟶ B_{i}}\right\}_{i∈\{2..n\}} {Π′ \atop … ⟶ C} Δ_{1}, …, Δ_{n}, Γ ⟶ C mc .

∃R/∃L: If Π_{1} and Π are

{Π′_{1} \atop Δ_{1} ⟶ B′_{1}[t/x]} ; Δ_{1} ⟶ ∃x.B′_{1} ∃R  {Π′ \atop B′_{1}[y/x], B_{2}, …, B_{n}, Γ ⟶ C} ; ∃x.B′_{1}, B_{2}, …, B_{n}, Γ ⟶ C ∃L ,

then Ξ reduces to

{Π′_{1} \atop Δ_{1} ⟶ B′_{1}[t/x]} \left\{{Π_{i} \atop Δ_{i} ⟶ B_{i}}\right\}_{i∈\{2..n\}} {Π′[t/y] \atop … ⟶ C} Δ_{1}, …, Δ_{n}, Γ ⟶ C mc .

42 CHAPTER 3. CUT-ELIMINATION FOR F Oλ^{ΔIN} natR/natL: Suppose Π_{1} is Δ_{1} ⟶ nat z natR and Π is

{Π′ \atop ⟶ D z} {Π′′ \atop D j ⟶ D (s j)} {Π′′′ \atop D z, B_{2}, …, B_{n}, Γ ⟶ C} nat z, B_{2}, …, B_{n}, Γ ⟶ C natL .

Then Ξ reduces to

{w(Δ_{1}, Π′) \atop Δ_{1} ⟶ D z} \left\{{Π_{i} \atop Δ_{i} ⟶ B_{i}}\right\}_{i∈\{2..n\}} {Π′′′ \atop D z, B_{2}, …, B_{n}, Γ ⟶ C} Δ_{1}, …, Δ_{n}, Γ ⟶ C mc .

natR/natL: Suppose Π_{1} is

{Π′_{1} \atop Δ_{1} ⟶ nat I}

Δ_{1} ⟶ nat (s I)

natR

and Π is

{Π′ \atop ⟶ D z} {Π′′ \atop D j ⟶ D (s j)} {Π′′′ \atop D (s I), B_{2}, …, B_{n}, Γ ⟶ C} nat (s I), B_{2}, …, B_{n}, Γ ⟶ C natL .

Let Ξ_{1} be

{Π′_{1} \atop Δ_{1} ⟶ nat I} {Π′ \atop ⟶ D z} {Π′′ \atop D j ⟶ D (s j)} D I ⟶ D I init nat I ⟶ D I natL Δ_{1} ⟶ D I mc ,

and Ξ_{2} be

\begin{matrix}{Ξ_{1} \atop Δ_{1} ⟶ D I} & {Π′′[I/j] \atop D I ⟶ D (s I)} \\ Δ_{1} ⟶ D (s I) \end{matrix} mc .

Then Ξ reduces to

{Ξ_{2} \atop Δ_{1} ⟶ D (s I)} \left\{{Π_{i} \atop Δ_{i} ⟶ B_{i}}\right\}_{i∈\{2..n\}} {Π′′′ \atop D (s I), B_{2}, …, B_{n}, Γ ⟶ C} Δ_{1}, …, Δ_{n}, Γ ⟶ C mc .

def R/def L: Suppose Π_{1} and Π are

{Π′_{1} \atop Δ_{1} ⟶ B′_{1}θ} ; Δ_{1} ⟶ B_{1} def R \begin{matrix}\{ & {Π^{ρ,σ,D} \atop Dσ, B_{2}ρ, …, B_{n}ρ, Γρ ⟶ Cρ} & \} \\ B_{1}, B_{2}, …, B_{n}, Γ ⟶ C \end{matrix} def L .

3.1. REDUCTION RULES FOR DERIVATIONS 43

Then by the def R rule in Π_{1} dfn(ϵ, B_{1}, θ, B′_{1}) holds. Let θ′ be the restriction of θ to the variables x̄ of the relevant definitional clause. Since B′_{1} is the body of this clause, its free variables are included in x̄, and so B′_{1}θ′ = B′_{1}θ. Then Ξ reduces to

{Π′_{1} \atop Δ_{1} ⟶ B′_{1}θ} \left\{{Π_{i} \atop Δ_{i} ⟶ B_{i}}\right\}_{i∈\{2..n\}} {Π^{ϵ,θ′,B′_{1}} \atop B′_{1}θ, B_{2}, …, B_{n}, Γ ⟶ C} Δ_{1}, …, Δ_{n}, Γ ⟶ C mc .

Left-commutative cases:

•L/ ∘ L: Suppose Π ends with a left rule other than cL acting on B_{1}, and Π_{1} is

\begin{matrix}\{ & {Π_{1}^{i} \atop Δ_{1}^{i} ⟶ B_{1}} & \} \\ Δ_{1} ⟶ B_{1} \end{matrix} •L ,

where •L is any left rule except ⊃ L, def L, or natL (but including cL). Then Ξ reduces to

\{{Π_{1}^{i} \atop Δ_{1}^{i} ⟶ B_{1}} \left\{{Π_{j} \atop Δ_{j} ⟶ B_{j}}\right\}_{j∈\{2..n\}} {Π \atop B_{1}, …, B_{n}, Γ ⟶ C} Δ_{1}^{i}, Δ_{2}, …, Δ_{n}, Γ ⟶ C mc\} Δ_{1}, Δ_{2}, …, Δ_{n}, Γ ⟶ C •L .

⊃ L/ ∘ L: Suppose Π ends with a left rule other than cL acting on B_{1} and Π_{1} is

\begin{matrix}{Π′_{1} \atop Δ′_{1} ⟶ D′_{1}} & {Π′′_{1} \atop D′′_{1}, Δ′_{1} ⟶ B_{1}} \\ D′_{1} ⊃ D′′_{1}, Δ′_{1} ⟶ B_{1} \end{matrix} ⊃ L .

Let Ξ_{1} be

{Π′′_{1} \atop D′′_{1}, Δ′_{1} ⟶ B_{1}} {Π_{2} \atop Δ_{2} ⟶ B_{2}} ⋯ {Π_{n} \atop Δ_{n} ⟶ B_{n}} {Π \atop B_{1}, …, B_{n}, Γ ⟶ C} D′′_{1}, Δ′_{1}, Δ_{2}, …, Δ_{n}, Γ ⟶ C mc .

Then Ξ reduces to

w(Δ_{2} ∪ … ∪ Δ_{n} ∪ Γ, Π′_{1}) Δ′_{1}, Δ_{2}, …, Δ_{n}, Γ ⟶ D′_{1} {Ξ_{1} \atop D′′_{1}, Δ′_{1}, Δ_{2}, …, Δ_{n}, Γ ⟶ C} D′_{1} ⊃ D′′_{1}, Δ′_{1}, Δ_{2}, …, Δ_{n}, Γ ⟶ C ⊃ L .

44 CHAPTER 3. CUT-ELIMINATION FOR F Oλ^{ΔIN} natL/ ∘ L: Suppose Π ends with a left rule other than cL acting on B_{1}, and Π_{1} is

{Π_{1}^{1} \atop ⟶ D_{1} z} {Π_{1}^{2} \atop D_{1} j ⟶ D_{1} (s j)} {Π_{1}^{3} \atop D_{1} I, Δ′_{1} ⟶ B_{1}} nat I, Δ′_{1} ⟶ B_{1} natL .

Let Ξ_{1} be

{Π_{1}^{3} \atop D_{1} I, Δ′_{1} ⟶ B_{1}} \left\{{Π_{i} \atop Δ_{i} ⟶ B_{i}}\right\}_{i∈\{2..n\}} {Π \atop B_{1}, …, B_{n}, Γ ⟶ C} D_{1} I, Δ′_{1}, Δ_{2}, …, Δ_{n}, Γ ⟶ C mc .

Then Ξ reduces to

{Π_{1}^{1} \atop ⟶ D_{1} z} {Π_{1}^{2} \atop D_{1} j ⟶ D_{1} (s j)} {Ξ_{1} \atop D_{1} I, Δ′_{1}, Δ_{2}, …, Δ_{n}, Γ ⟶ C} nat I, Δ′_{1}, Δ_{2}, …, Δ_{n}, Γ ⟶ C natL .

def L/ ∘ L: If Π ends with a left rule other than cL acting on B_{1} and Π_{1} is

\begin{matrix}\{ & {Π_{1}^{ρ,σ,D} \atop Dσ, Δ′_{1}ρ ⟶ B_{1}ρ} & \} \\ A, Δ′_{1} ⟶ B_{1} \end{matrix} def L ,

then Ξ reduces to

\{{Π_{1}^{ρ,σ,D} \atop Dσ, Δ′_{1}ρ ⟶ B_{1}ρ} \left\{{Π_{i}ρ \atop Δ_{i}ρ ⟶ B_{i}ρ}\right\}_{i∈\{2..n\}} {Πρ \atop … ⟶ Cρ} Dσ, Δ′_{1}ρ, Δ_{2}ρ, …, Δ_{n}ρ, Γρ ⟶ Cρ mc\} A, Δ′_{1}, Δ_{2}, …, Δ_{n}, Γ ⟶ C def L .

Right-commutative cases: −/ ∘ L: Suppose Π is

\begin{matrix}\{ & {Π^{i} \atop B_{1}, …, B_{n}, Γ^{i} ⟶ C} & \} \\ B_{1}, …, B_{n}, Γ ⟶ C \end{matrix} ∘L ,

where ∘L is any left rule other than ⊃ L, def L, or natL (but including cL) acting on a formula other than B_{1}, …, B_{n}. Then Ξ reduces to

\{{Π_{1} \atop Δ_{1} ⟶ B_{1}} ⋯ {Π_{n} \atop Δ_{n} ⟶ B_{n}} {Π^{i} \atop B_{1}, …, B_{n}, Γ^{i} ⟶ C} Δ_{1}, …, Δ_{n}, Γ^{i} ⟶ C mc\} Δ_{1}, …, Δ_{n}, Γ ⟶ C ∘L .

−/ ⊃ L: Suppose Π is

\begin{matrix}{Π′ \atop B_{1}, …, B_{n}, Γ′ ⟶ D′} & {Π′′ \atop B_{1}, …, B_{n}, D′′, Γ′ ⟶ C} \\ B_{1}, …, B_{n}, D′ ⊃ D′′, Γ′ ⟶ C \end{matrix} ⊃ L .

Let Ξ_{1} be

{Π_{1} \atop Δ_{1} ⟶ B_{1}} ⋯ {Π_{n} \atop Δ_{n} ⟶ B_{n}} {Π′ \atop B_{1}, …, B_{n}, Γ′ ⟶ D′}

Δ_{1}, …, Δ_{n}, Γ′ ⟶ D′ mc

and Ξ_{2} be

{Π_{1} \atop Δ_{1} ⟶ B_{1}} ⋯ {Π_{n} \atop Δ_{n} ⟶ B_{n}} {Π′′ \atop B_{1}, …, B_{n}, D′′, Γ′ ⟶ C} Δ_{1}, …, Δ_{n}, D′′, Γ′ ⟶ C mc .

Then Ξ reduces to

{Ξ_{1} \atop Δ_{1}, …, Δ_{n}, Γ′ ⟶ D′} {Ξ_{2} \atop Δ_{1}, …, Δ_{n}, D′′, Γ′ ⟶ C} Δ_{1}, …, Δ_{n}, D′ ⊃ D′′, Γ′ ⟶ C ⊃ L .

−/natL: Suppose Π is

{Π′ \atop ⟶ D z} {Π′′ \atop D j ⟶ D (s j)} {Π′′′ \atop B_{1}, …, B_{n}, D I, Γ′ ⟶ C} B_{1}, …, B_{n}, nat I, Γ′ ⟶ C natL .

Let Ξ_{1} be

{Π_{1} \atop Δ_{1} ⟶ B_{1}} ⋯ {Π_{n} \atop Δ_{n} ⟶ B_{n}} {Π′′′ \atop B_{1}, …, B_{n}, D I, Γ′ ⟶ C} Δ_{1}, …, Δ_{n}, D I, Γ′ ⟶ C mc .

then Ξ reduces to

{Π′ \atop ⟶ D z} {Π′′ \atop D j ⟶ D (s j)} {Ξ_{1} \atop Δ_{1}, …, Δ_{n}, D I, Γ′ ⟶ C} Δ_{1}, …, Δ_{n}, nat I, Γ′ ⟶ C natL .

−/def L: If Π is

\begin{matrix}\{ & {Π^{ρ,σ,D} \atop B_{1}ρ, …, B_{n}ρ, Dσ, Γ′ρ ⟶ Cρ} & \} \\ B_{1}, …, B_{n}, A, Γ′ ⟶ C \end{matrix} def L ,

46 CHAPTER 3. CUT-ELIMINATION FOR F Oλ^{ΔIN}

then Ξ reduces to

\{\begin{matrix}\left\{{Π_{i}ρ \atop Δ_{i}ρ ⟶ B_{i}ρ}\right\}_{i∈\{1..n\}} & {Π^{ρ,σ,D} \atop \{B_{i}ρ\}_{i∈\{1..n\}}, Dσ, Γ′ρ ⟶ Cρ} \\ Δ_{1}ρ, …, Δ_{n}ρ, Dσ, Γ′ρ ⟶ Cρ \end{matrix} mc\} Δ_{1}, …, Δ_{n}, A, Γ′ ⟶ C def L .

−/ ∘ R: If Π is

\begin{matrix}\{ & {Π^{i} \atop B_{1}, …, B_{n}, Γ^{i} ⟶ C^{i}} & \} \\ B_{1}, …, B_{n}, Γ ⟶ C \end{matrix} ∘R ,

where ∘R is any right rule, then Ξ reduces to

\{{Π_{1} \atop Δ_{1} ⟶ B_{1}} ⋯ {Π_{n} \atop Δ_{n} ⟶ B_{n}} {Π^{i} \atop B_{1}, …, B_{n}, Γ^{i} ⟶ C^{i}} Δ_{1}, …, Δ_{n}, Γ^{i} ⟶ C^{i} mc\} Δ_{1}, …, Δ_{n}, Γ ⟶ C ∘R .

Multicut cases: mc/ ∘ L: If Π ends with a left rule other than cL acting on B_{1} and Π_{1} ends with a multicut

and reduces to Π′_{1}, then Ξ reduces to

{Π′_{1} \atop Δ_{1} ⟶ B_{1}} {Π_{2} \atop Δ_{2} ⟶ B_{2}} ⋯ {Π_{n} \atop Δ_{n} ⟶ B_{n}} {Π \atop B_{1}, …, B_{n}, Γ ⟶ C} Δ_{1}, …, Δ_{n}, Γ ⟶ C mc .

−/mc: Suppose Π is

\begin{matrix}\left\{{Π^{j} \atop \{B_{i}\}_{i∈I^{j}}, Γ^{j} ⟶ D^{j}}\right\}_{j∈\{1..m\}} & {Π′ \atop \{D^{j}\}_{j∈\{1..m\}}, \{B_{i}\}_{i∈I′}, Γ′ ⟶ C} \\ B_{1}, …, B_{n}, Γ^{1}, …, Γ^{m}, Γ′ ⟶ C \end{matrix} mc ,

where I^{1}, …, I^{m}, I′ partition the formulas {B_{i}}_{i∈{1..n}} among the premise derivations Π_{1}, …, Π_{m}, Π′. For 1 ≤ j ≤ m let Ξ^{j} be

\begin{matrix}\left\{{Π_{i} \atop Δ_{i} ⟶ B_{i}}\right\}_{i∈I^{j}} & {Π^{j} \atop \{B_{i}\}_{i∈I^{j}}, Γ^{j} ⟶ D^{j}} \\ \{Δ_{i}\}_{i∈I^{j}}, Γ^{j} ⟶ D^{j} \end{matrix} mc .

Then Ξ reduces to

\left\{{Ξ^{j} \atop … ⟶ D^{j}}\right\}_{j∈\{1..m\}} \left\{{Π_{i} \atop Δ_{i} ⟶ B_{i}}\right\}_{i∈I′} {Π′ \atop … ⟶ C} Δ_{1}, …, Δ_{n}, Γ^{1}, … Γ^{m}, Γ′ ⟶ C mc .

Structural case:

−/cL: If Π is

{Π′ \atop B_{1}, B_{1}, B_{2}, …, B_{n}, Γ ⟶ C} ; B_{1}, …, B_{n}, Γ ⟶ C cL ,

then Ξ reduces to

{Π_{1} \atop Δ_{1} ⟶ B_{1}} \left\{{Π_{i} \atop Δ_{i} ⟶ B_{i}}\right\}_{i∈\{1..n\}} {Π′ \atop B_{1}, B_{1}, B_{2}, …, B_{n}, Γ ⟶ C} Δ_{1}, Δ_{1}, Δ_{2}, …, Δ_{n}, Γ ⟶ C mc cL Δ_{1}, …, Δ_{n}, Γ ⟶ C .

\underline{Axiom cases:}

init/ ∘ L: If Π ends with either natL or def L acting on B_{1} and Π_{1} ends with the init rule, then Ξ reduces to

{Π_{2} \atop Δ_{2} ⟶ B_{2}} ⋯ {Π_{n} \atop Δ_{n} ⟶ B_{n}} {w(Δ_{1} \ B_{1}, Π) \atop Δ_{1}, B_{2}, …, B_{n}, Γ ⟶ C} Δ_{1}, …, Δ_{n}, Γ ⟶ C mc .

−/init: If Π ends with the init rule and C is a formula in Γ, then Ξ reduces to

Δ_{1}, …, Δ_{n}, Γ ⟶ C init .

If Π ends with the init rule, but C is not a formula in Γ, then C must be one of the cut formulas, say B_{1}. In this case Ξ reduces to w(Δ_{2} ∪ … ∪ Δ_{n} ∪ Γ, Π_{1}).

An inspection of the rules of the logic and this definition will reveal that every derivation ending with a multicut has a reduct. Because we use a multiset as the left side of the sequent, there may be ambiguity as to whether a formula occurring on the left side of the rightmost premise to a multicut rule is in fact a cut formula, and if so, which of the left premises corresponds to it. As a result, several of the reduction rules may apply, and so a derivation may have multiple reducts.

We now prove that the reduction relation is preserved by weakening.

Lemma 3.2 If Ξ reduces to Ξ′, then, for any multiset Δ of formulas, w(Δ, Ξ) reduces to w(Δ, Ξ′).

48 CHAPTER 3. CUT-ELIMINATION FOR F Oλ^{ΔIN}

Proof We prove this lemma by a simple case analysis on the reduction rule used to reduce Ξ to Ξ′. Since Ξ is a redex, it is of the form

{Π_{1} \atop Δ_{1} ⟶ B_{1}} ⋯ {Π_{n} \atop Δ_{n} ⟶ B_{n}} {Π \atop B_{1}, …, B_{n}, Γ ⟶ C} Δ_{1}, …, Δ_{n}, Γ ⟶ C mc ,

and w(Δ, Ξ) is of the form

{Π_{1} \atop Δ_{1} ⟶ B_{1}} ⋯ {Π_{n} \atop Δ_{n} ⟶ B_{n}} {w(Δ, Π) \atop B_{1}, …, B_{n}, Γ, Δ ⟶ C} Δ_{1}, …, Δ_{n}, Γ, Δ ⟶ C mc .

As in the definition of the reduction relation, we shall arbitrarily distinguish Π_{1} without loss of generality.

The only interesting case is that of ∃R/∃L shown below; the remaining cases follow easily from Definition 2.8 and Lemma 2.12.

Suppose Π_{1} and Π are

{Π′_{1} \atop Δ_{1} ⟶ B′_{1}[t/x]} ; Δ_{1} ⟶ ∃x.B′_{1} ∃R  {Π′ \atop B′_{1}[y/x], B_{2}, …, B_{n}, Γ ⟶ C} ; ∃x.B′_{1}, B_{2}, …, B_{n}, Γ ⟶ C ∃L .

Then w(Δ, Π) is

{w(Δ, Π′) \atop B′_{1}[y/x], B_{2}, …, B_{n}, Γ, Δ ⟶ C} ; ∃x.B′_{1}, B_{2}, …, B_{n}, Γ, Δ ⟶ C ∃L ,

and w(Δ, Ξ) reduces to

{Π′_{1} \atop Δ_{1} ⟶ B′_{1}[t/x]} \left\{{Π_{i} \atop Δ_{i} ⟶ B_{i}}\right\}_{i∈\{2..n\}} {w(Δ, Π′)[t/y] \atop B′_{1}[t/x], B_{2}, …, B_{n}, Γ, Δ ⟶ C} Δ_{1}, …, Δ_{n}, Γ, Δ ⟶ C mc ,

where we choose y so that it is not free in Δ. On the other hand, Ξ reduces to Ξ′

{Π′_{1} \atop Δ_{1} ⟶ B′_{1}[t/x]} \left\{{Π_{i} \atop Δ_{i} ⟶ B_{i}}\right\}_{i∈\{2..n\}} {Π′[t/y] \atop B′_{1}[t/x], B_{2}, …, B_{n}, Γ ⟶ C} Δ_{1}, …, Δ_{n}, Γ ⟶ C mc ,

and w(Δ, Ξ′) is

{Π′_{1} \atop Δ_{1} ⟶ B′_{1}[t/x]} \left\{{Π_{i} \atop Δ_{i} ⟶ B_{i}}\right\}_{i∈\{2..n\}} {w(Δ, Π′[t/y]) \atop B′_{1}[t/x], B_{2}, …, B_{n}, Γ, Δ ⟶ C} Δ_{1}, …, Δ_{n}, Γ, Δ ⟶ C mc .

By Lemma 2.11, w(Δ, Π′)[t/y] is the same derivation as w(Δ[t/y], Π′[t/y]). Since y is not free in Δ, Δ[t/y] = Δ, so the reduct of w(Δ, Ξ) is w(Δ, Ξ′).

3.2 Normalizability and Reducibility

We now define two properties of derivations: normalizability and reducibility. Each of these properties implies that the derivation can be reduced to a cut-free derivation of the same end-sequent.

Definition 3.3 We define the set of normalizable derivations to be the smallest set that satisfies the following conditions:

1. If a derivation Π ends with a multicut, then it is normalizable if for every substitution θ there is a normalizable reduct of Πθ.

2. If a derivation ends with any rule other than a multicut, then it is normalizable if the premise derivations are normalizable.

These clauses assert that a given derivation is normalizable provided certain (perhaps infinitely many) other derivations are normalizable. If we call these other derivations the predecessors of the given derivation, then a derivation is normalizable if and only if the tree of the derivation and its successive predecessors is well-founded. In this case, the well-founded tree is call the normalization of the derivation.

Since a normalization is well-founded, it has an associated induction principle: for any property P of derivations, if for every derivation Π in the normalization, P holds for every predecessor of Π implies that P holds for Π, then P holds for every derivation in the normalization.

Lemma 3.4 If there is a normalizable derivation of a sequent, then there is a cut-free derivation of the sequent.

Proof Let Π be a normalizable derivation of the sequent Γ ⟶ B. We show by induction on the normalization of Π that there is a cut-free derivation of Γ ⟶ B.

50 CHAPTER 3. CUT-ELIMINATION FOR F Oλ^{ΔIN}

1. If Π ends with a multicut, then one of its reducts is one of its predecessors (by way of the empty substitution) and so is normalizable. But the reduct is also a derivation of Γ ⟶ B, so by the induction hypothesis this sequent has a cut-free derivation.

2. Suppose Π ends with a rule other than multicut. Since we are given that Π is normalizable, by definition the premise derivations are normalizable. These premise derivations are the predecessors of Π, so by the induction hypothesis there are cut-free derivations of the premises. Thus there is a cut-free derivation of Γ ⟶ B.

Lemma 3.5 If Π is a normalizable derivation, then for any substitution θ, Πθ is normalizable.

Proof We prove this lemma by induction on the normalization of Π.

1. If Π ends with a multicut, then Πθ also ends with a multicut. For any substitution θ′, some reduct of Πθθ′ is a predecessor of Π and is thus normalizable. Therefore Πθ is normalizable.

2. Suppose Π ends with a rule other than multicut and has premise derivations {Π_{i}}. By Definition 2.5 each premise derivation in Πθ is either Π_{i} or Π_{i}θ. Since Π is normalizable, Π_{i} is normalizable, and so by the induction hypothesis Π_{i}θ is also normalizable. Thus Πθ is normalizable.

Lemma 3.6 If Π is a normalizable derivation, then for any multiset Δ of formulas, w(Δ, Π) is normalizable.

Proof We prove this lemma by induction on the normalization of Π.

1. Suppose Π ends with a multicut. To show that w(Δ, Π) is normalizable, we must show that for any substitution θ some reduct of w(Δ, Π)θ is normalizable. Since Π is normalizable, it has as one of its predecessors a reduct Π′ of Πθ. By Lemmas 2.11 and 3.2, w(Δ, Π)θ reduces to w(Δθ, Π′). Π′ is normalizable since it is a predecessor of Π, so by the induction hypothesis w(Δθ, Π′) is normalizable.

3.2. NORMALIZABILITY AND REDUCIBILITY 51

2. Suppose Π ends with a rule other than multicut and has premise derivations {Π_{i}}. By Definition 2.8 each premise derivation of w(Δ, Π) is either Π_{i} or w(Δ′, Π_{i}) for some multiset Δ′ of formulas. Since Π is normalizable, Π_{i} is normalizable, and so by the induction hypothesis w(Δ′, Π_{i}) is also normalizable. Thus all the premise derivations of w(Δ, Π) are normalizable, and so w(Δ, Π) is normalizable.

We now define the property of reducibility for derivations. We do this by induction on the level of the derivation: in the definition of reducibility for derivations of level i we assume that reducibility is already defined for all levels j < i. (Recall from Definition 2.1 that the level of a derivation is defined to be the level of the consequent of its end-sequent.)

Definition 3.7 For any i, we define the set of reducible i-level derivations to be the smallest set of i-level derivations that satisfies the following conditions:

1. If a derivation Π ends with a multicut, then it is reducible if for every substitution θ there is a reducible reduct of Πθ.

2. Suppose the derivation ends with the implication right rule

{Π \atop B, Γ ⟶ C} ; Γ ⟶ B ⊃ C ⊃ R .

Then the derivation is reducible if the premise derivation Π is reducible and, for every substitution θ, multiset Δ of formulas, and reducible derivation Π′ of Δ ⟶ Bθ, the derivation

\begin{matrix}{Π′ \atop Δ ⟶ Bθ} & {Πθ \atop Bθ, Γθ ⟶ Cθ} \\ Δ, Γθ ⟶ Cθ \end{matrix} mc

is reducible.

3. If the derivation ends with the implication left rule or the nat left rule, then it is reducible if the right premise derivation is reducible and the other premise derivations are normalizable.

4. If the derivation ends with any other rule, then it is reducible if the premise derivations are reducible.

52 CHAPTER 3. CUT-ELIMINATION FOR F Oλ^{ΔIN}

These clauses assert that a given derivation is reducible provided certain (perhaps infinitely many) other derivations are reducible. If we call these other derivations the predecessors of the given derivation, then a derivation is reducible only if the tree of the derivation and its successive predecessors is well-founded. In this case, the well-founded tree is call the reduction of the derivation.

In defining reducibility for a derivation of Γ ⟶ B ⊃ C ending with ⊃ R we quantify over reducible derivations of Δ ⟶ Bθ. This is legitimate since we are defining reducibility for a derivation having level max(lvl(B) + 1, lvl(C)), so the set of reducible derivations having level lvl(Bθ) = lvl(B) is already defined. For a derivation ending with ⊃ L or natL, some premise derivations may have consequents with a higher level than that of the consequent of the conclusion. As a result, we cannot use the reducibility of those premise derivations to define the reducibility of the derivation as a whole, since the reducibility of the premise derivations may not yet be defined. Thus we use the weaker notion of normalizability for those premise derivations. Also observe that the consequent of the premise to the rule def R cannot have a higher level than the consequent of the conclusion because of the level restriction on definitional clauses. Finally, as with normalizations, reductions have associated induction principles.

Lemma 3.8 If a derivation is reducible, then it is normalizable.

Proof The proof of this lemma is a straightforward induction on the reduction of the given derivation.

Lemma 3.9 If Π is a reducible derivation, then for any substitution θ, Πθ is reducible.

Proof We prove this lemma by induction on the reduction of Π.

1. If Π ends with a multicut, then Πθ also ends with a multicut. For any substitution θ′, some reduct of Πθθ′ is a predecessor of Π and is thus reducible. Therefore Πθ is reducible.

2. If Π ends with the implication right rule then Π and Πθ are

{Π′ \atop B, Γ ⟶ C} ; Γ ⟶ B ⊃ C ⊃ R  {Π′θ \atop Bθ, Γθ ⟶ Cθ} ; Γθ ⟶ Bθ ⊃ Cθ ⊃ R .

Πθ is reducible if Π′θ is reducible and, for every substitution θ′, multiset Δ, and reducible derivation Π′′, the derivation Ξ

\begin{matrix}{Π′′ \atop Δ ⟶ Bθθ′} & {Π′θθ′ \atop Bθθ′, Γθθ′ ⟶ Cθθ′} \\ Δ, Γθθ′ ⟶ Cθθ′ \end{matrix} mc

is also reducible. Π′θ is reducible by the induction hypothesis, and Ξ is reducible since it is a predecessor of Π. Therefore Πθ is reducible.

3. If Π ends with ⊃ L or natL, then the right premise derivation is reducible and the other premise derivations are normalizable. By Definition 2.5 each premise derivation in Πθ is obtained by applying θ to a premise derivation in Π. By the induction hypothesis the right premise derivation of Πθ is reducible, and by Lemma 3.5 the other premise derivations are normalizable. Thus Πθ is reducible.

4. Suppose Π ends with any other rule and has premise derivations {Π_{i}}. By Definition 2.5 each premise derivation in Πθ is either Π_{i} or Π_{i}θ. Since Π is reducible, Π_{i} is reducible, and so by the induction hypothesis Π_{i}θ is also reducible. Thus Πθ is reducible.

Lemma 3.10 If Π is a reducible derivation, then for any multiset Δ of formulas, w(Δ, Π) is reducible.

Proof We prove this lemma by induction on the reduction of Π.

1. Suppose Π ends with a multicut. To show that w(Δ, Π) is reducible, we must show that for any substitution θ some reduct of w(Δ, Π)θ is reducible. Since Π is reducible, it has as one of its predecessors a reduct Π′ of Πθ. By Lemmas 2.11 and 3.2, w(Δ, Π)θ reduces to w(Δθ, Π′). Π′ is reducible since it is a predecessor of Π, so by the induction hypothesis w(Δθ, Π′) is reducible.

2. If Π ends with the implication right rule then Π and w(Δ, Π) are

{Π′ \atop B, Γ ⟶ C} ; Γ ⟶ B ⊃ C ⊃ R  {w(Δ, Π′) \atop B, Γ, Δ ⟶ C} ; Γ, Δ ⟶ B ⊃ C ⊃ R .

54 CHAPTER 3. CUT-ELIMINATION FOR F Oλ^{ΔIN}

w(Δ, Π) is reducible if w(Δ, Π′) is reducible and, for every substitution θ, multiset Δ′, and reducible derivation Π′′, the derivation Ξ

{Π′′ \atop Δ′ ⟶ Bθ} {w(Δ, Π′)θ \atop Bθ, Γθ, Δθ ⟶ Cθ}

Δ′, Γθ, Δθ ⟶ Cθ mc

is reducible. By Lemma 2.11 w(Δ, Π′)θ is the same derivation as w(Δθ, Π′θ). Thus Ξ is the same as w(Δθ, Ξ′), where Ξ′ is

\begin{matrix}{Π′′ \atop Δ′ ⟶ Bθ} & {Π′θ \atop Bθ, Γθ ⟶ Cθ} \\ Δ′, Γθ ⟶ Cθ \end{matrix} mc .

Π′ and Ξ′ are predecessors of Π, so they are reducible. Thus by the induction hypothesis w(Δ, Π′) and w(Δθ, Ξ′) are reducible, so w(Δ, Π) is reducible.

3. (a) If Π ends with the implication left rule

\begin{matrix}{Π_{1} \atop Γ ⟶ B} & {Π_{2} \atop C, Γ ⟶ D} \\ B ⊃ C, Γ ⟶ D \end{matrix} ⊃ L ,

then the derivation Π_{1} is normalizable and the derivation Π_{2} is reducible. By Lemma 3.6 w(Δ, Π_{1}) is normalizable, and by the induction hypothesis w(Δ, Π_{2}) is reducible. Thus w(Δ, Π) is reducible.

(b) If Π ends with the natL rule

{Π_{1} \atop ⟶ C z} {Π_{2} \atop C j ⟶ C (s j)} {Π_{3} \atop C I, Γ ⟶ B} nat I, Γ ⟶ B natL ,

then the derivations Π_{1} and Π_{2} are normalizable and the derivation Π_{3} is reducible. w(Δ, Π) is

{Π_{1} \atop ⟶ C z} {Π_{2} \atop C j ⟶ C (s j)} {w(Δ, Π_{3}) \atop C I, Γ, Δ ⟶ B} nat I, Γ, Δ ⟶ B natL .

By the induction hypothesis w(Δ, Π_{3}) is reducible, so w(Δ, Π) is reducible.

3.3. CUT-ELIMINATION 55

4. If Π ends with any other rule, then the premise derivations are reducible. By Definition 2.8 each premise derivation of w(Δ, Π) is w(Δ′, Π_{i}) for some premise derivation Π_{i} in Π and multiset Δ′ of formulas. w(Δ′, Π_{i}) is reducible by the induction hypothesis, so w(Δ, Π) is reducible.

3.3 Cut-Elimination

In the previous section we proved that every reducible derivation is normalizable and that every normalizable derivation can be reduced to a cut-free derivation of the same endsequent. In this section we show that every F Oλ^{ΔIN} derivation is reducible, and thus every derivable sequent can be derived without the cut rule. The consistency of F Oλ^{ΔIN} is then a simple corollary of the cut-elimination theorem.

Lemma 3.11 For any derivation Π of B_{1}, …, B_{n}, Γ ⟶ C and reducible derivations Π_{1}, …, Π_{n} of Δ_{1} ⟶ B_{1}, …, Δ_{n} ⟶ B_{n} (n ≥ 0), the derivation Ξ

{Π_{1} \atop Δ_{1} ⟶ B_{1}} ⋯ {Π_{n} \atop Δ_{n} ⟶ B_{n}} {Π \atop B_{1}, …, B_{n}, Γ ⟶ C}

Δ_{1}, …, Δ_{n}, Γ ⟶ C mc

is reducible.

Proof The proof is by induction on ht(Π), with subordinate inductions on n and on the reductions of Π_{1}, …, Π_{n}. The proof does not rely on the order of the inductions on reductions. Thus when we need to distinguish one of the Π_{i}, we shall refer to it as Π_{1} without loss of generality.

The derivation Ξ is reducible if for every substitution θ some reduct of Ξθ is reducible. If n = 0, then Ξθ reduces to Πθ. By Lemma 3.9 it suffices to show that Π is reducible. This is proved by a case analysis of the last rule in Π. For each case, the result follows easily from the outer induction hypothesis and Definition 3.7. The ⊃ R case requires that substitution for variables doesn’t increase the measure of a derivation (Lemma 2.7). In the cases for ⊃ L and natL we need the additional information that reducibility implies normalizability (Lemma 3.8).

56 CHAPTER 3. CUT-ELIMINATION FOR F Oλ^{ΔIN}

For n > 0 we proceed with a case analysis of the reduction rules that apply to Ξ (and thus to Ξθ) to show that in fact every reduct of Ξθ is reducible. Most cases follow easily from the induction hypothesis, Definition 3.7, and Lemmas 2.7, 2.10, 3.5, 3.6, 3.8, 3.9, and 3.10. We show the interesting cases below. ⊃ R/ ⊃ L: Π_{1} and Π are

{Π′_{1} \atop B′_{1}, Δ_{1} ⟶ B′′_{1}} ; Δ_{1} ⟶ B′_{1} ⊃ B′′_{1} ⊃ R \begin{matrix}{Π′ \atop B_{2}, …, B_{n}, Γ ⟶ B′_{1}} & {Π′′ \atop B′′_{1}, B_{2}, …, B_{n}, Γ ⟶ C} \\ B′_{1} ⊃ B′′_{1}, B_{2}, …, B_{n}, Γ ⟶ C \end{matrix} ⊃ L .

Recall that substitution for variables preserves reducibility (Lemma 3.9) and does not increase the measure of a derivation (Lemma 2.7). Thus the derivation Ξ_{1}

{Π_{2}θ \atop Δ_{2}θ ⟶ B_{2}θ} ⋯ {Π_{n}θ \atop Δ_{n}θ ⟶ B_{n}θ} {Π′θ \atop B_{2}θ, …, B_{n}θ, Γθ ⟶ B′_{1}θ}

Δ_{2}θ, …, Δ_{n}θ, Γθ ⟶ B′_{1}θ mc

is reducible by the outer induction hypothesis. Since we are given that Π_{1} is reducible, by Definition 3.7 the derivation Ξ_{2}

{Ξ_{1} \atop Δ_{2}θ, …, Δ_{n}θ, Γθ ⟶ B′_{1}θ} {Π′_{1}θ \atop B′_{1}θ, Δ_{1}θ ⟶ B′′_{1}θ}

Δ_{1}θ, …, Δ_{n}θ, Γθ ⟶ B′′_{1}θ mc

is reducible. Therefore the derivation

{Ξ_{2} \atop … ⟶ B′′_{1}θ} \left\{{Π_{i}θ \atop Δ_{i}θ ⟶ B_{i}θ}\right\}_{i∈\{2..n\}} {Π′′θ \atop B′′_{1}θ, \{B_{i}θ\}_{i∈\{2..n\}}, Γθ ⟶ Cθ} Δ_{1}θ, …, Δ_{n}θ, Γθ, Δ_{2}θ, …, Δ_{n}θ, Γθ ⟶ Cθ mc cL Δ_{1}θ, …, Δ_{n}θ, Γθ ⟶ Cθ ,

which is the reduct of Ξθ, is reducible by the outer induction hypothesis and Definition 3.7.

natR/natL: Π_{1} is

{Π′_{1} \atop Δ_{1} ⟶ nat I}

Δ_{1} ⟶ nat (s I)

natR

and Π is

{Π′ \atop ⟶ D z} {Π′′ \atop D j ⟶ D (s j)} {Π′′′ \atop D (s I), B_{2}, …, B_{n}, Γ ⟶ C} nat (s I), B_{2}, …, B_{n}, Γ ⟶ C natL .

Consider the derivation Ξ_{1}

{Π′_{1} \atop Δ_{1} ⟶ nat I} {Π′ \atop ⟶ D z} {Π′′ \atop D j ⟶ D (s j)} D I ⟶ D I init nat I ⟶ D I natL Δ_{1} ⟶ D I mc .

Since the measure of the right premise derivation is no larger than ht(Π), Ξ_{1} is reducible by induction on the reduction of Π_{1} (Π′_{1} is a predecessor of Π_{1}). Again recall that substitution for variables preserves reducibility (Lemma 3.9) and does not increase the measure of a derivation (Lemma 2.7). The derivation Ξ_{2}

\begin{matrix}{Ξ_{1}θ \atop Δ_{1}θ ⟶ Dθ Iθ} & {Π′′θ[Iθ/j] \atop Dθ Iθ ⟶ Dθ (s Iθ)} \\ Δ_{1}θ ⟶ Dθ (s Iθ) \end{matrix} mc

is then reducible by the outer induction hypothesis. Therefore the derivation

{Ξ_{2} \atop Δ_{1}θ ⟶ Dθ (s Iθ)} \left\{{Π_{i}θ \atop Δ_{i}θ ⟶ B_{i}θ}\right\}_{i∈\{2..n\}} {Π′′′θ \atop … ⟶ Cθ} Δ_{1}θ, …, Δ_{n}θ, Γθ ⟶ Cθ mc ,

which is the reduct of Ξθ, is reducible by the outer induction hypothesis.

def L/ ∘ L: Π_{1} and Π_{1}θ are

\begin{matrix}\{ & {Π_{1}^{ρ,σ,D} \atop Dσ, Δ′_{1}ρ ⟶ B_{1}ρ} & \} \\ A, Δ′_{1} ⟶ B_{1} \end{matrix} def L \begin{matrix}\{ & {Π_{1}^{θ∘ρ′,σ′,D} \atop Dσ′, Δ′_{1}θρ′ ⟶ B_{1}θρ′} & \} \\ Aθ, Δ′_{1}θ ⟶ B_{1}θ \end{matrix} def L .

The derivation Ξ^{ρ′,σ′,D}

{Π_{1}^{θ∘ρ′,σ′,D} \atop Dσ′, Δ′_{1}θρ′ ⟶ B_{1}θρ′} \left\{{Π_{i}θρ′ \atop Δ_{i}θρ′ ⟶ B_{i}θρ′}\right\}_{i∈\{2..n\}} {Πθρ′ \atop … ⟶ Cθρ′} Dσ′, Δ′_{1}θρ′, Δ_{2}θρ′, …, Δ_{n}θρ′, Γθρ′ ⟶ Cθρ′ mc .

is reducible by Lemmas 2.7 and 3.9 and induction on the reduction of Π_{1} (Π_{1}^{θ∘ρ′,σ′,D} is a predecessor of Π_{1}). Therefore the derivation

\left\{{Ξ^{ρ′,σ′,D} \atop Dσ′, Δ′_{1}θρ′, Δ_{2}θρ′, …, Δ_{n}θρ′, Γθρ′ ⟶ Cθρ′}\right\} Aθ, Δ′_{1}θ, Δ_{2}θ, …, Δ_{n}θ, Γθ ⟶ Cθ def L ,

which is the reduct of Ξθ, is reducible by Definition 3.7.

58 CHAPTER 3. CUT-ELIMINATION FOR F Oλ^{ΔIN}

−/ ⊃ R: Ξ has the form

{Π_{1} \atop Δ_{1} ⟶ B_{1}} ⋯ {Π_{n} \atop Δ_{n} ⟶ B_{n}} {Π′ \atop C′, B_{1}, …, B_{n}, Γ ⟶ C′′} ; B_{1}, …, B_{n}, Γ ⟶ C′ ⊃ C′′ ⊃ R Δ_{1}, …, Δ_{n}, Γ ⟶ C′ ⊃ C′′ mc .

Once again recall that substitution for variables preserves reducibility (Lemma 3.9) and does not increase the measure of a derivation (Lemma 2.7). The derivation Ξ_{1}

{Π_{1}θ \atop Δ_{1}θ ⟶ B_{1}θ} ⋯ {Π_{n}θ \atop Δ_{n}θ ⟶ B_{n}θ} {Π′θ \atop C′θ, B_{1}θ, …, B_{n}θ, Γθ ⟶ C′′θ}

C′θ, Δ_{1}θ, …, Δ_{n}θ, Γθ ⟶ C′′θ mc

is reducible by the outer induction hypothesis. For any substitutions θ′ and θ′′ and reducible derivation Ξ′, the derivation

{Ξ′θ′′ \atop (Δ′ ⟶ C′θθ′)θ′′} \left\{{Π_{i}θθ′θ′′ \atop (Δ_{i} ⟶ B_{i})θθ′θ′′}\right\}_{i∈\{1..n\}} {Π′θθ′θ′′ \atop (… ⟶ C′′)θθ′θ′′}

Δ′θ′′, Δ_{1}θθ′θ′′, …, Δ_{n}θθ′θ′′, Γθθ′θ′′ ⟶ C′′θθ′θ′′ mc

is reducible by the outer induction hypothesis. This is a reduct of Ξ_{2}θ′′, where Ξ_{2} is

{Ξ′ \atop Δ′ ⟶ C′θθ′} {Ξ_{1}θ′ \atop C′θθ′, Δ_{1}θθ′, …, Δ_{n}θθ′, Γθθ′ ⟶ C′′θθ′} Δ′, Δ_{1}θθ′, …, Δ_{n}θθ′, Γθθ′ ⟶ C′′θθ′ mc .

Since a reduct of Ξ_{2}θ′′ is reducible for every θ′′, by Definition 3.7 Ξ_{2} is reducible. Since Ξ_{1} is reducible and Ξ_{2} is reducible for every substitution θ′ and reducible derivation Ξ′, by Definition 3.7

{Ξ_{1} \atop C′θ, Δ_{1}θ, …, Δ_{n}θ, Γθ ⟶ C′′θ} ; Δ_{1}θ, …, Δ_{n}θ, Γθ ⟶ C′θ ⊃ C′′θ ⊃ R

is reducible. This last derivation is the reduct of Ξθ by the current reduction rule.

Corollary 3.12 Every derivation is reducible.

Proof This result follows immediately from Lemma 3.11 with n = 0.

Theorem 3.13 If a sequent is derivable, then there is a cut-free derivation of the sequent.

Proof This result follows immediately from Corollary 3.12, Lemma 3.8, and Lemma 3.4.

Since there is no right rule for ⊥, there is no cut-free derivation of ⟶ ⊥. Thus consistency is a simple corollary of cut-elimination.

Corollary 3.14 There is no F Oλ^{ΔIN} derivation of the sequent ⟶ ⊥.

3.4 Related Work

The logic F Oλ^{ΔIN} is related to Schroeder-Heister’s “logics with definitional reflection” [49]. He proved cut-elimination for two logics: the first without contraction but allowing arbitrary implications in definitions, the second with contraction but only implicationfree definitions. He also showed a counter-example to cut-elimination for the logic with both contraction and definitions with arbitrary implications, but conjectured that cutelimination should hold if the definitions were stratified (as we accomplish in F Oλ^{ΔIN} through the level restriction). The proof presented in this chapter clearly establishes that Schroeder-Heister’s conjecture is true.

However, there are significant differences between Schroeder-Heister’s logics and ours. The first is that F Oλ^{ΔIN} uses a stronger version of the left rule for definitions; Schroeder-Heister has extended his cut-elimination results to logics with this stronger rule [50]. More significantly, Schroeder-Heister has no induction rules in his logics. Because of the presence of the natL rule in F Oλ^{ΔIN}, Schroeder-Heister’s cut-elimination proofs do not extend to our setting.

The proof of cut-elimination presented in this chapter is patterned after Martin-Löf’s normalization proof for a natural deduction system with iterated inductive definitions [28]. Our work can be viewed as an extension of his to the sequent calculus setting: our rules for definitions and natural numbers roughly correspond to his introduction and elimination rules for inductively defined predicates.

Chapter 4

Reasoning about Transition

Systems in F Oλ^{ΔIN}

Cut-free sequent calculus proofs have been successfully used to encode the operational semantics of a wide range of computational systems. For example, the evaluation of functional programming languages and of their abstract machines have been specified in intuitionistic logic [4, 21, 22]; imperative and concurrency features have been modeled using linear logic programming languages [5, 6, 14, 36, 37]; and the sequential and concurrent (pipe-line) semantics of a RISC processor have also been specified in linear logic [6]. But we would like to extend our use of logic beyond specifying computation to reasoning about it. One of the interesting and important properties of a computational system is the set of equivalences among terms that the system suggests. Bisimulation [42] is a natural and widely-used equivalence relation that has grown out of the study of concurrency. Informally, two terms are bisimilar if every computational step that applies to either of the terms also applies to the other, and applying the step to both terms will result in two new terms that are also bisimilar. This requirement that every possible step in the computation of a term be matched in the computation of another term cannot be expressed with the natural representation of the computation system as a logical theory. When the system is encoded as a definition, however, such a requirement is easily captured. In this chapter, we show that in this way the definition facility of F Oλ^{ΔIN} makes it possible to go beyond operational 62 CHAPTER 4. REASONING ABOUT TRANSITION SYSTEMS IN F Oλ^{ΔIN}

semantics and both encode and reason about concepts such as simulation and bisimulation. This chapter presents work previously reported in [32], coauthored with Miller and Palamidessi.

4.1 Background

The triple T = (Λ, S, δ) is an abstract transition system (ats) if Λ is a non-empty set of actions, S is a non-empty set of states, and δ ⊆ S × Λ × S (Λ and S are assumed to be disjoint). We write p ⟶^{a} q if (p, a, q) ∈ δ. For w ∈ Λ^{∗} we write p ⟹^{w} q to mean that p makes a transition to q along a path of actions given by w. More formally, this relation is defined by induction on the length of w: thus p ⟹^{ϵ} p (where ϵ is the empty string) and if

p ⟶^{a} r and r ⟹^{w} q then p ⟹^{aw} q. For a state p, define ⟨⟨p⟩⟩ = {(a, q) | (p, a, q) ∈ δ}. The

ats T is finitely branching if, for each p, the set ⟨⟨p⟩⟩ is finite. T is noetherian if it contains no infinite paths. In a noetherian ats we can define the measure of a state p, denoted by meas(p), as the ordinal number given by

meas(p) = lub({meas(q) + 1 | p ⟶^{a} q for some a}) ,

where we assume lub(∅) = 0. If the ats is finitely branching then all its states have finite measure.

The notions of simulation and bisimulation provide important judgments on pairs of states in an abstract transition system. A relation R is a simulation between p and q if and only if for every transition p ⟶^{a} p′, there exists a transition q ⟶^{a} q′, such that p′Rq′. The largest such relation is written ⊑; that is, p ⊑ q (read “q simulates p”) if and only if there exists a simulation R such that pRq. If p ⊑ q and q ⊑ p both hold, then p and q are similar.

A relation R is a bisimulation between p and q if and only if for every transition p ⟶^{a} p′, there exists a transition q ⟶^{a} q′ such that p′Rq′, and for every transition q ⟶^{a} q′, there exists a transition p ⟶^{a} p′ such that q′Rp′. The largest such relation is called the bisimulation equivalence and is denoted by ≡; that is, p ≡ q (read “p is bisimilar to q”) if and only if there exists a bisimulation R such that pRq. It is well-known that bisimilarity implies similarity but not vice-versa.

Table 4.1: CCS transition rules

a.p ⟶^{a} p {p ⟶^{a} q \atop p | r ⟶^{a} q | r}  {p ⟶^{a} q \atop r | p ⟶^{a} r | q}  \begin{matrix}p ⟶^{a} r & q ⟶^{ā} s \\ p | q ⟶^{τ} r | s \end{matrix}
{p ⟶^{a} q \atop p + r ⟶^{a} q}  {r ⟶^{a} q \atop p + r ⟶^{a} q}  {p[μ_{x}p/x] ⟶^{a} q \atop μ_{x}p ⟶^{a} q}

To illustrate our results, we will consider throughout the chapter a more concrete example of an abstract transition system: the concurrent language CCS [40]. For convenience, we ignore the renaming and hiding combinators, and concentrate on the sublanguage described by the grammar

p ::= 0 | a.p | p + p | p | p | μ_{x}p ,

where a ranges over an arbitrary set of actions A, the set of the complementary actions Ā, and {τ}. The intended meaning of these symbols is as follows: 0 represents the inactive process, a.p represents a process prefixed by the action a, + and | are choice and parallel composition, respectively, and μ_{x} is the least fixed point operator, providing recursion. The operational semantics of CCS is specified by the transition rules in Table 4.1.

CCS can be seen as an abstract transition system where Λ = A∪Ā∪{τ}, S is the set of all expressions denoting CCS expressions, and δ is the set of transitions which are derivable by the rules above. A finite CCS process is a CCS process that does not contain μ. If S is restricted to the set of all finite CCS processes, then the resulting ats is noetherian.

4.2 Encoding Abstract Transition Systems

In this section we give an encoding of abstract transition systems in the logic F Oλ^{ΔIN}. Let (Λ, S, δ) be an ats, and let the primitive types σ and α denote elements of S and Λ, respectively. Let one : σ → α → σ → o be a predicate of three arguments denoting the one step transition relation and let the definition D(ats(δ)) contain the clause one p a q =^{△} ⊤ for every (p, a, q) ∈ δ. This definition is essentially a table. We also need the following 64 CHAPTER 4. REASONING ABOUT TRANSITION SYSTEMS IN F Oλ^{ΔIN}

definition D(path):

multi P nil P =^{△} ⊤ multi P (A :: W) Q =^{△} ∃r(one P A r ∧ multi r W Q) .

The predicates one and multi are assumed to have level 0. Here, members of Λ^{∗} are represented as terms of type lst(α) using nil : lst(α) for the empty list and :: of type α → lst(α) → lst(α) for the list constructor. We now prove the adequacy of this encoding.

Proposition 4.1 Let (Λ, S, δ) be an ats. Then p ⟹^{w} q if and only if (multi p w q) is derivable in F Oλ^{ΔIN} using definition D(ats(δ)) ∪ D(path).

Proof We prove this proposition by induction with respect to the length l of the path w. The key idea is to show that the transition along the path matches faithfully a certain sequence of inference rules in the derivation.

If l = 0, then p ⟹^{ϵ} p holds by definition, and the proposition multi p nil p is derivable:

⟶ ⊤ ⊤R ⟶ multi p nil p def R .

If l > 0, consider the path p ⟶^{a} r ⟹^{w′} q. Observe that a derivation of the sequent ⟶ multi p (a :: w′) q must end in the following way, since at each point no other rule applies:

\begin{matrix}⟶ ⊤ & ⊤R \\ ⟶ one p a r \end{matrix}def R ⟶ multi r w′ q ⟶ one p a r ∧ multi r w′ q ∧R ⟶ ∃r′(one p a r′ ∧ multi r w′ q) ∃R ⟶ multi p (a :: w′) q def R .

By the construction of D(ats(δ)), the sequent ⟶ one p a r is derivable if and only if p ⟹^{a} r, and by the inductive hypothesis, ⟶ multi r w′ q is derivable if and only if

r ⟹^{w′} q.

The encoding D(ats(δ)) is based on an extensional description of δ, hence the definition will be infinite if δ is infinite. In specific transition systems the transition relation might be described intentionally. This is the case for CCS, whose transitions can be encoded as the following definition D(ccs(A)) for any non-empty set A of actions:

one A.P A P =^{△} ⊤ one (P | R) A (Q | R) =^{△} one P A Q one (R | P) A (R | Q) =^{△} one P A Q one (P + R) A Q =^{△} one P A Q one (P + R) A Q =^{△} one R A Q one μM A Q =^{△} one (M μM) A Q one (P | Q) τ (R | S) =^{△} ∃a∃b(comp a b ∧ one P a R ∧ one Q b S)] ,

plus the clauses comp a ā =^{△} ⊤ and comp ā a =^{△} ⊤ for every a ∈ A. We assume τ : α ∉ A.

Observe that we are using meta-level λ-abstraction to encode μ_{x}P: such a term is represented as μM, where M is meant to be the abstraction λx.P. Thus the term P [μ_{x}P/x] can be represented simply by M(μM) without introducing an explicit notion of substitution (β-conversion in the meta-logic can perform substitution for us).

The following result shows that CCS transitions are completely described by logical derivability in D(ccs(A)).

Proposition 4.2 The CCS transition p ⟶^{a} q holds if and only if the formula (one p a q) is derivable in F Oλ^{ΔIN} using definition D(ccs(A)). The transition p ⟹^{w} q holds if and only if (multi p w q) is derivable using definition D(ccs(A)) ∪ D(path).

This theorem can be proved by simple structural induction by showing that derivations using the inference rules in Table 4.1 for CCS are essentially identical to F Oλ^{ΔIN} derivations over the corresponding clauses in the definition ccs(A). As in the proof of Proposition 4.1, the F Oλ^{ΔIN} derivations involve only right introduction rules.

4.3 Encoding Simulation and Bisimulation

4.3.1 Finite Behavior

We now consider encodings of simulation and bisimulation relations between states in a transition system. If we represent the transition step by the predicate one (as in the 66 CHAPTER 4. REASONING ABOUT TRANSITION SYSTEMS IN F Oλ^{ΔIN}

definitions D(ats(δ)) and D(ccs(A))), then it is possible to characterize simulation and bisimulation as predicates sim and bisim given by the following definition D(sims):

sim P Q =^{△} ∀a∀p′(\begin{matrix}one P a p′ ⊃ \\ ∃q′(one Q a q′ ∧ sim p′ q′)) \end{matrix}

bisim P Q =^{△} ∀a∀p′(\begin{matrix}one P a p′ ⊃ \\ ∃q′(one Q a q′ ∧ bisim p′ q′)) ∧ \end{matrix}

∀a∀q′(\begin{matrix}one Q a q′ ⊃ \\ ∃p′(one P a p′ ∧ bisim q′ p′)) . \end{matrix}

Since the level of one is 0, we need to assign to both sim and bisim the level 1 (or higher).

We proceed now to prove the correctness of these encodings. To do so, we introduce two new items. First, given a fixed ats (Λ, S, δ) and a pair (p, q) ∈ S × S, a premise set for (p, q) is a set P ⊆ S × S such that for every a ∈ Λ and p′ ∈ S such that (a, p′) ∈ ⟨⟨p⟩⟩ there exists a q′ ∈ S such that (a, q′) ∈ ⟨⟨q⟩⟩ and (p′, q′) ∈ P. Premise sets need not exist, but if there is a simulation R that contains (p, q) then there is a premise set P for that pair such that P ⊂ R. We can restrict premise sets to be minimal, although this is not strictly necessary. Second, we introduce the following inference rules:

{\{⟶ sim p′ q′ | (p′, q′) ∈ P\} \atop ⟶ sim p q} SIM
{⟶ bisim p′ q′ | (p′, q′) ∈ P} ∪ {⟶ bisim q′ p′ | (q′, p′) ∈ Q} ⟶ bisim p q BISIM ,

where P is a premise set for (p, q) and Q is a premise set for (q, p). Notice that this rule is finitary if the ats is finitely branching. In the case of CCS, one condition which guarantees this property is that recursion variables in bodies of μ-terms only occur prefixed.

Let ⊢_{SIM} Δ ⟶ C (respectively, ⊢_{BISIM} Δ ⟶ C) denote the proposition that the sequent Δ ⟶ C can be derived using only the SIM (respectively, BISIM) inference rule. The following lemma shows that these proof systems are a correct and complete representation of our encodings.

Lemma 4.3 Let (Λ, S, δ) be an ats, let p and q be members of S, and let ⊢ denote derivability in F Oλ^{ΔIN} using definition D(ats(δ)) ∪ D(sims). Then 4.3. ENCODING SIMULATION AND BISIMULATION 67

• ⊢ sim p q if and only if ⊢_{SIM} sim p q, and

• ⊢ bisim p q if and only if ⊢_{BISIM} bisim p q.

The same holds if we replace D(ats(δ)) by D(ccs(A)).

Proof We outline the proof of the first case; the second can be done similarly. Consider a derivation of the sequent ⟶ sim p q. This is derivable only by a def R rule using D(sims), and thus the sequents

⟶ ∀a∀p′(one p a p′ ⊃ ∃q′(one q a q′ ∧ sim p′ q′))

and

one p a p′ ⟶ ∃q′(one q a q′ ∧ sim p′ q′)

must be derivable. If this latter sequent is derivable, there is a derivation of it ending with def L, and thus the sequent

⟶ ∃q′(one q a_{0} q′ ∧ sim p′_{0} q′)

must be derivable, where the pair (a_{0}, p′_{0}) ranges over ⟨⟨p⟩⟩. This sequent is derivable only if the quantifier ∃q′ is instantiated with q′_{0} where (a_{0}, q′_{0}) ∈ ⟨⟨q⟩⟩. Let P be the premise set arising from collecting together all pairs (p′_{0}, q′_{0}) for such values p′_{0} and q′_{0}. Thus, our original sequent is derivable if and only if for every (p′_{0}, q′_{0}) ∈ P the sequent ⟶ sim p′_{0} q′_{0} is derivable. The other direction follows by reversing these reasoning steps.

We can now use this lemma to prove the correctness of our encodings of simulation and bisimulation.

Theorem 4.4 Let (Λ, S, δ) be a noetherian ats, let p and q be members of S, and let ⊢ denote derivability in F Oλ^{ΔIN} using definition D(ats(δ)) ∪ D(sims). Then

• ⊢ sim p q if and only if p ⊑ q, and

• ⊢ bisim p q if and only if p ≡ q.

Proof Again we only show the proof for simulation; the proof for bisimulation is similar.

68 CHAPTER 4. REASONING ABOUT TRANSITION SYSTEMS IN F Oλ^{ΔIN}

Given Lemma 4.3, we need only show that ⊢_{SIM} p ⟶ q if and only if q simulates p. First, assume that the sequent p ⟶ q has a derivation that contains only the SIM inference rule. Let R be the set of all pairs (r, s) such that the sequent r ⟶ s has an occurrence in that derivation. It is an easy matter to verify that R is a simulation.

Conversely, assume that q simulates p. Thus there is a simulation R such that pRq. The proof is by induction on the measure of p, meas(p). Since pRq, there is a premise set P ⊆ R for (p, q). If (p′, q′) ∈ P, then p′Rq′ and meas(p′) < meas(p), so we have by the induction hypothesis ⊢_{SIM} p′ ⟶ q′. Thus, we have derived ⊢_{SIM} p ⟶ q.

Concerning CCS, the full language is not noetherian because of the presence of the recursion operator. If we consider only terms without μ, i.e. finite processes, then the same property holds, as is witnessed by the following theorem. We omit the proof of this theorem since it is essentially like the preceding proof: the main difference is that the definition of one-step transitions in CCS is given by recursion.

Theorem 4.5 Let p and q be finite CCS processes, and let ⊢ denote derivability in F Oλ^{ΔIN} using definition D(ccs(A)) ∪ D(sims). Then

• ⊢ sim p q if and only if p ⊑ q, and

• ⊢ bisim p q if and only if p ≡ q.

4.3.2 Definitions and Fixed Points

As we mentioned in Section 2.1, a definition can be seen as a mutually recursive definition for the predicates that are present in the heads of clauses. To make the notion of recursive definition more explicit, we consider in more detail the definitions used in the previous section. For a general discussion of using stratified specifications to provide for mutually recursive predicate definitions, see, for example, [2].

The clauses for defining the level 0 predicate one (both for abstract transition systems and for CCS) can be seen as simple Horn clauses (when =^{△} is read as a reverse implication). The usual means for providing meaning to Horn clauses by seeing them as a monotone mapping on the Herbrand universe [1] can be exploited here as well. In particular, we can observe that if we remove the one clause of the CCS definition pertaining to μ (that is, 4.3. ENCODING SIMULATION AND BISIMULATION 69

if we do not allow processes to contain occurrences of the fixed point operator) then the resulting definition for one would yield an operator on the Herbrand universe with exactly one fixed point. We shall take this fixed point as the meaning of the definition for one.

Simulation and bisimulation are predicates of level 1 using recursive definitional clauses of the form ∀P ∀Q[r(P, Q) =^{△} Φ], where the formula Φ contains free occurrences of the variables P, Q, strictly positive occurrences of the predicate r, and both positive and negative occurrences of the predicate one. With such a clause we associate a function ϕ from binary relations to binary relations. Given the structure of Φ it is easy to see that ϕ will be monotone and thus have fixed points: in general, however, there will be more than one such fixed point.

Notice that both def L and def R are sound for all the relations which are fixed points of ϕ. To see this, assume that for any relation r there is only one such definitional clause (in case there are more, we group them in one clause which has as body the disjunction of the bodies). Then observe that the use of def L corresponds to replacing =^{△} by ⊃ in the clause, that is, to assuming the formula ∀P ∀Q[r(P, Q) ⊃ Φ]. The case for def R corresponds to the converse: that is, of replacing =^{△} with ⊂.

Let Φ_{s} and Φ_{b} be the bodies of the clauses given in D(sims) for sim and bisim, respectively, and consider the corresponding functions ϕ_{s} and ϕ_{b} on binary relations associated with these formulas. More explicitly, we may define these two functions on binary relations as follows:

ϕ_{s}(R) := \{(p, q) | \begin{matrix}for all a ∈ Λ and p′ ∈ S, if p ⟶^{a} p′ \\ then there is a q′ such that q ⟶^{a} q′ and (p′, q′) ∈ R\} \end{matrix}

ϕ_{b}(R) := \{(p, q) | \begin{matrix}for all a ∈ Λ and p′ ∈ S, if p ⟶^{a} p′ \\ then there is a q′ such that q ⟶^{a} q′ and (p′, q′) ∈ R, and \\ for all a ∈ Λ and q′ ∈ S, if q ⟶^{a} q′ \\ then there is a p′ such that p ⟶^{a} p′ and (q′, p′) ∈ R\} . \end{matrix}

We can see from their definitions that ⊑ and ≡ are the greatest fixed points of ϕ_{s} and ϕ_{b}, respectively. Notice that in derivations of ⟶ sim p q and ⟶ bisim p q using the definition D(ats(δ)) ∪ D(sims), def L is used on clauses in D(ats(δ)) but not with those in D(sims).

70 CHAPTER 4. REASONING ABOUT TRANSITION SYSTEMS IN F Oλ^{ΔIN}

As the following example shows, when the transition system is not noetherian, the “if” parts of Theorem 4.4 may not hold.

Example 4.6 Consider a transition system with two states only, p and q, and two transitions p ⟶^{a} p and q ⟶^{a} q. Then p ⊑ q holds, but sim p q cannot be derived. Notice that an attempt to derive it would end up in a circularity.

Since def L and def R are sound in all fixed points, if sim p q is derivable in F Oλ^{ΔIN} using D(ats(δ)) ∪ D(sims), then (p, q) must be contained in every fixed point of ϕ_{s}. In a noetherian abstract transition system, ϕ_{s} and ϕ_{b} have unique fixed points, and it is for this reason that ⊑ and ≡ can be completely characterized in a noetherian ats by derivability (Theorem 4.4).

Before proceeding to consider an encoding that captures the greatest fixed point of ϕ_{s} and ϕ_{b}, we briefly explore the kinds of properties about simulation and bisimulation that we can derive in F Oλ^{ΔIN} with D(sims).

In any transition system, bisimulation is symmetric; the encoding of this property is derivable in F Oλ^{ΔIN}:

Proposition 4.7 The formula ∀p∀q(bisim p q ⊃ bisim q p) is derivable in F Oλ^{ΔIN} using the definition D(ats(δ)) ∪ D(sims).

In CCS, bisimulation is preserved by the prefix operator; the encoding of this property is also derivable in F Oλ^{ΔIN}:

Proposition 4.8 The formula ∀a∀p∀q(bisim p q ⊃ bisim a.p a.q) is derivable in F Oλ^{ΔIN} using the definition D(ccs(A)) ∪ D(sims).

However, as the following examples illustrate, there are plenty of true properties of ≡ and ⊑ that cannot be derived within the logic. One reason for this lack is, intuitively, we can prove properties of sim and bisim from D(sims) only if they are true for every fixed point of ϕ_{s} and ϕ_{b}, but in the non-noetherian case, there is in general more than one fixed point.

Example 4.9 Bisimulation equivalence implies the largest simulation (or more formally: ≡ is a subset of ⊑) in any transition system. This property can be expressed by the formula 4.3. ENCODING SIMULATION AND BISIMULATION 71

∀p∀q(bisim p q ⊃ sim p q) but, in general, if δ is a non-noetherian transition relation, this formula cannot be derived using the definitions D(ats(δ)) and D(sims). For example, if we take the transition system ({a}, {p}, {(p, a, p)}) it is immediate to see that {(p, p)} is a bisimulation (the greatest fixed point of ϕ_{b}, namely bisimulation equivalence) and ∅ is a simulation (the least fixed point of ϕ_{s}). Hence, this formula cannot be derived for this transition system.

Example 4.10 The bisimulation equivalence relation is reflexive in any transition system, but the formula ∀p(bisim p p) cannot be derived using the definitions D(ats(δ)) and D(sims). Consider, for instance, the same transition system as in Example 4.9: the empty set ∅ is a bisimulation (the least fixed point of ϕ_{b}), and it is, of course, not reflexive.

Example 4.11 In CCS, bisimulation equivalence is preserved by the + operator. This property can be expressed as the formula ∀p∀q∀r(bisim p q ⊃ bisim (p + r) (q + r)). This sequent, however, cannot be derived using D(ccs(A)) and D(sims). If we let p = a.0, q = a.0 + a.0 and r = μ_{x}a.x, the least fixed point of ϕ_{b} contains the pair (a.0, a.0 + a.0) but not the pair (a.0 + μ_{x}a.x, a.0 + a.0 + μ_{x}a.x).

4.3.3 Non-Finite Behavior

We now provide an encoding of simulation and bisimulation that uses induction to capture the greatest fixed point. In particular, define the binary relations ⊑_{i} and ≡_{i} for each natural number i as follows. Both ⊑_{0} and ≡_{0} are defined to be S × S, and ⊑_{i+1}:= ϕ_{s}(⊑_{i}) and ≡_{i+1}:= ϕ_{b}(≡_{i}). Now set ⊑_{ω}:= ⋂_{i} ⊑_{i} and ≡_{ω}:= ⋂_{i} ≡_{i}. It is well known that, for finitely branching transition systems, ϕ_{s} and ϕ_{b} are downward-continuous and, hence, ⊑ equals ⊑_{ω} and ≡ equals ≡_{ω}. In CCS, for instance, finite branching is guaranteed whenever all the recursion variables in μ-expressions are prefixed.

Thus one approach to showing that two states are bisimilar is to show that for all natural numbers i, those two states are related by ≡_{i}. Such statements can often be proved by induction on natural numbers. If n is a natural number, then we write n̄ to denote the corresponding “numeral” for n, that is, n̄ is the term containing n occurrences of s and one occurrence of z.

72 CHAPTER 4. REASONING ABOUT TRANSITION SYSTEMS IN F Oλ^{ΔIN}

Table 4.2: Indexed definition for simulation and bisimulation

sim P Q =^{△} ∀k(nat k ⊃ isim k P Q)
isim z P Q =^{△} ⊤
isim (s K) P Q =^{△} ∀a∀p′(\begin{matrix}one P a p′ ⊃ \\ ∃q′(one Q a q′ ∧ isim K p′ q′)) \end{matrix}
bisim P Q =^{△} ∀k(nat k ⊃ ibisim k P Q)
ibisim z P Q =^{△} ⊤
ibisim (s K) P Q =^{△} ∀a∀p′(\begin{matrix}one P a p′ ⊃ \\ ∃q′(one Q a q′ ∧ ibisim K p′ q′))∧ \end{matrix}

∀a∀q′(\begin{matrix}one Q a q′ ⊃ \\ ∃p′(one P a p′ ∧ ibisim K q′ p′)) \end{matrix}

We can now encode ⊑_{i} and ≡_{i} by using the indexed versions of sim and bisim found in the definition D(isims) shown in Table 4.2.

Lemma 4.12 Let (Λ, S, δ) be an ats, let p and q be members of S, and let ⊢ denote derivability in F Oλ^{ΔIN} using definition D(ats(δ)) ∪ D(isims).

• If ⊢ sim p q then for every natural number n, ⊢ isim n̄ p q.

• If ⊢ bisim p q then for every natural number n, ⊢ ibisim n̄ p q.

Proof We prove the first result about simulation: the result about bisimulation is similar. A cut-free derivation of the sequent ⟶ sim p q must end in a def R rule, which (using ∀R and ⊃ R also) means that the sequent nat k ⟶ isim k p q is derivable, where k is a variable. Call this derivation Ξ. Now let n be a natural number. It is possible to substitute n̄ for the variable k into the derivation Ξ to obtain the derivation Ξ[n̄/k] of the sequent nat n̄ ⟶ isim n̄ p q. Given that n is a natural number, it is easy to construct a cut-free derivation of ⟶ nat n̄, one using only the right rules for nat. Now placing these two derivations together with a cut rule yields

⟶ nat n̄ nat n̄ ⟶ isim n̄ p q ⟶ isim n̄ p q cut .

Given the cut-elimination result for F Oλ^{ΔIN} (Theorem 3.13), we can conclude that ⟶ 4.3. ENCODING SIMULATION AND BISIMULATION 73

isim n̄ p q has a cut-free derivation (a conclusion that is needed in the proof of Proposition 4.13 below).

Proposition 4.13 Let (Λ, S, δ) be an ats, let p and q be members of S, let n be a natural number, and let ⊢ denote derivability in F Oλ^{ΔIN} using definition D(ats(δ)) ∪ D(isims).

• If ⊢ isim n̄ p q then p ⊑_{n} q.

• If ⊢ ibisim n̄ p q then p ≡_{n} q.

Proof We prove the first result about simulation: the result about bisimulation is similar. Assume that n is 0. Then p ⊑_{0} q holds immediately. Otherwise, let n be m + 1. Assume that isim s m̄ p q has a cut-free derivation. An analysis of the inference rules used to derive this sequent (as we argued similarly in Section 4.3.1) shows that that for some premise set P, there is a subderivation of the sequent ⟶ isim m̄ p′ q′ for every (p′, q′) ∈ P. Using the inductive assumption, p′ ⊑_{m} q′ for all (p′, q′) ∈ P. Hence, by the definition of ϕ_{s}, we have p ⊑_{m+1} q.

Putting these results together with the one mentioned earlier regarding when ϕ_{s} and ϕ_{b} are downward continuous, we can prove the following.

Theorem 4.14 Let (Λ, S, δ) be an ats, and let p and q be members of S.

• If (sim p q) is derivable in F Oλ^{ΔIN} using definition D(ats(δ))∪D(isims), then p ⊑_{ω} q.

• If (bisim p q) is derivable in F Oλ^{ΔIN} using definition D(ats(δ)) ∪ D(isims), then p ≡_{ω} q.

If the abstract transition system is finitely branching, then we can conclude the stronger fact that p ⊑ q or p ≡ q.

With this indexed definition it is now possible to derive many properties of simulation and bisimulation.

Theorem 4.15 The following formulas can be derived in F Oλ^{ΔIN} using the definition D(ccs(A)) ∪ D(isims):

∀p∀q(bisim p q ⊃ sim p q) ∀p∀q∀r(bisim p q ⊃ bisim (p + r) (q + r))

74 CHAPTER 4. REASONING ABOUT TRANSITION SYSTEMS IN F Oλ^{ΔIN}

∀p∀q(bisim p q ⊃ bisim q p) ∀a∀p∀q(bisim p q ⊃ bisim a.p a.q)
∀p∀q∀r(bisim p q ⊃ bisim q r ⊃ bisim p r) ∀a bisim μ_{x}a.x μ_{x}(a.x + a.x)
∀p bisim p p  ∀p bisim (p + 0) p  ∀p bisim (p + p) p .

4.4 Conclusion

We have shown that the definitional facilities of F Oλ^{ΔIN} allow us to naturally capture certain properties about elements of transition systems, namely simulation and bisimulation. Furthermore, with induction over natural numbers we can establish more high-level facts about these properties, such as the fact that bisimulation is an equivalence.

From a high-level point-of-view, we can characterize the experiments we have reported here in two ways. From a (traditional) logic programming point of view, a definition D is generally either a set of (positive) Horn clauses or an extension of them that allows negated atoms in the body of clauses. In that case, sequents in a derivation of an atomic formula are either of the form ⟶ B or B ⟶. In the first case, def R is used to establish B and, in the second case, def L is used to build a finite refutation of B. Here we consider richer definitions so that the search for deriations must consider sequents of the form B ⟶ C; with such sequents, both left and right introduction of definitions are used together. From a computational or concurrency point-of-view, derivations using just def R only capture the may behavior of a system: “there exists a computation such that …” is easily translated to “there exists a derivation of …”. The addition of the def L inference rule allows certain forms of must behavior to be captured.

Chapter 5

Reasoning about Logics in F Oλ^{ΔIN}

In Chapter 4 we showed how the logic F Oλ^{ΔIN} can be used to reason about transition systems. The only variable-binding constructor that we considered was the CCS μ constructor allowing the recursive description of processes; in that setting, higher-order abstract syntax played only a minor role. We now turn our attention to object systems where bound variables and substitution are more prominent and thus higher-order abstract syntax becomes more important. In this chapter we consider intuitionistic and linear logics; we proceed to reason about programming languages in Chapter 6.

Since F Oλ^{ΔIN} contains quantification at higher-order types and term structures involving λ-terms, it easily supports higher-order abstract syntax. Eriksson [12] demonstrated the use of his finitary calculus of partial inductive definitions (which is similar to F Oλ^{ΔIN}) for the specification of various logics and type systems using higher-order abstract syntax. Our goal is to go a step beyond that and also reason within F Oλ^{ΔIN} about the object systems. As we set about to do so, we encounter some difficulties in reasoning about higherorder abstract syntax specifications within the specification logic and develop strategies for surmounting those difficulties.

We begin the first section of this chapter by presenting the usual higher-order abstract syntax representation of intuitionistic logic and illustrating the problems alluded to above. We then proceed through several modifications of this encoding which improve our ability to perform meta-theoretic analyses, although at some loss of the benefits of higher-order abstract syntax. In Section 5.2 we further illustrate these encoding techniques through two 76 CHAPTER 5. REASONING ABOUT LOGICS IN F Oλ^{ΔIN}

examples involving fragments of intuitionistic and linear logic. The specifications of these two logics will also be used in Chapter 6 as part of an alternative strategy for formal reasoning with higher-order abstract syntax that retains the full benefits of this representation style. We conclude this chapter with a section discussing related work.

5.1 Logic Representations for Meta-Theoretic Analysis

5.1.1 Natural Deduction-Style Encoding

In order to examine our ability to reason about higher-order abstract syntax encodings in F Oλ^{ΔIN}, we present a definition of first-order intuitionistic logic. We use the type i for terms of the object logic, the type atm for atoms (atomic propositions) and the type prp for general propositions; we also introduce the following constants:

⟨ ⟩ : atm → prp  & : prp → prp → prp  ⋀i : (i → prp) → prp tt : prp  ⊕ : prp → prp → prp  ⋁i : (i → prp) → prp ff : prp  ⇒ : prp → prp → prp .

The constant ⟨ ⟩ coerces atoms into propositions: object-level predicates will be constants that build meta-level terms of type atm. The constants tt and ff are the representations of true and false, the constants &, ⊕, and ⇒ represent the conjunction, disjunction, and implication connectives, and ⋀i and ⋁i encode universal and existential quantification at type i. Notice that we are using the λ-abstraction of F Oλ^{ΔIN}’s term language to represent the variable binding of the two object logic quantifiers. As a result, α-equivalence of quantified object logic formulas follows from the α-equivalence of λ-bound terms in F Oλ^{ΔIN}, and substitution for object logic variables can be accomplished by β-reduction at the level of F Oλ^{ΔIN} terms.

Derivability in the object logic is encoded via the predicate prove of type prp → o; the usual higher-order abstract syntax encoding of this predicate is the theory shown in Table 5.1. The first seven clauses correspond to the introduction rules for natural deduction; the remaining seven correspond to the elimination rules.

Although this encoding mirrors the rules for natural deduction, it may be viewed as an encoding of the sequent calculus, with the derivability of the sequent B_{1}, …, B_{n} ⟶ C

Table 5.1: Natural deduction encoding of intuitionistic logic

prove tt ⊂ ⊤
prove (B & C) ⊂ prove B ∧ prove C
prove (B ⊕ C) ⊂ prove B
prove (B ⊕ C) ⊂ prove C
prove (B ⇒ C) ⊂ prove B ⊃ prove C
prove ⋀i B ⊂ ∀ix prove (B x)
prove ⋁i B ⊂ ∃ix prove (B x)
prove B ⊂ prove ff
prove B ⊂ ∃c prove (B & c)
prove C ⊂ ∃b prove (b & C)
prove D ⊂ ∃b∃c(prove (b ⊕ c) ∧ (prove b ⊃ prove D) ∧ (prove c ⊃ prove D))
prove C ⊂ ∃b(prove (b ⇒ C) ∧ prove b)
prove (B X) ⊂ prove ⋀i B
prove C ⊂ ∃b(prove ⋁i b ∧ (∃ix prove (b x) ⊃ prove C))

represented by the F Oλ^{ΔIN} formula

prove B_{1} ⊃ ⋯ ⊃ prove B_{n} ⊃ prove C .

This is in keeping with the higher-order abstract syntax principle of using specification logic hypotheses to represent contexts (in this case, the left side of the sequent). The structural rules (exchange, weakening, and contraction) follow immediately from this representation; for example, the derivation for weakening is

prove c, prove b ⟶ prove c init ⊃ R ⟶ prove c ⊃ (prove b ⊃ prove c) ∀R ⟶ ∀b∀c(prove c ⊃ (prove b ⊃ prove c)) .

The admissibility of the cut rule, encoded by the formula

∀b∀c((prove b ⊃ prove c) ⊃ prove b ⊃ prove c) ,

also follows easily from the ⊃ L rule. The right rules are the same as the corresponding introduction rules, and the left rules are easily derived from the clauses for the corresponding elimination rules. The left rule for ⋀i, for instance, is encoded by the F Oλ^{ΔIN} formula

∀b∀c(∃x(prove (b x) ⊃ prove c) ⊃ (prove ⋀i b ⊃ prove c)) ,

78 CHAPTER 5. REASONING ABOUT LOGICS IN F Oλ^{ΔIN}

whose derivation is evident from the clause for the elimination rule for ⋀i.

However, this encoding is not appropriate for meta-theoretic analysis of object logic derivations. To do such analysis in F Oλ^{ΔIN}, we need to be able to perform induction over the derivations. Recall that in Section 2.2.2 we used the natural number measure in the length predicate to derive an induction principle for lists. But there is no apparent way to add a natural number induction measure to the prove predicate because of the clause for the ⇒ introduction rule. This reflects the fact that this clause gives rise to a non-monotone operator (cf. Section 4.3.2); this is generally true of the types and theories in higher-order abstract syntax encodings, and makes inductive principles difficult to find. We would also like to change the specification into a definition so that we can use the def L rule for the analysis of derivations. Simply replacing the ⊂ in each clause by =^{△} is problematic for two reasons. First, the clause resulting from the introduction rule for ⇒ would not satisfy the level restriction for any level we might assign to prove. Second, the clause resulting from the elimination rule for ⋀i would have a problematic head. There are too many ways that (B X) can match and unify with other terms; this makes the practical application of the def R and def L rules difficult, and would result in many cases that are not productive.

5.1.2 Sequent-Style Encoding

We can solve the problems with the encoding of the introduction rule for ⇒ by introducing separate predicates

hyp : prp → o  conc : nt → prp → o

for the left and right sides of the sequent, respectively. The predicate hyp will not be a defined predicate, and so can have level zero. The negative occurrence of prove in the introduction clause for ⇒ becomes an occurence of hyp, so the predicate conc can then have level one. This also makes possible the assignment of a measure to conc, as suggested by its type. To emphasize that the first argument to conc is a measure, we will write it as a subscript. The problem introduced by the elimination clause for ⋀i is avoided by patterning the encoding after the sequent calculus rules rather than natural deduction rules. The resulting definition is shown in Table 5.2. The first clause encodes the initial

Table 5.2: Sequent calculus encoding of intuitionistic logic

conc_{I} ⟨A⟩ =^{△} hyp ⟨A⟩
conc_{I} tt =^{△} ⊤
conc_{(s I)} (B & C) =^{△} conc_{I} B ∧ conc_{I} C
conc_{(s I)} (B ⊕ C) =^{△} conc_{I} B
conc_{(s I)} (B ⊕ C) =^{△} conc_{I} C
conc_{(s I)} (B ⇒ C) =^{△} hyp B ⊃ conc_{I} C
conc_{(s I)} ⋀i B =^{△} ∀ix conc_{I} (B x)
conc_{(s I)} ⋁i B =^{△} ∃ix conc_{I} (B x)
conc_{I} B =^{△} hyp ff
conc_{(s I)} D =^{△} ∃b∃c(hyp (b & c) ∧ (hyp b ⊃ conc_{I} D))
conc_{(s I)} D =^{△} ∃b∃c(hyp (b & c) ∧ (hyp c ⊃ conc_{I} D))
conc_{(s I)} D =^{△} ∃b∃c(hyp (b ⊕ c) ∧ (hyp b ⊃ conc_{I} D) ∧ (hyp c ⊃ conc_{I} D))
conc_{(s I)} D =^{△} ∃b∃c(hyp (b ⇒ c) ∧ (hyp c ⊃ conc_{I} D) ∧ conc_{I} b)
conc_{(s I)} C =^{△} ∃b(hyp ⋀i b ∧ (∀ix hyp (b x) ⊃ conc_{I} C))
conc_{(s I)} C =^{△} ∃b(hyp ⋁i b ∧ (∃ix hyp (b x) ⊃ conc_{I} C))

axiom, the next seven correspond to the right introduction rules, and the remaining seven correspond to the left introduction rules.

Since we have not changed the representation of quantification, we get α-equivalence of quantified object logic formulas and substitution for object logic variables from the relevant features of F Oλ^{ΔIN} as before. We are still using F Oλ^{ΔIN} hypotheses to represent contexts, so the structural rules also follow as before. However, the admissibility of the cut rule, now encoded as

∀b∀c(∃i(hyp b ⊃ conc_{i} c) ⊃ ∃i conc_{i} b ⊃ ∃i conc_{i} c) ,

is no longer immediate: there is no simple proof of ∃i conc_{i} b ⟶ hyp b. We expect, though, that the admissibility of cut is still derivable in F Oλ^{ΔIN} following the method of [45].

This encoding has another limitation; to see it, consider the following example. Suppose we know that the sequent b ⇒ a ⟶ a is derivable in intuitionistic logic for some atom a and proposition b. Since a is atomic, the derivation must end with a left rule, and since 80 CHAPTER 5. REASONING ABOUT LOGICS IN F Oλ^{ΔIN}

the only formula on the left is b ⇒ a, it must be the left implication rule. Thus there are derivations of b ⇒ a ⟶ b and a, b ⇒ a ⟶ a. This second sequent is not so interesting, since it is an initial sequent. So we have shown that if b ⇒ a ⟶ a is derivable then b ⇒ a ⟶ b is as well.

Now let us try to capture this reasoning in F Oλ^{ΔIN} using our current encoding of intuitionistic logic. We want to derive the sequent

⟶ ∀a∀b(∃i(hyp (b ⇒ ⟨a⟩) ⊃ conc_{i} ⟨a⟩) ⊃ ∃j(hyp (b ⇒ ⟨a⟩) ⊃ conc_{j} b)) .

After the obvious uses of ∀R and ⊃ R, we get

∃i(hyp (b ⇒ ⟨a⟩) ⊃ conc_{i} ⟨a⟩) ⟶ ∃j(hyp (b ⇒ ⟨a⟩) ⊃ conc_{j} b) .

From our informal reasoning, we know that the derivation of b will have a smaller measure than the derivation of a; thus in applying the ∃L and ∃R rules it is conservative to substitute i for j:

hyp (b ⇒ ⟨a⟩) ⊃ conc_{i} ⟨a⟩ ⟶ hyp (b ⇒ ⟨a⟩) ⊃ conc_{i} b .

To follow the informal proof, we now want to indicate that hyp (b ⇒ ⟨a⟩) ⊃ conc_{i} ⟨a⟩ must be true by the definitional clause encoding the left ⇒ rule. However, we cannot apply the def L rule to this formula, since it is not an atom. The closest thing to this that we can do is to eliminate the ⊃ and then apply def L to conc_{i} ⟨a⟩. We can eliminate the ⊃ by using ⊃ R and then ⊃ L, yielding the two sequents

hyp (b ⇒ ⟨a⟩) ⟶ hyp (b ⇒ ⟨a⟩)
conc_{i} ⟨a⟩, hyp (b ⇒ ⟨a⟩) ⟶ conc_{i} b .

The first is immediate by the init rule. Applying the def L rule to conc_{i} ⟨a⟩ in the second sequent yields eight sequents corresponding to the cases where the derivation of a ends with the initial rule or any of the seven left rules:

hyp ⟨a⟩, hyp (b ⇒ ⟨a⟩) ⟶ conc_{i} b
hyp ff , hyp (b ⇒ ⟨a⟩) ⟶ conc_{i} b
∃b′∃c′(hyp (b′ & c′) ∧ (hyp b′ ⊃ conc_{i′} ⟨a⟩)), hyp (b ⇒ ⟨a⟩) ⟶ conc_{(s i′)} b

∃b′∃c′(hyp (b′ & c′) ∧ (hyp c′ ⊃ conc_{i′} ⟨a⟩)), hyp (b ⇒ ⟨a⟩) ⟶ conc_{(s i′)} b

∃b′∃c′(hyp (b′ ⊕ c′) ∧ (hyp b′ ⊃ conc_{i′} ⟨a⟩) ∧ (hyp c′ ⊃ conc_{i′} ⟨a⟩)), hyp (b ⇒ ⟨a⟩) ⟶ conc_{(s i′)} b ∃b′∃c′(hyp (b′ ⇒ c′) ∧ (hyp c′ ⊃ conc_{i′} ⟨a⟩) ∧ conc_{i′} b′), hyp (b ⇒ ⟨a⟩) ⟶ conc_{(s i′)} b

∃b′(hyp ⋀i b′ ∧ (∀ix hyp (b′ x) ⊃ conc_{i′} ⟨a⟩)), hyp (b ⇒ ⟨a⟩) ⟶ conc_{(s i′)} b
∃b′(hyp ⋁i b′ ∧ (∃ix hyp (b′ x) ⊃ conc_{i′} ⟨a⟩)), hyp (b ⇒ ⟨a⟩) ⟶ conc_{(s i′)} b .

This is clearly not what we want. Even in the case corresponding to the left ⇒ rule we do not know that the rule was applied to the implication b ⇒ ⟨a⟩. There are really two problems here. The first is that hyp (b ⇒ ⟨a⟩) ⊃ conc_{i} ⟨a⟩ expresses the idea that b ⇒ ⟨a⟩ is a hypothesis available in the derivation of conc_{i} ⟨a⟩, but it does not capture the idea that it is the only hypothesis available. Thus the def L rule forces us to consider derivations ending with the initial rule or any of the left rules, since the appropriate formula may be available as a hypothesis. The second problem is that we do not have any way to examine the different ways of deriving something from a specific set of hypotheses. Although the formula hyp (b ⇒ ⟨a⟩) ⊃ conc_{i} ⟨a⟩ indicates that the atom a is derivable from the hypothesis b ⇒ ⟨a⟩, we cannot examine how that derivation might take place. All we can do is use the def L rule, which says that we know that the hypothesis b ⇒ ⟨a⟩ is available and so can conclude that a holds.

5.1.3 Explicit Sequent Encoding

To remedy this situation, we explicitly represent the entire sequent in a single atomic judgement. As a result, the relevant object logic hypotheses are known to be exactly those listed in the judgement, and the def L rule can be applied to the judgement to examine how the corresponding sequent might be derived. Thus derivability is encoded via the predicate

seq : nt → prplst → prp → o .

The first argument is an induction measure and will be displayed as a subscript. The second argument is a list of terms of type prp and represents the left side of the sequent. We will assume that prplst is the same as the type lst introduced in Section 2.2.2, using prp for the

82 CHAPTER 5. REASONING ABOUT LOGICS IN F Oλ^{ΔIN}

Table 5.3: Explicit sequent encoding of intuitionistic logic

seq_{I} L ⟨A⟩ =^{△} element ⟨A⟩ L
seq_{I} L tt =^{△} ⊤
seq_{(s I)} L (B & C) =^{△} seq_{I} L B ∧ seq_{I} L C
seq_{(s I)} L (B ⊕ C) =^{△} seq_{I} L B
seq_{(s I)} L (B ⊕ C) =^{△} seq_{I} L C
seq_{(s I)} L (B ⇒ C) =^{△} seq_{I} (B::L) C
seq_{(s I)} L (⋀i B) =^{△} ∀ix seq_{I} L (B x)
seq_{(s I)} L (⋁i B) =^{△} ∃ix seq_{I} L (B x)
seq_{I} L B =^{△} element ff L
seq_{(s I)} L D =^{△} ∃b∃c(element (b & c) L ∧ seq_{I} (b::L) D)
seq_{(s I)} L D =^{△} ∃b∃c(element (b & c) L ∧ seq_{I} (c::L) D)
seq_{(s I)} L D =^{△} ∃b∃c(element (b ⊕ c) L ∧ seq_{I} (b::L) D ∧ seq_{I} (c::L) D)
seq_{(s I)} L D =^{△} ∃b∃c(element (b ⇒ c) L ∧ seq_{I} (c::L) D ∧ seq_{I} L b)
seq_{(s I)} L C =^{△} ∃b(element ⋀i b L ∧ ∃ix seq_{I} ((b x)::L) C)
seq_{(s I)} L C =^{△} ∃b(element ⋁i b L ∧ ∀ix seq_{I} ((b x)::L) C)

type of elements. In particular we will assume that we have constructors nil and ::, and a predicate element as defined in D(list(prp)). The third argument to seq corresponds to the right side of the sequent. The definition for this predicate is shown in Table 5.3.

Since we have not changed the representation of quantification, we get α-equivalence of quantified object logic formulas and substitution for object logic variables from the relevant features of F Oλ^{ΔIN} as before. We are no longer using F Oλ^{ΔIN} hypotheses to represent contexts, however, so the structural rules must now be derived by induction. The admissibility of the cut rule must also be derived by induction, as was the case with the previous encoding. With the atomic encoding of sequents, we now can analyze derivations of propositions from hypotheses. To see this, we revisit the example from above. To formalize this with the encoding of Table 5.3, we derive the sequent

⟶ ∀a∀b(∃i seq_{i} ((b ⇒ ⟨a⟩)::nil) ⟨a⟩ ⊃ ∃j seq_{j} ((b ⇒ ⟨a⟩)::nil) b) .

Applying the ∀R, ⊃ R, and ∃L rules yields the sequent

seq_{i} ((b ⇒ ⟨a⟩)::nil) ⟨a⟩ ⟶ ∃j seq_{j} ((b ⇒ ⟨a⟩)::nil) b .

Now we apply the def L rule to the judgement on the left, which yields eight sequents, again corresponding to the cases where the derivation of a ends with the initial rule or any of the seven left rules:

element ⟨a⟩ ((b ⇒ ⟨a⟩)::nil) ⟶ ∃j seq_{j} ((b ⇒ ⟨a⟩)::nil) b
element ff ((b ⇒ ⟨a⟩)::nil) ⟶ ∃j seq_{j} ((b ⇒ ⟨a⟩)::nil) b

∃b′∃c′(element (b′ & c′) ((b ⇒ ⟨a⟩)::nil) ∧ seq_{i′} (b′::(b ⇒ ⟨a⟩)::nil) ⟨a⟩) ⟶ ∃j seq_{j} ((b ⇒ ⟨a⟩)::nil) b

∃b′∃c′(element (b′ & c′) ((b ⇒ ⟨a⟩)::nil) ∧ seq_{i′} (c′::(b ⇒ ⟨a⟩)::nil) ⟨a⟩) ⟶ ∃j seq_{j} ((b ⇒ ⟨a⟩)::nil) b

∃b′∃c′(element (b′ ⊕ c′) ((b ⇒ ⟨a⟩)::nil) ∧ seq_{i′} (b′::(b ⇒ ⟨a⟩)::nil) ⟨a⟩ ∧ seq_{i′} (c′::(b ⇒ ⟨a⟩)::nil) ⟨a⟩) ⟶ ∃j seq_{j} ((b ⇒ ⟨a⟩)::nil) b

∃b′∃c′(element (b′ ⇒ c′) ((b ⇒ ⟨a⟩)::nil) ∧ seq_{i′} (c′::(b ⇒ ⟨a⟩)::nil) ⟨a⟩ ∧ seq_{i′} ((b ⇒ ⟨a⟩)::nil) b′) ⟶ ∃j seq_{j} ((b ⇒ ⟨a⟩)::nil) b

∃b′(\begin{matrix}element ⋀i b′ ((b ⇒ ⟨a⟩)::nil) ∧ \\ ∃ix seq_{i′} ((b′ x)::(b ⇒ ⟨a⟩)::nil) ⟨a⟩) ⟶ ∃j seq_{j} ((b ⇒ ⟨a⟩)::nil) b \end{matrix}

∃b′(\begin{matrix}element ⋁i b′ ((b ⇒ ⟨a⟩)::nil) ∧ \\ ∀ix seq_{i′} ((b′ x)::(b ⇒ ⟨a⟩)::nil) ⟨a⟩) ⟶ ∃j seq_{j} ((b ⇒ ⟨a⟩)::nil) b \end{matrix} .

But this time we can easily eliminate seven of the eight possibilities, since the element assumption is obviously false. In the first sequent, for example, we have the assumption element ⟨a⟩ ((b ⇒ ⟨a⟩)::nil). Since ⟨a⟩ cannot unify with (b ⇒ ⟨a⟩), ⟨a⟩ cannot be the first element of the list; therefore it must be an element of the remainder. But the remainder is 84 CHAPTER 5. REASONING ABOUT LOGICS IN F Oλ^{ΔIN}

the empty list, so ⟨a⟩ cannot be an element of it either. This is accomplished formally by applying the def L rule twice:

element ⟨a⟩ nil ⟶ ∃j seq_{j} ((b ⇒ ⟨a⟩)::nil) b def L element ⟨a⟩ ((b ⇒ ⟨a⟩)::nil) ⟶ ∃j seq_{j} ((b ⇒ ⟨a⟩)::nil) b def L .

The remaining cases are done similarly, except for the one valid case, which corresponds to a use of the left ⇒ rule:

∃b′∃c′(element (b′ ⇒ c′) ((b ⇒ ⟨a⟩)::nil) ∧ seq_{i′} (c′::(b ⇒ ⟨a⟩)::nil) ⟨a⟩ ∧ seq_{i′} ((b ⇒ ⟨a⟩)::nil) b′) ⟶ ∃j seq_{j} ((b ⇒ ⟨a⟩)::nil) b .

In this case, b′ ⇒ c′ does match the first element of the list, so we must consider the case where the left ⇒ rule was applied to (b ⇒ ⟨a⟩):

⊤, seq_{i′} ((b ⇒ ⟨a⟩)::nil) b ⟶ ∃j … element (b′ ⇒ c′) nil, … ⟶ ∃j … def L element (b′ ⇒ c′) ((b ⇒ ⟨a⟩)::nil), seq_{i′} ((b ⇒ ⟨a⟩)::nil) b′ ⟶ ∃j … def L ∧L element (b′ ⇒ c′) … ∧ …, element (b′ ⇒ c′) … ∧ … ⟶ ∃j … element (b′ ⇒ c′) ((b ⇒ ⟨a⟩)::nil) ∧ … ⟶ ∃j seq_{j} ((b ⇒ ⟨a⟩)::nil) b cL ∃L … ⟶ ∃j seq_{j} ((b ⇒ ⟨a⟩)::nil) b .

But the unproved sequent is easily derived by choosing j to be i′:

⊤, seq_{i′} ((b ⇒ ⟨a⟩)::nil) b ⟶ seq_{i′} ((b ⇒ ⟨a⟩)::nil) b init ⊤, seq_{i′} ((b ⇒ ⟨a⟩)::nil) b ⟶ ∃j seq_{j} ((b ⇒ ⟨a⟩)::nil) b ∃R .

Now let us consider another example. Suppose we know that the sequent

⟶ ⋀ y_{1} ⋀ y_{2}(p y_{1} t_{1} ⇒ p y_{2} t_{2} ⇒ p y_{2} t_{3})

is derivable in intuitionistic logic for some predicate constant p and some terms t_{1}, t_{2}, and t_{3}. The derivation must end with applications of the right rules for ⋀ and ⇒, since these are the only rules that apply. Thus we know that the sequent p y_{1} t_{1}, p y_{2} t_{2} ⟶ p y_{2} t_{3} is derivable. Since p is a predicate constant, these formulas are all atomic, so the only rule that applies is the initial rule. The eigenvariable condition for the application of the right 5.1. LOGIC REPRESENTATIONS FOR META-THEORETIC ANALYSIS 85

rule for ⋀ guarantees that y_{1} and y_{2} are distinct, so the initial rule must apply to the second hypothesis. Therefore, it must be the case that t_{2} and t_{3} are the same term.

Now let us try to capture this reasoning in F Oλ^{ΔIN} using our current encoding of intuitionistic logic. To do this, we will need some way to indicate term identity, and so we introduce the predicate ≡ of type i → i → o defined by the clause X ≡ X =^{△} ⊤. We then want to derive the sequent

⟶ ∀p∀t_{1}∀t_{2}∀t_{3}(∃i seq_{i} nil ⋀i y_{1} ⋀i y_{2}(p y_{1} t_{1} ⇒ p y_{2} t_{2} ⇒ ⟨p y_{2} t_{3}⟩) ⊃ t_{2} ≡ t_{3}) .

The only way to proceed is by applying ∀R and ⊃ R, yielding

∃i seq_{i} nil ⋀i y_{1} ⋀i y_{2}(p y_{1} t_{1} ⇒ p y_{2} t_{2} ⇒ ⟨p y_{2} t_{3}⟩) ⟶ t_{2} ≡ t_{3} .

There is nothing more that we can do on the right, since the definitional clause for ≡ does not apply. Applying ∃L gives us the sequent

seq_{i} nil ⋀i y_{1} ⋀i y_{2}(p y_{1} t_{1} ⇒ p y_{2} t_{2} ⇒ ⟨p y_{2} t_{3}⟩) ⟶ t_{2} ≡ t_{3} .

Now we want to reason about the derivation of ⋀ y_{1} ⋀ y_{2} … to conclude that t_{2} ≡ t_{3}. In the informal proof, we reasoned that this derivation must end with the right rule for ⋀; we do the same thing here using def L, which yields the sequent

∀y_{1} seq_{i_{1}} nil ⋀i y_{2}v(p y_{1} t_{1} ⇒ p y_{2} t_{2} ⇒ ⟨p y_{2} t_{3}⟩) ⟶ t_{2} ≡ t_{3} ,

as well as seven other sequents corresponding to the cases where the object logic derivation ends with the application of one of the left rules. Since these latter seven sequents represent cases that are not applicable, they are easily derivable as shown in the previous example; we thus focus on the sequent shown above. Before we can proceed to apply def L again for the second use of the right rule for ⋀, we must first apply ∀L, which requires supplying a substitution term for y_{1}. For this proof, it doesn’t matter what term we use for y_{1}, as long as it is something that does not unify with the term we supply for y_{2}. So let x_{1} and x_{2} be two distinct, non-unifiable terms of type i. If we use x_{1} for y_{1}, and then apply def L and ∀L again using x_{2} for y_{2}, we get

seq_{i_{2}} nil (p x_{1} t_{1} ⇒ p x_{2} t_{2} ⇒ ⟨p x_{2} t_{3}⟩) ⟶ t_{2} ≡ t_{3} .

86 CHAPTER 5. REASONING ABOUT LOGICS IN F Oλ^{ΔIN}

We now apply def L two more times, each of which corresponds to reasoning that the object logic derivation must proceed with a use of the right rule for ⇒. This yields the sequent

seq_{i_{3}} ((p x_{2} t_{2})::(p x_{1} t_{1})::nil) ⟨p x_{2} t_{3}⟩ ⟶ t_{2} ≡ t_{3} .

Another application of def L reflects the fact that in the object logic derivation only the initial rule now applies:

element (p x_{2} t_{3}) ((p x_{2} t_{2})::(p x_{1} t_{1})::nil) ⟶ t_{2} ≡ t_{3} .

For p x_{2} t_{3} to be the first element of the list, t_{2} and t_{3} must be the same, and this is what we want to prove. We have chosen x_{1} and x_{2} to be terms that do not unify, so p x_{2} t_{3} cannot be the other element of the list. This reasoning is represented formally by the F Oλ^{ΔIN} derivation

\begin{matrix}⊤ ⟶ ⊤ & ⊤R \\ ⊤ ⟶ t_{2} ≡ t_{2} \end{matrix} ; def R element (p x_{2} t_{3}) nil ⟶ t_{2} ≡ t_{3} def L element (p x_{2} t_{3}) ((p x_{1} t_{1})::nil) ⟶ t_{2} ≡ t_{3} def L element (p x_{2} t_{3}) ((p x_{2} t_{2})::(p x_{1} t_{1})::nil) ⟶ t_{2} ≡ t_{3} def L .

If we are able to construct the two non-unifiable terms x_{1} and x_{2}, we are able to conduct this analysis in F Oλ^{ΔIN}. But the need for these two terms is rather disturbing. The informal proof is independent of the type of y_{1} and y_{2} and the term structure of this type. In fact, the informal proof is valid even for a type that is uninhabited; this is obviously not the case for our representation in F Oλ^{ΔIN}. The problem is that our representation of object-level quantification in terms of F Oλ^{ΔIN} quantification doesn’t allow us to examine a derivation that is generic over certain terms. Although the formula ∀y seq_{i} L (B y) indicates that the proposition B y is derivable from the hypotheses in L for any y, it does not indicate that the derivation is the same for all y, and we cannot examine that derivation generically. All we can do is use the ∀L rule, which requires us to substitute a specific term for y, and then examine the derivation for that specific term. This is analagous to the problem we encountered before related to the encoding of object logic implication in terms of F Oλ^{ΔIN} implication.

5.1. LOGIC REPRESENTATIONS FOR META-THEORETIC ANALYSIS 87

5.1.4 Explicit Eigenvariable Encoding

To solve this problem we must explicitly keep track of the eigenvariables introduced by the quantifier rules. We do not wish to abandon, however, our higher-order abstract syntax representation of quantification. In the earlier encodings of this section, we encoded the rules for object logic quantification using F Oλ^{ΔIN} quantification; the key idea of our solution is to replace that use of F Oλ^{ΔIN} quantification with the use of F Oλ^{ΔIN} λ-abstraction. If we follow this idea naively and simply replace the quantification by λ-abstraction, we get the following encoding of the right rule for ⋀:

seq_{(s I)} L (⋀i B) =^{△} λx seq_{I} L (B x) .

This does not work, of course, since the body of this clause now has type i → o instead of type o. To address this problem, it is important to first realize that as more eigenvariables are added and propositions are moved between the left and right sides of the sequent, we must deal more generally with “judgements” of the form

λx_{1} … λx_{n} seq_{I} (L x_{1} … x_{n}) (B x_{1} … x_{n})

for arbitrary n ≥ 0. First consider “uncurrying” this expression by replacing the λabstractions over x_{1}, …, x_{n} by a single λ-abstraction over the n-tuple (x_{1}, …, x_{n}):

λx.seq_{I} (L (π_{1} x) … (π_{n} x)) (B (π_{1} x) … (π_{n} x)) .

Now we can deal with the arbitrary n by replacing the n-tuple with a list, and using fst x in place of π_{1} x, fst (rst x) in place of π_{2} x, fst (rst (rst x)) in place of π_{3} x, etc. Finally, we push the λ-abstraction into the seq predicate by changing its type:

seq : nt → (evs → prplst) → (evs → prp) → o .

Here evs is a new type representing a list of eigenvariables. We have already seen the two operators on this type, fst: evs → i and rst: evs → evs; fst l represents the first eigenvariable in the list l, and rst l represents the remainder of the list. The right rule for ⋀ is now encoded as follows:

seq_{(s I)} L (λl ⋀i(B l)) =^{△} seq_{I} (λl′ L(rst l′)) (λl′ B (rst l′) (fst l′)) .

88 CHAPTER 5. REASONING ABOUT LOGICS IN F Oλ^{ΔIN}

The bound variable l′ in the body of the clause should be thought of as a list whose length is one longer than the length of the bound variable l in the head of the clause; fst l′ represents the new eigenvariable, and rst l′ represents the eigenvariables in l. The left rule for ⋁i is similarly modified:

seq_{(s I)} L C =^{△} ∃b(\begin{matrix}element (λl ⋁i(b l)) L ∧ \\ seq_{I} (λl′ (b (rst l′) (fst l′))::(L (rst l′))) (λl′ C (rst l′)) . \end{matrix}

The remainder of the clauses are only modified to reflect the change in the type of seq. Note in particular that F Oλ^{ΔIN} quantification can still be used in the encodings of the left rule for ⋀ and the right rule for ⋁; since these rules do not introduce eigenvariables, this use of F Oλ^{ΔIN} quantification is not problematic. The type of the predicate element also changes:

element : (evs → prp) → (evs → prplst) → o .

Table 5.4 presents the definition for the entire logic.

Since we have not changed the representation of quantification, we get α-equivalence of quantified object logic formulas and substitution for object logic bound variables from the relevant features of F Oλ^{ΔIN} as before. Substitution for eigenvariables is a little more involved, as shown by its encoding via the predicates

subst : nt → (evs → i) → (evs → i) → (evs → i) → o
subst0 : nt → (evs → evs → i) → (evs → evs → i) → (evs → evs → i) → o .

The judgement subst i t_{1} t_{2} t′_{2} indicates that t′_{2} is the result of substituting t_{1} in t_{2} for the (i + 1)^{th} eigenvariable. We could just as easily use the actual encoding (fst (rst^{i} l)) of the (i + 1)^{th} eigenvariable in place of its index, but we find it more convenient to use the index so that we can perform induction on it. (Here we use (rst^{i} l) for n applications of rst to l, i.e. (rst^{0} l) is l, (rst^{1} l) is (rst l), (rst^{2} l) is (rst (rst l)), etc.) The subst0 predicate is used in the definition of subst; the extra evs argument is used to keep track of eigenvariables at the beginning of the list as we search down the list for the substitution variable. The encoding of these predicates is shown in Table 5.5. Substitution for the first eigenvariable can be done directly; to substitute for the (i + 2)^{th} eigenvariable we move the first eigenvariable from the list l to the list l′ and substitute for the (i + 1)^{th} eigenvariable of l.

5.1. LOGIC REPRESENTATIONS FOR META-THEORETIC ANALYSIS 89

Table 5.4: Explicit eigenvariable encoding of intuitionistic logic

seq_{I} L λl ⟨(A l)⟩ =^{△} element λl ⟨(A l)⟩ L
seq_{I} L (λl tt) =^{△} ⊤
seq_{(s I)} L λl ((B l) & (C l)) =^{△} seq_{I} L B ∧ seq_{I} L C
seq_{(s I)} L λl ((B l) ⊕ (C l)) =^{△} seq_{I} L B
seq_{(s I)} L λl ((B l) ⊕ (C l)) =^{△} seq_{I} L C
seq_{(s I)} L λl ((B l) ⇒ (C l)) =^{△} seq_{I} λl ((B l)::(L l)) C
seq_{(s I)} L (λl ⋀i(B l)) =^{△} seq_{I} (λl′ L (rst l′)) (λl′ B (rst l′) (fst l′))
seq_{(s I)} L (λl ⋁i(B l)) =^{△} ∃x seq_{I} L (λl B l (x l))
seq_{I} L B =^{△} element (λl ff ) L
seq_{(s I)} L D =^{△} ∃b∃c(\begin{matrix}element λl ((b l) & (c l)) L ∧ \\ seq_{I} λl ((b l)::(L l)) D) \end{matrix}
seq_{(s I)} L D =^{△} ∃b∃c(\begin{matrix}element λl ((b l) & (c l)) L ∧ \\ seq_{I} λl ((c l)::(L l)) D) \end{matrix}
seq_{(s I)} L D =^{△} ∃b∃c(\begin{matrix}element λl ((b l) ⊕ (c l)) L ∧ \\ seq_{I} λl ((b l)::(L l)) D ∧ seq_{I} λl ((c l)::(L l)) D) \end{matrix}
seq_{(s I)} L D =^{△} ∃b∃c(\begin{matrix}element λl ((b l) ⇒ (c l)) L ∧ \\ seq_{I} λl ((c l)::(L l)) D ∧ \\ seq_{I} L b) \end{matrix}
seq_{(s I)} L C =^{△} ∃b(\begin{matrix}element (λl ⋀i(b l)) L ∧ \\ ∃x seq_{I} λl ((b l (x l))::(L l)) C) \end{matrix}
seq_{(s I)} L C =^{△} ∃b(\begin{matrix}element (λl ⋁i(b l)) L ∧ \\ seq_{I} λl′ ((b (rst l′) (fst l′))::(L (rst l′))) (λl′ C (rst l′))) \end{matrix}
element X λl ((X l)::(L l)) =^{△} ⊤
element X λl ((Y l)::(L l)) =^{△} element X L

Table 5.5: Encoding of substitution for eigenvariables

subst I T_{1} T_{2} T′_{2} =^{△} subst_{0} I (λl′ T_{1}) (λl′ T_{2}) (λl′ T′_{2})

subst_{0} z T_{1} (λl′λl T_{2} l′ (fst l) (rst l)) (λl′λl T_{2} l′ (T_{1} l′ l) (rst l))

=^{△} ⊤

subst

0

(s I) (λl′λl T_{1} l′ (fst l) (rst l))

(λl′λl T_{2} l′ (fst l) (rst l)) (λl′λl T′_{2} l′ (fst l) (rst l))

=^{△} subst_{0} I (λl′λl T_{1} (rst l′) (fst l′) l) (λl′λl T_{2} (rst l′) (fst l′) l) (λl′λl T′_{2} (rst l′) (fst l′) l)

As with the previous encoding of intuitionistic logic, we must derive the admissibility of the structural rules and the cut rule by induction. We have retained the atomic encoding of sequents, so we can still analyze derivations of propositions from hypotheses. In addition, the explicit encoding of eigenvariables allows us to better analyze derivations of generic propositions. To see this, we revisit the example from before; the sequent we wish to derive is

⟶ ∀p∀t_{1}∀t_{2}∀t_{3}(∃i seq_{i} λl nil (λl ⋀i y_{1} ⋀i y_{2}(p y_{1} t_{1} ⇒ p y_{2} t_{2} ⇒ ⟨p y_{2} t_{3}⟩)) ⊃ t_{2} ≡ t_{3}) .

As before, we begin by applying the ∀R, ⊃ R, and ∃L rules to obtain the sequent

seq_{i} λl nil (λl ⋀i y_{1} ⋀i y_{2}(p y_{1} t_{1} ⇒ p y_{2} t_{2} ⇒ ⟨p y_{2} t_{3}⟩)) ⟶ t_{2} ≡ t_{3} .

The derivation of the object logic formula ⋀ y_{1} ⋀ y_{2} … must end with two applications of the right rule for ⋀; we formalize this by applying def L twice, which results in the sequent

seq_{i_{1}} λl nil λl (p (fst (rst l)) t_{1} ⇒ p (fst l) t_{2} ⇒ ⟨p (fst l) t_{3}⟩) ⟶ t_{2} ≡ t_{3} .

The object logic derivation must proceed with two applications of the right rule for ⇒; we deduce this formally by two more applications of the def L rule, yielding

seq_{i_{2}} λl ((p (fst l) t_{2})::(p (fst (rst l)) t_{1})::nil) λl ⟨p (fst l) t_{3}⟩ ⟶ t_{2} ≡ t_{3} .

An additional use of the def L rule corresponds to the realization that the initial rule must complete the object logic derivation, giving us the sequent

element (λl p (fst l) t_{3}) λl ((p (fst l) t_{2})::(p (fst (rst l)) t_{1})::nil) ⟶ t_{2} ≡ t_{3} .

5.1. LOGIC REPRESENTATIONS FOR META-THEORETIC ANALYSIS 91

If p (fst l) t_{3} is the first element of the list, then t_{2} and t_{3} are the same, which is the result we are trying to establish. The formula p (fst l) t_{3} cannot be the other element of the list, because the first argument to p differs; thus we are done. This is all formally encoded by the derivation

\begin{matrix}⊤ ⟶ ⊤ & ⊤R \\ ⊤ ⟶ t_{2} ≡ t_{2} \end{matrix} ; def R element (λl p (fst l) t_{3}) (λl nil) ⟶ t_{2} ≡ t_{3} def L element (λl p (fst l) t_{3}) λl ((p (fst (rst l)) t_{1})::nil) ⟶ t_{2} ≡ t_{3} def L element (λl p (fst l) t_{3}) λl ((p (fst l) t_{2})::(p (fst (rst l)) t_{1})::nil) ⟶ t_{2} ≡ t_{3} def L .

5.1.5 Discussion

Before going on to formally derive theorems about encodings of logics, let us reflect on the encoding styles we have discussed. What we have is a spectrum of styles, all of which share the same higher-order abstract syntax encoding of formulas, but which vary in the degree to which they use the higher-order abstract syntax encoding of inference rules. The first encoding used the typical higher-order abstract syntax techniques, which made a number of significant properties of the object logic fall out easily from the properties of F Oλ^{ΔIN}. Unfortunately this encoding did not lend itself to formal analysis within F Oλ^{ΔIN}, since it could not be expressed as a definition nor given an induction measure. We then progressed through three other encodings, each of which compromised the use higherorder abstract syntax a bit more. The cost of each compromise was a decrease in the elegance and an increase in the complexity of the encoding, and a reduction in the extent to which fundamental properties of the object logic followed from corresponding properties of F Oλ^{ΔIN}. The benefit, of course, was a greater ability to perform formal meta-theoretic analysis.

In Chapter 6 we will discuss an approach which lets us use the typical higher-order abstract syntax encodings and also perform meta-theoretic analyses on these encodings. The key to this approach is the use of a specification logic that is separate from F Oλ^{ΔIN}, and in fact is itself specified in F Oλ^{ΔIN}. In the next section we present two logics which will be used for this purpose, and which also serve as examples of the last two encoding techniques discussed in this section.

92 CHAPTER 5. REASONING ABOUT LOGICS IN F Oλ^{ΔIN}

5.2 Examples

In this section we illustrate the use of the some of the encoding techniques just presented. In Section 5.2.1 we use the explicit sequent technique of Section 5.1.3 to encode a fragment of intuitionistic logic; Section 5.2.2 discusses a fragment of linear logic encoded with the explicit eigenvariable technique of Section 5.1.4. In each case we prove the adequacy of the encoding and also derive in F Oλ^{ΔIN} some properties of the object logic. The results of Section 5.2.1 were presented in [31], coauthored with Miller.

5.2.1 Intuitionistic Logic

Consider the fragment of second-order intuitionistic logic given by the grammar

\begin{aligned}D & ::= & A | G ⇒ A | ⋀_{α} x.D | ⋀_{α→α} x.D \\ G & ::= & A | tt | G & G | A ⇒ G | ⋀_{α} x.G , \end{aligned}

where A ranges over atomic formulas and α ranges over ground types. D and G represent definite clauses and goal formulas, respectively. Although this seems like a rather simple fragment, higher-order abstract syntax encodings generally fall within the set of definite clauses given by this grammar. The set of goal formulas can be encoded by the following constants:

⟨ ⟩ : atm → prp  & : prp → prp → prp  ⋀i : (i → prp) → prp tt : prp  ⇒ : atm → prp → prp .

Notice that the antecendent of the implication is restricted to be atomic.

If we take any sequent calculus inference rule and restrict the conclusion to be a sequent whose antecedents are definite clauses and whose consequent is a goal formula, then the premises will also be sequents of this form. In fact, any antecedent in the premises will either be an antecedent of the conclusion or an atomic formula. Thus in a derivation in this fragment of intuitionistic logic, all non-atomic antecedents in any sequent of the derivation appear as antecedents in the end-sequent. So we can divide the antecedents into the original theory, which remains constant throughout the derivation, and some atomic antecedents, which vary throughout the derivation. Leaving the fixed theory aside for the moment, we can restrict our sequents to have only atomic antecedents:

seq : nt → atmlst → prp → o ,

where atmlst is the same as the type lst introduced in Section 2.2.2, using atm for the type of elements. Since the antecedents are atomic, only the initial and right rules are necessary:

seq_{I} (A′::L) ⟨A⟩ =^{△} element A (A′::L)
seq_{I} L tt =^{△} ⊤
seq_{(s I)} L (B & C) =^{△} seq_{I} L B ∧ seq_{I} L C
seq_{(s I)} L (A ⇒ B) =^{△} seq_{I} (A::L) B
seq_{(s I)} L (⋀i B) =^{△} ∀ix seq_{I} L (B x) .

We now turn to consider the set of definite clauses that make up the theory for the derivation. Notice that the atomic formula A is equivalent to the formula tt ⇒ A, so every definite clause can be written in the form ⋀ x_{1} ⋯ ⋀ x_{n}(G ⇒ A). In addition, the logic under consideration is a subset of the logic of hereditary Harrop formulas. As a result, for any derivable sequent there is a uniform derivation of that sequent [34, 39]. In our setting, a derivation is uniform if every subderivation ending in a left rule is of the form

\begin{matrix}⋮ . ; Γ ⟶ G[t_{1}, …, t_{n}/x_{1}, …, x_{n}] & A′, Γ ⟶ A′ init \\ (G ⇒ A)[t_{1}, …, t_{n}/x_{1}, …, x_{n}], Γ ⟶ A′ \end{matrix} ; ⇒ L ; ⋀ L ⋀ x_{1} ⋯ ⋀ x_{n}(G ⇒ A), Γ ⟶ A′ ,

where A′ and A[t_{1}, …, t_{n}/x_{1}, …, x_{n}] are the same. If we group these steps together, our aggregate left rule encoding needs to say that seq_{(s I)} L ⟨A′⟩ holds if and only if there is a clause ⋀ x_{1} ⋯ ⋀ x_{n}(G ⇒ A) in the theory such that A can be instantiated to match A′, and seq_{(s I)} L ⟨G′⟩ holds, where G′ is the corresponding instantiation of G. We use the predicate

prog : atm → prp → o

to encode the theory. The fact that the definite clause ⋀ x_{1} ⋯ ⋀ x_{n}(G ⇒ A) is in the theory is represented by the definitional clause prog A G =^{△} ⊤; the quantification of the definite clause is encoded by the (elided) quantification of the definitional clause. The encoding for 94 CHAPTER 5. REASONING ABOUT LOGICS IN F Oλ^{ΔIN}

the aggregate left rule is

seq_{(s I)} L ⟨A⟩ =^{△} ∃b(prog A b ∧ seq_{I} L b) ;

notice that the matching between A and the head of the definite clause is accomplished by the definition rules. Different object-level theories can be considered by varying the definition of prog, as illustrated in Chapter 6. The object-level formulas encoded using prog are treated by the object logic as a theory and not as a definition: there is no rule corresponding to F Oλ^{ΔIN}’s def L in the object logic.

We will refer to the six clauses for seq given in this section as D(intuit). For convenience we will abbreviate the formula ∃i(nat i ∧ seq_{i} L B) as L > B (or as >B when L is nil). We now state the following properties about this presentation of the object logic. If B is a term of type prp, then let ⟨[B]⟩ be its (obvious) translation into a formula of intuitionistic logic. If L is a term of type atmlst, let ⟨[L]⟩ be its (obvious) translation to a multiset of atomic formulas of intuitionistic logic.

Theorem 5.1 Let D(prog) be the definition {∀x̄_{1}[prog A_{1} G_{1} =^{△} ⊤], …, ∀x̄_{n}[prog A_{n} G_{n} =^{△} ⊤]} (n ≥ 0) which represents an object-level theory, and let P be the corresponding theory in intuitionistic logic (i.e. the set of formulas ⋀ x̄_{i}(⟨[G_{i}]⟩ ⇒ ⟨[A_{i}]⟩), for all i ∈ {1, …, n}). Let D be a definition that extends D(nat) ∪ D(list(atm)) ∪ D(intuit) ∪ D(prog) with clauses that do not define nat, seq, element, or prog. Then the sequent ⟶ L > B is derivable in F Oλ^{ΔIN} with definition D if and only if ⟨[B]⟩ is an intuitionistic consequence of ⟨[L]⟩ ∪ P.

Proof The reverse direction follows easily from the definition D(intuit). For the forward direction, the use of the def R rule with D(intuit) will cause the structure of the F Oλ^{ΔIN} derivation to closely follow that of the corresponding derivation in intuitionistic logic. However, we need to be sure that the natL and def L rules don’t allow us to derive anything that we can’t derive in intuitionistic logic. By Theorem 3.13, we only need to consider cut-free F Oλ^{ΔIN} derivations. By Lemma 5.2 a cut-free derivation of ⟶ L > B will consist only of sequents with empty antecedents. Thus the natL and def L rules are not used, since they both require a formula in the antecedent.

5.2. EXAMPLES 95

Lemma 5.2 If D is an implication-free definition, C is an implication-free formula, and Π is a cut-free derivation of the sequent ⟶ C in F Oλ^{ΔIN} using D, then every sequent in Π has an empty antecedent and an implication-free consequent.

Proof Consider the following two observations about the inference rules in F Oλ^{ΔIN}:

1. The only rule that can have a non-empty antecedent in a premise and an empty antecedent in the conclusion is ⊃ R.

2. The only rules that allow an implication in the consequent of a premise without one in the consequent of the conclusion are ⊃ L and natL. (The def R rule does not, since the clauses in D do not contain implications. The def L rule does not, since the types of variables cannot contain o.)

But the ⊃ L and natL rules have conclusions with a non-empty antecedent, and the ⊃ R rule has a conclusion with an implication in the consequent. Since the end-sequent has an empty antecedent and an implication-free consequent, a simple induction on the height of the proof shows that all sequents in the proof have this property.

The following theorems state that we can derive in F Oλ^{ΔIN} that the specialization rule, the cut rule and the usual structural rules are admissible for our object logic.

Theorem 5.3 The formula

∀i∀b∀l(nat i ⊃ seq_{(s i)} l ⋀ b ⊃ ∀x seq_{i} l (b x))

is derivable in F Oλ^{ΔIN} using the definition D(nat) ∪ D(list(atm)) ∪ D(intuit).

Theorem 5.4 The formula ∀a∀b∀l((a::l) > b ⊃ l > ⟨a⟩ ⊃ l > b) is derivable in F Oλ^{ΔIN} using the definition D(nat) ∪ D(list(atm)) ∪ D(intuit).

Theorem 5.5 The formula

∀i∀b∀l∀l′(nat i ⊃ ∀a(element a l ⊃ element a l′) ⊃ seq_{i} l b ⊃ seq_{i} l′ b)

is derivable in F Oλ^{ΔIN} using the definition D(nat) ∪ D(list(atm)) ∪ D(intuit).

Table 5.6: Inference rules for a fragment of intuitionistic linear logic

Γ; A ⟶ A initial  ^{{B, Γ; B, Δ ⟶ C \atop B, Γ; Δ ⟶ C} absorb}  ^{Γ; Δ ⟶ tt ttR}
{Γ; B, Δ ⟶ E \atop Γ; B & C, Δ ⟶ E} &L  ^{{Γ; C, Δ ⟶ E \atop Γ; B & C, Δ ⟶ E} &L}  ^{Γ; B[t/x], Δ ⟶ C ; Γ; ⋀ x.B, Δ ⟶ C ⋀ L}
\begin{matrix}Γ; Δ ⟶ B & Γ; Δ ⟶ C \\ Γ; Δ ⟶ B & C \end{matrix} &R  ^{Γ; Δ ⟶ B[y/x] ; Γ; Δ ⟶ ⋀ x.B ⋀ R}
\begin{matrix}Γ; Δ_{1} ⟶ B & Γ; A, Δ_{2} ⟶ C \\ Γ; B −∘ A, Δ_{1}, Δ_{2} ⟶ C \end{matrix} −∘L  ^{{Γ; A, Δ ⟶ B \atop Γ; Δ ⟶ A −∘ B} −∘R}
\begin{matrix}Γ; ⟶ B & Γ; A, Δ ⟶ C \\ Γ; B ⇒ A, Δ ⟶ C \end{matrix} ⇒ L  ^{{A, Γ; Δ ⟶ B \atop Γ; Δ ⟶ A ⇒ B} ⇒ R}
\begin{matrix}Γ; Δ_{1} ⟶ B & Γ; B, Δ_{2} ⟶ C \\ Γ; Δ_{1}, Δ_{2} ⟶ C \end{matrix} cut  ^{\begin{matrix}Γ; ⟶ B & B, Γ; Δ ⟶ C \\ Γ; Δ ⟶ C \end{matrix} cut!}

5.2.2 Linear Logic

Now consider the fragment of second-order linear logic given by the grammar

\begin{aligned}D & ::= & A | G −∘ A | G ⇒ A | ⋀_{α} x.D | ⋀_{α→α} x.D \\ G & ::= & A | tt | G & G | A −∘ G | A ⇒ G | ⋀_{α} x.G , \end{aligned}

where A ranges over atomic formulas and α ranges over ground types. As in Section 5.2.1, D and G represent definite clauses and goal formulas, respectively. A derivation system for this logic is shown in Table 5.6; the left side of the sequent is divided into a set Γ of intuitionistic (non-linear) antecedents and a multiset Δ of linear antecedents. In the ⋀ R rule, y is an eigenvariable that is not free in the lower sequent of the rule. We encode the set of goal formulas using the following constants:

⟨ ⟩ : atm → prp  & : prp → prp → prp  ⇒ : atm → prp → prp tt : prp  −∘ : atm → prp → prp  ⋀i : (i → prp) → prp .

We again separate the antecedents of sequents in a derivation into a theory, which remains constant throughout the derivation and is encoded via a predicate prog, and some 5.2. EXAMPLES 97

atomic antecedents, which vary from sequent to sequent in the derivation and are shown explicitly in the sequent. The atomic antecedents are further divided into linear and intuitionistic antecedents:

seq : nt → (evs → atmlst) → (evs → atmlst) → (evs → prp) → o .

The second and third arguments to seq represent multisets of intuitionistic and linear antecedents, respectively. Notice that we follow the explicit eigenvariable encoding style of Section 5.1.4 by encoding the antecedents and consequent as funtions whose domain is a list of eigenvariables. In order to highlight both the similarities and differences between this encoding and the encoding of Section 5.2.1, we will use a number of abbreviations; we introduce the first of these now. For any type τ, we will use τ^{∗} as an abbreviation for evs → τ. Thus the type of seq above can be expressed as

seq : nt → atmlst^{∗} → atmlst^{∗} → prp^{∗} → o .

We must modify the definition D(list(τ)) from Section 2.2.2 to work over the type lst^{∗}. The predicates will now have the following types:

length : lst^{∗} → nt → o  split : lst^{∗} → lst^{∗} → lst^{∗} → o list : lst^{∗} → o  permute : lst^{∗} → lst^{∗} → o element : τ^{∗} → lst^{∗} → o .

The new definition D(list^{∗}(τ)) is shown in Table 5.7; we use nil^{∗} and A::^{∗} L as abbreviations for λl nil and λl ((A l)::(L l)).

We similarly introduce abbreviations corresponding to constructors of prp^{∗}: ⟨A⟩^{∗} abbreviates λl ⟨A l⟩, tt^{∗} abbreviates λl tt, B&^{∗}C abbreviates λl ((B l)&(C l)), A−∘^{∗}B abbreviates λl ((A l)−∘(B l)), A ⇒^{∗} B abbreviates λl ((A l) ⇒ (B l)), and ⋀^{∗} B abbreviates λl (⋀(B l)).

Any definite clause in our fragment of linear logic is equivalent to a formula of the form

⋀ x_{1} ⋯ ⋀ x_{k}(B_{1} ⇒ ⋯ B_{m} ⇒ C_{1} −∘ ⋯ C_{n} −∘ A) ,

for some k, m, n ≥ 0 and goal formulas B_{1}, …, B_{m}, C_{1}, …, C_{n}. Uniform derivations have also been shown to be complete for this logic [25]; thus we use the predicate

prog : atm^{∗} → prplst^{∗} → prplst^{∗} → o

Table 5.7: Explicit eigenvariable encoding of lists

length nil^{∗} z =^{△} ⊤
length (A::^{∗} L) (s I) =^{△} length L I
list L =^{△} ∃i(nat i ∧ length L i)
element A (A::^{∗} L) =^{△} ⊤
element A (A′::^{∗} L) =^{△} element A L
split nil^{∗} nil^{∗} nil^{∗} =^{△} ⊤
split (A::^{∗} L_{1}) (A::^{∗} L_{2}) L_{3} =^{△} split L_{1} L_{2} L_{3}
split (A::^{∗} L_{1}) L_{2} (A::^{∗} L_{3}) =^{△} split L_{1} L_{2} L_{3}
permute nil^{∗} nil^{∗} =^{△} ⊤
permute (A::^{∗} L_{1}) L_{2} =^{△} ∃l_{22}(split L_{2} (A::^{∗} nil^{∗}) l_{22} ∧ permute L_{1} l_{22} )

to encode the set of definite clauses that make up the theory. The first argument represents the atomic head of the definite clause; the second and third arguments represent the lists C_{1}, …, C_{n} of linear hypotheses and B_{1}, …, B_{m} of intuitionistic hypotheses, respectively. The quantification of the definite clause is again encoded by the (elided) quantification of the definitional clause. The predicate

split seq : nt → atmlst^{∗} → atmlst^{∗} → prplst^{∗} → o

will be used to express the idea that the propositions in the last argument are derivable from the intuitionistic and linear antecedents in the second and third arguments. Each linear antecedent must be used exactly once in the derivation of all propositions in the last list. The inference rules for this logic are encoded in the definition D(linear) of Table 5.8, which defines the predicates seq and split seq. In the clause for ⋀i we subscript the constant fst with the type i because we will also be introducing a constant fsti→i for the representation of second-order eigenvariables. As in the previous section, different object-level theories can be considered by varying the definition of prog; an example theory will be given in Chapter 6. For convenience we will abbreviate the formula ∃i(nat i ∧ seq_{i} IL LL B) as IL; LL > B (or as >B when IL and LL are nil^{∗}).

Table 5.8: Explicit eigenvariable encoding of linear logic

seq_{I} IL (A′::^{∗} nil^{∗}) ⟨A⟩^{∗} =^{△} ⊤
seq_{I} (A′::^{∗} IL) nil^{∗} ⟨A⟩^{∗} =^{△} element ⟨A⟩^{∗} (A′::^{∗} IL)
seq_{(s I)} IL LL ⟨A⟩^{∗} =^{△} ∃ll∃il (\begin{matrix}list ll ∧ list il ∧ prog A ll il ∧ \\ split seq_{I} IL LL ll ∧ split seq_{I} IL nil^{∗} il) \end{matrix}
seq_{I} IL LL tt^{∗} =^{△} ⊤
seq_{(s I)} IL LL (B &^{∗} C) =^{△} seq_{I} IL LL B ∧ seq_{I} IL LL C
seq_{(s I)} IL LL (A −∘^{∗} B) =^{△} seq_{I} IL (A::^{∗} LL) B
seq_{(s I)} IL LL (A ⇒^{∗} B) =^{△} seq_{I} (A::^{∗} IL) LL B
seq_{(s I)} IL LL (⋀i B) =^{△} seq_{I} (λl IL (rst l)) (λl LL (rst l)) (λl B (rst l) (fsti l))
split seq_{I} IL nil^{∗} nil^{∗} =^{△} ⊤
split seq_{I} IL LL (B::^{∗} L) =^{△} ∃ll_{1}∃ll_{2} (split LL ll_{1} ll_{2} ∧
seq_{I} IL ll_{1}B ∧ split seq_{I} IL ll_{2} L)

We now proceed to prove the adequacy of this encoding. Since the representation is more complex and varies more from the typical higher-order abstract syntax encoding than the one presented in Section 5.2.1, we show its adequacy proof in more detail. We assume that all constants with return type i have at most second-order types built from only i and →. The restriction to types built from i is reasonable, since we expect the terms of our object logic to only be applied to other terms in the object logic. The second-order restriction reflects the second-order nature of the object logic. We also assume that rst is the only constant with return type evs, and that rst, fsti, and fsti→i are the only constants taking arguments of type evs. As a result, all terms of type evs will be of the form (rst^{n} l); furthermore, if such a term occurs as a subterm within a term of a different type, it must occur as an argument to either fsti or fsti→i.

As a first step toward proving the adequacy of our encoding, we formally define the mappings from closed terms (in βη long normal form) of type i^{∗}, atm^{∗}, and prp^{∗} to the terms, atoms, and formulas they represent. We assume that we have a canonical list of variables x_{1}, x_{2}, x_{3}, … that do not occur in the term under consideration; we will use these both for the free variables that are represented by the parameter of type evs and for bound variables. An upper bound on the number of free variables in a term can be determined Table 5.9: Decoding function for terms, atoms and goal formulas

⟨[λl fst_{υ} (rst^{m} l)]⟩_{n}^{υ} = x_{n−m}
⟨[λl c]⟩_{n}^{τ} = c where c is a constant symbol
⟨[λlλy : υ t]⟩_{n}^{υ→τ} = λx_{n}.⟨[λl′ t[rst l′/l][fst_{τ} l′/y]]⟩_{n+1}^{τ}
⟨[λl (f t)]⟩_{n}^{τ} = ⟨[λl f]⟩_{n}^{υ→τ} (⟨[λl t]⟩_{n}^{υ})
⟨[λl (p t_{1} … t_{m})]⟩_{n}^{atm} = p ⟨[λl t_{1}]⟩_{n}^{υ_{1}} … ⟨[λl t_{m}]⟩_{n}^{υ_{m}}
⟨[λl ⟨A⟩]⟩_{n}^{prp} = ⟨[λl A]⟩_{n}^{atm}
⟨[λl tt]⟩_{n}^{prp} = tt
⟨[λl (B & C)]⟩_{n}^{prp} = ⟨[λl B]⟩_{n}^{prp} & ⟨[λl C]⟩_{n}^{prp}
⟨[λl (A −∘ B)]⟩_{n}^{prp} = ⟨[λl A]⟩_{n}^{atm} −∘ ⟨[λl B]⟩_{n}^{prp}
⟨[λl (A ⇒ B)]⟩_{n}^{prp} = ⟨[λl A]⟩_{n}^{atm} ⇒ ⟨[λl B]⟩_{n}^{prp}
⟨[λl ⋀i(λy B)]⟩_{n}^{prp} = ⋀ x_{n}.⟨[λl′ B[rst l′/l][fsti l′/y]]⟩_{n+1}^{prp}

as follows: given the term λl.X, if X contains occurrences of (rst^{n} l), but does not contain occurrences of (rst^{m} l) for n < m, then at most n + 1 free variables will be needed for the mapping of λl.X. We parameterize our mappings by a number n that we assume is no less than this number of free variables in the term under consideration. This n will determine the specific variables from the list x_{1}, x_{2}, … that will be used as free variables. The mappings for terms, atoms, and goal formulas are defined in Table 5.9. In this table we use τ and υ to range over types built only from i and →; τ is used when the order of the type may be at most 2, and υ is used when the order may be at most 1. We will generally omit the type superscript when it is evident from the context. The mappings from lists to sets and multisets are obvious extensions of these. The definitional clause

∀y_{1} … ∀y_{k}.[prog A (C_{1} ::^{∗} ⋯ C_{n}::^{∗} nil^{∗}) (B_{1} ::^{∗} ⋯ B_{m}::^{∗} nil^{∗}) =^{△} ⊤]

represents the definite clause

⋀ x_{1} … ⋀ x_{k} (⟨[B_{1}θ]⟩_{k} ⇒ ⋯ ⟨[B_{m}θ]⟩_{k} ⇒ ⟨[C_{1}θ]⟩_{k} −∘ ⋯ ⟨[C_{n}θ]⟩_{k} −∘ ⟨[Aθ]⟩_{k}) ,

where θ is the substitution that replaces each variable y_{i} : τ by λl fst_{τ} (rst^{k−i} l). Since we allow first and second order variables in definite clauses, τ is either i or i → i. The constant fsti→i: evs → i → i is only used in this translation for definite clauses. Notice that 5.2. EXAMPLES 101

the quantified variables y_{1}, …, y_{k} should be able to match terms containing object-level eigenvariables, so should be of the type evs → τ. On the other hand, the definite clause itself should be closed, so the constants fst_{τ} and rst should not occur in the definitional clause and only bound variables should be needed by the mapping.

The adequacy of the logic encoding depends on the adequacy of the encoding of lists. The following proposition is provable by induction on L.

Proposition 5.6 Let D be a definition that extends D(list^{∗}(τ)) with clauses that do not define length, element, split, or permute. Then for any X: τ^{∗}, L, L′: lst^{∗}, multisets L′_{1} and L′_{2}, and natural number n such that ⟨[X]⟩_{n}, ⟨[L]⟩_{n}, and ⟨[L′]⟩_{n} are well-defined,

• ⟨[L]⟩_{n} is a multiset with cardinality m if and only if the sequent ⟶ length L (s^{m} z) is derivable in F Oλ^{ΔIN} with definition D;

• ⟨[X]⟩_{n} ∈ ⟨[L]⟩_{n} if and only if the sequent ⟶ element X L is derivable in F Oλ^{ΔIN} with definition D;

• ⟨[L]⟩_{n} is the multiset union of L′_{1} and L′_{2} if and only if there exist L_{1} and L_{2} such that ⟨[L_{1}]⟩_{n} = L′_{1}, ⟨[L_{2}]⟩_{n} = L′_{2}, and the sequent ⟶ split L L_{1} L_{2} is derivable in F Oλ^{ΔIN} with definition D;

• ⟨[L]⟩_{n} and ⟨[L′]⟩_{n} are the same multiset if and only if the sequent ⟶ permute L L′ is derivable in F Oλ^{ΔIN} with definition D.

Theorem 5.7 Fix a F Oλ^{ΔIN} signature whose only constants with types involving evs are fsti, fsti→i, and rst. Let D(prog) be the definition

{∀ȳ_{1}[prog A_{1} LL_{1} IL_{1} =^{△} ⊤], …, ∀ȳ_{m}[prog A_{m} LL_{m} IL_{m} =^{△} ⊤]}

(m ≥ 0), where the quantified variables in the list ȳ_{i} each have type evs → i or evs → i → i, and the constants fst_{τ} and rst do not occur in A_{i}, LL_{i}, or IL_{i}, for all i ∈ {1, …, m}. Let P be the theory in linear logic that corresponds to D(prog), and let D be a definition that extends D(nat) ∪ D(list^{∗}(atm)) ∪ D(list^{∗}(prp)) ∪ D(linear) ∪ D(prog) with clauses that do not define nat, length, list, element, split, split seq, prog, or seq. Finally, let IL: atmlst^{∗}, LL: atmlst^{∗}, and B: prp^{∗} be terms that do not contain occurrences of the constant fsti→i 102 CHAPTER 5. REASONING ABOUT LOGICS IN F Oλ^{ΔIN}

and let n be a natural number such that ⟨[IL]⟩_{n},⟨[LL]⟩_{n}, and ⟨[B]⟩_{n} are well-defined. Then the sequent ⟶ IL; LL > B is derivable in F Oλ^{ΔIN} with definition D if and only if the sequent P, ⟨[IL]⟩_{n}; ⟨[LL]⟩_{n} ⟶ ⟨[B]⟩_{n} is derivable in linear logic.

Proof: We can restrict our attention to uniform derivations in linear logic, since they are complete for this fragment of linear logic [25]. By Theorem 3.13 we can focus on cut-free F Oλ^{ΔIN} derivations, and by Lemma 5.2 these derivations will consist only of sequents with empty antecedents. Thus the definition of seq will ensure that the structure of the F Oλ^{ΔIN} derivation will closely follow that of the corresponding derivation in linear logic. The proof of the forward direction goes by induction on the structure of the F Oλ^{ΔIN} derivation, and the reverse direction by induction on the structure of the linear logic derivation. In general each case follows easily from the induction hypothesis. When the derivation ends with the initial rule using an intuitionistic antecedent, Proposition 5.6 is needed. When the derivation ends with the use of a definite clause in the theory, we need to know that there is an i such that the sequents ⟶ nat i and ⟶ split seq_{i} IL LL (B_{1} ::^{∗} ⋯ B_{m} ::^{∗} nil^{∗}) are derivable in F Oλ^{ΔIN} if and only if there are multisets LL′_{1}, …, LL′_{m} such that ⟨[LL]⟩_{n} is the multiset union of LL′_{1}, …, LL′_{m} and the sequents P, ⟨[IL]⟩_{n}; LL′_{1} ⟶ ⟨[B_{1}]⟩_{n}, …, P, ⟨[IL]⟩_{n}; LL′_{m} ⟶ ⟨[B_{m}]⟩_{n} are derivable in linear logic. This follows from the induction hypothesis by Proposition 5.6 and an additional induction on m. For the reverse direction of this case and the &R case, we also need to know that the formulas

∀i(nat i ⊃ ∀j(nat j ⊃ ∃k(nat k ∧ i < k ∧ j < k)))
∀i∀j∀il∀ll∀b(nat i ⊃ i < j ⊃ seq_{i} il ll b ⊃ seq_{j} il ll b)
∀i∀j∀l∀il∀ll(nat i ⊃ i < j ⊃ split seq_{i} il ll l ⊃ split seq_{j} il ll l)

are derivable in F Oλ^{ΔIN}; this follows from Propositions 2.17 and 5.11.

We now present the theorems that we have derived in F Oλ^{ΔIN} about our object logic. In order to express and prove these theorems, we need additional predicates for operations related to the evs parameter. The predicates

subst : nt → i^{∗} → τ^{∗} → τ^{∗} → o
subst0 : nt → i^{∗∗} → τ^{∗∗} → τ^{∗∗} → o ,

Table 5.10: Encoding of eigenvariable operations

subst I T X X′ =^{△} subst_{0} I (λl′ T) (λl′ X) (λl′ X′)

subst_{0} z T (λl′λl X l′ (fst l) (rst l)) (λl′λl X l′ (T l′ l) (rst l))

=^{△} ⊤

subst

0

(s I) (λl′λl T l′ (fst l) (rst l))

(λl′λl X l′ (fst l) (rst l)) (λl′λl X′ l′ (fst l) (rst l))

=^{△} subst_{0} I (λl′λl T (rst l′) (fst l′) l) (λl′λl X (rst l′) (fst l′) l) (λl′λl X′ (rst l′) (fst l′) l)
extend evars I X X′ =^{△} extend evars_{0} I (λl′ X) (λl′ X′)

extend evars_{0} z (λl′λl X l′ l) (λl′λl X l′ (rst l))

=^{△} ⊤

extend evars_{0} (s I) (λl′λl X l′ (fst l) (rst l)) (λl′λl X′ l′ (fst l) (rst l))

=^{△} extend evars_{0} I (λl′λl X (rst l′) (fst l′) l) (λl′λl X′ (rst l′) (fst l′) l)

will be use to represent substitution for eigenvariables; this is a simple generalization of the predicate of Section 5.1.4 to allow substitution in expressions of an arbitrary type τ. The type τ^{∗∗} should be understood to mean (τ^{∗})^{∗}, i.e. an abbrevation for (evs → evs → τ). We will also use the predicates

extend evars : nt → τ^{∗} → τ^{∗} → o
extend evars0 : nt → τ^{∗∗} → τ^{∗∗} → o ,

to add a new eigenvariable to the list at an offset. Thus extend evars i x x′ indicates that x′ is the result of adding a new eigenvariable in x at the (i + 1)^{th} position in the list; the eigenvariables that previously occupied positions (i + 1) or greater are shifted to one position later in the list. These predicates are defined in the definition D(evars(τ)) of Table 5.10. We will also need an version of D(list(τ)) to work over the type lst^{∗∗}; it is similar to D(list^{∗}(τ)) and we will refer it as D(list^{∗∗}(τ)).

Since we want our theorems about the object logic to be independent of any particular object logic theory, we need to include some assumptions about the predicate prog. Specifically, we will need to know that if an atom matches the head of a clause in the theory, then 104 CHAPTER 5. REASONING ABOUT LOGICS IN F Oλ^{ΔIN}

if we substitute for an eigenvariable in the atom or extend the list of eigenvariables, then the resulting atom will still match the head of the clause. We encode these assumptions as the following two formulas:

∀i∀t∀a∀a′∀ll∀il(\begin{matrix}nat i ⊃ prog a ll il ⊃ subst i t a a′ ⊃ \\ ∃ll′∃il′(prog a′ ll′ il′ ∧ subst i t ll ll′ ∧ subst i t il il′)) , \end{matrix}

which we will refer to as Psubst, and

∀i∀a∀a′∀ll∀il(\begin{matrix}nat i ⊃ prog a ll il ⊃ extend evars i a a′ ⊃ \\ ∃ll′∃il′(prog a′ ll′ il′ ∧ extend evars i ll ll′ ∧ extend evars i il il′ )) , \end{matrix}

which we will refer to as Pextend. The theory should not contain occurrences of eigenvariables, and if the definition of prog does not contain occurrences of fst or rst, then Psubst and Pextend will be derivable in F Oλ^{ΔIN}.

The following theorems state that we can derive in F Oλ^{ΔIN} that the specialization rule, the cut rule, and the usual linear logic structural rules are admissible for our object logic. We refer to the definition

D(list^{∗}(atm)) ∪ D(list^{∗}(prp)) ∪ D(list^{∗∗}(atm)) ∪ D(list^{∗∗}(prp))

as D(lists) and the definition

D(evars(atm)) ∪ D(evars(prp)) ∪ D(evars(atmlst)) ∪ D(evars(prplst))

as D(evars).

Theorem 5.8 The formula

Psubst ⊃
∀i∀b∀il∀ll(nat i ⊃ list il ⊃ list ll ⊃ seq_{(s i)} il ll ⋀^{∗} b ⊃ ∀x seq_{i} il ll (b x))

is derivable in F Oλ^{ΔIN} using the definition D(nat) ∪ D(lists) ∪ D(evars) ∪ D(linear).

Theorem 5.9 The formulas

Pextend ⊃
∀a∀b∀il∀ll(list il ⊃ list ll ⊃ (a::^{∗} il); ll > b ⊃ il; nil^{∗} > ⟨a⟩^{∗} ⊃ il; ll > b)

Pextend ⊃

∀a∀b∀il∀ll∀ll_{1}∀ll_{2}(\begin{matrix}list il ⊃ list ll ⊃ split ll ll_{1} ll_{2} ⊃ \\ il; (a::^{∗} ll_{1}) > b ⊃ il; ll_{2} > ⟨a⟩^{∗} ⊃ il; ll > b) \end{matrix}

are derivable in F Oλ^{ΔIN} using the definition D(nat) ∪ D(lists) ∪ D(evars) ∪ D(linear).

Theorem 5.10 The formula

∀i∀b∀il∀il′∀ll∀ll′(\begin{matrix}nat i ⊃ list il ⊃ list il′ ⊃ list ll ⊃ \\ ∀a(element a il ⊃ element a il′) ⊃ permute ll ll′ ⊃ \\ seq_{i} il ll b ⊃ seq_{i} il′ ll′ b) \end{matrix}

is derivable in F Oλ^{ΔIN} using the definition D(nat) ∪ D(lists) ∪ D(evars) ∪ D(linear).

The last proposition of this section states two additional properties of our object logic that are derivable in F Oλ^{ΔIN}.

Proposition 5.11 The following formulas are derivable in F Oλ^{ΔIN} using the definition D(nat) ∪ D(lists) ∪ D(evars) ∪ D(linear):

∀i∀j∀il∀ll∀b(nat i ⊃ i < j ⊃ seq_{i} il ll b ⊃ seq_{j} il ll b)
∀i∀j∀l∀il∀ll(nat i ⊃ i < j ⊃ split seq_{i} il ll l ⊃ split seq_{j} il ll l) .

5.3 Related Work

In this chapter we have presented several different encodings of logics; for each we discussed the extent to which reasoning about the encoded logic can take place within the meta-logic F Oλ^{ΔIN}. None of the encoding techniques is completely original, but their ability to support formal meta-theoretic analysis is a relatively new concern.

The natural deduction-style encoding of Section 5.1.1 is the prototypical representation style of higher-order abstract syntax. For example, the seminal paper on the Edinburgh Logical Framework (LF) [24] encodes first-order and higher-order logic in this manner and proves the adequacy of these encodings. The issue of meta-theoretic analysis of the encodings within the meta-logic is not addressed.

106 CHAPTER 5. REASONING ABOUT LOGICS IN F Oλ^{ΔIN}

The use of separate predicates for formulas on the left and right sides of the sequent, as was done in Section 5.1.2, is also common. Pfenning [45], for example, uses this representation style to encode structural cut-elimination proofs for intuitionistic, classical, and linear logics. The induction cases of these proofs are represented in Elf, so some amount of reasoning about the encoded logics is done in the meta-logic. However Elf does not itself contain any support for induction, so the completeness of the cases must be checked outside of the formal framework using techniques such as schema checking [47, 48]. Miller [37] uses both this sequent style of encoding and the natural deduction style. The two encodings are used to show that natural deduction and sequent calculus presentations of minimal logic have the same theorems. The proof of this result combines informal reasoning with formal reasoning in the meta-logic Forum.

Section 5.1.3 presented an encoding of logic which encoded the derivability of a sequent in a single predicate. This style of encoding was used in an early paper on the use of higher-order abstract syntax [38]. The paper focuses on an operational interpretation of such a specification, however, and does not discuss the potential for reasoning about the encoded logic in the meta-logic.

The idea of representing free variables as a list, discussed in Section 5.1.4, was first used in the context of higher-order abstract syntax by Despeyroux and Hirschowitz [9]. Their intent was to develop a way to use higher-order abstract syntax within the setting of the inductive definition facility of Coq. A key difference between their technique and ours is that they use both constructor and deconstructor operators for lists in the context of an equality theory. The encoding of the right rule for universal quantification in that setting might look like the following:

seq_{(s I)} L (λl ⋀i(λx B (cons x l))) =^{△} seq_{I} (λl′ L(rst l′)) B .

Within terms, bound and free variables are accessed by selecting the appropriate element from the list. In our simpler setting (without an equality theory) we use unification to get by with only deconstructors. The paper [9] was the first attempt to fully support formal reasoning about higher-order abstract syntax encodings within a meta-logic. Their examples involved encodings of simply-typed λ-terms, so we will further discuss their work at the end of the next chapter.

Chapter 6

Reasoning about Programming

Languages in F Oλ^{ΔIN}

In this chapter we consider reasoning about higher-order abstract syntax encodings of programming languages. We could choose one of the representation strategies used for logics in the previous chapter; instead we adopt a different strategy that allows us to use the traditional higher-order abstract syntax representation to its full advantage and still reason formally about the encoded system. The key to accomplishing this is to not specify the programming language directly in F Oλ^{ΔIN}, but in a small object logic that is itself specified in F Oλ^{ΔIN}. In this way we can reason in F Oλ^{ΔIN} about the structure of object logic sequents and their derivability.

The use of object-level sequents may seem at first a rather drastic step to take to embed the kind of hypothetical judgements common with higher-order abstract syntax into a metalogic. Such a representation is, however, used in various areas of programming language semantics. For example, Mitchell, in his textbook [41], uses typing judgements of the form Γ > M : σ and performs induction over their (sequent-style) derivation. This separation of the (object) specification logic from the meta-logic (F Oλ^{ΔIN}) in which reasoning is performed also reflects the usual structure of informal reasoning about higher-order abstract syntax encodings.

In the next section we motivate this approach through an informal proof of subject 108 CHAPTER 6. REASONING ABOUT PROGRAMMING LANGUAGES

reduction for the untyped λ-calculus. We proceed in Section 6.2 to formalize this proof by encoding the static and dynamic semantics for untyped λ-terms in the intuitionistic object logic of Section 5.2.1. We also list a variety of other theorems about the language that we have derived in F Oλ^{ΔIN}. Section 6.3 extends the encoding of Section 6.2 to the Programming language of Computable Functions (PCF) [52]. We examine a derivation of the unicity of typing for PCF to show that the encoding of quantification in the object logic does not support the kinds of analysis used in the typical informal proof of this theorem. In Section 6.4 we consider an encoding of PCF with references (PCF_{:=}) [18] in the linear object logic of Section 5.2.2. Since the encoding of this object logic uses the explicit eigenvariable style of Section 5.1.4, we are able to encode the standard proof of the unicity of typing in F Oλ^{ΔIN}. Finally, Section 6.5 compares the framework of this chapter with other research in formal reasoning about higher-order abstract syntax encodings. Most of the research discussed in this chapter was presented in [31], coauthored with Miller; the notable exception is Section 6.4, which is new.

6.1 Motivation from Informal Reasoning

In order to motivate our framework for reasoning about higher-order abstract syntax encodings, we consider a specification in intuitionistic logic of call-by-name evaluation and simple typing for the untyped λ-calculus. We introduce two types, tm and ty, to denote object-level terms and types. To represent the untyped λ-terms we introduce the two constants abs of type (tm → tm) → tm and app of type tm → tm → tm to denote object-level abstraction and application, respectively. Object-level types will be built up from a single primitive type using the arrow type constructor; these are denoted in the specification logic by the constants gnd of type ty and arr of type ty → ty → ty.

To specify call-by-name evaluation, we use an infix predicate ⇓ of type tm → tm → o and the two formulas

⋀ r((abs r) ⇓ (abs r))
⋀ m ⋀ n ⋀ v ⋀ r((m ⇓ (abs r) & (r n) ⇓ v) ⇒ (app m n) ⇓ v) .

To specify simple typing at the object-level, we use the binary predicate typeof of type 6.1. MOTIVATION FROM INFORMAL REASONING 109

tm → ty → o and the two formulas ⋀ m ⋀ n ⋀ t ⋀ u((typeof m (arr u t) & typeof n u) ⇒ typeof (app m n) t)

⋀ r ⋀ t ⋀ u(⋀ x(typeof x t ⇒ typeof (r x) u) ⇒ typeof (abs r) (arr t u)) .

Proofs that these two predicates correctly capture the notions of call-by-name evaluation and of simple typing can be found in various places in the literature: see, for example, [3, 23].

Now consider the following subject reduction theorem and its proof. We use ⊢ here to represent derivability in intuitionistic logic from the above formulas encoding evaluation and typing; we omit displaying these formulas on the left of the turnstile to simplify the presentation.

Proposition 6.1 If ⊢ P ⇓ V and ⊢ typeof P T, then ⊢ typeof V T.

Proof We prove this theorem by induction on the height of the derivation of P ⇓ V. Since P ⇓ V is atomic, its derivation must end with the use of one of the formulas encoding evaluation. If the ⇓ formula for abs is used, then P and V are both equal to abs R, for some R, and the consequent is immediate. If P ⇓ V was derived using the ⇓ formula for app, then P is of the form (app M N), and for some R there are shorter derivations of M ⇓ (abs R) and (R N) ⇓ V. Since ⊢ typeof (app M N) T, this typing judgement must have been derived using one of the formulas encoding the typing rules and, hence, there is a U such that ⊢ typeof M (arr U T) and ⊢ typeof N U. Using the inductive hypothesis, we have ⊢ typeof (abs R) (arr U T). This atomic formula must have been derived using the typeof formula for abs, and, hence, ⊢ ⋀ x(typeof x U ⇒ typeof (R x) T). Since our specification logic is intuitionistic logic, we can instantiate this quantifier with N and use cut and cut-elimination to conclude that ⊢ typeof (R N) T. Using the inductive hypothesis a second time yields ⊢ typeof V T.

This proof is clear and natural, and we would like to be able to formally capture proofs quite similar to this in structure. This suggests that the following features would be valuable in our framework:

1. Two distinct logics. One of the logics would correspond to the one written with logical syntax above and would capture judgements, e.g. about typability and evaluation.

The second logic would represent a formalization of the English text in the proof above. Atomic formulas of that logic would encode judgements in the object logic.

2. Induction over at least natural numbers.

3. Instantiation of meta-level eigenvariables. In the proof above, for example, the metalevel variable P was instantiated in one part of the proof to (abs R) and in another part of the proof to (app M N). Notice that this instantiation of eigenvariables within a proof does not happen in a strictly intuitionistic sequent calculus.

4. Analysis of the derivation of an assumed judgement. In the proof above this was done a few times, leading, for example, from the assumption

⊢ typeof (abs R) (arr U T)

to the assumption

⊢ ⋀ x(typeof x U ⇒ typeof (R x) T) .

The specification of typeof allows the implication to go in the other direction, but given the structure of the specification of typeof, this direction can also be justified at the meta-level.

In our framework, we accommodate the first feature by specifying an object logic within the meta-logic F Oλ^{ΔIN}, as illustrated in Chapter 5. The natL rule of F Oλ^{ΔIN} provides natural number induction. The last two features are accommodated by the definition facilities of F Oλ^{ΔIN}.

6.2 The Language of Untyped λ-Terms

We first demonstrate our approach to formal reasoning about higher-order abstract syntax encodings using the example of untyped λ-terms. This encoding will be similar to the one used to motivate the framework in the preceding section. The object logic used will be the fragment of second-order intuitionistic logic encoded by the definition D(intuit) of Section 5.2.1.

6.2. THE LANGUAGE OF UNTYPED λ-TERMS 111

Table 6.1: Object logic encoding of typing and evaluation of untyped λ-terms

prog (typeof (abs R) (arr T U)) ⋀ n((typeof n T) ⇒ ⟨typeof (R n) U⟩) prog (typeof (app M N) T) ⟨typeof M (arr U T)⟩ & ⟨typeof N U⟩

prog ((abs R) ⇓ (abs R)) tt

prog ((app M N) ⇓ V) ⟨M ⇓ (abs R)⟩ & ⟨(R N) ⇓ V ⟩

prog ((app (abs R) M) ⇝ (R M)) tt

prog ((app M N) ⇝ (app M′ N)) ⟨M ⇝ M′⟩

prog (M ⇝^{∗} M) tt

prog (M ⇝^{∗} N) ⟨M ⇝ M′⟩ & ⟨M′ ⇝^{∗} N⟩

The required constants to represent λ-terms are abs : (itm → itm) → itm and app : itm → itm → itm; for simple types (over one primitive type) we need gnd: ity and arr: ity → ity → ity. Since both types and terms in the language are represented by the object logic type i, we have added subscripts tm and ty. These subscripts should not be considered part of the encoding, but are added to improve the readability of these declarations.

Our object logic predicate representing typability is denoted by the F Oλ^{ΔIN} constant typeof of type itm → ity → atm. The predicates for natural semantics and transition semantics are denoted by the constants ⇓, ⇝, and ⇝^{∗}, all of type itm → itm → atm. The object logic specifications for these are the usual ones, written in the L_{λ} subset of higherorder logic [35] and are those common to specifications written in, say, λProlog [22] and Elf [44]. This object-level specification is represented in F Oλ^{ΔIN} as the definition D(lambda) shown in Table 6.1. (We have dropped the =^{△} ⊤ body of these clauses.) This definition can be interpreted in a logic programming fashion to compute object-level simple type checking and call-by-name evaluation in both structural operational semantic and natural semantic styles. Call-by-value is just as easily represented and used.

The following theorems list the properties of the untyped λ-calculus that we have derived in F Oλ^{ΔIN}: determinacy of semantics, equivalence of semantics, and subject reduction. The F Oλ^{ΔIN} derivations closely follow the informal proofs of these properties.

Theorem 6.2 The following formulas are derivable in F Oλ^{ΔIN} from the definition that 112 CHAPTER 6. REASONING ABOUT PROGRAMMING LANGUAGES

accumulates D(nat), D(list(atm)), D(intuit), D(lambda) and the clause X ≡ X =^{△} ⊤ defining the predicate ≡: i → i → o:

∀m∀m_{1}∀m_{2}(>⟨m ⇓ m_{1}⟩ ⊃ >⟨m ⇓ m_{2}⟩ ⊃ m_{1} ≡ m_{2})

∀m∀m_{1}∀m_{2}(>⟨m ⇝ m_{1}⟩ ⊃ >⟨m ⇝ m_{2}⟩ ⊃ m_{1} ≡ m_{2})
∀m∀r_{1}∀r_{2}(>⟨m ⇝^{∗} (abs r_{1})⟩ ⊃ >⟨m ⇝^{∗} (abs r_{2})⟩ ⊃ (abs r_{1}) ≡ (abs r_{2})) .

Theorem 6.3 The following formulas are derivable in F Oλ^{ΔIN} from the definition that accumulates D(nat), D(list(atm)), D(intuit), D(lambda) and the clause X ≡ X =^{△} ⊤ defining the predicate ≡: i → i → o:

∀m∀r(>⟨m ⇓ (abs r)⟩ ⊃ >⟨m ⇝^{∗} (abs r)⟩)

∀m∀r(>⟨m ⇝^{∗} (abs r)⟩ ⊃ >⟨m ⇓ (abs r)⟩) .

Theorem 6.4 The following formulas are derivable in F Oλ^{ΔIN} from the definition that accumulates D(nat), D(list(atm)), D(intuit), D(lambda) and the clause X ≡ X =^{△} ⊤ defining the predicate ≡: i → i → o:

∀m∀n(>⟨m ⇓ n⟩ ⊃ ∀t(>⟨typeof m t⟩ ⊃ >⟨typeof n t⟩))

∀m∀n(>⟨m ⇝ n⟩ ⊃ ∀t(>⟨typeof m t⟩ ⊃ >⟨typeof n t⟩))
∀m∀n(>⟨m ⇝^{∗} n⟩ ⊃ ∀t(>⟨typeof m t⟩ ⊃ >⟨typeof n t⟩)) .

Proof We show the derivation of the first subject reduction property, which is a formalization of Proposition 6.1.

We wish to show that evaluation preserves types:

⟶ ∀p∀v(>⟨p ⇓ v⟩ ⊃ ∀t(>⟨typeof p t⟩ ⊃ >⟨typeof v t⟩)) .

(We have changed the names of the quantified variables to agree with those in the informal proof.) Applying the ∀R, ⊃ R, ∃L, cL, and ∧L rules to the above sequent yields

nat i, seq_{i} nil ⟨p ⇓ v⟩, >⟨typeof p t⟩ ⟶ >⟨typeof v t⟩ .

(Recall that >⟨p ⇓ v⟩ is an abbreviation for ∃i(nat i ∧ seq_{i} nil ⟨p ⇓ v⟩).)

As in the informal proof, we proceed with an induction on the height of the derivation of p ⇓ v, which is represented here by i. We will use the derived rule for complete induction (Proposition 2.16) and our induction predicate will be

λi∀p∀v∀t(seq_{i} nil ⟨p ⇓ v⟩ ⊃ >⟨typeof p t⟩ ⊃ >⟨typeof v t⟩) ,

6.2. THE LANGUAGE OF UNTYPED λ-TERMS 113

which we will denote by IP. The derivation of the conclusion from the induction predicate applied to i is trivial, so it only remains to derive the induction step

nat j, ∀k(nat k ⊃ k < j ⊃ (IP k)) ⟶ (IP j) .

In the informal proof we use the fact that the derivation of the atomic formula p ⇓ v must end with the use of a clause from the specification of evaluation. We deduce this formally using the def L rule as follows:

nat (s j_{0}), ∀k …, ∃b(prog (p ⇓ v) b ∧ seq_{j_{0}} nil b), >⟨typeof p t⟩ ⟶ >⟨typeof v t⟩ nat j, ∀k …, seq_{j} nil ⟨p ⇓ v⟩, >⟨typeof p t⟩ ⟶ >⟨typeof v t⟩ def L ⊃ R nat j, ∀k … ⟶ seq_{j} nil ⟨p ⇓ v⟩ ⊃ >⟨typeof p t⟩ ⊃ >⟨typeof v t⟩ ∀R nat j, ∀k(nat k ⊃ k < j ⊃ (IP k)) ⟶ (IP j) .

We next apply the ∃L, cL, and ∧L rules, and then apply the def L rule to prog (p ⇓ v) b which yields the two sequents

nat (s j_{0}), ∀k …, seq_{j_{0}} nil tt, >⟨typeof (abs r) t⟩ ⟶ >⟨typeof (abs r) t⟩
nat (s j_{0}), ∀k …, seq_{j_{0}} nil ⟨m ⇓ (abs r)⟩ & ⟨(r n) ⇓ v⟩,
>⟨typeof (app m n) t⟩⟶ >⟨typeof v t⟩ .

This use of the def L rule corresponds to the case analysis of the formula used to derive p ⇓ v. As in the informal case, the abs case (represented here by the first sequent) is immediate. The derivation of the second sequent, representing the app case, begins with the use of the def L, cL, and ∧L, bringing us to the sequent

nat (s^{2} j_{1}), ∀k …, seq_{j_{1}} nil ⟨m ⇓ (abs r)⟩, seq_{j_{1}} nil ⟨(r n) ⇓ v⟩,

>⟨typeof (app m n) t⟩⟶ >⟨typeof v t⟩ .

(We use the term s^{2} j_{1} as an abbreviation for s (s j_{1}).)

The informal proof continues with an analysis of the derivation of typeof (app m n) t. Again we accomplish this through two uses of the def L rule, the first to indicate that the derivation must end with the use of a specification clause, and the second to determine the applicable clauses. In this case there is only one applicable clause, so we are left to derive the sequent

…, nat (s j′_{0}), seq_{j′_{0}} nil ⟨typeof m (arr u t)⟩ & ⟨typeof n u⟩ ⟶ >⟨typeof v t⟩ .

Additional uses of the def L, cL and ∧L rules bring us to the sequent

…, nat (s^{2} j′_{1}), seq_{j′_{1}} nil ⟨typeof m (arr u t)⟩, seq_{j′_{1}} nil ⟨typeof n u⟩ ⟶ >⟨typeof v t⟩ .

In the informal proof we now apply the induction hypothesis to the evaluation and typing judgments for m. We accomplish this here by applying the appropriate left rules to the elided induction hypothesis ∀k . . .. This requires the derivation of the five sequents

nat (s^{2} j_{1}), … ⟶ nat j_{1}  nat (s^{2} j_{1}), … ⟶ j_{1} < (s^{2} j_{1})
…, seq_{j_{1}} nil ⟨m ⇓ (abs r)⟩, … ⟶ seq_{j_{1}} nil ⟨m ⇓ (abs r)⟩
…, nat (s^{2} j′_{1}), seq_{j′_{1}} nil ⟨typeof m (arr u t)⟩, … ⟶ >⟨typeof m (arr u t)⟩
nat (s^{2} j_{1}), ∀k …, seq_{j_{1}} nil ⟨(r n) ⇓ v⟩,
>⟨typeof (abs r) (arr u t)⟩,
nat (s^{2} j′_{1}), seq_{j′_{1}} nil ⟨typeof n u⟩⟶ >⟨typeof v t⟩ .

The first two of these represent the fact that the measure of the evaluation derivation for m is a natural number that is smaller than the measure of the original evaluation derivation for p. By Proposition 2.17 these are derivable in F Oλ^{ΔIN} from D(nat). The third sequent is immediate, and the fourth also follows from Proposition 2.17:

…, nat (s^{2} j′_{1}), … ⟶ nat j′_{1} … ⟶ seq_{j′_{1}} ⟨typeof m (arr u t)⟩ init … ⟶ nat j′_{1} ∧ seq_{j′_{1}} ⟨typeof m (arr u t)⟩ ∧R …, nat (s^{2} j′_{1}), seq_{j′_{1}} nil ⟨typeof m (arr u t)⟩, … ⟶ >⟨typeof m (arr u t)⟩ ∃R .

The derivation of the fifth sequent proceeds with another two applications of the def L rule, corresponding to the analysis of the proof of typeof (abs r) (arr u t) in the informal proof. This yields the sequent

…, nat (s j′′_{0}), seq_{j′′_{0}} nil ⋀ x((typeof x u) ⇒ ⟨typeof (r x) t⟩), … ⟶ >⟨typeof v t⟩ .

This is followed by applications of the def L and ∀L rules to give us

…, nat (s^{3} j′′_{1}), seq_{j′′_{1}} ((typeof n u)::nil) ⟨typeof (r n) t⟩, … ⟶ >⟨typeof v t⟩ .

6.3. A LANGUAGE FOR COMPUTABLE FUNCTIONS 115

The informal proof proceeds with a use of the cut rule, and here we use the derived object-level cut rule (Theorem 5.4) with the elided assumption seq_{j′_{1}} nil ⟨typeof n u⟩ to obtain

…, nat (s^{3} j′′_{1}), seq_{j′′_{1}} ((typeof n u)::nil) ⟨typeof (r n) t⟩,
… ⟶ ((typeof n u)::nil) > ⟨typeof (r n) t⟩
…, nat (s^{2} j′_{1}), seq_{j′_{1}} nil ⟨typeof n u⟩ ⟶ >⟨typeof n u⟩
…, >⟨typeof (r n) t⟩ ⟶ >⟨typeof v t⟩ .

The first two of these follow easily from Proposition 2.17.

The informal proof concludes by applying the induction hypothesis to the evaluation and typing judgments for (r n). Again we accomplish this by applying the appropriate left rules to the induction hypothesis ∀k …, which requires the derivation of the five sequents

nat (s^{2} j_{1}) ⟶ nat j_{1}  nat (s^{2} j_{1}) ⟶ j_{1} < (s^{2} j_{1})
…, seq_{j_{1}} nil ⟨(r n) ⇓ v⟩, … ⟶ seq_{j_{1}} nil ⟨(r n) ⇓ v⟩
…, >⟨typeof (r n) t⟩ ⟶ >⟨typeof (r n) t⟩
…, >⟨typeof v t⟩ ⟶ >⟨typeof v t⟩ .

The first two sequents follow from Proposition 2.17, and the last three are all immediate.

6.3 A Language for Computable Functions

We now extend the encoding of the static and dynamic semantics for untyped λ-terms from the previous section to the programming language PCF [52]. The necessary F Oλ^{ΔIN} constants for PCF types are

num : ity  bool : ity  arr : ity → ity → ity .

Those for PCF terms are

zero : itm  succ : itm → itm  if : itm → itm → itm → itm
true : itm  pred : itm → itm  abs : ity → (itm → itm) → itm
false : itm  is zero : itm → itm  app : itm → itm → itm
rec : ity → (itm → itm) → itm .

Table 6.2: Object logic encoding of typing for PCF

prog (typeof zero num) tt prog (typeof true bool) tt prog (typeof false bool) tt prog (typeof (succ M) num) ⟨typeof M num⟩ prog (typeof (pred M) num) ⟨typeof M num⟩ prog (typeof (is zero M) bool) ⟨typeof M num⟩ prog (typeof (if M N_{1} N_{2}) T) ⟨typeof M bool⟩ & ⟨typeof N_{1} T ⟩ & ⟨typeof N_{2} T ⟩ prog (typeof (abs T R) (arr T U)) ⋀ n((typeof n T) ⇒ ⟨typeof (R n) U⟩) prog (typeof (app M N) T) ⟨typeof M (arr U T)⟩ & ⟨typeof N U⟩ prog (typeof (rec T R) T) ⋀ n((typeof n T) ⇒ ⟨typeof (R n) T ⟩)

We have again labeled the type i with subscripts to improve the readability of these declarations. The first argument to abs and rec represent the PCF type tag for the variable bound by the abstraction and recursion constructs.

The object logic predicates representing typability and evaluation are denoted by the same F Oλ^{ΔIN} constants as in Section 6.2, plus the additional constant value : itm → atm. The object-level specification is represented in F Oλ^{ΔIN} as the definition D(PCF) shown in Tables 6.2, 6.3, and 6.4; we have again omitted the =^{△} ⊤ body of the clauses. The following theorems list the properties of PCF that we have derived in F Oλ^{ΔIN}. The type tags in PCF terms allow the unicity of typing to hold in addition to the determinacy of semantics, equivalence of semantics and subject reduction. The F Oλ^{ΔIN} derivations again closely follow the informal proofs of these properties; the only exception is the derivation of the unicity of typing property, which we sketch below.

Theorem 6.5 The following formulas are derivable in F Oλ^{ΔIN} from the definition that accumulates D(nat), D(list(atm)), D(intuit), D(PCF) and the clause X ≡ X =^{△} ⊤ defining the predicate ≡: i → i → o:

∀m∀m_{1}∀m_{2}(>⟨m ⇓ m_{1}⟩ ⊃ >⟨m ⇓ m_{2}⟩ ⊃ m_{1} ≡ m_{2})
∀m∀m_{1}∀m_{2}(>⟨m ⇝ m_{1}⟩ ⊃ >⟨m ⇝ m_{2}⟩ ⊃ m_{1} ≡ m_{2})
∀m∀v_{1}∀v_{2}(>⟨value v_{1}⟩ ⊃ >⟨m ⇝^{∗} v_{1}⟩ ⊃ >⟨value v_{2}⟩ ⊃ >⟨m ⇝^{∗} v_{2}⟩ ⊃ v_{1} ≡ v_{2}) .

Table 6.3: Object logic encoding of natural semantics for PCF

prog (zero ⇓ zero) tt prog (true ⇓ true) tt prog (false ⇓ false) tt prog ((succ M) ⇓ (succ V)) ⟨M ⇓ V ⟩ prog ((pred M) ⇓ zero) ⟨M ⇓ zero⟩ prog ((pred M) ⇓ V) ⟨M ⇓ (succ V)⟩ prog ((is zero M) ⇓ true) ⟨M ⇓ zero⟩ prog ((is zero M) ⇓ false) ⟨M ⇓ (succ V)⟩ prog ((if M N_{1} N_{2}) ⇓ V) ⟨M ⇓ true⟩ & ⟨N_{1} ⇓ V ⟩ prog ((if M N_{1} N_{2}) ⇓ V) ⟨M ⇓ false⟩ & ⟨N_{2} ⇓ V ⟩ prog ((abs T R) ⇓ (abs T R)) tt prog ((app M N) ⇓ V) ⟨M ⇓ (abs T R)⟩ & ⟨(R N) ⇓ V ⟩ prog ((rec T R) ⇓ V) ⟨(R (rec T R)) ⇓ V ⟩

Table 6.4: Object logic encoding of transition semantics for PCF

prog ((succ M) ⇝ (succ M′)) ⟨M ⇝ M′⟩ prog ((pred zero) ⇝ zero) tt prog ((pred (succ V)) ⇝ V) ⟨value V ⟩ prog ((pred M) ⇝ (pred M′)) ⟨M ⇝ M′⟩ prog ((is zero zero) ⇝ true) tt prog ((is zero (succ V)) ⇝ false) ⟨value V ⟩ prog ((is zero M) ⇝ (is zero M′)) ⟨M ⇝ M′⟩ prog ((if true M N) ⇝ M) tt prog ((if false M N) ⇝ N) tt prog ((if M N_{1} N_{2}) ⇝ (if M′ N_{1} N_{2})) ⟨M ⇝ M′⟩ prog ((app (abs T R) N) ⇝ (R N)) tt prog ((app M N) ⇝ (app M′ N)) ⟨M ⇝ M′⟩ prog ((rec T R) ⇝ (R (rec T R))) tt

prog (M ⇝^{∗} M) tt prog (M ⇝^{∗} N) (⟨M ⇝ M′⟩ & ⟨M′ ⇝^{∗} N⟩)

prog (value zero) tt prog (value true) tt prog (value false) tt prog (value (succ V)) ⟨value V ⟩ prog (value (abs T R)) tt 118 CHAPTER 6. REASONING ABOUT PROGRAMMING LANGUAGES

Theorem 6.6 The following formulas are derivable in F Oλ^{ΔIN} from the definition that accumulates D(nat), D(list(atm)), D(intuit), D(PCF) and the clause X ≡ X =^{△} ⊤ defining the predicate ≡: i → i → o:

∀m∀v(>⟨m ⇓ v⟩ ⊃ (>⟨value v⟩ ∧ >⟨m ⇝^{∗} v⟩))
∀m∀v((>⟨value v⟩ ∧ >⟨m ⇝^{∗} v⟩) ⊃ >⟨m ⇓ v⟩) .

Theorem 6.7 The following formulas are derivable in F Oλ^{ΔIN} from the definition that accumulates D(nat), D(list(atm)), D(intuit), D(PCF) and the clause X ≡ X =^{△} ⊤ defining the predicate ≡: i → i → o:

∀m∀n(>⟨m ⇓ n⟩ ⊃ ∀t(>⟨typeof m t⟩ ⊃ >⟨typeof n t⟩))
∀m∀n(>⟨m ⇝ n⟩ ⊃ ∀t(>⟨typeof m t⟩ ⊃ >⟨typeof n t⟩))
∀m∀n(>⟨m ⇝^{∗} n⟩ ⊃ ∀t(>⟨typeof m t⟩ ⊃ >⟨typeof n t⟩)) .

Theorem 6.8 The following formula is derivable in F Oλ^{ΔIN} from the definition that accumulates D(nat), D(list(atm)), D(intuit), D(PCF) and the clause X ≡ X =^{△} ⊤ defining the predicate ≡: i → i → o:

∀m∀t_{1}∀t_{2}(>⟨typeof m t_{1}⟩ ⊃ >⟨typeof m t_{2}⟩ ⊃ t_{1} ≡ t_{2}) .

Proof We wish to show that every term has at most one type:

⟶ ∀m∀t_{1}∀t_{2}(>⟨typeof m t_{1}⟩ ⊃ >⟨typeof m t_{2}⟩ ⊃ t_{1} ≡ t_{2}) .

Applying the ∀R, ⊃ R, ∃L, cL, and ∧L rules to the above sequent yields

nat i, seq_{i} nil ⟨typeof m t_{1}⟩, >⟨typeof m t_{2}⟩ ⟶ t_{1} ≡ t_{2} .

(Recall that >⟨typeof m t_{1}⟩ is an abbreviation for ∃i(nat i ∧ seq_{i} nil ⟨typeof m t_{1}⟩).)

We proceed with a complete induction on the height i of the first typing derivation, using the derived rule of Proposition 2.16. If we let P be the binary predicate

λmλt_{1}∀t_{2}(>⟨typeof m t_{2}⟩ ⊃ >t_{1} ≡ t_{2}) ,

then our induction predicate IP will be

λj∀l∀m∀t(∀n∀u(element (typeof n u) l ⊃ (P n u)) ⊃ seq_{j} l ⟨typeof m t⟩ ⊃ (P m t)) .

6.3. A LANGUAGE FOR COMPUTABLE FUNCTIONS 119

If (P m t) holds, then t is the only type we can derive for m from an empty list of typing assumptions. The induction predicate then states that if this is true for every type assignment in the list l of hypotheses, then it is also true for every type assignment we can derive from l. We omit the derivation of the conclusion from IP i, which is straightforward if we choose nil for l.

It remains to derive the induction step

nat j, ∀k(nat k ⊃ k < j ⊃ (IP k)) ⟶ (IP j) .

We proceed with applications of the ∀R and ⊃ R rules, which yield the sequent

nat j, ∀k(nat k ⊃ k < j ⊃ (IP k)), ∀n∀u …, seq_{j} l ⟨typeof m t⟩ ⟶ (P m t) .

Since ⟨typeof m t⟩ is atomic, its object logic derivation must end with the use of either a typing assumption or a clause from the specification of typing. We obtain this formally by the application of the def L rule to the hypothesis seq_{j} l ⟨typeof m t⟩, which gives us the two sequents

nat j, ∀k …, ∀n∀u …, element (typeof m t) l ⟶ (P m t)
nat (s j_{0}), ∀k …, ∀n∀u …, ∃b(prog (typeof m t) b ∧ seq_{j_{0}} l b) ⟶ (P m t) .

To derive the first sequent, we can use the ∀n∀u … hypothesis (via ∀L and ⊃ L) to conclude that P holds of m and t. For the second sequent, we can apply the ∃L, cL and ∧L rules, and then apply the def L rule to the hypothesis prog (typeof m t) b. This corresponds to a case analysis of the last typing rule in the typing derivation for m.

If the typing derivation for m ends with a typing rule for zero, then m is zero and t is num:

nat (s j_{0}), ∀k …, ∀n∀u … ⟶ (P zero num) .

If we recall that (P zero num) is ∀t_{2}(>⟨typeof zero t_{2}⟩ ⊃ >num ≡ t_{2}), then it is easy to derive this formula. The typing derivation for zero and t_{2} must also end with the typing rule for zero, since no other typing rules apply and there are no typing assumptions in that derivation. Thus t_{2} must also be num. This is accomplished by first applying the ∀R and ⊃ R rules, then applying the ∃L, ∧L, and def L rules to >⟨typeof zero t_{2}⟩ twice, 120 CHAPTER 6. REASONING ABOUT PROGRAMMING LANGUAGES

and finally using the def R rule. The cases for true, false, succ, pred, is zero, and rec are similar.

If the typing derivation for m ends with a typing rule for if, then we know that m is of the form (if m′ n_{1} n_{2}), m′ has type bool, and both n_{1} and n_{2} have type t:

nat (s j_{1}), ∀k …, ∀n∀u …, seq_{j_{1}} l (⟨typeof m′ bool⟩ & ⟨typeof n_{1} t⟩ & ⟨typeof n_{2} t⟩) ⟶ (P (if m′ n_{1} n_{2}) t) .

Applying the ∀R and ⊃ R rules brings us to the sequent

nat (s j_{1}), ∀k …, ∀n∀u …, seq_{j_{1}} l …, >⟨typeof (if m′ n_{1} n_{2}) t_{2}⟩ ⟶ num ≡ t_{2} .

This second typing derivation for (if m′ n_{1} n_{2}) must also end with the typing rule for if; applying the ∃L, cL, ∧L, and def L rules twice yields

nat (s j_{1}), ∀k …, ∀n∀u …, seq_{j_{1}} l …, nat (s k_{1}), seq_{k_{1}} nil (⟨typeof m′ bool⟩ & ⟨typeof n_{1} t_{2}⟩ & ⟨typeof n_{2} t_{2}⟩) ⟶ t_{1} ≡ t_{2} .

If we apply the def L and ∧L rules to both seq_{j_{1}} l … and seq_{k_{1}} nil … we can obtain hypotheses seq_{j_{2}} l ⟨typeof n_{1} t_{1}⟩ and seq_{k_{2}} nil ⟨typeof n_{1} t_{2}⟩. We can then apply the induction hypothesis ∀k … to these to conclude that t_{1} ≡ t_{2}. The case for app is similar.

It remains to derive the case for abs:

nat (s j_{1}), ∀k …, ∀n∀u …, seq_{j_{1}} l ⋀ x((typeof x u_{1}) ⇒ ⟨typeof (r x) u_{2}⟩) ⟶ (P (abs u_{1} r) (arr u_{1} u_{2})) .

As in the other cases, we apply the ∀R and ⊃ R rules to obtain the sequent

nat (s j_{1}), ∀k …, ∀n∀u …, seq_{j_{1}} l …, >⟨typeof (abs u_{1} r) t_{2}⟩ ⟶ (arr u_{1} u_{2}) ≡ t_{2} ,

and then the ∃L, cL, ∧L,and def L rules, yielding

nat (s j_{1}), ∀k …, ∀n∀u …, seq_{j_{1}} l …, nat (s k_{1}), seq_{k_{1}} nil ⋀ x((typeof x u_{1}) ⇒ ⟨typeof (r x) u′_{2}⟩) ⟶ (arr u_{1} u_{2}) ≡ (arr u_{1} u′_{2}) .

We would like to proceed as before to obtain formulas

seq_{j_{2}} (typeof x u_{1} ::l) ⟨typeof (r x) u_{2}⟩

6.3. A LANGUAGE FOR COMPUTABLE FUNCTIONS 121

and

seq_{k_{2}} (typeof x u_{1} ::nil) ⟨typeof (r x) u′_{2}⟩ ,

and then apply the induction hypothesis to conclude that u_{2} ≡ u′_{2}. This requires the use of the ∀L rule, so we must actually choose a term for x. In order for the induction hypothesis to apply, we must also remove the (typeof x u_{1}) assumption from the second formula to obtain an empty list of typing assumptions. We choose the term (rec u_{1} (λy y)) for x. It is a simple matter to construct a derivation of ⟶ >⟨typeof (rec u_{1} (λy y)) u_{1}⟩, so we can apply the derived object logic cut rule (Theorem 5.4) to get rid of the unwanted typing assumption:

…, >⟨typeof (r (rec u_{1} (λy y))) u′_{2}⟩ ⟶ (arr u_{1} u_{2}) ≡ arr u_{1} u′_{2}) .

To apply the induction hypothesis to

seq_{j_{2}} (typeof (rec u_{1} (λy y)) u_{1} ::l) ⟨typeof (r (rec u_{1} (λy y)) u_{2}⟩

and >⟨typeof (r (rec u_{1} (λy y))) u′_{2}⟩, we must show that P holds for the new typing assumption typeof (rec u_{1} (λy y)) u_{1}. But we have already shown how to do this in the rec case of our derivation. Therefore we conclude by the induction hypothesis that u_{2} ≡ u′_{2}, and hence (arr u_{1} u_{2}) ≡ (arr u_{1} u′_{2}).

The usual informal proof of the unicity of typing relies on the requirement that the list of assumptions contains only typing assignments for variables and no more than one assignment for any particular variable. Since we have encoded the variables of PCF as variables of our object logic, which in turn are encoded as variables of F Oλ^{ΔIN}, we cannot state the first part of this requirement in F Oλ^{ΔIN}. Thus our derivation must differ from the informal proof. In fact, we make essential use of the PCF recursion construct in the abs case of the derivation; for an arbitrary type u, the term (rec u (λy y)) has the type u and no other type. As a result, our derivation so does not generalize to languages without this construct. In the next section we give an encoding of an extension of PCF in the linear object logic of Section 5.2.2, which is encoded in F Oλ^{ΔIN} using the explicit eigenvariable encoding. That encoding will allow us to capture in F Oλ^{ΔIN} the typical proof of the unicity of typing.

6.4 A Language with References

In this section we consider the programming language PCF_{:=}, an extension of PCF with state [18]. This language extends PCF with reference types and constructs for referencing, dereferencing, assignment, and sequential evaluation. The type (refty τ) is the type of references to values of type τ. If m is a term of type τ, then (ref m) has type (refty τ) and evaluates to a new memory location containing the value of m. If m is a term of type (refty τ), then !m has type τ and evaluates to the contents of the value of m. If m has type (refty τ) and n has type τ, then (m := n) has type τ. The evaluation of (m := n) changes the contents of the value of m to be the value of n; its value is the same as the value of n. If m_{1} and m_{2} have types τ_{1} and τ_{2}, respectively, then (m_{1}; m_{2}) has type τ_{2}. To evaluate (m_{1}; m_{2}), we first evaluate m_{1}, then evaluate m_{2}, and finally return the value of m_{2}. Clearly the value of a PCF_{:=} term will depend on the state in which it is evaluated, and the state may be modified in the evaluation process; thus evaluation becomes a mapping from a term-state pair to a value-state pair. The natural semantics for PCF_{:=} is given in Table 6.5; following [18] we specify call-by-value evaluation. In these evaluation rules, c is used to range over locations (reference cells). In the evaluation rule for (ref M), c must be a new location, i.e. a location that does not occur in σ_{1}. The expression σ[c ↦ V] represents the state that is the same as σ except that location c contains the value V.

To encode PCF_{:=}, we use the linear object logic of Section 5.2.2, since linear logic is well-suited as a specification logic for programming languages with state [5, 6, 37]. For such languages, the order of evaluation becomes important, and so a continuation-based operational semantics is often used for the encoding. In a continuation-based semantics, each rule has at most one premise, and any additional evaluation steps are encoded in the continuation. This encoding of the evaluation steps into the continuation makes the order of evaluation explicit. Table 6.6 shows a continuation-based variation of the semantics for PCF_{:=} given in Table 6.5. These semantics and their object logic encoding given below are a variation of those found in [5]. The judgement κ ⊢ (M, σ) ↪ ϕ represents the idea that the evaluation of the term M in state σ with continuation κ results in the final answer ϕ. A continuation is a list whose elements are of the form x̂.M, where M is a term containing the variable x. (We use x̂ instead of λx to avoid confusion with λ-abstraction in PCF_{:=}.) The 6.4. A LANGUAGE WITH REFERENCES 123

Table 6.5: Natural semantics for PCF_{:=}

(c, σ^{0}) ⇓ (c, σ^{0}) {(M, σ_{0}) ⇓ (V, σ_{1}) \atop (ref M, σ_{0}) ⇓ (c, σ_{1}[c ↦ V])} {(M, σ_{0}) ⇓ (c, σ_{1}) \atop (!M, σ_{0}) ⇓ (σ_{1}(c), σ_{1})}
\begin{matrix}(M, σ_{0}) ⇓ (c, σ_{1}) & (N, σ_{1}) ⇓ (V, σ_{2}) \\ (M := N, σ_{0}) ⇓ (V, σ_{2}[c ↦ V]) \end{matrix}  \begin{matrix}(M, σ_{0}) ⇓ (W, σ_{1}) & (N, σ_{1}) ⇓ (V, σ_{2}) \\ (M; N, σ_{0}) ⇓ (V, σ_{2}) \end{matrix}
(zero, σ^{0}) ⇓ (zero, σ^{0}) (true, σ^{0}) ⇓ (true, σ^{0}) (false, σ^{0}) ⇓ (false, σ^{0})
(M, σ_{0}) ⇓ (V, σ_{1})

(succ M, σ_{0}) ⇓ (succ V, σ_{1})

(M, σ_{0}) ⇓ (zero, σ_{1})
(pred M, σ_{0}) ⇓ (zero, σ_{1})

(M, σ_{0}) ⇓ (succ V, σ_{1})
(pred M, σ_{0}) ⇓ (V, σ_{1})
(M, σ_{0}) ⇓ (zero, σ_{1})
(is zero M, σ_{0}) ⇓ (true, σ_{1})

(M, σ_{0}) ⇓ (succ V, σ_{1})
(is zero M, σ_{0}) ⇓ (false, σ_{1})
\begin{matrix}(M, σ_{0}) ⇓ (true, σ_{1}) & (N_{1}, σ_{1}) ⇓ (V, σ_{2}) \\ (if M N_{1} N_{2}, σ_{0}) ⇓ (V, σ_{2}) \end{matrix}  \begin{matrix}(M, σ_{0}) ⇓ (false, σ_{1}) & (N_{2}, σ_{1}) ⇓ (V, σ_{2}) \\ (if M N_{1} N_{2}, σ_{0}) ⇓ (V, σ_{2}) \end{matrix}

\begin{aligned}(M, σ_{0}) ⇓ (λx : τ.M′, σ_{1}) & (N, σ_{1}) ⇓ (W, σ_{2}) & (M′[W/x], σ_{2}) ⇓ (V, σ_{3}) \\ & (M N, σ_{0}) ⇓ (V, σ_{3}) \end{aligned}

(λx : τ.M, σ^{0}) ⇓ (λx : τ.M, σ^{0})  {(M[rec x : τ.M /x], σ_{0}) ⇓ (V, σ_{1}) \atop (rec x : τ.M , σ_{0}) ⇓ (V, σ_{1})}

124 CHAPTER 6. REASONING ABOUT PROGRAMMING LANGUAGES

answer ϕ is a pair including the final value and the final state. The judgement κ ⊢ (V, σ) ˙↪ϕ indicates that passing the value V with state σ to the continuation κ results in the final answer ϕ.

To encode PCF_{:=}, we use the constants

refty : ity → ity  deref : itm → itm
cell : ilc → itm  assign : itm → itm → itm
ref : itm → itm  sequence : itm → itm → itm

in addition to the constants of Section 6.3. Once again we have labeled the type i with subscripts to improve the readability of these declarations. The subscript lc indicates that the argument to cell represents a PCF_{:=} location.

The object logic predicate representing typability is denoted by the same F Oλ^{ΔIN} constants as in Sections 6.2 and 6.3; its object-level specification is represented in F Oλ^{ΔIN} as the definition shown in Table 6.7. Recall that prog A (C_{1} :: … C_{n}:: nil) (B_{1} :: … B_{m}:: nil) represents the definite clause

⋀ x̄(B_{1} ⇒ ⋯ B_{m} ⇒ C_{1} −∘ ⋯ C_{n} −∘ A) ,

where the free variables of A, B_{1}, …, B_{m}, C_{1}, …, C_{n} are included in the list x̄. This means that to derive an instance of A, we can instead derive the corresponding instances of B_{1}, …, B_{m}, C_{1}, …, C_{n}. To establish LL; IL > ⟨A⟩, the rules of linear logic require that each assumption in IL be used exactly once in the derivation of one of the C_{i}’s; it cannot be used in the derivation of any of the B_{i}’s, or in the derivation of more than one C_{i}. In the specification of typing, no linear assumptions are introduced, so IL will be empty. In general, we will use linear formulas (C_{1}, …, C_{n}) in the bodies of specification clauses; we use intuitionistic formulas (B_{1}, …, B_{n}) only where we specifically wish to preclude the use of linear assumptions. This is only done in one clause in the encoding of the operational semantics, and will be discussed when it is introduced. We extend the abbreviation convention of Section 5.2.2 to the constants of this section. Thus (typeof^{∗} m t) abbreviates (λl typeof (m l) (t l)), (refty^{∗} t) abbreviates (λl refty (t l)), etc.

The semantics for PCF_{:=} is more complicated than those in the previous sections. The constant ⇓ now has type itm → ist → ians → atm. The object logic atom (m, s) ⇓ f

Table 6.6: Continuation-based natural semantics for PCF_{:=}

⊢ (V, σ) ˙↪(V, σ)  {x̂.ref x, κ ⊢ (M, σ) ↪ ϕ \atop κ ⊢ (ref M, σ) ↪ ϕ}  {x̂.!x, κ ⊢ (M, σ) ↪ ϕ \atop κ ⊢ (!M, σ) ↪ ϕ}

{κ ⊢ (c, σ) ˙↪ϕ \atop κ ⊢ (c, σ) ↪ ϕ}  {κ ⊢ (c, σ[c ↦ V]) ˙↪ϕ \atop x̂.ref x, κ ⊢ (V, σ) ˙↪ϕ}  {κ ⊢ (σ(c), σ) ˙↪ϕ \atop x̂.!x, κ ⊢ (c, σ) ˙↪ϕ}

{x̂.x := N, κ ⊢ (M, σ) ↪ ϕ \atop κ ⊢ (M := N, σ) ↪ ϕ}  {x̂.V := x, κ ⊢ (N, σ) ↪ ϕ \atop x̂.x := N, κ ⊢ (V, σ) ˙↪ϕ}  {κ ⊢ (V, σ[c ↦ V]) ˙↪ϕ \atop x̂.c := x, κ ⊢ (V, σ) ˙↪ϕ}

{x̂.x; N, κ ⊢ (M, σ) ↪ ϕ \atop κ ⊢ (M; N, σ) ↪ ϕ}  {κ ⊢ (N, σ) ↪ ϕ \atop x̂.x; N, κ ⊢ (V, σ) ˙↪ϕ}

κ ⊢ (zero, σ) ˙↪ϕ κ ⊢ (zero, σ) ↪ ϕ κ ⊢ (true, σ) ˙↪ϕ κ ⊢ (true, σ) ↪ ϕ

κ ⊢ (false, σ) ˙↪ϕ
κ ⊢ (false, σ) ↪ ϕ

x̂.succ x, κ ⊢ (M, σ) ↪ ϕ κ ⊢ (succ M, σ) ↪ ϕ

κ ⊢ (succ V, σ) ˙↪ϕ
x̂.succ x, κ ⊢ (V, σ) ˙↪ϕ

x̂.pred x, κ ⊢ (M, σ) ↪ ϕ κ ⊢ (pred M, σ) ↪ ϕ

κ ⊢ (zero, σ) ˙↪ϕ x̂.pred x, κ ⊢ (zero, σ) ˙↪ϕ

κ ⊢ (V, σ) ˙↪ϕ
x̂.pred x, κ ⊢ (succ V, σ) ˙↪ϕ

x̂.is zero x, κ ⊢ (M, σ) ↪ ϕ κ ⊢ (is zero M, σ) ↪ ϕ

{x̂.if x N_{1} N_{2}, κ ⊢ (M, σ) ↪ ϕ \atop κ ⊢ (if M N_{1} N_{2}, σ) ↪ ϕ}

κ ⊢ (true, σ) ˙↪ϕ x̂.is zero x, κ ⊢ (zero, σ) ˙↪ϕ

{κ ⊢ (N_{1}, σ) ↪ ϕ \atop x̂.if x N_{1} N_{2}, κ ⊢ (true, σ) ˙↪ϕ}

κ ⊢ (false, σ) ˙↪ϕ x̂.is zero x, κ ⊢ (succ V, σ) ˙↪ϕ

{κ ⊢ (N_{2}, σ) ↪ ϕ \atop x̂.if x N_{1} N_{2}, κ ⊢ (false, σ) ˙↪ϕ}

{x̂.x N, κ ⊢ (M, σ) ↪ ϕ \atop κ ⊢ (M N, σ) ↪ ϕ}  {x̂.V x, κ ⊢ (N, σ) ↪ ϕ \atop x̂.x N, κ ⊢ (V, σ) ˙↪ϕ}  {κ ⊢ (λx : τ.M, σ) ˙↪ϕ \atop κ ⊢ (λx : τ.M, σ) ↪ ϕ}

{κ ⊢ (M′[V/y], σ) ↪ ϕ \atop x̂.(λy : τ.M′) x, κ ⊢ (V, σ) ˙↪ϕ}  {κ ⊢ (M[rec x : τ.M /x], σ) ↪ ϕ \atop κ ⊢ (rec x : τ.M , σ) ↪ ϕ}

126 CHAPTER 6. REASONING ABOUT PROGRAMMING LANGUAGES

Table 6.7: Object logic encoding of typing for PCF_{:=} terms

prog (typeof^{∗} zero^{∗} num^{∗})
nil^{∗}  nil^{∗}
prog (typeof^{∗} true^{∗} bool^{∗})
nil^{∗}  nil^{∗}
prog (typeof^{∗} false^{∗} bool^{∗})
nil^{∗}  nil^{∗}
prog (typeof^{∗} (succ^{∗} M) num^{∗})
(⟨typeof^{∗} M num^{∗}⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (typeof^{∗} (pred^{∗} M) num^{∗})
(⟨typeof^{∗} M num^{∗}⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (typeof^{∗} (is zero M) bool^{∗})
(⟨typeof^{∗} M num^{∗}⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (typeof^{∗} (if^{∗} M N_{1} N_{2}) T)
(⟨typeof^{∗} M bool^{∗}⟩^{∗}::^{∗} ⟨typeof^{∗} N_{1} T ⟩^{∗}::^{∗} ⟨typeof^{∗} N_{2} T ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog typeof^{∗} (abs^{∗} T R) (arr^{∗} T U))
λl(⋀ n(typeof n (T l) ⇒ ⟨typeof (R l n) (U l)⟩)::nil)  nil^{∗}
prog (typeof^{∗} (app^{∗} M N) T)
(⟨typeof^{∗} M (arr^{∗} U T)⟩^{∗}::^{∗} ⟨typeof^{∗} N U⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (typeof^{∗} (rec^{∗} T R) T)
λl(⋀ n(typeof n (T l) ⇒ ⟨typeof (R l n) (T l)⟩)::nil)  nil^{∗}
prog (typeof^{∗} (ref^{∗} M) (refty^{∗} T))
(⟨typeof^{∗} M T ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (typeof^{∗} (deref^{∗} M) T)
(⟨typeof^{∗} M (refty^{∗} T)⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (typeof^{∗} (assign^{∗} M N) T)
(⟨typeof^{∗} M (refty^{∗} T)⟩^{∗}::^{∗} ⟨typeof^{∗} N T ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (typeof^{∗} (sequence^{∗} M N) T)
(⟨typeof^{∗} M U⟩^{∗}::^{∗} ⟨typeof^{∗} N T ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}

6.4. A LANGUAGE WITH REFERENCES 127

represents the evaluation of the term m in the state s yielding the final answer f. State is encoded using the constants null st: ist and extend st: ilc → itm → ist → ist; null st represents the state with no locations, and (extend st c v s) represents the state obtained by adding the location c containing value v to the state s. A value and a state are combined into an answer using the constant answer: itm → ist → ians; variables representing new locations are bound using new: (ilc → ians) → ians. Our specification of evaluation will also use the predicates

ns mach 1 : icntn → iinstr → ist → ians → atm
ns mach 2 : icntn → iinstr → ians → atm
contains : ilc → itm → atm
collect state : ist → atm .

The object logic atom ns mach 1 k i s f corresponds to the two judgements of Table 6.6. Continuations are constructed using init: icntn to represent the initial continuation and ≻: (itm → iinstr) → icntn → icntn to extend a continuation. Instructions, constructed from the constants

eval : itm → iinstr  eval arg : itm → itm → iinstr
return : itm → iinstr  apply : itm → itm → iinstr
monus : itm → iinstr  new ref : itm → iinstr
zero test : itm → iinstr  lookup : itm → iinstr
switch : itm → itm → itm → iinstr  eval rvalue : itm → itm → iinstr
update : itm → itm → iinstr ,

are used to indicate the current task in the evaluation of a term. The object logic atom ns mach 2 k i f is a variation of ns mach 1 k i s f which does not contain the state; instead the contents of each location is recorded using the object logic predicate denoted by the constant contains. The evaluation of terms is specified using this distributed representation of state; the state portion of the final answer is constructed again using the predicate collect state. The specifications for all of these predicates are represented by the F Oλ^{ΔIN} definition in Tables 6.8, 6.9, and 6.10.

This encoding differs slightly from the continuation semantics in Table 6.6. The object logic judgement nil^{∗}; ll > ⟨ns mach 2 k (return v) f⟩^{∗} corresponds to the judgement Table 6.8: Object logic encoding of natural semantics for PCF_{:=} (part I)

prog ((M, S) ⇓^{∗} F)
nil^{∗}  (⟨ns mach 1^{∗} init^{∗} (eval^{∗} M) S F ⟩^{∗}::^{∗} nil^{∗})
prog (ns mach 1^{∗} K I (extend st^{∗} C V S) F)
((contains^{∗} C V −∘^{∗} ⟨ns mach 1^{∗} K I S F ⟩^{∗})::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 1^{∗} K I null st^{∗} F)
(⟨ns mach 2^{∗} K I F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (collect state^{∗} (extend st^{∗} C V S))
(⟨contains^{∗} C V ⟩^{∗}::^{∗} ⟨collect state^{∗} S⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (collect state^{∗} null st^{∗})
nil^{∗}  nil^{∗}

κ ⊢ (v′, σ) ˙↪ϕ, where κ is the continuation encoded by k, v′ is the value encode by v, σ is the state encoded by the list ll of contains assumptions, and ϕ is the answer encoded by f. However, the specification for ns mach 2^{∗} k (return^{∗} v) f takes the first instruction from k and substitutes in the value v to obtain the new instruction. This new instruction then determines the next step in the evaluation. On the other hand, the rules of Table 6.6 examine the return value and the first term of the continuation to determine the next evaluation step. Other than this small difference, the encoding mirrors the continuation semantics very closely.

The distributed encoding of state in Tables 6.8, 6.9, and 6.10 makes vital use of linear implication. Since each assumption of the form contains^{∗} c v is a linear assumption, it can only be used once. This linearity is used, for example, in the clause for ns mach 2 with the instruction (update^{∗} (cell^{∗} c) v); the desired behavior is that the contents of location c be replaced by the value v. This clause has two linear formulas in its body, ⟨contains^{∗} c w⟩^{∗} and (contains^{∗} c v −∘^{∗} ⟨ns mach 2^{∗} k (return^{∗} v) f⟩^{∗}). Each contains assumption must be used exactly once in the derivation of these two formulas. Since there is no clause for contains in the object logic theory, the first formula must be derived by the initial rule, and so will use the one assumption representing the contents of location c. The remainder of the state is then available for the other formula, which adds a new assumption 6.4. A LANGUAGE WITH REFERENCES 129

Table 6.9: Object logic encoding of natural semantics for PCF_{:=} (part II)

prog (ns mach 2^{∗} init^{∗} (return^{∗} V) (answer^{∗} V S))
(⟨collect state^{∗} S⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} (I ≻^{∗} K) (return^{∗} V) F)
(⟨ns mach 2^{∗} K (λl I l (V l)) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (eval^{∗} (cell^{∗} C)) F)
(⟨ns mach 2^{∗} K (return^{∗} (cell^{∗} C)) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (eval^{∗} (ref^{∗} M)) F)
(⟨ns mach 2^{∗} ((λlλv new ref v) ≻^{∗} K) (eval^{∗} M) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (new ref^{∗} V) (new^{∗} F))

λl(⋀ c(contains c (V l) −∘ ⟨ns mach 2 (K l) (return (cell c)) (F l c)⟩)::nil^{∗})

nil^{∗}
prog (ns mach 2^{∗} K (eval^{∗} (deref^{∗} M)) F)
(⟨ns mach 2^{∗} ((λlλv lookup v) ≻^{∗} K) (eval^{∗} M) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (lookup^{∗} (cell^{∗} C)) F)

(\begin{matrix}⟨contains^{∗} C V ⟩^{∗}::^{∗} \\ (contains^{∗} C V −∘^{∗} ⟨ns mach 2^{∗} K (return^{∗} V) F ⟩^{∗})::^{∗} nil^{∗}) \end{matrix}

nil^{∗}
prog (ns mach 2^{∗} K (eval^{∗} (assign^{∗} M N)) F)

(⟨ns mach 2^{∗} ((λlλv eval rvalue v (N l)) ≻^{∗} K) (eval^{∗} M) F ⟩^{∗}::^{∗} nil^{∗})

nil^{∗}
prog (ns mach 2^{∗} K (eval rvalue^{∗} V N) F)
(⟨ns mach 2^{∗} ((λlλv update (V l) v) ≻^{∗} K) (eval^{∗} N) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (update^{∗} (cell^{∗} C) V) F)

(\begin{matrix}⟨contains^{∗} C W ⟩^{∗}::^{∗} \\ (contains^{∗} C V −∘^{∗} ⟨ns mach 2^{∗} K (return^{∗} V) F ⟩^{∗})::^{∗} nil^{∗}) \end{matrix}

nil^{∗}
prog (ns mach 2^{∗} K (eval^{∗} (sequence^{∗} M N)) F)
(⟨ns mach 2^{∗} ((λlλv eval (N l)) ≻^{∗} K) (eval^{∗} M) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}

130 CHAPTER 6. REASONING ABOUT PROGRAMMING LANGUAGES

Table 6.10: Object logic encoding of natural semantics for PCF_{:=} (part III)

prog (ns mach 2^{∗} (K l) (eval^{∗} zero^{∗}) F)
(⟨ns mach 2^{∗} K (return^{∗} zero^{∗}) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (eval^{∗} true^{∗}) F)
(⟨ns mach 2^{∗} K (return^{∗} true^{∗}) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (eval^{∗} false^{∗}) F)
(⟨ns mach 2^{∗} K (return^{∗} false^{∗}) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (eval^{∗} (succ^{∗} M)) F)
(⟨ns mach 2^{∗} ((λlλv return (succ v)) ≻^{∗} K) (eval^{∗} M) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (eval^{∗} (pred^{∗} M)) F)
(⟨ns mach 2^{∗} ((λlλv monus v) ≻^{∗} K) (eval^{∗} M) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (monus^{∗} zero^{∗}) F)
(⟨ns mach 2^{∗} K (return^{∗} zero^{∗}) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (monus^{∗} (succ^{∗} V)) F)
(⟨ns mach 2^{∗} K (return^{∗} V) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (eval^{∗} (is zero^{∗} M)) F)
(⟨ns mach 2^{∗} (λlλv zero test v) ≻^{∗} K (eval^{∗} M) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (zero test^{∗} zero^{∗}) F)
(⟨ns mach 2^{∗} K (return^{∗} true^{∗}) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (zero test^{∗} (succ^{∗} V)) F)
(⟨ns mach 2^{∗} K (return^{∗} false^{∗}) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (eval^{∗} (if^{∗} M N_{1} N_{2})) F)

(⟨ns mach 2^{∗} ((λlλv switch v (N_{1} l) (N_{2} l)) ≻^{∗} K) (eval^{∗} M) F ⟩^{∗}::^{∗} nil^{∗})

nil^{∗}
prog (ns mach 2^{∗} K (switch^{∗} true^{∗} N_{1} N_{2}) F)
(⟨ns mach 2^{∗} K (eval^{∗} N_{1}) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (switch^{∗} false^{∗} N_{1} N_{2}) F)
(⟨ns mach 2^{∗} K (eval^{∗} N_{2}) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (eval^{∗} (app^{∗} M N)) F)
(⟨ns mach 2^{∗} ((λlλv eval arg v (N l)) ≻^{∗} K) (eval^{∗} M) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (eval arg^{∗} V N) F)
(⟨ns mach 2^{∗} ((λlλv apply (V l) v) ≻^{∗} K) (eval^{∗} N) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (apply^{∗} (abs^{∗} T R) V) F)
(⟨ns mach 2^{∗} K (eval^{∗} (λl R l (V l))) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (eval^{∗} (abs^{∗} T R)) F)
(⟨ns mach 2^{∗} K (return^{∗} (abs^{∗} T R)) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (ns mach 2^{∗} K (eval^{∗} (rec^{∗} T R)) F)
(⟨ns mach 2^{∗} K (eval^{∗} (λl R l (rec (T l) (R l)))) F ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}

6.4. A LANGUAGE WITH REFERENCES 131

about the contents of c and then continues the evaluation encoded in the continuation k. The linearity of the contains assumptions is also used in the clause for ns mach 2 with the instruction (return^{∗} v) and the continuation init^{∗}. This clause represents the situation where the evaluation is complete and we wish to construct the final answer from the value v and the state encoded in the assumptions. The clause has the single linear formula ⟨collect state^{∗} s⟩^{∗} as its body. Thus the derivation of this formula must use all of the contains assumptions; this ensures that the constructed state includes all of the locations represented in the assumptions. Dually, the clause for ⇓ in Table 6.8 has a single intuitionistic formula ⟨ns mach 1^{∗} init^{∗} (eval^{∗} m) s f⟩^{∗} as its body. This clause represents the situation where we wish to evaluate the term m in the state s. Since the formula in the body is intuitionistic, it must be derived from an empty set of linear assumptions. Since there are no linear formulas in the body, this means that (m, s) ⇓^{∗} f is only derivable from an empty set of linear assumptions, i.e. the state is entirely represented in s.

We also introduce typing predicates for continuations, instructions, and answers:

typeof cntn : icntn → ity → atm
typeof instr : iinstr → ity → atm
typeof ans : ians → ity → atm .

The object-level specification for these predicates is represented in F Oλ^{ΔIN} by the definition of Table 6.11. A continuation has type (arr^{∗} t u) if it expects a value of type t in order to produce a value of type u. Instructions are typed in the same way as the corresponding terms. The type of an answer is the same as the type of its value component under some typing assumptions for any new memory locations. These assumptions must be consistent with the values stored in those locations; this consistency is expressed by the predicate well typed: ist → atm.

We now present the theorems we have derived in F Oλ^{ΔIN} about this object logic encoding of PCF_{:=}. We will refer to the collected clauses of Tables 6.7, 6.8, 6.9, 6.10, and 6.11 as the definition D(PCF_{:=}). To simplify the presentation of our theorems, we introduce 132 CHAPTER 6. REASONING ABOUT PROGRAMMING LANGUAGES

Table 6.11: Encoding of typing for PCF_{:=} continuations, instructions, and answers

prog (typeof cntn^{∗} init^{∗} (arr^{∗} T T))
nil^{∗}  nil^{∗}
prog (typeof cntn^{∗} (I ≻^{∗} K) (arr^{∗} T U))

(\begin{matrix}λl ⋀ v(typeof v (T l) ⇒ ⟨typeof instr (I l v) (T′ l)⟩)::^{∗} \\ ⟨typeof cntn^{∗} K (arr^{∗} T′ U)⟩^{∗}::^{∗} nil^{∗}) \end{matrix}

nil^{∗}
prog (typeof instr^{∗} (eval^{∗} M) T)
(⟨typeof^{∗} M T ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (typeof instr^{∗} (return^{∗} V) T)
(⟨typeof^{∗} V T ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (typeof instr^{∗} (monus^{∗} M) num^{∗})
(⟨typeof^{∗} M num^{∗}⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (typeof instr^{∗} (zero test^{∗} M) bool^{∗})
(⟨typeof^{∗} M num^{∗}⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (typeof instr^{∗} (switch^{∗} M N_{1} N_{2}) T)
(⟨typeof^{∗} M bool⟩^{∗}::^{∗} ⟨typeof^{∗} N_{1} T ⟩^{∗}::^{∗} ⟨typeof^{∗} N_{2} T ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (typeof instr^{∗} (eval arg^{∗} M N) T)
(⟨typeof^{∗} M (arr^{∗} U T)⟩^{∗}::^{∗} ⟨typeof^{∗} N U⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (typeof instr^{∗} (apply^{∗} M N) T)
(⟨typeof^{∗} M (arr^{∗} U T)⟩^{∗}::^{∗} ⟨typeof^{∗} N U⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (typeof instr^{∗} (new ref^{∗} M) (refty^{∗} T))
(⟨typeof^{∗} M T ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (typeof instr^{∗} (lookup^{∗} M) T)
(⟨typeof^{∗} M (refty^{∗} T)⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (typeof instr^{∗} (eval rvalue^{∗} M N) T)
(⟨typeof^{∗} M (refty^{∗} T)⟩^{∗}::^{∗} ⟨typeof^{∗} N T ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (typeof instr^{∗} (update^{∗} M N) T)
(⟨typeof^{∗} M (refty^{∗} T)⟩^{∗}::^{∗} ⟨typeof^{∗} N T ⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (typeof ans^{∗} (answer^{∗} V S) T)
(⟨typeof^{∗} V T ⟩^{∗}::^{∗} ⟨well typed^{∗} S⟩^{∗}::^{∗} nil^{∗})  nil^{∗}
prog (typeof ans^{∗} (new^{∗} F) T)
λl (⋀ c(typeof (cell c) (refty (U l)) ⇒ ⟨typeof ans (F l c) (T l)⟩)::nil)  nil^{∗}
prog (well typed^{∗} null st^{∗})
nil^{∗}  nil^{∗}
prog (well typed^{∗} (extend st^{∗} C V S))

(⟨typeof^{∗} (cell^{∗} C) (refty^{∗} T)⟩^{∗}::^{∗} ⟨typeof^{∗} V T ⟩^{∗}::^{∗} ⟨well typed^{∗} S⟩^{∗}::^{∗} nil^{∗})

nil^{∗}

Table 6.12: Meta-logic predicates for PCF_{:=} stores

store LL =^{△} list LL ∧ ∀a(\begin{matrix}element a LL ⊃ \\ ∃c∃v(a ≡atm^{∗} (contains^{∗} c v))) \end{matrix}
store typing IL =^{△} list IL ∧
∀a(\begin{matrix}element a IL ⊃ \\ ∃c∃t(a ≡atm^{∗} (typeof^{∗} (cell^{∗} c) (refty^{∗} t)))) ∧ \end{matrix}
∀c∀t_{1}∀t_{2}(\begin{matrix}element (typeof^{∗} (cell^{∗} c) (refty^{∗} t_{1})) IL ⊃ \\ element (typeof^{∗} (cell^{∗} c) (refty^{∗} t_{2})) IL ⊃ \\ t_{1} ≡i_{∗} t_{2}) \end{matrix}

store typeof LL IL =^{△} ∀c∀v(\begin{matrix}element (contains^{∗} c v) LL ⊃ \\ ∃t(\begin{matrix}element (typeof^{∗} (cell^{∗} c) (refty^{∗} t)) IL ∧ \\ IL; nil^{∗} > ⟨typeof^{∗} v t⟩^{∗})) \end{matrix} \end{matrix}

A ≡atm^{∗} A =^{△} ⊤
X ≡i_{∗} X =^{△} ⊤

several F Oλ^{ΔIN} predicates:

store : atmlst^{∗} → o  ≡atm^{∗} : atm^{∗} → atm^{∗} → o store typing : atmlst^{∗} → o  ≡i^{∗} : i^{∗} → i^{∗} → o store typeof : atmlst^{∗} → atmlst^{∗} → o .

The store predicate indicates that a list of object logic atoms is a valid distributed encoding of state, that is, its elements are of the form contains^{∗} c v. The predicate store typing holds if its argument is a valid list of typing assumptions for locations. The store typeof predicate holds for a store and store typing if every location in the store is assigned a type by the store typing that agrees with a type of the value stored in the location. Finally, ≡atm^{∗} and ≡i^{∗} encode syntactic identity over the types atm^{∗} and i^{∗}. The definition D(store) for these predicates is presented in Table 6.12. The following theorems state that we have derived the subject reduction and unicity of typing properties for PCF_{:=} in F Oλ^{ΔIN}. The F Oλ^{ΔIN} derivations again closely follow the informal proofs of these properties. We expect that the determinacy of semantics is also derivable, but have not yet shown this. We use the following abbreviations from Section 5.2.2: D(lists) for

D(list^{∗}(atm)) ∪ D(list^{∗}(prp)) ∪ D(list^{∗∗}(atm)) ∪ D(list^{∗∗}(prp)) ,

and D(evars) for

D(evars(atm)) ∪ D(evars(prp)) ∪ D(evars(atmlst)) ∪ D(evars(prplst)) .

Theorem 6.9 The following formulas are derivable in F Oλ^{ΔIN} from the definition that accumulates D(nat), D(lists), D(evars), D(linear), D(PCF_{:=}), and D(store):

∀m∀s∀f(\begin{matrix}>(⟨(m, s) ⇓^{∗} f⟩^{∗}) ⊃ \\ ∀ts∀t(\begin{matrix}store typing il ⊃ il; nil^{∗} > ⟨well typed^{∗} s⟩^{∗} ⊃ \\ il; nil^{∗} > ⟨typeof^{∗} m t⟩^{∗} ⊃ \\ il; nil^{∗} > ⟨typeof ans^{∗} f t⟩^{∗})) \end{matrix} \end{matrix}

∀ll∀k∀i∀f(\begin{matrix}store ll ⊃ nil^{∗}; ll > ⟨ns mach 2^{∗} k i f⟩^{∗} ⊃ \\ ∀il∀t∀u(\begin{matrix}store typing il ⊃ store typeof ll il ⊃ \\ il; nil^{∗} > ⟨typeof cntn^{∗} k (arr^{∗} t u)⟩^{∗} ⊃ \\ il; nil^{∗} > ⟨typeof instr^{∗} i t⟩^{∗} ⊃ \\ il; nil^{∗} > ⟨typeof ans^{∗} f u⟩^{∗})) . \end{matrix} \end{matrix}

Theorem 6.10 The formula

∀m∀t_{1}∀t_{2}(>⟨typeof^{∗} m t_{1}⟩^{∗} ⊃ >⟨typeof^{∗} m t_{2}⟩^{∗} ⊃ t_{1} ≡i_{∗} t_{2})

is derivable in F Oλ^{ΔIN} from the definition that accumulates D(nat), D(lists), D(evars), D(linear), D(PCF_{:=}), and D(store).

Proof To derive the unicity of typing

⟶ ∀m∀t_{1}∀t_{2}(>⟨typeof^{∗} m t_{1}⟩^{∗} ⊃ >⟨typeof^{∗} m t_{2}⟩^{∗} ⊃ t_{1} ≡i_{∗} t_{2}) ,

we begin by applying the ∀R, ⊃ R, ∃L, cL, and ∧L rules, obtaining

nat i, seq_{i} nil^{∗} nil^{∗} ⟨typeof^{∗} m t_{1}⟩^{∗}, >⟨typeof^{∗} m t_{2}⟩^{∗} ⟶ t_{1} ≡i_{∗} t_{2} .

We proceed with a complete induction on the height i of the first typing derivation. Let P_{1} be the predicate

λil∀a(element a il ⊃ ∃x∃t(a ≡atm^{∗} (typeof^{∗} (fsti^{∗} x) t)))

and P_{2} the predicate

λil∀x∀t_{1}∀t_{2}(element (typeof^{∗} x t_{1}) il ⊃ element (typeof^{∗} x t_{2}) il ⊃ t_{1} ≡i_{∗} t_{2}) .

These predicates encode the requirements that the list of assumptions contains only typing assignments for variables and assigns only one type to any one variable. Our induction predicate IP is then

λj∀il(\begin{matrix}list il ⊃ P_{1} il ⊃ P_{2} il ⊃ \\ ∀m∀t_{1}∀t_{2}(\begin{matrix}seq_{j} il nil^{∗} ⟨typeof^{∗} m t_{1}⟩^{∗} ⊃ \\ il; nil^{∗} > ⟨typeof^{∗} m t_{2}⟩^{∗} ⊃ t_{1} ≡i_{∗} t_{2})) . \end{matrix} \end{matrix}

The desired conclusion follows easily from this induction predicate, since P_{1} and P_{2} hold vacuously for nil^{∗}.

For the induction step, we must derive the sequent

nat j, ∀k(nat k ⊃ k < j ⊃ (IP k)) ⟶ (IP j) .

We proceed with applications of the ∀R and ⊃ R rules, which yield the sequent

nat j, ∀k …, list il, P_{1} il, P_{2} il, seq_{j} il nil^{∗} ⟨typeof^{∗} m t_{1}⟩^{∗}, il; nil^{∗} > ⟨typeof^{∗} m t_{2}⟩^{∗} ⟶ t_{1} ≡i_{∗} t_{2} .

Since ⟨typeof^{∗} m t_{1}⟩^{∗} represents an atomic proposition, its object logic derivation must end with the use of either a typing assumption or a clause from the specification of typing. We obtain this formally by applying the def L rule to the hypothesis seq_{j} …, which gives us the two sequents

…, element (typeof^{∗} m t_{1}) il, il; nil^{∗} > ⟨typeof^{∗} m t_{2}⟩^{∗} ⟶ t_{1} ≡i_{∗} t_{2}

…, ∃ll_{0}∃il_{0} (list ll_{0} ∧ list il_{0} ∧ prog (typeof^{∗} m t_{1}) ll_{0} il_{0} ∧ split seq_{j_{1}} il nil^{∗} ll_{0} ∧ split seq_{j_{1}} il nil^{∗} il_{0}), il; nil^{∗} > ⟨typeof^{∗} m t_{2}⟩^{∗} ⟶ t_{1} ≡i_{∗} t_{2} . We proceed to derive the first sequent, representing the case where the first typing

derivation for m ends with the use of a typing assumption. First we can use the elided hypothesis (P_{1} il) to conclude that m is an eigenvariable:

…, element (typeof^{∗} (fsti^{∗} m′) t_{1}) il, il; nil^{∗} > ⟨typeof^{∗} (fsti^{∗} m′) t_{2}⟩^{∗} ⟶ t_{1} ≡i_{∗} t_{2} .

Given that, the second typing derivation for m must also end with the use of a typing assumption, since none of the specification clauses apply. We obtain this formally by applying the ∃L, ∧L, and def L rule to the hypothesis il; nil^{∗} > …, which gives us the two sequents

…, element (typeof^{∗} (fsti^{∗} m′) t_{1}) il, element (typeof^{∗} (fsti^{∗} m′) t_{2}) il ⟶ t_{1} ≡i_{∗} t_{2}

…, element (typeof^{∗} (fsti^{∗} m′) t_{1}) il, ∃ll_{0}∃il_{0}(list ll_{0} ∧ list il_{0} ∧ prog (typeof^{∗} (fsti^{∗} m′) t_{2}) ll_{0} il_{0} ∧ split seq_{k_{1}} il nil^{∗} ll_{0} ∧ split seq_{k_{1}} il nil^{∗} il_{0}) ⟶ t_{1} ≡i_{∗} t_{2} . The second sequent corresponds to the possibility that the typing derivation ends with the use of a specification clause. We show this is not applicable by applying the ∃L and ∧L rules, and then apply the def L rule to the hypothesis prog (typeof^{∗} (fsti^{∗} m′) t_{2}) ll_{0} il_{0}. The first sequent indicates that the typing derivation ends with a use of a typing assumption. As a result, the elided hypothesis (P_{2} il) allows us to conclude t_{1} ≡i_{∗} t_{2}.

We now return to the sequent that representing the case where the first typing derivation of m ends with the use of a clause specifying a typing rule:

…, ∃ll_{0}∃il_{0} (list ll_{0} ∧ list il_{0} ∧ prog (typeof^{∗} m t_{1}) ll_{0} il_{0} ∧ split seq_{j_{1}} il nil^{∗} ll_{0} ∧ split seq_{j_{1}} il nil^{∗} il_{0}), il; nil^{∗} > ⟨typeof^{∗} m t_{2}⟩^{∗} ⟶ t_{1} ≡i_{∗} t_{2} .

We apply the ∃L, cL and ∧L rules, and then apply the def L rule to the hypothesis prog (typeof^{∗} m t_{1}) ll_{0} il_{0}. This corresponds to a case analysis of the last typing rule used in the first typing derivation for m.

6.4. A LANGUAGE WITH REFERENCES 137

If the first typing derivation for m ends with a typing rule for zero, then m is zero^{∗} and t_{1} is num^{∗}:

…, split seq_{j_{1}} il nil^{∗} nil^{∗}, il; nil^{∗} > ⟨typeof^{∗} zero^{∗} t_{2}⟩^{∗} ⟶ num^{∗} ≡i_{∗} t_{2} .

The second typing derivation for m must also end with the typing rule for zero, since no other typing rules apply and by (P_{1} il) the typing assumptions only apply to variables. We deduce this in F Oλ^{ΔIN} by first applying the ∃L, ∧L, and def L rules to il; nil^{∗} > . . .. This gives us two sequents corresponding to the possibilities that the typing derivation ends with the use of a typing assumption or the use of a typing rule:

…, split seq_{j_{1}} il nil^{∗} nil^{∗}, element (typeof^{∗} zero^{∗} t_{2}) il ⟶ num^{∗} ≡i_{∗} t_{2}

…, split seq_{j_{1}} il nil^{∗} nil^{∗}, ∃ll_{0}∃il_{0} (list ll_{0} ∧ list il_{0} ∧ prog (typeof^{∗} zero^{∗} t_{2}) ll_{0} il_{0} ∧ split seq_{k_{1}} il nil^{∗} ll_{0} ∧ split seq_{k_{1}} il nil^{∗} il_{0}) ⟶ num^{∗} ≡i_{∗} t_{2} .

We show that the first case is not relevant by using the elided hypothesis (P_{1} il) to get the hypothesis

(typeof^{∗} zero^{∗} num^{∗}) ≡atm^{∗} (typeof^{∗} (fsti^{∗} x) t) ,

and then applying def L to it. For the second sequent we apply the ∃L and ∧L rules and then apply the def L to prog (typeof^{∗} zero^{∗} t_{2}) ll_{0} il_{0}, yielding

…, split seq_{j_{1}} il nil^{∗} nil^{∗} ⟶ num^{∗} ≡i_{∗} num^{∗} .

This shows that since the second typing derivation ends with the typing rule for zero, t_{2} must also be num^{∗}. We complete the derivation with an application of the def R rule. The cases for true, false, succ, pred, is zero, and rec are similar.

If the first typing derivation for m ends with a typing rule for if, then we know that m is of the form (if^{∗} m′ n_{1} n_{2}), m′ has type bool, and both n_{1} and n_{2} have type t_{1}:

…, split seq_{j_{1}} il nil^{∗} (\begin{matrix}⟨typeof^{∗} m′ bool^{∗}⟩^{∗}::^{∗} \\ ⟨typeof^{∗} n_{1} t_{1}⟩^{∗}::^{∗} \\ ⟨typeof^{∗} n_{2} t_{1}⟩^{∗}::^{∗} nil^{∗}), \end{matrix} il; nil^{∗} > ⟨typeof^{∗} (if^{∗} m′ n_{1} n_{2}) t_{2}⟩^{∗} ⟶ t_{1} ≡i_{∗} t_{2} .

138 CHAPTER 6. REASONING ABOUT PROGRAMMING LANGUAGES

The second typing derivation for (if^{∗} m′ n_{1} n_{2}) must also end with the typing rule for if; this is deduced in F Oλ^{ΔIN} in the same way as in the zero case. This brings us to the sequent

…, split seq_{j_{1}} il nil^{∗} …, nat (s k_{1}), split seq_{k_{1}} il nil^{∗} (⟨typeof^{∗} m′ bool^{∗}⟩^{∗}::^{∗} ⟨typeof^{∗} n_{1} t_{2}⟩^{∗}::^{∗} ⟨typeof^{∗} n_{2} t_{2}⟩^{∗}::^{∗} nil^{∗}) ⟶ t_{1} ≡i_{∗} t_{2} .

By applying the def L, ∃L, cL, and ∧L rules to both split seq_{j_{1}} … and split seq_{k_{1}} … we can obtain hypotheses seq_{j_{2}} il nil^{∗} ⟨typeof n_{1} t_{1}⟩ and seq_{k_{2}} il nil^{∗} ⟨typeof n_{1} t_{2}⟩. We can then apply the induction hypothesis ∀k … to these to conclude that t_{1} ≡ t_{2}. The cases for app, ref , deref, assign, and sequence are similar.

It remains to derive the case for abs:

…, split seq_{j_{1}} il nil^{∗} λl(⋀ x(\begin{matrix}(typeof x (u l)) ⇒ \\ ⟨typeof (r l x) (t′_{1} l)⟩)::nil), \end{matrix} il; nil^{∗} > ⟨typeof^{∗} (abs^{∗} u r) t_{2}⟩^{∗} ⟶ (arr^{∗} u t′_{1}) ≡i_{∗} t_{2} .

As in the other cases, we deduce that the second typing derivation must end with the same typing rule:

…, split seq_{j_{1}} il nil^{∗} …, nat (s k_{1}),

split seq_{k_{1}} il nil^{∗} λl(⋀ x(\begin{matrix}(typeof x (u l)) ⇒ \\ ⟨typeof (r l x) (t′_{2} l)⟩)::nil) \end{matrix}

⟶ (arr^{∗} u t′_{1}) ≡i_{∗} (arr^{∗} u t′_{2}) .

By applying the def L, ∃L, cL, and ∧L rules to both split seq_{j_{1}} … and split seq_{k_{1}} … we can obtain hypotheses

seq_{j_{2}} λl((typeof (fsti l) (u (rst l)))::(il (rst l))) nil^{∗} λl⟨typeof (r (rst l) (fsti l)) (t′_{1} l)⟩

and

seq_{k_{2}} λl((typeof (fsti l) (u (rst l)))::(il (rst l))) nil^{∗} λl⟨typeof (r (rst l) (fsti l)) (t′_{2} l)⟩ .

To apply the elided induction hypothesis ∀k … to these, we must be able to show that the extended list of typing assumptions satisfies the predicates list, P_{1} and P_{2}. To show these, we first derive the following formulas by simple induction:

∀il(list il ⊃ list (λl il (rst l)))

∀a∀il(\begin{matrix}list (λl il (rst l)) ⊃ element a (λl il (rst l)) ⊃ \\ ∃a′(a ≡atm^{∗} (λl a′ (rst l)) ∧ element a′ il)) . \end{matrix}

It follows easily from the first of these that the extended list of assumptions satisfies the list predicate, since it has length one greater than λl il (rst l)). Since il satisfies P_{1}, to show that the extended list of assumptions satisfies P_{1}, it suffices by the second formula above to show that the new typing assumption λl (typeof (fsti l) (u (rst l))) gives a type for a variable; this is immediate. Similarly, to show that the extended list of assumptions satisfies P_{2}, it suffices to show that the new typing assumption is consistent with any other typing assumption for (fsti l) in λl il (rst l):

…, element (λl typeof (fsti l) (u′ l)) (λl il(rst l)) ⟶ (λl u(rst l)) ≡i_{∗} u′ .

But λl il (rst l) cannot contain any typing assumptions for (fsti l), since it cannot contain occurrences of (fsti l). We derive this in F Oλ^{ΔIN} by applying the second formula above to the hypothesis element (λl typeof (fsti l) (u′ l)) (λl il (rst l)), yielding

…, ∃a′((λl typeof (fsti l) (u′ l)) ≡atm^{∗} (λl a′ (rst l)) ∧ element a′ il) ⟶ (λl u(rst l)) ≡i_{∗} u′ .

Applying ∃L and ∧L to this, and then applying def L to λl (typeof (fsti l) (u′ l)) ≡atm^{∗} (λl a′ (rst l)) will complete the derivation. Having shown that the induction hypothesis applies, we can now conclude that t′_{1} ≡i_{∗} t′_{2}, and hence (arr^{∗} u t′_{1}) ≡i_{∗} (arr^{∗} u t′_{2}).

6.5 Related Work

There are several approaches others have taken to reason about higher-order abstract syntax encodings directly in a formalized meta-language. Despeyroux, Felty, and Hirschowitz [9, 8] show that induction principles for a restricted form of second-order abstract syntax can be derived in the Coq proof development system. To keep the definitions monotone, they introduce a separate type for variables and explicit coercions from variables to other types. For example, their constructors for λ-terms would be

var : vr → tm  abs : (vr → tm) → tm  app : tm → tm → tm ,

and the corresponding definition of typeof would be

typeof vr : vr → ty → o  typeof : tm → ty → o
typeof (var X) T =^{△} typeof vr X T
typeof (abs M) (arr T U) =^{△} ∀x(typeof vr x T ⊃ typeof (M x) U)
typeof (app M N) T =^{△} ∃u(typeof M (arr u T) ∧ typeof N u) .

This is similar to our use of the two predicates hyp and conc in our encoding of intuitionistic logic in Section 5.1.2. Notice that the type tm does not occur negatively in the type of any of its constructors, nor does the predicate typeof occur negatively in its definition. This allows Coq to automatically construct induction principles for tm and typeof. Since object-level variable binding is still represented by meta-level λ-abstraction, the object language still inherits α-equivalence from the meta-language. Because the abstraction is over the type vr, however, meta-level β-reduction cannot be used for substitution. These approaches also lessen the power of the meta-level cut as a reasoning tool. Suppose that ∀x(typeof vr x T ⊃ typeof (M x) U) and typeof N T are derivable. In contrast to our encoding, it is not immediate that substituting N for (var x) in (M x) yields a term M′ such that typeof M′ U is derivable. Thus of the three key benefits to higher-order abstract syntax, they only retain α-conversion. In addition, the Coq type (vr → tm) includes functions besides those expressible as λ-terms, so the type tm includes expressions that do not encode terms of the object language. They avoid these exotic terms through the definition and use of a validation predicate.

Despeyroux, Pfenning, and Schürmann [10] address the problem of exotic terms by using a modal operator to distinguish the types of parametric functions (expressible as λ-terms) from the types of arbitrary functions. As a result, their calculus allows primitive recursive functionals while preserving the adequacy of higher-order abstract syntax encodings. This represents a start toward a logical framework supporting meta-theoretic 6.5. RELATED WORK 141

reasoning, higher-order abstract syntax, and the judgments-as-types principle. In such a framework a derivation would be represented as a function whose type is the derived property. Thus the → type constructor must be rich enough to include the mappings from derivations to derivations such as the realizations of case analysis and induction. Their work is orthogonal to our work presented in this paper. We are not attempting to support the judgments-as-types principle, so the types of our meta-logic are only used to encode syntactic structure. Thus we can restrict these types to include only λ-terms, ensuring the adequacy of encodings in higher-order abstract syntax. They, on the other hand, do not address the issue of induction principles for higher-order abstract syntax, or more generally, the issue of formal reasoning about higher-order abstract syntax encodings.

Schürmann [51] offers another framework supporting higher-order abstract syntax and meta-theoretic analysis. He constructs a meta-logic MLF to reason about deductive systems represented in the Horn fragment of LF. This meta-logic includes a recursion rule that is used for induction and case analysis. This approach is similar in spirit to ours in that there are three levels: the deductive system(s) under consideration, the logic in which the deductive systems are encoded, and the logic in which meta-theoretic analysis takes place. His meta-logic MLF, however, is designed for a specific, fixed intermediate logic, the Horn fragment of LF. In our case, the meta-logic is a general framework capable of representing and reasoning about a variety of logics. In addition, the validity of Schürmann’s work depends on cut-elimination for MLF, which is still an open question.

Still another strategy for meta-theoretic reasoning about higher-order abstract syntax encodings is to perform each case of a proof in the meta-logic, but verify the completeness of the proof outside the logical framework. Rohwedder and Pfenning [47, 48] investigate the design and implementation of such external validity conditions.

Matthews seeks to reconcile the advantages of LF-style encodings with the facilities for meta-theoretic analysis found in theories of inductive definitions [29]. His approach has some similarity to our own, in that he creates a three-level hierarchy, with each level being encoded in the previous. As in our approach, his top level contains a definition facility and induction principles for reasoning about encodings at the next level. However, his logic at the intermediate level contains only an implication connective and no quantifiers.

142 CHAPTER 6. REASONING ABOUT PROGRAMMING LANGUAGES Thus he does not address the treatment of object-level bound variables, a major feature of higher-order abstract syntax and, consequently, of our work.

Chapter 7

Conclusion and Future Work

7.1 Summary of Accomplishments

In this dissertation we presented a logic F Oλ^{ΔIN} with definitions and natural number induction. Induction is a fundamental tool for reasoning about formal systems. The notion of definition supported by F Oλ^{ΔIN} extends the concept of a theory to include the sense that there are no other ways that defined concepts can be established. This sense of closure increases the logic’s capabilities for both expression and reasoning. In addition, the term language of F Oλ^{ΔIN} is the simply-typed λ-calculus, which is appropriate for the use of higher-order abstract syntax. We have proved cut-elimination and consistency theorems for F Oλ^{ΔIN}. The usual cut-elimination proofs for logics with definitions do not apply to F Oλ^{ΔIN} because of the presence of the induction rule; we instead used an extension of a technique due to Tait and Martin-Löf.

We demonstrated the expressive power of our logic in the realm of abstract transition systems. The sense of closure in F Oλ^{ΔIN}’s definitions made it possible to encode both may and must behavior of systems, and thus to express the notions of simulation and bisimulation. By also using induction over natural numbers, we were able to capture the greatest fixed-point of these notions, and thus the largest simulation and bisimulation relations, and to prove some high-level properties about them.

Finally, we developed a framework for formal reasoning about systems expressed in higher-order abstract syntax, avoiding the apparent tradeoff between the benefits of this 144 CHAPTER 7. CONCLUSION AND FUTURE WORK

representation technique and the ability to perform meta-theoretic analyses of encodings. We demonstrated this framework on encodings of three programming languages encompassing both functional and imperative paradigms. A number of significant theorems about these languages were derived in this framework, including unicity of typing and subject reduction. The flexibility of the framework was also shown through the use of intuitionistic and linear specification logics.

7.2 Future Work

There are many ways in which this work could be continued, both in extensions to the logic and in additional applications of it.

An obvious extension of F Oλ^{ΔIN} would be to replace the induction rule for natural numbers with induction over arbitrary definitions. Coq and FS_{0}, for example, both support induction for definitions in this manner. Care must be taken here to ensure that the cutelimination and consistency results extend to the extended logic.

Another interesting extension to consider is enriching the class of definitions to include the form of typical higher-order abstract syntax encodings. This would involve relaxing the level restriction, and it is not clear if this can be done without losing the cut-elimination and consistency properties. This also would cause the logic to support definitions outside the class of monotone inductive definitions, so the existence of induction principles for these definitions would be in question. With such an extension, however, it might become possible to both use higher-order abstract syntax and reason effectively about the encodings in the same logic. The presence of case analysis and induction in the logic make its implication connective stronger than that of intuitionistic logic, so a modal operator along the lines of [10] might become necessary to maintain the adequacy of encodings.

The implementation of the logic could also be improved. For this dissertation, the Pi derivation editor for the finitary calculus of partial inductive definitions was used. To ensure that the constructed derivations were valid for F Oλ^{ΔIN}, the induction rule was only used in a restricted manner, definitions for additional connectives were constructed, and all definitions were checked by hand to ensure that they satisfied the F Oλ^{ΔIN} level restrictions. An implementation of F Oλ^{ΔIN} would remove this burden from the user and 7.2. FUTURE WORK 145

further increase confidence in the derivations. Improvements to Pi itself are also possible; our use showed the need for increased robustness, more powerful unification, and the ability to import other derivations as lemmas or derived rules. In addition, a graphical display showing the shape of the entire derivation and allowing movement within the derivation would be helpful, and some automatic theorem proving capabilities would also be useful.

In terms of applications of the logic, an interesting extension of the work presented here would be to explore the encoding of simulation and bisimulation for languages with significant variable-binding constructs. For example, Howe [26] explores a bisimulation relation for functional programming languages and uses a syntactic technique to prove that it is a congruence. It would be interesting to see if this could be done formally within the framework presented in this dissertation. The logic could also be used to formally establish equivalences among specific programs; Chirimar [6] used linear logic specifications to informally prove various equivalences suggested by Meyer and Sieber [33].

Additional work in analysis of programming languages along the lines of Chapter 6 could also be done. Time precluded us from proving the determinacy of evaluation for PCF_{:=}, for example, and a transition semantics for the language could be constructed and shown to be equivalent to the natural semantics we constructed. It would also be interesting to formalize other analyses; Hannan and Miller, for example, construct abstract machines from operational semantics by applying of a series of transformations and argue informally that the transformations preserve correctness [22]. Richer languages could also be considered, including features such as concurrency, exceptions, polymorphism, etc.

Finally, alternatives to the explicit eigenvariable encoding of Section 5.1.4 could be explored. Although this encoding supports the higher-order abstract syntax representation of bound variables and allows substantial meta-theoretic analysis, it does have some drawbacks. The pervasive presence of the evs parameter representing the free variable list is somewhat cumbersome, and numerous lemmas must be proved to show that various properties are preserved by extensions of this list or substitution for free variables. The obvious alternative, a de Bruin-style encoding of free variables, would require a similar amount of work and would not support the higher-order abstract syntax representation for bound variables. It is important to point out that this issue relates to the encoding of the 146 CHAPTER 7. CONCLUSION AND FUTURE WORK

specification logic, not the object systems, of our framework. Thus these lemmas need to be proved only once for any specification logic, not for every object system, and so the representational advantage of higher-order abstract syntax for the object systems is not lost.

Bibliography

[1] K. R. Apt and M. H. van Emden. Contributions to the theory of logic programming. Journal of the ACM, 29(3):841–862, 1982.

[2] K.R. Apt and R. Bol. Logic programming and negation: a survey. Journal of Logic Programming, 19-20:9–71, 1994.

[3] Arnon Avron, Furio Honsell, Ian A. Mason, and Robert Pollack. Using typed lambda calculus to implement formal systems on a machine. Journal of Automated Reasoning, 9:309 – 354, 1992.

[4] R. Burstall and F. Honsell. A natural deduction treatment of operational semantics. In Proceedings of the 8th Conference on Foundations of Software Technology and Theoretical Computer Science, volume 338 of Lecture Notes in Computer Science, pages 250–269. Springer-Verlag, 1988.

[5] Iliano Cervesato and Frank Pfenning. A linear logic framework. In Proceedings, Eleventh Annual Symposium on Logic in Computer Science, pages 264–275. IEEE Computer Society Press, July 1996.

[6] Jawahar Chirimar. Proof Theoretic Approach to Specification Languages. PhD thesis, University of Pennsylvania, February 1995.

[7] Alonzo Church. A formulation of the simple theory of types. Journal of Symbolic Logic, 5:56–68, 1940.

[8] Joëlle Despeyroux, Amy Felty, and Andre Hirschowitz. Higher-order abstract syntax in Coq. In M. Dezani-Ciancaglini and G. Plotkin, editors, Second International Conference on Typed Lambda Calculi and Applications, volume 902 of Lecture Notes in Computer Science, pages 124–138. Springer-Verlag, April 1995.

[9] Joëlle Despeyroux and Andre Hirschowitz. Higher-order abstract syntax with induction in Coq. In F. Pfenning, editor, Proceedings of the Fifth International Conference on Logic Programming and Automated Reasoning, volume 822 of Lecture Notes in Artificial Intelligence, pages 159–173. Springer-Verlag, June 1994.

148 BIBLIOGRAPHY

[10] Joelle Despeyroux, Frank Pfenning, and Carsten Schürmann. Primitive recursion for higher-order abstract syntax. In R. Hindley, editor, Third International Conference on Typed Lambda Calculi and Applications, April 1997.

[11] Lars-Henrik Eriksson. A finitary version of the calculus of partial inductive definitions. In L.-H. Eriksson, L. Hallnäs, and P. Schroeder-Heister, editors, Proceedings of the Second International Workshop on Extensions to Logic Programming, volume 596 of Lecture Notes in Artificial Intelligence, pages 89–134. Springer-Verlag, 1991.

[12] Lars-Henrik Eriksson. Finitary partial inductive definitions as a general logic. In Proceedings of the Fourth International Workshop on Extensions to Logic Programming, volume 798 of Lecture Notes in Artificial Intelligence, pages 94–119. Springer-Verlag, 1993.

[13] Lars-Henrik Eriksson. Pi: an interactive derivation editor for the calculus of partial inductive definitions. In A. Bundy, editor, Proceedings of the Twelfth International Conference on Automated Deduction, volume 814 of Lecture Notes in Artificial Intelligence, pages 821–825. Springer-Verlag, June 1994.

[14] Vijay Gehlot and Carl Gunter. Normal process representatives. In Proceedings, Fifth Annual IEEE Symposium on Logic in Computer Science, pages 200–207. IEEE Computer Society Press, June 1990.

[15] Gerhard Gentzen. Investigations into logical deductions, 1935. In M. E. Szabo, editor, The Collected Papers of Gerhard Gentzen, pages 68–131. North-Holland Publishing Co., 1969.

[16] Jean-Yves Girard. Une extension de l’interprétation de Gödel à l’analyse, et son application à l’émination des coupures dans l’analyse et la théorie des types. In J.E. Fenstad, editor, Proceedings of the Second Scandinavian Logic Symposium, volume 63 of Studies in Logic and the Foundations of Mathematics, pages 63–92, Amsterdam, 1971. North-Holland.

BIBLIOGRAPHY 149

[17] Jean-Yves Girard. A fixpoint theorem in linear logic. A message posted on the

linear@cs.stanford.edu mailing list, http://www.csl.sri.com/linear/mailing-
list-traffic/www/07/mail_3.html, February 1992.

[18] Carl A. Gunter. Semantics of Programming Languages: Structures and Techniques. Foundations of Computing. MIT Press, 1992.

[19] Lars Hallnäs. Partial inductive definitions. Theoretical Computer Science, 87:115–142, 1991.

[20] Lars Hallnäs and Peter Schroeder-Heister. A proof-theoretic approach to logic programming. II. Programs as definitions. Journal of Logic and Computation, 1(5):635– 660, 1991.

[21] John Hannan. Extended natural semantics. Journal of Functional Programming, 3(2):123–152, April 1993.

[22] John Hannan and Dale Miller. From operational semantics to abstract machines. Mathematical Structures in Computer Science, 2(4):415–459, 1992.

[23] John J. Hannan. Investigating a Proof-Theoretic Meta-Language for Functional Programs. PhD thesis, University of Pennsylvania, August 1990.

[24] Robert Harper, Furio Honsell, and Gordon Plotkin. A framework for defining logics. Journal of the ACM, 40(1):143–184, 1993.

[25] Joshua Hodas and Dale Miller. Logic programming in a fragment of intuitionistic linear logic. Information and Computation, 110(2):327–365, 1994.

[26] Douglas J. Howe. Proving congruence of bisimulation in functional programming languages. Information and Computation, 124(2):103–112, 1996.

[27] Gérard Huet. A unification algorithm for typed λ-calculus. Theoretical Computer Science, 1:27–57, 1975.

[28] Per Martin-Löf. Hauptsatz for the intuitionistic theory of iterated inductive definitions. In J.E. Fenstad, editor, Proceedings of the Second Scandinavian Logic Symposium, volume 63 of Studies in Logic and the Foundations of Mathematics, pages 179–216. North-Holland, 1971.

[29] Seán Matthews. A practical implementation of simple consequence relations using inductive definitions. In W. McCune, editor, Proceedings of the 14th Conference on Automated Deduction. Springer-Verlag, July 1997.

[30] Sean Matthews, Alan Smaill, and David Basin. Experience with FS_{0} as a framework theory. In G. Huet and G.D. Plotkin, editors, Logical Environments, pages 61–82. Cambridge University Press, 1993.

[31] Raymond McDowell and Dale Miller. A logic for reasoning with higher-order abstract syntax. In Glynn Winskel, editor, Twelfth Annual IEEE Symposium on Logic in Computer Science. IEEE Computer Society Press, June 1997.

[32] Raymond McDowell, Dale Miller, and Catuscia Palamidessi. Encoding transition systems in sequent calculus: Preliminary report. In Proceedings of the 1996 Workshop on Linear Logic, volume 3 of Electronic Notes in Theoretical Computer Science. Elsevier, 1996.

[33] Albert R. Meyer and Kurt Sieber. Towards fully abstract semantics for local variables: preliminary report. In Proceedings of the 15^{th} Annual ACM Symposium on the Principles of Programming Languages, pages 191–203, 1988.

[34] Dale Miller. Abstractions in logic programs. In P. Odifreddi, editor, Logic and Computer Science, pages 329–359. Academic Press, 1990.

[35] Dale Miller. A logic programming language with lambda-abstraction, function variables, and simple unification. Journal of Logic and Computation, 1(4):497–536, 1991.

[36] Dale Miller. The π-calculus as a theory in linear logic: Preliminary results. In E. Lamma and P. Mello, editors, Proceedings of the 1992 Workshop on Extensions to Logic Programming, volume 660 of Lecture Notes in Computer Science, pages 242– 265. Springer-Verlag, 1993.

[37] Dale Miller. Forum: A multiple-conclusion specification language. Theoretical Computer Science, 165:201–232, 1996.

[38] Dale Miller and Gopalan Nadathur. A logic programming approach to manipulating formulas and programs. In S. Haridi, editor, IEEE Symposium on Logic Programming, pages 379–388, September 1987.

[39] Dale Miller, Gopalan Nadathur, Frank Pfenning, and Andre Scedrov. Uniform proofs as a foundation for logic programming. Annals of Pure and Applied Logic, 51:125–157, 1991.

[40] Robin Milner. Communication and Concurrency. Prentice-Hall International, 1989.

[41] John C. Mitchell. Foundations for Programming Languages. MIT Press, 1995.

[42] D. M. Park. Concurrency on automata and infinite sequences. In P. Deussen, editor, Conference on Theoretical Computer Science, volume 104 of Lecture Notes in Computer Science. Springer-Verlag, 1993.

[43] Christine Paulin-Mohring. Inductive definitions in the system Coq: Rules and properties. In Proceedings of the International Conference on Typed Lambda Calculi and Applications, pages 328–345, 1993.

[44] Frank Pfenning. Elf: A language for logic definition and verified metaprogramming. In Proceedings,Fourth Annual Symposium on Logic in Computer Science, pages 313–321. IEEE Computer Society Press, June 1989.

[45] Frank Pfenning. Structural cut elimination. In D. Kozen, editor, Proceedings, Tenth Annual IEEE Symposium on Logic in Computer Science, pages 156–166. IEEE Computer Society Press, June 1995.

[46] Frank Pfenning and Conal Elliot. Higher-order abstract syntax. In Proceedings of the ACM-SIGPLAN Conference on Programming Language Design and Implementation, pages 199–208, June 1988.

152 BIBLIOGRAPHY

[47] Frank Pfenning and Ekkehard Rohwedder. Implementing the meta-theory of deductive systems. In D. Kapur, editor, Proceedings of the Eleventh International Conference on Automated Deduction, volume 607 of Lecture Notes in Artificial Intelligence, pages 537–551. Springer-Verlag, June 1992.

[48] Ekkehard Rohwedder and Frank Pfenning. Mode and termination analysis for higherorder logic programs. In Proceedings of the European Symposium on Programming, pages 296–310, April 1996.

[49] Peter Schroeder-Heister. Cut-elimination in logics with definitional reflection. In D. Pearce and H. Wansing, editors, Nonclassical Logics and Information Processing, volume 619 of Lecture Notes in Computer Science, pages 146–171. Springer-Verlag, 1992.

[50] Peter Schroeder-Heister. Rules of definitional reflection. In M. Vardi, editor, Proceedings, Eighth Annual IEEE Symposium on Logic in Computer Science, pages 222–232. IEEE Computer Society Press, June 1993.

[51] Carsten Schürmann. A computational meta logic for the Horn fragment of LF. Master’s thesis, Carnegie Mellon University, December 1995.

[52] Dana S. Scott. A type theoretical alternative to CUCH,ISWIM,OWHY. Unpublished manuscript, 1969.

[53] John Slaney. Solution to a problem of Ono and Komori. Journal of Philosophic Logic, 18:103–111, 1989.

[54] W.W. Tait. Intensional interpretations of functionals of finite type I. Journal of Symbolic Logic, 32(2):198–212, 1967.