A Proof Theory for Generic Judgments: An extended abstract

Dale Miller

INRIA/Futurs/Saclay & École polytechnique dale.miller@inria.fr

Alwen Tiu

École polytechnique & Penn State University tiu@cse.psu.edu

Abstract

A powerful and declarative means of specifying computations containing abstractions involves meta-level, universally quantified generic judgments. We present a proof theory for such judgments in which signatures are associated to each sequent (used to account for eigenvariables of the sequent) and to each formula in the sequent (used to account for generic variables locally scoped over the formula). A new quantifier, ∇, is introduced to explicitly manipulate the local signature. Intuitionistic logic extended with ∇ satisfies cut-elimination even when the logic is additionally strengthened with a proof theoretic notion of definitions. The resulting logic can be used to encode naturally a number of examples involving name abstractions, and we illustrate using the π-calculus and the encoding of objectlevel provability.

Keywords: proof search, reasoning about operational semantics, generic judgments, higher-order abstract syntax.

1. Eigenvariables and generic reasoning

In specifying and reasoning about computations involving abstractions, one needs to encode both the static structure of such abstractions and their dynamic structure during computation. One successful approach to such an encoding, generally called higher-order abstract syntax [22], uses λ-terms to encode the static structure of abstractions and universally quantified judgments to encode their dynamic structure.

There are, of course, several ways to prove a universally quantified expression, ∀_{γ}x.B. An approach that can be called the extensional, attempts to prove B[t/x] for all (closed) terms t of type γ. This rule might involve an infinite number of premises if the domain of the type γ is infinite. If the type γ is defined inductively, a proof by induction can replace the need for infinite premises with finite premises (the base cases and inductive cases) but with the need to discover invariants. Another more intensional approach, however, involves introducing a new, generic variable, say, c : γ, that has not been introduced before in the proof, and to prove the formula B[c/x] instead. In natural deduction and sequent calculus proofs, such new variables are called eigenvariables.

In Gentzen’s original presentation of the sequent calculus [5], eigenvariables were immutable: reading proofs bottom-up, once an eigenvariable is introduced it is not used as a site for substitution. In other words, Gentzen’s eigenvariables did not vary in proof construction: rather they acted more as fresh, scoped constants.

The generic interpretation of quantifiers generally entails the extensional interpretation: this is a simple consequence of the cut-elimination theorem as follows. Assume that the sequent Γ ⟶ ∀x.B is proved using the introduction of ∀ on the right from the premise Γ ⟶ B[c/x], where c is an eigenvariable and Π(c) is a proof of this premise. Similarly, assume that the sequent Γ′, ∀xB ⟶ C is proved using the introduction of ∀ on the left from the premise Γ′, B[t/x] ⟶ C, where t is some term. To reduce the rank of the cut formula ∀x.B between the sequents Γ ⟶ ∀x.B and Γ′, ∀xB ⟶ C, the eigenvariable c in the sequent calculus proof Π(c) must be substituted by t to yield a proof Π(t) of Γ ⟶ B[t/x]: in this way, the cut-formula is now the smaller formula B[t/x]. In Gentzen, this role of c in Π(c) as a site for substitution only takes place in the metatheory of proofs and not in proofs themselves.

Recent years have witnessed two different developments in the role of eigenvariables in the specification of computation systems.

Eigenvariables as fresh, scoped constants Focusing on their intensional nature and guarantee of newness or freshness in proof search, eigenvariables have been used to encode name restrictions in the π-calculus [15], nonces in security protocols [1], reference locations in imperative programming [2, 16], and constructors hidden within abstract data-types [12]. Eigenvariables also provide an essential

{Σ : (σ, y : γ) ▷ B[y/x], Γ ⟶ C \atop Σ : σ ▷ ∇_{γ}x.B, Γ ⟶ C} ∇L

{Σ : Γ ⟶ (σ, y : γ) ▷ B[y/x] \atop Σ : Γ ⟶ σ ▷ ∇_{γ}x.B} ∇R

Figure 1. Rules for the ∇-quanti�er.

aspect of recursive programming with data encoded using higher-order abstract syntax. In this role, eigenvariables are essentially constants, scoped over part of a computation.

Eigenvariables as variables to instantiate Computation in logic programming can be seen as a (restricted) form of cut-free proof search. Cut and cut-elimination can then be used to reason directly about computation: for example, if A has a cut-free proof (that is, it can be computed) and we know that A ⊃ B can be proved (possibly with cuts), cutelimination allows us to conclude that B has a cut-free proof (that is, it can be computed). As we mentioned above, such direct reasoning on logic specification involves instantiations of eigenvariables. Similarly, focusing on their extensional nature guaranteed by cut-elimination, enrichments to the sequent calculus have been proposed by [7, 24, 6, 9] in which eigenvariables are intended as variables to be substituted. This enrichment to proof theory (discussed here in Section 4) holds promise for providing proof systems for the direct reasoning of logic specifications (see, for example, the above mentioned papers as well as [10, 11]).

These two approaches are, however, at odds with each other. Consider, for example, the problem of representing restriction of names or nonces using ∀ quantification. (The following example can be dualized in the event that a logical specification uses ∃ quantification instead of ∀, as in, for example, [1]). One can imagine that a proof of the expression ∀x∀y.P (x, y) involves two different fresh “names” or “nonces” whereas a proof of the expression ∀z.P (z, z) involves just one such item. Of course, in logic, the implication ∀x∀y.P (x, y) ⊃ ∀z.P (z, z) holds, so if there is a proof with the two different names, there must be one with those names identified (via cut-elimination), and this is unlikely to be the intended meaning of such quantification. This suggests that when using eigenvariables solely to provide scope and freshness to names, one cannot reason directly with the specification using the center piece of proof theory: cutelimination.

2. The ∇-quantifier

One approach to solving this problem of forcing one connective, the ∀-quantifier, to have two behaviors that are not entirely compatible, is to extend the logic with a new quantifier. In this paper, we do this by adding the ∇-quantifier: its role will be to declare variables to be new and of local scope. The syntax of the formula ∇_{γ}x.B is like that for the universal and existential quantifiers. Following Church’s approach with the Simple Theory of Types [3] formulas are given the type o, and for all types γ not containing o, ∇_{γ} is a constant of type (γ → o) → o. The expression ∇_{γ}λx.B is usually abbreviated as simply ∇_{γ}x.B or as ∇x.B if the type information is either simple to infer or not important.

Intuitionistic sequents without the need to account for ∇ are structures of the form

Σ : B_{1}, …, B_{n} ⟶ B_{0}.

Here, Σ is a signature containing the list of all (explicitly typed) eigenvariables of the sequent. We write Σ ⊢ t : γ to denote that t is a simply typed λ-term of type γ in which there may appear the (fixed) logical and non-logical constants as well as those eigenvariables in Σ. We shall also say t is a Σ-term (of type γ), and, if γ is o, t is a Σ-formula. In the displayed sequent above, n ≥ 0 and B_{0}, B_{1}, …, B_{n} are Σ-formulas. Informally, the “extensional” reading of this sequent would be that for every substitution θ that maps a variable x : γ ∈ Σ to a term of type γ, if B_{i}θ holds for all i = 1, …, n, then B_{0}θ holds.

To account for this new quantifier, we introduce into sequents a new element of context. Sequents will now have one global signature (containing the sequent’s eigenvariables) and several local signatures, used to scope locally fresh variables. More generally, sequents have the structure

Σ : σ_{1} ▷ B_{1}, …, σ_{n} ▷ B_{n} ⟶ σ_{0} ▷ B_{0}.

Here, σ_{i}, for i = 0, …, n are signatures and the other items are as above. We shall consider sequents to be binding structures in the sense that the signatures, both the global and local ones, are abstractions over their respective scopes. The variables in Σ and σ_{i} will admit α-conversion by systematically changing the names of variables in signatures as well as those in their scope, following the usual convention of the λ-calculus. In general, however, we will assume that the local signatures σ_{i} contain names different than those in the global signature Σ. The expression σ ▷ B is called a generic judgment or simply judgment. We use script letters A, B, etc. to denote judgments. We write simply B instead of σ ▷ B if the signature σ is empty.

The introduction rules for ∇ are given in Figure 1. The variable y must be new to the variables in σ and Σ (implicit in the definition of sequent). The expression (σ, y : γ) denotes the signature containing the type declaration y : γ appended to the end of the list σ. Notice that since the left and right rules are essentially the same, this quantifier will be self dual.

{Σ : σ ▷ B, Γ ⟶ D \atop Σ : σ ▷ B ∧ C, Γ ⟶ D} ∧L  {Σ : σ ▷ C, Γ ⟶ D \atop Σ : σ ▷ B ∧ C, Γ ⟶ D} ∧L  {Σ : Γ ⟶ σ ▷ B  Σ : Γ ⟶ σ ▷ C \atop Σ : Γ ⟶ σ ▷ B ∧ C} ∧R
{Σ : σ ▷ B, Γ ⟶ D  Σ : σ ▷ C, Γ ⟶ D \atop Σ : σ ▷ B ∨ C, Γ ⟶ D} ∨L  {Σ : Γ ⟶ σ ▷ B \atop Σ : Γ ⟶ σ ▷ B ∨ C} ∨R  {Σ : Γ ⟶ σ ▷ C \atop Σ : Γ ⟶ σ ▷ B ∨ C} ∨R
{Σ : Γ ⟶ σ ▷ B  Σ : σ ▷ C, Γ ⟶ D \atop Σ : σ ▷ B ⊃ C, Γ ⟶ D} ⊃ L  {Σ : σ ▷ B, Γ ⟶ σ ▷ C \atop Σ : Γ ⟶ σ ▷ B ⊃ C} ⊃ R

{Σ, σ ⊢ t : γ  Σ : σ ▷ B[t/x], Γ ⟶ C \atop Σ : σ ▷ ∀_{γ}x.B, Γ ⟶ C} ∀L  {Σ, h : Γ ⟶ σ ▷ B[(h σ)/x] \atop Σ : Γ ⟶ σ ▷ ∀x.B} ∀R

{Σ, h : σ ▷ B[(h σ)/x], Γ ⟶ C \atop Σ : σ ▷ ∃x.B, Γ ⟶ C} ∃L  {Σ, σ ⊢ t : γ  Σ : Γ ⟶ σ ▷ B[t/x] \atop Σ : Γ ⟶ σ ▷ ∃_{γ}x.B} ∃R
Σ : σ ▷ ⊥, Γ ⟶ B ⊥L  Σ : Γ ⟶ σ ▷ ⊤ ⊤R  {Σ : B, B, Γ ⟶ C \atop Σ : B, Γ ⟶ C} cL  {Σ : Γ ⟶ C \atop Σ : B, Γ ⟶ C} wL
Σ : σ ▷ B, Γ ⟶ σ ▷ B init {Σ : Δ ⟶ B  Σ : B, Γ ⟶ C \atop Σ : Δ, Γ ⟶ C} cut

Figure 2. The intuitionistic rules of F Oλ.

3. An intuitionistic logic with ∇

We now consider Gentzen’s LJ calculus [5] with the addition of global and local signatures and ∇. Besides this new quantifier, the other logical connectives are ⊥, ⊤, ∧, ∨, ⊃, ∀_{γ}, and ∃_{γ} (again, the type γ does not contain o) and their inference rules are given in Figure 2. Notice that no inference rule in Figure 2 requires non-empty local signatures: as a result, if all the local signatures in sequents in a derivation built from those rules are set to empty, the resulting derivation is a standard derivation in intuitionistic logic.

The interaction between the global and local signatures and the universal and existential quantifiers needs some explanations. In the rule for ∀L (and, dually, for ∃R), the quantifier appears in the scope of the global signature Σ and the local signature σ. This quantifier can be instantiated (reading the rule bottom-up) with a term built from variables in both of these signatures. Similarly, in the rule for ∀R (and, dually, for ∃L), the quantifier appears in the scope of the global signature Σ and the local signature σ. This quantifier can be instantiated (reading the rule bottomup) with an eigenvariable whose intended range is over all terms built from variables in Σ and σ. Since, however, the eigenvariable h is stored in the global scope, its dependency on σ would be forgotten unless we employ some particular encoding technique. For this purpose, we use raising [14]: to denote a variable of type γ_{0} that can range over some set of constants and over the variables in σ = (x_{1} : γ_{1}, …, x_{n} : γ_{n}) (n ≥ 0), we can use instead the term (hx_{1} … x_{n}) where the variable h ranges over the set of constants only (the dependency on σ can be forgotten). Of course, the type of h will be γ_{1} → ⋯ → γ_{n} → γ_{0} instead of simply γ_{0}. In the inference rules of Figure 2, we write (hσ) to denote (hx_{1} … x_{n}).

For the sake of consistency with a naming convention from the papers [8, 9], we shall refer to the inference system defined with just the rules in Figure 2 as F Oλ (mnemonic for a “first-order logic for λ-expressions”). The proof system resulting from the addition of the rules for ∇ (Figure 1) is called F Oλ^{∇}.

Below are some theorems of F Oλ^{∇} involving ∇. In these formulas, we use ¬C to abbreviate C ⊃ ⊥ and we write B ≡ C to denote (B ⊃ C) ∧ (C ⊃ B).

∇x¬Bx ≡ ¬∇xBx
∇x(Bx ∧ Cx) ≡ ∇xBx ∧ ∇xCx
∇x(Bx ∨ Cx) ≡ ∇xBx ∨ ∇xCx
∇x(Bx ⊃ Cx) ≡ ∇xBx ⊃ ∇xCx
∇x∀yBxy ≡ ∀h∇xBx(hx)
∇x∃yBxy ≡ ∃h∇xBx(hx)
∇x∀yBxy ⊃ ∀y∇xBxy
∇x.⊤ ≡ ⊤, ∇x.⊥ ≡ ⊥

As a result of these equivalences, ∇ can alway be given atomic scope within formulas (with the simple cost of raising the quantified variables in its scope).

Below are some non-theorems of F Oλ^{∇} involving ∇.

\begin{matrix}∇x∇yBxy ⊃ ∇zBzz & ∇xBx ⊃ ∃xBx \\ ∇zBzz ⊃ ∇x∇yBxy & ∇xBx ⊃ ∀xBx \\ ∀y∇xBxy ⊃ ∇x∀yBxy & ∃xBx ⊃ ∇xBx \\ ∇xB ≡ B & ∀xBx ⊃ ∇xBx \end{matrix}

4. Introduction rules for definitions

Introduction rules are, generally, restricted to logical connectives and quantifiers. The recent development of a proof theoretic notion of definitions [7, 24, 6, 9] provides left and right introduction rules also for non-logical predicate symbols, provided that they are “defined” in terms of other predicates appropriately. Given certain restrictions on the syntax of definitions, a proof system with such definition introduction rules can enjoy cut-elimination. In this section, we take the treatment of definitions from [8, 9] and extend it to handle local signatures.

Definition 1 A definitional clause is written ∀x̄[p t̄ =^{△} B], where p is a predicate constant, every free variable of the formula B is also free in at least one term in the list t̄ of terms, and all variables free in p t̄are contained in the list x̄ of variables. The atomic formula p t̄is called the head of the clause, and the formula B is called the body. The symbol =^{△} is used simply to indicate a definitional clause: it is not a logical connective. A definition is a (perhaps infinite) set of definitional clauses. The same predicate may occur in the head of multiple clauses of a definition: it is best to think of a definition as a mutually recursive definition of the predicates in the heads of the clauses.

Although predicates are defined via mutual recursion, circularities through implications (negations) must be avoided. To do this, we stratify definitions by first associating to each predicate p a natural number lvl(p), the level of p. The notion of level is generalized to formulas as follows.

Definition 2 Given a formula B, its level lvl(B) is defined as follows:

1. lvl(p t̄) = lvl(p)

2. lvl(⊥) = lvl(⊤) = 0

3. lvl(B ∧ C) = lvl(B ∨ C) = max(lvl(B), lvl(C))

4. lvl(B ⊃ C) = max(lvl(B) + 1, lvl(C))

5. lvl(∀x.B) = lvl(∇x.B) = lvl(∃x.B) = lvl(B).

We shall require that for every definitional clause ∀x̄[p t̄ =^{△} B], lvl(B) ≤ lvl(p). This requirement allows us to prove cut-elimination for F Oλ^{Δ∇} (see Section 5 and [9, 25]).

Introduction rules for defined atoms involve the use of substitutions. We recall some basic definitions related to substitutions. A substitution θ is a mapping (with application written in postfix notation) from variables to terms, such that the set {x | xθ ≠ x} is finite. Although substitutions are extended to mappings from terms to terms, generic judgments to generic judgments, etc, when we refer to the domain and the range of a substitution, we refer

{Σ : Γ ⟶ (σ ▷ B)θ \atop Σ : Γ ⟶ σ ▷ A} defR, where dfn(Σ, ϵ, σ ▷ A, θ, B)
{Σρ : (σ ▷ B)θ, Γρ ⟶ Cρ | dfn(Σ, ρ, σ ▷ A, θ, B)}

Σ : σ ▷ A, Γ ⟶ C defL

Figure 3. The de�nition introduction rules

to those sets defined on this most basic function. A substitution is extended to a function from terms to terms in the usual fashion. Composition of substitutions is defined as t(θ ∘ σ) = (tθ)σ, for all terms t. Two substitutions θ and σ are considered equal if for all variables x, xσ =_{η} xθ (equal modulo η-conversion). The empty substitution is written as ϵ. The application of a substitution θ to a generic judgment x_{1}, …, x_{n} ▷ B, written as (x_{1}, …, x_{n} ▷ B)θ, is x_{1}, …, x_{n} ▷ B′, if (λx_{1} … λx_{n}.B)θ is equal (modulo λconversion) to λx_{1} … λx_{n}.B′. If Γ is a multiset of generic judgments, then Γθ is the multiset {Jθ | J ∈ Γ}. Finally, if Σ is a signature then Σθ is the signature that results from removing from Σ the variables in the domain of θ and adding the variables that are free in the range of θ.

The following relation will be useful for the introduction rules for defined atoms.

Definition 3 The relation dfn(Σ, ρ, σ ▷ A, θ, B) holds for the formulas A and B, the substitutions ρ and θ, and the (disjoint) signatures Σ and σ whenever the following holds: the variables h_{1}, …, h_{n} are distinct from the variables in Σ and σ, the signature σ is the list of variables ȳ = y_{1}, …, y_{p} (p ≥ 0), the given definition contains a clause ∀x_{1}, …, x_{n}.[H′ =^{△} B′], the formulas B and H are “raised” versions of B′ and H′, that is,

B = B′[(h_{1} ȳ)/x_{1}, …, (h_{n} ȳ)/x_{n}]
H = H′[(h_{1} ȳ)/x_{1}, …, (h_{n} ȳ)/x_{n}]

and (λy_{1} ⋯ λy_{p}A)ρ = (λy_{1} ⋯ λy_{p}H)θ.

The right and left rules for atoms are given in Figure 3. Specifying a set of sequents as the premise should be understood to mean that each sequent in the set is a premise of the rule. Notice that in the defL rule, the free variables of the conclusion can be instantiated in the premises. In particular, a variable can possibly be removed from Σ and several new variables can be added.

These rules for definitions add considerable expressive power to intuitionistic logic. For example, defR is essentially the backchaining rule found in logic programming, while defL is essentially a case analysis on how an atom can be proved and can be used to establish finite failure. Together, these two rules can be used to encode simulation and bisimulation in certain abstract transition systems [11]. Other uses involve reasoning about computational system [10].

The proof system that arises from adding together the inference rules in Figures 2 and 3 is called F Oλ^{Δ}. If we add to F Oλ^{Δ} the rules in Figure 1, the resulting proof system is called F Oλ^{Δ∇} (pronounced “fold nabla”). It is this logic that will involve us for the remainder of this abstract.

5. The meta-theory of F Oλ^{Δ∇}

Of course, the main meta-theorem for F Oλ^{Δ∇} is cutelimination.

Proposition 4 Given a fixed stratified definition, a sequent has a proof in F Oλ^{Δ∇} if and only if it has a cut-free proof.

Proof Outline. The proof of cut-elimination for F Oλ^{ΔIN} [9] can be adapted to this setting. The F Oλ^{ΔIN} logic includes induction and hence the induction required to prove termination is much more complicated than is required for F Oλ^{Δ∇}, which does not incorporate induction. Here, an induction involving the heights of proofs works similarly to that done by Gentzen [5], with an additional measure involving the level of cut formulas. The stratification of definitions makes sure that the level of cut formulas decreases when permuting up cut over definition rules. Other aspects of the proof are similar. Central to the proof is the following substitution lemma about F Oλ^{Δ∇} proofs: if Σ : Γ ⟶ C has a proof and θ be a substitution, then there is a derivation of Σθ : Γθ ⟶ Cθ with the same or lesser height. A complete proof of cut elimination can be found in [25].

In certain situations, the difference between ∇ and ∀ cannot actually be observed. More specifically, consider the following restrictions on formulas and definitions. An hcgoal (named for Horn clauses) is a formula built from ⊤, ∧, ∨, and ∃. An hc^{∀}-goal is a formula built from ⊤, ∧, ∨, ∃, and ∀, while an hc^{∇}-goal is a formula built from ⊤, ∧, ∨, ∃, and ∇. A definition is an hc-definition (resp., hc^{∀}- definition and hc^{∇}-definition) if the body of all of its clauses are hc-goals (resp., hc^{∀}-goals and hc^{∇}-goals). Notice that all such definitions are trivially stratifiable. Numerous interesting computer science motivated specifications are examples of hc^{∀}-definitions: we consider in more detail two such examples in Sections 6 and 7. The proof of the following proposition follows by a simple induction on the structure of F Oλ^{Δ∇} proofs.

Proposition 5 Let D be an hc^{∀}-definition and let D′ be the hc^{∇}-definition resulting from replacing all occurrences of ∀ in the body of clauses of D with ∇. Similarly, let G be an hc^{∀}-goal and let G′ be the hc^{∇}-goal resulting from replacing all occurrences of ∀ in G with ∇. The sequent Σ : · ⟶ · ▷ G is provable using definition D if and only if the sequent · : · ⟶ Σ ▷ G′ is provable using definition D′.

As a consequence of this proposition, the difference between ∀ and ∇ (or, equivalently, between the global and local signatures of a sequent) cannot be seen if one is simply attempting to “evaluate” hc^{∀} logical programs by determining the goals that they can prove. A difference between these two quantifiers only starts to appear (for hc^{∀}- definitions) if more interesting goals are considered: for example, in Section 6, we illustrate the differences between ∀ and ∇ with the specification of simulation and bisimulation in the π-calculus.

A natural question to ask about ∇, in relation to its role as local binder, is whether the relative orders among consecutive ∇’s matters, or more precisely, whether the formula

∇y∇xBxy ⊃ ∇x∇yBxy

is provable in F Oλ^{Δ∇}. Of course, this formula is not provable in the logic without definitions. Consider the following Definition and Proposition.

Definition 6 A definition D is noetherian if for every definition clause ∀x̄.[pt̄ =^{△} B] in D, it holds that lvl(p) > lvl(B).

Proposition 7 Given a noetherian definition, the sequent Σ : Γ, σ ▷ B ⟶ σ′ ▷ B, where σ′ is a permutation of σ, is provable in F Oλ^{Δ∇}.

Proof By induction on the level of B with subordinate induction on the size of B. In the case where B is an atomic formula, we apply defL followed by defR. Since the definition is noetherian, we always get formulas of lower level as a result. A detailed proof can be found in [25].

Thus, for noetherian definitions, ∇’s can be interchanged. We conjecture that this is also true for nonnoetherian definitions as well.

6. Example: the π-calculus

Operational semantics of specification languages or programming languages is often given using inference rules, following the small-step approach (a.k.a., structured operational semantic) or big-step approach (a.k.a. natural semantics). Frequently, the specification of such semantics requires new symbols to be created to be used for such things as nonces in security protocols [1], locations for reference cells [2, 16], or new communication channels [19]. Given the logic F Oλ^{Δ∇}, we now have the ability to scope variables within sequents either globally via ∀ or locally via ∇. We illustrate these choices with a specification of the π-calculus.

\overline{τ.P ⟶^{τ} P} τ  \frac{P ⟶^{A} Q}{[x = x]P ⟶^{A} Q}match  \frac{P −⇀^{A} Q}{[x = x]P −⇀^{A} Q}match

\frac{P ⟶^{A} R}{P + Q ⟶^{A} R}sum \frac{Q ⟶^{A} R}{P + Q ⟶^{A} R}sum  \frac{P −⇀^{A} R}{P + Q −⇀^{A} R}sum \frac{Q −⇀^{A} R}{P + Q −⇀^{A} R}sum

\frac{P ⟶^{A} P′}{P | Q ⟶^{A} P′ | Q}par  \frac{Q ⟶^{A} Q′}{P | Q ⟶^{A} P | Q′} par  \frac{P −⇀^{A} M}{P | Q −⇀^{A} λn(Mn | Q)}par  \frac{Q −⇀^{A} N}{P | Q −⇀^{A} λn(P | Nn)}par

\frac{∇n(P n ⟶^{A} P′n)}{νn.P n ⟶^{A} νn.P′n}res  \frac{∇n(P n −⇀^{A} P′n)}{νn.P n −⇀^{A} λm νn.(P′nm)}res  \frac{∇y(My ⟶^{↑xy} M′y)}{νy.My −⇀^{↑x} M′} open

\overline{out x y P ⟶^{↑xy} P} output  \frac{P −⇀^{↓x} M  Q −⇀^{↑x} N}{P | Q ⟶^{τ} νn.(Mn | Nn)} close  \frac{P −⇀^{↑x} M  Q −⇀^{↓x} N}{P | Q ⟶^{τ} νn.(Mn | Nn)} close

\overline{in x M −⇀^{↓x} M} input  \frac{P −⇀^{↓x} M  Q ⟶^{↑xy} Q′}{P | Q ⟶^{τ} (My) | Q′} com  \frac{P ⟶^{↑xy} P′  Q −⇀^{↓x} N}{P | Q ⟶^{τ} P′ | (Ny)} com

Figure 4. The rules for the (late) π-calculus.

Consider encoding π-calculus [19] using higher-order abstract syntax following [17, 18]. Since we are focused here on abstractions in syntax, we shall deal with only finite π-calculus expression, that is, expressions without ! or defined constants. Extending this work to infinite process expressions should be possible by adding induction (as in [11]) or co-induction to our proof system. We shall require three primitive syntactic categories: n for channels, p for processes, and a for actions. The output prefix is the constructor out of type n → n → p → p and the input prefix is the constructor in of type n → (n → p) → p: the πcalculus expressions x̄y.P and x(y).P are represented as (out x y P) and (in x λy.P), respectively. We use | and +, both of type p → p → p and written as infix, to denote parallel composition and summation, and ν of type (n → p) → p to denote restriction. The π-calculus expression (x)P will be encoded as νλn.P, which itself is abbreviated as simply νx.P. The match operator, [· = ·]· is of type n → n → p → p. When τ is written as a prefix, it has type p → p. When τ is written as an action, it has type a. The symbols ↓ and ↑, both of type n → n → a, denote the input and output actions, respectively, on a named channel with a named value: e.g., ↓ xy denotes the action of inputting y on channel x.

We use two predicates to encode the one-step transition semantics for the π-calculus. The predicate · ⟶^{·} · of type p → a → p → o encodes transitions involving free values and the predicate · −⇀^{·} · of type p → (n → a) → (n → p) → o encodes transitions involving bound values. Figure 4 (taken from [18]) contains the inference rules specifying the late version of the transitions for the π-calculus [19]. In these rules, capital letters (possibly primed) are used to denote schema variables for inference rules: these schema variables have primitive types such as a, n, and p as well as functional types such as n → a and n → p. These inference rules can trivially be written as definition clauses: a few such clauses are presented in Figure 5. Here, schema variables are universally quantified (implicitly) at the top-level of such clauses. Notice that the complicated side conditions in the original specification of π-calculus are not present here as they are now part of the meta-logic. For example, the side condition that x ≠ y in the open rule is handled by using two different quantifier scopes for x and y and the rule of logic that substitutions cannot capture bound variables.

Let L be the complete definition for the one step transition for the π-calculus. Clearly, L is an hc^{∇}-definition. Let let L′ be the result of replacing all occurrences of ∇ in L with ∀. Furthermore, let L′′ be the result of replacing all occurrences of the symbol =^{△} in the clauses of L′ by reverse implication: thus, L′′ is a set of formulas and is not a definition. If we are interested in only computing the one-step transitions of the late π-calculus, that is, proving the atomic

formulas P ⟶^{A} P′ or P −⇀^{A} P′, then the following observations are easy to establish. Let B range over atomic formulas. Proposition 5 implies that · : · ⟶ B is provable in F Oλ^{Δ∇} using definition L if and only if · : · ⟶ B

\begin{matrix}νn.P n ⟶^{A} νn.Qn & =^{△} & ∇n(P n ⟶^{A} Qn) \\ νy.P y −⇀^{↑X} Q & =^{△} & ∇y(P y ⟶^{↑Xy} Qy) \\ in X M −⇀^{↓X} M & =^{△} & ⊤ \\ P | Q ⟶^{τ} S | (T Y) & =^{△} & ∃X.P ⟶^{↑XY} S ∧ Q −⇀^{↓X} T \end{matrix}

Figure 5. Corresponding de�nition clauses

simP Q =^{△} ∀A∀P′ \begin{matrix}[(P ⟶^{A} P′) ⊃ ∃Q′.(Q ⟶^{A} Q′) \\ ∧ sim P′ Q′] ∧ \end{matrix} ∀X∀P′ \begin{matrix}[(P −⇀^{↓X} P′) ⊃ ∃Q′.(Q −⇀^{↓X} Q′) \\ ∧ ∀w.sim (P′w) (Q′w)] ∧ \end{matrix} ∀X∀P′ \begin{matrix}[(P −⇀^{↑X} P′) ⊃ ∃Q′.(Q −⇀^{↑X} Q′) \\ ∧ ∇w.sim (P′w) (Q′w)] \end{matrix}

Figure 6. De�nition of π-calculus simulation

is provable in F Oλ^{Δ} using definition L′. Furthermore, a cut-free proof of · : · ⟶ B in F Oλ^{Δ} using definition L′ does not contain occurrences of defL, and, as a result, the definition mechanism itself can be replaced: the sequent · : · ⟶ B is provable in F Oλ^{Δ} with the definition L′ if and only if the sequent Σ : L′′ ⟶ B is provable in F Oλ.

Thus, only standard logic programming (such as in λProlog) is needed to compute the one-step transitions of the π-calculus, and ∇ and definitions do not add expressive power. To see what expressive power is contributed by both ∇ and definitions in a proof system, consider the problem of computing the relationship of simulation for the π-calculus. (For simplicity, we shall consider only simulation and not bisimulation: extending to bisimulation is not difficult but does introduce several more cases and make our examples more difficult to read.)

To illustrate how ∇ and ∀ in the body of this definition clause differ, consider following four π-calculus expressions. (Here we are using the usual abbreviations: when the name, say z is used as a prefix, it denotes the prefix z(w) where w is vacuous in its scope; when the name, z̄ is used as a prefix, it denotes the prefix z̄a, where a is some fixed value; the expression x̄(y).P abbreviates (y)x̄y.P; and when a prefix is written without a continuation, the continuation 0 is assumed. Thus, for example, ȳ | z denotes ȳa.0 | z(w).0.)

\begin{matrix}P_{1} = x(y).(ȳ | z) & P_{2} = x(y).((ȳ.z) + (z.ȳ)) \\ P_{3} = x̄(y).(ȳ | z) & P_{4} = x̄(y).((ȳ.z) + (z.ȳ)) \end{matrix}

The process P_{2} is simulated by P_{1} but the converse is not true since after P_{1} preforms an (↓ xz), it is possible for the resulting process to take a τ step. The sequence of actions (↓ xz) and τ is not possible with P_{2}. The processes P_{3} and P_{4} do, however, simulate each other (they are, in fact, bisimilar). The only difference between these pairs of processes is, of course, that the first is prefixed with a bounded input prefix while the second is prefixed with a bounded output prefix. These different bounded prefixes are handled in the simulation definition in Figure 6 using, in one case, ∀ and the other case ∇.

For example, consider proving the sequent

· : · ⟶ sim (x(y).(ȳ | z)) (x(y).((ȳ.z) + (z.ȳ))),

which, as we discussed above, should fail. (For readability, we shall use π-calculus syntax directly instead of the abstract syntax on which the actual logic is based.) The free names x and z are interpreted as meta-level constants. The attempt to prove this sequent reduces (via defR, ∀ and ⊃ R) to needing to prove the three sequents (1-3) in Figure 7. A simple argument about the permutabilities of inference rules [9] shows that if a sequent with an atom on the left has a proof, it has a proof with an instance of the defL rule that introduces that atom. Thus, we can conclude that sequents (1) and (3) are trivially provable since the required unification problem in defL fails for all clauses in the definition. The second sequent is the consequence of a non-trivial occurrence of the defL rule, giving rise to the need to prove sequent (4) in Figure 7 (here, the variable N is instantiated to x and P′ is instantiated to λy.(ȳ | z)). Proving this requires making the appropriate substitution for Q′ (obvious) and then proving the sequent

· : · ⟶ ∀w.sim (w̄ | z) ((w̄.z) + (z.w̄))

Similarly to our first step, proving this reduces to the three sequents (5), (6), and (7). Applying defL rule to sequents (6) and (7) produces one premise for each case, which eventually leads to proving the sequents w, u : · ⟶ sim w̄ w̄ and · : · ⟶ u▷sim z z; both are trivially provable. A proof of (5) using defL has two premises: one with A instantiated to τ, w to z, and P′ to 0 | 0, and one with A instantiated to ↑ wa and P′ to 0|z (w is not instantiated). The first of these premise sequents is the sequent

· : · ⟶ ∃Q′[((z̄.z) + (z.z̄)) ⟶^{τ} Q′ ∧ sim (0 | 0) Q′]

This is not provable since there is no τ transition from ((z̄.z) + (z.z̄)). As a result, since this sequent is not provable we may conclude that the original sequent is not provable. The reason for this failure is also clear from this attempt of a proof construction: although both P_{1} and P_{2} make an initial input step, the first of the resulting pair of processes can make a τ step but the second cannot.

Turning to the case of expressions P_{3} and P_{4}, consider proving the sequent

· : · ⟶ sim (x̄(y).(ȳ | z)) (x̄(y).((ȳ.z) + (z.ȳ))),

A, P′ : (x(y).(ȳ | z)) ⟶^{A} P′ ⟶ ∃Q′[(x(y).((ȳ.z) + (z.ȳ))) ⟶^{A} Q′ ∧ sim P′ Q′]  (1)
N, P′ : (x(y).(ȳ | z)) −⇀^{↓N} P′ ⟶ ∃Q′[(x(y).((ȳ.z) + (z.ȳ))) −⇀^{↓N} Q′ ∧ ∀w.sim (P′w) (Q′w)]  (2)
N, P′ : (x(y).(ȳ | z)) −⇀^{↑N} P′ ⟶ ∃Q′[(x(y).((ȳ.z) + (z.ȳ))) −⇀^{↑N} Q′ ∧ ∇x.sim (P′x) (Q′x)]  (3)
· : · ⟶ ∃Q′[(x(y).((ȳ.z) + (z.ȳ))) −⇀^{↓x} Q′ ∧ ∀w.sim (w̄ | z) (Q′w)]  (4)
w, A, P′ : (w̄ | z) ⟶^{A} P′ ⟶ ∃Q′[((w̄.z) + (z.w̄)) ⟶^{A} Q′ ∧ sim P′ Q′]  (5)
w, N, P′ : (w̄ | z) −⇀^{↓N} P′ ⟶ ∃Q′[((w̄.z) + (z.w̄)) −⇀^{↓N} Q′ ∧ ∀u.sim (P′u) (Q′u)]  (6)
w, N, P′ : (w̄ | z) −⇀^{↑N} P′ ⟶ ∃Q′[((w̄.z) + (z.w̄)) −⇀^{↑N} Q′ ∧ ∇u.sim (P′u) (Q′u)]  (7)
· : · ⟶ ∃Q′[(x̄(y).((ȳ.z) + (z.ȳ))) −⇀^{↑x} Q′ ∧ ∇w.sim (w̄ | z) (Q′w)]  (4′)
A, P′ : w ▷ (w̄ | z) ⟶^{(Aw)} (P′w) ⟶ w ▷ ∃Q′[((w̄.z) + (z.w̄)) ⟶^{(Aw)} Q′ ∧ sim (P′w) Q′]  (5′)
N, P′ : w ▷ (w̄ | z) −⇀^{↓(Nw)} (P′w) ⟶ w ▷ ∃Q′[((w̄.z) + (z.w̄)) −⇀^{↓(Nw)} Q′ ∧ ∀u.sim (P′wu) (Q′u)]  (6′)
N, P′ : w ▷ (w̄ | z) −⇀^{↑(Nw)} (P′w) ⟶ w ▷ ∃Q′[((w̄.z) + (z.w̄)) −⇀^{↑(Nw)} Q′ ∧ ∇u.sim (P′wu) (Q′u)]  (7′)

Figure 7. Some sequents

which, as we discussed above, should succeed. A proof attempt of this sequent proceeds similar to the previous example, yielding the sequent (4′) in Figure 7. Proving this reduces to the three sequents (5′), (6′), and (7′): notice that w is not given global scope in the sequents but local scope and that the eigenvariables (A, P′, and N′) are raised with respect to their counterparts in (5), (6), and (7)). Sequents (6′) and (7′) are proved as in (6) and (7). In this case, however, a proof of (5′) using defL has exactly one premise, where A instantiated to λw. ↑ wa and P′ to λw.0 | z. The resulting sequent is

· : · ⟶ w ▷ ∃Q′[((w̄.z) + (z.w̄)) ⟶^{↑wa} Q′ ∧ sim (0 | z) Q′]

This sequent, like all the remaining ones in this proof attempt, now have a simple proof.

Notice that although we have now encountered higherorder unification problems and higher-order substitutions, the unification problems generated from this particular example fall within the higher-order pattern unification or L_{λ} unification problems [13, 21]. This subset of the unification of simply typed λ-terms has complexity similar to that of first-order unification: it is decidable (in linear time) and has most general unifiers when unifiers exist. Proof search for a sequent that starts out with first-order quantification will remain “essentially” first-order, even though raising introduces variables of higher-order type.

The encoding of π-calculus above can also be extended to include the mismatch operator by using negation.

\begin{matrix}(x = y) ⊃ ⊥ & P ⟶^{A} Q \\ [x ≠ y]P ⟶^{A} Q \end{matrix} mismatch

Operationally, mismatch is modeled as failure of unification at the logic level. Notice that the resulting definition is not Horn anymore since we have an implication in the body of the clause representing the above inference rule. As a consequence, Proposition 5 is not applicable to this definition.

7. Example: an object-logic encoding

Consider the problem of proving the formula

∀u∀v[q ⟨u, t_{1}⟩ ⟨v, t_{2}⟩ ⟨v, t_{3}⟩],

where q is a three place predicate, ⟨·, ·⟩ is used to form pairs, t_{1} and t_{2} are some first-order terms, and the only assumptions for the predicate q are the (universal closure of the) three atomic formulas: q X X Y, q X Y X and q Y X X. Clearly, this query succeeds only if terms t_{2} and t_{3} are equal [18]. One natural way to formalizing this reasoning involves first encoding provability of an object-level first-order logic in F Oλ^{Δ∇} and then to reason directly on this encoding. Let obj be the type of object-level formulas and let the object-level logic constants be: ˆ⊤ of type obj, & and ⇒ of type obj → obj → obj, and ˆ∀ and ˆ∃ be the quantifiers at type (i → obj) → obj (for some fixed type i ranging over first-order object-level terms). To encode provability, we use four predicates: pv · of type obj → o encodes first-order provability, bc(·, ·) of type obj → obj → o encodes “backchaining”, atom · describes object-level atomic formulas, and prog · describes object-level logic programs clauses. Figure 8 presents an encoding of provability for a first-order logic programming language that is restricted to hc^{∀}. Figure 9 contains such additional clauses for the example we are considering here.

Notice that while the object-level logic here is hc^{∀} (since

pv ˆ⊤ =^{△} ⊤
pv (G & G′) =^{△} pv G ∧ pv G′
pv (ˆ∀ G) =^{△} ∇x.pv (Gx)
pv (ˆ∃ G) =^{△} ∃x.pv (Gx)
pv A =^{△} ∃D.atom A ∧ prog D ∧ bc(D, A)
bc(A, A) =^{△} atom A
bc(G ⇒ D, A) =^{△} bc(D, A) ∧ pv G
bc(ˆ∀ D, A) =^{△} ∃t. bc(D t, A)

Figure 8. Interpreter for an object-level logic.

X = X =^{△} ⊤
atom (q X Y Z) =^{△} ⊤
prog (ˆ∀ X ˆ∀ Y q X X Y) =^{△} ⊤
prog (ˆ∀ X ˆ∀ Y q X Y X) =^{△} ⊤
prog (ˆ∀ X ˆ∀ Y q Y X X) =^{△} ⊤

Figure 9. Additional de�nition clauses.

we are concerned with the provability of a universally quantified formula), the meta-level definition is hc^{∇}.

The query that captures our intended example is the following formula

∀x, y, z[pv (ˆ∀ u ˆ∀ v[q ⟨u, x⟩ ⟨v, y⟩ ⟨v, z⟩]) ⊃ y = z]

along with the definition consisting of the clauses in Figures 8 and 9. Attempting a proof of this formula leads to the following sequent (after applying some right rules and a pair of defL and ∇L rules):

X, Y, Z : (s, r) ▷ pv (q ⟨s, X⟩ ⟨r, Y ⟩ ⟨r, Z⟩) ⟶ ▷Y = Z.

A series of defL rules will now need to be applied in order to work through the encoding for the object-level interpreter. In the end, three separate unification problems will be attempted, one for each of the three ways to prove the predicate q. In particular, the defL rule will attempt to unify the term λsλr.(q ⟨s, X⟩ ⟨r, Y ⟩ ⟨r, Z⟩) with each of the following three terms:

λsλr.(q (X′ s r) (X′ s r) (Y′ s r)) λsλr.(q (X′ s r) (Y′ s r) (X′ s r)) λsλr.(q (Y′ s r) (X′ s r) (X′ s r))

The first two unification problems fail and hence the corresponding occurrences of defL succeed. The third of these unification problems is solvable, however, with X′ instantiated to λsλr.⟨r, Z⟩, Y′ instantiated to λsλr.⟨s, Z⟩, Y instantiated to Z (or vice versa), and X uninstantiated. As a result, this third premise is the sequent · : · ⟶ Y = Y, which is provable using defR.

The more common approach to encoding object-logic provability into a meta-logic uses the meta-level universal quantifier instead of the ∇ for the clause encoding the provability of object-level universal quantification: that is, the clause

pv (ˆ∀ x.G x) =^{△} ∀x[pv (G x)].

is used instead. In this case, attempting a proof of this formula reduces to an attempt to prove the sequent

X, Y, Z : ▷pv (q ⟨s_{1}, X⟩ ⟨s_{2}, Y ⟩ ⟨r, Z⟩) ⟶ ▷Y = Z,

and were s_{1} and s_{2} are two terms. To complete the proof, these two terms must be chosen to be different. While this sequent can be proved, doing so requires the assumption that there are two such terms (the domain is non-empty and not a singleton). Our encoding using ∇ allows this (metalevel) proof to be completed in a more natural way without this assumption.

8. Related work and conclusion

We have maintained the approach to specification in which meta-level and proof-level abstractions are used to encode abstractions both of the static structure of expressions (e.g., using meta-level λ-abstractions to encode the input prefix in the π-calculus) and the dynamic structure of computation (e.g., name generation as eigenvariables). While this style of syntactic representation has been successfully used to enumerate judgments about operational semantics and to encode object-logic provability, proof level abstractions (eigenvariables) seem inadequate when one wishes to reason about computation directly (as outlined in Section 1). Since this style of syntactic representation is best understood declaratively within proof theory, we have explored a simple mechanism within sequent calculus to expand the notion of abstraction in the building of proofs. In [18], we provided some experiments in specification that this paper attempts to formalize using proof theory.

It is natural to ask about possible connections between the ∇-quantifier here and the new quantifier of Pitts and Gabbay [4, 23]. Both are self dual and both have similar sets of applications in mind. There are significant differences, however: ∇ has a natural proof theory with a cut-elimination theorem but has no set theoretic semantics, while Pitts and Gabbay have a model theory based on set theory but no cut-elimination result. While ∇ neither implies nor is implied by ∀ or ∃, the quantifier of Pitts and Gabbay is entailed by ∀ and entails ∃.

To work with larger examples than those shown here, one needs an implementation of F Oλ^{Δ∇}. The Isabelle theorem prover should provide a promising setting for building an interactive theorem prover given the work reported in [20]. A natural next step is to attempt adding directly to F Oλ^{Δ∇} induction and co-induction: induction should work much as it does in F Oλ^{ΔIN} [9]. Some related work on co-induction appears in [20].

Acknowledgments The authors wish to thank Catuscia Palamidessi for valuable discussions regarding our πcalculus examples. We would also like to thank the anonymous reviewers of this paper for their helpful suggestions on an earlier draft of this paper. This work has been supported in part by NSF grants CCR-9912387, INT-9815645, and INT-9815731. The second author gratefully acknowledges support from LIX at École polytechnique.

References

[1] I. Cervesato, N. A. Durgin, P. D. Lincoln, J. C. Mitchell, and A. Scedrov. A meta-notation for protocol analysis. In R. Gorrieri, editor, Proceedings of the 12th IEEE Computer Security Foundations Workshop — CSFW’99, pages 55–69, Mordano, Italy, 28–30 June 1999. IEEE Computer Society Press.

[2] J. Chirimar. Proof Theoretic Approach to Specification Languages. PhD thesis, University of Pennsylvania, February 1995.

[3] A. Church. A formulation of the simple theory of types. Journal of Symbolic Logic, 5:56–68, 1940.

[4] M. J. Gabbay and A. M. Pitts. A new approach to abstract syntax with variable binding. Formal Aspects of Computing, 13:341–363, 2001.

[5] G. Gentzen. Investigations into logical deductions. In M. E. Szabo, editor, The Collected Papers of Gerhard Gentzen, pages 68–131. North-Holland Publishing Co., Amsterdam, 1969.

[6] J.-Y. Girard. A fixpoint theorem in linear logic. Email to the linear@cs.stanford.edu mailing list, February 1992.

[7] L. Hallnäs and P. Schroeder-Heister. A proof-theoretic approach to logic programming. ii. Programs as definitions. Journal of Logic and Computation, 1(5):635–660, October 1991.

[8] R. McDowell. Reasoning in a Logic with Definitions and Induction. PhD thesis, University of Pennsylvania, December 1997.

[9] R. McDowell and D. Miller. Cut-elimination for a logic with definitions and induction. Theoretical Computer Science, 232:91–119, 2000.

[10] R. McDowell and D. Miller. Reasoning with higher-order abstract syntax in a logical framework. ACM Transactions on Computational Logic, 3(1):80–136, January 2002.

[11] R. McDowell, D. Miller, and C. Palamidessi. Encoding transition systems in sequent calculus. Theoretical Computer Science, 294(3):411-437, 2003.

[12] D. Miller. Lexical scoping as universal quantification. In Sixth International Logic Programming Conference, pages 268–283, Lisbon, Portugal, June 1989. MIT Press.

[13] D. Miller. A logic programming language with lambdaabstraction, function variables, and simple unification. Journal of Logic and Computation, 1(4):497–536, 1991.

[14] D. Miller. Unification under a mixed prefix. Journal of Symbolic Computation, pages 321–358, 1992.

[15] D. Miller. The π-calculus as a theory in linear logic: Preliminary results. In E. Lamma and P. Mello, editors, Proceedings of the 1992 Workshop on Extensions to Logic Programming, number 660 in LNCS, pages 242–265. Springer-Verlag, 1993.

[16] D. Miller. Forum: A multiple-conclusion specification language. Theoretical Computer Science, 165(1):201–232, Sept. 1996.

[17] D. Miller and C. Palamidessi. Foundational aspects of syntax. In P. Degano, R. Gorrieri, A. Marchetti-Spaccamela, and P. Wegner, editors, ACM Computing Surveys Symposium on Theoretical Computer Science: A Perspective, volume 31. ACM, Sep 1999.

[18] D. Miller and A. Tiu. Encoding generic judgments. In Proceedings of FSTTCS, number 2556 in LNCS, pages 18–32, December 2002.

[19] R. Milner, J. Parrow, and D. Walker. A calculus of mobile processes, Part I. Information and Computation, pages 1– 40, September 1992.

[20] A. Momigliano, S. Ambler, and R. Crole. A hybrid encoding of Howe’s method for establishing congruence of bisimilarity. In LFM’02, volume 70.2 of ENTCS, 2002.

[21] T. Nipkow. Functional unification of higher-order patterns. In M. Vardi, editor, LICS93, pages 64–74. IEEE, June 1993.

[22] F. Pfenning and C. Elliott. Higher-order abstract syntax, In Proceedings of the ACM-SIGPLAN Conference on Programming Language Design and Implementation, ACM Press, pages 199–208, June 1988.

[23] A. M. Pitts. Nominal logic, a first order theory of names and binding. Information and Computation. To appear. (A preliminary version appeared in the Proceedings of the 4th International Symposium on Theoretical Aspects of Computer Software (TACS 2001), LNCS 2215, Springer-Verlag, 2001, pp 219–242.).

[24] P. Schroeder-Heister. Cut-elimination in logics with definitional reflection. In D. Pearce and H. Wansing, editors, Nonclassical Logics and Information Processing, volume 619 of LNCS, pages 146–171. Springer, 1992.

[25] A. Tiu. Cut-elimination for a logic with generic judgments. April 2003. Draft available via

http://www.cse.psu.edu/~tiu/foldn2.pdf.