Contents

1

1.1
1.2
1.3
1.4
1.5
1.6
1.6

2

2.1
2.2
2.3

2.4

2.5
2.6

3

3.1

Series Foreword
Prefacexiii
xv

Introduction
What is PX?
PX as a logic of computation
PX as a program extractor
PX as a classical logic
PX as a foundation of type theory
The origin of PX

DEF system: recursive functions over symbolic expressions
The language of PX
Basic axiom system: the logic of partial terms
2.3.1 -expression and -convertibility
2.3.2 Axioms for programs and primitive predicates
2.3.3 Rules for the usual logical symbols
2.3.4 Rules for r and !
2.3.5 Axioms for the modal operator
2.3.6 Miscellaneous axioms
Classes: data types as objects
2.4.1 CIG: conditional inductive generation
2.4.2 Axioms of Join and Product2.4.3 Graph and value class: the minimal graph axiom
Choice rule
Remarks on the axiom system
2.6.1 The logic of partial terms versus the logic of partial existence
2.6.2 Transparency of classes
2.6.3 Total variables versus partial variables

1
1
2
2
4
4
5
6
8
8
15
19
20
22
26
28
32
33
35
35
45
46
50
50
50
51
52

Realizability
px-realizability

54
54

Overview

Formal System

Contents

3.2

A re ned px-realizability

63

4

Writing programs via proofs
How to extract programs with PX
Curry-Howard isomorphism in PX

4.4
4.5
4.6

CIG recursion
4.3.1 De nition of CIG recursion
4.3.2 Examples of CIG recursion
4.3.2.1 Quotient and remainder
4.3.2.2 Maximal element in an integer list
4.3.2.3 The Ackermann function
4.3.2.4 A function whose termination is unknown
4.3.2.5 Searching for a prime number
4.3.2.6 The Chinese remainder theorem
PX is extensionally complete
Trans nite induction
Simulating Hoare logic

71
71
72
75
76
77
77
80
82
83
84
86
89
93
97

5

4.1
4.2
4.3

5.1
5.2

PX as a foundation of type theories

A view of \dependent sums as types of module implementations"Type polymorphism and an impredicative extension of PX

105
105
108

6

Semantics

6.4

Semantics of computation
Tarskian semantics of formulas
Semantics of classes
6.3.1 The restricted model
6.3.2 The full model
6.3.3 The model of the impredicative extension
Satis cation of MGA

115
115
125
127
128
130
131
133

7

Implementing PX

135
135

6.1
6.2
6.3

7.1

Hypotheses

Contents

7.2

Proof checker
7.2.1 Formulas
7.2.2 Proofs
7.2.3 Top level and commands
7.2.4 Inference rules
7.2.5 Inference macros
7.2.6 PX evaluator and declarations
Extractor
EKL translator
7.4.1 Interpreting LPT of PX in typed language of EKL
7.4.2 Translating expressions and functions
7.4.3 Translating formulas
7.4.4 Translating axiom system
7.4.5 How to call EKL from PX

137
137
140
140
144
145
147
153
154
155
155
158
160
161

8

Conclusion

What was done?
What is missed? What should be done?

163
163
163

A
B
C

Comparison of px-realizability and other interpretations
Extraction of a tautology checker of propositional logic
Optimizers

165
169
189

References

191

Index

197

7.3
7.4

8.1
8.2

Preface
This book describes a computational logic PX (Program eXtractor). PX is aconstructive logic about computation. The aims of PX are to verify programs,
extract programs from constructive proofs, and give foundations to type theories.
It is well known that programs can be extracted from constructive proofs, but
it has not been fully demonstrated how this is actually done, although there areinteresting works on the subject. The PX project was launched to provide a rigid
logical framework and its computer implementation, which enables us to develop
methodologies and a theory of program extraction through computer experiments.
This book gives a precise description of the formal theory of PX, its semantics, themathematical foundation of program extraction via PX, and some methodologies
and their theories of program extraction. We also describe its implementation andcomputer experiments using it.
In the last two decades, metamathematical investigations of constructive
logic have made great progress, e.g., Girard's work on higher order constructive
logic (Girard 1972), categorical logic, some formal theories developed to formalize
Bishop's constructive analysis(Bishop 1967), and the associated metamathematical studies. (See Troelstra 1973, Beeson 1985, Lambek and Scott 1986, and articles
in Barwise 1977.) The design of the logical system of PX is based on Feferman's
theory of functions and classes developed to formalize Bishop's constructive analysis. Martin-Lof's type theory (Martin-Lof 1982) was developed for the same
reason. Although these two have much in common, a basic di erence exists. Feferman's theory is a type free theory and so is PX. \Typed or type free" is acontroversial issue in programming languages. But in applications of constructive
logic to programming, only typed theories have received attention. For example,
Constable's group has implemented a Nuprl proof development system taking
Martin-Lof's system as its foundation (Constable et al. 1986), and Coquand andHuet designed a theory of construction, which is an extension of Girard-Reynolds
type theory (Coquand and Huet 1986). By presenting type free counterparts, wehope to contribute this active area. We wish to show how Feferman's type freetheory serves as a logical foundation of programming.
When I was at Tsukuba University, the basic idea of applying Feferman's
theory to programming came to me and the predecessors of PX were designed(Hayashi 1983). I began the design and implementation of the core of PX when I
was at Metropolitan College of Technology in Tokyo. Early implementation was
done on VAXTM /UNIXTM at the Computer Center of the University of Tokyo.
The project was continued after I moved to Kyoto University, and later Hiroshi
Nakano joined the project. We jointly designed the EKL-translator and inference
macros, and he implemented them. He also designed and implemented the prettyprinter and corrected a number of errors in my programs. For this book, Nakano
has written the section on the EKL-translator, and the part of the proofs ofPreface

hypotheses by EKL in appendix B.
Many people helped me in the course of the PX project. I give thanks
to them all here, but I especially thank Prof. Michael J. Beeson, Prof. Solomon
Feferman, Dr. Gerard Huet, Prof. Takayasu Ito, Dr. Jussi Ketonen, Zhaohui Luo,Prof. Per Martin-Lof, Dr. Eugenio Moggi, Christine Paulin-Mohring, Dr. Gerard
R. Renardel de Lavelette, Prof. Masahiko Sato, Prof. Dana Scott, Dr. Natarajan
Shankar, Prof. Satoru Takasu, Dr. Carolyn Talcott, and members of CAP projectof ICOT, for their interests in the project and/or helpful discussions, some of whichin uenced the design of PX and this book. I thank Prof. Mike O'Donnell, Prof.
Solomon Feferman, James Harland, Dr. Tetsuo Ida, Prof. Takayasu Ito, Dan
Pehoushek, Randy Pollak, Dr. Carolyn Talcott, and Prof. Mariko Yasugi for
their helpful comments on and criticisms of the manuscript. I thank Japan IBM
for its nancial support to enable me to present a summary paper at a meetingof IFIP WG2.2, and thank The University of Texas, Austin and Dr. G. Huet for
inviting me to lecture on PX at The Institute on Logical Foundations of Functional
Programming. I also thank the Japanese Ministry of Education (Monbushyo) for
supporting this work by a grant. I thank the Department of Computer Science of
The University of Edinburgh, the Formel project of INRIA, and the Departmentof Computer Science of Stanford University for providing me with the facilities tonish the manuscript of this book. Finally, I especially thank Prof. Albert Meyer
and Prof. Takayasu Ito for helping and encouraging me to publish this book.
S. Hayashi
Edinburgh
May 1988

1 Introduction
1.1. What is PX?
PX is a constructive logic for computation based on a constructive formal theory

T0 (Feferman 1979). It is a type free logic which formalizes a dialect of pure
Lisp. It has rigorous axioms for functional arguments, although it does not allow
a reasoning about destructive programs. PX has a logic by which one can reason
about the termination of programs.
PX has a very large family of data types. The family of data types is muchlarger than the data types used in the conventional programming languages sothat it includes the types in Martin-Lof's sense (except the universes).
PX is a system which realizes the idea of \proofs as programs". Whenan existence theorem is proved constructively, PX extracts a Lisp program thatcomputes a solution. The correctness of the program is certi ed by a rigorous
logical interpretation called px-realizability. Program extraction is the main aim
of PX as the name stands for Program eXtractor.
PX is designed to be compatible with classical logic as far as possible. PX
provides a way to separate out a \termination proof" in existence theorems. Termination may be proved classically. Programs can be extracted before \termination" is proved. This technique enables us to interpret Hoare logic in PX and toprove a relative completeness result.
PX's logic has rigorous mathematical semantics which is compatible withclassical mathematics. The semantics guarantees that the solution computed by
the extracted program from an existence proof meets the property in the senseof classical mathematics. The semantics guarantees that the extracted function
may be run on an ordinary Lisp system insofar as it terminates on the intended
domains of inputs. PX can translate the termination problem and some otherproblems to problems in higher order logic and can prove them by a proof checkerof classical higher order logic.
As well as basic inference rules, PX's proof checker has an expandable setof inference macros by which highly legible proofs can be written. PX enables
one to print out proofs written by the macros using TEXTM . So when one proves
a theorem with PX, not only a Lisp program but also a well formated proof is
automatically generated.

2

Chapter 1

1.2. PX as a logic of computation
The logic of PX is an ordinary logic except that terms may fail to denote a value.
Such a logic is called a logic of partial terms (see 2.3). By aid of this logic, PX
can reason about the termination of programs. We choose Lisp to describe purefunctional algorithms. The Lisp of PX is tailored so as to be formalizable without
the concepts of environments and situations, so that its logic is still simple enough.
The logic of PX enables us to reason about functional arguments in Lisp. For
example, we can rigorously prove Kleene's second recursion theorem.
Although PX is a rst order logic, PX's classes serve as data types (see2.4). Classes are de ned predicatively as Martin-Lof's types are. The exibility of a type free system enables us to de ne Martin-Lof's types and even moredata types by two principles, i.e., an induction scheme, called a CIG inductive
de nition, and a principle of existence of dependent sums. For example, we cande ne various functional spaces, e.g., spaces of intensional functions, spaces ofextensional functions, and spaces of partial functions. We can de ne many kindsof well-founded structures including Martin-Lof's W (Martin-Lof 1982), and we
can formulate a xed point induction and structural induction by utilizing CIG
induction (see 2.4.3 and 4.5). To introduce these into type theories, new types,
operators, and inference rules must be added. In our type free approach, all ofthem can be de ned or expressed by the existing language, i.e., they can be introduced without changing the system. (We have to introduce axioms to state thexed point induction mentioned above, but the axioms are stated in the languageof PX.)

1.3. PX as a program extractor

The principle of \proofs as programs" maintains that if a constructive proof of
8x : D:9y:A(x; y) is given, then an algorithm of a computable function f is automatically constructed (extracted) from the proof, such that (i) f (x) terminates
on every input x : D and (ii) 8x : D:A(x; f (y)) is satis ed. (See Howard 1980
and Bishop 1970.) Since f is constructed from a proof, these properties of f are
rigorously certi ed.
The formula 8x : D:A(x; f (y)) says that if an input x is in the data typeD, then the input x and the output f (x) satisfy the relation A(x; f (x)). Namely,
D speci es a data type on which f is de ned and A(x; y) speci es the relation
between the input x and the output y. So the formula 8x : D:9y:A(x; y) is a
speci cation of the \extensional" behavior of an algorithm f .
A constructive proof is an amalgamation of an algorithm and its veri cation.
When one develops a program as a proof, even the termination of the program is
automatically certi ed. This is one of the reason why systems like Martin-Lof's
type theory appeal to computer scientists. Another reason why such systems

Chapter 1

3

appeal is that they can describe many algorithms by a small number of inference
rules as formal systems for mathematics. We think that these are advantages, butthese can also seen as drawbacks.
In practice, we often need many inductions to extract natural and tractable
programs, an we need to separate the termination proof from the part of a proof
which represents an algorithm. Functional programs have many di erent forms ofrecursion. On the one hand, we need many induction principles to extract suchrecursions. On the other hand, termination of such recursions can be proved bya small number of induction principles. Namely, there are two di erent usages of
induction. One is to describe recursions and the other is to prove termination ofsuch recursions. These two were confused in the traditional approach of \proofs
as programs"
We will show in 3.3 that some natural constructive proofs produce unnaturaland slow programs due to this confusion. A typical example is a proof which
maintains the existence of a prime number p which is greater than or equal to anatural number n. The proof uses mathematical induction, so the extracted proof
uses primitive recursion. The program recursively calls itself n! ; n +2 times, even
if n is a prime number.
CIG induction provides a way to represent many recursions. PX can prove
terminations of such recursions before program extraction. Namely, the termination proof can be done at the level of mathematical theory rather than a direct
analysis of programs, and so retains the mathematical clarity of \proofs as programs". Furthermore, such a termination proof never disturbs programs to be
extracted. Thus, the termination proof of an extracted program can be separated from the other part of the proof. By this method, we can construct a new
proof of the prime number example mentioned above by using the old proof as atermination proof, and can extract a simple search program (see 4.3.2.5).
The method of extraction of a recursive program which realizes the formula
8x : D:9y:A(x; y) is as follows. Firstly, we start with an informal recursion scheme
which we wish to use in the program. It is not necessary to give details of the
program. What must be decided is what recursion scheme is used. The instanceof the scheme used in the program to be extracted need not be given. We de ne a
subdomain D1 of D by an instance of CIG induction which represents the scheme.
Then we prove 8x : D1 :9y:A(x; y) by induction for D1 . A program f which satis es
8x : D1 :A(x; f (x)) is extracted from this proof. The proof determines the detailsof the program. Then f is certi ed to be total on D1 . The termination of f on
D is proved by showing D  D1 . This can be proved by familiar inductions suchas those of Martin-Lof's systems. We can prove 8x : D:9y:A(x; y) by this and8x : D1 :9y:A(x; y). Then the proof of D  D1 does not disturb f . Hence, thesame f is extracted from the proof of 8x : D:9y:A(x; y) (see 3.3).

4

Chapter 1

This is because D  D1 is a rank 0 formula. Rank 0 formulas are formulas
whose proofs never have any computational signi cance, so it is not necessary
to prove them constructively. They may be proved by classical logic or even byanother proof checker. PX can prove rank 0 formulas by its classical logic (see2.3.5), or by a proof checker EKL (Ketonen and Weening 1983, 84) of classicalhigher order logic (see 7.4). Since termination may be proved by classical higher
order logic of EKL, all provable recursive functions of higher order arithmetic canbe extracted. If we use a proof checker for ZF set theory rather than for higher
order logic, then PX can extract all provably recursive functions of ZF set theory.
There is no theoretical limitation to extensions of the set of extractable programs.
PX can virtually extract all recursive functions by such extensions. Note thatsuch extensions do not force us to change the logic of PX. It is enough to give aninterpretation of PX in a stronger system. This fact is stated in a rigorous way
as a completeness theorem which resembles the relative completeness theorem of
Hoare logic (see 4.4). Using a similar argument, we show that Hoare logic can beembedded in PX (see 4.6).

1.4. PX as a classical logic

Our philosophy is to use classical logic as much as possible. We restrict ourselvesto constructivism only when it is necessary to extract programs from proofs. In
practice, it turns out that many lemmas used in proofs (besides termination) arerank 0, so that they may be proved classically. (This was rst pointed out by
Goad 1980, although he did not consider the termination problem.) PX has asimple mechanism by which we can do classical reasoning in the framework ofconstructive logic. This allows us to extract programs whose termination proofs
need classical reasoning. Compatibility with classical reasoning enables us to givea simple classical semantics of formulas, and to relate PX to the existing proof
checker of classical logic as we did with EKL.
It also allows users to think in the classical way. In constructive type theories,
an element f of the type of a formula 8x : D:9y:A(x; y) satis es 8x : D:A(x; f (x))
in the sense of constructive mathematics. In PX, 8x : D:A(x; f (x)) holds in thesense of classical mathematics as well as in the sense of constructive mathematics
of PX. (See chapters 3 and 4.)

1.5. px/ as a foundation of type theory

Many type theories have been developed in computer science. Their relations arestill widely unknown, and there is no one single framework to give semantics tothem. We believe that a type free theory will serve as such a framework. The
application of type free systems as foundations of type theories is an undeveloped
but interesting subject. PX itself is not strong enough to capture many type

Chapter 1

5

theories, since it is designed as a system of program extraction. Nonetheless,we will show that we can de ne Martin-Lof's types in PX and will point out
that PX can interpret some module systems. Furthermore, an interpretation of apolymorphic lambda calculus will be given in an impredicative extension of PX.
(See chapter 5)

1.6. The origin of PX

It seems that quite a few people are puzzled by PX's basic designs. It looks
like a logical system designed under the in uence of recent studies of type theory
in computer science. But it has a rather unconventional avor. Why untyped
theory? Why Lisp? We will explain the origin of PX to resolve existing andpossible misunderstandings about the motivation of the PX project.
Although PX looks like a type free counterpart of Martin-Lof's type theory(Martin-Lof 1982) or Nuprl (Constable 1986), it has a di erent origin. It wasborn independently of the recent studies of type theory. We were unaware ofstudies of type theory in computer science in the early stage of the project. The
predecessors of PX are the studies of a Japanese group (e.g., Goto 1979, 79a;
Sato 1979; Takasu and Kawabata 1981; and Takasu and Nakahara 1983). The
objective of the group was to give a mathematical foundation to the deductive
approach of program synthesis, e.g., Manna and Waldinger 1971, and to build
their own systems of program synthesis. The original objective of the PX project
was to strengthen the studies of the Japanese group both in theory and in its
implementation. The main ideas which led us to the PX project were replacing
the Godel interpretation by a more natural realizability, to replace HA (Heyting
Arithmetic) by much more powerful and natural Feferman's system T0 , and touse Lisp as a target language.
Goto 1979 and Sato 1979 used Godel interpretation to extract programsfrom proofs of HA. Sato used reductions of terms to execute extracted primitive
recursive functionals. The correctness of the execution was rigorously certi ed by
the correctness of reduction steps. But an experimental reducer written in Lisp
was hoplessly slow. Goto's system could compile extracted primitive recursivefunctionals to natural Lisp programs. But he did not give any correctness proofof the compilation.
One of the authors thought these studies unsatisfactory. Realizability lookedmuch more natural than Godel interpretation. Goto's approach to generate Lisp
codes looked attractive, since extracted programs could run on conventional Lisp
systems. But, the extracted programs should be written in the language of logic
and the correctness of the extracted programs should be demonstrated by thesame logic. It seemed rather easy to formalize properties of a subset of Lisp whichis enough for a realizability. Furthermore, there was a very good type free logical6

Chapter 1

system which was quite suitable to formalize the type free language of Lisp. This
was Feferman's T0 , which has a similar philosophy to Lisp. The core of both
Lisp and T0 is simple and minimal, but re ect the universe. They are so exiblethat their boundaries to the outer world are not clear. They harmonize with theuniverse, keeping their individuality, similar to Japanese gardens. They are simple
and exible, because they do not distinguish functions and classes (data types)
from objects. The key was that they were type free.
So the marriage of T0 and Lisp was quite natural. The rst o springs of themarriage were LM and LMI in Hayashi 1983, and an experimental implementation of a subset of LMI was built. (LM was based on the logic of total terms
and LMI was based on the logic of partial terms.) A serious drawback of thesystem was lack of recursive data types. Later, we added recursive data types bymeans of an extension of Feferman's principle IG (Inductive Generation) to thesystem. Since the principle looked like a conditional form of Lisp, we called it CIG(Conditional Inductive Generation). Due to this and other changes, the name ofthe system was changed to PX.
Working on some examples, it turned out that CIG provides a techniqueuseful to extract ecient programs. Meanwhile, we realized that it was a way toseparate the termination problem from the partial correctness problem, and themetamathematical results in chapter 4 were proved.
During these developments, we realized that the logic of partial terms of PX
was not satisfactory. Its semantics was based on a complicated translation of logic
of partial terms to a logic of total terms with a predicate which denotes the graphof the evaluator of Lisp. And there was a mistake in the treatment of function
closures. So we shifted to the present formulation of logic of partial terms and its
semantics.
Encouraged by these developments, we tried a larger example presented inappendix b. It was quite dicult to write a sizable proof by basic inference rulesof PX. We developed inference macros under the in uence of the CAP project of
ICOT (Furukawa and Yokoi 1984). Inference macros worked well and it turned
out that it was easy to print them by TEXTM , and we added the EKL translator toprove many hypotheses which are remained unproved by inference macros. Thenthe present version of PX was born.

1.6. Overview

An overview of this book is as follows. Chapter 2 gives a precise description of theaxiom system of PX. Chapter 3 gives a realizability that serves as a mathematical foundation for program extraction. These two chapters are rather technical.
Readers who are not interested in rigorous mathematical treatments should readchapter 2 brie y and then jump to chapter 4, which gives some examples andChapter 1

7methodologies of program extraction and their associated mathematical theories.
In chapter 5, we demonstrate that PX can serve as a foundation for the semantics of some type theories. Chapter 6 gives a mathematical semantics of PX.
Chapter 7 describes an implementation of PX. Chapter 8 gives a summary of theresults of the project and views for further studies. In appendix A we compare
our realizability with other interpretations. In appendix B we present experimentswith PX, in which a tautology checker for propositional logic is extracted froma proof of completeness theorem of propositional logic. Appendix C describes
optimization methods that are used in the implementation.

2 Formal System
In this chapter, we introduce the formal theory of PX. Basically it is an intuitionistic rst order theory axiomatizing properties of a dialect of Lisp.
An important departure of the logic of PX from ordinary logic is that in
PX expressions which may fail to denote a value are admitted. This extensionof logic is quite useful when one is attempting to give an axiom system for acomputational language, whose programs often fail to terminate. Such a logic
was used in classical recursion theory as an informal abbreviation, but was neveraxiomatized.
In section 2.1, we will introduce a system of expressions, functions, andfunction de nitions. It is a mathematical description of the processes of declaring
functions in Lisp. In section 2.2, we will de ne formulas and terms of PX. In
sections 2.3, 2.4, and 2.5, we will introduce the axiom system of PX.

2.1. DEF system: recursive functions over symbolic expressions
In this section, we will de ne expressions (terms) and functions of PX. The objects

described by expressions are S-expressions, i.e., objects are generated from atoms
by successive applications of dotted pair operations. Namely, we assume that theset of objects Obj is inductively generated as follows:
1. Atoms are objects. The set of atoms Atom is a disjoint union of the set of
natural numbers N and a countably in nite set of literal atoms.
2. Obj is closed under pairing ( : ) and all objects are generated from atoms
by successive applications of pairing.
Before giving the precise de nition of expressions and functions, we explain
their intended meanings. Roughly, expressions and functions are de ned by

e ::=xj
cj
fn(e1 ; : : : ; en)jcond(e1 ; d1 ; : : : ; en; dn )j(x1 = e1 ; : : : ; xn = en )(fn)jlet p1 = e1 ; : : : ; pn = en in e
fn ::=f j
(x1 ; : : : ; xn )(e)Chapter 2

9Here e; e1; d1 ; : : : and fn stand for expressions and a function, respectively, andx ranges over variables, c ranges over constants, and f ranges over function identi ers. These are mathematically re ned versions of M-expressions (McCarthy1965) for a certain class of well-formed Lisp programs. PX may be thought of asa system based on pure Lisp.
Let us explain the correspondence between our syntax and Lisp programs.
(See 6.1 for a detailed explanation.) The application fn(e1 ; : : : ; en ) correspondsto(fn e1 : : : en ):The conditional expression cond(e1 ; d1 ; : : : ; en; dn ) corresponds to(cond (e1 d1 ) : : : (en dn )):The let-expression let p1 = e1 ; : : : ; pn = en in e corresponds to(let ((p1 e1 ) : : : (pn en )) e):
The abstraction (x1 ; : : : ; xn )(e) corresponds to(lambda (x1 : : : xn ) e):
There is no Lisp primitive which precisely corresponds to . But the -expression
(x1 = e1 ; : : : ; xn = en)(fn) is almost equivalent to the Common Lisp program(let ((x1 e1 ) : : : (xn en )) (function fn)):(See Steele 1984 for Common Lisp.) We will explain  in 2.3.1 below in a detail.
The signi cant di erence between PX and Lisp is the separation of functions
from expressions. In Lisp, a function may be considered to be an expression, but,in PX, a function is not an expression. An expression of PX is a syntactic
object whose value is an S-expression. A function of PX is a syntactic object
whose value is a partial function in the sense of mathematics. Since variables are
expressions, we do not have variables for functions. Because of this separation,
we must introduce a method for converting functions to expressions to do higher
order programming. (Higher order programming is necessary for realizability.)
Another possible solution is the introduction of function variables. But it spoils
the simplicity of a type free system and does not t into the semantics of Lisp.
 is PX's syntactical operator converting functions to expressions. We use
a universal function app and an abstraction to convert an expression into afunction. (The role of \binding" x1 = e1 ; : : : ; xn = en in (x1 = e1 ; : : : ; xn =en )(fn) will be explained in 2.3.1.) Roughly, if fn is a function, then (fn) is

10Chapter 2

an expression such that the function (x)(app((fn); x)) extensionally equals
the function fn. (Our notation (x)(app(e)) is x:e in the usual -calculus
notation.) So we have two syntactic operations i and j which convert functions
and expressions as follows:i(fn) = (fn); j (e) = (x)(app(e; x));i
Func ! Exp ;[ j (i(fn))]] = [ fn] :jFunc is the set of functions of PX, Exp is the set of expressions of PX, and [ fn] isthe extension (graph) of the function fn. The expression app (x ; y ) corresponds
to the Lisp program (funcall x y) and Kleene's notation fxg(y) (see Kleene1952).
The expressions without recursive de nitions can represent any computablefunction (see proposition 2 in 2.3.2), but programs without recursive de nitions
are quite slow and consume huge amounts of space. So we introduce recursivede nitions of functions as in ordinary Lisp. For a mathematical description of\de nitions by recursive equations", we introduce the DEF system, which is asystem of De nitions, Expressions, and Functions. (Note that we do not use
label-notation to de ne recursive functions.) The de nition may look complicatedsince we insist on a very mathematical description, but it is no more than a subsetof Lisp whose grammar, including de nitions, is restricted to lexical scoping.
Let B be a countably in nite set of identi ers of basic functions with arities.
We assume that at least the following function names belong to B :app; app; list; atom; fst ; snd; pair; equal; suc; prd :The above ten function names correspond to be the following Lisp functions,
respectively:

;

;

;

;

;

;

;

;

;

:

apply funcall list atom car cdr cons equal add1 sub1

Arities of the basic functions are given by a mapping
arityB : B ! N [ (Pow (N ) ; (f;g [ ffngjn 2 N g));where Pow (N ) stands for power set of N . So an arity of a basic function may be
a set of natural numbers. The arities of the above basic functions are given byarity B (app) = 2; arity B (app) = N ; f0g; arity B (list) = N;arity B (atom) = arity B (fst ) = arity B (snd) = arity B (suc) = arity B (prd ) = 1;
arity B (pair) = arity B (equal) = 2:

Chapter 2

11

Let VV be a countably in nite set of variables and C be a countably in nite
set of constants. In our theory, a variable need not have a value. This is unusual
but quite convenient when axiomatizing properties of a programming language.
VV is divided into two in nite disjoint sets VV t and VV p . The variables of VV t
are called total variables and the variables of VV p are called partial variables.
We assume total variables (constants) are divided into two disjoint in nite classes,
i.e., class variables (class constant) and individual variables (individual constants)
This division of total variables and constants is not essential, but is convenientfor describing the logical system of PX. Constants and total variables must havevalues but partial variables need not have values. Constants are names for xed
values. So they have values. (For an abbreviation of a closed expression, which
may not have a value, we use 0-argument function instead of a constant.) At least,
the following are constants:
0; t; nil; V; N; Atm; T; quote( );where is an arbitrary object, i.e., quote is a one-to-one mapping that maps
each object to a constant representing it. Among these, V , N , Atm, T are classconstants and the others are individual constants. We will often write ' insteadof quote( ). V stands for the class of all objects, N stands for the class of all
natural numbers, Atm stands for the class of all atoms, and T stands for the classof all non nil objects.
Constants and partial variables are neither assigned to nor bound by executions of programs. Partial variables may be valueless or may have arbitraryvalues. Constants are supposed to have xed values. Partial variables serve as a
substitute for metavariables for expressions, since whenever a expression is substituted for a partial variable in a theorem, we still have a theorem. In this sense, therole of partial variables in PX is mainly that of enhancing the expressive powerof formulas of PX. On the other hand, total variables play rather a distinguishedrole in the PX of programming language. They are exclusively used for names oflexical variables. Our intended evaluator can bind lexical variables, so the variable
x of (x)(e) must be a total variable.
Another syntactic category besides B , C , VV is the function identi er for
user de ned functions. We denote it by FI , and we assume that FI is a countably
in nite set.
We de ne the expressions and the functions built from given B , C , VV , andFI . To this end, we de ne patterns, which are used in let-expressions.
De nition 1 (pattern). Patterns of let-expressions are de ned by the following
inductive de nition. These patterns are a generalization of the usual let-patternsof Lisp, so that constants may occur in them.

12

Chapter 2

1. Constants and total individual variables are patterns.
2. If p1 ; : : : ; pn are patterns, then (p1 : : : pn;1 : pn ) and (p1 : : : pn ) are patterns.
Note that the last dot of the former pattern is a literal dot and each item ofa list is to be separated by spaces.
For example, (x y), x, (x y : x), (x 0), (x (y) : nil) are patterns. The free variables(or variables for short) of a pattern are the variables appearing in it. We denotethe set of variables of a pattern p by FV (p). For example, FV (((x y) x 0)) isfx; yg. Patterns are useful to avoid messy destructors fst and snd as patternsof some Lisp systems are used. We allow constants to appear in patterns for thecompatibility with the usage of patterns in r-quanti er (see 2.2).
Now we can de ne expressions and functions.
De nition 2. Let A be a nite set of function names with an arity function
arityA : A ! N . We assume A is disjoint to B . We give an inductive de nition of
the expressions over A, E (A) for short, and the functions over A, F (A) for short.
Simultaneously we de ne their free variables and arities of functions. The set offree variables of is denoted by FV ( ). The arity is de ned as a function
arity : F (A) ! N q (Pow (N ) ; (f;g [ ffngjn 2 N g);
1. C , VV  E (A). If 2 C , then FV ( ) is f g, and, otherwise, it is f g.
2. Assume 2 A [ B . Then 2 F (A), FV ( ) = ;, and its arity is de ned asarityA ( ) or arityB ( ).
3. Assume f 2 F (A) such that arity(f ) = n or n 2 arity(f ). If e1 ; : : : ; en 2
E (A), thenf (e1 ; : : : ; en )belongs to E (A) and its free variables are FV (f ) [ FV (e1 ) [ : : : [ FV (en ).
This is called an application.
4. Assume e1 ; : : : ; en ; d1 ; : : : ; dn 2 E (A). Thencond(e1 ; d1 ; : : : ; en ; dn )belongs to E (A). This is called a conditional expression. Its free variables
are FV (e1 ) [ FV (d1 ) [ : : : [ FV (en ) [ FV (dn ). We will use case(e; e1; : : : ; en )as an abbreviation ofcond(equal(e; 1); e1; : : : ; equal(e; n); en):
5. Assume f 2 F (A) and all of free variables of f are total variables. Let
v1 ; : : : ; vn be a sequence of total variables without repetitions such that all
free variables of f appear among them. Then(v1 = e1 ; : : : ; vn = en )(f )Chapter 2

13

belongs to E (A). This is called a -expression and its free variables are
FV (e1 )[: : :[FV (en ). (f ) is an abbreviation of (v1 = v1 ; : : : ; vn = vn )(f ),where FV (f ) = fv1 ; : : : ; vn g. The variables v1 ; : : : ; vn are called the boundvariables of the -expression, and the part of v1 = e1 ; : : : ; vn = en is called
the binding of the -expression. The function f is called the body of the-expression.
6. Assume e 2 E (A) and v1 ; : : : ; vn are total individual variables without repetitions. Then(v1 ; : : : ; vn )(e)belongs to F (A). This is called a -function and its free variables are FV (e);fv1 ; : : : ; vn g. (It is not an \expression" but a \function" according to our
terminology. So we call it a -function instead of -expression.) Sometimes
we will write (v1 ; : : : ; vn ):e for simplicity. The variables v1 ; : : : ; vn are called
the bound variables of the -function. The expression e is called the body ofthe -function.
7. Assume e1 ; : : : ; en ; e belong to E (A) and p1 ; : : : ; pn are patterns. Thenlet p1 = e1 ; : : : ; pn = en in e
belongs to E (A). This is called a let-expression and its free variables are
FV (e) ; (FV (p1 ) [ : : : [ FV (pn )) [ FV (e1 ) [ : : : [ FV (en ). The variables of
p1 ; : : : ; pn are called the bound variables of the let-expression. The expression
e is called the body of the let-expression.
The syntactic constructors , , and let are quanti ers. -expressions andlet-expressions are quanti ed expressions. -functions are quanti ed functions.

An occurrence of a variable in an expression or function is bound in it, when it
is a bound variable of a subquanti ed expression (or a subquanti ed function)and in the body of the subquanti ed expression (or the subquanti ed function).
An occurrence of a variable is free, unless it is bound. A bound occurrence of avariable is bound by the same bound variable of the quanti er that is the smallest
quanti ed expression (or quanti ed expression) in which the occurrence is bound.
Substitution of expressions for variables of an expression or a function are
de ned as usual. The expression obtained by substituting e1; : : : ; en for variables
x1 ; : : : ; xn of e is denoted by e[e1 =x1 ; : : : ; en=xn ]. Not that we do not substitutea function for a variable, since all variables range over S-expressions rather thanfunctions. Since a con ict of free variables and bound variables may occur, renaming of bound variables is necessary. The equivalence of expressions or functions
by -convertibility, which involves semantics of the DEF system, will be discussed
in 2.3.1.
We give a formal de nition of \de nition of functions".

14

Chapter 2

De nition 3 (de nition of functions). Let f1; : : : ; fn be function identi ers
without repetitions. A de nition of f1 ; : : : ; fn over A is a set of equations ff1 (~v)1 =e1 ; : : : ; fn (~v)n = en g such that ~vi is a sequence of variables without repetitions,ei 2 E (A), and FV (ei )  ~vi . We assume the arity of each function fi matches tothe number of arguments.
Now we give the de nition of DEF system.
De nition 4 ( nite DEF system). A triple D; E; F is a nite DEF systemi it is de ned by one of the following clauses:
1. D; E; F are ;; E (;); F (;), respectively.
2. Assume hD; E; F i is a nite DEF system. Let f1 ; : : : ; fn be new function
identi ers not belonging to F . Let A be the union of the set of function
identi ers of F and ff1; : : : ; fn g. Then for each de nition d over A, hD [fdg; E (A); F (A)i is a nite DEF system. We denote this new nite DEF
system by hD; E; F i  d.
We de ne the DEF system as a limit of nite DEF systems.
De nition 5 (DEF system). Let DEF0; DEF1 ; : : : be a in nite sequence ofnite DEF systems such that each DEFi+1 is DEFi  di+1 for a de nition di+1
ofSnew S
functions and DEF0 is h;; E (;); F (;)i. Let DEFi be Di ; Ei ; Fi . Thenh i Di ; i Ei ; Si Fi i is called a DEF system. A DEF system is called regular if all
possible de nitions appear in the sequence d1 ; d2 ; : : : modulo renaming of function
names.
We can write all recursive programs in a regular DEF system. In 2.3.1, we
will show that even in the least nite DEF system h;; E (;); F (;)i we can de ne
all recursive functions by the aid of Kleene's second recursion theorem. It is easy
to see there is a regular DEF system. A regular DEF system is practically uniquein the sense that any functions of any DEF system are interpretable by any otherregular DEF system. So it is not essential which DEF system is chosen.
Remark 1. A nite DEF system corresponds to a nite collection of de nitionsof functions in PX proof checker (see 7.2.6). But we consider that PX is basedon a regular DEF system rather than on a nite DEF system, in order to state
the soundness theorem for our realizability (theorem 1 of 3.1) naturally. If PX isbased on a nite DEF system and a theorem is proved in it, then the realizer of thetheorem may belong to a larger nite DEF system rather than the DEF systemthat PX is based on, since the extraction algorithm may de ne new functions toconstruct the realizer. But a realizer extracted from a theorem should belong to
the same system in which the theorem is proved. Thus we use a regular DEF
system instead of a nite DEF system.

Chapter 2

15

2.2. The language of PX
PX is a system in which we can write recursive programs and prove their prop-

erties. Such a system must have two parts, a computational part and a logicalpart. The computational part is a programming language and the logical part isa logical system in which we can state and prove the properties of programs anddata types. In Hoare logic, the computational part is called the object language
and the logical part is called the assertion language. Any system of program
veri cation must have these two parts. A single framework may unify these twoparts (see, e.g., Sato 1985), but computing and logical reasoning about them haverather di erent natures and di erent aims. So we separate them.
In this section we will present the languages of both the computational andthe logical parts of PX. The axiom system will be explained in the following
sections 2.3-2.5. The precise semantics will be given in chapter 6, although we will
give informal explanations in this and the following sections. PX is a two-sorted
rst order constructive formal system. Fix a regular DEF system hD; E; F i, andwe de ne the PX system on it. The terms (expressions) of PX are the expressionsof E and the functions are the functions of F . Since a regular DEF system is notunique, the formal system of PX is not unique, either. This re ects the fact that
we can declare functions in the implementation of PX, so that de nitions of terms
and axioms of PX depend on declarations. To de ne formulas of PX we mustde ne some auxiliary concepts.
De nition 1 (expansion). Expansions of patterns are de ned inductively by
the following clauses. The expansion of a pattern p will be denoted by exp(p).
1. The expansions of constants and total variables are themselves.
2. Compounded patterns are expanded as follows:exp((p1 : p2 )) = pair(exp(p1 ); exp(p2 ));exp((p1 : : : pn;1 : pn )) = pair(exp(p1 ); exp(p2 : : : pn;1 : pn ));exp((p1 : : : pn )) = list(exp(p1); : : : ; exp(pn )):Note that an expansion of a pattern p is an expression constructed from total

constants and total variables by successive applications of the function identi ers
pair, list. The free variables of a pattern p are just the free variables of exp(p).
De nition 2 (tuple). If e1; : : : ; en are expressions, then [e1; : : : ; en] is a tuple.
We do not allow nested tuples, e.g., [e1 ; [e2 ]] is not a tuple in our sense. Tuple
is a meta notation (or an abbreviation) so it is not a part of formal syntax. We
identify [e] with e itself. On the other hand, a tuple [e1 ; : : : ; en ] whose length isnot 1 stands for list(e1; : : : ; en ). Especially, [ ] is nil. A tuple must be used onlyin the context of the form [e1 ; : : : ; en] : e or as a pattern. The free variables of16

Chapter 2[e1 ; : : : ; en ], symbolically FV ([e1 ; : : : ; en ]), are FV (e1 ) [ : : : [ FV (en ). If v1 ; : : : ; vn
are mutually distinct total variables, then the tuple [v1 ; : : : ; vn ] is called a tuple
variable. This may be used as a bound variable of a quanti er. We will often
denote a tuple variable by the vector notation ~v.
De nition 3 (formula). In the following e; d; ei; di : : : are metavariables forexpressions.
1. The atomic formulas of PX are

E (e); Class(e); e1 = e2 ; [e1 ; : : : ; en ] : en+1 ; ?; >:We write e1 : e2 for [e1 ] : e2 .
2. If A1 ; : : : ; An are formulas then so are

A1 _ : : : _ An ; A1 ^ : : : ^ An :3. If A and B are formulas, then so is

A  B:A  B is an abbreviation of the formula A  B ^ B  A.
4. If A is a formula, then so are:A; }A:
5. If A is a formula, e1; : : : ; en are expressions, and ~v1 ; : : : ;~vn are tuple variables
such that FV (~v1 ); : : : ; FV (~vn ) are mutually disjoint, then so are

8~v1 : e1; : : : ;~vn : en:A; 9~v1 : e1 ; : : : ;~vn : en :A:
6. If e1 ; : : : ; en are expressions and A1 ; : : : ; An are formulas, then so is

e1 ! A1 ; : : : ; en ! An
A formula of this form will be called a conditional formula and ei ! Ai is
called a clause with condition ei and body Ai .
7. If A is a formula, p1 ; : : : ; pn are patterns, and e1 ; : : : ; en are expressions suchthat FV (p1 ); : : : ; FV (pn ) are mutually disjoint, then so is

rp1 = e1; : : : ; pn = en:A:r is called r-quanti er or let-quanti er.

Chapter 2

17

In short, formulas are de ned by the grammar:

F ::=E (e)jClass(e)j[e1 ; : : : ; en] : eje1 = e2 j>j?j
F1 ^ : : : ^ Fn jF1 _ : : : _ Fn jF1  F2 je1 ! F1 ; : : : ; en ! Fn j:F j}F j
8~x1 : e1 ; : : : ; ~xn : en :F j9~x1 : e1 ; : : : ; ~xn : en :F jrp1 = e1 ; : : : ; xn = en :F;
where F; F1 ; : : : are formulas and e; e1; : : : are expressions. We will casually use
parentheses to group formulas.
Now we explain the meaning of the formulas informally. E (e) means e has avalue or the execution of e under the current environment terminates. Class(e)means that e has a value which is a class. Classes are descriptions of particular setsof objects. Although precise de nition of classes will be given later, readers mayhere assume that any reasonable data type, such as the natural numbers, lists,function spaces, etc., are classes. The equality e1 = e2 is Kleene's equality, i.e., if
e1 has a value then e2 has the same value and vice versa. [e1 ; : : : ; en ] : e meansthat e1 ; : : : ; en; e have values, say v1 ; : : : ; vn ; v, respectively, and v is a descriptionof a class to which the tuple [v1 : : : vn ] belongs. Namely, if n = 1, then it means
v1 belongs to v, and if n 6= 1, then it means the list (v1 : : : vn ) belongs to v. Notethat [e1 ] : e does not mean the singleton list (v1 ) belongs to v. > and ? mean
true and false, respectively.
The logical connectives except !, } are as usual. The modal operator }is just double negation. e1 ! A1 ; : : : ; en ! An means there is m such thate1 = : : : = em;1 = nil and em has a non nil value and Am holds. Note that if
all of e1 ; : : : ; en have the value nil then the formula is false. Since this semantics
resembles McCarthy's conditional form, we call this formula a conditional formula.
As in the case of conditional form we can de ne \serial or" as e1 ! >; : : : ; en ! >.
We will abbreviate it as Sor(e1 ; : : : ; en ). The case formula Case(a; A1 ; : : : ; An ) isan abbreviation of equal(a; 1) ! A1 ; : : : ; equal(a; n) ! An .
The universal quanti er 8~v1 : e1 ; : : : ;~vn : en A means that if ~v1 : e1 ; : : : ;~vn :en hold, then A holds. For example, 8[x; y] : C:R(x; y) means that R(x; y) holds for
all x; y such that [x; y] : C . Since we identify a tuple variable [x] with x, we write
8x : e:A instead of 8[x] : e:A. We abbreviate 8 : : : ; x : V; : : : as 8 : : : ; x; : : :. So
8[x] : V; [y] : V:A will be abbreviated as 8x; y:A. Note that 8x1 : e1 ; x2 : e2 :A is not
equivalent to 8x1 : e1 :8x2 : e2 :A, since, in the former formula, the free occurrencesof the variable x1 in e2 are not bound. The semantics of the existential quanti er
is similar to that of the universal quanti er.
The r-quanti er resembles let of Lisp. rp = e:A means that e has a value
which matches the pattern p and that under the matching A holds. The scope ofthe r-quanti er is the same as that of the universal quanti er. We will sometimes

18

Chapter 2

use a tuple notation for expressing a pattern. Then the tuple is a macro which
expands by the rule in De nition 2 above. Namely, r[p] = e:A means rp = e:A,and r[p1 ; : : : ; pn ] = e:A means r(p1 ; : : : ; pn ) = e:A, if n is greater than 1. The rquanti er is quite useful in speci cations of programs in symbolic manipulations
like programs on logic. In such speci cations, we often say as \let A be a formulaof the form B ^ C   ". This can be stated as r(B '^ C ) = A:(  ). It is also
useful for a formal de nition of realizability. Its inference rules are used to extract
the program construct let.
Note that we can de ne r by means of the universal quanti er and also
by means of the existential quanti er. For example, rx = e:A is de ned by
E (e) ^ 8x:(x = e  A) and also by 9x:(x = e ^ A). But our realizability ofrx = e:A is di erent from the realizability of these two formulas. This is one of
the reasons why r is a primitive logical sign. We can de ne ! and the predicate
E by means of the other logical signs. But they are primitive by the same reason.
We will assign a natural number rank(A) called rank of A for each formula
A in 3.2. Roughly, a rank of a formula is the length of lists realizing the formula(see chapter 3 for realizability). The formulas whose rank is 0, which we call rank
0 formulas, play an important role in PX. The rank 0 formula generalizes theHarrop formula, the almost negative formula of Troelstra 1973, and the normal
formula of Nepevoda 1978. (Troelstra allows the use of 9 in front of a recursive
predicate in almost negative formulas. Such a quanti er may be replaced by ar-quanti er.) To assert a rank 0 formula, it is enough to show it holds in thesense of classical mathematics. Here we de ne rank 0 formulas by the following
grammar.
De nition 4 (rank 0 formula). Let F range over all formulas and let G; G1 ; : : :range over rank 0 formulas. Then rank 0 formulas are generated by the grammar:

G ::=E (e)jClass(e)j[e1 ; : : : ; en ] : eje1 = e2 j>j?j
G1 ^ : : : ^ Gn jF  Gje1 ! G1 ; : : : ; en ! Gn j:F j}F j
8~x1 : e1; : : : ; ~xn : en :Gjrp1 = e1 ; : : : ; xn = en:G:
In 4.6, we will show how to simulate Hoare logic in a fragment of PX. There,
rank 0 formulas play the role of formulas of assertion language. As a generalizedcounterpart of the consequence rule of Hoare logic, we will introduce the ruleof (replacement) in 2.3.3, which enables us to replace a rank 0 subformula ina context by another subformula. For the formulation of the inference rule, wede ne the concept of contexts and their environments.
De nition 5 (context). An -formula is a formula which allows  as an atomic
formula. A context is an -formula which has exactly one occurrence of . We

Chapter 2

19

write a context as A[]. If A[] is a context and F is a formula, then A[F ] is aformula obtained by replacing  by F .
Note that the symbol  may occurs only once in a context A[]. So  ^  isan -formula but not a context. When  occurs in a positive (negative) part ofA[], we write A[]+ (A[]; ). For example, the following are contexts:

A[]+ = 8x : C (x = y  ); A[]; = 8x : C (  x = x):
Note that we do not rename bound variables of A[F ]. So A[x = x] in the above
example is 8x : C (x = y  x = x).
De nition 6 (environment). A context called the environment of  in A[],EnvA [] for short, is de ned by the clauses:
1. Env [] is .
2. If A[] is a conjunctive context, then just one conjunct is a context, i.e., A[]has the form A1 ^ : : : ^ Ai [] ^ : : : ^ An , where the conjuncts A1 ; : : : ; An are
ordinary formulas except Ai . Then EnvA [] is EnvAi []. The environmentof a context whose outermost logical symbol is _; ; :; } or ! is de ned
similarly.
3. If A[] is a context 8~v1 : e1 ; : : : ;~vn : en :B [] or 9~v1 : e1 ; : : : ;~vn : en :B [], thenits environment is 8~v1 : e1; : : : ;~vn : en:EnvB []. If A[] is rp1 = e1 ; : : : ; pn =en :B [], then its environment is rp1 = e1 ; : : : ; pn = en :EnvB [].

2.3. Basic axiom system: the logic of partial terms

In this section, we introduce a basic axiom system describing the properties ofprograms (expressions and functions) and logical symbols. The axiom system
concerning data types will be presented in the next section. The axiomatic systemin this section is a logic of partial terms (LPT). In the usual logic, every expression(term) is assumed to have a value. But in computational languages, expressions(programs) often fail to have a value due to loop or error. So usual logic is not too
useful in axiomatizing properties of such a language. There are many attempts
to axiomatize computational language: Hoare logic, dynamic logic, etc. Many ofthese attempts concern the axiomatization of imperative languages. LPT aims ataxiomatizing a pure functional language. One advantage of our approach is that
it is quite similar to ordinary logic; with only one additional logical primitive,
asserting the termination of a program, we can formulate practically almost all
properties of programs by means of the usual symbolism.
Similar and virtually the same formulations of LPT have been presented
by various authors independently and with di erent motivations (e.g., Fourman
1977; Scott 1979; Beeson 1981, 1985, 1986; Hayashi 1983, 1986; and Plotkin 1985).

20

Chapter 2(Fourman and Scott's logic is not a logic of partial terms but a logic of partial
existence. See 2.6 for a discussion of the di erence.) Their homogeneity would
be an evidence that LPT is the logic of partial terms. (See Moggi 1988 for an
extensive study on LPT.)

2.3.1. -expression and -convertibility

Before going into the axiom system, we will examine the role of -expression andthe de nition of -convertibility.
As we pointed out in 2.1, (x1 = e1 ; : : : ; xn = en )(fn) is almost equivalent
to(let ((x1 e1 ) : : : (xn en )) (function fn)):
It is evaluated to an S-expression as follows:
1. When fn is a function identi er, (x1 = e1; : : : ; xn = en )(fn) is evaluatedto a code of the function identi er fn.
2. When fn is (y1 ; : : : ; ym )(e), (x1 = e1 ; : : : ; xn = en)(fn) is evaluated to acode of the following function

 (y1 ; : : : ; ym)(let x1 = quote(v1 ); : : : ; xn = quote(vn ) in e)
where vi is the value of ei . (See 6.1 for code.) In the second case, when oneof e1 ; : : : ; en does not have a value, its value is unde ned. Then the value ofthe expression is unde ned.
It looks enough that introducing a syntactic constructor (fn) corresponding to (function fn) and de ning (x1 = en ; : : : ; xn = en)(fn) by let x1 =en ; : : : ; xn = en in (fn). But this contradicts to equality rule and our intended
semantics. Our intended semantics of (fn) is the value of a functional argument(function fn). So the value of (function fn) consists of a code of fn and its
environment. Let us show how this contradicts to simple (fn). By equality
axiom,
((x)(y)) = ((x)(y))
holds and y is a free variable of ((x)(y)). So, if we substitute fst (pair(0; 0))
and 0 for y of the left hand side and y of the right hand side, respectively, thenwe will have((x)(fst (pair(0; 0))) = ((x)(0));
for fst (pair(0; 0)) = 0 holds. But this does not holds, for the codes of the two
expressions (x)(fst (pair(0; 0))) and (x)(0) are di erent S-expressions(lambda (x) (fst (pair 0 0))) and (lambda (x) 0):

Chapter 2

21

By introducing (x1 = en ; : : : ; xn = en )(fn), we can avoid this problem.
Since all of free variables of fn of (x1 = en ; : : : ; xn = en)(fn) must appear amongx1 ; : : : ; xn , ((x)(y)) must be (y = y)((x)(y)). If we substitute fst (pair(0; 0)))
and 0 for y of ((x)(y)), then it becomes(y = fst (pair(0; 0)))((x)(y))
and(y = 0)((x)(y)):
Since fst (pair(0; 0)) is evaluated to 0 when(y = fst (pair(0; 0)))((x)(y))
is computed, the values of the both -expressions become the S-expression(lambda (x) (let ((y 0)) y)):The point is that all of free variables of the body fn of a -expression are boundby the -expression so that any substitution cannot be made for them.
A similar problem appears with respect to -convertibility of -expressions.
For example, the two -expressions ()((a)(a)), and ()((b)(b)) are not convertible, although they are expected to be so, since their values are di erent
S-expressions (lambda (a) a) and (lambda (b) b), respectively. So the bodies
of two -convertible -expressions must be identical. Thus, -convertibility of
expressions and functions are de ned as follows:

De nition 1 ( -convertibility)

1. Two constants (variables) are -convertible i they are identical.
2. Two expressions constructed by application or cond are -convertible i thecorresponding functions and subexpressions are -convertible.
3. let p1 = e1 ; : : : ; pn = en in e and let q1 = d1 ; : : : pn = dn in d are convertible i there is a substitution  such that(i) (a) = (b) i a = b, i.e.,  is bijective,(ii) ei and di are -convertible and pi  = qi , for each i = 1; : : : ; n,(iii) e and d are -convertible.
4. -convertibility of -functions is similarly de ned.
5. (x1 = e1 ; : : : ; xn = en )(fn) and (y1 = d1 ; : : : ; yn = dn )(gn) are convertible, i x1 ; : : : ; xn ; fn and y1 ; : : : ; yn ; gn are literally identical, respectively, and ei and di are -convertible for each i = 1; : : : ; n.
Since all the free variables of the body of a -expression are bound, no renaming ofbound variables of the function fn and the bound variables x1 ; : : : ; xn of (x1 =22

Chapter 2

e1 ; : : : ; xn = en )(fn) is done even if a substitution is made. So the above de nitionof -convertibility is consistent with renaming of variables by substitution.
The diculty we examined above is not so relevant to actual Lisp programming, for two functions closures are seldom compared by equal. Whenever we
do not care about equivalence of two function closures as S-expressions, we canneglect this problem. But for consistent axiomatization, we have to take care ofsuch a diculty as far as it may occur in principle, even if it may not be relevant
to actual programming activity.
The -convertibility of formulas is de ned as usual from the -convertibilityof expressions. Using the inference rule of (alpha) below, we may rename any
bound variables of a formula insofar as the result of renaming is -convertible tothe original one. So, when we make a substitution, we may assume that renamingsof bound variables are automatically done. The formula obtained by substituting
e1 ; : : : ; en for variables x1 ; : : : ; xn of A is denoted by A[e1 =x1 ; : : : ; en =xn ].

2.3.2. Axioms for programs and primitive predicates

The following give the basic axioms and inference rules about programs and primitive predicates. Although they are stated for a xed algorithmic language, they
may be regarded as a general formalization of an axiomatic recursion theory. The
key of our axiom system is the treatment of the -expression. Our -expression isessentially the same as the -notation of Kleene 1952, and it is another descriptionof the Snm function, which is the key to the axiomatization of recursion theory.
(See Friedman 1971 for axiomatic recursion theory.)
The axioms and rules are presented in natural deductive form. Our notation
for natural deduction is slightly di erent from the usual one. We use sequents topresent a theorem in a natural deduction. For example, the fact \F is derivablefrom the assumptions A1 ; : : : ; An " is expressed in such a way that fA1 ; : : : ; An g )F is derivable. The right hand side of a sequent is a single formula and the left
hand side is a set of a formula. So we do not need any structural inference suchas permutations of assumptions. The formulas of the left hand side of a sequent
are called the assumptions and the right hand side is called the conclusion. Eachinference rule is displayed as

S1 ; : : : ; Sn ;S
where S1 ; : : : ; Sn ; S are sequents. S1 ; : : : ; Sn are called the upper sequents of therule and S is called the lower sequent. We will sometimes call the upper sequentsthe premises. Sometimes the rules will be displayed as S1 ; : : : ; Sn =S to save space.
Note that some inference rules does not have upper sequents, i.e., S1 ; : : : ; Sn areabsent. Then the lower sequent of the rule is called an initial sequent and the rule

Chapter 2

23

is displayed by the initial sequent S instead ofS
Axioms are initial sequents without assumptions and they are displayed as a single
formula. All of the inference rules in this subsection 2.3.2 are axioms except (= 4).
(assume) and (>) of 2.3.3 are initial sequents.
Now we display the axioms and rules. In the following, a; b; a1; : : : ; an standfor total variables, e; e1; : : : ; en; d1 ; : : : ; dn stand for expressions, p1 ; : : : ; pn standfor patterns, and fn stands for a function.
(E 1)

E (e) (e is a constant or a total variable)(E 2)Class(e)  E (e)(E 3)[e1 ; : : : ; en;1 ] : en  E (ei ) for i = 1; : : : ; n(E 4)

E (fn(e1 ; : : : ; en))  E (e1 ) ^ : : : ^ E (en )(E 5)

E (e1 ) ^ : : : ^ E (en )  E ((v1 = e1 ; : : : ; vn = en )(fn))(Class1)

Class(e) (e is a class constant of a class variable)(Class2)[e1 ; : : : ; en] : e  Class(e)

(= 1)

e=e

(= 2)

e1 = e2  e2 = e1(= 3)

(E (e1 ) _ E (e2 )  e1 = e2 )  e1 = e2(= 4); ) P [e1 =a]  ) e1 = e2
; [  ) P [e2=a]24Chapter 2

a = b _ :a = b(= 5)(app) Let  be the substitution [a1 =v1 ; : : : ; an =vn ]. Then the following are axioms:

app((v1 = a1 ; : : : ; vn = an )(fn); list(e1; : : : ; en )) = (fn)(e1 ; : : : ; en )app((v1 = a1 ; : : : ; vn = an )(fn); e1 ; : : : ; en ) = (fn)(e1 ; : : : ; en )(beta) E (e1 ) ^ : : : ^ E (en )  ((v1 ; : : : ; vn )(e))(e1 ; : : : ; en ) = e[e1 =v1 ; : : : ; en =vn ](cond)

cond(e1 ; d1 ; : : : ; en ; dn ) = a  e1 ! a = d1 ; : : : ; en ! a = dn ; t ! a = nil(let) For each a not belonging to FV (p1 ) [ : : : [ FV (pn ), the following is an axiom:(let p1 = e1 ; : : : ; pn = en in e) = a  rp1 = e1; : : : ; pn = en:e = a
By the axioms (= 1), (= 3), we see our equality is Kleene's equality insteadof the equality de ned as both sides having the same value. For example, if e1 ande2 are unde ned, then e1 = e2 holds by the axiom (= 3). (= 5) says the equality
is decidable for total variables, i.e., values.
The axiom (beta) is call-by-value -conversion. The axiom (E 4) ensures that
our computation rule for application is call-by-value.
The value of an expression e can be characterized by determining the extension of the set faje = ag. This is the way by which we characterized the valuesof let and cond expressions above. This gives a way of proving equations. If theextensions of faje1 = ag and faje2 = ag are extensionally equal, then e1 = e2
holds. Indeed, the following proposition holds.
Proposition 1. In PX we can prove that e1 = e2 holds i

8 a:(e1 = a  e2 = a)holds, where a must appear neither in e1 nor in e2 . Furthermore, the characterization of an equation by this condition is equivalent to the axiom (= 3) under theother axioms.
Proof. Assume e1 is de ned. Then we can instantiate the variable a by e1 by (8E )below. Hence e1 = e1  e2 = e1 holds. By (= 1) and (= 2), we see e1 = e2 .
Similarly, we prove e1 = e2 from E (e2 ). Hence e1 = e2 holds by (= 3). The
other direction is trivial. Let us derive (= 3) from this characterization. Assume

Chapter 2

25

E (e1 ) _ E (e2 )  e1 = e2 holds. Assume e1 = a holds. Then e1 is de ned since a istotal. So e1 = e2 holds. By the transitivity of =, we see e2 = a holds. Similarly,
we can prove the other direction of the condition. So e1 = e2 holds.
Note the set faje = ag has at most one element, and e is de ned (or total)

i it has an element. Such a set may be thought as the \partial extension" or the\partial value" of the expression e as in Fourman 1977 and Scott 1979. It would
be a good exercise to derive some properties of let and cond from the axioms.
As was noted in the previous sections, we can prove Kleene's second recursion
theorem from these axioms.
Proposition 2 (recursion theorem). Let y; x1 ; : : : ; xn be total variables.
Assume e is an expression whose free variables are among them. Then there is a
closed expression such that E ( ) and the following equation are derivable fromthe above axioms:app( ; x1 ; : : : ; xn ) = e( ; x1 ; : : : ; xn ):Proof. The proof is essentially the same as the proof of the second recursion
theorem in Kleene 1952. The point of the proof was the construction of Snm
functions, which freeze m variables of m+n-ary functions with m values. Since our is an optional freezing function closure mechanism, we can de ne Snm functions.
For simplicity, we assume n = 1. Set
s11 = (z; y):((x1 ):app(z; y; x1 ));f = ((y; x1 ):e(s11 (y; y); x1 )):By (E 5), E (f ) holds and f is a closed expression. Let be the closed expression
s11 (f; f ). Then, by (beta) and (E 5), E ( ) holds. The equation is derived as follows:app( ; x1 ) = app((z = f; y = f )((x1 ):app(z; y; x1 )); x1 )= app(f; f; x1 )= app(((y; x1 ):e(s11 (y; y); x1 )); f; x1 )= e(s11 (f; f ); x1 ):To show how we can de ne a recursive function as an application of the above
proposition, we will de ne append. Let e(y; x1 ; x2 ) becond(x1 ; pair(fst (x1 ); ((a; b):app(y; a; b))(snd(x1 ); x2 )); t; x2 ):Take as in the above proposition. Let append be (a; b):app( ; a; b). Then thefollowing de ning equation of append is provable by the above proposition.
append(x1 ; x2 ) = cond(x1 ; pair(fst (x1 ); append(snd(x1 ); x2 )); t; x2 ):26

Chapter 2

2.3.3. Rules for the usual logical symbols

The rules of this subsection are the more or less usual rules of logical inference. The
variable condition must holds for (8I ); (9E ) below as usual. In (8I ), the variablesof ~v1 ; : : : ;~vn must not appear in ; ;f~v1 : e1 ; : : : ;~vn : en g as free variables. In (9E ),any formula of  ; fA;~v1 : e1 ; : : : ;~vn : en g does not have variables of ~v1 ; : : : ;~vn
as free variables.
(alpha) and (replacement) below are considered as derived rules in the usual
setting. But they are included as basic inference rules on purpose, since therealizers associated with the rules in the next section are di erent from the realizersof the derived rules by means of the other rules. The role of (replacement) issimilar to the role of the consequence rule of Hoare logic and a rule of subtype
concept of Constable et al. 1986. See 4.2 and 4.6.
(assume)fAg ) A

(>)

;)>

(?)

;)?
;)A

(thinning);)A;[) A(inst) Let x1 ; : : : ; xm be total variables, y1 ; : : : ; yn be class variables, z1; : : : ; zp be
partial variables, and  be a substitution de ned by[e1 =x1 ; : : : ; em =xm ; em+1=y1 ; : : : ; em+n =yn; em+n+1 =z1 ; : : : ; em+n+p =zp]:
Then the following is a logical inference:;)A1 ) E (e1 ) : : : m ) E (em )m+1 ) Class(em+1) : : : m+n Class(em+n); [ 1 [ : : : [ m [ m+1 [ : : : [ m+n ) A
(cut);)A )B; [ ( ; fAg) ) B

Chapter 227(alpha) If ; and , and A and B are -convertible to each other, respectively,
then the following is an inference rule:;)A)B(replacement) For any context A[] and rank 0 formulas B and C , the following
is an inference rule:; ) A[B ]+  ) EnvA[] [B  C ] ; ) A[C ];  ) EnvA[] [B  C ];; [  ) A[C ]+; [  ) A[B ];(^I );1 ) A1 : : : ;n ) An
;1 [ : : : [ ;n ) A1 ^ : : : ^ An(^E ); ) A1 ^ : : : ^ An (fi ; : : : ; i g  f1; : : :; ng)
1m; ) Ai1 ^ : : : ^ Aim(_I ); ) Ai; ) A1 _ : : : _ Ai;1 _ Ai _ Ai+1 _ : : : _ An(_E ); ) A1 _ : : : _ An 1 ) C; : : : ; n ) C; [ 1 ; fA1 g [ : : : [ n ; fAn g ) C( I );)B; ; fAg ) A  B( E );)AB )A
;[)B

(:I )

;)?
; ; fAg ) :A(:E ); ) :A  ) A
;[)?

28

(8I )

Chapter 2;)A; ; f~v1 : e1 ; : : : ;~vn : en g ) 8~v1 : e1 ; : : : ;~vn : en :A(8E ) Let ~vi be a tuple variable of the form [xi1 ; : : : ; ximi ] for each i = 1; : : : ; n, let
y1 ; : : : ; yp be the free class variables of ~v1 ; : : : ;~vn , and let  be the substitution
de ned by[e11 =x11 ; : : : ; e1m1 =x1m1 ; : : : ; en1 =xn1 ; : : : ; enmn =xnmn ]:Then the following is an inference rule:; ) 8~v1 : e1 ; : : : ;~vn : en :A1 ) [e11 ; : : : ; e1m1 ] : e1 : : : n ) [en1 ; : : : ; enmn ] : en1 ) Class((y1 )) : : : p ) Class((yp )); [ 1 [ : : : [ n [ 1 [ : : : [ p ) A
(9I ) Let ~v1 ; : : :~vn ; y1 ; : : : yp and  be the same as above. Then the following is aninference rule:; ) A1 ) [e11 ; : : : ; e1m1 ] : e1 : : : n ) [en1 ; : : : ; enmn ] : en1 ) Class((y1 )) : : : p ) Class((yp )); [ 1 [ : : : [ n [ 1 [ : : : [ q ) 9~v1 : e1 ; : : : ;~vn : en :A(9E ); ) 9~v1 : e1 ; : : : ;~vn : en :A  ) C; [  ; fA;~v1 : e1 ; : : : ;~vn : en g ) C

2.3.4. Rules for r and !

Each of the two logical symbols r and ! has two elimination rules and two
introduction rules. Each of the eight rules corresponds to a rule of ^,_,8, or 9 asindicated in the name of the rule like (! _I ). The rules (r9E ) and (r8I ) haveto satisfy the variable conditions. In (r9E ), the variables of p1 ; : : : ; pn must notappear in the following
 ; fA; exp(p1 ) = e1 ; : : : ; exp(pn ) = en ; E (e1 ); : : : ; E (en )g ) C
as free variables. In (r8I ), the variables of p1 ; : : : ; pn must not appear in thesequent; ; fexp(p1) = e1 ; : : : ; exp(pn ) = en ; E (e1 ); : : : ; E (en )gChapter 2

29

as free variables. Furthermore, free variables of e1; : : : ; en must not appear in thepatterns p1 ; : : : ; pn .
Now we state the inference rules for ! and r.
;1 ) e1 = nil : : : ;i;1 ) ei;1 = nil ;i ) ei : T ;i+1 ) Ai(! _I )
;1 [ : : : [ ;i+1 ) e1 ! A1 ; : : : ; en ! An(! _E ) Let Si be fe1 = nil; : : :; ei1 = nil; ei : T g for each i = 1; : : : ; n. Then thefollowing is an inference rule:; ) e1 ! A1 ; : : : ; en ! An 1 ) C : : : n ) C; [ 1 ; (fA1 g [ S1 ) [ : : : [ n ; (fAn g [ Sn ) ) C(! ^I ) Let Si be the same as the above. Then the following is an inference rule:;1 ) A1 : : : ;n ) An  ) Sor (e1 ; : : : ; en) [ ;1 ; S1 [ : : : [ ;n ; Sn ) e1 ! A1 ; : : : ; en ! An(! ^E )

(r9I ); ) e1 ! A1 ; : : : ; en ! An1 ) e1 = nil : : : i;1 ) ei = nil i ) ei : T; [ 1 [ : : : [ i ) Ai
; ) A1 ) exp(p1 ) = e1 : : : n ) exp(pn ) = en
1 ) E (e1 ) : : : n ) E (en ); [ 1 [ : : : [ n [ 1 [ : : : [ n ) rp1 = e1 ; : : : ; pn = en :A; ) rp1 = e1 ; : : : ; pn = en :A  ) C(r9E ) ; [ ( ; fA; exp(p1 ) = e1 ; : : : ; exp(pn ) = en ; E (e1 ); : : : ; E (en )g) ) C(r8I );)A1 ) exp(p1 ) = e1 : : : n ) exp(pn ) = en
1 ) E (e1 ) : : : n ) E (en ); ; fexp(p1 ) = e1 ; : : : ; exp(pn ) = en; E (e1 ); : : : ; E (en )g[ 1 [ : : : [ n [ 1 [ : : : [ n ) rp1 = e1; : : : ; pn = en:A
(r8E ); ) rp1 = e1 ; : : : ; pn = en :A1 ) exp(p1 ) = e1 : : : n ) exp(pn ) = en
; [ 1 [ : : : [ n ) A30

Chapter 2

These rules characterize the conditional formula and the r-quanti er. Let be the formula(e1 : T ^ A1 )_(e2 : T ^ e1 = nil ^ A2 )_ :::_(en : T ^ en;1 = nil ^ : : : ^ e1 = nil ^ An ):Then, by the rules (! _I ), (! _E ), we can prove e1 ! A1 ; : : : ; en ! An is logi-

cally equivalent to the formula . So these rules gives a complete characterizationof the conditional formula as a disjunctive formula. On the other hand, (! ^I ),(! ^E ) fail to characterize the conditional formula as conjunctive formula. The
intended conjunctive meaning of the conditional formula isSor (e1 ; : : : ;en )^(e1 : T  A1 ) ^ (e2 : T  e1 = nil  A2 )^ :::^(en : T  en;1 = : : : = e1 = nil  An ):But the above two conjunctive rules fails to imply the fact Sor(e1 ; : : : ; en ) is anecessary condition of the conditional formula. But, by the aid of the disjunctive
rules for !, we can prove that the conditional formula is logically equivalent tothe above conjunctive formula. We can derive the conjunctive rules for ! by the
disjunctive rules for !. But it is more natural to include them as primitive rules.
Note that we used Sor(e1 ; : : : ; en ) in the premises of (! ^I ). Since the \serialor" Sor itself is a conditional formula, we may apply the rules of ! to it.
The situation is completely the same in the case of the r-quanti er. Our
intended existential representation and universal representation of the formularp1 = e1 ; : : : ; xn = en :A are as follows:

9~x:(exp(p1 ) = e1 ^ : : : ^ exp(pn ) = en ^ A);}9~x:(exp(p1 ) = e1 ^ : : : ^ exp(pn ) = en )^8~x:(exp(p1 ) = e1  : : :  exp(pn ) = en  A);
where ~x is the sequence of variables FV (p1 ) [ : : : [ FV (pn ).

The following lemma will be used to prove the soundness theorem of pxrealizability in 3.1.
Lemma 1. Assume a formula A is strict with respect to a variable x, i.e.,A[e=x] ) E (e) holds. Then the following holds in PX:

Chapter 2

31(1) A[let p = e1 in e2 =x] i rp = e1 :A[e2 =x],
(2) A[cond(e1 ; d1 ; : : : ; en ; dn )=x] i e1 ! A[d1 =x]; : : : ; en ! A[dn =x],
(3) When x does not belong to FV (ei ) for i = 1; : : : ; n,(e1 ! A1 ; : : : ; en ! An )[cond(e1 ; d1 ; : : : ; en ; dn )=x]ie1 ! A1 [d1 =x]; : : : ; en ! An [dn =x]:

Proof. (1) Assume A[let p = e1 in e2 =x] holds. By the strictness condition,
we see E (let p = e1 in e2 ). By renaming bound variables, we may assume thepattern p does not have a free occurrence x, so exp(p)[e2 =x] = exp(p). Hence, by
substituting let p = e1 in e2 for a of (let), we see rp = e1 :(e2 = let p = e1 in e2 )holds. Hence, by (r8E ) and (= 4), we can derivefA[let p = e1 in e2 =x]; exp(p) = e1 g ) A[e2 =x]:
By (r8I ), the only-if part of (1) is derived from this sequent. The variableconditions may be assumed to hold by renaming variables of the patterns by theaid of (alpha). The if part is similarly proved.
(2) Assume A[cond(e1 ; d1 ; : : : ; en ; dn )=x] holds. Then

E (cond(e1 ; d1 ; : : : ; en ; dn ))holds. Hence, by substituting cond(e1 ; d1 ; : : : ; en; dn ) for a of (cond), we see

e1 ! cond(e1 ; d1 ; : : : ; en ; dn ) = d1 ; : : : ; en ! cond(e1 ; d1 ; : : : ; en; dn ) = dnholds. If e1 = nil; : : :; ei;1 = nil; ei : T hold, then, by (! ^E ),cond(e1 ; d1 ; : : : ; en ; dn ) = diholds, hence A[di =x] holds. By (! _I ), we see

e1 ! A[d1 =x]; : : : ; en ! A[dn =x]:
Hence, by (! _E ), we see the only-if part of (2) holds. The if part is similarly
proved.
(3) This is proved from (2) by the aid of the rules for !.

32

Chapter 2

2.3.5. Axioms for the modal operator(}1)::A  }A(}2)

8~x1 : e1 ; : : : ; ~xn : en :}F  }8~x1 : e1 ; : : : ; ~xn : en :F(}3)

A  }A ( A is a rank 0 formula)

The modal operator } is just double negation. So (}2) is the principle ofdouble negation shift (Troelstra 1973). By these axioms, we see that if we restrict
formulas to rank 0 formulas, then the logic of PX is classical, i.e., the following
proposition holds.
Proposition 3. A sequent ; ) A is provable in PX+(classical logic) i ; ) }A
is provable in PX. Especially, PX+(classical logic) is a conservative extension of
PX over rank 0 formulas.
Proof. Assume ; ) A is provable in PX+(classical logic). This means ; )A is provable from the additional initial sequents of the form f g ) F _ :Fand the rules and axioms of PX. Then there are formulas A1 ; : : : ; An such that; [ f8~x1 :(A1 _ :A1 ); : : : ; 8~xn :(A1 _ :An )g ) A is provable in PX, where ~xi isthe sequence of all total variables of Ai . This is not so trivial as in the usual
logic, since f g ) F _ :F is not always equivalent to f g ) 8~x(F _ :F ) for F
may have free partial variables which cannot be quanti ed. But this is provedby a straightforward induction on the length of the proof by the fact that all
eigenvariables of the rules with variable conditions, i.e., (8I ), (9E ), (r8I ), and(r9E ), are total variables. We leave the proof to the reader.
In general, if ; [  ) A is provable, then ; [ f::B jB 2 g ) ::A
is derivable from it only by (:I ) and (:E ). On the other hand, the theorem
8~xi :::(Ai _ :Ai ) is provable in intuitionistic predicate logic.
By (}1) and (}2), we can derive ::8~xi :(Ai _ :Ai ). Hence, we see ; ) }A
is provable. The other direction is trivial. By (}3), PX+(classical logic) is aconservative extension of PX over rank 0 formulas. (Note that (}2) is equivalent
to ::8~x(A _ :A).)
By the above proposition, we may prove rank 0 formulas by classical reasoning. This means that parts of proofs concerning rank 0 formulas do not haveany e ects on the programs extracted from the proofs. In actual proof building,we often assume rank 0 lemmas without proof, if their validity is mathematically
clear.

Chapter 2

33

In the actual implementation, we do not have the above axioms, but wehave a tautology checker which checks if a rank 0 formula is derivable from asubsystem of classical rst order logic. Although this is essentially a tautology
checker of classical propositional logic, the above axioms are proved by it (see7.2.4). These axioms can also be proved with the aid of the EKL translator (see7.4).
As an application of proposition 3, we will show that PX can derive a formof Markov's principle (see Troelstra 1973). Computer scientists call the principle\Dijkstra's linear search". It reads
If one has a procedure deciding if P (n) holds for each n 2 N and one knows::9x 2 N:P (n), then one can nd n0 2 N such that P (n0 ).
A logical formulation of the principle is

8n 2 N:(P (n) _ :P (n)) ^ ::9n 2 N:P (n)  9n 2 N:P (n):We prove a weaker version of (MR). Let f be a function of PX such that(A)
PX ` 8x : N; y : N:E (f (x; y)):(MR)

Then Markov's principle for f is stated as(MRf )

fx : N; }9y : N:f (x; y) : T g ) 9y : N:f (x; y) : T:

De ne functions minf , g byminf (x) = g(x; 0); g(x; y) = cond(f (x; y); y; t; g(x; y + 1)):
Resorting classical logic and (}1), we can prove the following by (A):fx : N; }9y : N:f (x; y) : T g ) ry = minf (x):f (x; y) : T:
Since the conclusion of this sequent is of rank 0, this is provable in PX by proposition 3 and (}3), and (MRf ) is derivable from this.

2.3.6. Miscellaneous axioms

The axioms of this subsection are not so essential. Some of them are even optional,
and others depend on the DEF system on which PX is based (see 7.2.6). The
actual PX system has a data base of minute axioms with query functions by which
a user can ask the system if his intended formulas belong to the data base. Allaxioms in this subsection except (def ), (N 5), (V 4) can be proved from the axioms

34

Chapter 2of the data base. (These three axioms are generated by other functions.) In thissubsection , , ; : : : are metavariables for objects, and a,a1 ,: : : ; b,b1 ; : : : are total
individual variables.
(constant)quote( ) = quote( ) ( = );:quote( ) = quote( ) ( 6= );t = quote(t); nil = quote(nil); 0 = quote(0);quote( ) : Atm ( 2 Atom);quote(( : )) = pair(quote( ); quote( ));quote( + 1) = suc(quote( )) ( 2 N ):(def ) For each de nition f1 (~v1 ) = e1 ; : : : ; fn (~vn ) = en of the DEF system, thefollowing are axioms:
f1 (~v1 ) = e1 ; : : : ; fn (~vn ) = en(totality)

E (atom(a)); E (equal(a; b)); E (pair(a; b)); E (list(a1 ; : : : ; an ))(char) atom(a) = t  a : Atm; equal(a; b) = t  a = b; a : T  :a = nil
(N 1)
(N 2)

0 : N; 8a : N:suc(a) : N

8a : N:prd (suc(a)) = a; 8a : N:(:a = 0  suc(prd (a)) = a)(N 3)

8X:(0 : X ^ 8a : X:suc(a) : X  8a : N:a : X )(V 1)

E (e)  e : V(V 2)

fst (pair(a; b)) = a; snd(pair(a; b)) = b;:a : Atm  pair(fst (a); snd(a)) = a(V 4)

8X:(8a : Atm:a : X ^ 8a : X; b : X:pair(a; b) : X  8a : V:a : X ):

Chapter 235

2.4. Classes: data types as objects
A class is a code of a set of objects. Classes and axioms on them play very
important roles in PX in two ways. For one thing, we can de ne various kindsof data types as classes including dependent types in the sense of Martin-Lof.
Since a class is a code of a set, we can program various operations on types. So
data types are rst class objects and the type discipline of PX is close to thoseof the typed languages Russell and Pebble, although it does not have the type ofall types. For another, the induction principles for the inductively de ned classes
are quite useful for representations of recursions called CIG recursions and their
domains of terminations are also representable by classes. Besides these, classis useful in characterizing the values of expressions and graphs of functions. In
2.4.3, we will show how to axiomatize the minimality of the graph of a recursively
de ned function by using the induction principle of CIG inductive de nition.
The axioms on classes are divided into two groups. One group contains theaxioms of conditional inductive generation (CIG), which maintains the existenceof a particular kind of inductively de ned sets. The other contains the axioms ofdependent types, which maintains the existence of dependent types in the sense ofMartin-Lof. The former is described in 2.4.1, and the latter is described in 2.4.2.

2.4.1. CIG: conditional inductive generation
CIG is a generalization of inductive generation (IG) of Feferman 1979. CIG plays
many important roles in PX. In fact, CIG is the \heart" of PX. For one thing, CIG
is a method by which we can de ne various classes, including Cartesian products,
function spaces, and various recursive data types. For another, it is a device forrepresenting fairly wide groups of recursions through proof rules associated withrecursively de ned classes (see chapter 4). In fact, we can derive all recursivefunctions in PX via CIG. It also provides a way to formulate our version of xed
point induction (see 2.4.3).
The principle of CIG is quite similar to recursive de nitions of types and theirrules of Nuprl (Constable and Mendler 1985). Although their recursively de ned
types also include re exive domains, induction rules are given only to the types
de ned by the positive recursive de nition forms. So the proof rules of Nuprl arevery closed to the proof rules of CIG.
First, we will give a simpli ed formulation of CIG, to which we will give amathematical semantics in 6.3. Later we will give a more realistic formulation. In
the following, variables X~ = X0 ; : : : ; Xn are always class variables.

De nition 1 (CIG templates). Formulas are called CIG templates with re-

36

Chapter 2

spect to X~ and n0 , CIGn0 (X~ ) for short, are generated by the following grammar:

H ::=E (e)jPC je = ej>j?
jH ^ : : : ^ H je ! H ; : : : ; e ! H j}P jK  H j:K
j8CV; : : : ; CV:H jrp = e; : : : ; p = e:H
P ::=H jP ^ : : : ^ P je ! P ; : : : ; e ! P jK  P jP _ : : : _ P
j8CV; : : : ; CV:P j9CV; : : : ; CV:P jrp = e; : : : ; p = e:P
K ::=E (e)jKC je = ej>j?
jK ^ : : : ^ K jK _ : : : _ K je ! K ; : : : ; e ! K j}K jP  K j:P
j8CV; : : : ; CV:K j9CV; : : : ; CV:K jrp = e; : : : ; p = e:K
PC ::=[e1 ; : : : ; en0 ] : X0 j[e; : : : ; e] : X1 j : : : j[e; : : : ; e] : Xn j[e; : : : ; e] : C
KC ::=[e; : : : ; e] : X1 j : : : j[e; : : : ; e] : Xn j[e; : : : ; e] : C
CV ::=~x : X1 j : : : j~x : Xn j~x : C
where H ranges over CIGn0 (X~ ), e; e1 ; :: range over expressions in which X0 does
not occur, p ranges over patterns, C ranges over class constants, and ~x ranges
over tuples of individual variables. Note that the length of the argument tuple ofX0 must be n0 . P (K ) ranges over formulas in which [e1 ; : : : ; en0 ] : X0 appears
only positively (negatively).
It is possible to extend the de nition of CV so that a formula like

}9x1 ; : : : ; xn0 : X0 :H
is a CIG template, too. But we do not do so, in order to avoid the complicationof substituting a formula for X0 . Instead, it must be written as}9x1 ; : : : ; xn0 :([x1 ; : : : ; xn0 ] : X0 ^ H ):This de nition of CIG templates is not very useful to humans. The following
is an equivalent and more recognizable de nition.
De nition 2 (another de nition of CIG templates). A formula H is a
CIG template of CIGn0 (X~ ) i it satis es the conditions:Chapter 2

37(1) H is a rank 0 formula.
(2) If a subformula of H has the form [e1 ; : : : ; en] : en+1 , then en+1 must be aclass constant or belong to X~ and e1; : : : ; en have no occurrence of X0 . Furthermore, if en+1 is X0 , then the entire subformula must occur in a positive
part of H and n is n0 . If a subformula of H has the form E (e), then e has
no occurrence of X0 . If a subformula of H has the form e1 = e2 , then e1 ande2 have no occurrence of X0 .
(3) For any subformula of the form 8~x1 : e1 ; : : : ; ~xn : en :F , ~x1 ; : : : ; ~xn are tuplesof individual variables and ei is an element of X~ or a class constant. Similarly
for the existential quanti er and the r-quanti er.
(4) H has no occurrence of the predicate symbol Class.
The important point is that the condition (1) maintains every CIG template isa rank 0 formula. It is possible to drop the restriction that CIG templates areof rank 0 (see Feferman 1979 and Tatsuta 1987). We put the restriction so thatclasses have no hidden information. See 2.6.2 for a discussion.
For each A 2 CIGn (X~ ) and variables ~a = a1 ; : : : ; an , we assume that there isan expression X0 f[~a]jAg, whose free variables are just FV (A) ;fX0; a1 ; : : : ; an g.
This expression is called a class expression. We will often abbreviate X0 f[~a]jAg toX0 f~ajAg. For example, X0 f[a1 ; a2 ]jAg will be abbreviated to X0 fa1; a2 jAg.
The class expression stands for the smallest xed point of the monotone map\X0 7! f~ajAg". So the following are axioms:(CIG def )Class(X0f~ajAg); r[a1 ; : : : ; an ] = x:A[X0 f~ajAg=X0]  x : X0 f~ajAg:
If X0 does not appear in A, we write f~ajAg. Then this class notation is thesame as the usual set notation. The inductive de nition of X0 f~ajAg is called CIG
inductive de nition. The induction rule for the inductive de nition of X0 f~ajAg,
called CIG induction is(CIG ind); ) F (~a)
f[~a] : X0 f~ajAgg [ ; ; fA[F (~a)=X0 ]; A[X0 f~ajAg=X0]g ) F (~a) ;where the variables of ~a must not be free variables of; ; fA[F (~a)=X0 ]; A[X0 f~ajAg=X0]g:
We substituted a formula F (~a) for a class variable X0 . This means replacing
all of the subformula of the form [e0 ; : : : ; en ] : X0 by F [e0 =a1; : : : ; en =an] andsubstituting the class expression X0 f~ajAg for the other occurrences of X0 .

38

Chapter 2

Note that we have not introduced an expression constructor for the classnotation X0 f~ajAg. If we introduced such a constructor, then we would have tode ne expressions and formulas simultaneously. It is possible to conceive of theintroduction of such a constructor as natural; in fact, Feferman and Martin-Loftook this approach. But we take another approach. Let  be the set~ AijA 2 CIGn (X~ ) ^ fv1 ; : : : ; vm g = FV (A) ; fX0 ; a1 ; : : : ; an gg;
fh~a;~v; X;
where ~v is the tuple of variables v1 ; : : : ; vm . Since  is countably in nite, there
are one-to-one mappings from the set into the set

B ; fapp; app; list; atom; fst ; snd; pair; equal; suc; prd g:(Recall that B is a countably in nite set.) Fix one such mappings, say cigname.
Then the class expression X0 f~ajAg for A 2 CIGn (X~ ) is

~ Ai))(v1 ; : : : ; vm );(cigname(h~a;~v; X;
where ~v = v1 ; : : : ; vm . (We assume cigname is chosen such that the arity of~ Ai) is m.) The function names belonging to cigname() arecigname(h~a;~v; X;~ Ai) may occur
called class functions. Note that a function name cigname(h~a;~v; X;
in the CIG template A. In the implementation of PX, users can declare a function~ Ai) for each CIG template A. This
identi er for a name of cigname(h~a;~v; X;
re ects the above formal treatment of class functions.
CIG in the implementation of PX described in chapter 7 is more exible
than the version of CIG presented here in respect to the following:(0) Simultaneous de nitions of classes are available.
(1) If e is an expression whose class variables belong to X1 ; : : : ; Xn (X0 not
allowed) and is con rmed to be a class by a speci c algorithm, then not only
[e1 ; : : : ; en] : Xi+1 but also [e1 ; : : : ; en ] : e is allowed as H and K in thegrammar of CIG templates.
(2) For a class whose body of de nition is a conditional formula, a more convenient form of CIG induction is available.
(3) A class may be speci ed as a superclass of the class to be de ned.
In the implementation of PX, classes can be de ned through the declarations
as the de nition of functions in Lisp systems. Let us explain the extended CIG
in terms of a declaration. For each i = 1; : : : ; n, let Ci be an expression of theform fi (~ai ; A~ i ), where fi is the name of the class-valued function which is going
to be de ned. ~ai is a list of individual variables and A~ i is a list of class variables.
Note that both ~ai and A~ i may be empty lists. Then fi is a name of a class rather

Chapter 2

39than of a function. We assume f1 ; : : : ; fn are each di erent from one another. Let~xi (i = 1; : : : ; n) be a nonempty sequence of mutually di erent total individual
variables that do not appear in Ci . Then a generalized CIG template with respect
to ~x1 : C1 ; : : : ; ~xn : Cn is de ned by the grammar of CIGn0 (X~ ) that is modi ed
as follows:

PC ::= [e1 ; : : : ; eli ] : Cli j[e; : : : ; e] : 
KC ::= [e; : : : ; e] : 
CV ::= ~x : ;
where li is the length of ~xi and  is a class expression over A~ 1 ; : : : ; A~ n that isde ned by
1. A class constant is a class expression over A~ 1 ; : : : ; A~ n .
2. Class variables A~ 1 ; :::; A~ n are class expressions over A~ 1 ; : : : ; A~ n .
3. When g(b1 ; : : : ; bm0 ; B1 ; : : : ; Bm1 ) is a declared CIG de niens (see below),e1 ; : : : ; em0 is a list of expressions which have been certi ed to have values, and 1 ; : : : ; m1 is a list of class expressions over A~ 1 ; : : : ; A~ n . Theng(e1 ; : : : ; em0 ; 1 ; : : : ; m1 ) is a class expression. Note that the CIG de niensg(b1 ; : : : ; bm0 ; B1 ; : : : ; Bm1 ) must have been declared, so it must not be oneof the fi that is going to be de ned.
Then a declaration of C1 ; : : : ; Cn by a simultaneous CIG inductive de nition takes
the formdeCIG ~x1 : C1 D1 body1~x2 : C2 D2 body2(CIG dec):::~xn : Cn Dn bodyn :In this de nition,body ::= clause j clause ; bodyclause ::= expression ! CIG-templatelist:
CIG-templatelist stands for a non-empty list of CIG templates and D1 ; : : : ; Dn
are class expressions over A~ 1 ; : : : ; A~ n . C1 ; : : : ; Cn are called CIG de niens of thisdeclaration. The bodies of the de nition must satisfy the variable condition: allof free variables of bodyi and Di must appear among free variables of ~xi : Ci .
Let bodyi be

ei1 ! i1;1 ; : : : ; i1;q1i ; : : : ; eipi ! ipi ;1 ; : : : ; ipi ;qpi i :40Chapter 2

After the declaration of the classes is made, the following become axioms of PX:Class(Ci ) (i=1; : : : ; n)~xi : Ci  ~xi : Di ^ ei1 !

qi
^
1
1

j =1

1;j ; : : : ; eipi ; !

i

qpi
^
i

j =1

pi ;j (i=1; : : : ; n):

The induction principle for the classes is;11 ) F1 : : : ;1p1 ) F1 : : : ;n1 ) Fn : : : ;npn ) Fn;
Sn Spi ;fi ) Vn (~x : C  F )i
i=1 j =1 ji=1 i i

(CIG ind )where ;fij is the set;ij ; (f~xi : Di g
[ fei1 = nil; : : :; eij;1 = nil; eij : T g[ fij;1 [F1 =C1 ; : : : ; Fn =Cn ]; : : : ; ij;qji [F1 =C1 ; : : : ; Fn =Cn ]g[ fij;1 ; : : : ; ij;qji g);
where the substitution [F1 =C1 ; : : : ; Fn =Cn ] means replacement of every subformula[e1 ; : : : ; em ] : Ci by the formula Fi [e1 ; : : : ; em =~xi ].
We next give some examples of classes generated by CIG. For simplicity andreadability, we will use in x notations and the class (set) notation.
(1) Function space: The space of functions (programs) from X to Y is givenby
X ! Y = ff j8a : X:app(f; a) : Y g:
This is a space of unary functions; function spaces with more arguments are de ned
similarly. Note that the functions of this space are intensional. Even if X and Y
are equipped with equivalence relation RX and RY , functions of the space need notpreserve them. If fa; bja : X ^ b : X ^ RX (a; b)g and fa; bja : Y ^ b : Y ^ RY (a; b)gare classes, say EX and EY respectively, then the extensional function space canbe de ned by

X ! Y = ff j8[a; b] : EX :[app(f; a); app(f; b)] : EY g:
Then the extensional equality on the space is de ned in the obvious way, andit again de nes a class. So we can construct higher order extensional function

Chapter 2

41

spaces over it. We will see an application of such a construction of a hierarchy ofextensional function spaces in 5.2. The partial function space from X to Y is alsode nable:

X * Y = ff j8a : X:(E (app(f; a))  app(f; a) : Y )g:(2) Finite set: The enumeration type of Pascal or nite set is easily de ned
through \serial or" as follows:

fx1 ; : : : ; xn g = fajSor(equal(x1 ; a); : : : ; equal(xn; a))g:
For example, Bool is de ned by ft; nilg. Note that Sor() is ? by de nition. So
fg = faj?g is an empty class.
(3) Cartesian product: The Cartesian product of two classes is de ned by

X  Y = fa1 ; a2 ja1 : X ^ a2 : Y g:
Similarly, we can de ne n-times products. The 0-times product is f[ ]j>g, i.e., theclass fnilg. So the lifting of a type X in the sense of Plotkin 1985 is de ned as
fnilg * X .
(4) Disjoint sum: The disjoint sum or coproduct of two classes is de ned by

X + Y = fxjr(a : b) = x:(equal(a; t) ! b : X ; equal(a; nil) ! b : Y )g:
The fst part of the dotted pair speci es the class to which the snd part belongs.
Finite disjoint sum of any numbers of classes are de ned similarly. The in nite
disjoint sum will be introduced by the Join operator below.
(5) Propositional equality: The following is an implementation of the typeof propositional equality of Martin-Lof 1982. Its extension equals the extensionof the 0-times product fnilg when a = b : X , and is empty otherwise. Martin-Lofuses a constant r instead of nil.

I (X; a; b) = fxjx = nil ^ a = b ^ a : X ^ b : X g:(6) Lists: The class of lists List(X1) is de ned by CIG as

X0 fajatom(a) ! a = nil; t ! fst (a) : X1 ^ snd(a) : X0 g:

42

Chapter 2

Then the induction principle for List(X ) is
(List1)
where; ) A(a)fa : List(X )g [ ; ; fHYP 1; HYP 2g ) A(a) ;HYP 1  atom(a) ! a = nil; t ! fst (a) : X ^ A(snd(a));
HYP 2  atom(a) ! a = nil; t ! fst (a) : X ^ snd(a) : List(X ):By using the rules of conditional forms, we see that this is logically equivalent to
the induction principle; ) A(a)  ) A(a)(List2):0 f a : List(X ) g
1(a) : T; a = nil g
B@ [; ; f atom
 atom CA ) A(a)
(
a
)
=
nil;
fst
(
a
)
:
X;
[ ; snd(a) : List(X ); A(snd(a))
By means of (CIG dec), a function List can be declared as follows:

deCIG a : List(X ) atom(a) ! a = nil;t ! fst (a) : X; snd(a) : List(X ):Then the induction principle for it is (List2) rather than (List1). In general,(List2) is preferable to (List1), since it is simpler and natural. In fact a simpleminded extractor will extract a list-recursion program with some redundancies
from proofs using (List1), since some rules on conditional formulas are involvedin such proofs. On the contrary, the usual list-recursion scheme will be extracted
from proofs using (List2). However, the actually implemented extractor describedin 3.2 extracts the same code from the proofs using these two di erent rules, thanks
to optimizations. (See 3.2 and appendix C.)
List(X ) was the class of list including nil. Let us de ne the class of nonempty
lists. The superclass feature is convenient for this. Set

a : Dp = fajr(x : y) = a:>g
deCIG a : List1(X ) Dp snd(a) ! fst (a) : X; snd(a) : List1(X );t ! fst (a) : X:
The class de ned by this is(A)X0 faja : Dp ^ (snd(a) ! fst (a) : X ^ snd(a) : X0 ; t ! fst (a) : X )g:Chapter 2

43

Dp is the class of dotted pairs and it is to be a superset of List1(X ) so that alllists of the class are not nil. The induction principle (CIG ind) for List1(X ) is
(List3); ) A(a) ) A(a)f a :List1(X ) g: Dp; snd(a) : T; fst (a) : X;
[ ; ; asnd
) A(a)(a) : List1 (X ); A(snd(a))[( ; f a : Dp; snd(a) = nil; fst (a) : X g):(7) Natural numbers and S -expressions: There are a built-in classes N andV , but we cannot use full induction for them, since their induction principles (N 3)and (V 4) are restricted to classes. We cannot state an arbitrary formula for theclass variable X of the axioms. So we should de ne a class Nat as follows:

deCIG a : Nat equal(0; a) ! >;t ! prd (a) : Nat :Then the usual mathematical induction is the induction for Nat . On the other
hand, it is easy to prove N and Nat are extensionally equal, i.e., 8x:x : N  x :Nat . By the aid of the rule of (replacement), we may replace e : N by e : Nat .
So we may use the usual mathematical induction for N , or we may think of Nat
as N . The same technique is applied to the class V of S-expressions. In theimplementation of PX, N and V are treated in a special way so that the fullinductions are assigned in advance.
(8) Type of dependent conditional: The typing of a dependent conditional
expression like if x then 3 else pair(a; b) is a controversial subject (Burstall andLampson 1984, Cardelli 1986). The conventional solution of this problem is to
assume that two expressions after then and else have the same type, since thetyping of the general form of such an expression involves logical inference. PX is alogical system, so there is no reason to avoid the type (class) of such an expression.
De ne

Cond(e1 ; X1 ; : : : ; en ; Xn ) = faje1 ! a : X1 ; : : : ; en ! a : Xn g:
By lemma 1 of 2.3.4, we can derive the dependent conditional typing condition

cond(e1 ; d1 ; : : : ; en ; dn ) : Cond(e1 ; X1 ; : : : ; en; Xn ) e1 ! d1 : X1 ; : : : ; en ! dn : Xn :

44

Chapter 2(9) Tree ordinals: Well-founded trees which have elements of X1 as leaves
and branch 1 or @0 times at each node can be de ned as follows:
deCIG x : O(X1) equal(fst (x); 0) ! r(a b) = x:b : X1;
equal(fst (x); 1) ! r(a b) = x:b : O(X1 );equal(fst (x); 2) ! r(a b) = x:8n : N:app(b; n) : O(X1 )By iteration of this construction to N , we get the hierarchy of constructive tree
ordinals O(N ); O(O(N )); : : : as in Feferman 1979.
(10) Subexpression relation: The modal operator } provides an easy way touse disjunction and existential quanti ers in CIG templates. For example, we cande ne a class Sub so that [x; y] : Sub i x is a sub S-expression of y:deCIG [x; y] : Sub equal(x; y) ! >;atom(y) ! ?;t ! r(a : b) = y:}([x; a] : Sub _ [x; b] : Sub):One cannot infer [x; fst (y)] : Sub _ [x; snd(y)] : Sub from [x; y] : Sub immediatelyfrom the de nition, since the body of the de nition is \classicalized" by putting} in front of the disjunction in the third clause. One must resort to structural
induction on S-expressions to prove the inference. The following de nition ofsubexpression relation Sub1 with extra information r allows one to infer if x is in
the fst part or snd part of y from the information r:
deCIG [r; x; y] : Sub1 equal(x; y) ! r = 0;atom(y) ! ?;equal(fst (r); 1) ! [snd(r); x; fst (y)] : Sub1;
equal(fst (r); 2) ! [snd(r); x; snd(y)] : Sub1:

Then r which satis es [r; x; y] : Sub1 represents where x is in y. So by looking up
the fst part of r one can decide which x is in fst part or snd part of y. The extra
information r is essentially the realizer of [x; y] : Sub0, if Sub0 is a class de nedby an extended CIG inductive de nition through the de nition equation of Sub
deleting the modal operators. See 2.6.2 for further discussion.
(11) Programming on data types: Since a class is an object, we are free to program on data types (classes). For example, we can de ne a function vector(n; X )which returns the class of lists of X whose length is n by ordinary recursion from
Cartesian products such as

vector(n; X ) = cond(n = 1; X ; t; X  vector(n ; 1; X )):Chapter 2

45

An application of programming on data types is implementation of modules.
For example, an implementation of a module of stack by lists is given bystack(x) = list(List(x); (push); (pop); empty);
empty = nil;pop(s) = list (fst (s); snd (s));
push(a; s) = pair(a; s):Note that push, pop, and empty are polymorphic.
(12) Finitely generated CCC: We can de ne the class of classes generated by
given nite numbers of classes and class formation operators. For example theobjects of CCC (Cartesian Closed Category) generated from X1 ; : : : ; Xn is de nedby the CIG de nition

deCIG x : CCC (X1 ; : : : ; Xn)
equal(x; X1) ! >;:::equal(x; Xn) ! >;equal(x; fg) ! >;t ! }[9y; z:(x = y  z ^ y : CCC (X1 ; : : : ; Xn ) ^ z : CCC (X1 ; : : : ; Xn ))_9y; z:(x = y ! z ^ y : CCC (X1 ; : : : ; Xn ) ^ z : CCC (X1 ; : : : ; Xn ))]:The hom set from an object x to y is given by hom(x; y) = x ! y, the identity morphism is id = ((x):x), and composition is f  g = ((x):app(f; (app(g; x)))).
So a Cartesian closed category generated from X1 ; : : : ; Xn is given by a list
list(CCC (X1 ; : : : ; Xn ); (hom); id; ()). Note that the identity morphism andcomposition are polymorphic.

2.4.2. Axioms of Join and ProductIn almost all cases, CIG de nition is enough to implement useful data types asclasses. But PX has another kind of class formation method. We assume PX has
a basic function  whose arity is two, and the axiom(Join )
8a : A:Class(app(f; a)) Class((A; f )) ^ 8x:(x : (A; f )  r(a : b) = x:(a : A ^ b : app(f; a)))):

46

Chapter 2

This corresponds to Martin-Lof's dependent sum. Note that this does not maintain the existence of the union of the classes app(f; a) such that a : A. We cannot
prove existence of union in PX. See 2.6.2 for a discussion.
By the aid of this axiom and CIG, we can derive the existence of dependent
products (Beeson 1985). But, for symmetry, we introduce a class constructor and the axiom of dependent products:(Product)8a : A:Class(app(f; a)) Class((A; f )) ^ 8x:(x : (A; f )  8a : A:app(x; a) : app(f; a)):By these two dependent types and the types introduced in the previous section,
we can interpret an intensional version of Martin-Lof's type theory ML0 without
the type of well-orderings. It is quite easy to de ne the type of well-ordering by
CIG and Join. But, to model extensionality, we must work some more as did
Beeson 1985 and Smith 1984.
Another application of (Join ) is a class of implementations of data types.
This will be examined in 5.1.

2.4.3. Graph and value class: the minimal graph axiom
The axiom system of PX does not include any axioms which maintain the factthat a recursively de ned function is the minimal xed point of its de nition. It
seems that structural induction is sucient to prove properties of programs rather
than xed point induction, for a function is normally equipped with an intended
domain. So we do not include it as an axiom of PX. But, in this section, we willshow a way of axiomatizing it partly. In our formulation, xed point induction fora recursively de ned function is an instance of CIG induction for an inductively
de ned class that represents the graph of the function. Instead of introducing
a new induction principle for expressing the minimality of a recursively de ned
function, we introduce an axiom maintaining that an inductively de ned classconstructed from the function is extensionally equal to the graph of the function.
This formulation of xed point induction was inspired by Constable and Mendler
1985.
First we de ne the value class of an expression and the graph of a function.
The value class of an expression e is de ned by
Value (e) = fyje = yg:

The graph of a function f is de ned byGraph (f ) = fa1 ; : : : ; an ; bjf (a1 ; : : : ; an ) = bg:

Chapter 2

47

Let A; B be classes, then A =ext B is 8x:(x : A  x : B ). We say A and B areextensionally equal, when A =ext B holds. Then the following holds:
Value (fn(e1 ; : : : ; en ))=ext faj}9a1 : Value (e1 ); : : : ; an : Value (en ):[a1 ; : : : ; an ; a] : Graph (f )g;
Value (cond(e1 ; d1 ; : : : ; en ; d1 )) =extfaj}[9a1 : Value (e1 ):(a1 : T ^ a : Value (d1 ))_9a1 : Value (e1 ); a2 : Value (e2 ):(a1 = nil ^ a2 : T ^ a : Value (d2 ))
_
_

:::

9a1 : Value (e1 ); a2 : Value (e2 ); : : : ; an : Value(en ):(a1 = nil ^ a2 = nil ^ : : : ^ an : T ^ a : Value(dn ))]g

Value (let p1 = e1 ; : : : ; pn = e1 in e)=ext faj}9a1 : Value (e1 ); : : : ; an : Value (en ):(rp1 = a1 ; : : : ; pn = an :a : Value (e))g;
Graph ((a1 ; : : : ; an )(e)) =ext fa1 ; : : : ; an ; yjy : Value (e)g:By the aid of these equations a value class or a graph of any expressions orfunction can be decomposed into value classes and graphs of smaller expressions
and functions, as far as the outermost construct of the expression is an application,
cond, let, or an abstraction. So a value class of any expressions can be de nable by
the foregoing class notations from the value classes of -notations and the graphsof basic functions. We do not decompose the value class of a -notation that
depends on the implementation of interpreter, although it is possible. Assume
that f is a function de ned by a recursive de nition in DEFi+1 :(A)f (a1 ; : : : ; an ) = e:
The right hand side may include the function symbol f . So by the above equations,
we can construct a nested class notation Ce (a1 ; : : : ; an ; X0 ), considering X0 as thegraphs of f , from the graphs of functions in DEFi and the value class of notations so that
Ce (a1 ; : : : ; an ; Graph (f )) =ext Value (e):48

Chapter 2

Hence, the minimality of Graph (f ) can be stated by(MGA)

Graph (f ) =ext X0 fa1 ; : : : ; an ; xjx : Ce (a1 ; : : : ; an ; X0 )g:

We call this the Minimal Graph Axiom (MGA). Note that CIG induction for theclass of the right hand side is xed point induction for the recursive de nition of(A). Although (MGA) is not included in the basic axiom system of PX, it holds
in the standard semantics of PX. So it may or may not be included as an axiomof PX, as you like. Ocially, we do not include this as an axiom of PX.
To illustrate the above method, we will compute the graph of Morris's function (see Manna 1974, example 5-27):

f (x; y) = cond(equal(x; 0); 1; t; f (x ; 1; f (x; y))):Let us denote the right hand side of this equation by e and let X0 be the graphof the function f . Then Ce (x; y; X0 ) is denoted byZero (x) = fajequal(x; 0) ! a = t; t ! a = nilg;
Value (cond(equal(x; 0); 1; t; f (x ; 1; f (x; y))))=ext faj}[9a1 : Zero (x):(a1 : T ^ a = 1)_

9a1 : Zero (x); a2 : ftg:
(a1 = nil ^ a : Value (f (x ; 1; f (x; y))))]g;
Value (f (x ; 1; f (x; y))=ext faj}9a1 : fx ; 1g; a2 : fa2j[x; y; a2 ] : X0 g:[a1 ; a2 ; a] : X0 g:
Then by means of the properties of conditional formulas and modal operator, we
see

(B)

Ce (x; y; X0 )=ext fajequal(x; 0) ! a = 1;
t ! }9a2:([x; y; a2 ] : X0 ^ [x ; 1; a2 ; a] : X0 )g:

Let ; be the empty class fx; y; z j?g. Then the rst approximation of the graphis given by
G0 = fx; y; z jz : Ce (x; y; ;)g= fx; y; z jequal(x; 0) ! z = 1; t ! ?g:Chapter 2

49

Since the class Ce (x; y; G0 ) is empty for x > 0,

G1 = fx; y; z jz : Ce (x; y; G0 )g = G0 :Hence the minimal xed point of the operation on classes,

X 7;! fx; y; z jz : Ce (x; y; X )g;
is just G0 . Actually, by the aid of CIG induction for the class of the right handside of (B), we can prove

X0 fx; y; z jz : Ce (x; y; X0 )g =ext fx; y; z jequal(x; 0) ! z = 1; t ! ?g:Hence by (MGA) and the de nition of Graph (f ), we see that
equal(x; 0) ! 8z:(f (x; y) = z  z = 1);
t ! 8z:(f (x; y) = z  ?):Henceequal(x; 0) ! f (x; y) = 1; t ! :E (f (x; y)):In the usual minimal xed point semantics of recursive functions, which employs
the call-by-name computation rule, Morris's function is the constant function x:1.
Since PX employs the call-by-value computation rule, the minimal xed point is
as above instead of a constant function.
MGA can determine graphs of functions de ned without app and app but
not for functions de ned with them. Although the graphs of app and app arexed in MGA, in reality their graphs are de ned through de nitions of functions.
For example, the following function search1 is unde ned for the singleton list (1)in Lisp, but there is a model of PX with MGA in which the graph of search1 is
the function which searches a leaf labeled by 1 of a tree so its value for the list
(1) is t:

search1(x) = cond(equal(x; 1); t;atom(x); nil;t; or(search1(fst (x)); forall ((search1); (list(x; x))))
forall (x; y) = cond(y = nil; nil; t; or(app(x; fst (x)); forall (x; snd(y)))):

It is possible to formulate a complete xed point induction for recursive function
de nitions. But the above example shows that if app or app concerns a de nition, then xed point induction must be formulated with a simultaneous recursive

50

Chapter 2

de nition with app and app. Furthermore, it would need the concept of function
environment. As these are complicated, so we do not attempt to formalize them.

2.5. Choice rule

In the implementation of PX, we may use another important rule, although it is
not counted as a basic inference rule of PX. The rule is a version of the extended
Church's rule of Troelstra 1973:(choice) f g ) 9f:8a ; :::; a :(V;;)9rx1(x; :::;:::xxn :A;1m
1 n ) = app(f; a1 ; :::; am ):A)
where formulas of ; are of rank 0, formulas of ; and A do not have partialVvariables, a1 ; :::; an are all of the free variables in the upper sequent, and ; isthe conjunction of the formulas of ;.
If this is interpreted as a semantically valid rule, then our semantics would
contradict classical logic. So we do not regard it as a semantically valid rule.
Indeed, this does not hold in our intended semantics; on the contrary, all of theothers hold. This rule should be interpreted as a derived rule, i.e., the set ofderivable sequents of PX is closed under the rule. This fact will be proved in 3.1.
In the implementation of PX, the choice rule is presented as an declarationof a choice function as follows:; ) 9x1 ; :::; xn :A(choice2); ) r(x1 :::xn ) = f (a1 ; :::; am ):A ;where f is a new function of arity n.

2.6. Remarks on the axiom system

In this section, we will give two remarks on the system to help the reader's understanding of the system. One is about the di erence between the logic of partial
term (LPT) and the logic of partial existence (LPE). Another is about informationtransparencies of classes and limitations caused by it.

2.6.1. The logic of partial terms versus the logic of partial existence

The logic in Scott 1979 looks essentially the same as our LPT. (Moggi 1988 gives
a relationship between them, and extensive discussions and studies on various
forms of LPT and LPE.) But it is a logic of partial existence (LPE) and there isa philosophical di erence between LPT and LPE. The main di erence lies in its
semantics. The semantics of LPE supposes the existence of partial elements like ?
of cpo. The semantics of LPT does not assume the existence of partial elements.
In LPT, all values are total. LPE has quanti cations over partial elements, but

Chapter 2

51

LPT has only quanti cations over total elements. In LPE, interpretation of every
expression is always de ned as a value in its semantic domain. If an expression is\unde ned", then its value should be an \unde ned value" in its semantic domain.
In LPT, an expression may fail to denote a value. So interpretation of terms in
LPT is partial. Since the semantic domain of LPT may be ordinary sets, LPT
seems closer to the traditional semantics of logic. It is possible to represent partial
elements in the frame work of LPT. Plotkin 1985 represented the partial valueof an expression e by x:e, where x is a variable not occurring in e. In PX we
can represent it by ((x)(e)). Note that this expression has a value as long ase does not have a partial variable. So a domain of partial values of D is de nedby the lifting fnilg * D. This domain of partial values is slightly di erent fromthe domain of partial values in the sense of Fourman 1977 and Scott 1979. If a
predicate P (x) over a domain D has the property 8x; y 2 D:(P (x)  x = y), thenthere is a partial value p which satis es the property 8x 2 D:(P (x)  x = p) in
their theories. But this is not true, when we use fnilg * D as the domain ofpartial values of D.

2.6.2. Transparency of classes

The reason why we restrict CIG templates to rank 0 formulas is that we do
not wish that a formula e : A has hidden information. We wish classes to betransparent. For example, if we allow a CIG inductive de nition of a class NN ofnatural numbers likex : NN def x = 0 _ 9y : NN :x = suc(y);then to show x : NN , we need a realizer r which realizes x : NN , i.e., informationby which we can see how x is constructed from 0 by suc. (See the next chapter
for the exact de nition of realizers.) Suppose we extracted a program f from a
proof of 8x : NN :9y:A(x; y). Then f needs an extra input r which realizes thefact x : NN besides the input x, i.e. f satis es only the property

8x; r:(r realizes x : NN  r(x y) = f (x; r):A(x; y)):For NN and also for almost all inductively de ned data types, such extra information r has a structure isomorphic to the input x itself, although not identical.
So the extra input r is redundant. Furthermore, for any class C de ned by suchan extended inductive de nition, the class fx; rjr realizes x : C g can be de ned by
CIG inductive de nition just we did in the example (10) of CIG inductive de nition in 2.4.1. Namely, if one wishes to de ne a class with hidden information, one
can do that with a CIG inductive de nition which explicitly includes such \hidden

52

Chapter 2

information" as an argument of the class. (See Feferman 1979 for a systematic
method to eliminate hidden information.)
A drawback of the restriction is that we cannot de ne a union of classes. The
axiom (Join) maintains the existence of a disjoint union of a family of classes. Ifapp(f; x) is a class for each x : A, an element of the join (A; f ) is a pair of x
and y such that x : A and y : app(f;Sx) rather than an element of app(f; x) suchthat x : A. The union of the classes x : A:app(f; x) is de ned by

fyj9x : A:pair(x; y) : (A; f )g:S
But this is not allowed in PX. Since we may replace the atomic formula y : x :A:app(f; x) by the formula 9x : A:pair(x; y) : (A; f ), it is always possible toreplace a union by a join.

2.6.3. Total variables versus partial variables

There are di erent opinions on free variables in LPT and related systems. In
the systems of Beeson 1981, 1985, 1986 and Moggi 1986, 1988, variables always
have values. On the contrary, free variables of LPT of Plotkin 1985 need not havevalues. (Free variables of LPE need not have values.) PX has partial variables andtotal variables both. The reason why we introduce both is for practical purposes.
In ordinary logic, in which terms always have values, the axiom x = x andthe axiom scheme e = e are equivalent. In a LPT whose free variables are total
variables, the axiom scheme e = e is stronger than the axiom x = x, since a term ewhich does not have a value cannot be substituted for x. Partial variables can bea substitute for metavariables to some extent and semantics for partial variables
is simpler than semantics for metavariables. Partial variables in PX are used todescribe axioms in an expandable data base of miscellaneous axioms. Even thoughusers do not extend the data base, they can use partial variables to state theorems
about LPT. If only total variables were allowed in PX, they could not be able tostate a fact

E (cond(e1 ; d1 ; e2 ; d2 ))  (E (e1 ) ^ E (d1 )) _ (E (e1 ) ^ E (e2 ) ^ E (d2 ))by a single theorem. Considering e1 , e2 , d1 , and d2 as partial variable, we canstate it by a single formula. Partial variables are useful to state properties aboutprogram constructs.
The reason why PX has total variables as well is again practical. Theoretically, we do not need free total variables, since a partial variable p turns to a total
variable by adding an extra existence assumption E (p) or p : V . In practice, partial variables are hardly used in a formula as a speci cation. Actually, no partial
variable is used in the examples in this book. In practice, it is rather messy toChapter 2

53

handle the extra existence assumptions on partial variables. When total variables
are used, we may omit such messy existence assumptions. So total variables areuseful to state formulas as speci cations.
Since both total variables and partial variables are useful in di erent purposes, we introduced both. It is not dicult to handle them in practice, since
they are syntactically distinguishable.

3 Realizability
There are many ways giving computational meaning to constructive proofs. We
use realizability to give computational meaning to proofs of PX as in Nepevoda
1982, Hayashi 1983, 1986, Beeson 1985, and Sato 1985. We use a slightly modi ed
q-realizability. Our realizability is called the px-realizability, and was introduced
in Hayashi 1983, 1986. It was referred to there as the q-realizability, but in thisbook we refer to it as px-realizability. The advantage of px-realizability is that
if a program f is extracted from a proof of a theorem 8x:9y:A, then f satis es
8x:ry = f (x):A in the sense of classical logic (4.1 and appendix A), and rank 0
formulas are realizable i this holds classically. The contents of this chapter are
rather technical, so readers who are not familiar with the subject or not interested
in a detailed proof of the soundness result may read the de nition of realizability
brie y and put o reading the rest of this chapter until the knowledge about theextraction algorithm is required in the next chapter. In the rest of this book, only
the extraction algorithm in 3.2 and its soundness result will be needed.
The de nition of px-realizability in 3.1 is presented only to explain the ideaof the soundness theorem. This is not the version of px-realizability that theactual PX uses. The actual px-realizability for PX is presented in 3.2. Except
in 3.1, px-realizability means the re ned px-realizability of 3.2.

3.1. px-realizability

Realizability of constructive mathematics goes back to Kleene's work in the forties.
Now quite a few variants are known (Troelstra 1973, Beeson 1985). Furthermore,their intrinsic meanings have been explored by the aid of categorical logic (Hyland 1982, McCarty 1984). We present a realizability called px-realizability andprove its soundness for PX in this subsection. As remarked above, this is not
the px-realizability and extraction algorithm used in the implementation of PX.
The actual version makes more distinctions of cases for optimization of extracted
programs.
Now we give the px-realizability. For each formula A, we assign a formulaa x A, Ax for short. We call it the px-realizability or px-realization of A. Whena x A holds, we say \a is a realizer of A" or \a realizes A". An important pointis that a is a total individual variable not occurring in A. So a realizer must
be a value (object). The variable a will be called a realizing variable of A. A
realizing variable may be an arbitrary individual variable that does not occur
in the realized formula. But, for convenience, we assume that a new variable isassigned to each formula as its own realizing variable. Strictly speaking, we extend

Chapter 3

55

PX by adding new individual variables. The new variables are exclusively used asrealizing variables. So in a x A, a should be a new variable, but A must not haveany new variables. Furthermore, we assume that if two formulas are -convertible
then their realizing variables are the same.
We write e x A for (a x A)[e=a]. For simplicity, we will often say simply\realizability" instead of \px-realizability". We de ne realization of formulas by
the induction on the complexity of formulas. We will de ne it so that FV (a x A)
is a subset of fag [ FV (A).

De nition 1 (px-realizability)
1. A is of rank 0. Then a x A is A ^ a = nil.
2. a x A1 ^ : : : ^ An is r(a1 : : : an ) = a:((a1 x A1 ) ^ : : : ^ (an x An )).
3. a x A  B is E (a) ^ A  B ^ 8b:((b x A)  rc = app(a; b):c x B ).
4. a x A1 _ : : : _ An is r(b : c) = a:Case(b; c x A1 ; : : : ; c x An ).
5. a x 8~x1 : e1 ; : : : ; ~xn : en :A is

E (a) ^ 8~x1 : e1; : : : ; ~xn : en :ry = app(a; a1 ; : : : ; am ):y x A;
where a1 ; : : : ; am is the concatenation of FV (~x1 ); : : : ; FV (~xn ).
6. a x 9~x1 : e1 ; : : : ; ~xn : en : isr(a1 : : : am b) = a:(~x1 : e1 ^ : : : ^ ~xn : en ^ b x A);
where a1 ; : : : ; am is the concatenation of FV (~x1 ); : : : ; FV (~xn ).
7. a x rp1 = e1 ; : : : ; pn = en :A is rp1 = e1 ; : : : ; pn = en :a x A.
8. a x e1 ! A1 ; : : : ; ; en ! An is e1 ! a x A1 ; : : : ; en ! a x An .
The following lemmas will be used in the proof of the soundness theorem.
They are easily proved by induction on the complexity of formulas.
Lemma 1. In PX, we can prove e x A ) E (e) and e x A ) A. As aconsequence of the former, e x A and ra = e:a x A are logically equivalent in
PX.

Lemma 2 (substitution lemma for px-realizability). Let  be a substitution which does not substitute for free variables of e. Then e x (A) and (e x A)
are logically equivalent in PX.
Let e be an expression, and let ; ) A be a sequent. Then e x (; ) A)
is a pair of sequents ; ) A and ;x ) e x A, where ;x is the set fAxjA 2 ;g.
The expression e is called a (provable) realizer of the sequent ; ) A, provided
e x (; ) A) is provable, i.e. both of the two sequents are provable. Then we can

56

Chapter 3

prove the following theorem, which gives the mathematical foundation of program
extraction with PX.
Theorem 1 (Soundness of px-realizability). If ; ) A is a provablesequent of PX without partial variables, then we can nd an expression e fromits proof such that e x (; ) A) is also provable in PX. Furthermore, we may
assume FV (e) is a subset of FV (;x [ fAg).
From the soundness of px-realizability, we can easily conclude the following
corollary.
Corollary. PX is closed under the rule of (choice). Especially, if

8[x1 ; : : : ; xn ] : e:9y:F (x1 ; : : : ; xn ; y)is a provable sentence (closed formula) in PX, then there is a closed function fn
such that8[x1 ; : : : ; xn ] : e:ry = fn(x1 ; : : : ; xn ):F (x1 ; : : : ; xn ; y)is also provable in PX.
Proof. We prove that PX is closed under (choice). Assume that e0 provablely
realizes the upper sequent of the rule in 2.5. By the condition on free variablesof realizers, we may assume FV (e0 )  FV (;x ) [ FV (9~v1 ; : : : ;~vn :A) holds. Substitute nil for the realizing variable of ;x , and let us denote it by ;0 . Then ;0 islogically equivalent to ;. Hence, we may assume that FV (e0 )  fa1 ; : : : ; am g and;x = ;. Set

f = ((a1 ; : : : ; am )(let (b1 : : : bn c) = e0 in list(b1; : : : ; bn)))andd = ((a1 ; : : : ; am ):(()(let (b1 : : : bn c) = e0 in c)));where b1; : : : ; bn are fresh variables. Let e be list(f; d). Then e is a closed ex-pression and provably realizes the lower sequent. The rst claim follows from thisfrom the de nition of realizability by lemma 1. The second claim of the corollaryholds, for we de ned f explicitly.
The condition on variables in theorem 1 is necessary to validate the pxrealizability of (8I ) and ( I ), etc. The variables that appear in formulas as
speci cations are normally total variables. Partial variables of PX are mainly
used as a substitute for metavariables. Namely if a formula with a partial variable
is provable, then any formula obtained by substituting any expressions for theChapter 3

57

variables is also provable. Assume that a partial variable x appears in a specication formula A and e is a realizer of A. When we substitute any expression
e0 for x, e[e0 =x] x A[e0 =x] should hold, but the variable condition of the theorem
prevents this. Plotkin's lifting technique provides a way to avoid this. Let y bea total variable. By substituting an expression app(y) for x of A, A turns out
to be a formula without partial variables. Assume e1 is extracted as a proof ofA[app(y)=x]. The expression (()(e0 )) always has a value, provided e0 does nothave partial variables. So substituting it for y, we see e1 [(()(e0 ))=y] x A[e0 =x].
Hence app(y) can be a substitute for a metavariable for expression without partial variables. If one wishes e0 to have a partial variable, then one can use thesame technique again.
We can eliminate partial variables in a proof of a provable sequent without
partial variables by the aid of the following lemma.
Lemma 3. If a provable sequent does not have partial variables, then it has a
proof in which any partial variables do not appear.
Proof. If partial variables are replaced by arbitrary constants, then all axioms
and rules remain valid except (inst). So we eliminate substitutions for partial
variables in (inst) by substituting i for the variables zi through the proof forevery i = 1; : : : ; p. We make this change from the bottom to the top. Finishing
this change, we substitute arbitrary constants for the remaining partial variables.
Then it turns out to be a proof without any partial variables.
In the following proof, we assume that all proofs have no partial variables,
when the conclusion has no partial variables.
Proof of Theorem 1. The proof is by induction on the complexity of proofs.
Note that we have to construct an expression for the lower sequent of each inference
rule and prove that it provably realizes the sequent. In the rest of the proof, allrealizers are provable realizers.
Since all axioms are of rank 0 except (= 5), their realizers are nil. A realizerof (= 5) iscond(equal(a; b); pair(1; nil); t; pair(2; nil)):Hence only inference rules remain. If the conclusion of an inference rule is of rank
0, then nil is a realizer of the lower sequent. We may assume that the conclusionsof inference rules are of rank 0 in the rest of the proof. Hence we do not go over theinference rules, whose conclusions are always of rank 0. The realizers we constructbelow may or may not satisfy the additional condition on free variables. When
one does not satisfy the condition, we substitute appropriate constants for freevariables which are not free variables of the sequent. We examine each inference
rule and construct its realizer e. In almost all cases, it is routine to prove that the58

Chapter 3

expression we construct is a realizer. We leave details of the proof to the reader,
except in some dicult or subtle cases. In particular, we will give a detailed proofof the realization of the axioms and rule of CIG.
(= 4) Take the realizer of the left upper sequent as e. Lemma 2 implies that
this is a realizer of the lower sequent.
(assume) Take the realizing variable of A as e.
(?) Take nil as e.
(thinning) Take the realizer of the upper sequent as e.
(inst) Let e0 be a realizer the rst upper sequent. Let  be the substitutionthat substitutes the realizing variables of A for the realizing variable of for every
A of ;. Set e = e0  .
(cut) Let e1 and e2 be realizers of the left upper sequent and the right upper
sequent, respectively. Set
e = let a = e1 in e2 ;where a is the realizing variable of A.
(alpha) Take the realizer of the upper sequent as e.
(replacement) Take the realizer of the left upper sequent as e. Note that theformulas B1 ; B2 must be rank 0 formulas. We can prove that e is a realizer by
proving that if B and C are rank 0 formulas, thenfEnvA[] [B  C ]; a x A[B ]+ g ) a x A[C ]+ ;fEnvA[] [B  C ]; a x A[C ]; g ) a x A[B ];hold. This can be proved by induction on the complexity of the context A[].
(^I ) Let ei be a realizer of ; ) Ai for each i = 1; : : : ; n. Set

e = list(e1; : : : ; en ):(^E ) Let e1 be a realizer of the upper sequent. Set

e = let [a1 : : : an ] = e1 in list(ai1 ; : : : ; aim ):(_I ) Let e1 be a realizer of the upper sequent. Take pair(i; e1) as e.

Chapter 3

59(_E ) Let e0 be a realizer of the rst upper sequent, and let ei be a realizerof the i + 1th upper sequent for each i = 1; : : : ; n. Then set

e = let (c : r) = e1 in case(c; e1[r=a1 ]; : : : ; en [r=an ]);where ai is the realizing variable of Ai and c; r are fresh variables.
( I ) Let e1 realize the upper sequent, and let a be the realizing variable of
A. Sete = ((a):e1 ):This is a legal expression, for e1 does not have free partial variables. By the
induction hypothesis, we see ;x ) e1 x B holds. We prove(; ; fAg)x ) e x A  B:

E (e) holds by (E 5). Let b be the realizing variable of A. Then, f g ) app(e; a) =((a):e1 )(a) = e1 holds by (app) and (beta). By the induction hypothesis, lemma
1, and (r9I ), we see ;x ) rc = app(e; a):c x B . Hence we see(; ; fAg)x ) 8a:(a x A  rc = app(e; a):c x B ):On the other hand, (; ; fAg)x ) A  B holds by lemma 1.
( E ) Let e1 and e2 be realizers of the left upper sequent and right upper
sequent, respectively. Set
e = app(e1 ; e2 ):(8I ) Let e1 be a realizer of the upper sequent, and let a1 ; : : : ; am be thenite sequence of variables obtained by concatenating the sequences of variables
FV (~v1 ); : : : ; FV (~vn ). Set

e = ((a1 ; : : : ; am ):e1 ):Similarly as in the case of ( I ), we can prove e is a realizer.
(8E ) Let e0 be a realizer of the rst upper sequent. Set

e = app(e0 ; e11 ; : : : ; e1m1 ; : : : ; en1 ; : : : ; enmn ):Use lemma 2 to prove e is a realizer.
(9I ) Let e0 be a realizer of the rst upper sequent. Set

e = list(e11; : : : ; e1m1 ; : : : ; en1 ; : : : ; enmn ; e0):60

Chapter 3

Use lemma 2 to prove e is a realizer.
(9E ) Let e1 and e2 be realizers the left upper sequent and right upper sequent,respectively. Let a1 ; : : : ; am be the sequence of variables obtained by concatenating the sequences of variables FV (~v1 ); : : : ; FV (~vn ). Then set

e = let (a1 : : : am a) = e1 in e2 ;where a is the realizing variable of A.
(! _I ) Take the realizer of the rightmost upper sequent as e.
(! _E ) Let e0 realize the rst upper sequent, and let ci realize the i + 1th
upper sequent for each i = 1; : : : ; n. Let ai be the realizing variable of Ai for eachi = 1; : : : ; n. Then set

e = cond(e1 ; let a1 = e0 in c1 ; : : : ; en; let an = e0 in cn )and

 = ; [ 1 ; (fA1 g [ S1 ) [ : : : [ n ; (fAn g [ Sn ):We have to prove  ) e x C . By lemma 1 of 2.3.4, this is equivalent to() ) ra1 = e0 ; : : : ; an = e0 :e1 ! c1 x C ; : : : ; en ! cn x C:

By the induction hypothesis on the rst upper sequent, we see that;x [ fe1 = nil; : : :; ei = nil; ei+1 : T g ) e0 x Ai+1
holds for each i = 1; : : : ; n. Hence, by the induction hypothesis on the right upper
sequent, we see that;x [ fe1 = nil; : : :; ei = nil; ei+1 : T g [ (xi ; fe0 x Ai+1 g) ) ci [e0 =ai ] x C
holds for each i = 1; : : : ; n. On the other hand, by the rst upper sequent, we canderive the sequent ; ) Sor (e1 ; : : : ; en). Hence, by (! ^I ) and (thinning) we seethatx ) e1 ! c1 [e0 =a1 ] x C ; : : : ; en ! cn [e0 =an ] x C
holds. Hence, by (r9I ), we prove ().
(! ^I ) Let di be a realizer of the ith upper sequent. Set

e = cond(e1 ; d1 ; : : : ; ; en; dn ):Chapter 3

61(! ^E ) Take the realizer of the rst upper sequent as e.
(r9I ) Take the realizer of the rst upper sequent as e. Use lemma 2 to prove
it is a realizer.
(r9E ) Let d1 and d2 be realizers of the left upper sequent and right upper
sequent, respectively. Set

e = let p1 = e1 ; : : : ; pn = en ; a = d1 in d2 ;where a is the realizing variable of A.
(r8I ) Let d be the realizer of the rst upper sequent. Set

e = let p1 = e1 ; : : : ; pn = en in d:(r8E ) Take the realizer of the leftmost upper sequent as e.
Now we give a realization of (CIG ind). First, we de ne an expression
pred (A; f ; ~b), for each CIG template A, function name f , and nite sequence ofvariables ~b. We will simply write pred (A) or pred (A; f ) instead of pred (A; f ; ~b),whenever f ,~b are clear from the context. We call pred (A) the CIG predecessor ofA.
(1) A is a rank 0 formula without any occurrences of X0 . Then pred (A) is nil,(2) pred ([e1 ; : : : ; en ] : X0 ; f ; ~b) = f (e1 ; : : : ; en ; ~b),(3) pred (A  B ) = ((x):pred (B )), where x is a new individual variable.
(4) pred (A1 ^ : : : ^ An ) = list(pred (A1 ); : : : ; pred (An )),(5) pred (8~v1 : e1 ; : : : ;~vn : en :A) = ((~x):pred (A)), where ~x is the concatenationof the sequences of variables ~v1 ; : : : ;~vn ,(6) pred (e1 ! A1 ; : : : ; en ! An ) = cond(e1 ; pred (A1 ); : : : ; en ; pred (An )),(7) pred (rp1 = e1 ; : : : ; pn = en :A) = let p1 = e1 ; : : : ; pn = en in pred (A).
Assume e0 realizes the upper sequent of (CIG ind). De ne a function f0 by

f0 (a1 ; : : : ; an ; b1 ; : : : ; bm ) = let r = pred (A; f0 ; b1; : : : ; bm ) in e0 ;where r is the realizing variable of A[F (~a)=X0 ] and ~b = b1 ; : : : ; bn is the sequenceof all free variables of e0 except r and a1 ; : : : ; an . Set

e = f0 (a1 ; : : : ; an ; b1 ; : : : ; bm ):Then e realizes the lower sequent. To prove this, we need the following lemma.

62

Chapter 3

Lemma 4. Let F (~a) be the formula f0(~a; ~b) x F (~a). Then the following is
provable in PX:(A)
A[F  (~a)=X0] ) pred (A; f0 ; ~b) x A[F (~a)=X0 ]:We will prove this lemma later. Here we use the lemma to prove that erealizes the lower sequent of (CIG ind).
(CIG ind) Assume the following is provable:()(; ; fA[F (~a)=X0 ];A[X0 f~ajAg=X0]g)x[ fA[F  (~a)=X0 ]; A[X0 f~ajAg=X0]g ) F  (~a):

Then, by applying (CIG ind) to this sequent, we can derivef[~a] : X0 f~ajAgg [ (; ; fA[F (~a)=X0 ]; A[X0 f~ajAg=X0]g)x ) F  (~a):
This means that e realizes the lower sequent of (CIG ind). Hence it is sucient toderive (). By the induction hypothesis, ;x ) e0 x F (~a) is provable. By lemma
4, we can prove;0 [ fr = pred (A; f0 ; ~b); A[F  (~a)=X0 ]g ) e0 x F (~a);
where ;0 = ;x ; fr x A[F (~a)=X0 ]g and r is the realizing variable of A[F (~a)=X0 ].
Since fA[F  (~a)=X0 ]g ) E (pred (A; f0 ; ~b)) is provable by lemmas 1 and 4, we
can prove the following by (r8I ) and lemma 1 of 2.3.4:(1);0 [ fA[F  (~a)=X0]g ) (let r = pred (A; f0 ; ~b) in e0 ) x F (~a):

Since A[X0 f~ajAg=X0] is a rank 0 formula, we see(2)

A[X0 f~ajAg=X0 ]  (A[X0 f~ajAg=X0])x :The sequent () follows from (1) and (2).
This is just the sequent () by de nition of the function f0. This ends theproof of validity of the realization of (CIG ind).
Now we prove lemma 4. We will prove it by induction for rank 0 formulas.

Proof of Lemma 4(1) Assume that A is a rank 0 formula without any occurrences of X0 . ThenA[F  (~a)=X0 ], and A[F (~a)=X0 ] are the same rank 0 formula. So (A) is provable.

Chapter 3

63(2) Assume A is [e1 ; : : : ; en ] : X0 . Then (A) is tautological by the de nitionof pred(A; f0 ; ~b).
(3) Assume A is A1  A2 . Let e0 be pred (A2 ; f0 ; ~b). Since X0 appears
negatively in A1 , fA1 [F (~a)=X0 ]g ) A1 [F  (~a)=X0 ] is provable. Hence, by the
induction hypothesis for A2 , we see that fA[F  (~a)=X0 ]; A1 [F (~a)=X0]g ) e0 x
A2 [F (~a)=X0 ] holds. Since X0 appears positively in A, A[F  (~a)=X0]  A[F (~a)=X0]
holds. So we can prove (A).
(4) Assume A is A1 ^ : : : ^ An . This case is obvious.
(5) Assume A is 8~v1 : e1 ; : : : ;~vn : en :A. This case is proved as the case (3).
(6) Assume A is e1 ! A1 ; : : : ; en ! An . We see thatfA[F  (~a)=X0 ]g ) Sor(e1 ; : : : ; en )holds. Hence, by the induction hypothesis, we see thatfA[F  (~a)=X0 ]g ) e1 ! pred (A1 ) x A1 ; : : : ; en ! pred (An ) x An
holds. Hence, by lemma 1 of 2.3.4, (A) is provable.
(7) Assume A is rp1 = e1 ; : : : ; pn = en :A. This case is proved as the case(6).

3.2. A re ned px-realizability
The px-realizability of the previous section is mathematically simple, but themathematical simplicity often causes redundancies in practice. We see thatfaja x 9x:Ag = f(x nil)jAg = fxjAg  fnilg;
provided A is a rank 0 formula. The part fnilg is redundant. So we wish to de ne
faja x 9x:Ag = fxjAg:
There is large room for similar re nements to the px-realizability given in theprevious section. We will give a re ned px-realizability below, which is actuallyadopted in the implementation described in chapter 7. In the rest of the book,px-realizability means this re ned px-realizability.
First, to each formula A, we de ne a nonnegative integer, called the rank of
A. We will write it rank(A).

De nition 1 (rank of formula)

64

Chapter 3

1. The rank of atomic formulas and formulas of the forms :A and }A is zero.
2. A is A1 ^ : : : ^ An . Set

rank(A) = #fijrank(Ai ) > 0g;
where # means the cardinality of a set. If all of A1 ; : : : ; An are of rank 0,
then so is A.
3. A is A1 _ : : : _ An . If all of A1 ; : : : ; An are of rank 0, then rank(A) is 1.
Otherwise, rank(A) is 2.
4. A is B  C . If C is of rank 0 then so is A. Otherwise, rank(A) is 1.
5. A is 8~v1 : e1; : : : ;~vn : en :B . If B is of rank 0, then so is A. Otherwise,rank(A) is 1.
6. A is 9~v1 : e1; : : : ;~vn : en :B . Then rank(A) is m + rank(B ), where m is thenumber of variables in ~v1 ; : : : ;~vn .
7. A is e1 ! A1 ; : : : ; en ! An . If all of A1 ; : : : ; An are of rank 0, then so is A.
Otherwise, rank(A) is 1.
8. A is rp1 = e1 ; : : : ; pn = en :B . Then rank(A) is rank(B ).
It is easy to see that rank(A) is 0 i A is a rank 0 formula in the sense of 2.2.
Now we de ne re ned px-realizability.

De nition 2 (re ned px-realizability)
1. Suppose A is of rank 0. Then a x A is A ^ a = nil.
2. Suppose A = A1 ^ : : : ^ An . If rank(A) = 0, then let Ai be the formula Ai ,otherwise, let Ai be ai x Ai . Let i1 <    < im be the sequence of the indicesi such that rank(Ai ) =6 0. Then a x A isr[ai1 ; : : : ; aim ] = a:(A1 ^ : : : ^ An ):3. a x A  B is
E (a) ^ A  B ^ 8b:(b x A  rc = fn(a; b):c x B );where if rank(A) = 1 then fn is app else rank(A) = 1 is app.
4. Suppose A is A1 _ : : : _ An . If rank(A1 ) =    = rank(An ) = 0, thena x A  Case(a; A1 ; : : : ; An );otherwisea x A  r(b c) = a:Case(b; c x A1 ; : : : ; c x An ):5. a x 8~x1 : e1 ; : : : ; ~xn : en :A is
E (a) ^ 8~x1 : e1; : : : ; ~xn : en :ry = app(a; a1 ; : : : ; am ):y x A;

Chapter 3

65

where a1 ; : : : ; am is the concatenation of FV (~x1 ); : : : ; FV (~xn ).
6. Suppose A is 9~x1 : e1 ; : : : ; ~xn : en :A0 . Let a1 ; : : : ; am be the concatenationof the variables FV (~x1 ); : : : ; FV (~xn ). If rank(A0 ) = 0, thena x A  r[a1 ; : : : ; am ] = a:(~x1 : e1 ^ : : : ^ ~xn : en ^ A0 );otherwisea x A  rp = a:(~x1 : e1 ^ : : : ^ ~xn : en ^ b x A0 );where p is (a1 : : : am b) if rank(A0 ) = 1, and (a1 : : : am : b) otherwise. The
last dot of the latter pattern is an actual dot.
7. a x rp1 = e1 ; : : : ; pn = en :A is rp1 = e1 ; : : : pn = en :a x A.
8. a x e1 ! A1 ; : : : ; ; en ! An is e1 ! a x A1 ; : : : ; en ! a x An .

De nition 3 (re ned CIG predecessor). The de nition of CIG predecessors

for re ned realizability is almost the same as the de nition of original CIG predecessors. Only the CIG predecessors for implication and conjunction are changed,
as follows:(3) pred (A  B ) = ((x1 ; : : : ; xn ):pred (B )), where x1 ; : : : ; xn are new individual variables and n is rank (A).
(4) pred(A1 ^ : : : ^ An ) = list(pred(Ai1 ); : : : ; pred(Aim )), where i1 ; : : : ; im are
the same as in clause 2 of de nition 2.
We present a detailed description of the actual extraction algorithm below.
We do not give its correctness proof, since it is essentially the same as the proofof theorem 1 given above. It is di erent from the algorithm presented in the proofof theorem 1 in the following respects:(A) We realize (CIG ind ) instead of (CIG ind).
(B) We attach a tuple with to each assumption as its realizing variable rather
than a single variable. Namely the tuple is the realizing variable, if it isconsidered as a tuple variable. Recall that when the rank of an assumption
is one, then it is a single variable, otherwise it is a list of variables.
(C) The extracted codes are optimized by some partial evaluations.
These are mainly for optimizations of the extracted programs, and the soundness
proof of the extracted programs is applicable to it without essential changes.
We have to introduce some auxiliary functions to describe the extractor.

Auxiliary functions
 If A is a formula, then rvars(A) is a sequence of mutually distinct variablesof length rank(A). It is considered as a tuple variable that realizes A. We

66

Chapter 3call it the realizing variables of A. We assume rvars(A) and rvars(B ) are
identical, i A and B are -convertible.
 tuple[e1; : : : ; en ] is another notation for the tuple [e1 ; : : : ; en ].
 rpattern (A) is the pattern [a1 ; : : : ; an ], where a1 ; : : : ; an = rvars(A).
 rpatterns (A1 ; : : : ; An ) is the sequence rpattern (A1 ); : : : ; rpattern (An ).
 newfunc () is a new function name.
 new(n) is a sequence of n new total variables.
 dummy(n) is a list of n atoms.
 upseqs(P ) is the upper sequents of a proof P .
 rule(P ) is the last rule of the proof P .
 con(P ) is the conclusion of the proof P .
 asp(P ) is the assumptions of the proof P .
 When rule(P ) is ( I ), dischI (P ) is the discharged formula of ( I ).
 When rule(P ) is (inst), subst(P ) is the substitution  of the rule of (inst)
in 2.3.3.
 delete0(P1; : : : ; Pn ) is the subsequence of P1 ; : : : ; Pn obtained by deleting
proofs whose conclusions are of ranks 0.
 If rule(P ) is (^E ), then indexes^E (P ) stands for the indexes of the sequenceof indexed formulas obtained by deleting all of rank 0 formulas from thesequence of indexed formulas Ai1 ; : : : ; Aim of (^E ).
 If rule(P ) is (_I ), then index_I (P ) is the index i in the rule of (_I ) in 2.3.3.
 eigenvars8I , etc., denote the sequence of eigenvariables of the rules (8I ), etc.
 Let rule(P ) be (8E ) and [e1 =a1 ; : : : ; em=am ] be the substitution  of (8E )in 2.3.3. Then instances8E (P ) are the expressions e1 ; : : : ; em. instances9I
is de ned similarly.
 body9 (A) is the immediate subformula of an existential formula A. body8 (A),bodys_ (A), and bodys! (A) are similarly de ned.
 conditions(A) is the sequence of conditions of a conditional formula.
 Let  be rp1 = e1 ; : : : ; pn = en:A. Then patterns() is p1 ; : : : ; pn andbindings() is e1 ; : : : ; en .
We construct a realizer of the generalized CIG induction rule (CIG ind )instead of the plain CIG induction rule (CIG ind), but we consider only the following non-simultaneous inductive de nition for simplicity. The rule (CIG ind )is realized in the same way by virtue of simultaneous recursion.
(CIG dec1 )deCIG ~x : C D e1 ! 1;1; : : : ; 1;q1 ;:::en ! n;1 ; : : : ; n;qn :Chapter 3

67

S;1n );~F;): : :~x; ;: nC ) FF ;(CIG ind1 )i=1 iwhere ;~ i is the set;i ; (f~x : Dg
[ fe1 = nil; : : :; ei = nil; ei : T g[ fi;1 [F=C ]; : : : ; i;q [F=C ]g[ fi;1 ; : : : ; i;q g):ii

For a proof P such that rule(P ) is (CIG ind1 ), we introduce the following auxiliary functions: template(P ) is (e1 ; 1;1 ; : : : ; 1;q1 ); : : : ; (en ; n;1 ; : : : ; n;q ).
 pred(A1 ; : : : ; An ) is pred(A1 ); : : : ; pred(An ): dischCIG(Pi ) is the discharged formulas i;1 [F=C ]; : : : ; i;q [F=C ] of the proof
of ;i ) F .
Besides these, we use three functions for optimizationsniOptimizecase; Optimize ; Optimizeand a construct subst which does substitution and/or builds a let-expression
in an optimized way. Optimize , Optimize do -reduction and -reduction,
respectively. Optimizecase does an optimization such ascase(cond(e; 1; t; 2); e1; e2 ) 7;! case(e; e1; e2 ):What subst does is rather complicated, but essentially it is a let form. The
value of the expression subst p e in e1 is always equivalent to the value oflet p = e in e1 as far as the both have values. However, if the pattern p (exactly
exp(p)) occurs only once in e1 , then subst does a partial evaluation by replacing
p by e, e.g., subst (a : b) e in pair(a; b) is just the expression e. Furthermore,
if p is the empty pattern () (or nil), subst neglects the substitution for p, e.g.,
subst () e1 in e2 is just e2. To understand results in this book, it suces toassume subst does only these optimizations. See appendix C for a full description.
In the following description of the extraction algorithm, the above auxiliary
functions, which are metalevel functions in the sense that they handle syntactic
entities of PX, will be printed in this typewriter-like font. Metavariables
for such entities are also typed in the same font. On the other hand, the program
constructs of PX are typed in the font of mathematical formulas. Some metalevel
program constructs, like def, let, case, are in boldface letters.

68

Chapter 3

The extraction algorithm
def extr(P)=let rank=rank(con(P)), P1; : : : ; Pn=upseqs(P) in
if rank=0 then nil else
case rule(P) of(= 5): cond(equal(a; b); 1; t; 2) ; (= 5) is the axiom a = b _ :a = b(assume): tuple[rvars(con(P))](?): dummy(rank(con(P)))(inst): let A1 ,...,An=asp(P1), =subst(P) in







extr(P1) [rvars(A1 )/rvars(A1),...,rvars(An )/rvars(An)](cut): subst rpattern(con(P1)) extr(P1) in extr(P2)(^I ): let Q1 ,...,Qm=delete0(P1,...,Pn) intuple[extr(Q1),...,extr(Qm)](^E ): let a1 ,...,an=new(n), j1 ,...,jp=indexes^E(P) in

subst [a1,...,an] extr(P1) in tuple[aj1 ,...,ajp ](_I ): if rank(con(P))=1 then index_I(P)else let i=index_I(P) in list(i;extr(Pi))(_E ): if rank(con(P1))=1 thenOptimizecase(case(extr(P1),extr(P2); : : : ;extr(Pn)))else
let c,r=new(2), p1,...,pn;1=rpatterns(bodys_(con(P)))
in
Optimizecase(subst (c r) extr(P1) incase(c;subst p1 r in extr(P2);...;subst pn;1 r in extr(Pn)))( I ): let a1 ,...,am=rvars(dischI(P)) in
Optimize (((a1 ; : : : ; am ):extr(P1 )))( E ): let f = if rank(con(P2))=1 then app else app in
Optimize (f(extr(P1),extr(P2)))(8I ): let a1 ,...,am=eigenvars8I(P) in
Optimize (((a1 ; : : : ; am ):extr(P1)))(8E ): let e1 ,...,em=instances8E(P) in
Optimize (app(extr(P1);e1 ; :::;em ))(9I ): let e1 ,: : :,em =instances9I(P),u=rank(body9(con(P1))) in
if u=0 then tuple[e1; : : : ; em]else if u=1 then tuple[e1; : : : ; em; extr(P1)]else pair(e1 ; pair(e2;    ; pair(em;extr(P1))   ))Chapter 3

69(9E ): let a1 ,...,am=eigenvars9E(P),b1 ,...,bu=rvars(body(con(P1))) in
if u=0 then subst [a1,...,am] extr(P1) in extr(P2)else if u=1
then subst (a1...am b1) extr(P1) in extr(P2)else let b=new(1) insubst (a1...am . b) extr(P1) insubst (b1...bu) b in extr(P2)(! _E ): let c1 ,...,cn;1=conditions(con(P1)),
p1 ,...,pn;1=rpatterns(bodys!(con(P1))),e=extr(P1),e1 =extr(P2),...,en;1=extr(Pn), incond(c1 ; subst p1 e in e1 ; : : : ; cn;1 ; subst pn;1 e in en;1 )(! ^I ): let c1 ,...,cn;1=conditions(con(Pn)) incond(c1 ;extr(P1);...;cn;1;extr(Pn;1))(r8I ): let p1 ,...,pm=patterns(con(P1)),
e1 ,...,em=bindings(con(P1)) in
let p1 =e1;...;pm=em in extr(P1)(r9E ): let p=rpattern(bodyr(con(P1))),
p1 ,...,pm=patterns(con(P1)),
e1 ,...,em=bindings(con(P1)) in
subst p1=e1,...,pn=em,p extr(P1) in extr(P2)(CIG ind1 ): let ~a=eigenvarsCIG(P),f=newfunc(),(e1 ;A1 ),...,(en;An )=template(P),pred1 =pred(A1),...
predn =pred(An),r1 =rpatterns(dischCIG(P1 )),...
rn =rpatterns(dischCIG(Pn ))

~

;;!

~

;;!

~

~

~

~
in
begin
def f(~a,~b)=cond(e1;subst ~r1 ;;!
pred1 in extr(P1);...
;;!
en ;subst ~rn predn in extr(Pn))
enddefault:
end.

~~

f(a,b)
extr(P1)

Besides the above, the extraction algorithm realizes the rule of (choice2) of
2.5. As described in 7.2, when one constructs a proof of an existential theorem,

70

Chapter 3

say 9y : C:A, with assumptions, say ;, which are of rank 0, then one can declarea function, say f , for which ; ) ry = f (a1 ; : : : ; an ):(y : C ^ A) is an axiom,
where a1 ; : : : ; an are free variables of ; and 9y:A. Then the extraction algorithm
computes a realizer of the proof of the existential theorem, say e, and associatesa realizer e1 with the axiom and attaches an expression e2 as its de nition as
follows: if A is of rank 0, then e1 is nil and e2 is e, else e1 is subst pp e in b
and e2 is subst pp e in y. where pp is (y b), if rank(A) = 1, and is (y . b)otherwise. We explained only the case when the number of the bound variablesof the existential quanti er is one. The general case is treated similarly.

4 Writing programs via proofs
In this chapter, we will give detailed accounts of our methodologies of program
extraction with PX. We will use petty examples to illustrate our methodologies.
A relatively big example will be presented in appendix B, in which we will extract
a tautology checker of propositional logic from a proof of its completeness theorem.
In 4.1, we will give an overview how a program is extracted from a proofof PX. More precise explanation will be found in chapter 7. In 4.2, we will
give a detailed account of how the formulas of PX represent \types" throughpx-realizability. In 4.3, we will present a class of recursion called CIG recursion
which is the recursion extracted from CIG induction. By the examples of 4.3
and theoretical considerations in 4.4-4.6, the power of the CIG recursion method
will be illustrated. Actually, in 4.4, we will show that PX can extract all partial
recursive functions from its proofs, and, in 4.6, we will show that the Hoare logic
of total correctness of regular programs is subsumed in PX.

4.1. How to extract programs with PX

The rst thing one does to extract a program with PX is to write a speci cation
by way of a sequent such as(A); ) 9y : C:A(x; y);where ; represents the condition on input x, C describes the condition on output
y and A describes the expected relation on input and output. The variables of thesequent must be total variables. Writing a constructive proof of (A) and applying
the extraction algorithm of 3.2, one gets an expression e of PX such that(B);x ) ry = e:(y : C ^ A(x; y))is provable. Namely, e terminates for any input that re ects the real meaning of;, i.e., ;x , and the value of e meets the conditions on output. This is also certi edby the soundness result in the previous chapter.
Let us explain how features of PX serve in the above process. To writea precise speci cation, one has to decide how data are represented by the data
structure of PX. S-expressions are known as a universal space of data representation, and CIG inductive de nition provides a way of de ning recursive data types.
The recursive data types de ned by CIG inductive de nition are much richer thanconventional data types, since one can use conditions written by logical formulas

72

Chapter 4

with quanti ers. Furthermore, CIG even supports higher order data types as we
saw in 2.4.
The inference rules of PX represent suciently many programming constructs. CIG induction rules represent quite a few recursion schemas and LPT
gives a convenient way of writing speci cations by formulas, and also serves program constructs as we will see in the rest of this chapter. It is often unnecessary
to prove lemmas on properties about data and termination of the algorithm byconstructive logic. In PX such things may be proved by resorting to classical logic
by means of proposition 3 of 2.3.5. This means even that if a proof is incomplete,
we can extract a program from it and may complete the proof later by classicallogic. Furthermore, we may have the lemmas and termination statement provedby another proof checker. Actually we take advantage of proving them with theproof checker EKL. This will be explained in the rest of this chapter and in chapter
7.
After giving a proof of the speci cation, we apply the extraction algorithm
to it. Then the extracted program meets the speci cation in the sense that thesequent (B) is also provable in PX. Furthermore, it holds in the sense of thesemantics given in chapter 6. The semantics is given in the framework of theusual classical logic, so the extracted program meets the speci cation also in thesense of the usual logic. If ; is comprised of rank 0 formulas, then ;x is equivalent
to ;, since the extraction algorithm for the re ned realizability does not create
realizing variables for rank 0 formulas. In almost all cases in practice, formulas of; are of rank 0.

4.2. Curry-Howard isomorphism in PX

The Curry-Howard isomorphism is a paradigm relating constructive logic and programming. It is regarded as a logical foundation of rigid functional programmingand type theory in programming languages. (Martin-Lof 1982, Coquand and Huet
1986). Roughly, it says that programming activity corresponds to mathematicalactivity in the following way:Constructive logic
Proof
FormulaProving theorem

Programming and veri cation
Veri ed program
Speci cation or Type
Programming with veri cation

So the paradigm is also called \proofs as programs", \formulas as types", or\propositions as types". We will see below how they are achieved in PX. Concise

Chapter 473

accounts for the notion can be found in Bates and Constable 1985, Mitchell andPlotkin 1985.
A formula of PX represents a \type" through the px-realizability. Whene x A holds, we may read it as \e belongs to a type represented by the formula
A". When e is extracted from a proof P of A, then we read it as \P represents a
program e which has the type represented by A". In short, \P is a program of a
type A". Logical connectives and quanti ers that construct formulas correspond to
type constructors, and inference rules that construct proofs correspond to program
constructs. When a formula is read as a type and a proof is read as a proof by
the ordinary realizability, then the correspondence between them is ordinary one
as in Martin-Lof 1982. Since we adopted px-realizability instead of the usual
realizability, our \formulas as types" notion di ers from the ordinary one, althoughthe \proofs as programs" notion is almost the same as the ordinary one. We willcompare sets of realizers by px-realizability with types of typed programming
languages below. We use Reynolds 1985 as a standard source of concepts andnotations of type disciplines in programming languages.
Each formula A represents a \type" faja x Ag. For simplicity we denote theset of realizer of A by x(A). (Note that x(A) need not be a class. So faja x Ag
is not our class notation but the usual set notation.)
The type of rank 0 formula A is an extended propositional equality in thesense of Martin-Lof 1982, i.e., it has exactly one element nil, which is consideredas the witness of the truth of A, i A holds. The de nition of x(A) is just thetruth value of A in the sense of Fourman 1977.
The type of conjunction A  A1 ^    ^ An represents the Cartesian productor the type of records.
x(A1)      x(An ) or prod(x(A1 ); : : : ; x(An )):But, if Ai is of rank 0 and Ai is false, then the eld corresponding to it is omitted.
If such a conjunction is used in a scope of an existential quanti er, it turns out aconstraint on realizers.
If A; B; C are not of rank 0, then x(A ^ B ^ C ) is a three- eld record type and,on the other hand, x(A ^ (B ^ C )) is a two- eld record type. The usual equivalence
proof of these two formulas represents the isomorphism between these two records
types. As usual (^I ) creates a record from elds. But (^E ) does more than fetch
elds, since it may also introduce conjunctions. This unusual convention is rather
useful. For example, we may represent an isomorphism between x(A  B ) andx(B  A) by just one application of (^I ).
The type of disjunction A = A1 _    _ An is the indexed disjoint sum or thetype of alternatives
x(A1) q    q x(An ) or choose(x(A1 ); : : : ; x(An )):74

Chapter 4(_I ) creates alternatives. (_E ) is altcase construct mentioned in Reynolds 1985.
If the disjuncts of the major premise are all of rank 0, then (_E ) is just the caseconstruct.
The type of implication A  B is a subset of the space x(A) ! x(B ) of codesof computable functions. It is just x(A) ! x(B ) as far as A  B holds. But itis the empty set, unless A  B holds. Hence the constructive axiom of choice(Church's thesis)
8x:9y:A  9f:8x:ry = app(f; x):A
cannot be px-realized. (Think why this does not con ict with the rule of choice.)
The inference rules ( E ) and ( I ) represent application and abstraction (function closure) as usual. When A is a true rank 0 formula, then x(A) is a singleton
so thatx(A  B)  x(A) ! x(B) ' x(B):Although we cannot de ne x(A  B ) by x(B ) (see appendix A), it is possible toeliminate the redundant x(A) in the context of a surrounded universal quanti er.
We may re ne px-realizability of an universal quanti er followed by an implication
A  B whose assumption part A is of rank 0 so thata x 8 : e:A  B i

E (a) ^ 8x : e:(A  ry = app(a; x):y x B ):In almost all cases in practice, fx : ejAg is a class so that 8x : e:A  B may bereplaced by 8x : fx : ejAg:B by which the same re nement is accomplished by theaid of the realizability of bounded universal quanti er. So we do not adopt theabove re nement.
The type of universal quanti er is the dependent product of Martin-Lof 1982:

x(8x : e:B) ' x : e:x(B):The inference rules (8E ) and (8I ) represent application and abstraction as usual.
In the extensional theory of types of Martin-Lof 1982, x 2 A:B (x) is a spaceof extension of functions, but our space is a space of codes which may not be
extensional. Furthermore, in Martin-Lof's theory, A is an arbitrary type andB (x) must be a type that belongs to the same or lower level of types to which
A belongs. In our case, A is a \small type" represented by a class and x(B (x))
may be a \large type" represented by a formula. Martin-Lof's type theory has acumulative hierarchy of types U0 ; U1 ; : : : with ! levels; on the other hand, PX has
only two levels of types, i.e., classes as small types and formulas as large types.
But Martin-Lof's type theory does not have a type expression such as x(e1 : e2 )for type expressions e1, e2 of the same level, which is our large type expression if
e1 and e2 are small type expressions. Furthermore, the nite set fe1 ; : : : ; en g isChapter 4

75

a small type, even if e1 ; : : : ; en are small types. If the bound variable x is a classvariable and e is V , then the type of dependent type is similar to the type 8 : ofthe second order -calculus. But there is a di erence; in second order -calculus
ranges over all types, but in our case ranges over only small types. Namely,
our type quanti er is predicative. So this is more similar to Martin-Lof's type
x : V0 :A(x) of the level V1 , where A(x) is a type of V1 .
Existential quanti er corresponds to the dependent sum. (9I ) construct atuple, which is just a list in our language, and (9E ) is a so-called split, which is
the let construct in our case. Note that whenever x1 does not belong to FV (e2 ),x(9x1 : e1:9x2 : e2:A) is not only isomorphic but also identical to x(9x1 : e1; x2 :e2 :A). On the other hand, x(8x1 : e1 ; x2 : e2 :A) is not identical, although it isisomorphic modulo extensional equality to x(8x1 : e1 :8x2 : e2 :A). An existential
formula with a class variable like 9X:A is a predicative second order type as similar
to the case of the universal quanti er above. Since a realizer of 9X:A actually
carries a witness of X , the dependent sum of the second order existential quanti er
is the \strong notion of sum" in the sense of Coquand 1986.
The type of conditional formula A = e1 ! A1 ; : : : ; en ! An is the type of
dependent conditionalCond(e1 ; x(A1 ); : : : ; en; x(An ))de ned in 2.4.1. (! _I ) and (! ^E ) do not express any program constructs. On
the other hand, (! _E ) and (! ^I ) are conditional forms. Note that conditionof each clause is an \expression" speci ed by a user, but the body is a \program"extracted from proofs.
The r-quanti er merely specializes the environment of a type expression.
But (r9E ), (r8I ) represent let constructs with arbitrary matching patterns.
The other two rules of r do not represent any program constructs.

4.3. CIG recursion

It is well known that the principle of mathematical induction represents primitive
recursion. Further correspondence between some structural induction principles
and recursions on data structures, such as list induction vs. list recursion, are
known. However, the known variety of the recursions represented by induction
principles has not been presented in a systematic way, and seems unsuitable tobe used as a control structure of an actual programming language. We solve thisproblem by using the recursion schemata generated by CIG induction. The aimof this section and the following section is to show that such recursion, called CIG
recursion, present a wide enough class of recursions to develop recursive programs.
The class de ned by an instance of CIG inductive de nition presents a domain
on which the corresponding CIG recursion terminates. This provides a method of

76

Chapter 4

separating the termination problem from the partial correctness problem in theframework of \proofs as programs". An implication of this method is that any
partial recursive function is programmable by a proof of PX, as we will show in
4.4.
Constable and Mendler 1985 have presented similar idea in the context ofthe type theory of Nuprl. Hagiya and Sakurai 1984 have presented a related idea
in the context of veri cation in logic programming.

4.3.1. De nition of CIG recursion

First, we de ne recursion schemata called CIG recursions, which are generated
from the CIG induction principle. The most general CIG recursions are simultaneous CIG recursions, but we consider only the nonsimultaneous case for simplicity.
Let us consider the nonsimultaneous CIG inductive de nition
deCIG ~x : C D e1 ! 1;1 ; : : : ; 1;q1 ;:::en ! n;1 ; : : : ; n;q :nLet ~y be a sequence of individual variables without repetition. For each i =1; : : : ; n and each j = 1; : : : ; qi , let ~vi;j be a tuple variable whose length equals
with the rank of the formula i;j . Let e01 ; : : : ; e0n be arbitrary expressions whose
free variables appear among the variables of ~x; ~y; FV (~v1;1 ); : : : ; FV (~vn;q ). Thenthe recursion schema of the the following form is called a CIG recursion for theabove CIG inductive de nition:f (~x; ~y) = cond(e1 ; let ~v1;1 = pred(1;1 ); : : : ;~v1;q1 = pred(1;q1 ) in e01
()
;:::;
en ; let ~vn;1 = pred(n;1 ); : : : ;~vn;q = pred(n;q ) in e0n )nnn

An instance of CIG recursion is called a CIG recursion in the narrow sense if
it is extracted from a proof which ends with CIG induction. Simultaneous CIG
recursion is de ned in the same way.
The following grammar de nes CIG predecessors without the help of CIG
templates. So CIG recursion is a logic-free concept.
::=f (e1; : : : ; en )jlist( 1; : : : ; n )jcond(e1 ; 1 ; : : : ; en ; n )j((x1 ; : : : ; xn )( ))jlet p1 = e1 ; : : : ; pn = en in ;

Chapter 4

77

where e1; : : : ; en are arbitrary expressions in which f does not appear. For any
given recursion of the form () whose CIG predecessors are de ned by the abovegrammar, we can give a CIG inductive de nition whose CIG recursion is the justthe given recursion. One serious restriction of CIG recursion is that f ( 1 ; : : : ; n )is not a CIG template, although f (e1 ; : : : ; en ) is. Consequently CIG recursions
tend not to be nested. But by the aid of higher order programming some nested
recursions are programmable by means of CIG recursion. We will later show that
the Ackermann function is programmable by means of CIG recursion. Anotherrestriction is that the conditions e1 ; : : : ; en of () are expressions in which thefunction f does not appear. We think this is a good restriction, for it makes
conditionals simple. Similar restriction is adopted in the regular programming
language of Hoare logic.

4.3.2. Examples of CIG recursion

In this subsection, we will present some examples that illustrate how actual recursive Lisp programs are written by means of CIG recursions.

4.3.2.1. Quotient and remainder

The rst example is the quotient-remainder algorithm. It is a simple but quite
instructive example. The theorem for which we are going to give constructive
proofs is the statement(I)fa : N; b : N +g ) 9q : N; r : N:(a = b  q + r ^ r < b):
N + is the class of positive integers. For readability, we use in x operators suchas , +, <; and some functions, such as <, , are regarded as both functions andpredicates. Assume e(a; b) realizes (I). Then it returns a list (q; r) whose q and r
are the quotient and the remainder of the division of a by b insofar as a : N andb : N + . We will give three proofs of this theorem, which represent three di erent
algorithms for computing the quotient and remainder. The fastest one will bepresented in 4.6.
In elementary arithmetic, the statement (I) would be proved by mathematicalinduction on a. We assume that N is de ned by CIG as Nat of 2.4.1. We assume
that the following three sequents are proved:(A1)
fa : N; b : N + ; equal(0; a) : T g ) a = b  0 + 0 ^ 0 < b;(A2)
; [ fr + 1 = bg ) a = b  (q + 1) + 0 ^ 0 < b;(A3)
; [ f:r + 1 = bg ) a = b  q + (r + 1) ^ r + 1 < b;where
; = fa : N; b : N + ; equal(0; a) = nil; q : N; r : N; a ; 1 = b  q + r ^ r < bg:

78

Chapter 4

The proof of these sequents do not a ect the extracted program, for they are rank
0 sequents (sequents with rank 0 conclusions). By the axiom (= 5) we can prove

fr : N; b : N + g ) r + 1 = b _ :r + 1 = b;(A4)
and its realizer iscond(equal(r + 1; b); 1; t; 2):(R1)

Roughly, by the following derivation we can prove (I).
(A1) (9I ) fF g ) F

S4(A3) (9I )(9I )(A4) (A2)
S
S
1

(I)

S5

S3

2

( _E )(9E )(CIG ind )whereF  9q : N; r : N:(a ; 1 = b  q + r ^ r < b):
Its realizer is f (a; b) where f is de ned byf (a; b) =cond(equal(0; a); list(0; 0);t; let (q r) = f (a ; 1; b) incond(equal(r + 1; b); list(q + 1; 0); t; list(q; r + 1))):This program is very slow. When f (a; b) is computed, f is always called a times.
Next we derive a more ecient program by another derivation. Set

deCIG a : D(b) N a < b ! >; t ! a ; b : D(b):A natural number a belongs to D(b) i a eventually becomes smaller than bthrough successive subtractions by b. Namely, D(b) is the domain on which the
Euclidean division algorithm in divisor b terminates. (Note that D(0) is the emptyset.) We abbreviate a = b  q + r ^ r < b by (a; b; q; r). We assume the following
two rank 0 sequents have been proved:(B1)
fa : N; b : N; a < bg ) (a; b; 0; a);(B2) fa : N; q : N; r : N; b : N; (a ; b; b; q; r); :a < bg ) (a; b; q + 1; r):Chapter 4

79

By applying (9I ) and (9E ) to (B 2), we prove(B3)
fa : N; b : N; :r < b; 9q : N; r : N:(a ; b; b; q; r)g ) 9q : N; r : N:(a; b; q; r):
Let a1 ; a2 be the realizing variables of the formula 9q : N; r : N:(a ; b; b; q; r).
Then list(a1 + 1; a2) is extracted from (B 3) thanks to the optimization done by
subst. Applying CIG induction on a : D(b) to 9q : N; r : N:(a; b; q; r) we prove
the following sequent from (B 1) and (B 3):(B4)

fb : N; a : D(b)g ) 9q : N; r : N:(a; b; q; r):From the proof, f (a; b) is extracted where f is a function de ned byf (a; b) = cond(a < b; list(0; a); t; let (a1 a2 ) = f (a ; b; b) in list(a1 + 1; a2)):
Assuming subtraction and < are primitive functions, this is much more ecientthan the previous program. The recursion has the form of iteration in the sense of
Backus 1978, and it actually represents the idea of the usual iterative algorithmof division. So far, we have established only the \partial correctness" of f , since
DD = f(a b)jb : N ^ a : D(b)g is a domain on which f terminates.
We will sometimes use the terminology \partial correctness" in a rather casual sense. Its actual meaning is as follows. In the framework of \proofs asprograms" in our setting, a conjecture (or goal formula) gives a speci cation of a
total correctness problem of a program to be extracted from a proof of the conjecture. Let us assume the speci cation of the function f is that f terminates
on each input x from a domain D and x and f (x) satis es the input-output condition P in the sense of 4.1. Then the partial correctness problem of the total
correctness problem is: to nd a domain E which is a superset of D and to prove
f terminates for each input x from E and the input and output satisfy P . The
problem does not include the problem: to prove E is a superset of D. Such aproblem will be called the termination problem of the total correctness problem.
If E is just the domain on which f terminates, this problem becomes the partial
correctness problem in the usual sense. But in actual proof-program development,
this relaxed sense is more useful than the usual sense. Note that we do not thinkof a partial correctness problem alone, but think of a partial correctness part of agiven total correctness problem.
So we have nished the partial correctness part of the problem. The nextstage is a veri cation of the termination part. To see that f (a; b) realizes (I), it issucient to prove(B5)

fa : N; b : N + g ) b : N; fa : N; b : N +g ) a : D(b):80

Chapter 4

These sequents state that f terminates on the intended domain fa; bja : N ^ b :N + g. They are easily proved and are rank 0 sequents. By applications of (cut)we nally prove the total correctness statement (I) from the partial correctness
statement (B4) and the termination statement (B5). Since the sequents of (B5)
are of rank 0, the applications of (cut) do not change the realizer, i.e., f (a; b) is
extracted from the proof of (I). In 4.6, we will see how to represent a tail recursive
division algorithm by CIG recursion.

4.3.2.2. Maximal element in an integer list

Next we consider the problem to get the maximum element of a nonempty list of
integers. The theorem we prove is

fa : List1(N )g ) 9m : N:(m 2 a ^ 8x : N:(x 2 a  x  m)):The formula m 2 a means m is an element of the list a and we suppose it is(II)

expressed in a rank 0 formula and List1(A) is the class of nonempty lists of A
de ned as in the example (6) of 2.4.1. The most straightforward proof will use
list induction. Let (m; a) be the formulam 2 a ^ 8x : N:(x 2 a  x  m):
First we prove the following rank 0 sequents:
(C1)
(C2)
(C3)

; [ ffst (a)  m0 g ) (fst (a); a);; [ ffst (a) < m0 g ) (m0 ; a);fa : Dp; snd (a) = nil; fst (a) : N g ) (fst (a); a);where ; is fa : Dp; snd (a) : T; a : List1(N ); fst (a) : N; (m0 ; snd (a))g: Furthermore we suppose

ffst (a) : N; m0 : N g ) fst (a)  m0 _ fst (a) < m0
has been proved, and its realizer is cond(fst (a)  m0 ; 1; t; 2). (Such a proof exists.)
Apply (9I ) to (C1) and (C2), then apply (_E ) to them with (C4) as a major
premise. Then a further application of (9E ) derives
(C4)

(C5)
fa : Dp; snd (a) : T; a : List1(N ); fst (a) : N; 9m : N:(m; snd (a))g ) 9m:(m; a):Applying (9I ) to (C3), we prove(C6)

fa : Dp; snd (a) = nil; fst (a) : N g ) 9m:(m; a):Chapter 4

81

Then by CIG induction for List1 we can prove (II) from (C5) and (C6). Its realizer
is f (a), and f is de ned byf (a) = cond(snd (a); let b = f (snd (a)) in cond(fst (a)  b; fst (a); t; b); t; fst (a));
where b is the realizing variable of 9m : N:(m; snd (a)).
This program is not realistic, for it consumes too much stack space. It is
possible to derive a tail-recursive realization of the same sequent. First we de nea classdeCIG [n; a] : M N List(N )equal(a; nil) ! >;n < fst (a) ! [fst (a); snd (a)] : M;
t ! [n; snd (a)] : M:;
and set(m; n; a) = }(m = n _ m 2 a) ^ 8x : N:((x = n _ x 2 a)  x  m):
Note that List(N ) is a list of N including nil. Suppose the following three valid
rank 0 sequents:(D1)
fequal(a; nil) : T; [n; a] : N  List(N )g ) (n; n; a);(D2); [ f (m; fst (a); snd (a)); n < fst (a)g ) (m; n; a);(D3); [ f (m; n; snd (a)); n  fst (a)g ) (m; n; a);where ; isfequal(a; nil) = nil; (m; fst (a); snd (a)); [n; a] : N  List(N )g:
Applying (9I ), (9E ) and CIG induction to these sequents, we can prove(D4)
f[n; a] : M g ) 9m : N:(m; n; a):Its realizer is f (n; a), where f is de ned byf (n; a) = cond(equal(a; nil); n;n < fst (a); f (fst (a); snd (a));
t; f (n; snd (a))):This recursive de nition is tail recursive and f (n; a) computes the maximum element of the list pair(n; a). By CIG induction for List1(N ), we can prove(D5)
fa : List1 (N )g ) [fst (a); snd (a)] : M;
(D6)
fa : List1(N )g ) 8m : N ( (m; fst (a); snd (a))  (m; a)):82

Chapter 4

Substitute fst (a) and snd (a) for n and a of (D4). Then the result is

fa : List1(N )g ) 9m : N: (m; fst (a); snd (a)):
By (replacement) with (D6), we can nally prove (II). The realizer extracted fromthe proof is f (fst (a); snd (a)). By the above idea, we will show how to simulates
Hoare logic in PX in 4.6.

4.3.2.3. The Ackermann function

So far all recursions we derived are not nested. We derive the Ackermann function
as an example of a nested CIG recursion through higher order programming. First
we de ne a graph of the Ackermann function.

deCIG [x;y; z] : Ack N N N
equal(x; 0) ! suc(y) = z;equal(y; 0) ! [prd(x); 1; z ] : Ack;t ! }(9z1 : N:([x; prd(y); z1 ] : Ack ^ [prd(x); z1 ; z ] : Ack)):
Next we de ne a class which denotes the recursion used in the Ackermann function.
deCIG [x; y] : Db N N equal(x; 0) ! >;equal(y; 0) ! [prd(x); 1] : Db;
t ! [x; prd(y)] : Db; 8y : N:[prd(x); y] : Db:
By CIG induction for Db with (9I ),(9E ), and (8E ), we can provef[x; y] : Dbg ) 9z : N:[x; y; z ] : Ack:
Its realizer is f (x; y), where f is de ned byf (x; y) = cond(equal(x; 0); suc(y);equal(y; 0); f (prd(x); 1);t; f (prd(x); f (x; prd(y)))):
Without the optimization by Optimize , the third clause of the above function
de nition would beapp(()((y):f (prd(x); y)); f (x; prd(y))):We prove fx : N; y : N g ) [x; y] : Db by double induction; by (cut) we prove(III)
fx : N; y : N g ) 9z : N:[x; y; z ] : Ack;

Chapter 4

83

and the realizer is the same as the above. The properties of Ack we used in theabove derivation, if we replace [x; y; z ] : Ack by Ack(x; y; z ), arefequal(x; 0)g ) Ack(x; y; suc(y));
fequal(y; 0); x =6 0; Ack(prd(x); 1; z )g ) Ack(x; y; z );fAck(x; prd(y); z1 ); Ack(prd(x); z1 ; z ); x =6 0; y =6 0g ) Ack(x; y; z );where x; y; z; z1 range over the natural numbers. The above three sequents may
be thought as a Prolog program for the the Ackermann function. What we did is
to compile it to a deterministic functional program and verify the total correctnessof the compiled code.

4.3.2.4. A function whose termination is unknown

The examples so far are functions whose termination are known. In this section
we extract a function whose termination is still unknown. The function isdef foo (x) = cond(equal(x; 0); 0;
equal(x; 1); 1;even(x); foo (x=2);
t; foo (3  x + 1));
where even(x) tests if x is an even number. The termination of this function isstill unknown, although its termination for many examples has been ascertainedby computer experiments. So we do not know how to extract this function witha termination proof, but we can extract this function from a proof by the same
method used to extract the Ackermann function. Namely we de ne two CIG
classes as follows:
deCIG x : D N equal(x; 0) ! >;equal(x; 1) ! >;even(x) ! x=2 : D;t ! 3  x + 1 : D:

deCIG [x; y] : G N N equal(x; 0) ! [x; 0] : G;equal(x; 1) ! [x; 1] : G;even(x) ! [x=2; y] : G;t ! [3  x + 1; y] : G:
Then it is easy to give a proof of x : D ) 9y : N:[x; y] : G by CIG induction for

D. Then from the proof, we can extract the program of foo . What did we prove?

84

Chapter 4

We proved that foo terminates on the class D. So the termination problem forfoo is stated as fx : N g ) x : D.

4.3.2.5. Searching for a prime number

Our technique separating termination and partial correctness provides a way to
extract search programs. Finding a prime number which is greater than or equal
to a given natural number was a problem for the \proof as program" approach.
The problem is formulated as(IV)

fn : N g ) 9p : N:(prime(p) = t ^ p  n);

where prime is a function which tests if a natural number is a prime. The standard
constructive proof of this theorem is as follows.
Assume that there is no prime number in the interval [n; n! + 1]. Then every
prime which is smaller than or equal to n! + 1 is smaller than n. But n! + 1 is notdivisible by a number m such that 2  m  n. So n!+1 must be a prime number.
This is a contradiction. So we see(E1)

fn : N g ) ::9m < n! ; n + 2:(prime(n + m) = t):

On the other hand, since prime(n + m) = t is decidable,(E2)

fb : N; n : N g ) 9m < b:(prime(n + m) = t) _ :9m < b:(prime(n + m) = t)

is constructively provable by mathematical induction on b. Hence we see

fn : N g ) 9m < n! ; n + 2:(prime(n + m) = t);
and this implies (IV).
Since mathematical induction is used to prove (E2), the realizer of (E2) uses
primitive recursion. The following was extracted by PX from a proof of (E2):f (b; n) =cond(zerop(b); list(2; nil);t; let (a1 a2 ) = f (b ; 1; n) incase(a1; list(1; a2); cond(prime(n + b); list(1; n + b); t; list(2; nil)))):The program extracted from the proof of (IV) islet (r1 r2) = f (n! ; n + 2; n) in case(r1; r2; quote(dummy)):Chapter 485This calculates n! and calls f recursively n! ; n + 2 times, even when n is a prime
number. So this program is not tractable.
We show how a simple search program is extracted from another proof whichuses the proof above as a termination proof.
The program which we expect is a simple search program which looks likesearchprime (n) = cond(prime(n); n; t; searchprime (suc(n))):First we de ne a class which represents this recursion. We call a prime which isgreater than or equal to n an upper prime of n. The property \n has an upper
prime" can be de ned by

deCIG n : HasUpperPrime N prime(n) ! >;t ! suc(n) : HasUpperPrime :By induction for HasUpperPrime, we can prove

fn : HasUpperPrime g ) 9p : N:(prime(p) = t ^ p  n):(E3)

Furthermore, we see

fprime(n) = tg ) n : HasUpperPrime ;fm : N; n : N; m  n; m : HasUpperPrime g ) n : HasUpperPrime :()So we see,(E4)

fn : N; 9p : N:(prime(p) = t ^ p  n)g ) n : HasUpperPrime :By (E3) and (E4), we see

fn : N; 9p : N:(prime(p) = t ^ p  n)g ) 9p : N:(prime(p) = t ^ p  n):
Although this sequent looks tautological, the program extracted from the proof
above is searchprime (n). Since we have proved (IV), we can prove (IV) from thisand the extracted program is again searchprime (n). This proof looks unnatural,since we used a proof of (IV) to prove (IV). To avoid this unnaturalness, we may
prove the sequent(E5)

fn : N g ) n : HasUpperPrime

directly and prove (I) by (E3) and (E5). (E5) is provable by (E1), (E4), andf::n : HasUpperPrime g ) n : HasUpperPrime :86

Chapter 4(E5) is also provable as (E1) using the two properties () of HasUpperPrime above.
This method is an application of Markov's principle of 2.3.5. PX can prove
Markov's principle}9x : N:P (x)  9x : N:P (x)for any provably decidable P (x), and the extracted program is just a search program which tests natural numbers by P (x) successively from zero. So, when one
proves existence of x by any method (even classically), one can kill the computational content of the proof by putting } in front and then applying Markov's
principle to extract the search program.

4.3.2.6. The Chinese remainder theorem

Many theorems in elementary number theory are constructive and involve various kinds of algorithms. It would be interesting to see how such theorems areformalized by the language of PX and such algorithms are represented by CIG
recursions. (In this section, we assume a class of integers Int, and basic functions
and axioms on it. The actual implementation described in chapter 7 has these.)
As a rst step in the development of elementary number theory in PX, wewill do the existence part of the Chinese remainder theorem (see Shockley 1967).
The theorem, thousands of years old, is informally stated as follows.

The Chinese remainder theorem. The system of linear congruences

8 x  a1 (mod m1)>< x  a2 (mod m2)>: x  a (modm)
nn

has a solution if m1 ; : : : ; mn are pairwise relatively prime.
The rst thing to be done is the formalization of the systems of congruences.
We formalize a single congruence a  b (mod m) by [a; b] : Mod (m), where
Mod (m) = f[a; b] : Int  Int jm : PN ^ m : Divides (a ; b)g;
PN is the class of positive integers and Divides(a) is the class of divisors of ade ned by
Divides (a) = fa : Int jb : Int ^ }9q : Int :b  q = ag:

Chapter 4

87

A system of congruences [c; m] : SystemOfCong and its solution x : Satis es (c; m)is formalized as follows:
deCIG [c; m] :SystemOfCong 
c ! fst (c) : Int ; fst (m) : PN ; [snd (c); snd (m)] : SystemOfCong ;t ! m = nil :deCIG [c; m] :IsSatis edBy (x) SystemOfCong
c ! [x; fst (c)] : Mod (fst (m)); [snd (c); snd (m)] : IsSatis edBy (x);t ! m = nil ; x : Int :Satis es (c; m) = fxj[c; m] : IsSatis edBy (x)g

We may formulate the assumption \m1 ; : : : ; mn are pairwise relatively prime"by any rank 0 formula. We will denote it by PrPrime(m). Then the Chineseremainder theorem is formulated as(V)f[c; m] : SystemOfCong ; PrPrime (m)g ) 9x : Int :(x : Satis es (c; m)):Next we prove the following lemma:
Lemma A. The linear diophantine equation a  x + b  y = c has a solution if
the greatest common divisor of a and b divides c.
The greatest common divisor of a and b will be denoted by gcd (a; b). Ourformulation of this lemma is

8[a; b; c] : LemmaAAsp :9x; y : Int :a  x + b  y = c;where LemmaAAsp is de ned by
LemmaAAsp = fa; b; cja : Int ^ b : Int ^ gcd (a; b) : Divides (c)g:

We prove this lemma by the Euler method (see Shockley 1967) from the following
two lemmas:
LemmaB : 8a; b : Int :9q : Int ; r : N :(a = b  q + r ^ r : AbsLess0 (b));
LemmaC : 8b : Int ; a : Divides (b):9q : Int :a = b  q:
AbsLess0(b) is the class de ned by

deCIG x : AbsLess0 (b) Int equal (b; 0) ! x = 0; t ! x < jbj:

88

Chapter 4

The former lemma is an extension of the result of 4.3.2.1 and the latter follows
from this. We assume these from now on.
We de ne two auxiliary classes to prove LemmaA.
ImpElm (a) = f[a1 ; b1 ; c1 ] : LemmaAAsp ja1 < ag;deCIG [a; b; c] : Dom LemmaAAsp 8[a1; b1; c1] : ImpElm (a):[a1 ; b1; c1] : Dom :Dom denotes the recursion used in the Euler method and ImpElm is an exampleof the technique eliminating an implication mentioned in 4.2.
The partial correctness of the Euler method is stated asfLemmaB ; LemmaC ; [a; b; c] : Dom g ) 9x; y : Int :a  x + b  y = c:
This can be proved by induction for Dom. In the case a = 0, there is y0 such thatb  y0 = c. The solution of the equation is x = 0 and y = y0 . Let us assume a 6= 0.
Let q1 , r1 and q2 , r2 be the quotients and remainders when b and c are divided
by a. Since r1 is smaller than a, the equation r1  x + a  y = r2 has a solution by
the induction hypothesis. Let x1 and y1 be a solution. Then x = q2 + y1 ; q1  x1
and y = x1 is a solution of a  x + b  y = c.
The termination is stated asf[a; b; c] : LemmaAAsp g ) [a; b; c] : Dom :The proof is obvious. By these we can prove the lemma by the rule of (cut). The
program extracted from this proof is f (a; b; c; 1; 2 ), wheref (a; b; c; 1 ; 2 ) =cond(equal(a; 0); list(0; app(app( 1 ; b; c)));t; let (q2 r2 ) = app( 2 ; c; a) inlet (q1 r1 ) = app( 2 ; b; a) inlet (x1 y1 ) = app(((a1 ; b1 ; c1 )(f (a1 ; b1 ; c1 ; 1 ; 2 ))); r1 ; a; r2 ) inlist(q2 + y1 ; q1  x1 ; x1 )):This program has two unnecessary app's. This was caused by the limited
power of the present version of optimizers. (See appendix C.) The variables 1
and 2 are realizing variables of LemmaC and LemmaB, respectively.
By LemmaA, we can prove()

8a; b : Int ; m; n : PN :([m; n] : RPrime 9x : Int :([x; a] : Mod (m) ^ [x; b] : Mod (n)));Chapter 4

89

by solving the equation m  x1 + n  y1 = a ; b and taking n  y1 + b as x. RPrimeis the class of m and n which are relatively prime.
We prove the Chinese remainder theorem from this fact by the induction
for SystemOfCong. Assume y0 is a solution of [snd (c); snd (m)] : SystemOfCong .
Let (list(a1 ; : : : ; an )) be the product a1      an . By the assumption of thetheorem, fst (m) and (snd (m)) are relatively prime. By (), there is x0 suchthat [x0 ; fst (c)] : Mod (fst (m)) and [x0 ; y0 ] : Mod ((snd (m))). Obviously x0 :Satis es (c; m).
The program extracted from this proof isg(c; m; 1 ; 2 ) =cond(c; app((m = fst (m);n = (snd (m));
a = fst (c);b = g(snd (c); snd (m); 1 ; 2 );1 = 1;t; 0):

2 = 2)
()(let (x1 y1 ) = f (m; n; a ; b; 1 ; 2 ) in n  y1 + b));This program computes the product (snd (m)) at each time when g is called.
To avoid this, we may replace the conclusion of (V) by

9x; y : Int :(x : Satisfies(c; m) ^ y = (m)):
Then we can use the value of y instead of (snd (m)) in the proof of induction
step. So  does not appear in the extracted program.

4.4. PX is extensionally complete

We say a class of recursion (recursive de nition) is intensionally complete when
any form of recursive de nition belongs to the class. On the other hand, we say
a class of recursive functions is extensionally complete when any recursive function belongs to the class. (Caution: we use the word \function" in the sense of
programming languages. So a recursive function is a partial recursive function in
the sense of recursion theory.) Evidently, the class of CIG recursions is not intensionally complete, but it generates an extensionally complete class of functions.
Furthermore, any recursive functions can be programmed by CIG recursions in
the narrow sense.

90

Chapter 4

We consider recursive functions over natural numbers, i.e., a (partial) function de ned by one of the following:(i) (x1 ; : : : ; xn ) = k (k 2 N );(ii) (x1 ; : : : ; xn ) = xi (i = 1; : : : ; n);(iii) (x) = suc(x);(iv) (x1 ; : : : ; xn ) =  ( 1 (x1 ; : : : ; xn ); : : : ; m (x1 ; : : : ; xn ));(v) (0; x2 ; : : : ; xn ) = (x2 ; : : : ; xn );(x1 ; x2 ; : : : ; xn ) = ((prd(x1 ); x2 ; : : : ; xn ); prd(x1 ); x2 ; : : : ; xn ) if x1 > 0;(vi) (x1 ; : : : ; xn ) = ymin
( (x1 ; : : : ; xn ; y) = 0):
2NLet (x1 ; : : : ; xn ) be a recursive function. Then we de ne a class D and a rank
0 formula G(x1 ; :::; xn ; y) that de nes a class. The intended meanings of D and
G are the domain and the graph of . We de ne G as we de ned the graph of afunction in 2.4.3. Furthermore we will show(A)

8[x1; : : : ; xn ] : D:9y : N:G(x1 ; : : : ; xn ; y)is provable in PX. We say that (A) is the speci cation of .
The speci cations of the functions of (i), (ii), (iii) are

8[x1 ; : : : ; xn ] : N n :9y : N:k = y;8[x1 ; : : : ; xn ] : N n :9y : N:xi = y;
8x : N:9y : N:suc(x) = y:
For the composition (iv) we assume n = 1 for simplicity. Assume that 8x1 :D1 :9y : N:G1 is the speci cation of 1 and 8x1 : D2 :9y : N:G2 is the speci cationof . Then the speci cation of (x1 ) is

8x1 : D:9y : N:G(x1 ; y);whereG(x1 ; z ) = }y1 : D1 :(G1 (x1 ; y1 ) ^ G2 (y1 ; z ));D = fx1 : D1 j9z : N:G(x1 ; z )g:
For (v) we assume n = 2. Assume that 8x2 : D1 :9y : N:G1 (x2 ; y) is the speci cation of (x2 ) and 8[y; x1; x2 ] : D2 :9z : N:G2 (y; x1 ; x2 ; z ) is the speci cation ofChapter 4

91(y; x1 ; x2 ). De nedeCIG [x1 ; x2; z] : C equal(x1; 0) ! G1 (x2 ; z ) ^ x2 : D1 ;t ! rx1 = prd(x1 ):}9y : N:([y; x1 ; x2 ] : D2 ^ G2 (y; x1 ; x2 ; z ) ^ [x1 ; x2 ; y] : C );and setG(x1 ; x2 ; y) = [x1 ; x2 ; y] : C;
D = fx1 j}9y : N:[x1 ; x2 ; y] : Gg:
Then we can prove (A) for these G and D by mathematical induction on x1 .
Note that we cannot prove (A) for these directly from the de nition of D, for thefollowing is not constructive:(}9y : N:G)  9y : N:G:
So far only constants, variables, equal(x; 0), and prd(x) are used as expressions.
The next step (vi) requires an introduction of a new function using (choice2). We
assume n = 1. Assume 8[x; y] : D1 :9z : N:G1 (x; y; z ) is the speci cation of .
Then by the rule of (choice2) we may introduce a new function f for which thefollowing is provable:

f[x; y] : D1 g ) rz = f (x; y):G1 (x; y; z ):De nedeCIG z : D0(x) N equal(f (x; z); 0) ! >;t ! suc(z ) : D0 (x):Let G0 (x; y; z ) be the formula[x; y; z ] : N  N  N ^ z  y ^ f (x; y) = 0 ^ 8u : N:(z  u < y  f (x; u) 6= 0);
and setD = fx : N j0 : D0 (x)g;G(x; y) = G0 (x; y; 0):Then we can prove the following by induction for D0 (x):fx : N; z : D0 (x)g ) 9y : N:G0 (x; y; z ):

92

Chapter 4

By substituting 0 for z , we can prove (A) for the above G and D, i.e., 8x : D:9y :N:G(x; y) holds.
Hence each partial recursive function (x1 ; : : : ; xn ) has a proof P whose
conclusion is the form (A) whose D and G satisfy the conditions

PX ` 8[x1; : : : ; xn ] : D:xi : N (i = 1; : : : ; n);PX ` 8[x1; : : : ; xn] : D; y : N; y0 : N:G(x1 ; : : : ; xn; y) ^ G(x1 ; : : : ; xn ; y0)  y = y0;
PX ` 9y:G(x1 ; : : : ; xn ; y)  [x1; : : : ; xn ] : D;
G is the graph of ,
D is the domain of .

According to the de nition of realizability, insofar as P is a proof of (A) with theabove properties, for each [x1 ; : : : ; xn ] : D,extr(P )(x1 ; : : : ; xn ) = (x1 ; : : : ; xn )holds. If we use the recursive de nition or a recursion theorem, then the theorem
is trivial. To extract a recursive function f , we de ne f by the aid of recursion,and de ne D and G as fx : N jf (x) : N g and fx; y : N  N jf (x) = yg. Then
8x : D:9y : N:[x; y] : G is obvious and f is extracted from the proof. What did weprove then? The point of the theorem is that we used neither recursive de nitions
nor recursion theorem of PX to deduce P for . We started with basic functions
prd, suc, and equal, then we constructed functions by proving theorems in PX
and extracting functions from such proofs by the rule of (choice2). By this accumulation of functions, we could achieve all partial recursive functions. Namely, we
programmed recursive functions not by the aid of ordinary programming language
but by proofs.
If one wants to verify that a function  which is extracted from a proof P
has a property, say()

8x1; : : : ; xn :(Input (x1 ; : : : ; xn )  Output (x1 ; : : : ; xn ; (x1 ; : : : ; xn )));

then it is sucient to verify the two conditions
Input (x1 ; : : : ; xn )  [x1 ; : : : ; xn ] : D;
Input (x1 ; : : : ; xn ) ^ G(x1 ; : : : ; xn ; y)  Output (x1 ; : : : ; xn ; y):The rst condition says that insofar as the input x1 ; : : : ; xn satis es the input
condition Input,  terminates on the input. The second condition says that
if  terminates on the input x1 ; : : : ; xn with an output y, then it satis es theChapter 4

93

output condition. Hence these are just the conditions of termination and partial
correctness of the statement of () in the usual sense (not in the casual sense of
4.3). Note that the input and output conditions may be thought to be of rank 0,
since they are statements on data, i.e., they do not embody any computational(or constructive) meaning. Hence the above two conditions may be thought tobe of rank 0. Thanks to proposition 3 of 2.3.5, one may prove them by virtueof classical logic. Furthermore one may prove them by semantic considerations.
This resembles the fact that Cook's relative completeness result on Hoare logic uses
formulas that are valid in the intended interpretation of an assertion language asaxioms in the consequence rule. Thus we have obtained the following completenessresult:Theorem 1 (extensional completeness of PX). PX can presents any partial recursive function by its proof, and its veri cation conditions for properties
expressed in the language of PX can also be expressed by the language of PX.
Furthermore, the veri cation conditions may be proved by any valid reasoning.
This is a theoretical basis for programming via proofs in PX. As noted above,
this completeness result strongly resembles the completeness results of Hoare logic.
Compare with the above argument with completeness proofs of Apt 1981. We will
give a more sophisticated result on relationship between PX and Hoare logic in
4.6.
We can program all the partial recursive functions by means of proofs, but
it is an open problem whether all higher order partial recursive functions can be
programmed by proofs. We conjecture that an extension of the theorem to higher
order is impossible. But we have not yet been able to show this incompletenessresult.

4.5. Trans nite induction

Hayashi 1983 introduced two formulations of the structural induction rule, SIR
and SIR0 . These were the main tools for representing recursive programs via
proofs in LM, an earlier version of PX. PX does not have those principles as
postulates, but CIG induction subsumes them. A diculty of SIR and SIR0 wasthat they were not schemata but rules. This restriction inevitably followed fromthe fact that our logic does not have variables representing arbitrary functions.
To state the well-foundness of a binary relation, a variable ranging over arbitrary
functions is necessary:(WF1):9 8n : N:R( (n + 1); (n)):
But every function of LM and PX is a computable function. If ranges over only
computable functions, then the binary relation R is not well-founded even if (WF1)

94

Chapter 4holds. So, to formulate SIR, we had to introduce a new function variable which
was intended to range over arbitrary functions and state structural inductions
approximately as follows:; ) :8n : N:R( (n + 1); (n))(SIR)
; [ f8x((8y:R(y; x)  (y))  (x))g ) (x) :The point is that of the upper sequent is considered to be bound by a universal
quanti er, so we could not make it a schema. Although PX is a system that does
not include the concept of arbitrary functions, by means of the inductive de nition
via CIG, we can describe the well-foundness of relations by using a single formula
without function variables. Let R be a binary relation over a class D, i.e. if
R(x; y) holds then x : D and y : D. We assume R is a CIG template so that we
can de ne a class Prd by

PrdD (x; R) = fy : DjR(y; x)g:
Then we de ne a class Acc of the accessible elements by R as follows:
deCIG x : Acc(D; R) D 8y : PrdD (x; R):y : Acc(D; R):
Then R is a well-founded relation on D i(WF2)
8x : D:x : Acc(D; R):
Actually this is the condition of the following rule of induction on R over D:; [ fx : D; 8y : PrdD (x; R):(y)g ) (x) :(ID1)fx : Dg [ ; ) (x)Let us prove this fact. Assume (ID1) holds. Then set;  ;; (x)  x : Acc(D; R):
Then by the de nition of Acc the upper sequent of (ID1) holds. So (WF2) holds.
On the other hand, by (CIG ind) for Acc, (ID1) is derived from (WF2) as follows:; [ fx : D; 8y : Prd(x; R):(y)g ) (x)fx : Dg ) x : Acc(D; R)
fx : Acc(D; R)g [ ; ) (x):fx : Dg [ ; ; fx : Acc(D; R)g ) (x)The expected recursion()f (x;~a) = g(((y):f (y;~a)); x;~a);Chapter 495

which was associated with SIR in Hayashi 1983 is actually extracted from thisderivation by the extraction algorithm extr. Hence SIR of Hayashi 1983 is reformulated as(SIR0 )
if (WF2) is a theorem in PX, then (ID1) is a rule of PX.
Note that we may use this principle not only as the rule stated above but also as
a schema:
f8x : D:x : Acc(D; R)g ) 8x : D:(8y : Prd(x; R):(y)  (x))  8x : D:(x):Although schematic formulation of SIR is unnecessary for the actual practice ofprogram extraction, its clarity is a theoretical advantage. It is noteworthy thatthe di erence between (WF1) and (WF2) make no di erence from a theoreticalpoint of view. By the technique of Hayashi 1982, we can prove that (WF1) isprovable in PX i (WF2) is provable in PX. Since (WF1) and (WF2) are rank
0 formulas, we may ignore how they are proved. So despite the di erence in theformulation of the well-foundness of R, (SIR0 ) may be thought as a reformulationof SIR of Hayashi 1983. Note that the result of Hayashi 1982 establishes only theprovable equivalence of (WF1) and (WF2), i.e.,` (WF1) i ` (WF2):
Since a class de ned through a CIG inductive de nition represents the minimal
xed point of the inductive de nition in the semantics given in chapter 7, (WF2)
actually de nes the well-foundness of R in our semantics of PX. So (WF1) and(WF2) are semantically equivalent, i.e.,j= (WF1)  (WF2):
We must show how to derive SIR0 and its realizer of Hayashi 1983 from CIG
recursion. For simplicity, we do not treat the full formulation, but it is completely
straightforward to extend the following arguments to the general case. Assume
the following are provable:; [ fx : C1 ; x : Dg ) t1 (x) : D ^ t2 (x) : D;
; [ fx : C2 ; x : Dg ) t3 (x) : D;
; [ fx : Dg ) x : C1 _ x : C2 ;; [ fx : Dg ) :(x : C1 ^ x : C2 );where ; is a set of rank 0 formulas. De ne R(y; x) by
R(y; x)  x : D ^ }((t1 (x) = y _ t2 (x) = y) ^ x : C1 ) _ (t3 (x) = y _ x : C2 ):96

Chapter 4

Further assume that (WF1) or (WF2) holds for these D and R. SIR0 asserts thevalidity of the following rule under these conditions:(ID2); [ fx : D; x : C1 ; A(t1 (x)); A(t2 (x))g ) A(x); [ fx : D; x : C2 ; A(t3 (x))g ) A(x):; [ fx : Dg ) A(x)By the conditions, using (choice2), there is an expression e such thatfx : Dg ) Case(e; x : C1 ; x : C2 )is provable. De nedeCIG x : DD D equal(e; 1) ! x : C1 ; t1 (x) : DD; t2 (x) : DD;equal(e; 2) ! x : C2 ; t3 (x) : DD:
The rule of (CIG ind) for DD is as follows:
(ID3)

;)A

)A

:
0 f x : DD g1(e; 1) : T; x : C1 ; A(t1 (x)); A(t2 (x)) g C
B@ [; ; f equal
 equal(e; 1) = nil; equal(e; 2) : T; A ) A(x)[ ;x : C2 ;A(t3 (x))
By the rule of CIG induction for Acc, we can prove thatfx : Acc(D; R)g ) x : DD:
Hence, if WF1 holds for R, then 8x : D:x : DD, so we may replace DD of (ID3)by D. The result is a rule that subsumes (ID2). CIG recursion for (ID3) isf (x;~a) = case(e; e0(f (t1 (x;~a); f (t2 (x;~a)));~a); e1 (f (t3 (x);~a)));which is the realizer associated with SIR0 in Hayashi 1983. In Hayashi 1983 we
had to treat SIR and SIR0 as di erent rules with di erent realization methods,
but now they are special cases of of CIG induction.
The addition of trans nite recursion or trans nite induction for primitive recursive well-orderings on natural numbers are standard proof-theoretic techniques
to enlarge proof-theoretic strength and the set of provably recursive functions.
The introduction of well-founded relations are also an old technique in program
synthesis systems. CIG subsumes these techniques in a natural way, and generalizes them. If we use only trans nite induction for well-founded relations, i.e. SIR0

Chapter 4

97

as de ned above, the extracted recursion always has the form of (). But CIG
induction can generate a much wider class of recursions.

4.6. Simulating Hoare logic

In this section we present a method by which we can \simulate" Hoare logic in
PX. The extraction of the maximum element function in 4.3.2.2 turns out to be
an example of the technique of this section. We rst explain basic motivation for
the \simulation".
In light of the technique of developing programs with proofs of correctness
of Alagic and Arbib 1978, a derivation in Hoare logic may be thought of not
only as a veri cation of the \written out program" but also as a \trace" or partial\history" of the program's development. In the Hoare logic of a Pascal-like regularprogramming language, each program construct has exactly one logical inference
rule by which the construct is newly introduced. A veri ed program is determinedby the structure of its correctness proof. Hence we can \extract" a program froma derivation of Hoare logic whose programs are hidden. This observation is a key
with which to relate the notion of \proofs as programs" and Hoare logic.
Let us illustrate the idea by an example. Consider the following skeleton ofa derivation in Hoare logic:
(A)
1
2
(AA)
(AA)

fx  yg ) F1 fF1 gS1 fGg (CR) f:x  yg ) F2 fF2 gS2 fGg (CR)fx  ygS3 fGg
f:x  ygS4fGg(if R);
f gS5fGg

where

F1 = x  x ^ x  y ^ x 2 fx; yg;
F2 = y  x ^ y  y ^ y 2 fx; yg;
G = z  x ^ z  y ^ z 2 fx; yg:and (AA), (CR), (if R) mean Assignment Axiom, Consequence Rule, and Conditional Rule, respectively. Let us recover the program S5 from this. The matchingof G and F1 is z = x, so, ignoring identical assignment, S1 must be z := x.
Similarly we see S2 is z := y. Since consequent rules do not change programs,
S3 ; S4 must be S1 ; S2 . Similar considerations tell us that S5 is if x  y then z :=x else z := y. So the program S5 is uniquely determined by the structure of
logical inferences of the proof skeleton (A).
On the other hand, replacing G by 9z:G, further replacing fP gAfQg by
fP g ) Q, and adding some trivial sequents, (A) turns into a proof in PX:

98

(B)

Chapter 4

2
fF1 g ) F1
fF2 g ) F2
fx  yg ) F1 fF1 g ) 9z:G f:x  yg ) F2 fF2 g ) 9z:G0fx  yg ) 9z:G
f:x  yg ) 9z:G;
f g ) 9z:G
where the last inference is regarded as (! _E ) and 0 is a proof of Sor(x y; :x  y). Furthermore we can reconstruct (A) from (B), and then the realizer1of (B) is equivalent to a function that returns the value of the variable z of S5 .
Deriving the proof (B) is equivalent to developing the program S5 with the correctness proof (A). So we say (B) simulates (A). Essentially the same idea appearedin Takasu and Kawabata 1981 and a system based on it has been implemented by
Takasu and Nakahara 1983. Their system constructs a Pascal program throughan interactive development of a proof of an existence theorem. They used logicalinference rules tailored to their speci c purpose. In essence, their inference rules
are rules of Hoare logic hiding programs. We will show that the inference rules of
PX can be used for the same purpose, although they were designed to be much
more general.
We formulate our simulation technique as the following theorem.
Theorem 1. Assume the assertion language of Hoare logic is interpretablein PX. If fQgB fRg is provable in Hoare logic with all of true statements of theassertion language as axioms, then there is a proof of PX with true rank 0 sequentsas axioms, say , satis es the conditions(a) extr() is an iterative program, see below, which is equivalent to B underQ.
(b) The assumption of  is Q under the interpretation of L in PX.
(c) The conclusion of  is 9~x:R under the interpretation of L in PX, where ~x isthe sequence of variables assigned values by B .
By the relative completeness of Hoare logic, the provability and validity offQgB fRg are equivalent. So the assumption of this theorem may be \fQgB fRg
is valid" instead of \fQgB fRg is provable".
PX does not have imperative programming features, so we have to represent
them as state transition functions. We say a functional program is an iterative
program if its recursions involve only tail recursion so that a compiler or an optimizer can directly transform them to actual Algol-like imperative programs. The
set of iterative programs, say S, is de ned by the following. A positive number
called a rank is attached to each iterative program (expression).
(1) If e1 ; : : : ; en are expressions interpreting terms of (the assertion language of)
Hoare logic, then [e1 ; : : : ; en ] belongs to S.

Chapter 4

99(2) Assume e1 and e2 are elements of S . Let ~x = [x1 ; : : : ; xn ] be a tuple ofvariables without repetitions such that n is the rank of e1 . Then subst ~x
e1 in e2 belongs to S and its rank is the rank of e2 .
(3) If e is an expression interperting a term of the of Hoare logic and e1 ; e2 2 Swith the same rank then cond(e; e1 ; t; e2 ) is in S and its rank is the rank ofe1 and e2 .
(4) Assume that e is an expression interpreting a term of Hoare logic and theexpressions e1 ; : : : ; en are elements of S. Let ~x = x1 ; : : : xn be a sequence ofvariables without repetition. Then de ne a function f by the tail recursion

f (~x; ~y) = cond(e; f (e1 ; : : : ; en; ~y); t; [~x]):Then f (~x; ~y) is in S and its rank is n.
These (1)-(4) are counterparts of statements of assignment, composition, conditional, and while, respectively.
A program e of PX is said to be equivalent to an imperative program P
under a condition Q i FV (e) is a subset of the set of all variables appearing in
P , and under the function declaration

function foo (x1 ; : : : ; xn ; y1; : : : ; ym) begin P ; foo := [x1; : : : ; xn ] end
the equatione = foo (x1 ; : : : ; xn ; y1; : : : ; ym )holds under the condition Q, where x1 ; : : : ; xn is the variables to which the program P assigns values and y1 ; : : : ; yn are the rest of the variables appearing in P .
We call x1 ; : : : ; xn the program variables of P and denote them by PV (P ).

This de nition of equivalence of the programs guarantees only the extensional equivalence of programs, so the statement of the theorem guarantees onlythat extr() is extensionally equal to B , but the proof of this theorem below
constructs a proof  for which extr() is almost intensionally equivalent to B .
Namely, if extr() is optimized by a clever optimizer that transforms tail recursions to iterations and removes unnecessarily created lists used as tuples, then the
optimized extr() may be almost literally equivalent to B . Although we do nothave a formal description of this fact, the proof below may convince the readersthat our claim is reasonable.
We de ne a Hoare logic of total correctness HL, which we are going tosimulate by PX. Let L be the assertion language of HL. We assume there is aninterpretation of L in PX. The interpretations of expressions of L in PX must havevalues. Especially, true and false must be interpreted as t and nil, respectively.
The class of regular programs is de ned as usual except that we use simultaneous

100

Chapter 4

assignment. We assume that L does not have logical symbols 9; _. Since thelogic of L is classical, this is not an essential restriction. Furthermore, we assume
that f~xjP g is a class in PX for any formula P of L. This mild assumption is notnecessary but simpli es the proof.
Assignment Axiom :fP (~t)g ~x := ~t fP (~x)g:

Composition Rule :fP gAfQg fQgB fRg :fP gA; B fRg

Conditional Rule :while Rule :fP ^ e = truegB1fQg fP ^ e = falsegB2fQg :fP g if e then B1 else B2 fQg
fP ^ e = true ^ ~x = ;;!
snapgB fP ^ ;;!
snap  ~xgfP gwhile e do B odfP ^ e = falseg ;where ;;!
snap is a sequence of \snapshot variables" appearing neither in the program
B nor in the formula P and ~x is PV (B ), e is a Boolean expression, and the binary
relation  is well-founded.
Consequence Rule :P 0  P fP gAfQg Q  Q0 :fP 0gAfQ0 g

This system is complete in Cook's sense (see Apt 1981).
Proof of theorem 1. We prove theorem 1 by induction on the structure of
proofs of Hoare logic. For simplicity, we assume that the domain of the assertion
language is the domain of PX.
With the assignment axiom we associate; tn )g ) P (t1 ; : : : ; tn )
 = fP (t ; f: P: :(;tt1 ;):g: :)9x ; : : : ; x :P (x ; : : : ; x ) (9I ):
1

n

1

n

1

n

Then extr() is [t1 ; : : : ; tn ], and it can be regarded as an assignment statementof S satisfying the conditions of the theorem.
Assume that
1 ` fP g ) 9~x0 :Q; 2 ` fQg ) 9~x:R

Chapter 4

101

are associated with the premises of the composition rule. Then  is1 2 (9E)

fP g ) 9~x:R

andextr() = subst ~x0

extr(1 ) in extr(2 ):This belongs to S.
Let 1 and 2 be associated with the premises of the conditional rule. By
the aid of (^I ) and (cut) there are 01 and 02 such that
01 ` fe : T; P g ) 9~x0 :Q; extr(01 )  extr(1 );02 ` fe = nil; P g ) 9~x00 :Q; extr(02 )  extr(2 ):Then  is
0

1

2

Sor(e; t) fP; e : T g ) 9~x:Q fP; e = nilg ) 9~x:Q (!_E)
fP g ) 9~x:Q
where ~x is the union of ~x0 and ~x00 , andfQg ) Q01fe
: T; P g ) 9~x0 :Q fQg ) 9~x:Q
1 =(9E );
fP; e : T g ) 9~x:Q
fQg ) Q
0200
fe : T; P g ) 9~x :Q fQg ) 9~x:Q (9E):2 =fP; e = nilg ) 9~x:Q

Note that we assume that Sor(e; t) is provable, for e is an expression of HL, so it
always denotes a value. Then its realizer iscond(e; subst ~x0

extr(1 ) in ~x; t; subst ~x00

extr(2 ) in ~x):This belongs to S.
Suppose ` fP ^ e = true ^ ~x = ;;!
snapg ) 9~x:(P ^ ;;!
snap  ~x)is associated with the premise of the while rule. Let ~x be x1 ; : : : ; xn and letextr() be d. Set
di = nth(i; d); d~ = [d1 ; : : : ; dn ];102Chapter 4

where nth(i; d) is the function that fetches the ith element of the list d. By(choice2), we may regard d~ as a tuple of expressions de ned in PX. So we candeclare a class W (~s), such thatdeCIG ~x : W (~s)  e ! d~ : W (~s); t ! >:;where ~s = (FV (d~) [ FV (e)) ; f~xg. Set

F (~x) = 9~x0 :~x : R(~x0 ;~s)deCIG ~x : R(~x0 ;~s) f~xjP g e ! d~ : R(~x0 ;~s); t ! ~x = ~x0 :Apparently fP; e = nilg ) ~x : R(~x;~s) is provable. Let 01 be its proof. Set
01g ) ~x : R(~x;~s)1 = fP;feP;=e nil= nilg ) F (~x) (9I ):(1)Then extr(1 ) is ~x. By (CIG def ),fe : T; P g ) 8~x0:(d~ : R(~x0 ;~s)  ~x : R(~x0 ;~s))(2)
is provable. Set~~
0 = fF (d)g ) F~ (d) (2) (replacement):
fe : T; P; F (d)g ) F (~x)
Then extr(0 ) is just the realizing variables of F (d~). By (CIG ind) we derive a
proof  such that
0

1

~
P g ) F (~x) : = fe : T; P; F (df)~xg :)WF(~s(~x);)P g f)e =F (nil;~x)
Then its realizer is f (~x;~s) and f is de ned byf (~x;~s) = cond(e; f (d~;~s); t; ~x):This is the while statement in the sense of iterative programs S. But this is not
the end of the proof. We have to adjust  so as to satisfy the conditions (a), (b)Chapter 4

103of the theorem. By the de nition of W , we see from the validity of the premise of
the while rule thatfP g ) ~x : W (~s)(3)

is a true rank 0 sequent so that we may use it as an axiom. This is the assumptionthat we may have to assume without a formal proof of PX. On the other hand,
there is a proof 3 such that
3 ` f g ) 8~x0 :(~x : R(~x0 ;~s)  (P ^ e = nil)[~x0 =~x]):
Set

(3) 

(cut)

 = ffPPgg))9F~x:((~xP) ^ e = nil3 ) (replacement)&(alpha):

Then extr() = extr() and  satis es the conditions of the theorem.
The counterpart of the consequence rule is just (replacement). It does notchange the program. This ends the proof of theorem 1.
What we have proved can be summarized by the diagram `HL f?P gAfQg ;;;;;;;!  `PX fP?g ) 9~x:Q

??
?y


=

A

??
?y

extr()The correspondence between HL and PX used in the above proof is summarized by the table

HL

Assertion formula ` fP gAfQg
Assignment
Composition
Conditional
While
Consequence

PX

Rank 0 formula ` fP g ) 9~x:Q
(9I )
(9E )
(! _E )
(CIG ind)(replacement)

104

Chapter 4

As an example of the above method, we derive another program of thequotient-remainder theorem (I) of 4.3.2.1. Set

D(a; b) = fq; rjq : N ^ r : N ^ a = b  q + rg
anddeCIG [x; y] : W (a; b) D(a;b) y  b ! [x + 1; y ; b] : W (a; b); t ! >:deCIG [x; y] : R(q; r; a; b) D(a;b) y  b ! [x + 1; y ; b] : R(q; r; a; b);t ! x = q; y = r:
As in the proof of the theorem, we can derive a program  such that(4) ` fa : N; b : N + ; [x; y] : W (a; b)g ) 9q : N; r : N:[x; y] : R(q; r; a; b)and extr() is f (x; y; a; b) whose f is de ned byf (x; y; a; b) = cond(y  b; f (x + 1; y ; b; a; b); t; list(x; y)):Substitute 0; a for x; y in (4). Since [0; a] : W (a; b) holds provided a : N; b : N + ,we can eliminate this from the assumption of (4). Since R is inductively de ned,
if R(q; r; a; b) is nonempty, then there is a value [x0 ; y0 ] of [x; y] satisfying theconditions of the base case:[x0 ; y0 ] : D(a; b); y0 < b; x0 = q; y0 = r:
So a = b  q + r ^ r < b holds. Formalizing this argument, we can derive(5)

8q : N; r : N:([0; a] : R(q; r; a; b)  a = b  q + r ^ r < b):Hence the sequent (I) of 4.3.2.1 is derivable by (replacement) and its realizer
is the expression f (0; a; a; b). This is a tail-recursive functional program for the
Euclidean division algorithm.

5 PX as a foundation of type theories
There are quite a few type theories of programming languages (see Cardelli andWegner 1986). In this chapter, we will show how some type theories are interpreted in PX. The subjects we consider here are (i) dependent sums as types ofmodules and (ii) polymorphic types in the sense of second order -calculus. Theinterpretation of subtypes as subsets is straightforward, since PX is a type freesystem; and interpretation of the types in the sense of Martin-Lof 1982 is possible
as was showed in 2.4. Note that these type disciplines are interpreted in PX, so
it is child's play to mix them in the single type free framework of PX.

5.1. A view of \dependent sums as types of module implementations"

The dependent sum was used as the type of the module implementations in
Burstall and Lampson 1984. To form a type of the implementations of a module,
they used the type of all types used in implementation. (The type of all types isan element of itself.) If such a type were a class, say CLASS , i.e., the class of
all classes, then it would be possible to de ne a type of implementations of stack
module function (stack module with a parameter x) such as
(CLASS; (x):(CLASS; (y):(x  y ! y)  (y ! x  y)  y):
Unfortunately, the existence of CLASS contradicts the axiom system of PX(see 6.3.1), although it is consistent with PX ; f(Join); (Product)g as shown in
6.3. But CIG allows us to de ne the class of classes generated by given nite
numbers of classes and class formation operators as in (12) of 2.4.1. For example,
the class of implementations of a module implemented in a class of nitely generated CCC is obtained by replacing CLASS by CCC (X1 ; : : : ; Xn ) and a ! b
by hom(a; b). If we add List(X ) and X + Y in the possible class formation
operators of CCC (X1 ; : : : ; Xn ), then the class of nitely generated classes, say
Types0(X1 ; : : : ; Xn ), would be enough to implement conventional modules suchas stack, queue, records, etc., insofar as X1 ; : : : ; Xn includes enough basic datatypes. Since Types0(X1 ; : : : ; Xn ) is again a class, a higher type such as the type ofmodule functions, i.e., functions mapping implementations of a module to another
implementation of module, is again a class. The class Types0(X1 ; : : : ; Xn ) is not
an element of itself, so we have a hierarchy of modules as the module system of
MacQueen 1986. The essential di erence of our module hierarchy to MacQueen's
is that each stage of our hierarchy is not closed under dependent type formations.
Since dependent types are used as types of modules or module functions, this does
not seem to be a serious restriction.

106

Chapter 5

One can include various \logical" conditions on the type of the implementations of a module. For example, a description of the class of implementations ofstack module functions would beStck(x; X~ ) = (Types0(X~ ); (y):(hom(x  y; x)  hom(y; x  y)  y));f = (x):f(y (pu po empty)) : Stck(x; X~ )j
8b : x; s : y:(pop(push(b; s)) = list(b; s)^ pop(empty) = list(nil; empty))g
Stack(X~ ) = (Types0(X~ ); f );where X~ is X1 ; : : : ; Xn andpush = (b; s):app(pu; b; s); pop = (s):app(po; s):The body of the -function of f is not a legal class expression, for y appears as
s : y. Let us explain how to validate such a class expression. Let p be a pattern
and y1 ; : : : ; yn be some free variables of p such that

8x : A:rp = x:(Class(y1 ) ^ : : : ^ Class(yn )):Let  be a CIG template with respect to X0 ; X1 ; : : : ; Xm+n . We assume that X0
does not appear in . This assumption is made for the sake of simplicity. Then
we de ne an extended class expression as follows:

fp : Aj[y1 =X1; : : : ; yn =Xn]g = fx : Ajpair(x; nil) : B g;
B = (A; (x):let p = x in(frjr = nil ^ g[y1 =X1; : : : ; yn =Xn])):Then it is easy to see that x : fp : Aj[y1 =X1 ; : : : ; yn =Xn ]g holds i x : A ^ rp =x:.

If we use the second order extension of PX in 5.2, we can de ne a classof stack functions satisfying an initial algebra condition by replacing Stck of thede nition of Stack by

InitStck(x; X~ ) =f(y (pu po empty)) : Stck(x; X~ )j
8X:((empty : X ^ 8b : y; s : X:push(b; s) : X )  y  X )g:
Furthermore, by means of logical inferences of PX, we can derive various kindsof properties of modules.

Chapter 5107

Pebble in Burstall and Lampson 1984 has values called bindings and theirtypes. A binding is a tuple of tagged value or, more precisely, an environment
as a value. If x is an identi er and v is a value, then xv is a binding and it
expresses the environment in which v is bound to x. Multiple binding is available, and is written as [x1 v1 ; : : : ; xn vn ]. The type of this binding is written
as x1 : A1  : : :  xn : An , where A1 ; : : : ; An are types of v1 ; : : : ; vn . Since PX
cannot handle environments as values, it does not have bindings in the sense of
Burstall and Lampson 1984. But the main usage of binding is as an implementation of modules. This is interpretable in PX. A module of Stck(x) is just alist with four elements, say (x1 x2 x3 x4 ). When we use bingings, we may write[stackx1 ; pushx2 ; popx3 ; emptyx4 ]. This makes the meaning of elements
clear. More, it allows the mechanism of inheritance. Namely, even if the type of
input of a module is a type of bindings of the form [xvalue], it can be applied
to a binding which extends this form, e.g., [xvalue; yvalue]. The inheritanceof Pebble is accomplished by a coercion. When a module function is applied to a
multiple binding that has excess bindings, it is shrunk down to the proper shape.
Namely, when a function f from x : A is applied to an element of x : A  y : B , sayb, f (b) is automatically interpreted as f (proj1 (b)). On the other hand, PX may
support inclusion polymorphism. Namely, we may interpret the class of bindings
so that x : A  y : B is a subtype of the type of x : A. This can be achieved byinterpreting the type of bindings as follows. Let Bndg be the classfb : List(Atm  V )j8m : N; n : N:m 6= n  fst(nth(m; b)) 6= fst(nth(n; b))g;
where nth(n; a) is n th element of a list a. This is a class of all bindings. A classthat represents the type x1 : A1  : : :  xn : An is de ned by
fb : Bndgjfetch(x1 ; b) : A1 ^ : : : ^ fetch(xn ; b) : An g;
where fetch(x; b) returns the element of b whose fst part is x, if it exists.
The module system IOTA of Nakajima and Yuasa 1983 does not have thetype of all types, but it has a veri cation system by which users can verify that an
implementation meets its speci cation. IOTA allows arbitrary rst order formulasin speci cations, and initial algebra conditions may be put in the speci cations.
Furthermore, any module is built up from xed (so nitely many) built-in basic
parameterized or nonparameterized modules. It seems that modules of IOTA
are enough for conventional programming. (See the examples given in Nakajima
and Yuasa 1983.) It is likely that any practical module system can be built on
nite many basic modules as in IOTA. The technique described above may serve
as a logical foundation of IOTA-like nitely generated module systems and may
be enough to cover a large portion of module building activity in conventional
programming.

108

Chapter 55.2. Type polymorphism and an impredicative extension of PX

The type polymorphism is a useful discipline in typed languages. We will show
how polymorphic types are interpreted as classes. To this end we extend the CIG
inductive de nition so that impredicative de nition of classes is possible. The CIG
inductive de nition is predicative de nition of classes, for bound class variables
are inhibited in CIG templates. This means all classes are gradually constructedfrom basic classes by applications of explicit class formation operators. Actuallysuch processes will be observed in the model constructions in 6.3. On the other
hand, impredicative classes must be given at once as the power sets of in nite sets.
Templates for impredicative CIG inductive de nition, called strati ed templates,
are de ned as follows:
De nition 1 (strati ed template). A formula H is a strati ed template ofStrn (X~ ) i it satis es the following conditions:(1) If a subformula of H has the form [e1 ; : : : ; en] : en+1 , then en+1 must be aclass constant or a bound class variable or belong to X~ . Furthermore, if en+1
is X0 , then the entire subformula must occur in a positive part of H and n is
n0 .If a subformula of H has the form E (e), then e has no occurrence of X0 .
If a subformula of H has the form e1 = e2 , then e1 and e2 have no occurrenceof X0 .
(2) For any subformula of H of the form 8~x1 : e1 ; : : : ; ~xn : en:F or 9~x1 :e1 ; : : : ; ~xn : en :F , the following holds: When there is a class variable inthe variables of ~xi , ei is the class constant V . Otherwise, ei is an element of
X~ or a class constant or a bound class variable. Similarly for the existential
quanti er.
(3) H has no occurrence of the predicate symbol Class.
(4) In any subformula of the form E (e), e1 = e2 , there are no bound classvariables. There are no bound class variables in [e1; : : : ; en ] of any subformulaof the form of [e1 ; : : : ; en ] : e.
Any subformula of a strati ed template is called a strati ed formula. We
extend CIG allowing the strati ed templates as CIG templates. Then the extended
CIG inductive de nition is called CIG2 inductive de nition. Note that CIG2 isan extension of CIG in two ways. One thing we do not assume is that a CIG2
template is a rank 0 formula. The other is that a CIG2 template may containbound class variables. The second assumption is an essential extension, but the
rst one is not, for we do not consider realizability of CIG2. (Feferman 1979
described a realizability for an impredicative extension of T0 , but it turned outthat it does not work properly, for the realizability of a strati ed formula may not
be strati ed. So the existence property and consistency with Church's thesis of
the system are still unproved.)
0Chapter 5

109

A polymorphic function is a typed function that may apply to di erent types
uniformly. For example, append is applicable to any type of the form List(X ) 
List(X ). We will give so-called \forgetful semantics" of an extensional theoryof second order type polymorphism in PX + CIG2. Such a semantics of type
polymorphism was rst given by Girard 1972 and Troelstra 1973 in the frameworkof ordinary recursion theory, and later MacQueen and Sethi 1982 gave essentiallythe same semantics in the framework of Scott semantics. Feferman has given
essentially the same semantics to ours in an impredicatively extended T0.
First we de ne a typing system PT (polymorphic typing). PT has three
syntax categories called types, terms, and judgment. A type, or type expression,is an expression that is inductively de ned as follows:
1. A type variable is a type. We denote type variables by , , etc. On theother hand, types will be denoted by  , , etc.
2. If  and  are types, then  !  is a type.
3. If  is a type and is a type variable, then 8 : is a type.
We call 8 : a polymorphic type and free type variables of types, etc. are de ned
as usual.
A term is simply a -term in the sense of -calculus, i.e.,
1. Variables are terms. Variables will be denoted by x, y, etc., and terms will
be denoted by t, s, etc. (We assume that such variables are disjoint to thetype variables.)2. If t and s are terms, then its application ts is a term.
3. If t is a term and x is a variable, then its abstraction x:t is a term.
As opposed to the usual typed -calculus, we do not identify two -convertible
terms or types implicitly. -convertibility of types is formulated as inference
rules. On the other hand, -convertibility of terms is derivable from the others.
A judgment is an expression of the form t :  or t1 = t2 . Note that any syntactic
expression of this form is called judgment, even if it is not provable.
An environment is a partial function from variables to types with nite domain. It is denoted by ;, , etc.. An environment ; with a domain fa1; : : : ; an gis also denoted by a set fa1 : 1 ; : : : ; an : n g, where i = ;(ai ). ;; x :  means
the extension of the environment ; that maps x to  . So we assume x does notbelong to the domain of ;. A hypothetical judgment is a form ; ` A, where ; isan environment and A is an judgment.
Next we de ne typing, i.e., provable hypothetical judgments or theorems.
Typings are generated by the axiom(A1)

fa1 : 1 ; : : : ; an : n g ` ai : i

110

Chapter 5

and the following rules:;`t:; ` t = t
 t2
(R3) ;; `` tt1 =2 = t1:`t:
(R5) ;;`; xx:t:!
(R7) ; ;` `t :t 8: : ` t1 :  ; ` t 2 : (R9) ;;;`x (:x:t
1 )(t2 ) = t1 [t2 =x]; x :  ` t1 = t2(R11) ; ` ;(x:t1 ) =! (x:t2 )(R13) ;;``t t1== t2t1 8 : 2(R15) ffaa1 :: 10 ;; :: :: :: ;; aan :: n0 gg `` tt :: 00
1 1
n n
0

(R1)

(R2)
(R4)
(R6)
(R8)
(R10)
(R12)
(R14)
(R16)

; ` t = t;`t:; ` t1 = t2 ; ` t2 = t3; ` t1 = t3; ` t1 :  !  ; ` t2 : ; ` t1 t2 : ; ` t : 8 :; ` t :  [= ];`t:!
; ` x:(tx) =! t; ` t1 =! t2 ; ` t3 = t4; ` t1 t3 = t2 t4; ` t1 =8 : t2; ` t1 = [= ] t2
fa1 : 1 ; : : : ; an : n g ` t1 = t2
fa1 : 10 ; : : : ; an : n0 g ` t1 = 0 t2
0
0These rules are legal under the following conditions: in (R5), (R9), and(R11) the variable x does not appear as a free variable in ;, in (R7) and (R13)the variable does not appear as a free type variable in ;, in (R8), (R9), and(R14)  [= ] and t1 [t2 =x] are legal substitutions, e.g., t2 must be substitutable tox without any change of bound variables of t1 , in (R10) x is not a free variable oft, and in (R15) and (R16) i is -convertible to i0 .
Note that if ; ` t1 = t2 is provable, then ; ` t1 :  and ; ` t2 :  areprovable by (R2), (R3), and (R4). If ; ` t :  is provable and t0 is -convertible tot0 , then ; ` t0 :  is also provable. This can be proved by induction on the lengthof the derivation of typing. It is not quite trivial, but is left for the reader.
The semantics of PT that we introduce below is known as HEO2 (Troelstra
1973) or PER model (Mitchell 1986). Our semantics is a \formalized semantics"
in the sense that it is a syntactic translation from PT to PX+CIG2. We translateeach typing to a provable sequent of PX+CIG2, by translating terms to expressions, types to classes, and judgments to formulas. We assume there are one to one
mappings i and j from the variables of PT to (total) individual variables and type

Chapter 5111

variables to (total) class variables. We assume they coincide on the type variables,
but di er on the variables. We denote i(a) by a and j (a) by a~. So  = ~ for any
type variable , but x 6= x~ for any variable x. For each type  , we de ne a classexpression  and Eq , which are interpretated to be the type  and the equalityof the type. Since Eq is an equality de ned over , it is a partial equivalence
relation, i.e., 8[a; b] : Eq :[b; a] : Eq and 8[a; b] : Eq ; [b; c] : Eq :[a; c] : Eq hold,but 8a:[a; a] : Eq need not hold. The domain of any partial equivalence relation
R(x; y) is de ned by fxjR(x; x)g, i.e., the largest set on which R is an equivalence
relation. Hence a type equipped with an equivalence relation on it is realized asa partial equivalence relation. So the association of the interpretation of types isdone as follows:
0. For each type  ,  is fxj[x; x] : Eq g.
1. For a type variable , Eq is .
2. Eq! is given by[x; y] : Eq! = fx; yj8[a; b] : Eq :[app(x; a); app(y; b)] : Eq g:
3. Eq8 : is given by[x; y] : Eq8 : = fx; yj8 :PER( )  [x; y] : Eq g;
where PER() is a formula which stands for  is a partial equivalence relation (see above).
Next, we de ne expressions t and t~ for each term t.
1. For a variable x, x is x.
2. The interpretation of abstraction x:t is ((x)(t)).
3. The interpretation of application t1 t2 is app(t1 ; t2 ).
4. The interpretation t~ is de ned as above, except a variable x is translated tox~ instead of x.
The interpretations of t :  and t1 = t2 are[t; t~] : Eqand[t1 ; t~1 ] : Eq ^ [t2 ; t~2 ] : Eq ^ [t1 ; t~2 ] : Eq ;respectively. We denote the interpretation of a judgment A by A. The interpretation of an environment ; = fa1 : 1 ; : : : ; an : n g, ; in notation, is de ned asfollows:; = PER; [ f[a1 ; a~1 ] : Eq ; : : : ; [an ; a~n ] : Eqn g;
PER; = fPER()j is a free type variable in ;g:1

112

Chapter 5

Furthermore, we de ne; A = ; [ PERA ;PERA = fPER()j is a free type variable of Ag:
The interpretation of a hypothetical judgment ; ` A is given by ; A ` A.
Then we can prove the following theorem by the induction on the length ofderivations of typings.
Theorem. If ; ` A is a typing, then ; A ` A is provable in PX+CIG2.
As a corollary we have the following:
Corollary. Set;^ A = fa : ja :  2 ;g [ PER; [ PERA ;td:  = t : ;t1 d= t2 = [t1 ; t2 ] : Eq
If ; ` A is a typing, then ;^ ` A^ is provable in PX+CIG2.
Hence there is no term t such that ` t : 8 : is a typing. Namely, PT is
consistent in the sense of traditional logic. (Even if such a term exists, a system
may be consistent from the view point of computation. Since we may think thevalue of such a term is an \unde ned value".)
Proof of theorem. The theorem is proved by the induction of the complexity ofthe derivation of typings. Except for the veri cation of (R9), nothing is dicult.
Let us show how to verify (R9). The induction hypotheses are; [ f[x; x~] : Eq g [ PER [ PER ) [t1 ; t~1 ] : Eq ;; [ PER ) [t2 ; t~2 ] : Eq ;where PER is the set fPER()j 2 FV ( )g. We have to show the following
three are provable under the assumption ; [ PER :g1 )t2 ] : Eq ; (2) [t1 [t2 =x]; t1 [g(1) [(x:t1 )t2 ; (x:tt2 =x]] : Eq ;g(3) [(x:t1 )t2 ; t1 [t2 =x]] : Eq :Let us verify (3). (x:t1 )t2 is app(((x)(t1 )); t2 ). We may assume E (t2 ) by the
induction hypothesis. So this is equivalent to t1 [t2 =x] by the equality of PX. On
the other hand, from the induction hypotheses, we see [t1 [t2 =x]; t~1 [t~2 =x~]] : Eq .
By means of the following substitution lemma, t1 [gt2 =x] is equivalent to t~1 [t~2 =x~] by

Chapter 5

113

the equality Eq . These imply (3). (1) is obvious from the induction hypothesisand (2) is provable by the substitution lemma.
The key of the above proof is the following substitution lemma.
Substitution lemma. If ;; x :  ` t1 :  and ; ` t2 :  are typings of PT andtheir interpretations are provable in PX, then the following is provable in PX:;^ ) [t1 [t2 =x]; t1 [t2 =x]] : Eq :This appears obvious, but it is not. For example, (x:xy)[z=y] is (z =z)((x)(app(x; z))), but x:xy [z=y] is (x = z)((x)(app(x; y))). They are not-convertible in the sense of PX. Their values are di erent -closures, so we haveto show they are extensionally equal as functions of an appropriate type  !  ,respecting the equality of the type. The substitution lemma is proved by the
induction on the complexity of t1 by means of the following lemma.

Lemma(A) If ; ` x :  is provable, then there is a  such that (i) x :  2 ;, (ii)  isthe form 8 1 : : : 8 n:0 (n may be 0) and  is 0 [0 = 0] : : : [n = n ] for some
1 ; : : : ; n .
(B) If ; ` t1 t2 :  is provable, then  is -convertible to the form 8 1 : : : n :1 (nmay be 0) such that 1 ; : : : ; n are not free variables of ;, and the following
are provable:; ` t1 : 2 ! 1 ; ` t2 : 2(C) If ; ` y:t :  is provable, then  is -convertible to 8 1 : : : 8 n:(1 ! 2 ) (nmay be 0) such that 1 ; : : : ; n are not free variables of ;, and the following
is provable:;; y : 1 ` t : 2
This lemma can be proved by means of an induction on the length of derivationof typings. Proofs of these two lemmas are left for the reader.
The complication of the proof of the above theorem is due to by the interpretation of the -function. There is an easy way to avoid this. We can de ne
call-by-value combinators k and s as follows:k  ((x)((y)(x)));s  ((x)((y)((z )(app(app(x; y); app(x; z )))))):
By means of the translation of the -calculus to the call-by-value combinatory
logic of s and k, we see a substitution lemma holds without any assumption oftype assignments. The cost of this approach is that the translated PX expressions
are more complicated and slower than the ones in the interpretation given above.

114

Chapter 5

The semantics given above is essentially an impredicative version of the formalized semantics of Martin-Lof's type theory without type hierarchy of Beeson
1985. It is possible to extend type system so as including various other types,
e.g., Martin-Lof's propositional equality I (A; x; y), intersection types of Coppo
and Dezani-Ciancaglini 1979, and even a subtype judgment such as 1  2 .

6 Semantics
In this chapter, we give a mathematical semantics for PX. Although we pronounce
PX to be a constructive theory, we give the semantics in the framework of classicalmathematics. We must do so, for PX includes classical reasoning via the modal
sign. We will do so, for we wish the extracted programs to meet speci cations in
the usual rather than the constructive sense (see 4.1).
The basic idea of the semantics is due to Feferman 1979. Feferman gave
a number of semantics for his theories of functions and classes on which PX isbased. The one we use is one of them. The semantics employs three stages.
First, Feferman gives a semantics of an axiom system APP. This is done to givea semantics of the \programming language" used in his theories. Secondly, hegives a semantics of formulas relative to an arbitrary semantics of Class(a) anda1 : a2 . Lastly, he gives a semantics of classes via this relative semantics offormulas. Over the semantics of classes, a nonrelative semantics of formulas is
automatically given by the relative semantics. Our semantics of PX takes thesethree steps, too. But there are di erences between Feferman's and our semantics.
In the second step, Feferman uses the usual semantics of the usual logic of total
terms, but we use a semantics of logic of partial terms (LPT). In the third step,
Feferman uses ordinals to construct a model of classes. We use a xed point
theorem instead. Our construction is essentially the same as Feferman's, but ismore easily understandable.
The three steps will be presented in 6.1, 6.2, and 6.3, respectively. In 6.4, we
will show that MGA is satis ed.

6.1. Semantics of computation

In this section, we give a semantics of the DEF-system. the DEF-system is adialect of Lisp and our semantics is given by its interpreter. First, as in the case ofLisp, we de ne MS-translation, i.e., we de ne an injection from the DEF-systems
to the set of S-expressions Obj . Let hD; E; F i be a DEF-system constructed fromsets of variables, say VV , constants, say C , identi ers for basic functions, say
B , and identi ers for other (user de ned) functions, say FI . Since D, E , F arecountable sets, there is an injection code such thatcode : B q C q FI q VV q Reserved ! Latom;
where Reserved is the set of \reserved words" cond, , , and let, and Latom isthe set of literal atoms, i.e., the set Atm ; N . We x such an injection code in

116

Chapter 6

the rest of this section. For simplicity, we often denote code( ) by  . We extend
the map code to expressions E , functions F , and de nitions D as follows:
1. When e is an expression f (e1 ; : : : ; en ), e is(f  e1  : : : en  ):2. When e is an expression cond(e1 ; d1 ; : : : ; en ; dn ), e is(cond (e1  d1  ) : : : (en  dn  )):3. When e is an expression (v1 = e1 ; : : : ; vn = en )(f ), e is( ((v1  e1  ) : : : (vn  en )) f  ):4. When f is a function (v1 ; : : : ; vn )(e), f  is( (v1  : : : vn  ) e ):5. When e is an expression let p1 = e1 ; : : : ; pn = en in e, e is(let ((p1  e1  ) : : : (pn  en  )) e):6. When d is a de nition ff1~v1 = e1 ; : : : ; fn~vn = en g, d is((f1  (~v1 ) e1  ) : : : (fn  (~vn ) en  )):The interpreter of the DEF-system consists three evaluators, Eval, Func, andDef, which compute the value of expressions, functions, and de nitions, respectively. Nontheless, for mathematical exactness and clarity and also for technicalreasons related to the proof of the validity of MGA, we will give two di erent
denotations of the interpreter according to the method of Plotkin 1985.
First, we will give an overview of Plotkin's denotational semantics. Plotkin1985 showed how to rephrase the D1 -construction in his setting, but this is notnecessary for our purpose, so we will not pursue it. The basic point of Plotkin's
new approach to Scott theory is the change of the de nition of cpo.
De nition 1 (cpo in Plotkin's sense). A cpo in Plotkin's sense is a partiallyorderedset satisfying the condition: any ascending chain a1 v a2 v : : : has a supF
an .
Note that we do not assume the existence of a bottom element. So eachplane set S can be considered to be a cpo without adding a bottom element. Such

Chapter 6117

a cpo is called a at domain. The nite or in nite product of cpo's is a cpo bycoordinatewise ordering, e.g.,

ha1 ; a2 i v hb1 ; b2 i i ai v bi (i = 1; 2):Q

The projection operator to a component D from the product 2 D is denotedby proj  . The nite or in nite coproduct of cpo's is also a cpo.
` Note that it is notnecessary to add a new bottom. The order of the coproduct 2 D is given bya v b i a and b are in the same D and a v b in D :`The injection operator from D to 2 D is denoted by inj .

In Scott's theory of computation, a partial function is identi ed with thetotal function, which takes a bottom when it is not de ned for an input. Sincea cpo in Plotkin's sense does not necessarily have a bottom element, we cannot
follow this convention. So we use partial functions rather than total functions.
De nition 2 (partial function). A partial function from A to B is a mappingfrom A to B that is not necessarily de ned for all elements of A, i.e., its graph isa set G  A  B that satis es the condition: if hx; yi 2 G and hx; z i 2 G, theny = z . We will indicate by graph(f ) the graph of f . (From the set-theoreticalstandpoint f should be identi ed with graph(f ).) When f is a partial function
from A to B , we write f : A * B .
In Scott's theory, there is a diculty in the interpretation of bottom. In his
theory, a bottom is not always an \unde ned value", e.g., the bottom element ofa function space is not an unde ned value but a value of the function which isunde ned for every input. There is no simple criteria by which we can decide if
a bottom stands for an unde ned value or a meaningful value. Since in Plotkin's
theory no actual value stands for an unde ned value, this problem does not appear.
This is good, but it causes another problem. In Scott's theory every expression
is assumed to have a value, but this is not so in Plotkin's theory, where partial
functions are used. We have to introduce new notational conventions by which
we may denote unde ned expressions. The notational conventions we are going
to introduce are essentially the same as those of the logic of partial terms (LPT)of PX. But it should be noted this system of notational conventions is meta-level.
Even though our informal arguments look like arguments in LPT of PX, we haveto distinguish them from the formalized arguments of LPT of PX, since we will
give a semantics of LPT of PX by them.
First, we have to de ne when an expression has a value for each expression
we use. It is sucient to de ne an expression's de nedness and value for eachnotation which builds a compound expression from other expressions. We will

118

Chapter 6

use , , ; : : : as variables for expressions. These appear to be similar to partial
variables of PX, but they are di erent. We may say \let be an expression thathas the form if then ", but we cannot talk about the syntactic form of a valueof partial variable. On the contrary, a, b, c, u, v, x, y, z with or without indicesstand for actual values. These just correspond to total variables of PX. The mostfundamental expression that may fail to have a value is a function applicationf ( ). A partial function f is said to be de ned for an input x, when there is anelement y for which hx; yi belongs to the graph of f , and the value of f (x) is y suchthat hx; yi 2 graph(f ). But this is not sucient, we have de ned the de nednessof the expression f (x) only when x is an actual value. The de nedness and valueof a general function application f ( ) is de ned as follows: f ( ) is de ned i theexpression is de ned and has a value x, and f (x) is de ned, and the value off ( ) is de ned to be the value of f (x). Namely, function application is computedby the call-by-value rule.
When an expression has a value, we will write E ( ) and denote its value
by the expression itself.
As opposed to the usual mathematical language and so to the usual computational languages, a conditional expression must be distinguished from partial functions, since it does not obey the call-by-value rule. The expression\if then else " is de ned as follows: if has the value true, and isde ned, then it is de ned and its value is , and if has the value false andis de ned, then it is de ned and its value is .
An abstraction x 2 A: stands for the partial function whose graph isfhx; yijx 2 A; is de ned and its value is yg:
Note that an abstraction is always de ned and denotes this value.
The equation e1 ' e2 means if e1 has a value then e2 also has the same value
and vice versa. This corresponds to the equality of PX. The usual equality sign
= is used for an abbreviation for E ( ) & E ( ) & ' . The inequality< means if has a value then also has a value and the value of is equal
to or smaller than the value of . On the contrary, v means that andare de ned and the value of is smaller than or equal to the value of . Notethat ' Fis equivalent to <
 & <
 . Assume 0 < 1<
 : : :. Then theexpression m is de ned i there is an m such that n is de F
ned. If such
F an mexists, en has a value, say an , for all n  m, then the value of n is nm an .
In the following undefined is an any xed unde ned expression, and 6= means
and are de ned and have di erent values.
This provides enough notational conventions to de ne the interpreter of a
DEF-system, except for recursive de nitions, for which we need the concept ofcontinuity.

Chapter 6

119

De nition 3 (partial continuous function). A partial continuous function

f from a cpo D1 to a cpo D2 is a partial function from D1 to D2 satis es theconditions:(i) f preserves < , i.e., 8x; yF2 D1 :x <
F y  f (x) < f (y).
(ii) if a1 v a2 v : : :, then f ( an ) ' f (an).
We will write [D1 * D2] for the set of continuous partial function from D1
to D2 . The partial order of cpo of partial continuous functions is de ned by
f1 v f2 i 8x 2 D1 :f1 (x) < f2 (x):The totally unde ned function ? de ned by 8x:?(x) = ? is the bottom elementof the cpo. If f 2 [D1 * D2 ]: de nes a continuous total automorphism of[D1 * D2 ], say , then the partial continuous function f that is deF ned by
the recursive de nition f = is the minimal xed point fix(), i.e., n (?).
Simultaneous recursive de nition is de ned similarly. A partial function withn arguments f (x1 ; : : : ; xn ) is continuous i f is continuous for each argument
xi . Projections of products and injections of sums are all continuous. Note thatproj i (x) is continuous with respect to not only x but also the index i. We consider
the set of indices to be a at domain.
We have introduced four constructors of expressions: application, abstraction, conditional expression, and recursive de nition. When an expression isbuilt up from variables and constants of cpo's through these constructors, it iscontinuous with respect to each variable x, i.e., x: is continuous. We recognizethat all function variables run over some spaces of partial continuous functions.
Strictly speaking, we are working in the category of cpo's and partial continuousfunctions.
Even though the notational conventions of informal LPT are sucient, in order to de ne the interpreter of the DEF-system we need a concept of environment.
In the following, we use the notation[x 2 A ! B (x)] = ff 2 [A !
[x 2 A * B (x)] = ff 2 [A *

a

x2A

a

x2A

B (x)]j8x 2 A:f (x) 2 B (x)g;

B (x)]j8x 2 A:E (f (x))  f (x) 2 B (x)g;

x 2 A  B ((x) = fhx; yijx 2 A ^ y 2 B (x)g;[Obj i * Obj ]if x 2 N
Hom(x) = Q [Obj i * Obj ] otherwise.
i2x

If A is a cpo and B (x) is a cpo for each x 2 A, then [x 2 A ! B (x)], [x 2 A *B (x)], x 2 A  B (x) are canonically cpo's.

120

Chapter 6

De nition 4 (environment). A constant environment is a total function

from C  to Obj satisfying the condition: (i) (0)=0, (quote( ))= , (ii) (t),(nil), (V ), (N ), (Atm), (T ) are literal atoms di erent from each other.
We denote the set of constant environments by EnvC . A value environment is
a partial function  from VV  to Obj satisfying the condition:  is de ned foreach total variable of VV t . We denote the set of value environments by EnvV . A
function environment  is a total function of [f 2 FI  ! Hom(arity (f ))]. Recall
arity (f ) is the arity of f . A basic function environment is a partial functionof [f 2 (B ; fapp; appg) * Hom(arity (f ))] satisfying: (i) each basic function
identi er must be mapped to its intended meaning, e.g., (suc) is the successor
function over natural numbers, (ii) proj n ( (list)) is the n-argument list function.
We will write EnvB and EnvF for the sets of basic function environments andfunction environments, respectively.
Note that a basic function environment does not give a denotation of app, orapp, but a function environment does.
Let  be a value environment and let x1 ; : : : ; xn 2 VV  and v1 ; : : : ; vn 2 Obj .
Then a new environment changing the values of xi [v0 =x0 ; : : : ; vn =xn ] is de nedby
x is xi ,[v0 =x0 ; : : : ; vn =xn ](x) = vi(x) ifotherwise.
We will denote ?[: : :] by [: : :] and [a1 =b1 ; : : : ; an =bn ] by [a1 ; : : : ; an =b1; : : : ; bn].
Strictly speaking, we de ned a total continuous function changechange 2 [EnvV  (a 2 List(VV  )  Listlength(a) (Obj )) ! EnvV ];such thatchange(; (x0 ; : : : ; xn ); (v0 ; : : : ; vn )) = [v0 =x0 ; : : : ; vn =xn ];where List(VV  ) is the cpo of the list of VV  and Listlength(a) (Obj ) is the cpo
of lists of objects whose length is the same as the length of the list a. Hence if oneof 1 ; : : : ; n is unde ned, then [ 1 =x1 ; : : : ; n =xn ] is unde ned. The operation
[a0 =b0; : : : ; an =bn] is continuous with respect to , ai and bi .
Now we give the rst de nition of the interpreter for the DEF-system. The
reason why we present the de nition is to show what is going on from a mathematical point of view. The point is that meanings of basic functions except app,
app are xed, but the meanings of app and app must be determined through thede nitions of user-de ned functions. Since this makes much use of function spaces,
it is not immediately clear that the interpreter is actually implementable on machines. We later give another de nition, which is essentially a Lisp evaluator, andsee the equivalence of the two de nitions.

Chapter 6

121

A DEF-system is a system of function de nitions, expressions, and function
expressions, so their denotations consist of a function environment, say Def, avalue of an expression e under a value environment , say Value(e; ), and afunction of a function expression f under a value environment , say Func(f; ).
Namely, Def, Value, and Func have the types
Def 2 EnvF ;Value 2 [E   EnvV * Obj ];Func 2 [x 2 (F   EnvV ) ! Hom(arity (code;1 (proj 1 (x))))]:The denotations of the basic functions except app, app are given by the basic
function environment. On the other hand, the denotations of app and app aresimultaneously de ned with Def, Value, and Func, for this depends on the function
de nitions. We denote the denotations of app and app by App, App, respectively.
These two denotations have the types
App 2 Hom(2); App 2 Hom(N + ):We will give simultaneous equations below whose minimal solution is thesedenotations. Strictly speaking, the equations have parameters , constant environment, and , a basic function environment, so the solution depends on these.
But they are xed, so we omit such parameters. For simplicity, we restrict patternsof let to variables.
In the de nition, we use the following conventions. We recognize a predicate P (a) on a at domain as a total continuous function f to the domain
ftrue; falseg such that f (a) = true i P (a) holds. The membership relation
2 and its negation 62 are regarded as binary predicates. So e1 62 e2 implies e1 ande2 are de ned. FC is the set of function closures, i.e., the S-expressions of theform f , where f is in FI or a closed function expression of F of the form (a1 : : : an ) (let b1 = quote( 1 ); : : : ; bm = quote( m ) in f );where

1 ; : : : ; m are arbitrary S-expressions. Arity (a) is de ned byarity (code;1 (a))g if arity (code;1 (a)) 2 N ,Arity (a) = farity(code;1 (a)) otherwise.

List is the set of lists. If f 2 FI  then def (f ) and vars (f ) are the function
body and formal parameters of the de nition of f , respectively. If f is in Hom(n)(n 2 N ), then fetch(n; f ) is f and if f is in Hom(P ) (P  N ) and n 2 P , thenfetch(n; f ) is proj n (f ). The variables a, b, c, : : : and these with indexes run over

122

Chapter 6

Obj and when we write, e.g., a  (b c), it means the S-expressions a is a list of band c. l(a) is the length of a list a and nth(i; a) is the ith element of a.
Value(a; ) 'if a 62 E  then unde ned
else if a 2 C  then (a)else if a 2 VV  then (a)else if a  (cond (a1 b1 ) : : : (an bn )) then
if n = 0 then nil
else if Value(a1 ; ) 6 nil then Value(b1 ; )else Value((cond (a2 b2 ) : : : (an bn ))); )else if a  ( ((a1 b1 ) : : : (an bn )) f ) thenif f  ( (c1 : : : cm) e) then( (c1 : : : cm )(let ((a1 (quote Value(b1 ; ))) : : : (an (quote Value(bn ; )))) e))else felse if a  (let ((a1 b1 ) : : : (an bn )) c) thenValue(c; [Value(b1 ; )=a1 ; : : : ; Value(bn ; )=an ])else if a  (f a1 : : : an ) thenfetch(n; Func(f; ))(Value(a1 ; ); : : : ; Value(an ; ))else unde ned

Func(f; ) ' if f 62 F  then a:unde ned
else if f 2 B  then (f )else if f 2 FI  then Def(f )
else if f  app then App
else if f  app then Appelse if f  ( (a1 : : : am ) b) thenx1 ; : : : ; xm :Value(b; [x1 =a1; : : : ; xm =am ])else a:unde ned

Chapter 6

123

App ' a; b:if a 62 FC or b 62 List or l(b) 62 Arity (a) then unde ned
else fetch(l(b); Func(a; ?))(nth(1; b); : : : ; nth(l(b); b))App ' l 2 N + :a; b1 ; : : : ; bl;1 :if a 62 FC or l ; 1 62 Arity (a) then unde ned
else fetch(l; Func(a; ?))(b1 ; : : : ; bl;1 )Def(a) ' b1 ; : : : ; barity(code; (a)) :Value(def (a); [b1 ; : : : ; barity(code; (a)) =vars(a)])
11

We used the notation [e1 =x1 ; : : : ; en =xn ] in the above equations. Strictly
speaking, those must be expressed by the function change mentioned above. We
do not explain how to do that, since it is easy.
The right hand sides of these equations are built up from variables and constants of cpo's by means of application, abstraction, and conditional expression.
So they are continuous with respects to free variables, and the minimal solutionof the equations exists.
Next we give another description of Value which is essentially a Lisp interpreter. The point of the new interpreter is that it does not give a denotation ofa function, so it does not involve the function spaces. We de ne two evaluators
Apply and Eval by means of the following equations:
Apply(a; b; ) 'if a 62 FC or b 62 List or l(b) 62 Arity (a) then unde ned
else if a 2 FI  then Eval(def (a); [nth(1; b)=v1a ; : : : ; nth(l(b); b)=vla(b)])
else if a  ( (v1 : : : vn ) c) thenEval(c; [nth(1; b)=v1 ; : : : ; nth(l(b); b)=vl(b) ])else if a  app thenif l(b) 6 2 or nth(1; b) 62 FC then unde ned
else Apply(nth(1; b); nth(2; b); ?)else if a  app thenif nth(1; b) 62 FC or l(b) ; 1 62 Arity (nth(1; b)) then unde ned
else Apply(nth(1; b); tail(b); ?);124

Chapter 6

where tail(b) is the tail of the list b, and v1a ; : : : ; vla(b) is vars (a).
Eval(a; ) 'if a 62 E  then unde ned
else if a 2 C  then (a)else if a 2 VV  then (a)else if a  (cond (a1 b1) : : : (an bn )) then
if n = 0 then nil
else if Eval(a1 ; ) 6 nil then Eval(b1 ; )else Eval((cond (a2 b2 ) : : : (an bn ))); )else if a  ( ((a1 b1 ) : : : (an bn )) f ) thenif f  ( (c1 : : : cm ) e) then( (c1 : : : cm )(let ((a1 (quote Eval(b1 ; ))) : : : (an (quote Eval(bn ; )))) e))else felse if a  (let ((a1 b1 ) : : : (an bn )) c) thenEval(c; [Eval(b1 ; )=a1; : : : ; Eval(bn ; )=an ])else if a  (f a1 : : : an ) then
Apply(f; (Eval(a1 ; ); : : : ; Eval(an ; )); )else unde ned
Then Eval v Value holds, for if we set
Eval = Value; Apply = a; b; :Value((app x y); [a=x; (quote b)=y]);then the de nition equations of Eval and Apply hold. In the same way, we canprove that Value v Eval. Hence Eval equals Value.
Theorem 1. The two descriptions of PX interpreter are equivalent.
It would be clear that if a Lisp interpreter evaluates an expression of PX toa value, then Eval evaluates it to the same value as far as  is implemented as
an appropriate macro. But the reverse is not true, for the usual Lisp interpreter
does not check the rst argument of apply to be in FC .
Claim. When an expression has a value v in the semantics of PX, then it isevaluated to the same value by the ordinary Lisp interpreter.

Chapter 6

125This maintains that we may evaluate extracted programs by Lisp. The interpreter enjoys the usual semantic properties of formal languages, e.g., the substitution lemma. Set

g (e; ) = Value(e ; ); Funcg (f; ) = Func(f  ; ):
Value
Then the substitution lemma is stated as follows:g . If e1 and e2 are expressions, f is a function
Substitution lemma for Value,and x is a free variable of e1 , then the following hold:g (e1 [e2 =x]; ) ' Valueg (e1 ; hValueg (e2 ; )=xi);
Valueg (f [e=x]; ) ' Funcg (f; hFunc
g (e; )=xi);
Func
where h =xi is de ned by

x is y,h =xi(y) = (x) ifotherwise.
Note that h =xi is always de ned.
This can be proved by the induction on the complexity of e1 and f . It isg (e; 1 ) ' Valueg (e; ), whenever 1 and 2 coincide on
also easy to see that Value
the free variables of e. These properties may fail for a Lisp interpreter, even if its
scoping rule is lexical. The substitution property strongly depends on the variablecondition and execution rules on -expressions.

6.2. Tarskian semantics of formulas

In this section, we give the semantics of formulas relative to an arbitrary interpretation of classes. Note that we give the semantics using classical logic. This isinevitable, for PX includes the axioms on }. Each of the soundness theorems inthis and the next section gives a soundness result not only for the theory statedthere but also for the theory enhanced with classical logic.
Let Cl be an arbitrary subset of Obj and let Ext be an arbitrary total
function from Cl to the power set of Obj , P (Obj ) in notation. The intended
meaning of Cl is the set of classes and Ext(c) is intended to be the extensionof c, i.e., fxjx : cg. Then we de ne Tarskian semantics of formulas relative to;Ext . The
Cl and Ext. The truth value of the formula of F is denoted by [ F ] Clconditional formula
e1 ! F1 ; : : : ; en ! Fn126

Chapter 6

is recognized as an abbreviation of(e1 : T ^ F1 ) _ (e2 : T ^ e1 = nil ^ F2 ) _ : : : _ (en : T ^ en;1 = nil ^ : : : ^ e1 = nil ^ Fn );and

rp1 = e1 ; : : : ; xn = en :F;

is recognized as an abbreviation of

9~x:(exp(p1 ) = e1 ^ : : : ^ exp(pn ) = en ^ F );where ~x is the sequence of the variables FV (p1 ) [ : : : [ FV (pn ). So we do not give

semantics of these formulas.
;Ext , we will use the following conventions. The
In the de nition of [ F ] Clnotation 2 means and have values v1 and v2 such that v2 is a set towhich v1 belongs. We will use the tuple notation [ 1 ; : : : ; n ] as a macro just as
explained in 2.2. Then the Tarskian semantics of formulas is given by;Ext defg (e; ))[ E (e)]]Cl
= E (Value;Ext defg (e; ) 2 Cl
[ Class(e)]]Cl= Value;Ext def
g (e1 ; ) ' Valueg (e2 ; )
[ e1 = e2] Cl= Value;Ext def[ [e1 ; : : : ; en ] : e] Cl=g (e) 2 Cl ^ [Valueg (e1 ; ); : : : ; Valueg (en ; )] 2 Ext(Valueg (e; ))Value
;Ext def[ >] Cl= true;Ext def[ ?] Cl= false;Ext def;Ext ^ : : : ^ [ Fn ] Cl;Ext[ F1 ^ : : : ^ Fn ] Cl
= [ F1 ] Cl



def
Cl
;
Ext
Cl
;
Ext
;Ext
[ F1 _ : : : _ Fn ] = [ F1 ] _ : : : _ [ Fn ] Cl;Ext def;Ext  [ F2 ] Cl;Ext[ F1  F2 ] Cl
= [ F1 ] Cl



def
;Ext = :[ F ] Cl;Ext[ :F ] Cldef;Ext = [ F ] Cl;Ext[ }F ] Cl


def
Cl
;
Ext
[ 8~x1 : e1 ; : : : ; ~xn : en:F ] 
=
^ g
;Ext
Value (ei ; ) 2 Cl  8~v1 ; : : : ;~v n :(Ri (~v)  [ F ] Cl
[~v =~x ;:::;~vn =~xn ] )i=1;:::;n11Chapter 6

127;Ext def[ 9~x1 : e1 ; : : : ; ~xn : en:F ] Cl
=
^ g
;Ext
Value (ei ; ) 2 Cl ^ 9~v1 ; : : : ;~vn :(Ri (~v ) ^ [ F ] Cl
[~v =~x ;:::;~vn =~xn ] );1i=1;:::;nwhere Ri (~v ) is the formula de ned by^g (ei ; )) ^~vi 2 Ext(Value^1

vji 2 Cl;

i=1;:::;nj =1;:::;miso that v1i ; : : : ; vmi i are the class variables among ~vi . Note that this de nition is

by induction on the complexity of formulas.
We say a value environment  satis es the class condition i (x) is in Cl,
whenever x is a class constant or class variable. A formula F is said to be valid;Ext holds for all value environments satisfying
relative to Cl and Ext, when [ F ] Clthe class condition. Then we have the following theorem:
Relative soundness theorem. All the axioms and rules of section 2.3 except(char), (N 1)-(N 3), (V 1), (V 3), and (V 4) are valid relative to any Cl and Ext.
The most dicult rules to verify are (= 4), (8E ), (9I ), (r8E ), (r9I ) and(inst). These are veri ed by means of the following lemma:;Ext . [ F [e=x]]]Cl;Ext holds i [ F ] Cl;Ext holds,
Substitution lemma for [ F ] Clg (e; )=xi.
where 1 is hValueIn the next section, we will construct Cl and Ext that satisfy the remaining
axioms and rules. The following lemma will be of use:
Lemma 1. Let F be a CIG template. Then if the following conditions holds foreach class constant and free class variable of F , say x,
g (x; ) 2 Cl1 \ Cl2 and Ext1 (Valueg (x; )) = Ext2 (Valueg (x; ));Value
;Ext is equivalent to [ F ] Cl ;Ext .
then [ F ] Cl


1

1

1

2

2

Proof. Since F is a CIG template, e is one of the free class variables X~ in all of
the form [e1 ; : : : ; en ] : e appearing in F . Since there is no occurrence of the form
Class(e) and bound class variable in F , Cl and Ext a ect the interpretation of F
only through the interpretation of the right hand side of the form by Ext. Hencethe conclusion is obvious by the condition of the lemma.

6.3. Semantics of classes

In this section, we construct Cl and Ext so that the relative semantics of theprevious section satis es the axioms for class. The general construction is a simpli cation of the constructions due to Feferman 1979. If it is not necessary to

128

Chapter 6

validate the axioms of join and product the semantics is considerably simpli ed,
and we may assume the set of classes to be a recursive set. So we rst give asemantics of classes without join and product, and later give the full semantics. It
should be noted that the condition \a CIG template is of rank 0" is meaninglessfor the semantics of this section, since, as was noted before, our semantics is givenin the sense of classical model theory, so any formula F is equivalent to }F .

6.3.1. The restricted model

The idea of the construction is simple: we think of a class as a code of the de nition
by which its extension is de ned. By the condition of CIG templates it is possible
to know the extension of a class from the extensions of classes from which theclass is de ned. The key point is that CIG de nition is a predicative de nitionof sets. As the de nition of CIG templates, we will refer to de nition 2 of 2.4.
~ Ai
First we de ne the set of classes. Let  be the set of CIG templates h~a;~v; X;
as in 2.4.1. Recall that there is an injection cigname from  into the set of basic
function names. We denote the function code  cigname by cigcode. We assume
the basic function environment has the following additional conditions:(i) For each CIG template  , (cigcode( )) is a total one-to-one function whose
range is disjoint to the image of the set of class constants by code.
(ii) If 1 6 2 then, the ranges of two functions (cigcode(1 )) and (cigcode(2 ))are disjoint.
For example,~ Ai) 7;! ~v:list((quote cigcode(h~a;~v; X;~ Ai) );~v)
cigcode(h~a;~v; X;
satis es these conditions. We denote the function (cigcode( )) by cig for each
CIG template  . Then the set of classes C is de ned by the following clauses:(1) If c is a class constant, then c belongs to C .
~ Ai and ~v be v1 ; : : : ; vn . Then
(2) Let  be a CIG template h~a;~v; X;

cig ((v1 ); : : : ; (vn ))belongs to C for any value assignment  with the class condition, i.e., (Xi )has been in C for any Xi of X~ .
If the coding functions of cig are appropriately chosen, then C is a recursive set,i.e., we can decide if an S-expression is a class. Next we de ne the extension E (c)for each class c 2 C by induction on the construction of c:(a) If c is V  , then E (c) is Obj .
(b) If c is N  , then E (c) is N .

Chapter 6

129(c) If c is Atm , then E (c) is Atom.
(d) If c is T , then E (c) is fxjx 6= nilg.
~ Ai, then E (c) is the minimal(e) If c is cig ((v1 ); : : : ; (vn )) and  = h~a;~v; X;
solution of the set equation
X;
X = f~xj[ A] C[;~xE=~
a;c=X ] g;0

where X~ is X0 ; : : : ; Xn and EX is the function de ned by(X
if x = cEX; (x) = E (x)if x 2 f(X1 ); : : : ; (Xn )garbitrary subset of Obj otherwise.
(f) Otherwise, Ext(c) is an arbitrary subset of Obj .
Then the following theorem holds:
The restricted soundness theorem. All of axioms and rules of PX except(Product) and (Join) are valid under the semantics relative to C and E . Furthermore, the axiom of the decidability of C is valid, too, i.e., there is an individual
constant cl for which the following is an axiom:
8x:ry = app(cl; x):(y = t  x : Class):
Proof. The axioms (char), (N 1)-(N 3), (V 1), (V 3), (V 4) are automatically trueby the de nition. So only the axioms (CIG def ) and (CIG ind) remain to be
proved. These axioms are valid if the extension of a class notation c = X0 :f~ajAg~ Ai is the minimal solution of
for a CIG template  = h~a;~v; X;

X = f~xj[ A] C[;~xE=~X=ca;c=X ] g;
where the value of E[X=c] for c is X and the same as E for the others. This holds,[]

0

since by lemma 1 of the previous section, the right hand side of the equation isunchanged even if E[X=c] is replaced by EX; .
The validity of the additional axiom of decidability of the classes is straightforward, for we may think of the codings involved in the construction as all e ective. Note that the axiom is not only e ective, but also realizable, for the axiom
is of rank 0. Since the class of all classes can be de ned by fxjapp(cl; x) = tg,
the restricted system is consistent with the existence of such a class.
Corollary. The axiom system of PX without (Join) and (Product) but plus aclass constant CL and the axiom Class(x)  x : CL is consistent.
This axiom system contradicts (Join). Let us prove this by an argument due
to Feferman 1979. For each class X , we can de ne its complement by Cmp (X ) =130

Chapter 6

fxj:x : X g. So Class (Cmp (x)) holds for all x : CL. By (Join), we have a class
R1 = fpair(x; y)j:y : x ^ x : CLg. So we can de ne a class R = fxj:pair(x; x) :R1 g. Then R : R  :R : R. Contradiction.

6.3.2. The full model

Next we construct the interpretation of classes also satis es (Join) and (Product).
We denote the functions ( ) and ( ) by ~ and ~ , respectively. We suppose
two more conditions on the basic function environment:(iii) The ranges of ~ and ~ are mutually disjoint.
(iv) The ranges of ~ and ~ are disjoint to the image of the set of class constantsby code and also to the range of (cigcode( )) for each CIG template  .
The construction of classes and extensions of classes, say C~ and E~, is doneby mutual inductive de nition as opposite to the construction of C and E . We
do the inductive de nition on the following set of partial functions from Obj toPow (Obj ): = fhCl; ExtijCl 2 Pow (Obj ) ^ Ext : Cl ! Pow (Obj )g:
We consider  to be an ordered set under the ordering

hCl1 ; Ext1 i vhCl2 ; Ext2 i i
Cl1  Cl2 and Ext1 is the restriction of Ext2 to Cl1.
Then  is a cpo with the bottom h;; ;i. We de ne a monotone function from 
to  whose any xed point is a model of PX satisfying (Join) and (Product). Let
hCl; Exti be an element of . Then the value of (hCl; Exti), say hCl1 ; Ext1 i,
is de ned as follows:(I) x 2 Cl1 , if x is obtained by one of clauses (1), (2) of the de nition of C byreplacing C by Cl.
(II) x 2 Cl1 , if x is of the form ~ (c; f ) or ~ (c; f ) such that c 2 Cl andApp(1)(f; y) 2 Cl holds for all y 2 Ext(c).
(III) Assume x has turned out to be an element of Cl1 by (I). If x is obtained by
the clause (1), then Ext1 (x) is de ned as the clauses (a)-(d) of the de nition~ Ai,
of E . Otherwise, x is a form cig ((v1 ); : : : ; (vn )) such that  = h~a;~v; X;
and then Ext1 (x) is the minimal solution of the set equation;ExtX;
X = f~xj[ A] Cl[~x=~a;c=X ] g;0

where ExtX; is de ned as EX; .

Chapter 6

131(IV) If x is the form obtained by (II), then Ext1 (x) is de ned by

Ext1(~ (c; f )) def= faj8b 2 Ext(c):App(1)(a; b) 2 Ext(App(1)(f; b))g
Ext1 (~ (c; f )) def= f(a : b)ja 2 Ext(c) ^ b 2 Ext(App(1)(f; a))g:
It is easy to see that is a monotone function, since every monotone function
on a cpo with a bottom has a minimal xed point. By the following theorem, we
can see that any xed point of is a model.
~ be any xed point of . Then all of
The soundness theorem. Let hC~; Eiaxioms and rules of PX including (Join) and (Product) are valid by the semantics[ F ] C~;E~.
The proof, a straightforward consequence of the de nition of , is left to thereader.
The construction of the minimal xed point of the monotone function isproved as follows: De
F ne a trans nite sequence fX g such as X0 = ?, X +1 =(X ) and X = < X for a limit ordinal . Then fX g is an increasing
sequence. So there is a least ordinal smaller than or equal to the cardinal of such that X = X +1 and X is the minimal xed point of . Feferman usedordinals to construct his model, and the construction of the minimal xed pointof is essentially the same as his construction of the model. Our construction isa \sugared" Feferman construction.
See Beeson 1985 and Allen 1987 for other constructions of related theories.
Allen 1987 gives a constructive proof of existence of a model of Martin-Lof's typetheory. His idea is applicable to PX. Using Pow (Obj  Pow (Obj )) rather than ,
we can construct a model of PX without modal sign in intuitionistic set theory
or type theories.

6.3.3. The model of the impredicative extension
To construct a model of PX+CIG2 of 5.2, we need the trick of the \Skolem
paradox". (This is essentially nonconstructive.) This is also due to Feferman 1979.
In this section, we will construct a model of PX+CIG2-f(Join); (Product)g. The
construction of the impredicative full model is obtained by the same method.
First we introduce a modi ed relative semantics tuned to strati ed formulas.
It is given by modifying the interpretation of quanti ers over classes so that allclass variables range not over the set Cl, but the set of all subsets of Obj . A
bound class variable in a strati ed formula appears only in the right hand side of\:", so a bound class variable is never referred to as an object. In other words, the132

Chapter 6interpretation of a bound class variable in a strati ed formula is arbitrary. For
example the semantics 9X is given by;Ext;Ext def
Str[ 9X:F ] Cl
= 9S  Obj:Str[ F ] Cl
 C  =X S=X ;

[

[
]

]

where C is an arbitrary class constant. Next we associate a Skolem function, saySk , with each existential strati ed formula, say (x; X ) = 9Y:F , so that
Cl;Ext[Sk ((x);hExt(X);(X)i=Y ];Ext , then Str[ F ] 
if Str[ ] Cl:Note that the value of the Skolem function depends on not only the code, i.e.,(X ), but also the extension of X , i.e., Ext(X ). The existence of such a function
is certi ed by the axiom of choice. Since the number of strati ed formulas arecountable, we may assume that there are basic function identi ers which code
Skolem functions. We assume that they satisfy the following conditions:(iii) For each strati ed formula , (Sk ) is a total one-to-one function whose
range is disjoint to the image of the set of class constants by code and to therange of each (cigcode( )).
(iv) If 1 6 2 then, the ranges of two functions (Sk ) and (Sk ) are disjoint.
We denote (Sk ) by sk . The following clause is added to the construction of C :(3) Let  be a strati ed formula with free variables v1 ; : : : ; vn . Then for any
value assignment  with the class condition (i.e., if vi is a class variable, then(vi ) has been in C ), sk ((v1 ); : : : ; (vn )) belongs to C .
The clauses of the construction of E are modi ed as follows:~ Ai, then E (c) is the minimal(f) If c is cig ((v1 ); : : : ; (vn )) and  = h~a;~v; X;
solution of the set equation
1

2

X;
X = f~xjStr[ A] C[;~xE=~
a;c=X ] g:
0(g) If c is sk ((v1 ); : : : ; (vn )), then E (c) is Sk (0 (v1 ); : : : ; 0 (vn )), where0 (vi ) =hE ((vi )); (vi )i if vi is a class variable,(vi )

otherwise.

(h) Otherwise, Ext(c) is an arbitrary subset of Obj .
Then the following lemma holds:

Chapter 6

133

Lemma. For any strati ed formula  and a value environment with the classcondition, the modi ed semantics under C and E is equivalent to the original
semantics, i.e.,[ ] C ;E i Str[ ] C ;E :Proof. This is proved by induction on . Note that any subformula of a strati ed
formula is again strati ed. The point is the change of the interpretation of classquanti ers. For example, let us assume  is 9X:F . The \only if" part is obvious.
So let us prove the \if" part. Assume that the right hand side of the theorem
holds. Then by the induction hypothesis, the de nition of E , and the property of
the Skolem function sk , we see thatE
[ F ] C[;sk; ((v );:::;(vn ))=X ]1

where v1 ; : : : ; vn are the free variables of . Since sk ((v1 ); : : : ; (vn )) belongs to
C , the left hand side holds.
By this lemma, the Str[ A] in the clause (f) of the construction of E may bereplaced by [ A] . Hence the restricted soundness theorem holds for the impredicative model. Note that the construction of C is still e ective. So the impredicativeextension is still consistent with the axiom of the decidability, and its corollary
remains true.

6.4. Satis cation of MGA

We will show the models constructed in this chapter satisfy the minimal graphaxiom (MGA) of 2.4.3. Let us reexamine the de nition of the rst interpreterof 6.1. It is a simultaneous equations with nite many equations and variables.
But it may be recognized as simultaneous equation with in nite many variables
and equations considering Def (a) is a variable for the function with the function
name a. Then the de nition equation for Def turns to a collection of in nite manyequations. Of course, the minimal solution is unchanged. For simplicity, assume
a de nition of a function identi er f consists of a single equation f = body(f ) andthe arity of f is one. Since the semantics of a class de ned by a CIG inductive
de nition is the minimal solution of a monotone operator de ned by its CIG
template, (MGA) for f states that Def (f ) is the minimal solution of the equationof f = (f ), where  is the monotone operator on the cpo [Obj * Obj ] de nedby body(f ). If app is included in body(f ), then f is simultaneously de ned withapp. (MGA) maintains that f is still the minimal solution of a single equationf = (f ), even though the graph of app in body(f ) is interpreted as the graphof app which is simultaneously de ned with the other functions including f . The
following general result suces to show (MGA) holds.

134

Chapter 6

Lemma 1. Let fDg2 beQ a collection of cpo's with bottoms and let  bea continuous function from 2 D to D . Assume hM i2 is the minimal
solution of the simultaneous equations fX =  (hX i2 )g2 . Set(X ) =  (MX );0

where MX is determined by00proj (MX0 ) =

X if  = 0 :M otherwise

Then the minimal solution of X = (X ), say N , coincides with M .
Proof. Since M is also a solution of X = (X ), N v M holds. Hence
MN v hM i2 holds. So  (MN ) v MN holds for each  2 . HencehM i2 v MN holds. This implies M v N .
0

0

0

0

0

0

0

0

7 Implementing PX
In this chapter, we describe an implementation of PX. The implementation isbased on the formal theory described in earlier chapters, but the actual implementation has extended features. More or less, the extensions are not essentialfrom theoretical viewpoint so that the actual implementation is interpretable in
the formal theory of PX. The system is implemented by Franz Lisp on a Sun
workstation.TM
In 7.1, we will introduce the concept of \hypothesis" to extend the basic
logic. It is not an essential extension, but provides a means of backward proof
developments. The actual implementation of PX is described in 7.2 and 7.3. In
7.4, we will describe a utility by which we can prove hypotheses unproved by PX's
proof checker with a more powerful proof checker EKL.

7.1. Hypotheses

As was explained in chapter 4, it is not necessary to ll all details of a proof to
extract its execution program. In the course of a proof development, a user often
wants to retain many unproved lemmas, as trivial \hypotheses" as in mathematicaltexts. Giving the full details of a proof in the course of the development, we often
lose our main idea of the proof. So we desire a mechanism by which we can retainsome \trivial" facts unproved as hypotheses in the course of the development andlater can retrieve and certify all hypotheses when we wish to ll in the details of
the proof. PX has such a feature, called hypothesis. A hypothesis is merely asequent whose conclusion is a rank 0 formula, and any proof may have any nite
numbers of hypotheses. To formalize the notion of proofs with hypotheses, it isenough to introduce the following two inference rules:(hypI ); ) F (F is of rank 0)(hypE )

;1 ) F1 ;2 ) F2 :;1 ) F1

The rule (hypI ) means we may use any hypothesis as a new axiom. To explain(hypE ), we de ne the hypotheses of a proof.
De nition 1. Let P be a proof ends with a rule r. Then the hypotheses of P ,say hyp(P ), are de ned by(1) If r is (hypI ), then hyp(P ) is f; ) F g.

136

Chapter 7(2) If r is (hypE ), let P1 and P2 be the left and right immediate subproof of P .
Then we set

hyp(P ) = (hyp(P1 ) ; f;2 ) F2 g) [ hyp(P2 ):(3) If r is neither (hypI ) nor (hypE ), then hyp(P ) is hyp(P1 ) [ : : : [ hyp(Pn ),where P1 ; : : : ; Pn are the immediate subproofs of P .
If a proof P has hypotheses, i.e., hyp(P ) 6= ;, then P is called a hypothetical
proof or an incomplete proof. Otherwise, it is called a complete proof. A sequentis a theorem i a complete proof ends with it.
A proof of the form S1 =S2 =S3 may be thought to be constructed in two ways
(S1 =S2 )=S3 and S1 =(S2 =S3). The former is a proof by forward reasoning andthe latter is by backward reasoning. But the ocial inductive de nition of proof
trees does not allow an \incomplete" proof like (S2 =S3 ). In this sense, backward
reasoning is forbidden in traditional formal systems. Regarding S2 as a hypothesis,
i.e., a proof of S2 created by (hypI ), we think (S2 =S3 ) is a hypothetical proof andwe get a complete proof S1 =(S2 =S3 ) by applying (hypE ). That is to say, (hypI )reserves a point (leaf) of a proof tree and another proof tree is grafted on the tree atthe point by (hypE ). Backward reasoning is a way to build a proof tree from root
to leaves; in this sense (hypI ) and (hypE ) provide a means of backward reasoning.
Note that to do \one step backward inference" we have to make a proof from newgoals created by (hypI ) by the corresponding forward inference rule and thenapply (hypE ). This takes many steps, so if a proof is built mainly by backward
reasoning our mechanism is not useful. But actual proof writing in mathematics
mainly proceeds in the forward direction. Although one step backward reasoning
may be useful as a tool for proof development, as in Edinburgh LCF (Gordon,
Milner, and Wadsworth 1979, Constable et al. 1986), it seems not too useful for
proof writing.
By attaching the realizer of the left upper sequent to the lower sequent, we
can realize the rule (hypE ). The following obviously holds:
Proposition 1. Let P be a hypothetical proof of ; ) F and let r be a program
extracted from P . Then r is a realizer of ; ) F , if all of the hypotheses of P arevalid.
Furthermore, the realizer extracted from a proof P1 that is obtained by eliminating hypotheses of a proof P by successive applications of (hypE ) is identical to
the realizer extracted from P . So proof-program development in PX may proceed
in one of the following ways, and the results are completely the same.

Chapter 7

137

Approach A.
0) Give a speci cation as a sequent.
1) Make an incomplete proof of the speci cation.
2) Extract a realizer of the speci cation from the proof.
3) Prove the hypotheses of the proof.
Approach B.
0) Give a speci cation as a sequent.
1) Make an incomplete proof of the speci cation.
2) Complete the proof eliminating hypotheses by (hypE ).
3) Extract a realizer of the speci cation from the completed proof.
A termination condition can be stated as a hypothesis, as we saw in chapter 4;
this is the hardest part of veri cation. So we normally put it in the hypotheses
and take approach A, for we can see the program before we nish the cumbersome
veri cation of the termination condition. Since hypotheses are rank 0 sequents, it
is possible to prove them by means of another proof checker, insofar as the checker
is faithful to the semantics of PX. Namely, step 3 of approach A may be doneby another proof checker. To do so we have to make a translator of languages
and a theory in PX, which the proof is developed in, to a servant proof checker.
(In proof development, a theory is built up on plain PX by declaring functions
and so on. See the next section.) Having such conversion method, approach A ismodi ed as follows.
Approach C0) Give a speci cation as a sequent.
1) Make an incomplete proof of the speci cation.
2) Extract a realizer of the speci cation from the proof.
3) Translate the theory and hypotheses into the servant proof checker.
4) Prove the translated hypotheses in the theory by using the servant proof
checker.
We have implemented a translator that translates a theory and hypotheses of
PX into a powerful proof checker EKL; this will be described in 7.4. An actual
program-proof development by approach C with EKL translator will be given inappendix B.

7.2. Proof checker

In this section we brie y describe the proof checker of PX. We will not giveaccounts of all functions supported by PX.

7.2.1. FormulasFirst we give the abstract syntax of formulas. Table 1 shows the correspondenceof the abstract syntax and the concrete syntax. For readability, any formula may

138

Chapter 7

Table 1

Concrete syntax
Abstract syntax
app; app
apply; funcall
pair; fst ; snd; list
cons; car; cdr; list
atom; equal
atom; equal
suc; prd
add1; sub1
0 ; t ; nil; V; N; Atm; T; quote( )0 ; t ; nil; V; N; Atm; T; (quote )f (e1 ; : : : ; en )(f e1 : : : en )cond(e1 ; d1 ; : : : ; en ; dn )(cond (e1 d1 ) : : : (en dn ))(x1 ; : : : ; xn )(e)(lambda (x1 : : : xn ) e)(x1 = e1 ; : : : ; xn = en )(f )(Lambda ((x1 e1 ) : : : (xn en )) f )let p1 = e1 ; : : : ; pn = en in e
(let! ((p1 e1 ) : : : (pn en )) e)>; ?
TRUE, FALSE[e1 ; : : : ; en ] : ee1 : : : en : e
e1 = e2
e1 = e2E ( e)
E e
Class(e)CL e
F1 ^ : : : ^ Fn
F1 & : : : & Fn
F1 _ : : : _ Fn
F1 + : : : + Fn
F1  F2
F1 -> F2
F1  F2
F1 <-> F2
:F
-F
}F
$F
e1 ! F1 ; : : : ; en ! Fn
(COND (e1 F1 ) : : : (en Fn ))Sor (e1 ; : : : ; en )(OR e1 : : : en )Case (e; F1 ; : : : ; Fn )(CASE e (F1 ) : : : (Fn ))rp1 = e1 ; : : : ; pn = en :F(LET (p1 e1 ) : : : (pn en ))(F )8[x1 ; : : : ; xl ] : e1 ; : : : ; [y1 ; : : : ; ym ] : en :F (UN (x1 : : : xl ) : e1 : : : (y1 : : : ym ) : en )(F )9[x1 ; : : : ; xl ] : e1 ; : : : ; [y1 ; : : : ; ym ] : en :F (EX (x1 : : : xl ) : e1 : : : (y1 : : : ym ) : en )(F )be surrounded by parentheses. But the print routine of PX always deletes arepeated grouping of parentheses, so that even if one types in ((COND : : :)), PX
prints (COND : : :).
When the length of a tuple variable is just one, it is treated as a single variable. And the restriction by V may be omitted. So one may type in (UN x)(F )instead of (UN (x) : V)(F ). Furthermore, (UN x : C y : C)(F ) may be abbreviatedas (UN x y : C)(F ). CASE and OR are treated as \abbreviations", i.e., the readroutine translates these into conditional formulas, and the print routine abbreviates conditional formulas into these as much as it can. PX allows to use de ned

Chapter 7

139

predicates and predicate variables. These are explained in 7.2.3.
The abstract syntax is comprised of external forms of formulas. When these
are inputs, they are translated to internal forms. Every internal form is just an
S-expression, e.g., x = y is represented by (% = x y).
To let PX recognize an input sequence as a formula, one has to surround it
by braces, as fx = yg. The left brace is a character macro which reads the input
sequences until the next right brace and returns the internal form of the formula.
So the internal form of x = y is inputed by typing in 'fx = yg.
Variables and constants in the abstract syntax are as follows:hvariablei := htotal variableijhpartial variablei
htotal variablei := hindividual variableijhclass variablei
hindividual variablei := ha;zi except tjha;zihnumerali
j$hindividual symbolihsymboli
jhindividual variableihclass variablei := hA;Zi except hNjVij$hA;ZihsymbolijhA;Zihdigit stringi
jhclass variablesi
hpartial variablei := ?hsymboli
hidenti eri := hindividual identi erijhclass identi eri
hindividual identi eri := ha;ziha;zjA;Zihsymbolijtjhnumeralij(quote hS;expressioni)
hclass identi eri := hA;Ziha;zjA;ZihsymbolijNjVjT
hsymboli := 0j1j : : : j9jAjBj : : : jyjz
jhsymbolihsymboli
jhsymboli ; hsymboli
jhsymboli hsymboli
hindividual symboli := hsymboli except hA;Zi
hdigit stringi := 0j1j : : : j9jhdigit stringihdigit stringi
hnumerali := 0jh1j : : : j9ihdigit stringi
Except for these, PX creates some individual variables and individual identi ers
during extraction. Although they are noted as variables and identi ers by PX,
users are not allowed to use them unless PX has created them.

140

Chapter 7

These syntactic categories are not the syntactic categories of the DEF-system.
An individual identi er may be either an individual constant or a function identier. After one declares which it is, or after one places it in the proper position in
the input formula, it belongs to one of theses exclusively. This will be explained in
7.2.6. To know what an individual belongs to, a command syncat, which returns
the syntax category of each atom, is available. Similarly, a class identi er may beeither a class constant or a function identi er. The arity of a de ned function isdetermined by its declaration. Some function identi ers and constants are predeclared, e.g., car is a function identi er, t is an individual constant, and N is a classconstant. Note that it is not necessary to declare variables. When renaming ofbound variables is necessary for the substitution of expressions, PX adds enoughnumbers of \*" to the end of variables.

7.2.2. Proofs

A proof is also an S-expression. A proof is a list beginning with the atom%%proof%%. A list beginning with %%proof%% is called a pseudo proof. Insofar
as PX is used legally, any pseudo proof has the structure of a proof. The second
and third items of a proof are the conclusion and the list of assumptions. In PX
mode, the default mode of PX, any illegal input is detected by the top level andis not executed. So pseudo proofs are always proofs. But in Lisp mode, one may
execute any lisp commands, so it is child's play to make an S-expression which
is a pseudo proof but not a proof. For example, the value of (list '%%proof%%'%FALSE nil) is a pseudo proof of FALSE without any assumptions. PX does notsupport any method to check if an S-expression is an actual proof. So the only
way to ensure that one has not built pseudo proofs which are not proofs is to use
PX only in the PX mode. By the form of the prompt, one may ascertain that
one has fallen into the Lisp mode.

7.2.3. Top level and commands
The top level of PX is a modi cation of the CMU top level of Franz Lisp. So

one may omit the outermost parentheses at the top level; the top level retains theevents, which may be redone (see Foderaro, Sklower, and Layer 1984). The readand print routines of PX are almost the same as those of the CMU top level ofFranz Lisp, and the brace macro \f" for reading external formulas is supported, as
mentioned above, and read-eval routines support a checking mechanism for legal
commands.
A command is any program of Lisp. PX checks if it may create an illegal
pseudo proof and then executes it as a Lisp program only when it is safe. Such asafe program is called a legal command. A legal command is a command whose
execution does not violate the following condition: every object created in PX

Chapter 7

141

represents a proof insofar as it is a cons cell and its car part is %%proof%%. For
example a destructor, e.g., car, is safe, for it does not create new cells. On thecontrary, cons is dangerous. So a command using cons is illegal. But list constructors inevitably use Lisp as metalanguage in the sense of ML of Edinburgh
LCF. So PX supports the safe constructors sfcons, sflist etc. These constructors never create a cell whose car part is %%proof%%. (The sfcons stands forsafe cons.) Other functions besides constructors that may violate the condition
are the loading function and functions assigning a value or a function de nition
to atoms. For the former, a legal function sfload is available. It checks that each
input from a le is legal. Its actual use is shown in 7.2.6. The other functions will
also be discussed in 7.2.6.
The print routine supports pretty printing of formulas and proofs. If an
S-expression is a formula, the print routine prints it as an external formula surrounded by braces. If an S-expression is a proof, the print routine prints a sequenceof representing dots and the yield sign \]-" followed by the conclusion, as Edinburgh LCF does. A printed proof is also surrounded by braces, and if it is ahypothetical proof, then an asterisk follows the left brace. The following shows
how this works:
1:assume {(add1 x) = (sub1 x)}{.]- (add1 x) = (sub1 x)}
2:(deprf prf1 it){.]- (add1 x) = (sub1 x)}
3:display-thm prf1
prf1.
{(add1 x) = (sub1 x)}
from[1] {(add1 x) = (sub1 x)}; A proof with an assumption.
; Assign it to the atom prf1.
; Display the sequent of the proof.

t
4:(deprf prf2 (hypI '{x = (cons x x)} ; Introduce a hypothesis.
'{(car x) = x}'{(cdr x) = x})){*..]- x = (cons x x)}; An asterisk is observed.
5:display-thm it; The value of the last event was assigned to the atomit.
it.
{x = (cons x x)}
from[1] {(car x) = x}[2] {(cdr x) = x}

142

with 1 hypotheses

Chapter 7; display-thm tells there is a hypothesis.

t
6:(deprf prf3 (conjI prf1 prf2)) ; Conjunction introduction.
{*...]- (add1 x) = (sub1 x) & x = (cons x x)}
7:(display-thm prf3)
prf3.
{(add1 x) = (sub1 x) & x = (cons x x)}
from[1] {(add1 x) = (sub1 x)}[2] {(car x) = x}[3] {(cdr x) = x}with 1 hypothesest
9:(showhyp prf3); Display the hypotheses of prf3.

Hypothesis{x = (cons x x)}
from[1] {(car x) = x}[2] {(cdr x) = x}t

In PX mode, the prompt is an event number followed by \:". So the rst
thing one sees when PX is loaded is \1:" as above. In Lisp mode, the prompt isan event number followed by \." as in the CMU top level. After you enter in Lisp
mode once, the prompt of PX mode turns to an event number followed by \;".
The function mode changes the mode.
The following shows the changes of mode:
1:mode; Mode is PX.
PX
2:assume {FALSE}{.]- FALSE}
3:display-thm itit.
{FALSE}from; Create a proof of f?g ) ?.
; Display the sequent of it.

Chapter 7

143[1] {FALSE}t
4:vl 2; Get the value of the event 2.
{.]- FALSE}
5:pp it; Print it to see the internal form.
(setq it '(%%proof%% (%FALSE) ((%FALSE)) (%assume (0 (%FALSE)))))t6:'(%%proof%% (%FALSE) ()); Make an illegal proof.
'(%%proof%% (%FALSE) nil)
Illegal input for PX; The attempt failed.
nil
7:mode lisp
; Change to Lisp mode.
LISP
8.'(%%proof%% (%FALSE) ()); Make an illegal proof.
{]- FALSE}; It succeeded, this time.
9.display-thm it; Display it.
it.
{FALSE}t10.(setq fff (vl 8)){]- FALSE}
11.mode px
PX12;'(%%proof%% (%FALSE) ())'(%%proof%% (%FALSE) nil)
Illegal input for PX
nil
13;fff{]- FALSE}; Keep the illegal proof.
; Again PX mode.
; So you can't remake the illegal one.
; But the old one is still kept.

Observe that after entering Lisp mode once, one may have a bad proof, even if
one has again returned to PX mode.
The function con returns the conclusion of a proof, the function asp returns
a list of the assumptions of a proof and the function get hyp returns a list of the
hypotheses of a proof. A hypothesis fA1 ; : : : ; An g ) F is represented as a list
(F (A1 : : : An )). To display hypotheses, a function showhyp is available as shown
above.

144

Chapter 7

7.2.4. Inference rules

Since a proof is an S-expression, any inference rule that is a Lisp function returns
a proof. For example, (assume) is implemented as a function assume such that(assume F ) = fF g ) F (F is a formula);
and the conjunction introduction (^I ) is a function conjI such that(conjI P1 : : : Pn ) = FP1^; :: :: :: ;^PFn
1

n

I:

(^ )

So the value of (conjI (assume 'fx=yg) (assume 'fy=zg)) is a proof of thesequent
fx = y; y = zg ) x = y & y = z:
Almost all inference rules are implemented as functions in the manner described above, respecting their concrete description. But there are some exceptions. The axioms about the modal operator are not implemented separately, but
as part of a tautology checker. PX has a which returns a proof of a rank 0 formula
if the following procedures succeed: (i) regarding the modal operator as double
negation, eliminate all successive pairs of negations, (ii) expanding conditional formulas to the disjunctive equivalent in 2.3.4, and regarding any quanti ed formula
as a propositional variable and two quanti ed formulas as the same propositional
formulas when they are -convertible, check if it is a tautology. The tautology
checker respect only propositional logic, although it call axiom? below to check if
formulas are axioms. The following shows a use of the tautology checker TAUT.
1:deGP ^Prd 1 0 ; Declare ^Prd as a rank 0 predicate of arity 1. See 7.2.6.
^Prd
2:TAUT $ ^Prd(x) <-> ^Prd(x); Axiom ( 3).
]- $ ^Prd (x) <-> ^Prd (x)3:TAUT $ ^Prd(x) <-> - - ^Prd(x); Axiom ( 1).
]- $ ^Prd (x) <-> - - ^Prd (x)4:TAUT $(UN x)(^Prd(x)) <-> (UN x) ($ ^Prd(x))]- $ (UN x) (^Prd (x)) <-> (UN x) ($ ^Prd (x))
5:TAUT - (EX x)(- ^Prd(x)) <-> (UN x)(^Prd(x))
nil; TAUT doesn't know predicate calculus.

f
f
f

f
f
f
f

g

g

}

g

g

}

g ; Axiom (}2).
ggAnother exception concerns is a data base of axiom schemas. One can ask

PX if a formula is its axiom schema by a query function axiom? as follows:
1:axiom? fE xg; axiom? knows a total variables has a value.
f]- E xg

Chapter 7

145

f

g

2:axiom?
E ?1; axiom? doesn't know about this.
Error in axiom?: I don't know E ?1
3:axiom?
(cons ?1 ?2) : Dp !(assume 0 E ?1 ) !(assume ' E ?2 )..]- (cons ?1 ?2) : Dp
4:display-thm it
it.
(cons ?1 ?2) : Dp
; (cons ?1 ?2) is a dotted pair,from; under the following assumptions.
[1] E ?1
[2] E ?2t
5:axiom?
(car (cons x y)) = x]- (car (cons x y)) = x
6:axiom?
E ?1 !(assume ' E (cons ?1 0) ).]- E ?1
7:display-thm it
it.
E ?1
from
[1] E (cons ?1 0)t
8:(deprf th (axiom? ' ?1 = ?1 ))]- ?1 = ?1
9:(exI ' (EX x)(x = x) th (assume ' E (cons ?1 x) )).]- (EX x) (x = x)
; axiom? is called in ( ).
10:display-thm it
it.
(EX x) (x = x)
from[1] E (cons ?1 x)
t

f

f

g

f

f

g

g

f

g

f

g

g

f
f

g
g

f

f
f

g

f

f

g

g

g

f

g

g

f

f

g

f

f

f

f

g

g

g

g

f

9I

g

g

f

g

7.2.5. Inference macros
PX provides macros by which you can write natural programs to build up proofs.

These programs are then expanded to programs written in terms of the inference
rules described above and executed. So we call them inference macros. The
example of appendix B is written in these inference macros. In this subsection,
we will give an overview of them.
Let e be a program whose value is a list of proofs. Then (We see F e) is
expanded to an appropriate inference rule. For example, if the values of e1 and e2

146

Chapter 7

are proofs whose conclusions are A and B , then (We see fA & B g (sflist e1e2 )) is expanded to (conjI e1 e2 ). When you wish to specify what rule is used,
you can say, e.g., (We see F by conjI e). The function sflist does not looknatural. PX provides some connectives like since, for, by, in the following,etc., which are aliases of sflist. So the above example may be restated as(We see fA & B g (for e1 e2 )). The connectives that start with an upper caseletter: By, Since, In the following, etc. provide a way to change the order ofsentences in proofs. For example, (By e (we see F )) is expanded to (we see F(by e)). (we see is an alias of We see. All the macros except some connectives
have such aliases.)
The macro proofs is similar to prog of Lisp. (@ is a synonym for proofs.)(proofs e1 : : : en ) equals (prog e1 : : : en ), but in the program ei+1 the valueof the previous program ei can be referred as the previous fact. On the other
hand, the previous facts stands for the list of the values of the previous expressions.
Let and Set are aliases of sfsetq explained below. When (We prove (A) Fe) is evaluated, the formula F is bound to the atom A then e is evaluated. So one
can refer to F by the label A. Furthermore, it applys the rule (alpha) to F and thevalue of e. Thus, if the value of e is a proof whose conclusion is -convertible to
F , then the value of the program is a proof of F . The label (A) may be omitted.
Then only the adjustment by (alpha) is done.
In the mathematical text, the elimination rules like existential elimination
introduce local assumptions. When we prove 9x:A ) C by existential elimination,
we introduce a local assumption A and prove C under the assumption. But
the ocial rule (9E ) does not allow such an inference. We must built proofs of
f9x:Ag ) 9x:A and fAg ) C , then apply the rule. This is not quite a natural
way of proving theorems. The above proof can be written as follows by a macro
We assume:(We assume there exists x such that (Asp1)

F e).

When this expression is evaluated, a proof of fF g ) F is bound to Asp1, then e
is evaluated. So one can refer to the local assumption F by Asp1 in e. But thisdoes not exhaust the features of the macro. PX has an assumption stack in which
local assumptions are kept. The macro also pushes the local assumption on thestack. When one says (Obviously B G1 : : : Gm ) in e, it is expanded to (hypI
B F1 : : : Fn G1 : : : Gm ), where F1 ; : : : ; Fn is the content of the assumption
stack. After evaluating e, the local assumption pushed by the macro pops up. See
examples in appendix B.
When the major premise of (9E ) is not an assumption but a proved fact,

Chapter 7

147

then one may say(We may assume there exists x such that (A)F e1 e2 )Then the value of e2 is used as the major premise of (9E ). By combining connectives such as By, etc., with this, one can say (By e2 (we may assume : : : e1 )).
The macros for the elimination rule for r are also We assume and We may assume.
The macros understand the rule should be (9E ), if the keyword there exists
exists. If it is absent and a declaration (Asp1) p matches e exists, then (r9E )is used.
The macros for (_E ) and (! _E ) are By cases. The keywords by which
the macro decides which rule should be used are or for (_E ) and otherwise for(! _E ). See appendix B.
To push assumptions onto the assumption stack, one may say (Suppose (A)F e). Then F is pushed onto the stack, the assumption is bound to the label A,
and e is evaluated. (We assume (A) F e) is equivalent to the above. Namely,
We assume turns to be an alias of Suppose, if the keywords mentioned above areabsent.
Since the inference macros look like English phrases, it is child's play toprint a program of PX written by inference macros in TEX. PX's TEX translator
deletes underscores of macro names and translates formulas in abstract syntax
to TEX commands representing formulas in concrete syntax. Then the resulted
TEX le can be formated by TEX. An example will be found in appendix B. Notethat inference macros are expanded to basic inference functions, so PX cannot
translate internal forms of proofs to TEX commands. It is possible to de ned new
inference macros in PX. Then the TEX translator print them by using a default
format. So to print them beautifully, a user has to specify how to print them bymeans of TEX commands.

7.2.6. PX evaluator and declarations
PX can be considered to be based on a regular DEF-system. A regular DEFsystem consists of an in nite number of function de nitions. But a DEF-systemcreated by the actual PX always has only a nite number of function de nitions.
We may regard any environment created with the proof checker of PX to bea nite subsystem of a regular DEF-system. The environment created by PX
is called a theory and it consists of a nite number of declarations. A theory
is not an environment in Lisp on which PX is implemented. So even if one

declares a function in a theory, it is not available as a Lisp function. Since atheory is di erent from the environment of Lisp, users are allowed to declarea function with a function name which PX uses. For example, in the theoryof the experiment in appendix B, we declare a function con which returns the148

Chapter 7

conclusion of a proof of the propositional logic de ned in the theory. This does
not change the de nition of the function con of PX, which returns the conclusionof a proof of PX. The PX evaluator, px-eval, evaluates expressions of PX underthe environment of theory. px-eval may have less than two arguments. (px-evale a) evaluates the expression e under the assignment a, which assigns values tofree variables of e. An assignment is a list of lists of the form (variable value).
px-eval has a current environment and an expression e is evaluated under thecurrent environment by (px-eval e). One can assign a value of the expression
e to a variable x of the current environment by (px-eval-setq x e). Note that
this does not change the theory. Even if one assigns a value to a variable of thecurrent environment of px-eval, one cannot prove that the variable is equal to thevalue. The assignment of values to variables in the current environment is allowed
only for the convenience of running extracted functions. By (px-eval-import xy), one can import the value of the variable y of the proof checker to the current
environment. Invoking the command (px-eval), one enters into the interactivemode of the PX evaluator. Then each command is evaluated under the current
environment. In the interactive mode of PX evaluator, one changes the current
environment by setq, which is available only on the top level of the interactive
mode. One can exit from the PX evaluator top level by (exit), and then thecurrent environment is retained.
Declarations are classi ed to constant declarations, function declarations, orpredicate declarations. Constant declaration declares identi ers as constants inthe sense of DEF system. Function declaration declares identi ers as function
identi ers in the sense of DEF system. Function and constant declarations arealso classi ed as class declarations and individual declarations. Predicate declarations are further classi ed as generic predicate declarations, and user de ned
predicate declarations. So there are six kinds of declarations, i.e., individual constant declaration, individual function declaration, class constant declaration, class
function declaration, generic predicated declarations, and user-de ned predicate
declarations. Declarations are exclusive, i.e., an identi er once declared cannot be
redeclared. This restriction retains the consistency of proofs and an environment
built by declarations. A declaration is done via one of the following functions:deCONST, deFUN, deEXFUN, deCIG, deECA, deDP, deGP or the read routine of
PX. The declarations done by the read routine are called incomplete declarations.
Even if the individual identi er ff is not declared, one can use it in one's formula.
If one inputs 'f(ff x) = yg, then the read routine declares ff as a function identi er with arity 1. If one inputs 'fff = yg instead, then the read routine declares
ff as a constant. Such declarations are called incomplete declarations, for they
does not determine the de nition of identi ers. When an identi er has an incomplete declaration, the de nition of the identi er may be declared by deFUN, deCIG,

Chapter 7

149

deECA, or deCONST according to its incomplete declaration.

Note that deEXFUN
cannot be used. At extraction, the de nition of an incomplete identi er is anappropriate default value.
Numerals and the identi er of the form (quote ) are constants without
declarations. And some identi ers t, nil, etc., are predeclared.
The function deCOSNT declares an individual identi er as a constant. So declarations done via deCONST are always individual constant declarations. Invoking(deCONST xx v ), the individual identi er xx is declared as an individual constantwith the value v. If xx is not an individual identi er, the declaration is denied.
After the declaration, the axiom xx = 'v is added to the theory. Invoking (axiom'xx) one obtains a proof of this axiom. If the body of deCONST is empty, e.g.,(deCONST xx), then xx is declared to be a constant and the axiom E xx is added
to the theory. The declaration (deCOST (xx 1) (yy) (zz t)) declares xx, yy,
and yy at once.
The function deFUN declares a function. For example, append is declared as(deFUN append (x y):(cond (x (cons (car x) (append (cdr x) y))) (t y)))A function declaration via deFUN is always an individual function declaration. A
function declaration must be lexical, i.e., all free variables of the function bodymust appear in the argument list. Incremental programming is not available in
PX, i.e., all functions in the body of deFUN must have been declared. Simultaneousfunction declaration is available, e.g., even and odd can be declared as follows:(deFUN (even (x) (cond ((equalx0)t) ( t ( odd ( sub1x)))))(odd (x) (cond ((equal x 1) t) (t (even (sub1 x)))))).

The axioms added by a function declaration are de nition equations of the declared functions. For example, after the above declaration, one obtains a proofof(odd x)=(cond ((equal x 1) t) (t (even (sub1 x))))by invoking (axiom 'odd). (deFUN foo (x y)) will do an incomplete declaration.
The derived rule of (choice2) of 2.5 is implemented as an individual function
declaration. When P is a proof whose sequent satis es the condition of (choice2),
then its choice function is declared by(deEXFUN foo (x1: : : xn) 'P ):150

Chapter 7

When this is invoked, a program extracted from P and a function declaration of
foo is done by deFUN. So (axiom 'foo) returns a proof whose conclusion is thede nition of foo. When PX creates some new functions for CIG induction in P ,then they are also declared by deFUN. (choice-rule 'foo) returns a proof of thelower sequent of the rule (choice2).
A CIG de nition is done by deCIG or deECA. (deECA x y1 : : : yn ) is just a
macro for (deCIG x (t y1 : : : yn)). The abstract syntax of (CIG dec1 ) of 3.2
is as follows:(deCIG

fxx : Cg (in D)e 1;1 : : : 1;q1 ):::(en n;1 : : : n;qn )):( 1

The class notation C may be a class identi er or an expression of the form (f ~x),where f is a class identi er and ~x is a sequence of total variables. In the former
case, the declaration is a class constant declaration, which declares the class identi er as a class constant, and in the latter it is a class function declaration, which
declares the class identi er as a function. The axiom maintaining C is the minimal
xed point is available by (axiom 'C). The axiom maintains C is a class is available by the function axiom?. When one declares C by CIG, (axiom? '{CL C})
will return a proof of CL C. The following are some actual uses of these functions:1.(deCIG {x : (Tree X)}; Declare the class of binary trees.
((atom x) {x : (Tree X)})(t {(car x) : (Tree X)} {(cdr x) :(Tree X)}))(Tree X)
2.axiom Tree
; The axiom (CIG def) for (Tree X).
{]- (COND ((atom x) x : (Tree X))(t (car x) : (Tree X) & (cdr x) : (Tree X)))<-> x : (Tree X)}
3.axiom? {CL (Tree X)}; (Tree X) is a class.
{]- CL (Tree X)}
4.(deCIG; Simultaneous de nition of Even and Odd.
({x : Even} (in N) ((equal x 0) {TRUE})(t {(sub1 x) : Odd}))({x : Odd} (in N) ((equal x 0) {TRUE})(t {(sub1 x) : Even})))(Even Odd)
9.axiom Even
; The axiom (CIG def) for Even.
{]- x : N &(COND ((equal x 0) TRUE) (t (sub1 x) : Odd)) <-> x : Even}Chapter 7

151

10.axiom Odd; The axiom (CIG def) for Odd.
{]- x : N &(COND ((equal x 0) TRUE) (t (sub1 x) : Even)) <-> x :Odd}

The function implementing the inference of (CIG ind) is cigIND. The following is a part of an actual session which created a hypothetical proof of (B4) of
4.3.2.1. It also illustrates a use of sfload.
Programs create hypothetical proofs of (B1) and (B2) of 4.3.2.1 and assign
them to BASIS and STEP are in a le named divitr.px, whose rst lines are as
follows:; These are proofs of (B1) and (B2) of 4.3.2.1.
(deCIG {a : (DD b)} (in N)((lessp a b) {TRUE}) (t {(diff a b) :(sfsetq Goal'{(EX q r :(DD b)}))N) (a = (plus (times b q) r) & (lessp r b) :(deprf BASIS(exI Goal(deprf Lemma1

T)})

..
.

So rst we sfload them and create a proof of (B4) by the CIG induction rule
cigIND.
1:sfload divitr; Load the le of the proof.
[loading divitr.px in PX mode]t
2:display-thm BASIS STEP
; Display basis and induction step.
BASIS.
{(EX q r : N) (a = (plus (times b q) r) & (lessp r b) : T)}from[1] {(lessp a b) : T}
[2] {a : N}
[3] {b : N}with 1 hypotheses
STEP.

152

Chapter 7{(EX q r : N) (a = (plus (times b q) r) & (lessp r b) : T)}from[1] {(EX q r : N)((diff a b) = (plus (times b q) r) & (lessp r b) : T)}[2] {(lessp a b) = nil}[3] {a : N}
[4] {b : N}with 1 hypothesest
3:(cigIND '{a : (DD b)} BASIS STEP}); Apply CIG induction of DD.
{*..]- (EX q r : N) (a = (plus (times b q) r) & (lessp r b) : T)}
4:display-thm it
it.
{(EX q r : N) (a = (plus (times b q) r) & (lessp r b) : T)}from[1] {a : (DD b)}[2] {b : N}with 2 hypothesest

The function deDP declares a user de ned predicate. A predicate identi er
must be a symbol whose rst character is \*" and whose second character is anupper case letter. For example, invoking the command (deDP *A (x y) {y =x}), *A(0 1) is a formula which is equivalent to 1 = 0. There are two rules
for predicate declaration. dpI does folding and dpE does unfolding of de ned
predicate for the conclusion of a proof. The variable list of the declaration must
contain all of the free variables of the de nition body.
The function deGP declares a predicate variable. Such a variable is called ageneric predicate variable and is always free, i.e., we do not have quanti ers overgeneric predicate variables. A generic predicate variable is a symbol whose rst
character is \^" and whose second is an upper case letter. For example, invoking(deGP ^A 2 3), ^A is declared as a predicate variable whose rank is 3 and arity
is 2. Since the extraction algorithm needs rank information for any formula, sucha declaration of rank is necessary. A rule for generic predicate variables is theinstantiation rule gpE, which substitute any formula with the same rank to a
generic predicate.

Chapter 7

153

Lisp is the metalanguage for PX. To de ne a new function by Lisp, a function
This is the same as ordinary defun of Franz Lisp except(i) the function name must not be in use by another function or macro, although
one may rede ne a function declared by sfdefun, (ii) the de nition body must bea legal PX command. This restriction ensures that such a function declaration
does not cause PX to crash. Similarly, sfdefmacro is a counterpart of defmacro.
The value assignment is done by sfsetq, which is a safe version of setq.
sfdefun is available.

7.3. Extractor

The implemented extraction algorithm (extractor) is more or less the same as
the algorithm presented in 3.2. The name of the extraction algorithm in PX is
Extract. When it applied to a proof with partial variables, then it fails. The
function is more or less an implementation of the method described in chapter 3.
But it di ers from the algorithm of chapter 3 in the following respects:
1. The elimination of partial variables (lemma 3, 3.1) is not done. The extractor
applies the algorithm of 3.2 to a given proof and substitutes constants forpartial variables in the extracted program. This procedure is correct, forthe result is identical to the program extracted from the proof whose partial
variables are deleted by the method of lemma 3 of 3.1.
2. The extractor employs a trick by which unnecessary usage of stacks by functions created by CIG recursion is avoided.
The following shows an example of extraction of program from a proof having apartial variable.
6.prf1{]- E (cond (t 1) (t ?1))}7.(exI (quote {(EX x) (E x)}) it){]- (EX x) (E x)}
8.(Extract it); Extract the code.
(cond (t 1) (t dummy1))

The following example is a program extraction from the proof shown in asession example in 7.2.6.
5:(Extract (vl 3)) ; Extract a program from the proof of event 3.
Function definitions are as follows:(defrec <DD-0> (a) (b)(cond ((lessp a b) (list 0 a))(t(let! (((@1:1 @1:2) (<DD-0> (diff a b) b)))(list (add1 @1:1) @1:2)))))

154

Chapter 7

The extracted realizer is(<DD-0> a b)

The function <DD-0> with two arguments a, b is de ned by CIG recursion extracted from the CIG inductive de nition of DD, so it is certain that the valueof b is constant in the course of computation of (<DD-0> a b). When the function <DD-0> is declared by defrec as above, it can be executed without consuming
stacks by pushing either the name or values of b. The declaration (defrec <DD-0>(a) (b) : : :) is the same as the declaration (deFUN <DD-0> (a b) : : :) for the
proof checker. This di erence a ects only the evaluation of the functions. Users
are not allowed to use defrec; it is used by the extractor exclusively.
The extracted codes can be run by the PX evaluator, and they may also be
executed by Franz Lisp. What's more, they may be compiled by the Franz Lisp
compiler. The function export-for-lisp makes a le including all functions of
the present theory. If a le name is an argument of the function, then the function
creates a le of the name with an extension .l. The le can be compiled by theFranz Lisp compiler. But there is a defect: the codes are not consistent with thestandard semantics, for -expressions are compiled. But the compiled functions
are consistent with the theory of PX. When export-for-lisp has an optional
argument not-trick, it does not do this.

7.4. EKL translator
As mentioned in 7.1, hypotheses may be proved in any other logical system whenever they are sound with in the semantics of PX. We present a way to have anotherproof checker prove hypotheses. We adopt EKL as our target system. EKL is ainteractive proof checker developed by Ketonen and Weening 1984, based on ahigher order typed language and a term-rewriting system. In EKL formulas areterms of the type of truth values, which is denoted by truthval. A term of thetype truthval is proved when it is rewritten to a constant true, so that logicalinference can be done by term-rewriting. In typical cases, one can prove a conjecture that is an implication by rewriting its conclusion to true step by step,using axioms and its assumption as rewriting rules. One can use also a decision
procedure that decides provability of conjectures in a restricted logical system.
This procedure is not complete with respect to the complete logical system of
EKL, but always terminates. The term-rewriter employed in EKL is so powerfulthat one can prove conjectures very naturally.

Chapter 7155

7.4.1. Interpreting LPT of PX in typed language of EKL

To prove hypotheses in EKL, we must translate them and the axiom system of
PX into EKL. Since EKL is based on typed language, expression, functions, andformulas of PX must be translated into terms of appropriate types. EKL has
a type named ground representing the type of the lowest level objects. We use
it as the type that every expression of PX has after the translation. That is,
all expressions are translated into terms whose types are ground. Functions of
PX must be translated into terms that have the appropriate types according totheir arities. For example, equal has the type (ground ground)!ground, where\ " and \!" are EKL primitives that mean the product type and the typeof function space, respectively. Some functions of PX, e.g., list, have in nite
numbers of possible arities. EKL has a post x type operator \*" of the union ofarbitrary nite products of a given type. So the type of list can be represented
as ground!ground. Formulas are translated into terms which have the type
truthval mentioned above.
PX is based on LPT. On the other hand, EKL is based on the usual logic of
total terms. So we must translate partial terms into the total terms of EKL. We
use the notion sort of EKL to realize this. Conceptually, a sort is considered asa predicate over a type, and each variable or constant may have a sort among its
attributes. The predicate is considered to be true for any variable or any constantof the sort. We introduce a sort e, which corresponds to E of PX, and a constantbottom, which has the type ground and represents the \unde ned value" of PX.
The constant bottom does not have the sort e. We consider a total expression,i.e., an expression that has a value, of PX as an expression that has the sort e andothers , i.e., expressions that have no value, as expressions whose value is bottom.
The ordinary equality = of the EKL logic of total terms turns out to be Kleene's
equality = of PX. Thus LPT of PX can be translated into the typed language of
EKL.

7.4.2. Translating expressions and functions
Each constant and variable of PX is translated into a constant and variable ofthe type ground. In EKL, one must declare every constant and every variable
before he or she uses them. Constants and total variables are declared with thesort e besides its type ground. Class variables and class constants are declaredwith the sort cl, which corresponds to Class of PX. A total variable (constant)of EKL is a variable (constant) with the sort e or cl, and a partial variable of
EKL is a variable without any sorts. An axiom is included to guarantee that an
expression which has the sort cl has the sort e. So an expression with the sort cl
is a total expression. The actual system of EKL is case insensitive, i.e., it neglects
the cases of letters, and it does not permit names of identi ers to include some

156

Chapter 7

special characters such as \*". But PX is case sensitive and permits such special
characters among atoms. So we must arrange these to be legal names, distinct
from each other. We adopt the method of removing special characters from themand inserting \ " immediately before each uppercase letter. If some names arestill identical, we add suxes such as \ 1" to distinguish them. For example,
atm, Atm and Atm are converted into atm, atm and atm 1 respectively. The
following are examples of declarations.
(decl (px py pz) (type ground))(decl (x y z) (type ground) (sort e))(decl (atm) (syntype constant) (type ground) (sort cl));where (syntype constant) means that the identi ers are used as constants. The
variables px, py, pz are partial variables, the variables x, y, z are total variables,
and the constant atm is a total constant. Tuples such as [e1 ; : : : ; en] are treatedas (e1 ; : : : ; en) in EKL, which has type ground : : : ground. EKL identi es (e)with e as PX does.
To translate -expressions into EKL, we introduce a notion called -frame.
A -frame is a context such as (x1 = ; : : : ; xn = )(fn) with \holes" denotedby 's. At rst, a constant cf whose type is groundn !ground is generated foreach -frame f by the following axiom

8x : : : xn args:
1

cf (x1 ; : : : ;xn )) ^ apply(cf (x1 ; : : : ;xn ); list(args)) =fn(args);
where the variables x1 ; : : : ; xn have the sort e, and args is declared to have thetype ?cf . In EKL, type identi ers beginning with \?" means variable types.
e(

A variable type denotes an implicit type, which is automatically assigned to an
appropriate type in the context where the variable type occurs. For example, it isground ground if fn is equal. Note that a variable type is not a polymorphic typevariable. All occurrences of the variable type represent an identical type througha proof in EKL. In this setting, each -closure (x1 = e1 ; : : : ; xn = en )(fn) is
translated to the term cf (e1 ; : : : ;en ), where cf is the constant corresponding tothe -frame (x1 = ; : : : ; xn = )(fn).
We treat quote the same as . We generate one constant corresponding toeach atomic expression. We use \`" to generate the constant. \`" is an EKLprimitive, which generates a constant `a denoting the symbol a itself. If a and b
are distinct symbols, EKL automatically regards : `a=`b as a predeclared axiom.
When the quoted expression is not atomic, we expand it using pair and list. For
example, quote((a b c)) and quote((a : b)) are converted into list(`a; `b; `c) andpair(`a; `b), respectively.

Chapter 7

157

EKL has no primitives corresponding to the let-quanti er; we must represent
this by other EKL primitives. We illustrate this by an example.

let (x y) = a; (x 0) = b in e)

assert(cddr(a) = nil^ car(b) = car(a) ^ cadr(b) = 0 ^ cddr(b) = nil;(x y: e)(car(a); cadr(a)));where assert is a constant of the type (truthval ground)!ground with theaxiom
8px: assert(true; px) = px ^ :e(assert(false; px));
where the variable px is a partial variable declared as above.
Each function constant is translated into a constant of functional types. For
example, we declare equal of PX with type (ground ground)!ground.
We translate PX's cond into EKL's constant cond of the type(ground ground)!ground:
The inference rules for it is translated into the following axiom:

8x px clauses:

cond() = nil^ cond((nil; px); clauses) = cond(clauses)^ (:x = nil  cond((x; px); clauses) = px);
where the variable clauses, x, and px have type (ground ground), ground, andground respectively, and x has the sort e.
EKL supports -expressions, so functions represented by -expressions in PX
are straightforwardly representable in EKL. For example, (x; y)(x) is translated
into x y: y. Whenever EKL executes -conversion, it checks the sort conditionsof the arguments. Since x and y have the sort e, (x y: y)(e1; e2 ) is not rewritten
into e2 unless e(e1 ) ^ e(e2 ) holds. This guarantees that -conversion performed
by EKL on translated -expressions is the call-by-value -conversion. We have to
add the following axiom for each natural number n to prove that -reduction for
the translated -expressions is call-by-value:

8fn x : : : xn px : : : pxn :11

x1 : : : xn : fn (x1 ; : : : ;xn ))(px1 ; : : : ;pxn ))  e(px1 ) ^ : : : ^ e(pxn );where the types of fn , xi and pxi are groundn !ground, ground and ground,respectively, and fn and pxi are partial variable and xi is a total variable of EKL.
e((

158

Chapter 7

This is consistent with the intended semantics of -expression in EKL describedin Ketonen and Weening 1983. It does not specify the value of the expression(x1 ; : : : ; xn :e)(e1 ; : : : ; en ) when one of the values of e1 ; : : : ; en does not satisfy
the sort of the corresponding variable of x1 ; : : : ; xn . So we may regard its value as
bottom, and then the above axiom is satis ed. Since fn is a partial variable, we
may instantiate it by an expression of the form x1 ; : : : ; xn :e whenever the typeof the term e is ground and the partial variables px1 ; : : : ; pxn may be instantiatedby any expressions e1 ; : : : ; en of the type ground. Then by the aid of -reductionin EKL, it turns out to be the axiom

x1 : : : xn : e)(e1; : : : ;en ))  e(e1 ) ^ : : : ^ (en ):e((

Application of a function to an expression is denoted as in the concrete
syntax of PX. This ends the explanation of how expressions and functions of PX
are translated into EKL. We summarize the translations in the table

PX

app; app
pair; fst; snd; list
atom; equal
suc; prd
0 ; t ; nil; V; N; Atm; T
quote( )f (e1; : : : ; en )cond(e1 ; d1 ; : : : ; en ; dn )(x1 ; : : : ; xn )(e)(x1 = e1 ; : : : ; xn = en )(e)let p1 = e1 ; : : : ; pn = en in e

7.4.3. Translating formulas

EKL;

apply funcall
cons car cdr list
atom equal
add1 sub1
t nil v
n
atm
t

;

0

; ;

;

;
;
;

;

;

;

;

See above:f (e1 ; : : : ; en)cond((e1 ; d1 ); : : : ; (en ; dn ))x1 : : : xn : e
cf (e1 ; : : : ; en)
See above:

Each formula is translated into a term which has the type truthval as mentioned above. Propositional constant > and ? are translated into true andfalse respectively, which are both primitives of EKL. The predicate E , Class,and \:" are translated to have type ground!truthval, ground!truthval and(ground ground)!truthval, respectively. We denote them e, cl, and \::",
respectively. Predicate \=" of PX is translated into \=" of EKL. Every propositional connective and quanti er is translated straightforwardly, except }, !,Chapter 7

159

and the r-quanti er. The modal operator } is removed, for } stands for double
negation and EKL follows classical logic.
One possible way of translating ! is to represent it by means of the otherlogical symbols as described in 2.3.4. But we introduce a constant condfml of
the type (ground truthval)!truthval. Note that cond is the conditional for
expressions and condfml is the conditional for formulas. We translate the axioms
concerning it into EKL as follows:

8x prop pclauses::condfml()^ condfml((nil; prop); pclauses)  cond(pclauses)^ (:x = nil  condfml((x; prop); pclauses)  prop);
where x, prop and pclauses are declared with type ground, truthval, and(ground truthval), respectively, and x has the sort e.
The quanti er r is representable using the existential or universal quanti er
as in 2.3.4. But, making e ective use of the term-rewriting power of EKL, we
instead treat it like the let-quanti er, as follows:r(x y) = a; (x 0) = b: F
) cddr(a) = nil ^ car(b) = car(a) ^ cadr(b) = 0 ^ cddr(b) = nil^ (x y: F )(car(a); cadr(a)):
Note that x and y must be total variables, i.e., they must have been declared tohave the sort e. To justify this translation, we must add the following axiom asin the case of call-by-value -expression.

8phin x : : : xn px : : : pxn :11(x1 : : : xn : phin (x1 ; : : : ; xn ))(px1 ; : : : ; pxn )  e(px1 ) ^ : : : ^ e(pxn );where phin is declared to have type groundn !truthval and any other variables
are the same as the case of call-by-value -expressions.
Sorts provide a simple method of relativizing quanti cations. For example,
suppose that variables x and y are declared to have the sorts S and the universal
sort (i.e., the sort y: true), respectively. Then 8x: P(x) means 8y: S(y)  P(y).
Such a relativization is also available for 9. The totalness condition of (8E ) and(9I ) in PX are represented as conditions concerning sort in EKL. This is not
only syntactically simple, but also good for preserving the term-rewriting powerof EKL. Translation of formulas is summarized in table 2.

160

Chapter 7

Table 2PX>; ?

[e1 ; : : : ; en ] : ee1 = e2E ( e)Class(e)F1 ^ : : : ^ Fn
F1 _ : : : _ Fn
F1  F2
F1  F2:F
}F
e1 ! F1 ; : : : ; en ! Fn
rp1 = e1 ; : : : ; pn = en :F
8[x1 ; : : : ; xl ] : e1 ; : : : ; [y1 ; : : : ; ym ] : en :F
9[x1 ; : : : ; xl ] : e1 ; : : : ; [y1 ; : : : ; ym ] : en :F

EKL
true, false(e1 ; : : : ; en )::e
e1 =e2e(e)cl(e)
F1 ^ : : : ^ Fn
F1 _ : : : _ Fn
F1  F2
F1  F2:F
F
condfml((e1 ; F1 ); : : : ; (en ; Fn ))See above:
8x1 : : : xl : : : y1 : : : ym :(x1 ; : : : ; xl )::e1 ^ : : : ^ (y1 ; : : : ; ym )::en  F
9x1 : : : xl : : : y1 : : : ym :(x1 ; : : : ; xl )::e1 ^ : : : ^ (y1 ; : : : ; ym )::en ^ F

7.4.4. Translating axiom system

Now we explain how the axiom system of PX is translated into EKL. The almost
all axioms and inference rules of PX need not be translated into EKL, because
EKL has a set of usual axioms for higher order logic.
We generate one declaration and three axioms for each CIG inductive de nition. We declare the de ned symbol to have the type appropriate to the numberof its parameters. The rst axiom indicates that the de ned symbol has thesort cl and the second indicates that the class is a xed point of the de ning
equation. The last one is the schema of the CIG induction. The following is
the example of the case of List in 2.4.1. At rst, List is declared with typeground!ground. Suppose that a, x and phi are declared to have type ground,ground and (ground ground)!truthval, respectively and a has the sort cl.

8 a: cl( list( a))8 a x:
x : list( a) condfml((atom(x); x = nil); (t; fst(x) : a ^ snd(x) : list( a)))Chapter 7161

8phi a:(8x: (condfml((atom(x); x = nil);(t; fst(x) : a ^ snd(x) : list( a) ^ phi(snd(x)))) phi(x))
 (8x: x : list( a)  phi(x));
where condfml is the constant corresponding to ! and list corresponds to List.
Each function or individual constant de ned by a user of PX is declaredwith an appropriate type and the axiom indicating that the function or theconstant is a xed point of the equation given in the de nition. Axioms forthe modal operator } are not necessary, since it is removed when formulas aretranslated. The totality and strictness properties of functions are represented assorts. For example, we declare predicate constants total2 and strict2 with type((ground ground)!ground)!truthval, then we declare total and strict functions with two arguments such as equal to have the sorts total2 and strict2,
adding the axioms

8tf x y: e(tf(x; y))8sf px py: e(sf(px; py))  e(px) ^ e(py);where tf, sf, x and y have the sort total2, strict2, e and e, respectively, and px
and py have the universal sort. The axioms for quoted constants are automaticallyobtained by the EKL system, for we adopt the method presented in 7.4.2.

7.4.5. How to call EKL from PX

The following illustrates how to call EKL from PX.
1:

eklI {x = z} {x = y} {y = z}

Sending hypothesis.
>Wait.
127.

(show hyp hyp c);labels:124.

PRF HYP C(DEFAX HYP C |HYP C(X,Z) IFF X = Z|);labels:

PRF HYP

126.

(DEFAX HYP |HYP IFF (X = Y&Y = Z IMP HYP C(X,Z))|)

128.

(trw hyp (open hyp hyp c))

162

Chapter 7

;HYP
129.

(qed)

;Please type Control-D
Bye.
{..]- x = z}

We call EKL by the function eklI. To prove a hypothesis fF1 ; : : : ; Fn g ) F ,we invoke a command (eklI F F1 : : : Fn ). Then the EKL translator translates
the hypothesis, calls EKL, and sends the necessary stu to EKL. The rst line
above is a line of PX and the command on it invokes EKL. The lines 127 to 129
are lines of EKL. The command in line 127 displays the hypothesis labeled as
hyp and its conclusion labeled as hyp c. Since the conclusion of the hypothesis
has two free variables x, y, it is hyp c(x,y) instead of hyp c. The command of
the line 127 proves the hypothesis, and the command (qed) of line 129 checks if
the hypothesis is proved. To exit from EKL, we type in Control-D. EKL returns
a signal of the completion of the proof to PX and eklI makes a proof of the
hypothesis as the result of the command of the line 1 of PX. When you exit fromEKL without completing the proof, then EKL returns a signal indicating failureof the proof and eklI fails.

8 Conclusion
8.1. What was done?

The possibility of program extraction has been widely known in constructive mathematics and computer science as the \proofs as programs" principle. In spite ofsome interesting work, it has not been made so clear how feasible programs are
gotten from constructive proofs. When it came to the eciency of produced programs, many people were pessimistic. We built a computer system which suggeststhat there is hope to write ecient realistic programs by constructive proofs. Using a new viewpoint to the induction principle and the termination problem, we
presented a general method to extract ecient Lisp programs.
We presented a type free logical system which serves as a foundation for
the rigorous development of functional programs. The exibility of the type free
approach was shown through program extraction and interpretation of types.
Apart from the theoretical aspects, we presented a proof checker with anextensible set of inference macros which resembles natural language, and can be
printed by TEX.

8.2. What is missed? What should be done?

We proved that all recursive functions can be extracted from PX by adding all true
rank 0 formulas. But this can be done only for rst order functions. It is unclear
to what extent higher order functions can be extracted from constructive proofs.
Extraction of ecient higher order programs and satisfactory characterization ofhigher order programs remain unsolved. Diculty of characterization of higher
order programs re ects in the result in 2.4.3. This is one of the most interesting
subjects in theoretical studies in our direction.
The interactive interface of PX is still in a very primitive stage, when it iscompared to Nuprl. It seems that there is no theoretical diculty in adding tacticlike features to PX. But it will take great e ort. Although tactic-like features andNuprl-like interface help proof development to a great extent, it deos not useful topresent completed proofs to the others. Our inference macros and TEX translator
will help. But there is no logical relationship internal proofs in PX and proofs
in TEX. Something which bridges them is expected. It would be useful to build acomputerized textbook of mathematics.
The optimizers used in the extraction algorithm are still not satisfactory,
although they work well in most cases. There is a theoretical drawback to opti-

164

mizations of codes in the type free approach (see appendix C). This needs further
study. Aside from this drawback, further optimizations will be possible by using
information contained in source proofs. For example, an extractor can decide
types of expressions in extracted programs, looking up source proofs. This will
enable the extractor to add type declarations for optimizations. It is expected toincrease eciency of compiled codes to a great extent.
The treatment of function closure (-expression) is not quite elegant. Thisis mainly because that we obey syntax and semantics of Lisp. It made us use
functional argument with free variables and intensional equality in comparing
functions. This could be solved by replacing Lisp by a more idealistic language,e.g., CAM (Cousineau, Curien, and Mauny 1985), and/or the introduction of aclass of function values and extensional equality between functions. Then decidability of equality cannot be retained. But, this is not serious as T0 does not haveit. The reason why we included the decidability is that we intended the universe
V as the domain of Lisp.

A

Comparison of px-realizability and other interpretations

There are many possible ways to extract the computational content of a constructive proof. In this appendix, we compare them with px-realizability. The interpretations we examine are r-realizability, q-realizability, Grayson's g-realizabilityGodel interpretation, modi ed realizability, and the normalization method.
Ordinary realizability, which we refers to as r-realizability, is more transparent than px-realizability as a foundation of \formulas as types". Its defect isthat the double negation shift (the axiom (}2)), from which proposition 3 of 2.3.5
follows, does not hold in the interpretation. Furthermore, even if f is a realizer of
8x:9y:A, it does not guarantee that 8x:ry = f (x):A holds classically. For example, Church's axiom (see Troelstra 1973) is realized by the interpretation, but it
does not hold classically. This con icts with our point of view that a speci cation
is given by the 89-formula under the interpretation of ordinary logic.
Grayson's realizability, which we refer to as g-realizability, is one of motivations of px-realizability. It is given by modifying clause 1 of de nition 1 of 3.1 of
px-realizability as follows:
1. A is an atomic formula. Then a x A is A.
It is a variant of q-realizability and is essentially the semantics of the \logicalspace" obtained by gluing (in the sense of Artin) the logical space obtainedby r-realizability and the logical space of sets and functions (Johnstone 1977).
Grayson's realizability is not equivalent to traditional q-realizability; e.g.,:8x(9y:T (x; x; y) _ :9y:T (x; x; y))is q-realized but not g-realized. The relation between q-realizability and grealizability is that a g-realizes A i a q-realizes A and A holds. (The relationof the realizability in Hayashi 1983 and px-realizability is the same.) When weallow only valid sequents, these q-realizability and g-realizability are essentiallythe same.
For a rank 0 formula A, if A holds, then A is q-realizable. Hence A holds i A
is g-realizable for any rank 0 formula A. This also holds for px-realizability. The
only di erence between px-realizability and g-realizability is the di erence of realizers of rank 0 formulas. Realizers of rank 0 formulas are deliberately restricted
to nil in px-realizability. This accords with the fact that the type I (A; x; y)166Appendix Aof Martin-Lof's type theory has at most one element. This also leads the simpli cation of types represented by formulas in re ned px-realizability such asx(A  B) = x(B) for the rank 0 formula A. The favorable aspect of g-realizability
and px-realizability is that whenever a formula is realizable, then it holds classically. This does not hold for q-realizability, e.g., Church's axiom holds underit.
It is noteworthy that the realization of a formula whose is not rank 0 cannot
be rank 0 in g-realizability and px-realizability. On the other hand, all realization
formulas of the traditional realizabilities are rank 0. The property \if A is realizable, then A holds" contradicts to the property \realizations are rank 0 formulas".
Traditional realizabilities include the latter property, while we include the former.
Modi ed realizability is known as a \typed realizability. But usage of type
is not the essential di erence from the other realizability. The di erence is theinterpretation of implication. If A is a rank 0 formula in our sense, then theinterpretation of A  B in modi ed realizability isa mr A  B  A  a mr B:
Since A does not have any computational information, a realizer for A is notnecessary for the computation of a realizer of B . This appears to be better thanour realizability; but the above modi cation of the interpretation of implication
contradicts LPT. For example, the following is a theorem of LPT, but it is notrealized by modi ed realizability:

E (e)  9x:(e = x):If e1 is a realizer of this, then e1 should have a value, and whenever E (e) holds
it must coincide the value of e. Let T be Kleene's T -predicate (Kleene 1953).
If we take y:T (x; x; y) as e, then the existence of such e1 for e contradicts theundecidability of the termination problem. If all terms have value, such a diculty
does not appear. In the usual typed logical theories, all terms have value. Thisis the reason why modi ed realizability ts typed theories rather than untyped
theories like PX. Since programs need not have values, it seems that ordinary
realizability is more appropriate as a program extraction method than modi ed
realizability. Modi ed realizability is not appropriate as an extraction method for
PX, which is based on the logic of partial terms.
Note that the above argument depends on the assumption that a realizer is avalue or an expression whose computation terminates. We think this assumption
is fair. Even if it were possible to de ne a realizability so that a realizer need nothave a value, there would be no guarantee that f (x) terminates on arbitrary input
x, for a realizer f of 8x:9y:A. One might insist that f (x) has a value, thinking

Appendix A

167

nontermination as a value as in models of -calculus or in the logic of partial
existence. But when y is intended to be a concrete datum like an integer, such anargument seems to be unacceptable.
The interpretation that was rst used to extract programs from proofs is theGodel interpretation (Goto 1979, 1979a, Sato 1979). But it is not quite adequate
as a tool for program extraction. The interpretation of the implication is rather
intricate, and the form of the interpretation is 9~x8~y:A, where A does not contain quanti ers. So it is hard to arrive at the interpretation of a formula withcomplicated implication and quanti ers, as was pointed out by Goto 1979a. Thisimplies that it is dicult to represent an intended speci cation by a formula. On
the other hand, it is easy to write an intended speci cation by a formula througha realizability as we saw in chapter 4.
Beeson 1978 pointed out that the Godel interpretation ts neither in thenatural deduction nor the logic of partial terms. The most dicult logical rule
to verify in the Godel interpretation is A  A ^ A or A  B; A  C=A  B ^ C(see Beeson 1978, Troelstra 1973). This is \sharing of an assumption by di erent
proofs" and corresponds to \sharing of an input by di erent programs". Such asituation quite often appears in natural deduction proofs and programming. Let
9uF 8vF :FD be the Godel interpretation of F . (In the original Godel interpretation, uF and vF are sequents of variables, but for simplicity we think they are
single variables of appropriate Cartesian types.) Then the Godel interpretation ofa sequent fAg ) B would befAD (uA ; vA (uA ; vB ))g ) BD (uB (uA ); vB ):A term hvA ; uB i satis es this interpretation if this sequent holds. Let hv1A ; uB1 iand hv2A ; uB2 i be terms satisfying the upper sequents of the rule

fAg ) B1 fAg ) B2 :fAg ) B1 ^ B2
Although both v1A and v2A give the existential information of A in the sequent,
they may di er. For example, if A is a universal formula and is instantiated by
two di erent terms to derive B1 and B2 , then they di er. Let us denote B1 ^ B2
by C . Then vC is normally

 A
C
C
A A
C
C
1 (v ); pr2 (v )) :AD (u ; v2 (pr1 (v ); pr2 (v )))vC (uA ; vA (uA ; vC )) = vv2A ((prCC
1 pr1 (v ); pr2 (v )) otherwise

For any inference rules that have more than one upper sequent, we have to do thesame thing. Since many inference rules of natural deduction have more than one

168

Appendix A

upper sequent, this complicates the interpretation of natural deduction. Furthermore, Beeson pointed out that the quanti er-free formula AD must be decidable
in order to carry out the above de nition, but quanti er-free formulas of LPT
may not be decidable. Beeson 1978 used a Diller-Nahm variant of the Godel interpretation for T0 . His interpretation of the implication is also complicated, andthe problem of \sharing of assumption" still remains. The Godel interpretationis therefore not suitable for program extraction, especially not for \programming
via proofs". Recent researches in liner logic show that the Godel interpretation issuitable to linear logic. Linear logic is a logic without the sharing of assumptions.
Liner logic and the Godel interpretation might be useful for program extractionof programs for which sharing of variables is dangerous, e.g., programming withmany processes.
The normalization method is not exactly program extraction, for a proof itself
is executed. But when -terms like codes are extracted from proofs as was doneby Goad 1980, we may regard it as program extraction for which the executionof extracted codes is done by -reduction. Then, as was pointed out by Goad
1980, the extraction method is almost the same as modi ed realizability. The
advantage is that logical information kept by proofs may be used as optimization ofcomputation, as was also shown by Goad. The disadvantage is that the execution
method is xed. It would be possible to \compile" extracted codes to otheralgorithmic languages. In a sense, our realizability method is one of such possible
compilation methods. On the other hand, it would be possible to compile proofs
through the realizability to codes of an appropriate language so that the compiled
codes keep the logical information of the source proofs to do optimizations as
was done by the proof interpreter of Goad 1980. It seems the relation between
the realizability and normalization methods is similar to the relation between acompiler and interpreter. So it is dicult to say which is better.

B

Extraction of a tautology checker of propositional logic

In this appendix, we give an example of programming via proofs with PX. We dene a formal system PL of propositional logic and prove its completeness theorem.
From the proof of the completeness theorem, we extract a program that returns
a proof of a given sequent, when it is provable, and returns a refutation, i.e., avaluation under which the sequent is false, when it is not provable. The algorithm
adopted by the program is the Wang algorithm, i.e., the algorithm of the programof McCarthy 1965, VIII. Boyer and Moore 1979 have veri ed a tautology checkerof propositional logic. Their program checks if a formula is a tautology, but does
not return a proof. Shankar 1985 has veri ed essentially the same theorem as
ours by means of Boyer-Moore theorem prover. But the algorithms employed arecompletely di erent from ours.
We give an informal description of the system of PL before giving its formal
development. PL has only one logical connective, implication \", and one propositional constant, falsehood \?". A formula of PL is constructed by these frompropositional variables. PL is a sequent calculus. A sequent is a form g1 ) g2,
where g1 and g2 are lists of formula. The inference rules of PL are(falsehood) g1 ) g2 (g1 contains ?)(intersect) g1 ) g2 (g1 and g2 have a common element)

g2(permutation) gg1 )) g (g3 and g4 are permutations of g1 and g2 )3

4

: g1 ) ) (B : g2 )(impI) (gA )(A  B : g )1

2: g1 ) ) g2
(impE) g1 )((AA: gB2 ): g(B) )g1

2

A valuation are a function from propositional variables to Boolean values. A
refutation of sequent g1 ) g2 is a valuation such that all formulas of g1 are true
and all formulas of g2 are false under it. What we have proved with PX is thatfor each sequent, its proof exists or its refutation exists.
Next we explain how we represented PL in PX. Propositional variables are
represented by atoms, except nil. nil represents ?. A formula A  B is represented by a list (A B ). A sequent g1 ) g2 is also represented by a list (g1 g2 ). A
proof represented by a list such that the rst element is the name of the last inference rule, the second element is the lower sequent of the rule, and the remaining

170

Appendix B

elements are the immediate subproofs. Truth values are represented by t and nil.
A valuation is a function closure whose range is ft; nilg such that nil is mappedto nil.
The formal development of these representation is; x is supposed to be a list
(deFUN existNonAtom (x)(cond ((null x) nil)((atom (car x)) (existNonAtom (cdr x)))(t t))); Assume x contains a non-atom.
; Then this returns a triple (a b c) s.t. a*<b>*c=x and; a is a list of atoms, b is a non-atom and c is the rest.
(deFUN divide (x)(cond ((atom (car x))(let! (((a b c) (divide (cdr x))))(list (cons (car x) a) b c)))(t(list nil (car x) (cdr x))))); Formulas of PL. (a b) is interpreted as a -> b
(deCIG {x : Fm}((atom x) {TRUE})(t {(LET ((a b) x)) (a : Fm & b : Fm)})); Lists of formulas(deECA {x : FmL} {x :(List Fm)}); Formula lists containing a non-atomic formula(deECA {x : NonTrivFmL} {x : FmL & (existNonAtom x) :(deECA {x :TrivFmL} {x :FmL & - x :; Function space(deECA {f : (Func X Y)} {(UN x :; Valuation(deECA {v :T})

NonTrivFmL})

X)((funcall f x) :Y)})Val} (in (Func Atm Bool)) {(funcall v nil) = nil}); Truthvalue of x:Fm under the valuation r:Val(deFUN truthfml (x r)(cond ((atom x) (funcall r x))(t (or (not (truthfml (car x) r))(truthfml (cadr x) r))))); All formulas in x:FmL are true under r:Val(deFUN truthand (x r)(cond ((dtpr x) (and (truthfml (car x) r) (truthand (cdr x) r)))(t t))); There is a true formula in x:FmL under r:Val

Appendix B

171(deFUN truthor (x r)(cond ((dtpr x) (or (truthfml (car x) r) (truthor (cdr x) r)))(t nil))); Fetch subproofs(deFUN subprf1 (x) (caddr x))(deFUN subprf2 (x) (cadddr x)); g1 is a permutation of g2(deECA {g1 g2 : Perm}{(UN x)((member x g1) :T <-> (member x g2) :T)}); Definition of proofs of PL.
(deCIG {x : Prf} (in Dp)((equal (car x) 'permutation){(subprf1 x) : Prf &(LET (('permutation (g1 g2) (n (g3 g4) d)) x))(g1 : FmL & g2 : FmL & g3 : FmL & g4 : FmL& g1 g3 : Perm & g2 g4 : Perm)})((equal (car x) 'intersect){(LET ((a b) (cadr x)))(a : FmL & b : FmL &$((EX x)((member x a) :((equal (car x) 'falsehood){(LET ((a b) (cadr x)))(a :T & (member x b) :FmL & b :T)))})

FmL & (member nil a) :((equal (car x) 'impI){(LET ((a b) (cadr x)))((subprf1 x) : Prf &(LET (('impI (g1 ((f1 f2) . g2)) (n ((f1 .
(TRUE))})

g1)(f2 .

g2)) d)) x))((equal (car x) 'impE){(LET ((a b) (cadr x)))((subprf1 x) : Prf& (subprf2 x) : Prf& (LET (('impE (((f1 f2) . c) g2)(n1 (c (f1 . g2)) d1)(n2 ((f2 . c) g2) d2)) x))(TRUE))})); This CIG represents the control structure of the target program.
(deCIG; top level of the program({g1 g2 : Right} (in (Cartesian FmL FmL))((and g2 (existNonAtom g2)) {g1 g2 : PermR})(t {g1 g2 : Left}))

T)})

172

Appendix B; g2 = nil or all elements of g2 are atoms.
({g1 g2 : Left} (in (Cartesian FmL TrivFmL))((and g1 (existNonAtom g1)) {g1 g2 : PermL})(t {TRUE}))({g1 g2 : RuleR} (in (Cartesian FmL FmL))(t {(LET (((a b) . c) g2)) ((cons a g1) (cons b c) :({g1 g2 : RuleL} (in (Cartesian FmL FmL))(t {(LET (((a b) . c) g1))(c (cons a g2) : Right & (cons b c) g2 :Right)}))

Right)}))({g1 g2 : PermR} (in (Cartesian FmL NonTrivFmL))(t {(LET ((a b c) (divide g2)))(g1 (append (list b) c a) : RuleR)}))({g1 g2 : PermL} (in (Cartesian NonTrivFmL FmL))(t {(LET ((a b c) (divide g1)))((append (list b) c a) g2 : RuleL)}))); The conclusion of a proof x(deFUN con (x) (cadr x))

The following are programs which build a proof of the completeness theoremof PL. The proof of the completeness theorem is assigned to the variable Wang.
; User-defined inference macros used in the proof.
(sfdefmacro LEMMA: (name proof)`(progn (deprf ,name ,proof) (display-thm ,name)))(sfdefmacro THEOREM: (name proof)`(progn (deprf ,name ,proof) (display-thm ,name)))(sfdefmacro Under the assumptions arg `(Suppose . ,arg))(sfdefmacro Under the assumption arg `(Suppose . ,arg))(sfdefmacro by apply induction of arg `(Apply induction of .
(sfdefmacro Make assumption arg `(assume . ,arg))(sfdefmacro the left conjunct of (x) (sflist 'conjE x 1))(sfdefmacro the right conjunct of (x) (sflist 'conjE x 2))(LEMMA: Lemma1(We prove (CON){(UN g1 g2 : (List V))($(EX x)((member x g1) : T & (member x g2) : T)+
- (EX x)((member x g1) : T & (member x g2) : T))}
;PROOF,arg))

Appendix B

173(@(Under the assumptions(Asp1) {g1 :(Asp2) {g2 :(List V)}
(List V)}

(We prove(CON1) {$(EX x)((member x g1) : T & (member x g2) : T)+
- (EX x)((member x g1) : T & (member x g2) : T)}(by apply induction of {g1 :;BASE CASE

(List V)} to ;INDUCTION STEP and;INDUCTION STEP
(Suppose(INDHYP1) {(dtpr g1) : T}
(INDHYP2) {(cdr g1) : (List V)}(INDHYP3) {$(EX x)((member x (cdr g1)) :+-(EX x)((member x (cdr g1)) :T & (member x g2) :T)

T & (member x g2) :T)}(We prove CON1 (by cases (A) or (B) of INDHYP3
In the case (A)(We see CON1 (since (obviously{$(EX x)((member x g1) :T & (member x g2) :T)})))In the case (B)(We prove CON1 (by cases (B1) otherwise (B2) of (the fact{(OR (member (car g1) g2) t)})In the case (B1)
(We see CON1 (since (obviously{$(EX x)((member x g1) :T & (member x g2) :T)})))

T & (member x g2) :T)}))))))))In the case (B2)
(We see CON1 (since (obviously{-(EX x)((member x g1) :;BASE CASE
(Suppose

174

Appendix B(INDHYP4) {g1 = nil}
(We see CON1 (since (obviously{-(EX x)((member x g1) :T & (member x g2) :T)})))))))(Hence CON)))); Shorthands(sfdefun Provable fexpr (l)(let (((x y) l))`{(EX p : Prf) (LET ((h1 h2) (con p)))(h1 = ,x & h2 = ,y)}))(sfdefun Refutable fexpr (l)(let (((x y) l))`{(EX r : Val)((truthand ,x r) :(Let CON be `{ (Provable g1 g2) +T & (truthor ,y r) = nil)}))(Refutable g1 g2)}); Proof of Completeness Theorem(LEMMA: Right1 (Make assumption CON))(LEMMA: Right2 (Make assumption CON))(LEMMA: Left1 (Make assumption CON))(LEMMA: Left2(Under the assumptions(INDHYP0) {g1 g2 :(Cartesian FmL TrivFmL)}(INDHYP1) {(and g1 (existNonAtom g1)) = nil}
(We prove CON (by cases (A) otherwise (B) of (the fact{(OR (member nil g1) t)})In the case (A)(We see CON (since (obviously (Provable g1 g2)
regarding (list 'falsehood (list g1 g2) as p))))In the case (B) ; (member nil g1) = nil(@(Obviously {g1 :(List V)})

Appendix B

175(Obviously {g2 : (List V)})(We instantiate g1 and g2 of Lemma1 by g1 and g2)(We prove CON (by cases (B1) or (B2) of the previous fact
In the case (B1)
(We see CON (since (obviously (Provable g1 g2)
regarding (list 'intersection (list g1 g2)) as p)))In the case (B2)
(We see CON (since (obviously (Refutable g1 g2)
regarding(Lambda ((g1 g1)) (lambda (a) (cond ((member a g1) t))))as r))))))))))(LEMMA: RuleR(Suppose(INDHYP0) {g1 g2 :(Cartesian FmL FmL)}(We assume(INDHYP1:1) ((a b) . c) matches g2(INDHYP1:2) g2 exists(INDHYP1:3) {(EX p : Prf)
(LET ((h1 h2) (con p)))(h1 = (cons a g1) & h2 = (cons b c))+(EX r : Val)((truthand (cons a g1) r) : T& (truthor (cons b c) r) = nil)}(We prove CON (by cases (A) or (B) of INDHYP1:3
In the case (A)(Since A (we may assume there exists p1 such that
(A1) {p1 : Prf}
(A2) {(LET ((h1 h2) (con p1)))(h1 = (cons a g1) & h2 = (cons b c))}(We see CON (since (obviously (Provable g1 g2)
regarding (list 'impI (list g1 g2) p1) as p)))))In the case (B)(Since B (we may assume there exists r1 such that

176

Appendix B(B1) {r1 : Val}
(B2) {(truthand (cons a g1) r1) : T& (truthor (cons b c) r1) = nil}(@(Obviously {(truthand g1 r1) :(We see (Refutable g1 g2))
(Hence CON)))))))))

T & (truthor g2 r1) = nil})(LEMMA: RuleL(Suppose(INDHYP0) {g1 g2 :(Cartesian FmL FmL)}(We assume(INDHYP1:1) ((a b) . c) matches g1(INDHYP1:2) g1 exists(INDHYP1:3){(((EX p : Prf)
(LET ((h1 h2) (con p)))(h1 = c & h2 = (cons a g2))+
(EX r : Val)((truthand c r) : T & (truthor (cons a g2) r) = nil))&((EX p : Prf)
(LET ((h1 h2) (con p)))(h1 = (cons b c) & h2 = g2)+(EX r : Val)((truthand (cons b c) r) : T & (truthor g2 r) = nil)))}(We prove CON (by cases (A) or (B) of (the left conjunct of INDHYP1:3)
In the case (A)(We prove CON (by cases (C) or (D) of (the right conjunct of
INDHYP1:3)
In the case (C)(Since A (we may assume there exists p1 such that
(A1) {p1 : Prf}
(A2) {(LET ((h1 h2) (con p1)))(h1 = c & h2 = (cons a g2))}(Since C (we may assume there exists p2 such that
(C1) {p2 : Prf}
(C2) {(LET ((h1 h2) (con p2)))(h1 = (cons b c) & h2 = g2)}

Appendix B

177(We see CON (since (obviously (Provable g1 g2)
regarding (list 'impE (list g1 g2) p1 p2) as p)))))))In the case (D)(Since D (we may assume there exists r1 such that
(D1) {r1 : Val}
(D2) {(truthand (cons b c) r1) :(@(Obviously {(truthand g1 r1) :(We see (Refutable g1 g2))
(Hence CON))))))

T & (truthor g2 r1) = nil}
T & (truthor g2 r1) = nil})

In the case (B)(Since B (we may assume there exists r2 such that
(B1) {r2 : Val}
(B2) {(truthand c r2) :T & (truthor (cons a g2) r2) = nil}(@(Obviously {(truthand g1 r2) : T & (truthor g2 r2) = nil})(We see (Refutable g1 g2) (by B1))
(Hence CON)))))))))(LEMMA: PermR(Suppose(INDHYP0) {g1 g2 :(Cartesian FmL NonTrivFmL)}(We assume(INDHYP1:1) (a b c) matches (divide g2)(INDHYP1:2) (divide g2) exists(INDHYP1:3) {(EX p : Prf)
(LET ((h1 h2) (con p)))(h1 = g1 & h2 = (append (list b) c a))+(EX r : Val)((truthand g1 r) : T& (truthor (append (list b) c a) r) = nil)}(We prove CON (by cases (A) or (B) of INDHYP1:3
In the case (A)(Since A (we may assume there exists p1 such that

178

Appendix B(A1) {p1 : Prf}
(A2) {(LET ((h1 h2) (con p1)))(h1 = g1 & h2 = (append (list b) c a))}(We see CON (since (obviously (Provable g1 g2)
regarding (list 'PermR (list g1 g2) p1) as p)))))In the case (B)(Since B (we may assume there exists r1 such that
(B1) {r1 : Val}
(B2) {(truthand g1 r1) : T& (truthor (append (list b) c a) r1) = nil}(@(Obviously {(truthand g1 r1) : T & (truthor g2 r1) = nil})(We see (Refutable g1 g2) (by B1))
(Hence CON)))))))))(LEMMA: PermL(Under the assumption(INDHYP0) {g1 g2 :(Cartesian NonTrivFmL FmL)}(We assume(INDHYP1:1) (a b c) matches (divide g1)(INDHYP1:2) (divide g1) exists(INDHYP1:3) {(EX p : Prf)
(LET ((h1 h2) (con p)))(h1 = (append (list b) c a) & h2 = g2)+(EX r : Val)((truthand (append (list b) c a) r) : T& (truthor g2 r) = nil)}(We prove CON (by cases (A) or (B) of INDHYP1:3
In the case (A);TeX(Since A (we may assume there exists p1 such that
(A1) {p1 : Prf}
(A2) {(LET ((h1 h2) (con p1)))(h1 = (append (list b) c a) & h2 = g2)}
(We see CON (since (obviously (Provable g1 g2)
regarding (list 'PermL (list g1 g2) p1) as p)))))

Appendix B

179

;TeX

In the case (B)(Since B (we may assume there exists r1 such that
(B1) {r1 : Val}
(B2) {(truthand (append (list b) c a) r1) :& (truthor g2 r1) = nil}T(@
(Obviously {(truthand g1 r1) : T & (truthor g2 r1) = nil})(We see (Refutable g1 g2) (by B1))
(Hence CON)))))))))(LEMMA:

Partial correctness(Apply simultaneous induction on{g1 g2 :{g1 g2 :{g1 g2 :Right} {g1 g2 :RuleR} {g1 g2 :PermR} {g1 g2 :Left}
RuleL}
PermL}

to(the proofs Right1 Right2)(the proofs Left1 Left2)(the proofs RuleR)(the proofs RuleL)(the proofs PermR)(the proofs PermL)))(LEMMA: Termination(Under the assumption (*) {g1 g2 :Seq} (obviously {g1 g2 :Right})))(THEOREM: Completeness theorem(Under the assumption (*) {g1 g2 :Seq}

(We prove CON;PROOF(@(We see {g1 g2 : Right} (by Termination))(By Partial correctness(we see `{g1 g2 : Right -> (Provable g1 g2) +(Hence CON)))))In the abstract syntax, the completeness theorem is(Refutable g1 g2)}))

180

Appendix B

Wang.
{g1 g2 : Seq ->(EX p : Prf) (LET ((h1 h2) (con p))) (h1 = g1 & h2 = g2)+ (EX r : Val) ((truthand g1 r) : T & (truthor g2 r) = nil)}with 27 hypotheses

The extracted program is
Function definitions are as follows:(defrec <PermL-6>(g1 g2)
nil(let! (((@17:1 @17:2)(let! (((a b c) (divide g1)))(<RuleL-4> (append (list b) c a) g2))))(case @17:1(list 1 (list 'PermL (list g1 g2) @17:2))(list 2 @17:2)))))(defrec <PermR-5>(g1 g2)
nil(let! (((@13:1 @13:2)(let! (((a b c) (divide g2)))(<RuleR-3> g1 (append (list b) c a)))))(case @13:1(list 1 (list 'PermR (list g1 g2) @13:2))(list 2 @13:2)))))(defrec <RuleL-4>(g1 g2)
nil(let! (((@7:1 @7:2)(let! ((((a b) . c) g1))
(list (<Right-0> c (cons a g2))(<Right-0> (cons b c) g2)))))(let! (((<disjE-4> <disjE-5>) @7:1))(case <disjE-4>(let! (((<disjE-2> <disjE-3>) @7:2))(case <disjE-2>(list 1(list 'impE(list g1 g2)<disjE-5><disjE-3>))(list 2 <disjE-3>)))(list 2 <disjE-5>))))))(defrec <RuleR-3>(g1 g2)

Appendix B

181

nil
(let!

(((@3:1 @3:2)(let! ((((a b) . c) g2))(<Right-0> (cons a g1) (cons b c)))))(case @3:1
(list 1 (list 'impI (list g1 g2) @3:2))(list 2 @3:2)))))(defrec <Left-1>(g1 g2)nil(cond ((and g1 (existNonAtom g1)) (<PermL-6> g1 g2))(t(cond ((member nil g1)(list 1 (list 'falsehood (list g1 g2))))(t(case (<List-2> g1 g2)(list 1(list 'intersection(list g1 g2)))(list 2
(Lambda ((g1 g1))
(lambda (a)(cond((member a g1) t)))))))))))(defrec <Right-0>(g1 g2)nil(cond ((and g2 (existNonAtom g2)) (<PermR-5> g1 g2))
(t (<Left-1> g1 g2))))(defrec <List-2>
(g1)
(g2)
(cond ((dtpr g1)(case (<List-2> (cdr g1))
1
(cond ((member (car g1) g2) 1) (t 2))))(t 2)))The extracted realizer is(Lambda ((g1 g1) (g2 g2)) (lambda nil (<Right-0> g1 g2)))

As was indicated above, the proof of the completeness theorem has 27 hypotheses. We will illustrate how to prove these in EKL by the following three
examples. The examples displayed below have been taken from transcriptions of

182

Appendix B

actual sessions, but some displays of EKL terms have been edited for typographical reasons.

(Example 1)r(h1 h2) = con(list('falsehood; list(g1; g2)):h1 = g1 ^ h2 = g2:
The translated form of this formula is named HYP in EKL by declaring it
as a propositional constant. Its conclusion is named by a propositional function
HYP C. The lines declaring these are labeled with PRF. We will show them withthe command (show prf) as follows:
140.

(show prf);labels:137.

PRF HYP C(DEFAX HYP C|HYP C(G1,G2) IFF
CDDR(CON(LIST(`FALSEHOOD,LIST(G1,G2)))) = NIL&(LAMBDA H1 H2.H1 = G1&H2 = G2)(CAR(CON(LIST(`FALSEHOOD,LIST(G1,G2)))),CADR(CON(LIST(`FALSEHOOD,LIST(G1,G2)))))|);labels:139.

PRF HYP(DEFAX HYP |HYP IFF HYP C(G1,G2)|)First, we open our target.
140.

(trw hyp (open hyp hyp c));HYP IFF;CDDR(CON(LIST(`FALSEHOOD,LIST(G1,G2)))) = NIL&;(LAMBDA H1 H2.H1 = G1&H2 = G2);(CAR(CON(LIST(`FALSEHOOD,LIST(G1,G2)))),CADR(CON(LIST(`FALSEHOOD,LIST(G1,G2)))))We expand two expressions of the form LIST(: : :). Since one is a subexpression of the other, we must open it twice.
141.

(rw * (open list list));HYP IFF;CDDR(CON(`FALSEHOOD.((G1.(G2.NIL)).NIL))) = NIL&;(LAMBDA H1 H2.H1 = G1&H2 = G2);(CAR(CON(`FALSEHOOD.((G1.(G2.NIL)).NIL))),; CADR(CON(`FALSEHOOD.((G1.(G2.NIL)).NIL))))We expand CON(: : :) by (use CON mode exact). When we take the option(: : : mode exact), EKL apply the rewrite rule to each subexpression exactly once.

Appendix B

183

Otherwise, EKL applies it only if the result of the application is syntactically simpler than the original one. Because CON was introduced without using (defax : : :),we cannot use (open con) ( The reason why we do not use (defax : : :) is thatit may refer to itself in its de nition). Since CON is a strict function, we mustshow that its arguments exist. To this end, we add tsf2 to the rewriter. tsf2 is
an axiom maintaining that any functions of sort tsf2 are total and strict. Since
CONS, which is denoted as in xed \.", has the sort tsf2, the arguments of CON
exist.
142.

(rw * (use tsf2) (use con mode exact));HYP IFF;CDDR(CADR(`FALSEHOOD.((G1.(G2.NIL)).NIL))) = NIL&;(LAMBDA H1 H2.H1 = G1&H2 = G2);(CAR(CADR(`FALSEHOOD.((G1.(G2.NIL)).NIL))),CADR(CADR(`FALSEHOOD.((G1.(G2.NIL)).NIL))))We expand CADR and CDDR. We open CADR twice for the same reason as
mentioned above.
143.

(rw * (open cadr cadr cddr));HYP IFF;CDR(CDR(CAR(CDR(`FALSEHOOD.((G1.(G2.NIL)).NIL))))) = NIL&;(LAMBDA H1 H2.H1 = G1&H2 = G2);(CAR(CAR(CDR(`FALSEHOOD.((G1.(G2.NIL)).NIL)))),; CAR(CDR(CAR(CDR(`FALSEHOOD.((G1.(G2.NIL)).NIL))))))

Finally, we reduce CAR(CONS(: : :)) and CDR(CONS(: : :)) by the axioms car consand cdr cons, which maintain that CAR and CDR are destructors of pairs constructed by CONS. The necessary condition of this reduction such that the twoarguments of CONS exist is guaranteed by tsf2.
144.

(rw * (use tsf2 car cons cdr cons))

;HYP
145.

(qed)

We can prove the conjecture in one line as follows.
140.

(trw hyp (open hyp hyp c list list cadr cadr cddr) (use tsf2 car cons cdr cons)(use con mode exact))

;HYP
141.

(qed)

184

Appendix B(Example 2)member(nil; g1) : T ^ [g1; g2] : Cartesian(FmL; TrivFmL)
 list('falsehood; list(g1; g2)) : Prf

Each assumption is automatically assumed and labeled with HYP n, where
n is its serial number. It is labeled with HYP a, too. So HYP a is a label for all

assumptions.
276.

(show prf);labels:270.
;deps:CARTESIAN( FM L, TRIV FM L)|)(HYP 2);labels:

PRF HYP C(DEFAX HYP C |HYP C(G1,G2) IFF LIST(`FALSEHOOD,LIST(G1,G2)) ::;labels:275.

PRF HYP A HYP 2(ASSUME |(G1,G2) ::;deps:

273.

T|)(HYP 1);labels:271.

PRF HYP A HYP 1(ASSUME |MEMBER(NIL,G1) ::PRF HYP(DEFAX HYP |HYP IFF (MEMBER(NIL,G1) ::(G1,G2) ::

276.

PRF|)

T&

CARTESIAN( FM L, TRIV FM L) IMP HYP C(G1,G2))|)(trw |hyp c(g1,g2)| (open hyp c));HYP C(G1,G2) IFF LIST(`FALSEHOOD,LIST(G1,G2)) ::PRFFirst, we expand PRF using axiom prf fix. prf fix is an axiom maintaining that class PRF is a xed point of its CIG inductive de nition.
277.

(rw * (use tsfn) (useprf fix mode exact));HYP C(G1,G2) IFF;LIST(`FALSEHOOD,LIST(G1,G2)) ::DP&: : :): : :);CONDFML((EQUAL(CAR(LIST(`FALSEHOOD,LIST(G1,G2))),`PERMUTATION),;(EQUAL(CAR(LIST(`FALSEHOOD,LIST(G1,G2))),`INTERSECT),;(EQUAL(CAR(LIST(`FALSEHOOD,LIST(G1,G2))),`FALSEHOOD),;

CDDADR(LIST(`FALSEHOOD,LIST(G1,G2))) = NIL&
FM L&B ::FM L&MEMBER(NIL,A) ::;(LAMBDA A B.A ::;(CAADR(LIST(`FALSEHOOD,LIST(G1,G2))),;CADADR(LIST(`FALSEHOOD,LIST(G1,G2))))),;(EQUAL(CAR(LIST(`FALSEHOOD,LIST(G1,G2))),`IMP I),;

EQUAL(CAR(LIST(`FALSEHOOD,LIST(G1,G2))),`IMP E),: : :): : :)

T)

Appendix B

185

We simplify (COND : : :) by axiom condfml after opening LIST and EQUAL. At
the same time, we expand DP.
278.

(rw * (use tsfn tsf2 car cons condfml) (open equal list) (usedp fix mode exact));HYP C(G1,G2) IFF;NOT DTPR(`FALSEHOOD.((G1.(G2.NIL)).NIL)) = NIL&CDDADR(`FALSEHOOD.(LIST(G1,G2).NIL)) = NIL&;(LAMBDA A B.A ::FM L&B ::FM L&MEMBER(NIL,A) ::T);(CAADR(`FALSEHOOD.(LIST(G1,G2).NIL)),CADADR(`FALSEHOOD.(LIST(G1,G2).NIL)))

Note that DTPR is de ned using ATOM. We open it and execute reduction of

CAR and CDR.
279.

(rw * (use tsf2 atom cons car cons cdr cons condexp)(open dtpr list cddadr caadr cadadr));HYP C(G1,G2) IFF G1 ::FM L&G2 ::FM L&MEMBER(NIL,G1) ::T

The third conjunct is implied by the line HYP 1, so we can delete it.
280.

(rw * (use hyp a));HYP C(G1,G2) IFF G1 ::;deps:
284.

FM L&G2 ::FM L(HYP A)(label target);Labeled.

Labeling it, we now rewrite the line HYP 2. Then we apply the result to thetarget.
284.

(rw hyp 2 (usecartesian fix;G1 ::

FM L&G2 ::FM L&NOT G2 ::;deps:(HYP 2)285.

triv fm l fix mode exact))
NON TRIV FM L

(rw target (use *));HYP C(G1,G2);deps:(HYP A)

We now get the conjecture HYP. The command (ci : : :) introduces implication by discharging assumptions.
286.

(ci hyp a *);MEMBER(NIL,G1) ::
287.
;HYP

T&(G1,G2) ::(trw hyp (open hyp) (use *))CARTESIAN( FM L, TRIV FM L) IMP HYP C(G1,G2)

186

Appendix B

288.

(qed)

(Example 3)
member(nil; g1) = nil  (g1 = g1)((a)(cond(member(a; g1); t))) : V al
153.

(show prf);labels:148.

PRF HYP A HYP 1(ASSUME |MEMBER(NIL,G1) = NIL|);deps:(HYP 1);labels:150.

PRF HYP C(DEFAX HYP C |HYP C(G1) IFF CLOSURE1(G1) ::;labels:
152.

VAL|)

PRF HYP(DEFAX HYP |HYP IFF (MEMBER(NIL,G1) = NIL IMP HYP C(G1))|)

The axiom concerning CLOSURE1 is as follows :153.

(show closure1);labels:
144.

CLOSURE1(AXIOM |ALL G1 ARG CLOSURE1.
E(CLOSURE1(G1))&APPLY(CLOSURE1(G1),LIST(ARG CLOSURE1)) =(LAMBDA A.COND(MEMBER(A,G1),T))(ARG CLOSURE1)|)

We open HYP and VAL rst.
153.

(trw |hyp c(g1)| (open hyp c) (use closure1) (useval fix mode exact));HYP C(G1) IFF;CLOSURE1(G1) ::154.

FUNC( ATM, BOOL)&FUNCALL(CLOSURE1(G1),NIL) = NIL(rw * (use closure1

func fix mode exact) (open funcall));HYP C(G1) IFF;(ALL X.X ::155.

ATM IMP COND(MEMBER(X,G1),T) ::(rw * (use hyp a condexp));HYP C(G1) IFF (ALL X.X ::;deps:
156.

BOOL)&COND(MEMBER(NIL,G1),T) = NIL(HYP 1)(label target)

ATM IMP COND(MEMBER(X,G1),T) ::BOOL)Appendix B

187;Labeled.

We prove it by cases. The rst case is156.

(assume |not member(x,g1) = nil|);deps:
157.

(156)(trw |cond(member(x,g1),t) ::bool| (use * condexp tsf2)(use;COND(MEMBER(X,G1),T) ::;deps:
158.

bool fix mode exact))

BOOL IFF CONDFML((T,TRUE),T,TRUE)(156)(rw * (use condfml));COND(MEMBER(X,G1),T) ::;deps:
159.

BOOL

(156)
(label case1);Labeled.

The second case is159.

(assume |member(x,g1) = nil|);deps:
160.

(159)(trw |cond(member(x,g1),t) ::bool| (use * condexp condfml)(use;COND(MEMBER(X,G1),T) ::;deps:
161.

bool fix mode exact))

BOOL

(159)
(label case2);Labeled.

We now merge the two subproofs.
161.

(derive |not member(x,g1) = nil or member(x,g1) = nil|)162.

(cases * case1 case2);COND(MEMBER(X,G1),T) ::163.

(rw target (use *));HYP C(G1);deps:(HYP 1)164.

(ci hyp a *)

BOOL

188

Appendix B;MEMBER(NIL,G1) = NIL IMP HYP C(G1)

We can now obtain HYP.
165.

(trw hyp (open hyp) (use *));HYPThe following shows how the TEX translator translates the portion of theproof that begins and ends with the lines agged by TEX.
Since (A), we may assume there exists p1 such that
(A1)

p1 : Prf(A2)

r(h1 h2) = con(p1): h1 = append(list(b);c; a) ^ h2 = g2

We see (CON), since obviously Provable(g1; g2) regarding list( PermL; list(g1; g2); p1)
as p.
0

The TEX translator does not respect over ll of lines, so one may have overfulllines.

C

Optimizers

The following are de nitions of optimizers and subst used in section 3.2.

Optimizecase(case(i; e1; : : : ; en)) 7;! ei ;Optimizecase(case(case(e; 1; : : :; n)); e1 ; : : : ; en ) 7;! e;
Optimize (app(((a1 ; : : : ; an ):e); e1 )) 7;! subst [a1 ; : : : ; an ] e1 in e;
Optimize (app(((a1 ; : : : ; an ):e); e1 ; : : : ; en ))7;! subst a1 e1 ; : : : ; an en in e;
Optimize (((a1 ; : : : ; an ):app(e; list(a1; : : : ; an )))) 7;! e
Optimize (((a1 ; : : : ; an ):app(e; a1 ; : : : ; an ))) 7;! e
The subst construct does some substitution and/or builds a let-form: Leteach of 1 ; : : : ; n be a \binding" p = e or a \substitution" [a1 ; : : : ; an ] e or
(a1 : : : an : b) e. Then we de ne subst 1 ; : : : ; n in e. Let p e1 be one of
the assignments of 1 ; : : : ; n . Let a1 ; : : : ; an be FV (p). Then we de ne a terme and a sequence of bindings, say B , by the the following cases.
(1) None of the a1 ; : : : ; an appear freely in e. Then B is empty and e0 is
e itself. Note that n may be 0, e.g., p is the empty pattern (). That case isrecognized as a particular case of the present case.
(2) e has a free occurrence of a variable of a1 ; : : : ; an . Let new be a new total
individual variable. If p has the form [a1 ; : : : ; an ], then let e0 be the expression
obtained from e by replacing the free occurrences of [a1 ; : : : ; an] in e by new.
Otherwise e0 is e itself. (Note that each of the ai must not be bounded in a freeoccurrence of [a1 ; : : : ; an ].) Let e00 be e0 [e1 =new], if new occurs at most once in e0 .
Otherwise e00 is e0 itself. Let B 00 be ;, if new occurs at most once in e0 . Otherwise
B 00 is new = e1 .
Let e1 be the form pair(d1 ; pair(d2 ;    pair(du ; e2)   )), possibly u = 0, suchthat e2 is not the form pair(; ). We consider list(d1 ; : : : ; dn ) aspair(d1 ; pair(d2 ;    pair(du ; nil)   )):Let expand0 (p) be the expansion of p except that list is rewritten by successive

190

Appendix C

applications of pair. match(expand0 (p); e) is a set of bindings de ned by

8 match(d ; e ) [ match(d ; e ); if e  pair(e ; e )
1 1
2 2
1 2
>
>
>
>
and 0
>
<
expand (p)match(expand0 (p); e) = > pair(d1 ; d2 )
>
>
>
;
;
if
p
=
[]
>
: fp = eg
otherwise
Then we de ne e by cases.
(2a) There is a free occurrence of a1 ; : : : ; an in e00 , but new does not occur.
Let p1 = d1 ; : : : ; pu = du be the bindings among match(expand0 (p); e1 ) such thatpi is a single variable and appears freely only once in e1 or di is a variable or aconstant, and let p01 = d01 ; : : : ; p0m = d0m be the union of the other bindings andB 00 . Then e islet p01 = d01 ; : : : ; p0m = d0m in e1 [d1 =p1; : : : ; du =pu]:
e is(2b) There is a free occurrence of a1 ; : : : ; an in e00 and new occurs, too. Then

let new = e1 in let p = new in e2 :Further optimization is possible in the case of (2b), but we do not carry itout since it is rather messy.
The power of our optimization method is rather limited, since optimizers are
not de ned recursively. When Optimize is applied to a -redex, then it may
create a new -redex. Optimize does not reduce such a new -redex. Examples
of such -redexes appeared in an extracted program in 4.3.2.6. So improvementof optimizers should be done in a future study. The correctness of optimizationsof arbitrary program is not quite easy in the type free approach. For example, theoptimization of ((x)(app(((y)(e1 )); e2 ))) to ((x)(e1 [e2 =y])) is not always
correct, since their values may be di erent in our semantics of -form. Generally
speaking, optimization in -form is not correct. But, if
((x)(app(((y)(e1 )); e2 )))is created as a realizer of 8x : D:A, then the optimized form ((x)(e1 [e2 =y])) is
also a realizer of 8x : D:A, since app(((y)(e1 )); e2 ) equals e1 [e2 =y]. Namely, we
have to consider how an expression is used to do optimization. In type theories,
expressions are typed and their types describe how they are used. So optimizations
are easier in type theories. The diculty of optimization is a drawback in the typefree approach of PX. Further research is necessary to solve this problem.

References
Alagic, S. and Arbib, M.A.
1978 The Design of Well-Structured and Correct Programs, Springer-Verlag.
Allen, S.
1987 A Non-Type-Theoretic De nition of Martin-Lof's Types, Proceedings of the 2nd
Symposium on Logic in Computer Science, IEEE, pp. 215-221
Apt, K.R.
1981 Ten Years of Hoare's Logic: A Survey-Part I, ACM Transactions of Programming Languages and Systems, vol. 3, pp. 431-483.
Backus, J.
1978 Can programming be liberated from the von Neumann Style?, Communicationsof ACM , vol. 21, pp. 613-641.
Barwise, J.
1977 Handbook of Mathematical Logic, North-Holland, Amsterdam.
Bates, J.L., and Constable, R.L.
1985 Proofs as programs, ACM Transactions of Programming Languages and Systems, vol. 7, no. 1, pp. 113-136.
Beeson, M.J.
1978 A type-free Godel interpretation, The Journal of Symbolic Logic, vol. 43, no.
2, pp. 213-246.
1981 Formalizing constructive mathematics: why and how?, Lecture Note in Mathematics, Springer-Verlag, vol. 873, pp. 146-190.
1985 The Foundations of Constructive Mathematics, Springer-Verlag.
1986 Proving Programs and Programming Proofs, in Logic, Methodology, and Philosophy of Sciences VII, Barcan Marcus, R., Dorn, G.J.W., and Weingartner,P., eds., North-Holland, Amsterdam, pp. 51-82.
Bishop, E.
1967 Foundations of Constructive Analysis, McGraw-Hill.
1970 Mathematics as a numerical language, in Intuitionism and Proof theory: Proceedings of the Summer Conference at Bu alo, New York, 1968, Kino, A., Myhill, J., and Vesley, R.E., eds., North-Holland, pp. 53-71.
Bishop, E. and Bridges, D.
1985 Constructive Analysis, Springer-Verlag.
Boyer, R.S., and Moore, J.S.
1979 A computational Logic, Academic Press.
Burstall, R., and Lampson, B.
1984 A kernel language for abstract data types and modules, Lecture Note in Computer Science, Springer-Verlag, vol. 173, pp. 1-50.

192

References

Cardelli, L.
1986 A polymorphic -calculus with Type:Type, preprint, Systems Research Center,
Digital Equipment Corporation.
Cardelli, L., and Wegner, P.
1985 On understanding Types, Data Abstraction, and Polymorphism, ACM Computing Survey, vol. 17, no. 4, pp. 471-522.
Chang, C.C., and Keisler, H.J.
1973 Model theory, second edition, North-Holland.
Constable, R.L., and Mendler, N.P.
1985 Recursive De nitions in Type Theory, Lecture Notes in Computer Science,
Springer-Verlag, vol. 193, pp. 61-78.
Constable, R.L., et al.
1986 Implementing Mathematics with the Nuprl Proof Development System, PrenticeHall.
Coppo, M., and Dezani-Ciancaglini, M.
1979 A new type assignment for -terms, Archive fur mathematisch Logik und Grundragenforschung, vol. 19, pp. 139-156.
Coquand, T.
1986 An Analysis of Girard's Paradox, Rapports de Recherche, INRIA, no. 531.
Coquand, T., and Huet, G.
1985 A Selected Bibliography on Constructive Mathematics, Intuitionistic Type Theory and Higher Order Deduction, J. Symbolic Computation, vol. 1, pp. 323-328.
1986 The Calculus of Constructions, Rapports de Recherche, INRIA, no. 530, Information and Computation, to appear.
Cousineau, G, Curien, P.L., and Mauny, M.
1985 The Categorical Abstract Machine, Lecture Notes in Computer Science,
Springer-Verlag, vol. 201, pp. 50-64.
Feferman, S.
1975 A language and axioms for explicit mathematics, Lecture Notes in Mathematics,
Springer-Verlag, vol. 450, pp. 87-139.
1979 Constructive theories of functions and classes, in Logic Colloquium '78, Bo a,
M., and van Dalen, D., and McAloon, K., eds., North-Holland, pp. 159-224.
1984 Between constructive mathematics and classical mathematics, Lecture Notes inMathematics, Springer-Verlag, vol. 1104, pp. 143-161.
Foderaro, J.K., Sklower, K.L., and Layer, K.
1984 The Franz Lisp Manual.
Fourman, M.P.
1977 The logic of topoi, in Handbook of Mathematical Logic, Barwise, J., ed., NorthHolland, pp. 1053-1090.

References

193

Friedman, H.M.
1971 Axiomatic recursive function theory, in Logic Colloquium 69, Gandy, R.O., andYates, C.M.E., eds., North-Holland, pp. 113-137.
Furukawa, K. and Yokoi, T.
1984 Basic Software System, in Proceedings of the International Conference on Fifth
Generation Computer Systems 1984, Institute for New Generation Computer
Technology, pp. 37-57.
Girard, J.Y.
1972 Interpretation fonctionnelle et elimination des coupures de l'arithmetiqued'ordre superieur, Ph.D. thesis, University of Paris, VII.
Goad, C.
1980 Computational uses of the manipulation of formal proofs, Ph.D. thesis, Stanford
University.
Gordon, M.J., Milner, R., and Wadsworth, C.P.
1979 Edinburgh LCF, Lecture Notes in Computer Science, Springer-Verlag, vol. 78.
Goto, S.
1979 Program synthesis from natural deduction proofs, Proceedings of the Sixth International Joint Conference on Arti cial Intelligence, vol. 1, pp. 339-341.
1979a Program synthesis through Godel's interpretation, Lecture Notes in Computer
Science, vol. 75, pp. 302-325.
Hagiya, M., and Sakurai, T.
1984 Foundations of Logic Programming Based on Inductive De nition, New Generation Computing, vol.2, pp. 59-77.
Hayashi, S.
1982 A note on bar induction rule, in The L.E.J. Brouwer Centenary Symposium,
Troelstra, A.S., and van Dalen, D. eds., North-Holland, pp. 149-163.
1983 Extracting Lisp Programs from Constructive Proofs: A Formal Theory of Constructive Mathematics Based on Lisp, Publications of the Research Institute forMathematical Sciences, vol. 19, pp. 169-191.
1986 PX: a system extracting programs from proofs, in Formal Description of Programming Concepts-III, Wirsing, M., ed., North-Holland.
Hyland, J.M.E.
1982 The E ective Topos, in The L.E.J. Brouwer Centenary Symposium, Troelstra,
A.S., and van Dalen, D., eds., North-Holland, pp. 165-216.
Johnstone, P.T.
1977 Topos theory, Academic Press.
Ketonen, J., and Weening, J.S.
1983 The Language of an Interactive Proof Checker, Stanford University, report no.
STAN-CS-83-992.
1984 EKL-An Interactive Proof Checker User's Reference Manual, Stanford University.

194

References

Kleene, S.C.
1952 Introduction to Metamathematics, Van Nostrand.
Lambek, J.L., and Scott, P.J.
1986 Introduction to higher order categorical logic, Cambridge University Press.
MacQueen, D.
1986 Using Dependent Types to Express Modular Structure, in 13th Annual Symp.
on Principles of Programming Languages, pp. 277-286.
MacQueen, D., and Sethi, R.
1982 A Semantic Model of Types for Applicative Languages, in ACM Symp. on Lispand Functional Programming, Pittsburgh, pp. 243-252.
Manna, Z.
1974 Mathematical Theory of Computation, McGraw-Hill.
Manna, Z., and Waldinger, R.
1971 Towards automatic program synthesis, Communications of ACM, vol. 14, pp.
151-165.
Martin-Lof, P.
1982 Constructive mathematics and computer programming, in Logic, Methodology,
and Philosophy of Science VI, Cohen, L.J., et al., eds., North-Holland, pp.
153-179.
1983 On the meanings of the logical constants and the justi cations of the logicallaws, lectures given at Siena, April 1983, included in Proceedings of the Third
Japanese-Swedish Workshop, Institute of New Generation Computing Technology, 1985.
McCarthy, J., et al.
1965 Lisp 1.5 Programmer's Manual, MIT Press.
McCarty, D.C.
1984 Realizability and Recursive Mathematics, Ph. D. thesis, Oxford.
Meyer, A.R., and Reinhold, M.B.
1986 `Type' is not a type, in Conference Record of the Thirteenth Annual ACM Symposium on Principles of Programming Languages, Association for Computing
Machinery.
Mitchell, J.C.
1986 A type-inference approach to reduction properties and semantics of polymorphic
expressions, in 1986 ACM Symposium on Lisp and Functional Programming, pp.
308-319.
Mitchell, J.C., and Plotkin, G.
1985 Abstract data types have existential type, in 12th Annual Symp. on Principles
of Programming Languages, pp. 37-51.
Moggi, E.
1986 Categories of partial morphisms and the partial lambda calculus, in Lecture
Notes in Computer Science, Springer-Verlag, vol. 240, pp. 242-251.

References

195

1988 The Partial Lambda-Calculus, Ph.D. thesis, University of Edinburgh.
Nakajima, R., and Yuasa, T.
1983 The IOTA Programming System, Lecture Notes in Computer Science, vol. 160.
Nepevoda, N.N.
1978 A relation between the natural deduction rules and operators of higher level
algorithmic languages, Soviet Mathematics Doklady, vol.19, no. 2, pp. 360-363
1982 Logical Approach to Programming, in Logic, Methodology, and Philosophy of
Science VI, Cohen, L.J., et al., eds., North-Holland, pp. 109-122.
Nordstrom, B., and Petersson, K.
1983 Programming in constructive set theory: some examples, in Proceedings of 1981
Conference on Functional Programming Language and Computer Architecture,
pp. 141-153.
Plotkin, G.
1985 Lectures given at ASL Stanford meeting, July.
Reynolds, J.C.
1985 Three approaches to type structure, Lecture Notes in Computer Science,
Springer-Verlag, vol. 185, pp. 97-138.
Sato, M.
1979 Towards a mathematical theory of program synthesis, Proceedings of the Sixth
International Joint Conference on Arti cial Intelligence, vol. 2, pp. 757-762.
1985 Typed Logical Calculus, Department of Information Science, Faculty of Science,
University of Tokyo, Technical Report 85-13.
Scott, D.S.
1979 Identity and existence in intuitionistic logic, Lecture Notes in Mathematics,
Springer-Verlag, vol. 753, pp. 660-696.
Shankar, N.
1985 Towards Mechanical Metamathematics, Journal of Automated Reasoning, vol.
1, pp. 407-434.
Shockley, J.E.
1967 Introduction to Number Theory, Holt, Rinehart and Winston.
Smith, J.
1984 An interpretation of Martin-Lof's type theory in a type-free theory of propositions, The Journal of symbolic logic, vol. 49, no. 3, pp. 730-753.
Steele, G.
1984 Common LISP: The language, Digital Press.
Takasu, S., and Kawabata, S.
1981 A Logical Basis for programming Methodology, Theoretical Computer Science,
vol. 16, pp. 43-60.

196

References

Takasu, S., and Nakahara, T.
1983 Programming with mathematical thinking, in IFIP 83, North-Holland, pp. 419424.
Tatsuta, M.
1987 Program Synthesis Using Realizability, Master's thesis, University of Tokyo.
Troelstra, A.S.
1973 Metamathematical investigations of intuitionistic arithmetic and analysis, Lecture Notes in Mathematics, Springer-Verlag, vol. 344

Index

abstract syntax 137
abstraction 9, 118
almost negative formula 18-convertibility 20-22
application 9, 12
arity 10, 12
of basic function 10
assumption stack 146
atom 8backward reasoning 136
basic function 10-conversion 24, 157
call-by-value -conversion 24
of EKL 157
binding 13, 107of -expression 13
body 13of -expression 13of -function 13
of let-expression 13
bound occurrence 13
bound variable 13of -expression 13of -function 13
call-by-value -conversion 24
call-by-value combinator 113
Cartesian product 41
CCC (Cartesian Closed Category) 45, 105
nitely generated CCC 105
characterization 24, 30
of r and ! 30
of value of expression 24
choice function 50
CIG 2-6, 35-39, 61, 65, 76, 108
another de nition of CIG template 36
CIG de niens 39
CIG induction 37
simultaneous CIG inductive
de nition 39
CIG inductive de nition 37
CIG predecessor 61
re ned CIG predecessor 65
CIG recursion 76
in the narrow sense 76

CIG template 35
generalized CIG template 39
CIG2 inductive de nition 108
class 2, 11, 35-39, 105, 127condition 127
constant 11
expression 37, 39
function 38
of all classes 105
variable 11
CMU top level 140
code 35, 115
command 140
legal command 140
Common Lisp 9
completeness 89, 93
extensional completeness of PX 93
extensional completeness 89
intensional completeness 89
concrete syntax 137
conditional expression 9, 12
conditional formula 16
conditional inductive generation See CIG
connective 146
constant 11
class constant 11
individual constant 11
context 18
cpo in Plotkin's sense 116
cpo of partial continuous functions 119
Curry-Howard isomorphism 72
declaration 148
class declaration 148
constant declaration 148
function declaration 148
incomplete declaration 148
individual declaration 148
generic predicate declaration 148
user de ned predicate
declaration 148
predicate declaration 148
DEF system 10, 14
nite DEF system 14
regular DEF system 14

198

de nition of function 14
dependent conditional 43
dependent product 46
dependent sum 46, 105disjoint sum 41
dotted pair 8
Edinburgh LCF 136, 141
EKL 154, 155sort of EKL 155
partial variable of EKL 155
total variable (constant) of EKL 155
environment 19, 109, 120
basic function environment 120
constant environment 120
function environment 120
of PT 109
value environment 120
expansion 15
expression 8, 12-13, 15, 20-22, 37, 39
class expression 37, 39
conditional expression 12
-expression 12-13, 20-22
let-expression 13
of PX 15
over A 12
extended Church's rule 50
extraction algorithm 68
extractor 153
nite set 41
at domain 117
forgetful semantics 109
formula 16-18
conditional formula 16
formulas as types 72
Franz Lisp 140
free occurrence 13
free variable 12function space 40, 41
extensional function space 40
partial function space 41
function 8, 11-13, 38, 117-119
application 118
class function 38
de nition of function 13

Index

identi er 11
-function 13
over A 12
partial continuous function 119
partial function 117
generic predicate variable 152Godel interpretation 167
graph 46, 117
Harrop formula 18
hidden information 51
Hoare logic 99
hypothesis 135
of proof 135
hypothetical proof 136
IG 6, 35
impredicative de nition of classes 108
incomplete proof 136
inductive generation 35
inference macro 145
initial sequent 22
interpreter 122-123, 123-124
rst de nition of interpreter 122-123
second de nition of interpreter 123-124
IOTA 107
iterative program 98
judgment 109
hypothetical judgment 109
of PT 109
Kleene's equality 17, 155
Kleene's -notation 22
-expression 9, 13, 20-22
-frame 156
-function 13
legal command 140
let-expression 9, 13
let-quanti er 16
lifting technique 51, 57
Lisp mode 140
literal atom 8
local assumption 146
logic of partial existence (LPE) 50
logic of partial terms (LPT) 2, 19, 50
lower sequent 22
M-expression 9

IndexMarkov's principle 33
minimal xed point 49, 119
minimal graph axiom (MGA) 48
modal operator 16, 17, 32
module 105
MS-translation 115
r-quanti er 16
natural deduction 22
normal formula 18
normalization method 168
Nuprl 35
object 8
optimization 67
pairing 8
partial continuous function 119
partial correctness problem 79
partial equivalence relation 111
partial extension 25
partial function space 41
partial function 117
partial value 25
partial variable 11
pattern 11
Pebble 35, 107
PER model 110
polymorphic function 109
polymorphism 108
predicate 152
generic predicate variable 152
identi er 152
predicative de nition of classes 108
principle of double negation shift 32
program variable 99
programming on data types 44
proof 136, 140
hypothetical proof 136
incomplete proof 136
pseudo proof 140
proofs as programs 1, 72
propositional equality 41
propositions as types 72
pseudo proof 140
PT 109-110
PX evaluator 148

199

PX mode 140

quanti er 16
let-quanti er 16
r-quanti er 16
rank (of formula) 18, 63
rank 0 formula 18, 64
rank 0 sequent 78
realizability 1, 54-55, 63-65, 165
g-realizability 165
px-realizability 1, 54-55
q-realizability 165
r-realizability 165
re ned px-realizability 63-65
realization 54
realizer 54, 56
provable realizer 55
realizes 54
realizing variable 54, 65
recursion theorem 25
recursive de nition 119
reserved word 115
Russell 35
S-expression 8
Snm function 22, 25
safe constructor 141
serial or 17, 30
set notation 37
sharing of assumption 167
Skolem function 132
soundness 56, 127, 129, 131of px-realizability 56
relative soundness theorem 127
restricted soundness theorem 129
The soundness theorem 131
speci cation 2
strati ed formula 108
strati ed template 108
structural induction 93
substitution lemma 55, 113, 125, 127
for Value 125;Ext 127
for [ F ] Clfor PT 113
for px-realizability 55
substitution 13, 22, 37

g

200

subtype 107
tautology checker 144
term 15, 109
of PT 109
of PX 15
termination problem 79
theory 147
total correctness problem 79
total variable 11trans nite recursion 96
tree ordinal 44
tuple 15
tuple variable 16
type (of PT) 109
polymorphic type 109
type expression 109
type variable 109
typing 109
T0 1
unde ned value 51, 117, 155

Indexuniversal function 9
upper sequent 22
valid relative to Cl and Ext 127
value class 46
value environment 120
variable condition 26, 28
for 8I and 9E 26
for r9E and r8I 28
variable type 156
variable 11, 12, 16class variable 11
free variable 12
individual variable 11partial variable 11
total variable 11
tuple variable 16
Wang algorithm 169
well-foundness of a binary relation 93
-formula 18