Selected Papers on Automath (Studies in Logic and the Foundations of Mathematics)

SELECTED PAPERS ON AUTOMATH STUDIES INLOGIC AND THE FOUNDATIONS OF MATHEMATICS VOLUME 133 Honorary Editor: P. SUPPE...

Author: R. P. Nederpelt

11 downloads 532 Views 38MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!
Report copyright / DMCA form

DOWNLOAD PDF

SELECTED PAPERS ON AUTOMATH

STUDIES INLOGIC AND THE FOUNDATIONS OF MATHEMATICS VOLUME 133

Honorary Editor:

P. SUPPES

Editors: S . ABRAMSKY, London J. BARWISE, Stanford K.FINE, Los Angeles H.J. KEISLER,Madison A S . TROELSTRA,Amsterdam

ELSEVIER AMSTERDAM LAUSANNE NEW YORK OXFORD SHANNON TOKYO

SELECTEDPAPERS ON AUTOMATH

Edited by

R.P. NEDERPELT J.H. GEUVERS Eindhoven University of Technology The Netherlands R.C. DE VRIJER Vrije Universiteit Amsterdam The Netherlands with the assistance of

L.S.VAN BENTHEM JUTTING D.T. VAN DAALEN

1994

ELSEVIER AMSTERDAM-LAUSANNE. NEW YORK.OXFORD.SHANNON*TOKYO

ELSEVIER SCIENCE B.V. Sara Burgerhartstraat25 P.O. Box 211,1000 AE Amsterdam, The Netherlands

ISBN: 044489822 0 0 1994Elsevier Science B.V.All rights reserved.

No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without the prior written permission of the publisher, Elsevier Science B.V., Copyright & Permissions Department, P.O. Box 521, 1000AM Amsterdam,The Netherlands. Special regulations for readers in the U.S.A. - This publication has been registered with the Copyright Clearance Center Inc. (CCC), Salem, Massachusetts. Information can be obtained from the CCC about conditions under which photocopies of parts of this publication may be made in the U.S.A. All other copyright questions, including photocopying outside of the U.S.A., should be referred to the copyright owner, Elsevier Science B.V., unless otherwise specified.

No responsibility is assumed by the publisher for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions or ideas contained in the material herein. This book is printed on acid-free paper. Printed in The Netherlands

dedicated to N.G. de Bruijn

N.G. de Bmgn

vii

Preface Around 1967, N.G. (Dick) de Bruijn developed the first versions of Automath, a formal language suitable for the representation of mathematics. This topic, the formalization of a mathematical subject matter, fits in a respectable tradition. Whitehead and Russell, for instance, undertook a similar task in the first decade of the twentieth century. Their work culminated in the publication of Principia Mathematica, three sizeable volumes containing the formalization of a considerable amount of mathematics. However impressive the achievement of Whitehead and Russell was, they left large parts of the justification of their formalized mathematics to the reader. Precisely the novelty and the main virtue of de Bruijn’s efforts is that he incorporated automated verifiability as an essential ingredient of his design. The traditional systems all accomodate in one way or another common mathematical notions like axiom, theorem, proof and definition. What Automath adds to this, is the extra rigour that is required for a fully formalized representation of a mathematical argument. This involves issues that have remained somewhat out of focus in more traditional logical systems, such as the computational aspects of function application and the efficient handling of definitions. In order to achieve this, de Bruijn adopted a logical framework which deviates rather drastically from the logical mainstream at that time. A basic feature is that derivations are treated as objects in the formal system and that proof classes of propositions are treated as types. Automath has an inbuilt type mechanism that handles these aspects. Recently, type theory has become a fast developing branch of research. It has applications in mathematics and computer science, especially in the areas of proof checking and program verification. Many current proof systems pay tribute to de Bruijn and his early Automath investigations. The ideas developed in the Automath tradition and the results obtained in the project have been a starting point and a source of inspiration for many recent developments in the area. Therefore the time appears to be ripe for an anthology of papers about and around Automath. The present Volume contains a considered choice of the existing literature on Automath. Many of the papers included in this Volume have been published in journals or conference proceedings, but a number have only circulated as research reports or have remained unpublished. The aim of this book is to present a representative selection of existing articles and reports and of material contained in dissertations, giving a compact and more or less complete overview

viii of the work that has been done in the Automath research field, from the beginning to the present day. Six different areas have been distinguished, which correspond to the Parts A t o F of this Volume. These areas range from general ideas and motivation, to detailed syntactical investigations: A. Motivation and exposition B. Language definition and special subjects C. Theory D. Text examples E. Verification F. Related topics. For more detailed information about the organization of this Volume we refer the reader to the Contents and the subsequent section Hints for the reader. A survey of the contents and a detailed description of each of the selected papers can be found in Section 2 of the introductory paper by R.P. Nederpelt and J.H. Geuvers: Twenty-five years of Automath research.

ACKNOWLEDGEMENTS The editors are glad to have been assisted by the co-editors Bert van Benthem Jutting and Diederik van Daalen in a number of editorial matters, in particular as regards the selection and the arrangement of the contents. Thanks are due to Dick de Bruijn (who composed many figures), to Piet van Rooij (for his advise about the format of the references), to Sjaak Smetsers (for his help in composing figures), to Jan Joris Vereijken (for his help in encapsulating Postscript figures in IATfl) and to Jeff Zucker (for the careful reading of the introductory paper). The editors are very happy with the elegant and flexible layout provided by the UTEX Document Preparation System. They also wish to express their admiration for Anita Klooster of the Protex Text Editing Bureau, who retyped the majority of the papers in UTEX, in an extremely skilful and accurate fashion. We thank the Department of Mathematics and Computing Science of the Eindhoven University of Technology and its Section Computing Science, for their financial assistance which made this publication possible. Furthermore, the editors express their gratitude to the following persons, institutions and publishers for the permission to reprint one or more papers: Academic Press Inc. (Orlando), P. Braffort, Collhge International de Philosophie et ALAMO (Paris), Gesellschaft fur Mathematik und Datenverarbeitung MBH (Schloss Birlinghoven) , JAnos Bolyai Mathematical Society (Budapest),

ix Koninklijke Nederlandse Akademie van Wetenschappen (Amsterdam), Marcel Dekker Inc. (New York), G. Lebeau, Dept. de MathCmatique de 1’ UniversitC Paris Sud (Orsay), Presses du Centre National de la Recherche Scientifique (Paris), P. Dybjer, Programming Methodology Group (Goteborg), Springer-Verlag Inc. (Heidelberg) and Stichting Mathematisch Centrum (Amsterdam). The editors: Rob Nederpelt, Herman Geuvers, Roe1 de Vrijer.

This Page Intentionally Left Blank

xi

Contents Preface

vii

Contents

xi

Hints for the reader

xv

Notation

xvii

Introduction

1

R.P. Nederpelt and J.H. Geuvers: Twenty-five years of Automath research

3

PART A Motivation and exposition

55

A.l. N.G. de Bruijn: Verification of mathematical proofs by a computer A.2. N.G. de Bruijn: The mathematical language Automath, its usage, and some of its extensions A.3. D.T. van Daalen: A description of Automath and some aspects of its language theory A.4. J. Zucker: Formalization of classical mathematics in Automath A.5. N.G. de Bruijn: A survey of the project Automath A.6. D.T. van Daalen: The language theory of Automath. Chapter I, Sections 1-5 (Introduction) A.7. N.G. de Bruijn: Reflections on Automath A.8. R.P. Nederpelt: Type systems - basic ideas and applications

57

163 20 1 229

PART B Language deflnition and special subjects

249

B.l. B.2. B.3. B.4. B.5.

251 275 283 289

L.S. van Benthem Jutting: Description of AUT-68 N.G. de Bruijn: AUT-SL, a single line version of Automath N.G. de Bruijn: Some extensions of Automath: the AUT-4 family N.G. de Bruijn: AUT-QE without type inclusion L.S. van Benthem Jutting: Checking Landau’s ‘‘Grundlagen” in the Automath system. Appendix 9 (AUT-SYNT) B.6. D.T. van Daalen: The language theory of Automath. Chapter VIII, 1 and 2 (AUT-ll) B.7. N.G. de Bruijn: Generalizing Automath by means of a lambdatyped lambda calculus B.8. H. Balsters: Lambda calculus extended with segments. Chapter 1, Sections 1.1 and 1.2 (Introduction)

73 101 127 141

299 303 313 339

xii

Contents

PARTC Theory C.1. L.S. van Benthem Jutting: A normal form theorem in a A-calculus with types C.2. N.G. de Bruijn: Lambda calculus notation with nameless dummies, a tool for automatic formula manipulation, with application t o the Church-Rosser theorem C.3. R.P. Nederpelt: Strong normalization in a typed lambda calculus with lambda structured types C.4. R.C. de Vrijer: Big trees in a A-calculus with A-expressions as types (2.5. D.T. van Daalen: The language theory of Automath. Parts of Chapters 11, IV, V-VIII C.6. L.S. van Benthem Jutting: The language theory of A,, a typed A-calculus where terms are types

369 371

375 389 469 493 655

PART D Text examples

685

D.l. N.G. de Bruijn: Example of a text written in Automath D.2. L.S. van Benthem Jutting: Checking Landau’s “Grundlagen” in the Automath system. Parts of Chapters 0, 1 and 2 (Introduction, Preparation, Translation) D.3. L.S. van Benthem Jutting: Checking Landau’s “Grundlagen” in the Automath system. Chapter 4 (Conclusions) D.4. L.S. van Benthem Jutting and R.C. de Vrijer: A text fragment from Zucker’s “Real Analysis” D.5. L.S. van Benthem Jutting: Checking Landau’s “Grundlagen” in the Automath system. Appendices 3 and 4 (The PN-lines; Excerpt for “Satz 27”)

687

PART E Veriftcation

78 1

E.1. I. Zandleven: A verifying program for Automath E.2. L.S. van Benthem Jutting: Checking Landau’s “Grundlagen’’ in the Automath system. Parts of Chapter 3 (Verification) E.3. L.S. van Benthem Jutting: An implementation of substitution in a A-calculus with dependent types

783

PART F Related topics

839

F.l. N.G. de Bruijn: Set theory with type restrictions F.2. N.G. de Bruijn: Formalization of constructivity in Automath

841 849

70 1

72 1 733

763

805 809

...

Contents

Xlll

F.3. N.G. de Bruijn: The Mathematical Vernacular, a language for mathematics with typed sets F.4. R.M.A. Wieringa: Relational semantics in an integrated system F.5. N.G. de Bruijn: Computer program semantics in space and time

865 937 947

Bibliography

973

References

975

Indexes

995

Index of Names Index of Notations Index of Subjects

997 1003 1005


xv

Hints for the Reader The introductory contribution Twenty-five years of Automath research by R.P. Nederpelt and J.H. Geuvers has been written especially for this Volume. It contains a short historical sketch of the development of proof systems and a detailed survey of the contents of this book. The other papers in this Volume have first been distributed over the parts A to F on purely thematic grounds. Then, within the parts, the order is mainly determined by chronology. Therefore, the order in which the papers appear in this book is not to be taken as a hint for the order of reading.

For an exposition of the ideas underlying Automath, we suggest that the reader starts with either one of the following two papers: A.3. D.T. van Daalen: A description of Automath and some aspects of its language theory, A .5. N.G. de Bruijn: A survey of the project Automath. For a personal view of de Bruijn, looking back on his motivation for developing Automath and the related Mathematical Vernacular, see:

A.7. N.G. de Bruijn: RefEections on Automath. An introductory overview of the basic notions used in type systems like Automath, in relation to recent developments in logic, mathematics and computer science, can be found in:

A.8. R.P. Nederpelt: Type systems - basic ideas and applications. The reader with no experience of type systems and interested in obtaining a working knowledge of one of the Automath systems, is referred to:

B.l. L.S. van Benthem Jutting: Description of AUT-68. EDITORIAL NOTES Editor’s comments or new notes added by the authors are given in the running text between square brackets, in italics. For revisions which are more than simple rephrasings or obvious corrections, the same format is used. Omitted text is indicated as follows: [...I.

xvi

THE REFERENCES The contributions in this Volume (but for the new introductory paper Twentyfive years of Automath research) are identified with a letter-number combination. For example, B. 7 refers t o paper no. 7 in Part B of this Volume. All the references are listed at the end of the Volume. The reference list starts with the precise bibliographic data of the selected papers, ordered according t o the letter-number code. Thereafter, all references, including the selected papers, are listed alphabetically by author name and, for each author, by publication date. Within the papers, references to other papers which have been reproduced in whole or part in this Volume are indicated i n italics. For a paper that is fully reproduced in this Volume, we also give the letter-number code; e.g., [ d e Bruzjn 876 (B.7)].If only a part or parts of a paper or thesis are reproduced, we generally give the reference to the full work, without the letter-number code(s), again in italics; e.g., [van Daalen 801. If, however, the reference in question only concerns the text of that part which is reproduced in this Volume, then we do give the relevant letter-number combination. For reasons of readability, we deviate from the above conventions in the introductory paper Twenty-five years of Automath research: there we only use the short letter-number code when referring t o the papers or parts of papers reproduced in this Volume. All other references throughout this Volume are given in roman typeface. For example, we may cite [Barendregt 84a] or [de Bruijn 931.

xvii

Notation In the course of time, different notations have been used for several notions in Automath papers. We have tried to uniformize these notations in this Volume, but only if this created no technical problems. Below we give a list of the standard Automath notations as employed in this Volume. Unavoidably, however, there remain several locations where the notation deviates from the Automath standards.

Functional abstraction. Standard notation: [z : A ] B . This denotes the lambda abstraction of the variable x of type A over B. This notation for lambda abstraction was originally proposed by de Bruijn. In usual lambda calculus notation, one writes something like X,:A.B.

Exceptions: A . 8 : Ax : A . B . This paper has the usual lambda calculus notation. 0 B.8: X,.B. The paper deals with the type-free lambda calculus in the usual notation. 0 C.2: A, B. The lambda calculus is type-free, for the most part, and uses the ordinary X for abstraction. There is, however, a section on typed lambda calculus in which the notation T ( A ,X,B) is proposed for A,:A.B. 0 0.5: [ x , A ] B .In older Automath literature one finds a comma instead of a colon for the separation of abstraction variable and type. This is also the case in this paper, containing the literal rendering of an original Automath text. 0

Functional application. Standard notation: ( E )F. This denotes F applied to E. Note that it is a well-considered Automath decision to put the argument in front ofthe function: ( E ) F is the notation for the expression usually written as F ( E ) . Exceptions: 0 A.8: ( F E ) . This paper has the usual lambda calculus notation. 0 B.2: { E } F . In older Automath literature, one can find curly braces instead of angular brackets around the argument. This is also the case in this paper, in order to avoid confusion with the Backus-Naur normal form for abstract syntax, which uses angular brackets. 0 B.8: 6 E F . This paper uses a deviating notation for application. 0 C.2: A(F,E ) . This notation is in line with the one proposed in this paper for abstraction in typed lambda calculus. 0 E.3: F { E } . This paper employs the usual notation with the usual order of

xviii function and argument, but with curly braces instead of parentheses.

Substitution. Standard notation: A [ . := B ] . This meta-term denotes the result of the substitution of B for all free occurrences of the variable z in A. For simultaneous substitution of B1 for X I , . . . , B, for xn, one can find the notation A [ z l , .. . ,z, := B1,. . . , B,]. Many papers in this Volume use a notation for substitution that deviates from this standard. Sometimes, a meta-term like A [ z ]is employed to indicate that z may occur as a free variable in A . Then the result of substituting B for X can easily be described as A [ B ] . Exceptions: A . 2 : Q x ( B ) A .A special notation used in this paper. 0 A . 3 : A [ B ] or [z := B ] A . The notation A[B] is used as an informal notation for the result of the substitution of B for z in A[$].Formally, this substitution is denoted by [z := B ] A , hence with the substitution operator preceeding the term in which the substitution must take place. 0 A . 6 : A [ B ] .This is, again, the result of substituting B for z in A [ z ] . 0 8.3: A ( B ) . Here the notation A ( z ) is used to indicate that z may occur free in A . 0 B.6: A [ B ]or A [ z / B ] .The first notation is used if it is clear which variable z is intended. 0 B.8:C , ( B , A ) . A special notation used in this paper. 0 C.2: See Section 6 of this paper. 0 C.3: (z := B ) A . Note the deviating place and form of the substitution operator. 0 C . 4 : See Subsection 2.3.6 of this paper for the notation of simultaneous substitution. 0 C.5: A [ B ] or A [ z / B ] . (Cf. B.6.)See Subsection 11.10 of this paper for the notation of multiple substitution. 0 (7.6: See Definition 3.3 of this paper. 0 E . l : I[z/B]IA. 0 E.3: See Subsections 2.2.2 and 2.2.3 of this paper. 0 F.3: [ [ z / B ] ] ASee . Subsection 11.6. 0

Reduction and conversion. Standard notation: A + B , A ++ B, A = B , for a one-step reduction relation, a (multi-step) reduction relation and a conversion relation, respectively, holding between A and B. For special kinds of reduction, the relation symbols can be provided with a subscript. E.g., in lambda calculus, one-step ,&reduction of A to B is denoted by A +p B. Multiple subscripts point to a possible choice (in each step) of one of the relations mentioned in the subscript. For example, A - ~ p B, means ~ that

xix

there is a multiple reduction path “leading” from A to B , each step being either a @-stepor an 77-step. Exceptions : 0 A.3, A.6, B.6 and C . 5 : A 9 B is used for conversion. 0 B.6: A > B for (one-step) reduction. 0 C . 3 : A 2’ B , A 2 B for one-step and multi-step reduction respectively. 0 C.5: A > B, A 2 B for (generic) one-step and multi-step reduction respectively. (See the editorial note at the beginning of this paper). E . l : A > B, A 2 B for one-step and multi-step reduction respectively. Typing. Standard notation: A : B . This denotes that A has type B. Sometimes types can be defined by means of a typing function, e.g. typ(A) for the (canonical) type of A . Exceptions: A.3, A.6, B.5, (2.4, (7.5, 0.2, 0 . 3 , E . l , E.2 and F . l : A E B .


Introduction


3

Twenty-Five Years of Autornath Research R.P. Nederpelt and J.H. Geuvers

This introductory contribution consists of two parts. In Section 1, we give a concise historical overview of proof systems, leading to a short survey of the Automath project and a description of recent developments. The main subject, to be found in Section 2, is an explanatory survey of all papers selected for this Volume.

1. FORMAL PROOF SYSTEMS AND AUTOMATH 1.1. The origins

The study of valid inference, the basis of logic, seems t o have started with geometrical demonstrations (Thales, Pythagoras) and found an early culmination in Aristotle and his Orgunon (fourth century B.C.) (see [Kneale & Kneale 621). Aristotle’s investigations about inferences, and in particular the analysis and systematization of the syllogisms, were very influential throughout many centuries. Of equal influence were Aristotle’s ideas on the deductive organization of science. The “axiomatic method” was applied on a substantial scale in Euclid’s Elements. In Roman and Medieval times the findings of the Greek philosophers were taken as the basis of logic. There was hardly any progress until after the Renaissance, when Leibniz (1646-1716) made a large step forwards. He tried to develop a universal scientific language, which he called the Characteristicu Universalis. In particular, he desired to invent a calculus for logic, the calculus ratiocinator. His conviction was that, in this setting, a faulty argumentation would inevitably lead t o a mistake in calculation, and hence would become immediately detectable. His attempts to formalize and universalize the scientific language thus gave rise to the beginning of symbolic logic. At the end of the 19th century, it was Frege who invented the Begriffsschrift ([Frege 1879]), a formal language for logic, which he developed in his search for a foundation of arithmetic. In 1893 Frege published his Grundgesetze der Arithmetik ([Frege 18931) in which he ventured on a complete formalization

4

R.P. Nederpelt and J.H.Geuvers

of large parts of mathematics, based on logical principles. He stood up for a clear separation between axioms and theorems. Moreover, he advocated that the inferential machinery that one uses in mathematics should be introduced beforehand. A formal approach to the notion of ‘inference’ was, in his view, indispensable in order t o dissociate oneself from unclear, natural language based reasoning. However, Frege’s attempts turned out t o be too bold. In a letter to Frege, Russell pointed out that Frege’s system leads to a paradox. In the light of the history, Frege is hardly to blame, since such pioneering work is inevitably a hazardous shot in the dark. Whitehead and Russell, inspired by Frege’s work, wrote in their famous Principia Mathematica the following homage: “In all questions of logical analysis, our chief debt is to Frege” ([Whitehead & Russell 19101). 1.2. The influence of the paradoxes In order to prevent the paradoxes, Whitehead and Russell analysed the vicious circles present in all the known paradoxes. They came to the conviction that a hierarchy was necessary for a sound development of arithmetic and they proposed a type system: the simple type theory. It turned out that a refinement was necessary, which they called the ramified theory of types. This worked as they desired, albeit that they needed an extra axiom, in order to “soften” the strictness of the typing hierarchy. Only with this axiom of reducibility they were able to incorporate full arithmetic, in particular the real numbers, based on Dedekind cuts. This idea of using types emerged quite naturally, once the vicious circles had been detected. In fact, one may say that types existed since early mathematics was developed: categories like ‘natural number’ and ’real number’ in calculus, or ‘point’ and ‘line’ in geometry, grouped elements together in clusters with a common meaning or structure. In this sense, types were meant to emphasize the similarities between given entities. But at the same time, types can be of use in establishing differences between entities. The latter aspects turned out to be of great importance in combatting against the paradoxes. Hilbert and Ackermann ((Hilbert & Ackermann 1928)) were not fully content with the solution that Whitehead and Russell had given for the avoidance of paradoxes. In particular, Hilbert and his student Ackermann tried t o avoid the axiom of reducibility. A close examination of the paradoxes led them t o a division of the known paradoxes into two categories: the logical paradoxes and the semantical ones. For the logical paradoxes, the simple type theory appeared to be sufficient. The semantical paradoxes - like the famous liar’s paradox of Epimenides, or like Richard’s paradox - were rendered harmless by the distinction between object language and meta-language. The object lan-

Formal proof systems and Automath

5

guage accounts for the formal body of “mathematics” which is expressed inside this formalism. The meta-language is intended for expressing the intuitively simple “meta-mathematics” , which is used for discussions about the formalism, in particular for the study of properties such as consistency. (More recent ideas in this direction are due to Tarski.) The last mentioned distinction has since been generally accepted as a sound approach to foundational matters. For an analysis of “Hilbert’s program” see [Smorynski 771. Noteworthy is the purely formalistic conception of the nature of mathematics that was adopted by Hilbert. 1.3. Church’s contributions

One may regard Alonzo Church as the founder of type theory. His general investigations about functions gave rise to lambda calculus, the lambda being used as a symbol for abstraction of a function value over a variable. Church’s intentions ([Church 321) were to give a foundation for logic in terms of this general theory of functions. However, his attempts produced a n inconsistent logic, which caused many researchers of the time to turn away from lambda calculus. Church used lambda calculus also for investigations in computability ([Church 361). It turned out that the so-called lambda-definable functions coincide with Godel’s general recursive functions. This fact supported Church’s thesis that lambda-definability (and hence general recursiveness) is an adequate formalization for the intuitive notion of computability. In a new attempt to give a basis for logic by means of lambda calculus, Church introduced a system with types ([Church 401). This system is now known as the simple theory of types. These types were given as an independent set of entities. Both the lambda calculus framework and the types were proposed as objects for study in their own right. A recent adaptation is made by Barendregt et al. in Nijmegen, The Netherlands, (see e.g. [Barendregt & Hemerik 901 or [Barendregt 921) and is called X +Church. The discovery that a proposition can also be considered as a kind of type - t o be precize: the type of all of its proofs - can be viewed as an important byproduct of this approach. This notion, also called the notion of propositions-as-types (and proofs-as-objects) proved to be very fruitful in the following decades, in logic, mathematics and computer science. Later, Curry developed a type notion for lambda calculus that is different from Church’s. The difference is that Church gave a type-annotation for the binding variables in his term, which results in a unique type for each term. Curry used type-free terms and investigated all possible typings, giving a set of types for a term (possibly empty). For more details and for a contemporary discussion, see (Barendregt 921.

6

R.P. Nederpelt and J.H. Geuvers

1.4. The Automath project De Bruijn developed his ideas about a formal language for mathematics around 1967. He then was a full professor in the Mathematics Department of Eindhoven University of Technology, the Netherlands. (The university was called Technische Hogeschool Eindhoven, at that time.) It was his personal experience with reasoning in mathematics that brought him t o the conviction that a formal linguistic apparatus would be advantageous in many respects. (See de Bruijn’s own words about this matter in [ A . 7 ] , this Volume.) De Bruijn tailored the system to his own insights, which originated in a lasting and deep association with mathematical theories in different areas. Quite recently, his friend and colleague J.J. Seidel gave a description of the “highlights” in de Bruijn’s research work by selecting 14 of the most outstanding books and papers among his 175 or so official publications. As main areas of de Bruijn’s work, Seidel mentioned: number theory, combinatorics, asymptotics, functional analysis, optimal control, Fourier theory, type theory and the theory of quasicristals. It is remarkable, and typical for de Bruijn, that he did not revert to known theories for the development of his language for mathematics, not even as regards the underlying logic. As a matter of fact, he needed not much more than the lambda abstraction and application and the reduction mechanism of lambda calculus. For logic he only incorporated the absolute minimum, (re-)inventing the propositions-as-types notion as a unifying basis. De Bruijn baptized his system ‘Automath’, since it had to do with the “automation of mathematics”. However, connotations of this name in the direction of (automated) theorem proving were never intended. His aim was t o develop a formal language for the full range of mathematics, including logic, by the aid of which it would become possible to check mathematical theories which already have been developed. This purpose is considerably more modest than t o invent some artificial intelligence-like expedient. For the verification part, de Bruijn had the intention, from the beginning, to use a computer. This intended use of a computer influenced his design, in the sense that the formal language had t o be implementable on a machine. The then (and now) existing habits of rendering mathematical thoughts were much too informal and inaccurate for his aims. Soon after de Bruijn made public his ideas about Automath (cf. [ A . 1 ] in the present Volume), he appointed L.S. van Benthem Jutting at the Eindhoven University of Technology for research in this area. In 1969, R.P. Nederpelt started his work at the same university, as a Ph.D. student, under guidance of de Bruijn.


7

De Bruijn, van Benthem Jutting and Nederpelt continued t o work on the subject in the following decades, employed by the university. Apart from that, the Dutch Organization for Pure Scientific Research (ZWO) financed a project called Mathematical Language Automath, also located at Eindhoven University, from 1971 until 1976. From a historical point of view, it appears to be interesting to repeat the aims of this project, as formulated by de Bruijn (the original Dutch has been translated): 0

0

0

0

0

The design of a language in which all of mathematics can be expressed so accurately, that linguistic correctness automatically entails mathematical correctness. The development of programs which enable a computer to verify the books written in that language as regards linguistic acceptability, and hence also mat hemat ical correctness. The buildup in the mentioned language of a piece of mathematics, sufficiently voluminous and sufficiently usable to enable a large group of mathematicians to transfer their own mathematical texts into the language. The elaboration of the thoughts that such a language evokes, more or less automatically, as regards the build-up and the presentation of existing mathematics. The attainment of the situation that complicated and badly organized pieces of mathematics can be formulated in an absolutely reliable manner, by cooperation between mathematician and computer.

The following researchers were employed in the mentioned project, for longer or shorter periods: D.T. van Daalen, A. Kornaat, R. de Vrijer, I. Zandleven and J.I. Zucker. Moreover, programmers, typists and some 25 students participated in the work. The results of the project can be divided in the following areas: 0

Language-theoretical contributions.

0

Software.

0

Mathematics in Automath (14 different subjects).

In the present Volume one may find a number of publications that have been prepared or finished in the framework of this project. For example, Zucker’s [ A . 4 ] is a direct result of his work in the project. The same holds for de Bruijn’s [B.3],[B.4]and [F.1], van Daalen’s [A.3],Nederpelt’s Ph.D. thesis [C.3],de . of the work presented in van Daalen’s Vrijer’s [C.4]and Zandleven’s [ E l ] Much thesis ([vanDaalen S O ] ) and in van Benthem Jutting’s thesis ([vanBenthem Jutting 771) originates from this period.

8


In retrospect, one may conclude that the project was successful. A definite drawback, however, has been that many of the results have only been published in unofficial notes and reports. The international community has not sufficiently been able to take note of all the results, ranging from language theory to computer implementations. One reason was that publication in international journals was not the main objective of the project, another that the subject was not really welcomed in the scientific community of the time, probably because of its isolation: for logicians, Automath was not logic; for mathematicians, it was not mathematics, either. And as regards computer science, the flowering of type theory (including Automath-like constructs) is only very recent. Anyway, there has been a continual lack of official publications concerning the Automath project, ever since its inception. Also after the end of the Automath project (1976), this situation has not really changed. However, the work on Automath continued, albeit with a smaller group (viz. de Bruijn, van Benthem Jutting, van Daalen, Nederpelt, de Vrijer, and (later) Wieringa and B a k e r s ) . The intention of the present Volume is that a coherent and representative selection from the Automath literature becomes widely available.

1.5. Related type systems At about the same time as the beginning of the Automath project, Howard invented his version of LLformulae-as-types”, intended as a formalization of the intuitionistic idea of “proofs-as-constructions” . The handwritten notes of the paper [Howard 801 were privately circulated in 1969. (For comparison, the report version [de Bruijn 68b] of [de Bmijn 7Oa (A.2)] appeared in November 1968.) The work of Howard is based on ideas that go back to [Curry and Feys 581. During the active period of the Automath project, other type systems were being developed, some of them also intended as systems for doing mathematics on a computer, others as a mechanism for typing in (functional) programming languages and again others as a system for foundational studies (like, e.g. the above-mentioned work of Howard). An early example of the latter kind is Martin-Lof’s system of Intuitionistic Type Theory, which was developed as a formal system for intuitionistic mathematics. In fact there are many different versions of the system, one of them impredicative, but most of them not. (Impredicativity means in typed lambda calculus that a type can be defined by quantification over the collection of all types.) The first formulation, just called ‘Theory of Types’ dates from 1971 ([Martin-Lof 71al) and is impredicative. It turned out t o be inconsistent by a result of Girard. This result has become known as Girard’s paradox and was first reported in [Girard 721, but see also [Coquand 861 for a general treatment


9

of the paradox in typed lambda calculi. Later versions are all predicative, like the one in [Martin-Lof 75a], which also has decidable type checking, due to the intensional treatment of equality. Martin-Lof also described a type theory with extensional (and hence undecidable) equality ([Martin-Lof 84]), in which type checking is not decidable. This is also the type theory used in the proof development system ‘Nuprl’. (See [Constable et al. 861.) The Martin-Lof type theories are also convenient as formalisms for program development, as the systems permit formal specifications for which programs can be constructed by means of the proof rules. This exploits the old idea that an intuitionistic proof of a formula of the form Vx € A . 3y € B [(p(z,y)] contains a procedure (algorithm) for constructing for every a E A an element b E B such that ~ ( ab), holds. For Martin-Lof’s intuitionistic type theory, this method is explained in [Nordstrom et al. 901, which also gives a good general overview of Martin-Lof’s systems. Another early example of the use of typed lambda calculus for foundational studies is the work of Girard in [Girard 711 and [Girard 721. There the polymorphic lambda calculus (system F ) is described and its higher order extensions. (The polymorphic lambda calculus was later rediscovered by Reynolds as a system for the typing of parametric functional programs, see [Reynolds 741.) The aim of Girard was not to give a calculus for doing formal mathematics, but to extend Godel’s Dialectica interpretation t o higher order arithmetic. This resulted in a lot of new results on the representability of recursive functions in typed lambda calculus and new techniques for proving normalization. (By now, Girard’s proof of normalization has become the standard method for these kind of proofs for higher order typed lambda calculi.) The systems of Girard are impredicative, which makes the normalization proof hard, proof-theoretically speaking. In contrast, all Automath-systems are predicative. Let’s point out here that, although the work of Girard has been very influential for later developments in the connections between typed lambda calculus and proof systems (e.g. the Calculus of Constructions), the polymorphic lambda calculus does not include logic but is purely a system for describing functions and data types. An early system that, like Automath, mixes computation and logic is Scott’s ‘Logic for Computable Functions’, a formal system for reasoning about the behaviour of recursively defined functions. The LCF system goes back to 1969 and marks the beginning of domain theory. (See [Scott 731.) The first implementation of the system was done by Milner around 1972, now known as Stanford LCF. Later versions of the system include Edinburgh LCF and Cambridge LCF, which further develop the basic ideas. The development of ML as an interactive metalanguage has been an important offshoot of Edinburgh LCF. (See [Gordon et al. 791.) The metalanguage ML allows the user to program tactics for proofsearch in LCF, and it also gives relatively great security against faulty proofs. Besides first order predicate logic, all the basic domain-theoretic constructions

10


can be included in LCF as theories. The original formal system is now sometimes referred to as ‘PPX’ (Polymorphic Predicate X calculus), to distinguish it from its implementations. See [Paulson 871.

1.6. Recent Developments Recently there has been a boom in the research on typed lambda calculi and proof development systems, maybe best illustrated by the joint European (ESPRIT) research projects ‘Logical Frameworks’ and its successor ‘Types for Proofs and Programs’. (The latter has as a major aim the study of proof development systems based on typed lambda calculus.) A lot of research in the field is inspired by early work in the Automath project. We therefore want to mention here some lines of ongoing research. Our summary is not meant to be exhaustive but intends just to illustrate the broad actual interest in the topic, from both computer science and mathematics. One of the newer systems that is very close to Automath is LF, developed in Edinburgh and quite close to AUT-QE. (See [Harper et al. 871.) The system has been implemented and the implementation provides interactive proof development facilities. Furthermore the research in LF (an abbreviation for ‘Logical Framework’) has produced a large amount of examples of representations of formal systems in LF, showing the flexibility of the system. At the same time the problem of adequacy of representation has been taken very seriously from the start. (Given the representation of a formal system in LF, it is usually quite straightforward to show that if a statement p is provable in the formal system, then the type that interprets p in LF, say p , is inhabited in LF. The adequacy of the interpretation, stating that if p is inhabited in LF, then p is provable in the original formal system, is much more complicated.) A system that in fact unifies some of the Automath work with the work of Girard, is Coquand and Huet’s Calculus of Constructions (CC). It is a higher order dependent typed lambda calculus that includes constructive higher order predicate logic (by the formulas-as-types embedding) and at the same time includes many data types, due to the fact that they can be coded in Girard’s polymorphic lambda calculus. The system was first described in [Coquand 851 and not much later implemented by Huet in CAML. (See [Coquand & Huet 881 and [Coquand 901.) A lot of formal proofs have been done in the system, which are reported for example in [Coquand & Huet 851. Due to the representability of data types and the formulas-as-types embedding, it is also possible to write specifications (they are in fact formulas) in the system, which in turn allows the extraction of programs from proofs. The idea behind this programs-from-proofs method is the same as for Martin-Lof’s systems, but, due to the higher order logic and the definability of data types in CC, the actual mechanism is different.


11

The method is extensively described and implemented by Paulin-Mohring. (See [Mohring 861 and [Paulin-Mohring 891.) Very recently the Calculus of Constructions has been extended with so called Inductive Definitions, which amounts to the extension of the system with a scheme for inductively defining mathematical objects like sets and predicates, and also for constructing proofs and recursive functions by induction. This new system has been implemented as ‘Coq’ by researchers at INRIA. (See [Dowek et al. 911 for details.) Another implementation of the Calculus of Constructions has been done in Edinburgh by Pollack. The system is called ‘LEGO’ and it in fact allows the user to make a choice for a typed lambda calculus he or she wants to work with. Among the possible choices are of course CC, the already mentioned system LF and also an extended version of CC, called ECC. This system ECC is due to Luo ([Luo 89]), who has also provided the language theory for it. An interesting feature of the system is the possibility of representing a mathematical theory as a type, allowing theory abstraction and the description of morphisms between theories. In the system this is done by using so called C-types (a C-type is of the form Cz : A . B ( z ) with as canonical inhabitants the pairs (a,6) with a of type A and 6 of type B ( a ) ) ,allowing for the same kind of flexibility as can be obtained via de Bruijn’s notion of ‘telescope’ t o denote theories. (The subject ‘telescopic mappings’, by itself, would have been interesting enough for inclusion in the present Volume. However, de Bruijn’s paper [de Bruijn 91a] is very recent and can easily be tracked. Therefore, it has not been reproduced in this Volume. Telescopes are also discussed in Subsection 4.1.3 of [0.3]and in [A.4].) The pure study of the language theory of typed lambda calculi that originated from the Automath project, has also been continued, notably in Nijmegen by the research group of Barendregt. This resulted in the general treatment of different typed lambda calculi in one framework, first the ‘cube of typed lambda calculi’, which later resulted in the notion of ‘Pure Type System’ (PTS). (See [Geuvers & Nederhof 911, (Barendregt 921 and [Geuvers 931.) The framework allows proofs of many of the standard results like closure (under reduction) and uniqueness of typing, in a generic way. An implementation of arbitrary PTSs has been done by Helmink at Philips Research Laboratories under the name ‘Constructor’. Users of the system are allowed to select their own P T S to work in. We have already mentioned the system Nuprl ([Constable et al. 86]), developed at Cornell and based on the formulas-as-types approach and ideas on intuitionistic type theory from Martin-Lof. The actual system has also benefited a great deal from the work on LCF: Nuprl is implemented in ML and exploits ideas from LCF on goal directed interactive proof development. The Nuprl system actively supports the programs-from-proofs mechanism.

12


The type theory of Martin-Lof has also been applied to theorem proving in Sweden itself, notably in Goteborg. This has led to a system called ALF (Another Logical Framework), constructed by Augustsson, Coquand and Nordstrom (see [Magnusson & Nordstrom 941). A proof system which is based on typed lambda calculus but does not treat proofs as formal objects is HOL (Higher Order Logic.) The system was developed in Cambridge by Gordon (see [Gordon & Melham 931) and is in fact based on Church’s simple theory of types ([Church 401) and LCF. The system is not a framework but supports a version of classical higher order predicate logic. Just as in Church’s original work, the typed lambda calculus is used to describe the higher order language while the derivation rules are functions in the metalanguage ML. The implementation is based on ideas from LCF about interactive theorem proving and is done in Lisp and in ML. Another interesting difference between HOL and systems such as Automath or CC is the extensional treatment of equality. HOL does not distinguish between definitional equality (conversion) and, what is in Automath terminology called ‘book equality’ (locally defined), but interprets the definitional equality as a proposition. A lot of experience with HOL has been gained, especially in the field of hardware verification. Of course there are also systems for proof development that do not use type theory at all. An example is the ‘high level formalized language for mathematics MIZAR’. (See [Trybulec 901.) Another example of such a system is the BoyerMoore Theorem Prover. (See [Boyer & Moore 881.) The system is a heuristic theorem prover in the sense that the theorem prover gives the user a lot of support for finding an actual proof. This of course has its price: the logical basis of the system is a quantifier-free variant of Peano arithmetic. It is remarkable that a lot of interesting results can still be proved in the system although this usually requires a serious reformulation of the theorems to make them manageable for the machine. The theorem prover has been applied to many examples, both from computer science (e.g. hardware verification) and mathematics or logic (like Godel’s incompleteness theorem).

2. SURVEY OF THE CONTENTS The papers which have been selected for the present book, are divided in six groups, in accordance with the global character of the topics treated. Each of these groups corresponds to a Part of this book, with the following headings:

Survey of the contents

Part Part Part Part Part Part

A B C D E F

13

Motivation and exposition Language definition and special subjects Theory Text examples Verification Related topics

Inside each of these parts, the papers are ordered chronologically, except when a strong relation in the themes of two papers appears to be more important than the ordering in time. In the present section we describe the contents of the papers which have been selected for this book. This description is meant to give a general idea of the subjects which are dealt with in the respective papers. Moreover, we take the opportunity to sketch the connections between the papers and the developments in the course of time. Often we go further than providing pure abstracts of the papers, because many of the selected papers lack such a r6sumC. Our purpose is then to give some insight into the contents of the different papers, with a view t o the aims and ideas of the Automath project. In particular, this applies to our comments about the (general) Part A, which are rather copious. For Parts B to F, however, which have more specialized subjects, we give more concise rCsumC’s. References to the papers included in this Volume will be indicated with the letter-number combination as given in the list of contents, printed in italics, e.g. [C.2].

Part A: Motivation and exposition

A.l. N.G.de Bruijn: Verification of mathematical proofs by a computer This is the first paper ever that has appeared about Automath. It was written as a companion paper t o a colloquium lecture which de Bruijn delivered at Eindhoven University of Technology, the 9th of January 1967. The paper has primarily been selected for historical reasons. De Bruijn presents it as a “preparatory study” for a project Automath and the paper as such is rather experimental. It is surprising, however, how clear the exposition is and how many of the main themes of the following Automath project are already incorporated. De Bruijn explains his ideas on the basis of a mathematical example concerning equivalence classes in a set. He uses this example to conceive a general plan of formalization. At the same time, the example serves as a good exercise for the discovery and the analysis of the mathematical and logical structures which are


14

present in an average mathematical text, structural aspects which are grasped and understood implicitly by every mathematically educated reader, but which are hardly ever studied in isolation, or elaborated into the finest details. The chosen example is very appropriate, since the distance between the original text and the formalization is great: a considerable amount of work has to be got through in order to obtain the result desired. The formalization of the example consists of three stages: (1) the mathematical text in the usual phrasing, as it could be found in a mathematics book, (2) an elaboration and structuration, using the logical and mathematical formularium wherever appropriate, (3) a full formalization in six columns, with a line-wise development. Each line consists of:

(a) a “call”, or heading, establishing the textual function of the line: whether it concerns a definition of an expression, a context extension or contraction, a derivation step, etc., all with the necessary parameters, (b) the definition of the expression (if appropriate), (c) a “stack”, containing the context administration of variable introductions and assumptions, (d) a “proof”, being an abbreviated form of the asserted expression in the current context, (e) an elaborated version of the proof, (f) a reference number for the proof expression. The paper shows how de Bruijn goes about with the underlying deductive structure. It is intriguing to see how he “reinvents” the rules for natural deduction, still a bit chaotic, but uncompromising. As a major result, variables become first-class citizens, which is hardly the case in the usual conception of natural deduction (or mathematics). The difference between free and bound variables plays an important role. Moreover, de Bruijn employs a useful contextor block-mechanism for variables and assumptions. Finally, we may notice a formal treatment of substitution. The formalization as a whole seems a bit complicated and ad hoc. However, many of its features recur in the subsequent definitions of Automath languages, e.g. the treatment of variables, the substitution mechanism, the block structure and the formal shape of definitions. There are also meta-results: it becomes clear that the given formalization has possibilities for a mechanic verification; the formalization of a proof leads naturally to conclusions about the proof (e.g.

Survey of the contents

15

that a certain assumption is superfluous). Still absent is the propositions-astypes idea, that became so very fertile immediately after this preliminary phase.

N.G. de Bruijn: The mathematical language Automath, its usage, and some of its extensions This paper builds on an internal report of the Technische Hogeschool Eindhoven (the name of the Technological University of Eindhoven at that time), called Automath, a language for mathematics ([de Bruijn 68bl). That report was intended for the Symposium on Automatic Demonstration in Versailles, France (December 1968), which was attended by de Bruijn, and it has been published in the Springer Lecture Notes series. It is the first international publication about Automath. Some of the statements in this paper give an impression of the implicit “Automath programme” that de Bruijn had in mind. We think that it is worth while to quote a number of these phrases: A.2.

Automath is a language which we claim to be suitable for expressing very large parts of mathematics, in such a way that the correctness of the mathematical contents is guaranteed as long as the rules of the grammar are obeyed. The author feels that [...] Automath [...] is very close to the way mathematicians have always been writing, and that the abbreviation system used in Automath has been taken from existing mathematical habits. [Automath] is little more than [.. I the art of substitution.

De Bruijn explains how he uses the essential characteristics of a deductive system, by means of a context structure consisting of a set of nested blocks, in the vein of a “linearized” system of natural deduction. First, a basic abbreviation system is introduced, called PAL (which is an abbreviation for Primitive Automatic Language). A formal text in PAL (a PAL-book) consists of a set of consecutive lines, built from four parts: (1) an indicator referring to the top of a context stack,

(2) an identifier serving as a name (an abbreviation) for the string to be defined in that context, (3) the string which is abbreviated in the given context,

(4) a “category” (or type) for that string Note that PAL already has types, meant to restrict the set of terms in a natural way. (A simpler, pure abbreviation system without types, is called Semipal

16


in the paper.) The terms used as strings are variables, constants or compound strings of the form f(a1,. . . ,an). De Bruijn takes some time to explain the rules for type respecting substitution which must be obeyed in a correct PAL-book. So-called PN-lines (the P N is for Primitive Notion) can be used for basic constants which cannot be defined in terms of previous ones. They may serve for the formalization of primitive notions (like N or the number 0) and axioms. There is a very important aspect in all this, that de Bruijn is very well aware of. Already in the beginning of the report he announces: “The way we handle propositions and assertions will be novel”. To be precise, he introduces and employs a formal version of what is known today as the propositions-as-types notion. As he says:

[...I we represent statements by categories. Saying we have a thing in such a category means asserting the statement. He elucidates this conception with an example concerning (defined) equality. (Note that equalities like “a = b” for set-elements do not fit in the basic linguistic equipment of the Automath languages; this so-called book equality, =, must be introduced as a primitive notion, together with the suitable axioms.) In this example he shows the following: if there is given an expression of type is(7,a, b) (that expression is to be interpreted as a witness for the equality of the elements a and b in the set v), then one can construct an expression of type is(q,b,a) (witnessing that b and a are equal), as well. De Bruijn adds the following remarks:

[...] the category [i.e. type] “is( k we have the extra condition that the (n- k)-th entry of the indicator string of b is either equal to u or contained in the indicator string of u. Let v1, ..., v k be the last k entries in the indicator string of b. We require, for i = 1,...,k , that

is definitionally equal (in the sense of A') to Ri. (If i = 1 we have t o read (1) as v:. If any of the v+ does not occur in A', we have to read (1) as type, and the condition is just that R; = type.) Under these conditions we proclaim b(C1, ...,C k ) to be acceptable at u, and we give it the category b+(C1, ...,C k ) . If b+ does not occur in A', the new expression b(C1, ...,C k ) is given the category type. One minor modification should be made: we promised that the category would not be an expression containing identifiers with plus signs. Therefore we replace b+(C1, ..., C k ) by the result of an application of a substitution such as described at the end of Sec. 4.7.

5. HOW TO USE PAL FOR MATHEMATICAL REASONING

5.1. In Section 4 we explained how to express things by means of PAL. Seemingly, expressing things covers only a small part of mathematics, for usually we are interested in proving statements. Mathematics has the same block structure as we have in PAL, but there are two ways to open a block. One is by introducing a variable that will have a meaning throughout the block, the other one is by making an assumption that is valid throughout the block. We shall be able to deal with the second case as efficiently as with the first one, if we represent statements by categories. Saying we have a thing in such a category

N.G. de Bruijn

86

means asserting the statement. This can be done in three ways: by means of -, or PN, or an expression. These three correspond to assertion by assumption, by axiom, by proof, respectively. 5.2. As an example we shall deal with equality in a n arbitrary category. The following piece of text introduces equality as a primitive notion, and states the three usual axioms. 0

t

E

X

Y

1

X

i

X

.-..-.....-

reflex asp 1 symm

:= :=

PN

1 2 3 4 5

-

6

:=

PN

asp 2 trans

:= :=

-

7 8 9

PN

10

Y is

Y asp 1 asp 1 z

asp 2

-

-

PN

.-.-

-

This book is not a nested one since line 5 does not belong to the block opened by y. Even so, the vertical bars, with an interruption at line 5 , can be helpful. We now show how this piece of text can be used in later parts of the book. Assume we have the following lines (in some order) in the book:

0 7 7 0

a

0 0

b known

.-....-.:=

.... .... .... ....

type

77 77

zs(v,a, b )

We wish to derive a line: 0

result

:=

....

is (77, b, a )

*

We have to find a definition part for this line. What we want is to apply line 7. The indicator string is (E,x,y,asp 1). In ordinary mathematical terms, we have to furnish a value for 5, a value for x , a value for y , and a proof for the statement obtained from “ x = y” by these substitutions. A proof for the statement means, in our present convention, something of the category is (71, a , b). Indeed we have something, viz. “known”. The reader can easily verify that 0

result

:=

symm(7, a, b,known)

is (77, b, a )

is an acceptable line. The above application was given entirely in context 0, but it can be done in any block that contains 77, a, b and known.

The mathematical language Automath (A.2)

87

We are, of course, inclined to see the categories as classes, and things having that category as elements of those classes. If we want to maintain that picture, we have to say that the category “is (t,z, y)” consists of all proofs for z = y. In this picture the usual phrase “assume z = y” is replaced by “let p be a proof for 2 = y”. Another aspect is that we have to imagine the category “is (t,z, y)” to be empty if the statement z = y is false. The latter remark points at a difference between these assertion categories and the “ordinary” categories like “nut” and “reul” in Sec. 4. In the spirit of the example of Sec. 4 it is vital to know what the expressions are, and it seems pretty useless to deal with empty categories. With the assertion categories it is different. The interesting question is whether we can find something in such a category, it doesn’t matter what. 5.3.

5.4. A modern mathematician has the feeling that asserting is something we do with a proposition. The author thinks that this is not the historic point of view. The primitive mathematical mind asserts the things it can, and is unable to discuss things it cannot assert. To put it in a nicer way, it has a kind of constructivist point of view. It requires a crooked way of thinking to build expressions that can be doubted, i.e. to build things that might or might not be asserted. A possible way to do this in PAL is to talk about the category “bool” consisting of all propositions, and to attach to each proposition an assertion category. We start the book like this:

’1 b

L:uE

.-..-.-

PN

:=

PN

type bool type

-

The standard interpretation is simple. If we write in a certain context

...

.-

....

TRUE(c)

,

where c is (in that context) a proposition, then the interpretation in every-day mathematical language is that we are asserting c. 5.5. In PAL we are able to write axioms and prove theorems about propositions (e.g. tautologies). In later parts of the book we will be able to use these axioms and theorems (just like the derivation of “result” in Sec. 5.2). This means that in a PAL book we are able to derive inference rules that can be applied later in that same book. As a very primitive example we shall write the following in PAL. After introducing bool and TRUE we introduce the conjunction of two propositions. We present some axioms concerning that conjunction, and we show that from z A y we can derive y A z. Finally we show how in a later piece of text the result can be used as an inference rule.

N . G . de Bruijn

88

bool

0 0 b

b

0

X

T R YE

X

Y

Y Y

and asp 1

asp 1 asp 2 Y asp 3 asp 3 asp 3 0 0 0 0

~

2; asp 3 ax 2 ax 3 theorem U 2,

known derived

._ .-

._ .~.........._ ..-

._ .-

PN

-

type bool

PN

type

-

bool bool bool TRUE ( x ) TRUE(Y) TRUE(and)

-

PN -

PN -

..PN ._ .PN .-.- ax l(y,x,ax 3,az 2) .-..... .._ .... ...... .-.- theorem(u,v,known)

TRUE( a n d ) TRUE(x) T R UE ( Y ) TRUE(and(y,x)) bool bool TRUE(and(u,v)) TRUE(and(v,u ) )

5.6. The reader will have observed from the above examples that we do not need to subdivide our text into parts like “theorem”, “proof”, “definition”, “axiom”. Every line is a result that can be used whenever we wish. It may require a large number of lines t o translate the proof of a theorem into PAL. (Needless to say, we can always try to reduce the number of lines, but that makes the lines more complicated and hard to read.) Some of the lines represent definitions of notions introduced only for the sake of the proof. Other lines represent subresults, usually called lemmas. The usual idea about theorems and proofs is, at least formally, that we are not allowed to refer to results obtained inside a proof. In PAL (and in Automath), however, we are free to use every line everywhere. We never announce a theorem before the proof starts, the result is not stated before it has been derived.

6. EXTENDING PAL TO AUTOMATH

6.1. I t was shown in Sec. 4 how we can deal with functional relationship in PAL. Once a function has been defined (either by P N or by definition in terms of previous notions) it can be applied. That is, a function f is introduced by saying what the value of f ( x ) is for every x of a certain category. And if we have, at a later stage, an expression C having that same category, it will be possible t o talk about f(C). A thing that we can not write in PAL, however,


89

is “let f be any function, mapping category C1 into category C2”. If we wish to deal with such mappings the way it is done in mathematics, we want several things: (i)

We need the facility of building the category of the mappings of C1 into

(ii) If f is an element of that mapping category, and if x is something having category C1, then we have to be able to form the image of x under f . (iii) If a mapping of C1 into C2 is explicitly given in the PAL way then we have to be able to recognize that mapping as a member f of that mapping category. (iv) If we apply (ii) to the f obtained in (iii), we can (making z a block opener) obtain a function given in the PAL way. This function should be equivalent to the one we started from in (iii).

6.2. Let us consider (iii) more closely. The “PAL way” of giving a function is the following one: We have somewhere in the book

X

x

:=

- C1

u

:=

A

C2

1 2

where A is an expression possibly depending on x. (That is, its normal form may contain z) But it is only fair to remark that C2 may also depend on x; C1, on the other hand, can not contain x. Let us assume that neither C1 nor C2 is the symbol type. The mapping described here attaches to every x of type C1 a value depending on x, which value has category also depending on x. We shall use the notation

[x: El] C2 for the category of this mapping, and [X : El] A

for the mapping itself. There is an objection against using the old identifier x for this new purpose, and therefore we replace it by a new identifier t. This t will never occur as identifier part of a line. It is called a bound variable, and we may assume that it will be used here, but never again. We shall write i2,(E)A for the result of substitution of C for x in the expression A . (It should be remarked that A may contain x implicitly, which can happen if the above block contains lines between line 1 and line 2. In order to

N.G. de Bruijn

90

make such implicit occurrences explicit, we have to transform A by application of definitions up to a point where further implicit occurrence is impossible.) We can now phrase the rule of functional abstraction: In Automath we have the right to deduce from lines 1 and 2 the acceptability of the line U

...

.._

[t : El] R,(t)A

[t : Ci] &(t)C2

Accordingly we have the right to consider [t : El] O,(t) we have (if C1 and Cz are expressions) U

z

X

w

:= :=

-

CZ

C2

3

as a category. So if

4

C1 type

5

we have the right to add U

...

.-

[t : Ell %(t)&

type

6

This makes it possible t o open a new block with 21

f

:

=

-

It : El] R,(t)Cz ,

7

that is, we can start an argument with: let f be any mapping of the described kind. We also have the possibility to write line 7 with PN instead of -. 6.4. Now returning to point (ii) Sec. 6.1, we introduce the following rule. If we have a line

and also a line U

...

..-

A

El

9

then we take the liberty t o write U

...

:=

(~)r

R,(A)c~.

10

The interpretation is that (A) I? is the result of the substitution of A into I?. We write this instead of r ( A ) since, in the case that I' is a single identifier, the latter notation already had an entirely different meaning in PAL: it was used t o change context. That is, r(A) is the mapping we obtain from r if we substitute A for u, and it is even questionable whether this is possible, since u need not be of category C1. 6.5. In connection with this notation ( ) we take the liberty to extend the notion of definitional equality by the following pair of rules:


91

(i) If C1, C2, C3 are expressions, where C2 contains the bound variable t, but C1 and CJ do not, then we postulate the definitional equality of

That is, it does not make a difference whether substitution is carried out before or after functional abstraction. (ii) If C1 and C2 are expressions that do not contain the bound variable x,then we postulate the definitional equality of

The above rules (i) and (ii) explain why we prefer to write (z) f instead of f (x). By way of these rules, (x)f is in agreement with the convention [t : C1]C2 for functional abstraction, and the latter is in agreement with the general mathematical habit to write quantifiers like VXESl

UXES,

n,=, m

to the left of the formulas they act on. 6.6. The description of Automath in the preceding sections was not as complete

as the description of SEMIPAL and PAL in Sec. 4. For a complete and more formal definition of Automath we refer to the report mentioned in Sec. 1.2.

7. HOW TO USE AUTOMATH FOR MATHEMATICAL REASONING

7.1. If we write elementary mathematical reasoning in PAL as described in Section 5, one of the first things we can not do is to derive an implication. There are two things we wish to do with implication, and only one of the two can be done in PAL. First assume we have introduced implication as a primitive notion, then it is easy to write "modus ponens" as an inference rule:

N.G. de Bruijn

92

0 0 b b

bool b TRUE

C

impl

C

C

asp 1 asp 2

modpon

...-.._ ..-.._ ....._ .-

PN

type

-

bool

PN

type

-

PN -

PN

bool bool TRUE(b) T R UE(impl) TR UE(c)

By means of this piece of text we are able to use the inference rule

A, A = + B B in all possible situations. The second thing we want to do is this. If we have 0 0

P

._ .-

.-.-

....

bool

....

bool T R UE (PI TRUE(q)

....

9 10 11 12

(it might have been given in any other context instead of 0) then we want to construct something in TRUE(imp1 ( p , q ) ) . This cannot be done by means of the rules of PAL. The problem can be solved in Automath, however. We first say that if we have a mapping from TRUE(b)into TRUE'(c),then impl(b,c) is true:

.. .. [ x : TRUE(b)]TRUE(c) TRUE(imp1)

C

13 14

Using the axiom, and functional abstraction, we can derive from lines 11, 12 0 0

first

:=

[y : TRUE(p)]then(y)

second

:=

axiom(p,q,first)

[y : TRUE(p)]TRUE(q) T R (impl(PI q )

15 16

That is, we have derived an assertion of impl ( p ,q). So we have the inference rule

A B

-

A=+B available in all possible cases. If we wish, we can write the application of this inference rule in one line instead of two, viz.


0

...

93

axiom(p,q,[y : TRUE(p)]then(y))

:=

TRUE(impl(p,q)) 17

As a second example we introduce the all-quantifier for a predicate P on an arbitrary type )sucf

+

144.))

.

The relation = is the smallest equivalence relation which contains relation is called definitional equality.

+. This

Interpretation. Two expressions which are definitionally equal can be thought to denote the same object.

L.S. van Benthem Jutting

258

Examples. (i)

D

3a = 3c because 3a

--*

suc(2) and 3c --H suc(2).

-W

suc(suc(1)) and 36 + suc(suc(1)).

D

(ii) 3a = 36 because 3a

D

D

D

(iii) 36 = 3c because 3a = 3c and 3a = 36.

Exercises.

D

(i) Prove that 3a = (l)plus2f.

D

(ii) Prove that plus2 f = [z ] plus2(z).

6. TYPING

Up till now we have presented an “untyped version” of AUT-68. This has some drawbacks. We mention: (i) According to the rules, we could write in our book on an empty context the expression comp(l,2), which would reduce to [z ]((z)suc(l))l. This expression does not have an intuitive interpretation. (ii) Some queer phenomena can be observed concerning reduction. When we then we observe that this try to P-reduce the expression ([z ](z)z)[z ](z)z, expression reduces to itself. These drawbacks can be removed by taking into account the “functional structure” of the various objects. For any object we want to administrate whether it is a function and, if so, what is its “domain” and its “range”. Moreover we require that only functions can be “applied”, and only to objects in their domain. This book-keeping is attained by typing. Adding types to expressions gives the language AUT-68. In AUT-68 the objects (indicated by expressions) are divided into disjoint classes, called types. These types themselves are also indicated by expressions. We start by giving some definitions and conventions in our metalanguage. Expressions indicating objects are called 3-expressions. Expressions indicating types are called 2-expressions. The new word ‘type’will be called a 1-expression. In the metalanguage 3-expressions are indicated by capitals: A , B,G, ... and 2expressions by Greek letters: a,P, y, .... (Occasionally we will deviate from this convention, but we will be explicit about such a deviation). The 2-expressions

Description of AUT-68 (B.1)

259

have the same syntactical structure as the 3-expressions. They can be variables, head expressions, abstraction expressions and application expressions. For any expression it will be clear (from the environment) whether it is a 3-expression or a 2-expression, and, if it is a 3-expression, what is its type. In the language we will have formulae:

A :a a : type

to be interpreted as ‘ A has type a’, and to be interpreted as ‘a is a type’.

7. CONTEXTS AND LINES In some cases typing changes the rules of the language as given above. (i)

Contexts, object variables and type variables. For variables in the context it should be indicated what is their type. If the variable is a 3expression its type is given together with its introduction: [z : a], if the variable is a 2-expression this is indicated by [y : type]. Example. So a possible context is [z : type][y : z].

(ii) Expressions. Also abstracted variables are given with their types. So clause (iii) in Section 4 becomes: If A is a 3-expression in context [z : ..] [y : ..I [z : a ] ,with z a 3-expression, then [ z : a]A is a 3-expression in context [z : ..] [y : ..I. In the same way we can form a typed 2-expression [ z : 010. Note that the abstracted variable z is always required t o be a 3-expression. The same requirement is made for the argument of an application expression. (iii) The content of a line. As we explained in Section 3, the content of the line gives meaning to a name. It will now also include type information, with the semicolon as separation symbol. -

The name could indicate a primitive object. In this case the type of this object should be made clear, so the content gets the shape PN

-

: a .

The name could also indicate a primitive type. In this case the content is

PN

: type.

Example. A book in AUT-68 on natural numbers could start with the lines

L.S. vaa Benthem Jutting

260

nat 0 1 0 [x:nat] suc(x)

:= PN := PN := PN

: type :

:

nat nat .

In these lines nat has been introduced as a primitive type, the type of natural numbers. After that 1 and the successor have been introduced as primitive objects of type nat. We could now, for an arbitrary natural number n, introduce the ndimensional space Rn as a primitive type, and then in any R” the zero vector as a primitive element. [ n :nat] R(n) [ n :nat] O(n) -

:= PN := P N

: type : R(n)

.

The name could also indicate a defined object, or a defined type. In that case the content of the line will be a formula:

A : a or a : t y p e . Example. Our book on natural numbers could be extended as follows:

0 0

2 := 3a := [z : nat] plus2(2) := 0 3b :=

suc(1) suc(2) suc(suc(z)) plu82(1)

nat : nat : nat : nat. :

8. THE TYPING OPERATOR It will be clear that we don’t want to accept as last line in the book above

0

36

:= plus2(1)

: R(2).

That this is not acceptable can be checked “mechanically”. In fact it is possible to calculate for any object (denoted by a 3-expression) its type. There is an operator r mapping 3-expressions to 2-expressions in such a way that for any 3-expression A we have A : r ( A ) . We define r by cases: (i)

A = x, a variable. Then x is given, either in the context or within an expression, together with its type a as [z : a],and we have ~ ( z= ) a.

(ii)

A = a(B,C), a head expression. Then there is a line in the book shaped either

Description of AUT-68 (B.l) [z : ..][y : ..] a(z,y)

:=

26 1

E

: a

or [z : ..][y :

.I

a(z,y)

:= P N

: a

and we have 7(a(B,C)) = a [z, y := B, C].

Example. ~ ( p b s 2 ( 1 )= ) nat [z := 11 = nat and T ( O ( 2 ) ) = R(n)[n:= 21 = R(2). (iii) A = [z : a ] B ,an abstraction expression. A should be interpreted as a function, the variable z has its type a associated to it also inside this expression. The function A has as its domain a and as its codomain the type of B. We define in this case ~ ( [ :za ] B )= [z : a]7(B).

Remark. [z : alp should therefore be interpreted as “the type of the functions mapping a to p’. So [z : alp does not represent a function! Complication. As we have seen types could depend upon parameters: we have introduced the type R(n) depending on the parameter n. This gives us (in our interpretation) a “sequence of types” R(1), R(2), ... but this sequence cannot be coded by an expression in our language. We have however: T ( [ Z : nat]O(z)) =

.

[z : nat]7(0(z)) = [z : nat]R(z)

So we see that [z : nat]R(z)should be interpreted as “the type of the functions associating to every n E N a vector in R(n)” that is “the Cartesian product R ( l ) x R(2) x ...”. Summarizing. - [z : a ] Bshould be interpreted as a function. If z does not occur in B it

is a constant function. - [z : a10 should be interpreted as a Cartesian product. If z does not occur

in p it is isomorphic t o

pa, the class of functions from a to p.

(iv) A = ( B ) C ,an application expression. ) (B)T(C). We define T ( ( B ) C=

L.S. v m Benthem Jutting

262

We can now formulate our requirement on the content of a line in the book:

D

A : a is acceptable as the content of a line only if T ( A ) = a . Example. We could extend our book with the following lines.

0 0 0

sucf idf

:= [z : nat]suc(z) := [ z : natla:

3c

:= (2)sucf

[f : [z : nut]nat][g : [z : nut]nut] c o w ( f , g ) := [.: natI((4g)f 0 plus2 f := comp(sucf, sucf) 0 Of := [z : nut]O(z)

: [z : nat]nat : [ z : nat]nut : nut : [z : nat] nat : [ z : nat] nat : [ z : nut]R(z).

Note that [z : nut] nut is “the type of the functions nut -+ nat” and [z : nat]R(z)is “the Cartesian product of the types R(z)”.Note also that in the line introducing 3c we have: ~ ( ( 2 ) s u c f= ) (2)7-(sucf)= (2)[z : nat]nat -‘p

nat .

Nota bene. In the line above again [z : nat]nut should be interpreted as the Cartesian product of a countable set of copies of N . Then (2)[z : nat]nut must be interpreted as the second copy of N , and not as some function applied to 2. Hence application on 2-expressions represents selection of a coordinate axis in a Cartesian product, and &reduction represents computation of such a coordinate axis.

9. CORRECTNESS We now want to restrict the class of our expressions in such a way that no expressions occur which can not be interpreted. We have no interpretation for the expression (2)l because “1is not a function”, and we have no interpretation for camp( 1,2) because “1and 2 are not functions”. In the latter case we say that the sequence (1,2) does not fit in the context [f : [z : nat]nat][g: [z : nat]nat], that is the context of the line in which comp has been defined. We will now define what fitting means. In our definition A , B and C represent either 2- or 3-expressions (deviating from the notational habits introduced in Section 6).

Definition. The sequence ( A , B , C )fits in the context [z : ..][y : if we have:

. I[.

:

..]

Description of AUT-68

(B.1)

263

or A and 2 are both 2-expressions, or B and y are both 2-expressions, T ( B )= ( ~ ( y ) [z ) := A] T ( C )= ( ~ ( z ) )[z, y := A, B] or C and z are both 2-expressions.

T(A) = ~ ( z )

Similar definitions can be given for longer or shorter sequences and contexts. The definition is complicated because substitution is involved. That this should be the case can be demonstrated by a context like [z : type][y : z]. A sequence fitting in this context is (nat,2) and a sequence not fitting in it is (nat, sucf). Now we can define correctness of 2- and 3-expressions relative to a given book and a given context. (i)

If [z : type] is in the context, then z is a correct 2-expression. If [z : a]is in the context, then z is a correct 3-expression.

(ii) If A, B and C are correct, A, B and C being 2- or 3-expressions, and if (A, B,C) fits in the context [z : ..][y : : ..] then we have:

.I[%

- If either

[z : ..][y :

. I[.

:

..I

a(z,y,z):=

PN

: type

or [z : ..][y :

. I[% : ..I

: type

a(z,y,z):= a

is a line in the book, then a(A, B, C) is a correct 2-expression. - If either

[z : ..][y :

..I[% : ..I

a(z, y,z):= P N

..I[%

a(z,y,z):=

: a

or [z : ..][y :

: ..]

D

: a

is a line in the book, then a(A, B, C) is a correct 3-expression. (iii) If a is a correct 2-expression in the context [z : ..][y : ..I then we have:

. I[.

: a],then [z : alp

B is a correct 3-expression on context [z : ..][y : . I[. is a correct 3-expression on context [z : ..][y : ..I.

: a], then [ z : a ] B

- If ,Cl is a correct 2-expression on context [z : ..][y : is a correct 2-expression on context [z : ..][y :

.I.

- If


264

(iv) - If cr is a correct 2-expression, B is a correct 3-expression and a D = [z : T(B)]Pfor some p, then (B)ais a correct 2-expression. Note that cr represents a Cartesian product of types and ( B ) ais a coordinate axis.

A and B are correct 3-expressions and if T ( A ) D = [z : 7(B)]Pfor some p, then ( B ) A is a correct 3-expression. Note that A is a function with domain T ( B ) ,because D T ( A ) = [ z : 7(B)]P.

- If

Finally we have the general requirement:

All expressions occurring in our book must be correct. Example. This holds for our present book:

0 0

nat 1

(z : nat] suc(z)

[ n : nat] R(n) [ n :nat] O(n)

0 0

2 3a

[z : nat] plus2(z) 3b

0 0 0 0

sucf idf

:= := := := := := := := := :=

PN PN PN PN PN

suc(1) suc(2) suc(suc(z)) plus2(1) [z : nat] suc(z) := [ z : natlz

3c := (2)sucf [f : [z : nat] nat][g: [z : nat] nat]

0 0

10. LAT

comp(f19) := .1 : n a t I ( ( 4 9 ) f := comp(sucf sucf) plus2 f Of := [z : nat]o(z)

: : : : : : : : : : : :

type

nat nat type

R(n) nat nat nat nat [z : nat] nat [ z : nat] nat nat

: [z : nat] nat : [z : nat] nat : [z : n a t ] R ( z )

GI AGE THEORY IN A NUTSHELL

The main problem in verifying the correctness of a book is deciding definitional equality. Therefore the language theory of Automath, which was developed mainly by Nederpelt and van Daalen, concentrates on definitional equality and reduction.

Description of AUT-68 (B.1)

265

An expression is called normal if it cannot be reduced by a p- or &step. An expression is called normalizing if it reduces t o a normal expression. An expression A is called strongly normalizing if there is no infinite sequence A l , A2, ... such that A + A1 + A2 + ... . The Church-Rosser property holds for A if we have: if A + B and A + C , then there exists an expression D such that B -H D andC-HD.

A.

Figure 1 If the Church-Rosser property holds for A then there is at mos6 one normal expression B such that A + B. If moreover A is strongly normalizing, then B will be reached in a finite number of steps, no matter which reduction strategy might be chosen. For many Automath languages (including AUT-68) it has been proved that the Church-Rosser property and strong normalization hold for all correct expresD sions. This gives us “theoretical” decidability for the relation =. For “feasible” decidability it is necessary that the verifying program uses a practical strategy. Deciding definitional equality by reducing expressions until they are normal is not practical!

11. SOME TECHNICAL REMARKS

(i)

Context administration. Contrary t o what has been said before, it is customary in Automath to extend context in separate lines, which are called context lines. In other lines it is possible to refer to such context lines by a context indication. This context indication is separated from the name which is defined in the line by the symbol ‘@’ . The empty context is indicated by writing nothing before the ‘62’.Lines which do not contain a ‘62’have the context of the previous line. We will illustrate the customs with an example.


266

.-.- ... .-.- ... .-.- ...

@ C

Y

@ d(z,y)

2

@ e(z) [z : 61

context extension (on 0 ) the context is [z : a][y: p][z: 71, as introduced in the previous line the context is [z : a][y: p][z : 71, the context of the previous line the context is 0 the context is [z : a][y: p] the context is [z : a] context extension (on [z : a], the context of the previous line) the context is [z : a][z: 61 the context is [z : a][y: p] the context is [z : a][z: 61 context extension (on [z : a][y: p] ) context [z : a][y: p][t: .

4

(ii) Omitting variables. Contrary to our presentation in Section 3 (ii), the variables in the context will not be mentioned behind the name. So we will not write in the text of our last example a(z,y,z)

:= ..., b(z,y,z) := ..., y @ d ( z , y ) := ... etc.

but

a := ..., b := ..., y @ d := ...etc. Moreover it is possible to omit variables from the context behind names in other places, starting with the first variable. Suppose, for example, that the name a has been defined in the context [z : a][y: p] then in following lines a(z,A) can be abbreviated to a(A) and and a ( z , y )to a. Note that a(A,y) can not be abbreviated! (iii) The shape of names; prefix, infix and postfix symbols. Every string of upper or lower case letters, digits and the symbol '-' can be used as a name.

Examples. de-Bruijn, 1-9-81, A UT-68. Such names can also be used for variables. It is practical to choose for variables one-letter names and for defined names longer words, which are expressive of the concept they represent. In order to make texts more readable for humans it is allowed to introduce prefix, infix and postfix names. There are two kinds of such names:

Description of AUT-68 (B.l)

267

=, +, -, *, I, &. anything which is written in quotes, e.g. ‘(’, ‘+-’,

-

A number of special symbols, including

-

Nearly

‘or’, ‘= N ’ .

Prefix, infix and postfix notation are introduced showing (one or two) variables.

Examples. Q [z : nat] Q [z : nat]

z‘!’ -z

:=

...

.- ...

62 [z : nat][y: nat] z + y := ... Q [z : nat][y: nut] z = y := ...

introduces the postfix symbol ‘!’ introduces the prefix symbol -

+

introduces the infix symbol introduces the infix symbol =

+

Now in following lines 2‘!’, -3 and 2 1 are expressions. There are no precedence rules, for parsing parentheses are needed: 1 2 3 is not allowed, neither is 1 2 = 3.

+ +

+

(iv) The symbol $ is used for “end of line”.

Example. As an illustration we present our book once more with the conventions just given. We have changed some of the names into infix and postfix symbols. Q nat 1

:= PN := PN

: type : nat

:= PN

:

[x: nat] ‘suc’ Q [n: nat] 2

Q

x Q Q

Q

R := PN 0 := PN 2 := 1 ‘suc’ .3a .- 2 ‘SUC’ plus2 := (z ‘suc’) ‘SUC’ 36 := plus2(1) sucf := [x : nat](z‘ S U C ’ ) idf := [ z : natlz 3c := (2)sucf [f : [z : nat]nat][g: [z : nat] nat] f ‘0’9 := [z : nat]((z)g)f plus2f := sucf ‘0’ sucf Of := [z : nat]O(z)

: : :

: : : : :

: : : :

$ $ $ nat $ $ type $ R(n) $ nat $ nat $ nat $ nat $ [ z : nat]nat $ [ z : nat]nut $ nat $ $ [z : nat]nat $ [ z : nat]nat $ [ z : nat]R(z)$

Finally it should be mentioned that in other papers on Automath other notations have been used. We mention:

L.S.van Benthem Jutting

268

for P N for context extension [z : a] for context extension [z : a]

pram x := E B : a 2

:=

-

:ff

(in such notations only one variable per line can be added to the context) for for for for

(A)B [z : a ] B A : cy @.

12. LOGIC

As our aim is t o describe mathematics in Automath, the question arises how to represent logic. In this section we present an Automath text introducing logic in a Natural Deduction style. The lines of this text will be numbered for referencing, and comments can be found in Section 13 below. Q

Prop

:=

PN

b : PrOPllq : ProPl[T : PWPI p Q Pr := PN 0 [ A :type] PRd

:=

[z: Alprop

[P : P 4 4 l All := PN [u : [z: A] Pr( (z) P)] := PN Akin P Q [ti : Pr(All(A,P ) ) ] [ u: A] := PN All-el spec := All.el(u,a) 9

Q

P'-"Q

:= AZl(Pr(p),[z: Pr(p)]q)

[u : [z: J Y P ) I Pr(q)l Imp-in := A l l i n ( P r ( p ) ,[z: Pr(p)]q,u) q Q [u : Pr(p'+'q)][v : Pr(p)] Imp-el := All.el(Pr(p), [z: P r (p )] q,u,v ) := Imp_el(u,v ) mod g o n p Q reflImp := Imp_in(p,p,[z: P r ( p ) ] z ) r 0 [u : Pr(p'+'q)][v : Pr(q'+'r)]

trans-Imp

: type

: type

: type

$ $ $ $

1 2 3 4

$

5

:

6 7 8 Pr(All(A,P)) $ 9 $ 10 Pr((a)P) 8 11

:

Pr((a)P)

: PWP

:

: prop

$ $ $

$

12

13 14 $ 15

$

$ :

Pr(p'-.'q)

16 17 $ 18 $

Pr(q) : W q ) : Pr(p'+'p) :

$

$

19

$

20

$

21

:= I m p i n ( p ,r ,

.1

: Pr(P)lImP-el(q,rr v , ImP-eZ(P,9 , u,

:

PT(P'"T)

Description of AUT-68 (B.l) Q Fls p Q [u : Pr(FZs)] Fls-el

:=

269

All(prop, [z: proplz)

:

$

22 23 24 25 26 27 28 29

$

30

$

31

$ $

All-el(prop, [z: prop]z,u,p) := p'+'Fls p Q 1-'p [u : [z: Pr(p)]Pr( Fls)] Not _in := Zmp-in(p, F l s , u ) q Q [u : Pr(' - 'p)][v: Pr(p)] Not _el := Fls-el(q, Zmp-el(p, F l s , u , v ) ) q Q [u : Pr(' - 'p)] n-antec-soimp := Zmp_in( :=

$

P.(P) : prop :

$ $

: Pr"-

'p)

$ $

:

: .[ : Pr(p)lNot-el(p,49% q)l conseq-so-imp := I m p i n ( [ z : P r ( p ) ] u ) : p Q [u : Pr(' - '(' - ' p ) ) ] := P N dble-negdaw : q Q [u : Pr(p'+'q)][v : Pr(' - 'q)] mod.to1 := trans_Zmp(p,q, Fls, u, v ) : u Q contrapos-1 := Imp_in(' - 'q,' - 'p, [z: Pr(' - 'q)]rnod-tol(p,q,u,z)) :

Q

prop

P,(q)

Pr(p'-+'q)

$ 32

Q [ u :W

Pr(p'+'q)

$ $

P.(P)

$ $

Pr('- 'p)

$

Pr((' - 'q)'+'(' - ' p ) ) $

q Q [u : Pr((' - 'p)'+'('

contrapos-2

33 34 35 36 37

- 'q))]

$

38 39

:= Imp_in(q,p,[z: Pr(q)]

dbl-neg_law(p,Not.in(' - 'p, [y : Pr(' - 'p)]Zmp_el(q, Fls, 9 Q P'v'q

Imp-el(' - 'p, := - 'p)'+'q

- 'q, u, y), z))))

(1

: Pr(q'-+'p) : prop

b:W P ) l Or-in-1

40 $ 41 $ 42 $

:= Zmp_in(' - 'p,q,

[z: P r ( ' - 'p)]Not.el(p,q,z,u)) : Pr(p'V'q)

$

q)l Or-in-2 := conseq_so.imp(' - 'p, q, u ) : Pr(p'v'q) r Q [u : Pr(p'v'q)][v: [z: Pr(p)]P r ( r ) ] [ w: [z: Pr(q)]P r ( r ) ] Or .el := dbl-neglaw(r, Not.in(' - ' r , [z: P r ( ' - 'r)]Zmp.el(r,Fls,z, (Zmp-el(' - 'p,q, u, Not_in(p, [y : Pr(p)]Zmp.el(r,F l s , I, (Y)V))))W))) : Pr(r) pr f .byrases := Or-el(u,v,w ) : Pr(r)

$

4

Q

.[

:W

43 44 $ 45 $ 46

47 $ 48 $


270

q Q [ U :PT(p'V'q)]

Com-OT

$

49

:= OT-el(q'V'p,u,

[z: PT(p)]OTin-Z(q,p,Z), [Z: PT(q)]OT-Zn_l(q,p,Z)) [U : [Z : PT(' - 'p)]PT(q)] := Imp_in('- ' p ,q,u) O~in-3 4 @ ['U : [Z : pT(' - ' q ) ] PT(p)] Orin-4 := c o m D r ( q , p , O r i n 9 ( q , p u , )) Q Q ['U : PT(p'v'q)][V: P?'(' - 'p)] := Imp_el('- ' p ,q, u, v ) not-case-l Q 0 [U : pT(p'v'q)][V: Pr(' - 'q)] := not_case_l(q,p,c o m D r ( u ) ,v ) not-case-:! Q

Q

13. COMMENT In this section comment is given on the text in Section 12. We give the comment line by line. (1)

prop is the type of the propositions.

(2)

We introduce three propositions p , q and r for future use.

(3)

If p is a proposition then we can assert p , i.e. we can say that p holds. In Automath assertion is treated by introducing proofs as objects. Logic could also be treated in other ways in Automath, but this method is rather natural. For every proposition p we have the type of the proofs of p : propositions correspond to types (of their proofs). The type P r ( p ) should be considered as the type of the proofs of p . Then u : P r ( p ) should be interpreted as ' u is a proof of p' or ' u proves p'. Now we have three methods for introducing proofs: (i)

As a variable in a context:

...[u : P r ( p ) ] . The interpretation is: 'let u be some proof of p ' , or, in other words, 'assume p'. (ii) As a primitive object: y @ ax

:= PN

:

WP)


(B.I)

271

The interpretation is: ‘ax is a primitive proof of p’ or, in other words, ‘ p is an axiom’. (iii) As a defined constant, abbreviating an expression: y @ th

:= B

:

P.(P)

The interpretation is: ‘ t h denotes the proof of p which is given by the expression B’, or ‘ p is a theorem (with proof El)’. (5)

Let A be a type. A predicate over A is a function which associates to every object x of type A a proposition, that is: a predicate is a function of type [z : A] prop.

So we define pred := [x : A] prop. Then we have: if P : pred(A) then P is a predicate over A . Note that for a : A the proposition ( a ) P means that P holds at a. (7)

Universal quantification. The universal quantifier turns a propositional function into a proposition.

After having introduced the universal quantifier we should fix its meaning. We do this by giving two rules for using it: (i) A rule from which we can conclude that the proposition holds. Such a rule is called a n introduction rule. (ii) A rule that tells us how we can use the fact that the proposition holds. Such a rule is called an elimination rule. (9)

Ad (i). Introduction rule. How do I find a proof for A11(A,P ) , in other words, how do I find an object in P r ( A l l ( A , P ) ) ? Intuitively this is the case if for any x : A I have a proof for ( z ) P ,in other words, if for any x : A I have an object in Pr( ( x ) P ) .That is, if I have a function in (the Cartesian product) [z : A] P r ( ( z ) P ) . This intuition is captured in the (primitive) introduction rule All-in.

(11) Ad (ii). Elimination rule. How can I use the fact that I know A11(A, P)? Intuitively I can use this if I have an object a : A . In that case I can deduce ( a ) P . Again this intuition is captured in the (primitive) elimination rule All-el. In logic the rule is known as specialization.

Remarks. (i) The rules All-in and All-el are each others inverse. They express a link between functions u : [x : A] P r ( ( x ) P )and objects w : P r ( A l l ( A ,P ) ) .


272

(ii) The logical system which associates to the various logical operators the introduction and elimination rules which express their meaning is called

Natural Deduction. (13) Implication. Let p and q be propositions. We consider a predicate over the type P r ( p ) - i.e. the type of proofs of p - namely the predicate [x : P r(p)]q,which associates to every proof of p the proposition q. This is, in a sense, a “constant predicate”, because x does not occur in q. What would be the meaning of A ll(P r (p ),[z : P r ( p ) ] q )? This would be that for any proof x of p we have a proof that q holds. In other words, if p holds, then also q will hold, that is p implies q. This is therefore our definition of implication p ‘+’q. (15) With this definition we can derive the introduction and elimination rules for p ‘+’q.

Introduction rule. We can deduce that p ‘+’q if for any proof of p we have a proof of q, i.e. if we have a function mapping proofs of p to proofs of q, i.e. if we have an object of type [x : P r ( p ) ]P r ( q ) . We have

With the definition given it follows that

D

I m p i n ( p , q , u ) : P r ( A l l ( P r ( p ) ,[z : P r ( p ) ] q ) )= Pr( p‘+’q)

.

(17) Elimination rule. This is the well-known rule modus ponens. Check that the definition is correct. (19) Now we can prove p ‘-+’p. (21) We assume p ‘+’q and q ‘+’r and prove p ‘+’r. (22) Contradiction. We define the contradiction Fls as: “all propositions hold”. (This is in fact a definition in second order logic). (24) From the definition of Fls its elimination rule follows: If we have a proof of Fls we have a proof for any proposition p . (25) Negation. We define ‘ - ’ p t o mean p ‘+’Fls.


(B.1)

273

(27) Introduction rule. If we have an object of type [z : P r ( p ) ]Pr(F1s) then we can conclude ' - ' p . (29) Elimination rule. If both p and ' - ' p hold then any proposition q will hold. (31) Now we assume ' - ' p and we deduce p'+'q : the antecedent does not hold, so the implication does. (33) Also we assume q and deduce p '+'q : the consequent holds, so the implication does. (35) We add a new axiom, the double n e g a t i o n law : Assume ' - '(' - ' p ) then we have p .

This gives us classical logic. Without this axiom we have a system for (second order) intuitionistic logic. Now we give some theorems on implication and negation:

(37) Modus tollens: assuming p '+'q and ' - ' q we deduce ' - ' p . (38) The first form of contraposition: assuming p '+'q we deduce (' - ' q ) '+'('

- 'p).

(40) The second form of contraposition, which is the converse of the first form: assuming (' - ' p ) '+'(' - ' q ) we deduce q '+'p.

(The proof uses the double negation law.)

(41) Disjunction. We now define disjunction: p'V'q := (' - 'p)'+'q, (43) We derive two introduction rules and a n elimination rule for p'v'q.

Introduction rule 1. Assuming p we conclude p'v'q. (45) Introduction rule 2. Assuming q we also conclude p'v'q.

(47) Elimination rule. This is the way of reasoning which is called "proof by cases". If we have p'v'q and if we can deduce T from p and also from q, then we can conclude T . In our formalism: If

u : Pr(p'v'q), v : [z : Pr(p)]P T ( T )and w : [z : P r ( q ) ] P T ( T )

then O r . e l ( p , q, T , u, v,w ) : P r ( r ) . Note that v is a function from proofs of p to proofs of is a function from proofs of q to proofs of T .

T,

and similarly w


275

AUT-SL, a Single Line Version of Automath N.G. de Bruijn

1. INTRODUCTION We can write Automath in a form as studied in [Nederpelt 71a], called XAutomath. This amounts to abolishing block openers and indicator strings, writing everything in the form of abstractions; some of these abstractions are not necessarily legitimate in Automath itself. Moreover, expressions like b(&, C1, C B ) are replaced by things like {&} {Cz} {El} B, where B is not the same as b, but related to B by means of obvious abstractions. We can go further along this line: First we can abolish all definitions, i.e. all letters expressed by means of a line with a middle part other than PN or EB [EB indicates the bar used as middle part in a block opening line]. A next step is to abolish PN’s: Being under the reign of a given axiom can be interpreted as living in a block where the axiom is a block opener. For example, the book following

bool

:=

PN

type bool TRUE := PN type can be compared with a book preceded by the quantifier string

lb

._ .-

-

[bool : type] [true : [z : bool]type] .

( 1)

(2)

The latter seems to be, in some sense, stronger than (1). The form (2) has the following feature: If we have some model for (1) (i.e. a type p and a mapping 7 attaching a category to every object with category p), then the rest of the book can be applied to that model just by substitution. In the form (l),however, such conclusions can only be made metamathematically: every proof of the book following (1) can be rewritten, by trivial translation, as a proof of a statement about such a model. Since we are abolishing all definitions, or, what is the same thing, abolishing all abbreviations, any interesting line of an Automath book can now be written \ and read independently of the preceding book: all necessary information is to be condensed in that line.

N . G . de Bruijn

276

There is a further extension, to be explained now. In Automath we have three kinds of expressions. First, there is a single 1-expression, viz. the expression “type”. (In AUT-QE, an extension of Automath, we have also 1-expressions like [z : nat] [y : bool] type.) Next there are 2-expressions1 as C in a line like

a := C

type.

Finally, we have 3-expressions like 0 in a := C b := 0

type C

But we do not admit, in Automath, 4-expressions like r in

a := C b := 0 :=

type C

r

0 .

In AUT-SL, there is no such restriction. In AUT-SL, we write quantifier strings like

[a : type] [b : a] [c : b] [d : c] corresponding to a := -

I,

b := c := d :=

type

a b

~

C

-

There are two aspects in which AUT-SL deviates from Automath. First we do not consider q-conversion in AUT-SL. That is, we do not admit reduction of [z : A] {z}f t o f (if z is not free in f). It would not be hard, however, to modify AUT-SL such as to admit 77-conversion. A second difference seems to be more serious. In Automath we have the following. If the book contains

x :=

-

q :=

...

A type

we may write

... .- [t : A] q ( t ) *-

type

.

In AUT-QE, however, we may write (3) as well as (4):

...

:=

[t : A ] q ( t )

[t : A] type .

AUT-SL, a single line version of Automath (B.2)

277

In AUT-SL we are more strict: we allow (4) but we forbid (3). This convention makes the language somewhat simpler. It seems to be a good strategy to study this simpler case in every detail before returning to Automath. We shall define AUT-SL by means of a program that checks the correctness of an AUT-SL line. The program produces the “normal form” of a given expression, and it produces, if possible, the category of that expression. It either accepts or rejects: it can be shown that the program will never run indefinitely.

2. THE SYNTAX OF AUT-SL

The syntax is very simple. We have two sets of symbols: “dummies” and “signs”. The set of dummies is infinite; they are different from the signs. The signs are given by (sign) ::= >

I 1 I 1 I { I 1 I type

We can now define “expressions”, “quantifier strings” and “expression tails” recursively: ::= (quantifier string) (expression tail) (expression) (quantifier string) ::= I [(dummy) : (expression)](quantifier string) ::= type I (dummy)I {(expression)} (expression) (expression tail)

Our program will attach a normal form to any expression it finds acceptable. These normal forms are ‘‘normal expressions”; their syntax is given by (normal expr) ::= (normal quant str) (normal expr tail) (normal quant str) ::= I[(dummy) : (normal expr)] (normal quant str) (normal expr tail) ::= type I(dummy)I {(normal expr)} (normal expr tail) The consequence is that in normal expressions the “}” is never immediately followed by a The handling of dummies (i.e. the answer t o the question of which occurrences of a dummy are bound by which quantifiers) is as explained in [de Bruijn 70b], with the simplification that parentheses “(”, “)” do not occur.

‘‘r.

N.G. de Bruijn

278

3. ANEXAMPLE Assume we offer the following expression to the program:

[bool : type] [true : [z,bool] type] [nonempty : [ksz : type] bool] [a : bool] { { a } true} [ksz : type] {{ksz} nonempty} true then this is taken in as 2. The action of the program produces as the normal form, to be called 21, [bool : type] [true : [z : bool] type] [nonempty : [ksz : type] bool] [a : bool] { { { a } true} nonempty} true Moreover it produces k = 2, i.e. it says that 2 and 21 are 2-expressions. And the program produces the category of 2, viz. 2 2 :

[bool : type] [true : [z : bool] type] [nonempty : [ksz : type] bool] [a : bool] t y p e

As the norm it presents the value m = 7. We devote a few words to its background: Every dummy has a category: viz. in 2 the dummy “nonempty” has the category “[ksz : type] boor’. Moreover, we have the difference between binding occurrences of a dummy (i.e., occurrences followed by a comma) and bound occurrences (i.e , all n+tw occxrences) Mr. Nederpelt’s norm IS obtained roughly as follows: replace the bound o( currences of dummies by their categories. Carry this on umiL AC h i i.r*ei sound occurrences of dummies are left [n this way our expresswn -’g- do: SF I,c [bool : type] [true : [z : type] type] [nonempty : [ksz : type] type] [a : type1 {{type) [z : type1 type} [ksz * type1 ((tYP.1 [ksz : type1 type) .1 : type1 t y p e Next we start canceling parts like { A } [z : B]. So {type} [z : type] t y p e reduces to type. Actually all braces { } can be removed this way: the fact that this can be done is a consequence of the acceptability of 2. What remains is

[bool : type] [true : [z : type] type] [nonempty : [ksz : type] type] [a : type1 t y p e and that is essentially Mr. Nederpelt’s norm. It is not an acceptable expression itself. The simpler norm m we shall work with, is just the number of occurrences of t y p e in Mr. Nederpelt’s norm. There are 7 of them, so m = 7.


4.

279

THE PROGRAM

The program is written in ALGOL 60, with some trivial extensions. It uses wwds li!e “expressim”. “quantifier string” in the same way as ordinary ALGOL uses words like integer and real. There is an input statement “2 .- read”, by which the given expression is fed into the program, and there are output statements like “print (21 )” which produces the actual expression that was denoted by Z1, just like “print (rc)” produces the actual number that was denoted by k. The program uses the following equality of expressions: A G B means that the expressions A and B can be transformed into each other by means of Qconversion, i.e., just by the very unessential process of changing names of dummies (provided that name changing is not done so clumsily that the relation between a bound occurrence and the binding occurrence of a dummy is disturbed). The program contains the statements create new dummy s‘ ;

D’ := subst(s := s’, D )

which have the following meaning. First, s’ is a dummy that has not been used before in the expressions occurring in the program. The second statement means that D’ gets as its value the expression we obtain from D if we replace every occurrence of s by s’. In our syntax an empty string was presented by the simple procedure of writing nothing at all. Since this is not always very clear, we shall write 0 for the empty string. The program contains clauses like “ i f X starts with [”, which are not ALGOL but cannot be misunderstood. And it contains things like “write X = [u : Y ]2”. It means: we know at this stage that X has the form [... : ...; now give u, Y , 2 the (uniquely determined) values such that indeed X = [u : Y ]2. The reader will notice that the execution of the program causes quite some duplication of work. Having to choose between simpler program and shorter execution, we preferred the former.

..I

begin procedure check ( Q , X , X I ,X z , k , m ) ; value Q , X ; quantifier string Q ; expression X , X I , X z ; integer k, m; begin if X is a dummy then begin dummy y ; quantifier string Q1; expression A , A l , Az; integer k,; if Q = 8 then goto wrong; write Q = Q1 [ y . A ] ; if y f X thencheck ( Q l r X , X 1 , X 2 , k , m ) else begin check ( Q l , A , A l , A z ,k , , m ) ; X i := X ; X z := A , ; k := k , 1 end

+

N.G. de Bruijn

280

end else if X G type then begin k := 1; X1 := type;m := 1 end else if X starts with [ then begin dummy u; expression Y , Y1, Yz, 2 , 21, Z Z ;integer k,, my,m,; write X = [u : Y ]2 ; check ( Q ,Y,Y1,Yz, k,, m y ) ; c h e c k ( Q [ u : Y ] , Z , Z 1 , Z z , k , m Zm ) ; := m,+m,; X1 := [u : Yl]Z1; if k > 1 then Xz := [u : Yl]Zz end else if X starts with { then begin expression Y , Y1, Yz,z, 21,zz, W I , integer k,, k,, k,, m u ,m,, m,; write X = { Y } 2 ; check ( Q ,Y ,Y l ,Yz,k,, mu);if k , = 1 then goto wrong; check (Q, Z , Z 1 , Z z , k,, m,); if 2 1 = type then goto wrong; if k , > 1 thencheck ( Q , { Y l } Z z , W l , W z , k , , m , ) ; if 2 1 starts with [then begin dummy u; expression V , R; write 2 1 = [u : V ]R; if V f Yz then goto wrong; if ( R = type) V ( R is a dummy # u ) then check ( Q ,R , X l , X z , k , m ) else if R G u then begin X I := y1; X z := yz; k := k,; m := mu end else if R starts with { then begin expression C ,D ; write R = {C} D ; check ( Q , { { Y l } [ u :V l C ) { y ~ } [ uV:l D , X i , X z , k , m ) end else if R starts with [ then begin dummy s; expression C , D , D‘; write R = [s : C ]D ; create new d u m m y 8’; D‘ := subst(s := s‘,D); check ( Q , [ s ’ :{ Y l } [ u :V ] C ] { Y 1 } [ uV: ] D ’ , X 1 , X z , k , m ) end else goto wrong; end else begin X1 := { Y l } 2 1 ; if k, = 1 then goto wrong; X2 := Wz; k := k,; m := m, end

wz;


281

end else goto wrong end procedure check; program: expression E, El, Ez; integer k, m; E := read; check ( 8 , E, El, Ez,k,’m); print(E1); print(k); print(rn); if k > 1 then print(E2); goto end; wrong: print(# the given expression is not acceptable 3 ) ; end: end

5. TERMINATION OF THE PROGRAM

[Note (1992). This section claimed to give a sketch of a proof for the termination of the program. Unfortunately, the author had to admit later that the ideas presented in that sketch were not suficient for making the proof work. A satisfactory proof can be given on the basis of Nederpelt’s strong normalization theorem (see [Nederpelt 73 (C.3)]).]

6. FINAL REMARKS The language AUT-SL has been defined by means of reduction to normal form. The next step is that we can produce a number of language rules that does not involve the normal form explicitly. First, let us call two acceptable D expressions definitionally equal (symbol: =) if they have the same normal form. Next we can formulate rules producing definitional equality, like:

D D A1 = A2, B1 = B2, if {Al}B1 is acceptable, D then {Az}B2 is acceptable, and {AI} B1 = { A z }Bz if

.

In this way, we can phrase quite a number of derived rules for AUT-SL. On the other hand, we could take these derived rules as the definition of AUT-SL (in the same line as the definition of Automath), and prove the reducibility to normal forms as a theorem.


283

Some Extensions of Automath: The AUT-4 Family N.G. de Bruijn

1. In Automath (see [ d e Bruijn 70a (A.2)], [de Bruijn 73bl) we have ezpressions of degree 1, 2, 3 and a typing operation that attaches to each expression of degree 2 an expression of degree 1, and to each expression of degree 3 an expression of degree 2. If the typing operation takes P into Q we shall write this here as P : Q. The lines in Automath are all of the form (context indicator), (identifier) , (definitional part), (category part) , where the category part D has degree 1 or 2 and where the definitional part C (if it is not the block opener symbol or the symbol PN) satisfies C : D. The substitutional mechanism and the abbreviation system are independent of the degrees of the expressions involved. The degrees do make a difference, however, in the rules that express the right to carry out abstraction and application. We shall not recapitulate these rules of Automath here.

2. The extensions to be considered in this note all have the first of the following two features, and may or may not have the second one.

(i) Alongside with expressions of degrees 1, 2, 3 we admit expressions of degree 4, and we consider formulas P : Q where P has degree 4 and Q has degree 3. Accordingly, we admit blockopener lines and PN-lines with category part of degree 3. u (ii) Definitional equality = is extended as follows: For expressions of degree 4 we take the rules that directly correspond with the rules we have in Automath for expressions of degrees 1, 2, 3, but we take the following rule in addition: if P I , P2 are expressions of degree 4, if PI : Q1, P2 : Q2, where

D Q1 and Q2 are expressions of degree 3 satisfying Q1 = Q2, then we have

D

PI = P2. We shall refer to this feature as fourth degree identification.

N.G. de Bruijn

284

The Automath-like languages for which i) is required, will be called AUT-4 languages.

3. In order to show the ideas behind AUT-4, we first devote some attention to the interpretation of texts in languages of the Automath family. We necessarily have to be vague about this, since “interpretation” will mean the system of relations between an Automath book and the “mathematical world”. This mathematical world is not a real world, but the imaginary world of mathematics that has developed in the mind of mathematicians. These mathematicians have been able to discuss that world in natural language, hardly ever getting into serious permanent disagreement, and therefore they feel very confident about it. Nevertheless, it is a strange patchwork of words, formulas and conventions, certainly not easy to describe. In the mathematical world we say things like “7 is a natural number”, “2+2 = 3 is a proposition”, and if T is some piece of text we can say “T is a proof for 2 + 2 = 4”. Let us indicate the particular use of the word “is” in these sentences by means of the symbol E 7 E class of all natural numbers,

2

T

(3.1)

+ 2 = 3 E class of all propositions,

(34

+2 =4.

(3.3)

E

class of all proofs for 2

Let us write N and A for the classes in (3.1) and (3.2),and let us simply omit the words “class of proofs” in (3.3). So we get 7 E N ,

(3.4)

In previous reports on Automath we have recommended the following system of interpretations: the 3, N , etc. of the mathematical world correspond to Automath expressions that we shall abbreviate here by “3”, “ N ” , etc. Now “ N ” , “2 2 = 3”, “2 2 = 4” have degree 2, “7” and “T”have degree 3. There is an extra symbol type of degree 1, and we write

+

+

“7” : “N” : t y p e , “2 + 2 = 3” ; type ,

“T”; “2 + 2 = 4” : t y p e . That is, the symbol type can be interpreted as r if we feel like it. This system has advantages as well as disadvantages.

Some extensions of Automath: The AUT-4 family (B.3)

285

An advantage is that we can reduce the number of primitive notions of a book, since there are primitive notions that serve the needs for classes as well as for propositions (for example, the Cartesian product of two classes can be specialized to the conjunction of two propositions). But this is also a disadvantage: there can be axioms we want to hold for all propositions and not for all classes. In particular we may wish to phrase the axiom of the excluded third without being forced to accept its equivalent for classes (i.e. Hilbert’s universal operator that selects an element from every non-empty set). This disadvantage can be overcome if we introduce in the Automath text a primitive “bool” of degree 2, and a function “TRUE” that attaches t o every b with b : boo1 a value TRUE(b) of degree 2 (see [ d e Bruijn 7Oa ( A . 2 ) ] , [de Bruijn 73bl). In the interpretation the TRUE(b) corresponds to a proposition, and the things which are : TRUE(b) correspond to proofs of that proposition. A minor disadvantage is that we have to pass from b’s to TRUE(b)’s all the time. There is also the matter of “type reduction” [also called “type inclusion”], which we shall briefly discuss presently. Let C be an expression of degree 2 and assume that for all z with z : C we have derived A ( z ) : t y p e . Then we may infer in AUT-QE (see [de Bruij’n 7Qa (A.21, Section 12.71, [de Bruijn 73b, p. 521) that [z : C] A ( z ) : [z : C] type, and it is optional to replace this [z : C] t y p e by t y p e (whence [z : C] A(z) : type). This is called type reduction, it violates the Automath law that in A : B the B is uniquely determined by A, up to definitional equivalence. In Automath type reduction is compulsory. So the feature of AUT-QE is that type reduction can be left undone; at the same time it opens the possibility to start with “let u be a thing with u : [z : C] t y p e ” , which makes it possible to express something with the interpretation “let u be a predicate on C”. Experiences with writing AUT-QE seem to have pointed out that type reduction is nice for the cases of class interpretation, and that the possibility to leave type reduction undone is attractive for the cases with propositional interpretation. We might say that we wish type reduction to be effective for classes and not for propositions. In AUT-4 we have a possibility of an interpretational system that seems t o be definitely better than the system described above. Referring to the examples (3.4), (3.5), (3.6), we let “T” have degree 4, “2 2 = 4”, “2 2 = 3”, “7” get degree 3, “ N ” and “R” get degree 2, and we admit only a single expression of degree 1, viz. t y p e . So instead of (3.7), (3.8), (3.9) we get (3.10) “7” : “N” : t y p e , 112 + 2 = 3” LLx), : t y p e 7 (3.11) (3.12) “T” : “2 + 2 = 4” : “r”: t y p e .

+

+

N.G. de Bruijn

286

Propositions and classes now show a difference on the syntactic level: they get different degrees. If we require type reduction, it works for classes and not for propositions. There is a second syntactic difference with the old system: proofs now get degree 4, and are thus syntactically distinct from things like numbers. The fourth degree identification as described in Section 2 (ii) seems t o be quite attractive for the case of proofs; it has no consequences for objects like numbers, where the corresponding identification would be utterly unacceptable. The interpretation of fourth degree identification is what we call irrelevance of proofs. The idea is connected with the general idea of proofs in classical mathematics. In the use of Automath as described in previous reports ( [ d e Bruijn 7Oa ( A . 2 ) ] , [de Bruijn 73b]), objects may depend on proofs. For example, the logarithm of a real number is defined for positive numbers only. So actually the log is a function of two variables; and if we use the expression log(p,q), we have to check that p is a real number and q is a proof for the proposition “ p > 0”. If q1 and q2 are different proofs for p > 0, the expressions log(p, q1) and log(p, 42) are not definitionally equal in Automath. Yet the classical mathematician wants them to be equal (though not necessarily definitionally equal). It causes quite some trouble to achieve this, and at every instant where such a thing appears we have to appeal to a place in the book where this kind of equality is expressed. And the text checking computer has to do quite a lot of work, too. Yet it seems so simple: if we are not interested in the difference between q1 and 42, then we just don’t look at them, look only at what they prove. This is what fourth degree identification in AUT-4 can do for us.

4. Let us inspect the various possibilities for language definitions in the AUT-4

family. (i)

There is the possibility to admit quasi-expressions(things like [z : A] type) as expression of degree 1, and to admit or to forbit type reduction. In connection with what we said in Section 3, it seems not necessary to use quasi-expressions. In order to simplify the subsequent discussion we shall restrict ourselves to the case without quasi-expressions. That is, type is only expression of degree 1, and type reduction is compulsory.

(ii) Various things are possible with abstraction. Let A be an expression of degree i (i = 1,2,3)and assume that we have in our book with the context x : A that B(x) : C(z), where B ( z ) and C(z) have degree j 1 and j , respectively ( j= 1,2,3). Then we wish to be allowed to write outside the context z : A , that

+

[z : A] B ( z ) : [z : A] C(z)

Some extensions of Automath: The AUT-4 family (B.3) if j

287

> 1, and [z : A] B ( z ) : type

(44

if j = 1 (whence C(z) = type). Let us call this (i, 3)-abstraction and refer to it as “abstraction from A”. We can choose for which pairs (i, j ) we shall admit this in the language definition. It seems to be reasonable t o admit all pairs with i # 1. (One might hesitate about i = 3, but if we do nut admit i = 3 here, the passage from the interpretational system (3.4)-(3.6) to the system (3.16)-(3.12) would have a serious drawback.) Entirely independently of the question whether (4.1) and (4.2) are admitted, we agree that the “abstractive expression” [z : A ]B(z) has the same degree as B ( z ) (and [z : A] C(z) has the same degree as C(s)). (iii) Let, in a certain context, q and f be expressions of degree i and assume that q : A , f : [z : A] C(s)

+ 1 and j + 1, (4.3)

where A has degree i and C(z) has degree j. Then we can wish to be allowed t o write

(which is called ( i ,j)-application, in this particular case application of f to q ) . We can choose for which pairs ( i , j ) (1 5 i 5 3, 1 5 j 5 3) we shall admit this in the language definition. It seems reasonable t o admit it for all pairs with 2 5 i 5 3, 2 5 j 5 3. Entirely independently of the question whether (4.4) is admitted, we agree the “applicative expression” ( q ) f has the same degree as f . (iv) If j = 3 there is a rule slightly stronger than iii): if q and f have degree i 1 and 4, respectively, and if

+

q .A,

f : h , h : [z : A] D ( z )

then

This rule probably has not much use. It is certainly superfluous if we have both and q-reduction, for then we can write h as [z : A] (z)h. But even if it is not superfluous it is questionable whether we shall ever need it badly.

N.G. de Bruijn

288

+

(v) Let in a certain context q have degree i 1, and let [z : A] B ( z ) be an expression of degree j where A has degree i. Then we wish to reduce

which is called p-reduction. We have to state for which pairs (i, j) this will be taken as definitional equivalence. It seems reasonable t o admit all i and j with 2 I i 5 3, 2 5 j 54. Instead of this ordinary p-reduction, we can take type-restricted preduction. In that case, the above reduction is allowed only if we can show that q : A . (vi) If A and B have degrees i and j , and B contains no

5,

we wish to reduce

[z: A] ( z ) B to B (0-reduction). It is reasonable to admit it for 2 5 i

I 3, 2 5 j 5 4.

(vii) In the interpretations we discussed in Section 3, we had use for expressions p of degree 4 only if p : A where A represents a proposition. Let us refer to all other expressions of degree 4 as extras. One might think it better to ban all extras as long as no interpretation has been agreed upon. On the other hand one may hope to be able to show that extras do not harm, in the following sense: Let B be a correct book, and let 1 be a line we wish to add to B. Let B* be a book with exactly the same PN’s as B has, and no others. Assume that B* contains the line 1, and that neither B nor 1 contain extras. Then there is a correct extension B** of B such that B*\B contains 1, but no PN’s and no extras. If this is true, we may say that the language that allows extras is conservative over the one that does not. Nevertheless there can be some use for extras. Assume we are interested in constructibility of real numbers. Let C be a construction for the real number T , and if “C”and “r” are the expressions corresponding to C and T , we want to have “C” : r ‘ ~ r r . By means of axioms we can describe primitive constructions, and primitive ways to obtain new constructions from constructions already known. In that way we can get a theory of constructions in our book. If our language has fourth degree identification then we have construction irrelevance: if something depends on a construction it only depends on the constructed object and on the fact that a construction exists.

289

AUT-QE without Type Inclusion N.G. de Bruijn

1. INTRODUCTION

We consider a language AUT-QE-NTI. Its definition is identical to the one of AUT-QE in [van Daalen 73 (A.3)] but for the fact that the type inclusion rule (Rule 6 of Section 5.5.4 of [van Daalen 73 (A.3)])is omitted. The letters NTI stand for ‘‘no type inclusion”. The power of this language can be increased in various ways; e.g. (i)

by admitting “mock typing” for writing axiom schemes (cf. [de Bruijn 74a]),

(ii) adding the type inclusion of AUT-QE with about the same effect, (iii) taking the II-operators of AUT-II (cf. [Zucker 77 (A.411, [de Bruijn 771). The latter language has some features that seem peculiar from the point of view of language structure, e.g. if compared to the simplicity of AUT-QE-NTI, but, on the other hand, AUT-II seems to be quite natural from the user’s point of view. In this note we shall try to show that in AUT-QE-NTI a set of axioms on universal quantifications can lead to a set of theorems which can take over the role of type inclusion. Application of these theorems is a kind of automatic affair. It is to be expected that AUT-QE-NTI, enriched with such automatic devices (which means that some “book theorems” are shifted to the language definition) has about the same expressive power as AUT-QE and AUT-II.

2. THE RULES OF AUT-QE-NTI

In [de Bruijn 771 we described AUT-II by a set of basic rules, omitting everything the Automath family has in common (like structure of lines, books, contexts, instantiation). We describe AUT-QE-NTI in the same fashion ( r stands for either type or prop): 1

(i)

k r

N.G. de Bruijn

290 2

1

I- a : ? -

(ii)

~-

1

F

[x : a ]P

:

~ (.:a) I- Q : P

2

(iii)

(.:a) .~ F P

2

f a

--

2

~

I- [ x : a ] Q : [ z : a ] P 3

2

a : ~ (.:a) I- R : Q (iv) 3 I- [ x : a ] R : [ z : a ] Q k

~

3

2

I- A : ~ : T (v)

I- Q : [ a : : c u ] P

2

I- ( A ) Q :P [ x := A] 3

(vi)

3

I- A : & : ? ~

I- R : Q : [ x : a ] P

!( A )R : ( A ) Q

3. THE AXIOMS FOR UNIVERSAL QUANTIFICATION

a := Q :=

~

~

: 7

:

All := P N :

x

[x : a17 7

A11(Q) A z l := P N : Q :=

~

:

Q

y : = - :

Ax2 := P N

:

All(Q)

Properly speaking, we have t o consider various sets of axioms: the 7 in the first line may be either type or prop, and the T ' S of the second and third lines may be either both t y p e or both prop. We do not go into these difficulties, and we shall behave as if ?- were the only basic expression of degree 1.

4. GENERALIZATION OF All TO MULTIPLE QUANTIFICATION We consider cases like Q : [z1 : a11 ... [x,,, : am]7 . We cannot introduce independently: 0 2 may depend on xl, etc. But in order to give a

a l , ...,a,

AUT-QE without type inclusion (B.4)

29 1

preliminary idea, we show what can be done if the a's are independent. We take m = 3.

Q

:=

-:

[XI : 011 [ 2 2 :

[ ~ : 3I Y ~ 7 ]

k31 := [21 : a11 [ZZ : a 2 1 All(a3, ($2) (51) k32 := [XI : 011 k33 :=

All(02, 2.i

9 ) : [XI

: 0112.[

Q ) ) : 1x1 : 011 7

: 021 A l l ( a 3 , ( 5 2 ) ($1)

: a 2 1 A l l ( a 3 , (Q) ($1)

All(ai, [$I : 011 All(a2, 2.[

: a21 7

Q))) : 7-

These formulas are the same as those presented in [ 1: in AUT-II the role of All is played by II, which is not introduced by means of axioms, but by a language rule. Note how the kmi's imitate type inclusion. If

Q : [XI: a11 [Q : I Y ~ ][Q : a3]7 then a language with type inclusion permits us to write Q : [XI: a11 T . Here in AUT-QE-NTI we just have t o write k32(Q) : [q : a11 7. We now turn to the general case. Let m be an integer ...,prn as follows (the example shows the case m = 4)

>

1. We introduce

$91,

- : 7

$91 :=

$72 := - : [Zl : $711 7-

$73 :=

-

: 1x1 : $71121.

$74 :=

-

.

[Xl

.

, i j (

:'.,

: (21) $921 7

(p:; 1%;

(Xz) (21) $931 7

Instead of the independent t./?e: C.I' we now have, in the context of ' ~ 4 ,the types $71, (21) $72, ( 2 2 ) ( 2 1 ) $73, (23) ( 2 2 ) ($1) ' ~ 4 .When writing in this context, we shall introduce as "typographical" abbreviations: (l)= ($1)

if j is any integer

[j] =

1

(2) = (.2)

7 '"

,

( j ) = ($J)

> 0; (0) will stand for an empty string. : $711 [ZZ: ($1) 'P2] .'. [$J : ($J-l)

'**

($1)

'**

Similarly

($1) $731

and [O] stands for the empty string. In the context of $9, we now write as correct lines krno := Q := [m - 11All((m- 1),P,( k,1 := [m - 21 All((m - 2) ( k,2

~

: [ m ] ~ : [m - 117 (m - 1)kmo) ~ - (m 1 , - 2) kml) : [m - 21 7

......... ,k

:= All(P1, kmn-1)

The recursion is produced by

: 7

N . G . d e Bruijn

292

kmi := [m- i] A l l ( ( m - i) vm-i+1,( m - i) km,i-l) : [m- i] T for 0

< i 5 m.

5. GENERALIZATION OF Azl AND A22

A d expresses something for the case m = 1. There it says: if we have something of type kll (= A l l ( Q ) ) then we have something of type klo (= Q ) . A22 does it the other way round. We can generalize this to all m 2 1: if 0 5 i 5 m, 0 5 j 5 m, and if we have something of type kmi then we have something of type k m j . It suffices to deal with the cases j = i f 1. We start in the context of qm (of Section 4). If 1 5 i 5 m we can write (by virtue of r]-reduction rules) 'u.

:=

: kmi

~

sm-i := [m- i] A21 ( ( m- i) vm-i+1,( m- i) km,i-1, ( m - i)

U)

: km,i-l .

In particular if i = m this takes the form : kmm

u := 80

:= A z l ( v l , k m , m - l , u ) km,m-1

In the other direction we have, if 1 5 i

.

< m - 1,

u := : km,i-l tm-i := [m- i] A22 ( ( m- i) vm-i+1,( m- i) km,i-l, (m- i) U) : kmi . In particular if i = m this becomes

u := : km,m-1 to := A 2 2 ( p 1 , k m m - 1 , ~ ): k m , m . By means of composition of these operations we can pass indeed from any kmi to any kmj:

1

u

: kmi

:=

t m i j :=

... : k m j

where for each set of integers m, i, j (0 5 i 5 m, 0 5 j 5 m) the dots stand for a particular expression. The larger m and ]i - jl are, the longer this expression will become. In particular, we can pass from

R:Q:[m]r to

t m o j ( R ): k m j ( Q ) : [ m - j l ~ .


293

6. EQUALITY It is attractive to consider the Ax1 and Ax2 of Section 3 as inverse operations. This means that in the context of Q the expressions

x

and

Az2(Axl(x))

refer to the same object (of type All(Q)), and

y

and

Axl(Ax2(y))

refer to the same object (of type Q ) . We can express this by equality axioms (for which we need further PN’s). The applications we have in mind, suggest that identification of x and Ax2(Axl(z)), and of y and Axl(Ax2(y)) is of a linguistic rather than of a mathematical nature. So it is attractive to accept the above equalities as definitional equalities (thus extending the notion of definitional equality). If we accept this, we conclude that the si and ti (of Section 5) are each other’s inverses in the same definitional equality sense, and similarly t m i j and t , j i are each other’s inverses.

7. OMITTING THE k,i’s The category of kmi(Q) (Section 4) is [m- 4 7 . On the basis of what we know on uniqueness of types we can remark that once the category of k,i(Q) is given, then i is known. This can lead us t o the following convention: kmi(&) : [m- i] 7

is to be abbreviated as

Q :[ m - i ] ~ . From the right-hand side we see that the Q on the left is intended to denote km i( Q ) . Another convention is that we omit the t m i j ’ s (see the last line of Section 5 ) : from the typing it is obvious which ones they should have been (provided we have the definitional equalities of Section 6 ) . These funny conventions are exactly equivalent to the rules of type inclusion! That is, they turn AUT-QE-NTI into AUT-QE. It should be remarked that AUT-QE is very convenient for writing and checking. Compared to AUT-QE-NTI it must be said that AUT-QE saves a large number of /3- and v-reductions and similar definitional equalities.

N.G. de Bruijn

294 8. A B S T R A C T I O N I N D E X

In order to facilitate the discussion on the relation between the various languages we coin the term “abstraction index” of an expression in an AUT-QENTI book. In a context containing the context of the 91,..., (P, of Section 4, and with the abbreviation of Section 4, we say that the abstraction index of [m]T is m. Also, if Q : [ m ]and ~ if R : Q : [ m ]we ~ say that the abstraction index of Q and R is m. The abstraction index increases by 1 if we put a single abstractor [x : a] in front, and decreases by 1 if we put a single applicator ( A ) in front (the latter only applies to Q and R, not to [m]T itself).

9. COMPARING AUT-QE-NTI TO AUT-IT

Let us take AUT-QE-NTI with extended definitional equality as described in Section 6. A book in that language may contain expressions of degrees 1, 2, 3 and arbitrary abstraction index. It is not hard to see that we can rewrite such a book in an equivalent form in which all identifiers of degree 3 have abstraction : Q (where Q has degree index 0. We replace any block opener line x := 2 and abstraction index m ) by a line x := - : k,,(Q). Furthermore we Because of replace definitional lines c := R : Q by c := tmom(R): k,,(Q). these changes there have to be obvious adaptions in all places where such an x or such a c is referred to. Let us call a book with this property (all identifiers of degree 3 have abstraction index 0) j, “zero abstraction index book”. Such a book niay very well contain subexpressions of degree 3 and abstraction index > 0, just because the index of a n expression increases if we put an abstractor in front of it. A zero abstraction index book is essentially an AUT-II book. There is a peculiarity with abstraction and application in AUT-IT, however. In AUT-II all expressions of degree 3 have abstraction index 0: if R : Q then Q : T . If we translate AUT-ll into AUT-QE-NTI we have to do the following: every abstractor [x: a ]of AUT-ll has to be replaced by tlol[x : a ] ,and every applicator ( A ) of AUT-11 has to be replaced by ( A )tllo. One might naturally ask whether, conversely, AUT-QE-NTI can be interpreted in terms of AUT-II. A convenient way to do this seems to be the following one. First rewrite all AUT-IT-expressions of degree 3, replacing ( ) by ( )* and [ ] by [ ]=.Next extend the collection of all expressions of degree 3 by putting [ 1’s (without T ) in front of other expressions and provide them with a type according to a rule “if R : Q then [ ] R : [ ] Q”. In this way the typing of expressions of higher index are interpreted as typings of expressions of lower ~


295

index. Needless to say, quite some work has yet to be done!

10. SCHEMATIC PRESENTATION In order to get a quick survey of the various operations discussed thus far, we present expressions as points in a diagram. In such a diagram we have horizontal levels 0, 1,2, ... , according to the abstraction index. If A is an expression then [z : a]A is drawn one level higher, with a vertical arrow connecting the two, and similarly an application is drawn one level lower:

[x:a]A I A

I

A A

Figure 1 If Q has degree 2 and abstraction index 1 we can apply All, and this is indicated as follows

Figure 2 If R has degree 3 and abstraction index 1 we have Ax2(R) with index 0 ; if S has degree 3 and abstraction index 0 we have A x l ( S ) with index 0 , provided that S : AU(Q) with some Q of index 1 . These operations are indicated as follows

R

1

-

-

0

S

Ax2(R) Figure 3

Presenting composite operations we proceed from right to left. Let Q have

N.G. de Bruijn

296

index 3, then kgl(Q),k32(Q) and k33(Q) are depicted like this

Figure 4 If Q has index 4 we get

.tQ

Figure 5 Next we take the case of degree 3. Let Q have index 3, and let R : Q . The operations of Section 5 can be depicted as follows

Figure 6 The composite operations t,ij can be drawn accordingly. Note that some detours ( ) [ ] can be eliminated by @-reductionand detours [ ] ( ) by v-reduction.


297

Some examples are

Figure 7 At the end of Section 6 we mentioned definitional equalities. In the pictures they mean that the detours

Figure 8 can be eliminated. At the end of Section 9 we mentioned that for expressions of degree 3 the abstractors and applicators in AUT-IT have to be adjusted when translating into AUT-QE-NTI. Denoting them by [ IT and ( )* we have

Figure 9 In this way AUT-ll manages to keep the abstraction index zero for all expressions of degree 3.


299

Checking Landau’s “Grundlagen” in the Automath System Appendix 9 (AUT-SYNT) L.S. van Benthem Jutting

APPENDIX 9.

AUT-SYNT

In 4.1.0 we have indicated that for andi the parameters u and v are essential, while a and b are redundant parameters. If A, B , p and q can be correctly substituted for a, b, u and v, then A and B can be calculated (up to definitional equality) from p and q, because A is definitionally equal to CAT(p) and B to CA T ( q ) . Here we introduce an extension of Automath languages, called AUT-SYNT, in which it is possible to suppress redundant parameters. In this language, CAT is incorporated as a predefined function. For any 2- or 3-expression E , C A T ( E ) is the mechanically calculated type of E. It follows that an&( CAT@), CAT(q),p,q)equals andi(A, B,p, 4). The extended language moreover contains variables for expressions. A basic symbol synt (which has no degree) is added to the language. Variables of type synt (or synt variables) are t o be interpreted as syntactic variables for expressions. There are no typing restrictions on substitution for such a variable. Following the AUT-QE text in 4.1.1 we can write in AUT-SYNT:

zl z2

* * *

z2

..._ .-

ANDI

:= an&( CAT(zl), CAT(z2),z l , z2)

z1

-

E synt E synt

Now, if AEprop, BEprop, PEA, qEB then ANDl(p,q) = a n d i ( C A T ( p ) ,CAT(q),p,q)= andi(A, B,p,q)Eand(a,b). Besides CAT we have other predefined functions in AUT-SYNT. They are defined for certain classes of expressions (just as CAT is defined for 2-expressions and 3-expressions). We list these functions here with their semantics. In the description of the semantics we will frequently use the clause: “if E reduces to ...‘I. We will say e.g. “if E reduces to [ x : A] B...”. This is intended to mean: “if [z : A] B is the first abstraction expression in the reduction sequence, obtained by reducing E according to the strategy of the verifying program”. Similar


300

meanings are intended in other cases. Everywhere in the description E and E l , Ez, ...,En will denote correct AUT-expressions. predefined function

semantics

CAT

C A T ( E ) is the "mechanical type" of the 2- or 3-expression E

DOM

If E reduces to [z : A ] B or C A T ( E ) reduces to [z : A] B or C A T ( C A T ( E ) )= [z : A]B then D O M ( E ) = A.

VAL

If E reduces t o [z : A] B and B does not contain z then VAL(E)= B.

ARG

If E reduces to ( A )B then A R G ( E ) = A.

FUN

If E reduces to ( A )B then FUN(E) = B.

TAIL

If E reduces to c(Al, ...,An) then TAIL(c,E ) is the string of expressions A1, ...,A,.

LASTELT

If E l , ...,En is a nonempty string of expressions then LASTELT(E1, En) = En. a,.,

PREPART

If E l , ...,En is a nonempty string of expressions then PREPART(E1,...,En) is the string of expressions E l , ...,En-l.

Remarks. ( 1 ) Expressions containing synt variables do not have a type. Lines having such an expression as their middle part do not have a category part. (2) EB-lines which have synt variables in their context can only have synt as their category part. In other words: on a synt context only synt variables may be introduced. (3) The identifiers CAT, D O M , VAL, ARG, FUN, TAIL, PREPART and L A S T E L T , and the identifiers defined in terms of these should not be treated as ordinary identifiers. In particular the monotonicity of definitional equality (in this case: if A = B then c(A) = c ( B ) where c is one of these special identifiers) does not generally apply here. E.g. i f f = [z : nat] 1then D

( 1 )f ((1)suc) f , while ARG((1)f ) = 1 # (1)suc = ARG(((1)suc) f ) . Similar examples can be found for FUN and TAIL.

(4) For languages admitting infix expressions there are functions L F E (for left fixed expression) and R F E (for right fixed expression) with semantics: If E reduces to A c B then LFE(c, E ) = A and R F E ( c ,E ) = B.

Checking Landau’s ‘iGrundlagen”,AUT-SYNT (B.5)

30 1

Examples.

( 1 ) The first elimination rule for conjunction can be represented in AUT-QE by adding, on the context a E p r o p ; b E prop ; introduced in 41.0: b * u u * andel

.:=

-

....

E and(a,b )

Ea

Then a and b are redundant parameters, for andel and u is an essential parameter. In fact, if p is a substitution instance for u, then the type of p can be expected to reduce to and(A,B ) for some A and B , and these A and B should then be substituted for a and b. Therefore, keeping the context z l E synt introduced above, we can add the AUT-SYNT line

zl

*

ANDEl

:= andel(LASTELT(PREPART(TAZL(and,

C A T ( z l ) ) ) )L, A S T E L T ( TAZL(and (CAT(Zl))))IZ1) Then pEand(A,B ) implies ANDEl(p)E A . We can now indicate a complication which must be kept in mind when using AUT-SYNT, and which is connected with Remark 3 above. Suppose and has been defined by and := not(imp(a,not(b))). We may have p , A and B such that CAT(p) = not(imp(A,not(B))),and then we have andel(A,B , p )E A , but ANDEl(p) will be incorrect, since CAT@) does not reduce t o and(A,B ) . Even worse complications may occur when using ARG and FUN.

(2) In [van Daalen 73 (A.3), 3.61 book-equality is introduced. In AUT-SYNT we could add to this text, on the context z l E synt ; t 2 E synt ; 22

zl el

*

* *

is := I S ( C A T ( z l ) ,zl,22) r e f i s := R E F I S ( C A T ( z l ) , z l ) symis := SYMIS( C A T ( L A S T E L T (TAZL(is,z l ) ) ) , LASTELT(PREPART( TAZL(is,z l ) ) ) , L A S T E L T ( TAZL(is,z l ) ) , 21)

Then for a n y type S, if x E S and y E S , equality of x and y could be expressed by is(z,y) instead of IS(S,z,y). Moreover, if z E S we have r e f i s ( z )E is(z,x) and if p E is(z,y) we have syrnis(p) E ia(y, 2). (3) A text in AUT-68-SYNT1 in which the first three theorems of Landau’s book are proved, appears in Appendix 8. [Not an this Volume.]


303

The Language Theory of Aut ornat h Chapter VIII, 1 and 2 (AUT-II) D.T. van Daalen

VIII. SOME R E S U L T S ON A U T - n VIII.l. Introduction and summary 1.1. There are two languages of the Automath family that have been developed for practical (in contrast with, say, language theoretical) purposes and have actually been applied in extensive formalization projects. On the one hand there is AUT-QE, used by L.S. van Benthem Jutting in his Landau translation [wan Benthem Jutting 771. The latter reference also contains an informal introduction to the language [van Daalen 73 ( A . 3 ) ] . The theory of AUT-QE is t o be found in [wan Daalen 80, Ch. IV to VI] [large parts of which are included in this Volume]. On the other hand there is AUT-II, invented by J. Zucker, and employed by Zucker and A. Kornaat for the formalization of classical analysis and some related topics. In [Zucker 77 (A.411 one finds a short account of both the language and the formalization project. This chapter is devoted to the theory of AUT-n, which is not quite as complete as the theory of AUT-QE. Some work remains to be done, notably on the extensional version of the language (see IC.5, VIII.61). 1.2. What AUT-QE and AUT-IT have in common We have described AUT-QE as a first-order pure, regular, generalized typed A-calculus system. Using the same terminology, AUT-IT is a first-order extended, regular, generalized typed A-calculus system. So both languages have much in common and, in some sense, AUT-QE can be considered a sublanguage of AUT-IT. We resume: both languages are regular, i.e. they have just expressions of degree l(supertypes), 2 (types and type valued functions) and 3 (terms). They are first-order, i.e. there is only quantification and A-abstraction over term variables, not over type-variables. Further, they have generalized type structure, i.e. the types are constructed along with the terms. Besides, AUT-II and AUT-QE have the book-and-context structure in common. Books to introduce primitive and

304

D.T. v i ~ nDaalen

defined constants, depending on variables, for which substitution (instantiation) is permitted. Contexts for the introduction of variables. Here we want to emphasize that, just like AUT-QE, AUT-11 is a non-arithmetical system, i.e. it has no recursion constant with the corresponding reduction.

1.3. T h e additional operations of AUT-ll But, where AUT-QE belongs to pure typed A-calculus (abstraction, application and instantiation as the only term-forming operations), AUT-II is a typical extended system, with the additional kinds of terms: pairs ( P ,A , B ) ,projections A(1) and AQ), injections i l ( A , p ) and iz(B,a) and @-functions (or: @-terns) A $ B. Here the P of the pair, and the p and a of the injections are mere type-labels to guarantee uniqueness of types. Corresponding with these new terms there are new type-constructs: first the sum-type C P containing the pairs ( P , A ,B ) as elements, where P is a typevalued function with domain a , A belongs to a and B is of type ( A ) P. In case P (as a type-valued function) is constant, i.e. ( A )P does not depend on A, the pair and the sum type can be considered to degenerate to ( A ,B ) and a @ p respectively, where @ is the ordinary Cartesian product and p is the type of B. Secondly, there is the disjoint union or $-type a @ ,B, containing the injections i l ( A ,p) and iz(B,a ) , where A and B are of types a and p respectively. The pairs get their meaning by the presence of the projections and the ass& ciated reductions: if A is a pair, i.e. element of a sum-type, say C P , then A(1) is ) Now ( P,A , B)(1) an element of the domain of P and A(2) is element of ( A ( l ) P. K-reduces to A and ( P , A ,B)(2) reduces t o B. In the extensional version of AUT-II, ( P ,A ( l ) A , Q ) )o-reduces to A , provided A belongs t o C P (otherwise the type would vary under reduction). Similarly, the injections get their meaning by the @-terms and the associated reduction. Let us first explain what a $-term is. Roughly speaking, when f is a function on a and g is a function on p, then - under certain conditions - f @ g is a function defined on a @ p, acting on (injections of terms of type) a as f and on (injections of terms of type) p like g. So the reductions are as follows: ( i l ( A , P ) ) ( f$ g) +-reduces t o ( A )f and (iz(B,a))(f@ g) +-reduces to ( B )g. The corresponding extensional reduction is &-reduction: [z : a]( i l ( z ) )f $ [z : p] (iz(z)) f &-reducesto f, provided f does not contain z as a free variable (i.e. does not depend on z). Please note the use of parentheses: $ is supposed to bind more loosely than the other term forming operations. A more precise definition of AUT-II follows in Sec. 2.

The language theory of Autornath, Chapter VIII, Section 1 (B.6)

305

1.4. The connection with natural deductions systems By the well-known formulae-as-types, derivation-as-terms interpretation, systems of typed A-calculus can be brought into close correspondence with certain natural deduction systems for intuitionistic logic (including the usual proof theoretic reduction relations). Thus, pure systems correspond to logical systems with + and V only, and extended systems correspond to systems with more connectives. In particular, the C, the pairs and the projections of AUT-II may provide the interpretation of “strong” existential quantification with its introduction and elimination rules (though this has not been exploited in Zucker’s book, see [Zuclcer 77 (A.411). And @, the degenerate form of C, corresponds precisely to conjunction. As for the interpretation of V (disjunction) by @-types, the introduction rules of V do correspond to injection, but the elimination rule of V differs slightly from its counterpart in AUT-n. The usual elimination rule of V (see, e.g., [Prawitz 651) operates on three arguments: from (1) a derivation of a V p, (2) a derivation of y under the assumption a , ( 3 ) a derivation of y under the assumption 0,

one can form a derivation with conclusion y. The assumptions a and ,O of the derivations (2) and ( 3 ) are discharged. The AUT-II operation representing this rule must be constructed in several steps: first (2) and ( 3 ) are transformed into derivations of a + y and p + y respectively. These two derivations are combined into a derivation of (avp) -P y (by using @). Then the conclusion y follows from modus ponens (by (1)). Here we stick to the AUT-II variant of the rule. For a discussion of the alternatives see [Pottinger 771, [Pottinger 791. Because AUT-II is still non-arithmetical, it cannot represent natural-deduction systems for arithmetic (in the sense intended above). 1.5. Product formation versus type inclusion Now we discuss a specific difference between AUT-QE and AUT-II, that prevents AUT-QE from being an actual sublanguage of AUT-II. In AUT-QE there is no difference in notation between type-valued functions and function types. 1.e. the expression [x : a]p, with p an expression of degree 2, stands for the function that to arguments A in a assigns types p [ A ] ,but also for the type of the functions which, when applied to A in a , produce a value in p [ A ] .And, to make things even more complicated, it is possible that p allows such multiple interpretations as well.

306

D.T. van Daalen

In AUT-lI there is reserved a special symbol for referring to the function type, viz. II (for Cartesian product formation): by prefixing with II the type-valued function [z : a]p is turned into the corresponding function type ll [z : a]p. More general, if P is a type-valued function, then llP is the corresponding product type, containing those functions as elements which, when applied to arguments A of the right type, produce values in ( A )P. The language AUT-II is named after the II of product formation. In AUT-QE the expression [z : a l p can get (at least) two possible types, viz. [z : a17 and 7, according to which interpretation is intended. This is implemented by the rule of type inclusion. As a consequence, uniqueness of types is valid for terms only. Some problems arise from this in connection with defined constants (see (C.5, V.1.71 and [G.5, V.3.3.101). In AUT-II uniqueness of types is valid for types as well: e.g. if p is a type, then [z : a]p has type II [z : a ]T and lI [z : a]p has type T . Note here the use of II again which makes the (constant) “super-type valued function” [z : a]7 into a super-type II [z : a]7. At first sight it seems that the here-indicated difference is a trifle, and that AUT-QE can be made into a subsystem of AUT-II by simply inserting II’s at the right places. However, as noted by de Bruijn, the correspondence is not that close: the rule of type-inclusion (of AUT-QE) is somewhat stronger than the product formation rule (of AUT-II). See Sec. 6.1 of this chapter, [de Bruijn 771 and [de Bruijn 78c (B.4)]. 1.6. Some features of AUT-ll not discussed here For completeness we mention two important, more or less syntactical, features that enrich the language used by Zucker and Kornaat in their AUT-rI book. First, there is the use of AUT-synt, a kind of Automath shorthand, as documented in [van Benthem Jutting 771. Secondly, there is the use of stringsand-telescopes (see [Zucker 77 (A.4)] [and [Balsters 8611). However, these features do not belong specifically to AUT-II; they rather can be attached to any Automath language, but were not yet available when van Benthem Jutting started his Landau translation. On the contrary, the stringsand-telescopes generalize (and, hence, duplicate) in some sense the pairs-andsums of AUT-II. These two features are not discussed in this thesis. In [Zucker 77 (A.411 Zucker describes how the whole language is divided into a t-part (for terms and types) and a p-part (for proofs and propositions). This division originates with the distinction between the two degree 1 basic constants, 7 (or type) and 7r (or prop). Connected with this is the principle of equality of proofs (two proofs of the same proposition are considered to be definitionally equal; only consistent with classical logic). Here we just use 7 as our basic constant. As a consequence we do not discuss equality of proofs.

The language theory of Automath, Chapter VIII, Section 2 (B.6)

307

1.7. Section 2 below contains a more precise definition of AUT-II. In [C.5, VIII.31 we prove the closure property: Correctness is preserved under reduction. In [C.5, VIII.4] we first define two systems of normable expressions, AUT-IIo and AUT-IIl, which have the same “connectives” and reductions as AUT-II but a simplified type structure. We study SN [i.e., strong normalization] for these two systems. First we show that the methods of proving 0-SN directly apply to the situation with P7r-reduction. In [C.5,VIII.51 we give some different proof methods for SN in presence of +-reduction. Then we extend the AUT-IIl results to AUT-II. [C.5, VIII.61 just contains some remarks on the connection between AUT-II and AUT-QE (type-inclusion vs. product formation), and on the particular problems posed by the addition of &-reduction. VIII.2. A short definition of AUT-II 2.1.1. We give an E-definition of AUT-II, along the lines of the AUT-QE definition in [C.5, V.21. For the formation of books and contezts we refer to [ A . 3 , IV.31, and for their correctness to the requirements in [C.5, V.2.1.31. However, the inhabitable degree condition, to the effect that correct expressions can be of degree 1, 2 and 3 only, has to be restricted further, to an inhabitability condition: Expressions acting as the t y p of a variable or a constant have to be inhabitable. Where we define QI to be inhabitable when degree(cr) = 1, or: degree(a) = 2 and a E 7 (or a E 7 r ) . 2.1.2. But first we must define the degree (and, implicitly, the notion of degree correctness) of the typical AUT-II expressions: degree(A) = 1 or 2 degree(A) = 2

+ degree(II(A)) = degree(A)

+ degree(C(A)) = 2

* degree(A(l)) = 3, degree(Ai(2))= 3 degree(A) = degree(B) = 2 or 3 * degree(A @ B) = degree(A) degree(A) = 3, degree(B) = 2 * degree(il(A, B ) ) = degree(A) = 3

degree(is(A, B)) = 3 degree(A) = 2, degree(B) = degree(C) = 3

* degree((A,B, C)) = 3

2.1.3. Correctness of expressions, E-formulas (for typing) and Q-formulas (for equality) is defined simultaneously. For the notational conventions and abbreviations we refer to [C.5, V.2.11 and IC.5, V.2.21. E.g., we display degrees as superscripts to the correctness symbol F, we freely omit books and contexts (or parts of contexts) not relevant to the rule under consideration, and we sometimes omit I- as well (viz. in front of a formula when context and degree are not shown).

D.T. van Daalen

308

2.2. The general rules 2.2.1. We start with the rules that AUT-II has in common with AUT-QE. We assume a correct book B and a correct context E. First the general rules for correctness of expressions and E-formulas. type and prop: I-' r and I-'

(i)

(ii) variables:

...,x E a,...,

T.

x(E a).

(iii) instantiation: if c is introduced in 0,with context O E B , then c(@ (EtYP(4

PI>.

dEB[g]3

For our language theoretical purposes we need not distinguish between r and T . So in the sequel we just use r , intending to cover T as well. Then the remaining general rules: for Q , for type-modification and strengthening. 2.2.2.

(iv) Q-reflexivity: I- A (v)

+A

A.

Q-propagation: A Q B, k C, ( B > C or C > B ) + A 9 C.

(vi) type-conversion: A E B Q

c jA E c.

(vii) strengthening: if (xEa,r]) I- B (E/QC), x does not occur free in r](,C) and B then r] I- B (E/QC). The Q-propagation rule still depends on an assumed reduction relation, e.g. either with or without the extensional reductions r ] , E , IS.The rule of strengthening is only included for technical reasons associated with r] and E , so can be omitted in the non-extensional case. Notice that the rule of type-inclusion of AUT-QE has been left out here. Its role, viz. of transforming (type-valued) functions into types, is to be played here by the product rule for 2-expressions of the next section. 2.3. The specific rules I Now we come to the rules specific for AUT-II. They are divided into three groups. Each consists of one (or more) introduction rule(s), one (or more) elimination rule(s), and a type formation rule to provide the introduced expression(s) with a type. With each group an IE-reduction rule (i.e. introduction-elimination reduction rule) and its extensional counter part can be associated.

I Abstraction, application and products. (1) Product rule 1: x E a I-lB

+ k1n ( [ x : a]B).


(2) Product rule 2: BEn([z:a].)

309

* n(B)Er.

(3) Abstr. rule: k'a, zEa ki+' B (EC) =+ ki+' [z : a]B (EII([z : a]C)).

(4) Appl. rule 1: A E ~k2BErI([z: , alp)

+ F2(A) B (Ep[A]).

(5) Appl. rule 2: A E ~BEn(C), , CErI([z:a].)

*

( A ) B (E(A)C).

The associated reduction relations are p and 7:

(A) [z : a]B >p B [A] , [z : a](z) A >,, A if z @ FV(A)

.

It is in the above group of rules that the difference between AUT-QE and AUT-II becomes explicit. For a discussion of the rule of n see 1.5, and [ C . 5 , VIII.S.l]. Notation: In case z @ FV(B) we abbreviate II( [z : a]B ) by a --t B. Using this convention, product rule 2 and appl. rule 2 become

BE&+?-

* n ( B )E T

and

A E ~ B , En(c), CEa-v

*

(A)BE(A)C.

2.4. A possible extension concerning 1-expressions Notice that all compound correct 1-expressions have a II in front, or possibly (when 1-abbreviation constants are present) &reduce to a n expression starting with II. In fact, each correct 1-expression &reduces to an expression like II([Zl : a11 rI([z2 : a4 rI(...rI([ :z an] n T )...))). As a consequence all 1-expressions contain parts which are not correct, e.g. the part [z : a]T in n([z: a]T ) . If we do not like this we can easily extend the language by (1) restricting the notion of inhabitable 1-expressions: 1-expressions are said to be inhabitable according to: (i)

7

inhabitable,

(ii) if B inhabitable, then

n([z: a]B) inhabitable,

(iii) if B inhabitable, B 9 C, then C inhabitable. (2) restricting product rule 1: z E a k1B , B inhabitable

+ k rI( [z : a]B ) .

+

(3) dropping the restriction to degree i 1 in the abstr. rule. Then, we can further extend AUT-rI to a +-language (i.e. all value degrees are also function degrees, see V.2.7) by

D.T. v i ~ nDaalen

310

(4) adding a new appl. rule:

A E ~ B, Q [ z a: ] C

+k (A)B.

These changes are relatively unimportant, of course. 2.5. The specific rules I1 2.5.1. The rules of group I can be considered as just rephrasing the corre-

sponding rules of AUT-QE. Now, however, we come t o rules which have no counterpart in AUT-QE.

I1 Pairs, projections, sums. Let cpEa + r. Then (1) Sum rule: I- C(p) (ET).

*

(2) Pair rule: A E ~B, E ( A ) ~ ~ k (cp,A,B)(EC(cp)).

( 3 ) Projection rules: CEC((P) =s I- C(l) ( ~ a k ) ,C ( 2 )(E(C(*)) 9). The reduction rules associated with group I1 are

A

and

0:

(cp,A,B)(,)> r r A , (cP,A,B)(2)>?r B AEC(cp)

*

(!%4(1),42))

>o

A

2.5.2. Notice that here, for the first time, reduction ceases to be a purely syntactical matter. The condition A E C(cp) is inserted here because we want to maintain preservation of types

A E ~ A, > B * B E ~ . Otherwise, we come in trouble with cp E a + 7 ,A E a , 1c, = [z : a]( A )cp, BE ( A )cp, where C e (cp,A,B)EC(cp)and ( $ J , C ( , ) , C ( ~ ) ) E Cand ( $ Jnot ) cpQ$J. As a consequence we must modify one of the monotonicity rules into: if zEa + A > B then [z : a ] A > [z : a]B. 2.5.3. Notation: In case z @ FV(@ we abbreviate C([z : alp) by a 8 p. For pairs (9,A , B ) in such a degenerate sum we can omit the type label cp and just write ( A ,B ) (because it is intended that cp can be constructed from A and B in this case). The degenerate versions of pair rule and projection rules are:

A E ~ BEP , CEa8P

*

+

( A , B ) E ~ @ ~

C(l)Ea, C ( 2 ) E p .

311


For degenerate pairs the typing condition for a-reduction can be omitted. Notice that, in contrast with products, only degree 2 sums are formed, and consequently only degree 3 pairs. Besides, the two components of a pair are 3-expressions too. 2.6. The specific rules I11 See the discussion in 1.4. The rules concern

I11 Binary unions, injections and plus-terms. Let ~ E T P, E T . Then (1) Binary union: I- a e3 P (E 7). (2) Injection 1: A E + ~ I- il(A,P) ( E a @ P ) .

(3) Injection 2: BED =+ I- Zz(B,a) (Eae3P). (4) Plus rule: y E 7 ,B E a -,y, C E P -, y I- B (33 c (E (a€I3 P ) -,7 ) .

*

The associated reductions are

+ and

E:

(il(P,A)) (C e3 D) >+ (A) c , ( i z ( B ,0))(C @ D ) >+

(4D

[x : a](il(z))F @ [z : PI ( i z ( x ) )F

.

>€

F if z

FV(F)

Notation: @ is supposed to bind more loosely than the other connectives. This is why the function parts of the +-redices are, and the left- and right part of the E-redex are not put inside parentheses. We mention also the alternative form of +, +’ (which is in fact followed by PI:

+

(il(A,P ) ) ([.

:

I.

B e3 C) >+‘ B “41

and an alternative form of

.1

E,

salt:

: a1 B [Ylil(Z,P)I e3 .[ : PI

We clearly have

B [ y l i z ( z ,.)I

>€alt

[Y : a @ PI B .

>+! =+ >+>p (see 11.7.1.2 for the notation). Further

( il( A ,P ))(B @ C+’ ( A ) B

+

etc. i.e. >+ =+ +~. So, as far as equality 9 is concerned, we have (P, =+- +’) and (7, +’ =+ +). Since we always include P, and 7 is optional, we prefer the rule in our definition. Similarly we have >€ >ralt>,, and >Ealt =+ Edt

.1

: a @PI Y

E

or E alt:

*

We do not discuss this extension here, because it really complicates the normability problem (see [ C.5, VIII.4.6)). 2.8. Elementary properties As in V.2.7-V.2.9 we can infer some nice properties. First, concerning the degrees: I- A

* A degree correct

A 9B AEB

degree(A) = degree(B) 3 degree(A)

= degree( B )

+1 .

Then, concerning contexts, renaming (see (C.5, V.2.9.21) and weakening ( [ C . 5 , V.2.9.31). Further, the simultaneous and the single substitution theorem ([C . 5 , V.2.9.4-5]), and correctness of categories ( [ C . 5 ,V.2.101): A E B I- B. Analogously to the abstr. and appl. properties in ((7.5, V.2.101 and [C.5, V.2.141 (which mutatis mutandis hold hold as well in AUT-II) we have properties like

*

I- (9, A, B )

* ( AEa, c p ~ a+

7,

B E(A) cp) etc.

i.e. the “inversion of the correctness rules”. An important additional property (to be proved in the next section) is uniqueness of types: AEB, AEC*BqC which in AUT-QE did not hold for A of degree 2, because of type inclusion.

313

Generalizing Automat h by Means of a Lambda-Typed Lambda Calculus* N.G. de Bruijn

SUMMARY The calculus A h developed in this paper is claimed to be able t o embrace all the essential aspects of Automath, apart from the feature of type inclusion, which will not be considered in this paper. The calculus deals with a correctness notion for lambda-typed lambda formulas (which are presented in the form of what will be called lambda trees). To an Automath book there corresponds a single lambda tree, and the correctness of the book is equivalent to the correctness of the tree. The algorithmic definition of correctness of lambda trees corresponds to an efficient checking algorithm for Automath books.

1. INTRODUCTION 1.1. Automath and lambda calculus We are not going to explain Automath in this paper; for references and a few remarks we refer to Section 6.1. The basic common feature of the languages of the Automath family is lambda-typed lambda calculus. Nevertheless Automath has various aspects of a different nature, of which we mention the context administration and the mechanism of instantiation. Moreover there is the notion of degree, and the rules of the languages, in particular those regarding abstractors, are different for different degrees. But a large part of what can be said about Automath, in particular as far as language theory is concerned, can be said about the bare lambda-typed lambda calculus already. In [de Bruijn 71 (B.2)] it was described how a complete Automath book can be considered as a single lambda calculus formula, and that idea gave rise *Reprinted from: Kueker, D.W., Lopes-Escobar, E.G.K. and Smith, C.H., eds., Mathematical Logic and Theoretical Computer Science, p. 71-92, by courtesy of Marcel Dekker Inc., New York.

N.G. de Bruijn

314

to work on language theory ([Nederpelt 73 (C.3)], [van Daalen 801) about the lambda-typed lambda calculus system called A. This system of condensation of an Automath book into a single formula (AUT-SL: single line Automath book) had a disadvantage, however. In order to put the book into the lambda calculus framework it was necessary to first eliminate all definitional lines of the book. Considering the fact that the description of a mathematical subject may involve a large number of definitions, the exponential growth in length we get by eliminating them is prohibitive in practice: it can serve a theoretical purpose only. The kind of lambda-typed lambda calculus to be developed in the present paper may be better in this respect. It makes it possible to keep the full abbreviational power of Automath books within the framework of a lambda calculus. In this framework a number of features of Automath can be explained in a unifying way. Lines, contexts and instantiations all vanish from the scene. They find their natural expression in the lambda calculus, like in AUT-SL, but now without loosing the relation with the original Automath book. In particular the way we actually check the correctness of an Automath book is directly related to an efficient way t o check the correctness of a lambda formula. Therefore the checking algorithm described in this paper can be expected to become a basis of all checkers of Automath-like languages. The little differences between the various members of the Automath family lead to rather superficial modifications of that basic program. It can be expected that most of these modifications will be felt at the input stage only. The paper is restricted t o the Automath languages without type inclusion. The feature of type inclusion (which is used in AUT-68 and AUT-QE) requires modifications in the correctness definition and the checking algorithm. We shall not discuss such modifications here.

1.2.

lkees

The paper has another feature, not strongly related t o the main theme. That feature is the predominant place given to the description in terms of trees rather than to the one in terms of character strings. Of course, this may be considered as just a matter of taste. Nevertheless it may have an advantage to have a coherent description in terms of trees, in particular for future reference. The author believes that if it ever comes to treating the theory of Automath in an Automath book, the trees may stand a better chance than the character strings.

Generalizing Automath (B. 7)

315

2. LAMBDA TREES

2.1. What to take as fundamental, character strings or trees Syntax is closely connected to trees. Formulas, and other syntactic structures, are given as strings of characters, but can be represented by means of trees. On the other hand, treeshaped structures can be coded in the form of strings of characters. One might say that the trees and the character strings are two faces of one and the same subject. The trees are usually closer to the nature of things, the character strings are usually better for communication. Or, to put it in the superficial form of a slogan, the trees are what we mean, the strings are what we say. Discussing syntax we have to choose which one of the two points of view, trees of strings, is to be taken as the point of departure. Usually one seems to prefer the character strings, but we shall take the less traditional view to start from the trees. One can have various reasons for this preference, but here we mention the following two as relevant for the present paper: (i) It seems t o be easier to talk about the various points of a tree than about the various “places” in a character string. (ii) The trees make it easier to discuss the matter of bound variables. We shall use the character strings as a kind of shorthand in cases where the trees become inconvenient. This shorthand is quite often easier to write, to print and to read, but the reader should know all the time that the trees are the mathematical structures we really intend to describe. In Section 2.7 we shall display the shorthand rules. 2.2. The infinite binary tree We start from a set with two elements, 1 and r (mnemonic for “left” and “right”). W is to be the set of all words over ( 1 , T } , including the empty word E ; in standard notation W = {l,r}*. This set W will be called the infinite binary tree. We consider the mappings father leftson rightson

(W\{E})+ W , : W +W , : W +W .

:

The father of a word is obtained by omitting its rightmost letter, the leftson is obtained by adding an 1 on the right, the rightson is obtained by adding an r on the right.

N.G. de Bruijn

316

Examples: father(1) = E , father(?-) = E , father(1rl) = IT leftson(&)= 1 , leftson(lrr1) = 1 ~ ~ 1 1 , rightson(&)= T

rightson(rl1) = rllr.

In these examples we have followed the usual sloppy way t o write words as concatenated sequences of letters, and to make no distinction between a oneletter word and the letter it consists of. We define the binary infix relation < by agreeing that u < v (with u E W , v E W ) means that the word u is obtained from the word v by omitting one or more letters on the right. So ITT < I T T T ~ , and E < u for all u E W\{E}. The relation is obviously transitive. As usual, u 5 v means that either u < v or u = v. And v > u (v 2 u ) will mean the same thing as u < v (u 5 v).

2.3. Binary trees We shall consider all binary trees t o be finite subtrees of the infinite binary tree. A binary tree is a finite subset V of W with the following properties:

(i)

E

E

V,

(ii) for all u E V with u #

E

we have father(u) E V ,

(iii) if u E V then leftson(u) E V if and only if rightson(u) E V . Elements of V are called points of the binary tree. If u E V and leftson(u) # V , rightson(u) # V , then is called an end-point of V . The set of all end-points is denoted V,. The point E is called the root of

V. There are two popular ways t o draw two-dimensional pictures of a binary tree. The way we follow in this paper is to draw sons above their fathers. The other one has the fathers above their sons (such pictures can be called weeping willows). In both cases leftson(u) is drawn t o the left of rightson(u), for all u. Readers who prefer to draw weeping willows instead of upright trees will not have any trouble, since for their benefit we shall avoid the use of terms like “up”, “down”, “above”, “below” for describing vertical orientation. The inequality < is neutral in this respect. 2.4. Labels We consider three different objects outside W . They will be called A, T and Elements of the set W U {A, T, T} will be called labels. Points with label A or T will be called A-nodes and T-nodes, respectively. T.

Generalizing Automath (B.7)

317

If V is a binary tree then any mapping of V into the set of labels is called a labeling of V . If f is a labeling, and u E V , then f(u)is called the label of u. 2.5. Definition of lambda trees

A lambda tree is a pair (V,lab), where V is a binary tree, and lab is a labeling of V that satisfies the following conditions (i), (ii), (iii): (i)

If u E V\Ve then lab(u) E { A , T } .

(ii) If u E V, then lab(u) E V U { r } . (iii) If u E V, and lab(u) E V then lab(lab(u)) = T and rightson(lab(u)) 5 u.

2.6. An example We give an example with 17 points. These points and their labels are specified as follows: lab(&)= T , lab(l) = r , lab(r) = T , lab(r1) = T , lab(rll) = 7 , lab(&) = A , lab(rZr1) = rl , lab(r1rr) = E , lab(rr) = A , lab(rrl) = T , lab(rrl1) = T , lab(rr1r) = r , lab(rrr) = T , lab(rrrl) = 7 , lab(rrrr) = T , lab(rrrr1) = TTT , lab(rrrrr) = T . This lambda tree is pictured in Figure 1.

Figure 1, A lambda tree The picture does not show the names of the points, but it does show their labels as far as they are A, T or r. In the cases of points u with labels in V we have indicated lab(u) by means of a dotted arrow from u (which is always an

N.G. de Bruijn

318

end-point, according t o 2.5 (i)) to lab(u) (which is a point on the path from u to the root of the tree). Indeed the arrows always go to points with label T , and at such points the arrows always come from the right, according to 2.5 (iii).

2.7. Representation of a lambda tree as a character string We begin by taking a set of identifiers to be called dummies. They are no elements of the set of labels. Next in some arbitrary way we attach a dummy to every point of the tree that has label T , and different points get different dummies. In the example of 2.6 we attach X I to E , x2 to r , 23 t o rl, 2 4 to rr1, x5 to rrr, 2 6 to rrrr. We can now also attach dummies to the end-points as far as their label is not T . To the end-point u (with label lab(u) E V ) we attach the same dummy as we attached t o lab(u). The point lab(u) with its dummy is called the binding instance of the dummy, the point u with its dummy is called a bound instance. In Figure 2 the dummies are shown. The arrows could be omitted since their information is provided by the dummies: the arrows run from the bound instances of a dummy to its binding instance.

Figure 2, Tree with named dummies We now produce the character string representation by the following algorithm that attaches character strings to all subtrees: (i)

A subtree consisting of a single point is represented by T if its label is and by its dummy if it is a bound instance of that dummy.

T

(ii) A subtree whose root is labeled by A , to which there is attached a left-hand subtree (with character string P ) and a right-hand subtree (with character string Q), gets the character string ( P )Q. (iii) A subtree whose root is labeled by T , with dummy xi, say, and with P and Q as under (ii), gets the character string [xi : PI Q.


319

If we apply the algorithm to the tree of Figure 2 we get [zl : T ] [z2 : [z3 : T ] ( 2 3 ) 211 ([z4 : z2] T ) [ 2 5 : T ] (26 : 251 2 2

.

The way back from character string to lambda tree is easy, and we omit its description. 2.8. Remarks

The following remarks might give some background to our definitions and notations. (i)

The notation [z : P ]Q is the notation in Automath for the typed lambda abstraction. Here the binding dummy z is declared as being of type P. In untyped lambda calculus one might write [z] Q , but it is usually written with a lambda: Az.Q or A, Q.

(ii) In standard lambda calculus there is the construct called “application”, usually written as a concatenation QP. The interpretation is that Q is a function, P a value of the argument, and that Q P is the value of the function Q at the point P . The Automath notation puts the argument in front of the function: it has ( P )Q instead of QP. The decision t o put the “applicator” ( P ) in front of the function Q , is in harmony with the convention to put abstractors (like the [z : P] above) in front of what they operate on. Older Automath publications had { P }Q instead of ( P )Q. (iii) The T has about the same role that is played in Automath by ‘type’ and ‘prop’, the basic expressions of degree 1. (iv) The labels A and T in the lambda tree are mnemonic for “application” and “typing”. (v) The typing nodes are at the same time lambda nodes. This is different from what we had in [de Bruzjn 72b (C.2)],Section 13; there the lambda was a separate node in the right-hand subtree of the node with label T. Taking them together has the effect that the arrows in the lambda tree lead to nodes labeled T instead of A, and that the provision has to be made that arrows leading to a T-node always arrive from the right (see 2.5 (iii)). In the character string representation this provision means that in the case of [z : P]Q the dummy 2 does not occur in P. (vi) The tree of Figure 2 can be presented in namefree form by means of the reference depth system of [ d e Bruzjn 72b (C.2)]. We explain it here: If

N.G. de Bruijn

320

there is an arrow from an end-point u to lab(u) then the reference depth of u is the number of IJ with lab(v) = T and lab(u) 5 IJ < rightson(v) 5 u. We can replace the information contained in lab(u) by the reference depth of u. If that depth is 3, say, then we find lab(u) by proceeding from u to the root of the tree; the point we want is the third T-node we meet, provided that we only count T-nodes we approach from the right. For the tree of Figure 1 this is carried out in Figure 3.

Figure 3, Tree with reference depths Comparing Figure 3 t o Figure 2 we note that the three ones in Figure 3 lead to three different dummies ( 5 3 , 52, 55) in Figure 2, and that the two bound instances of 52 have the different reference depths 1 and 3. If we pass from the tree to the character string representation, we can omit the names of the dummies. We can write the namefree form of the example of Figure 2 as

This simple example demonstrates that the depth reference system was designed for other purposes than for easy reading.

3. DEGREE AND TYPE 3.1. Introduction

To every lambda tree we shall assign a non-negative number, t o be called its degree. And we shall even assign a degree to every end-point of a lambda tree.


32 1

If a lambda tree has degree > 1 we shall define its type, which is again a lambda tree. The degree of the new tree is 1 less than the one of the original one. As a preparation we need the notion of the lexicographical order in a binary tree. Moreover, for the definition of the type of a lambda tree we need the notion of implantation.

3.2. Lexicographical order In a lambda tree the points are words consisting of 1’s and r’s. We can order them as in a dictionary, starting with the empty word. For the tree of Figure 1 (Section 2.6) the dictionary is: E,

1 , r, rl, rll, rlr, rlrl, rlrr, rr, rrl, rrll, r r l r , rrr, rrrl, rrrr, r r r r l , rrrrr

.

A word u is said to be lexicographically lower than the word v if u comes before v in the dictionary. Note that if u < v (in the sense of Section 2.2) then u is lexicographically lower than v, but the converse need not be true. 3.3. Ascendants Let (V,lab) be a lambda tree. If u is an end-point with lab(u) # T then we shall define the ascendant of u, to be denoted by asc(u); it will be again an end-point. We note that lab(u) is not an end-point (see 2.5 (iii)), and therefore there exist points of V which are lexicographically higher than lab(u) and lower than rightson(lab(u)). The lexicographically highest of these is an end-point of V, and it is this end-point that we take as the definition of asc(u). Let us take Figure 1 as an example. The end-points are, in lexicographic order: I , rll, rlrl, rlrr, rrll, r r l r , r r r l , rrrrl, rrrrr. Of these, I , rll, r r l r and rrrl have no ascendants, but asc(rlr1) = rll, asc(r1rr) = I , asc(rrl1) = r l r r , asc(rrrr1) = rrrl, asc(rrrrr) = r l r r . 3.4. Degree of an end-point If u is an end-point of (V,lab), and lab(u) # cally lower than u. This is obvious since (i)

7,

then asc(u) is lexicographi-

asc(u) is lexicographically lower than rightson(lab(u)),

(ii) rightson(lab(u)) 5 u by Section 2.5, so (iii) rightson(lab(u)) is either equal to or lexicographically lower than u. We can now define the degree deg(u) of the end-points one by one, proceeding through the lexicographically ordered sequence of end-points. We define

N . G . de Bruijn

322 deg(u) = 1

+ deg(asc(u))

deg(u) = 1

if lab(u) = r

,

if lab(u) #

.

T

This defines deg as a function: deg : V,

+

{1,2,3,...}

.

In the example of Figure 1, we have 1, rll, rrlr, rrrl of degree 1, rlrl, rlrr, rrrrl of degree 2, and rrll, rrrrr of degree 3. 3.5. Degree of a l a m b d a tree

As the degree of a lambda tree (V,lab) we define deg(w), where w is the lexicographically highest point of V. This w is a word without l’s. Note that a lambda tree can have end-points whose degree exceeds the degree of the tree. We get an example if in the tree of Figure 1 we replace the label of rrrrr by r : then the tree has degree 1 but its point rrll has degree 3. 3.6. I mp la n tation Let (V,lab) be a lambda tree, and u be a point of V, not necessarily an end-point. And let S be a set of end-points of V . We assume that the following implantation condition holds: for every w E S and for every v E V with v 2 u, lab(v) E V, lab(v) < u we have rightson(lab(v)) 5 w. In this situation we shall describe a new lambda tree obtained by implanting at every point of S a copy of the subtree whose root is u. This new tree (V’,lab’) will be denoted as (V’, lab’) = impl( V, lab, u, S) . First we form the subtree at u, to be denoted as sub(u). It is the set of all words p E { l , r } *such that the concatenation up belongs to V . Next we define V’ as V’=VU

u

wES

u

p€sub(u)

WP

where wp is the concatenation of w and p. In order to define the labeling lab‘ of V’ we divide the set sub(u) into two categories: subl(u) and sub2(u). The first one, subl(u), is the set of all p E sub(u) for which both lab(up) E V and lab(up) 2 u. Such a p has the property that lab(up) = uq with some q E sub(u). We may call these p’s points with internal reference. All other points of sub(u) are put into sub2(u). This consists of the p’s such that lab(up) is A, T or T and of all p’s for which both lab(up) E V and lab(up) < u. The latter p’s may be called points with external reference. We are now ready t o describe the labeling lab’ of V‘. For all u E V\S we take lab’(u) = lab(u). The other points of V’ can be uniquely written as wp with w E S, p E sub(u). If p E sub2(u) we simply take lab’(wp) = lab(up). If


323

p E subl(u), however, the label of the copied point is no longer the same as the original label, but the copy of the original label. To be precise, if q is such that lab(up) = uq, then we take lab’(wp) = wq. Note that if s E S then s belongs to both V and V‘, and that lab’(s) can be different from lab(s). It is not hard to show that (V‘, lab’) is again a lambda tree. In Figure 4 we show a case of implantation. The lambda tree on the left is (V,lab), the one on the right is (V‘,lab’). We have (V’, lab’) = impl( V, lab, rl, { rrr}). S

Figure

4,

Implantation

3.7. Implantation and degree We keep the notation of Section 3.6. Taking some fixed w E S we can consider the wp (with p € sub(u)) as copies of the corresponding up. We now claim that the degree of wp in (V’, lab’) is always equal to the degree of u p in (V, lab). This can be proved by induction, letting p run through sub(u) in lexicographical order. If p is an external reference then the statement on the degrees is an easy consequence of the fact that the points of V\S have in (V,lab) the same degree as in (V’,lab’). If p is an internal reference, however, we remark that the ascendants of up in (V,lab) and of wp in (V’,lab’) are corresponding points again, so that they have equal degree by the induction hypothesis. Since deg(up) = deg(asc(up)) 1, deg(wp) = deg(asc(wp)) 1, we also have deg(up) = d e g ( w ) .

+

+

3.8. Type of a lambda tree If a lambda tree (V,lab) has degree > 1 we shall define the type, which is again a lambda tree. Let w be the lexicographically highest point of w (see 3.5). If lab(w) = T then (V, lab) has degree 1 and its type will not be defined. The only other possibility is that lab(w) E V. Now lab(lab(w)) = T , whence lab(w) has a leftson. We now

N.G. de Bruijn

324

define the type of (V, lab), to be denoted typ(V,lab), by implanting the subtree of leftson(lab(w)); here the set S consists of the single point w: typ(V, lab) = impl(V, lab, leftson(lab(w)), {w})

.

An example of typing is already available in Figure 4: the tree on the right is the type of the one on the left. 3.9. Typing lowers the degree by 1

We shall show that if the degree of (V,lab) exceeds 1, then the degree of typ(V, lab) is one less than the degree of (V,lab). Let again 20 be as in Sections 3.5 and 3.7. Since deg(w) > 1, w has an ascendant: u = asc(w). Then deg(w) = deg(v) 1. In the terminology of Section 3.8 we can now state that the lexicographically highest point in typ(V,lab) is the copy of v, and so, by the result of that section, its degree in typ(V, lab) equals the degree of u in (V, lab). So the degree of type(V, lab), i.e., the degree of its lexicographically highest point, is one less than deg(w), which is the degree of (V, lab).

+

4. REDUCTIONS 4.1. Beta reduction

We shall not present beta reduction directly. It will be introduced as the result of a set of more primitive reductions: local beta reductions and ATremovals. The reason for this is that the delta reductions of Automath can be considered as local beta reductions, and not as ordinary beta reductions. 4.2. AT-pairs

Let (V,lab) be a lambda tree. An AT-pair is a pair (u,v) where u E V, u E V, lab(u) = A, lab(v) = T, v = rightson(u).

Example: in Figure 1 (TT, T T T ) is an AT-pair. 4.3. AT-couples

We mention that whatever we do with AT-pairs can be generalized to ATcouples. We shall not actually use AT-couples, but we give the definition for the sake of completeness. Let n be a positive integer, let u1, u2, ...,u,,be points 1 = 1 5 n. Furthermore, whenever of V with ui = rightson(uj) for 1 < j 1 5 m < n, the number of i with 1 5 i 5 m and lab(ui) = T is less than the number of i with 1 5 i 5 m and lab(ui) = A. And finally the number of i with 1 5 i 5 n and lab(ui) = T is equal to the number of i with 1 5 i 5 n and lab(ui) = A. Now ( u l , ~ , , )is called an AT-couple. It is easy to see that

+


325

lab(u1) = A, lab(u,) = T . The situation can be illustrated by replacing the sequence ul,..., un by a sequence of opening and closing brackets: ui is replaced by an opening or a closing bracket according to lab(ui) = A or lab(ui) = T . The conditions mentioned above mean that the first and the last bracket form a matching pair of brackets, like in

[I1 “I[111.

4.4. Local beta reduction Let (V,lab) be a lambda tree, and let w be an end-point with lab(w) # T . We assume that the point lab(w) is the rightson of a point u with label A. So (u,lab(w)) is an AT-pair. We can now form the following implantation (Vf,lab‘) = impl(V, lab, leftson(u), {w})

.

The passage from (V, lab) to (Vf,lab’) is called local beta reduction at w. We give an example in the language of character strings. Let (V,lab) correspond to

[w:7][z: ([z:w]z)[y: [p:T]T](y)y]T. We apply local beta reduction to the second one of the two bound occurrences of y. It comes down to replacing that y by [ z : w]z (but we have to refresh the dummy z ) :

[w: T I [z: ( [ z : w ] z ) [y : [p : TI TI (y) [q : w]q] 7 * 4.5. AT-removal

Let (u,v) be an AT-pair in the lambda tree (V,lab), and assume that there is no w E V such that lab(w) = v. Then we can define a new lambda tree (V’,lab’) that arises by omitting this AT-pair and everything that grows on u and v on the left. A formal definition of V’ is the following one. We omit u and v from V, and furthermore all points which are 1 u1 and all points which are 2 vl. Next every point of the form urrw is replaced by the corresponding uw. In the latter cases the labels are redefined: if in V we had lab(urrw) = U T T Z then we take lab’(uw) = uz; if, however, lab(urrw) is not 2 urr we just take lab’(uw) = lab(urrw). We given a n example of AT-removal in the language of character strings. In ((7) .[ :

TI [Y : 71 Y) 7

there are no bound instances of

2, so

the pair

(T)

[z : T] can be removed.

N.G. de Bruijn

326

The result is

4.6. Mini-reductions

We shall use the word mini-reduction for what is either a local beta reduction or an AT-removal.

4.7. Beta reduction Let (u,v) be an AT-pair in the lambda tree (V, lab). Then beta reduction of (V,lab) (with respect to (u,v)) is obtained in two steps: (i) We pass from (V, lab) to impl(V, lab, leftson(u), S) , where S is the set of all w E V with lab(w) = v. (ii) This new lambda tree still has the AT-pair (u,v). To this pair we apply AT-removal. Step (i) can also be described as a sequence of local beta reductions, applied one by one to the w with lab(w) = v. The order in which these w's are taken is irrelevant.

4.8. The Church-Rosser property In the following, R is a relation on the set of all lambda trees. For example, the relation R can be the one of mini-reduction: if A and B are lambda trees then (A, B) E R expresses that B is obtained from A by mini-reduction. If A and B are lambda trees, we say that B is an R-reduct of A if either B = A or there is a finite sequence A = Ao, A l , ...,A , = B such that for every i (0 5 i < n ) we have (Ai,Ai+l) E R. We say that lambda trees C and D are R-equivalent if there is an E which is an R-reduct of both C and D. Simple examples of this are (i) the case C = D , and (ii) the cases where D is an R-reduct of C . We note that this equivalence notion is obviously reflexive and symmetric. If it is also transitive, we say that R has the Church-Rosser property.

Generalizing Automath (€3.7)

327

4.9. Church-Rosser for beta reductions The famouschurch-Rossertheorem states that in untypedlambdacalculus the set of all beta reductions has the Church-Rosser property (see [Barendregt 811). The fact that we have lambda trees with T-nodes does not make it much harder. The left-hand subtrees of the T-nodes do not play an important role in the beta reductions, but nevertheless reductions take place in these subtrees too, so they cannot be ignored. For a treatment that inludes the case of lambda trees we refer to [ d e Bruzj'n 72b (C.2)]. 4.10. Church-Rosser for mini-reductions The Church-Rosser property for mini-reductions is a simple consequence of the one for beta reductions. Actually two lambda trees C and D are beta equivalent if and only if they are mini-equivalent. This follows from the transitivity of beta equivalence, combined with (i) If A leads to B by a beta reduction then B is a mini-reduct of A. (This was already noted at the end of Section 4.7.) (ii) If A leads to B by a mini-reduction then A and B are beta equivalent. In order t o show (ii) we note that if the mini-reduction is local beta reduction with the AT-pair (u, v), then beta reduction with respect t o (u, v) can be applied both to A and B , and the results are identical. If the mini-reduction is AT-removal, it is just a case of beta reduction. 4.11. Equivalence Now that we know that beta equivalence and mini-equivalence are the same, we just use the word equivalence for both.

5. CORRECTNESS 5.1. Introduction The notion of correctness of a lambda tree is concerned with the type of the P's that occur in subtrees ( P )Q. Roughly speaking, we require that either Q, or the type of Q, or the type of the type of Q, ... , is equivalent to something of the form [x : R] S, where R is equivalent to the type of P. The system of all correct lambda trees will be called delta-lambda (or Ah). It is different from the older system A (see [Nederpelt 73 (C.3)], [van Daalen SO]) in the following respect. In A we always require for the correctness of ( P )Q that

N.G. de Bruijn

328

both P and Q are correct themselves. In AA we do not: P should be correct, but in formulating the requirements for Q we may make use of P. For example, in ( P )[z : R]S the [z : R]S need not be correct. We may have to apply local beta reduction by means of the pair ( P )[z : R], that transforms S into some S’ such that [z : R]S’ is correct. We actually need this feature if we want to interpret an Automath book as a correct lambda tree. 5.2. Subdivided lambda trees In order to facilitate the formulation of correctness, we introduce a particular kind of lambda trees, where the points are colored red, white and blue. We consider a quadruple (V, lab, p , q ) , where (V,lab) is a lambda tree, and p , q are non-negative integers. Every u E V is a word of T’S and l’s, and by ~ T ( u )we ) 0, ~ T ( T T = ) 2, ~ T ( T T ~ = T ) 2, denote the number of T’S it starts with. So ~ T ( E = etc. The points u with TIT(U) 5 p are called red, those with p < ~ T ( u )5 q white, those with n r ( u ) > q blue. The points el T , T T , T T T , ... are called main line points. We shall call (V,lab,p,q) a subdivided l a m b d a tree if (i) and (ii) hold: (i) The white main line points all have label A . (ii) Among the red main line points there are no two consecutive labels A , and the last one in the red sequence E , T , T T , ... has label T . In other words, the sequence can be partitioned into groups of length 1 and 2, those of length 1 have label T , and those of length 2 consist of two consecutive points with labels A and T , respectively. It is any easy consequence of (i) and (ii) that the set of blue points is nonempty. Note that the conditions are automatically satisfied if p = q = 0. In other words, any lambda tree is a subdivided lambda tree if we color it all blue. In the language of character strings a subdivided lambda tree looks like RWB, where W is a (possibly empty) string ( P I )... (pk)(where k = q - p ) , and R is a string with entries either of the form [z : Q] or of the form ( P )[z : Q]. The red part R might be called a knowledge f r a m e , the white part W a waiting l i s t . In order to clearly indicate the subdivision we write the character string as

w,B ) .

(R,

5.3. The deflnition of correctness Let Slam3 be the set of all subdivided lambda trees. It can be presented as a set of triples ( R ,W,B).

Generalizing Automath (B. 7)

329

We shall define a subset Corr3 of Slam3. The elements of Corr3 are called the correct elements of Slam3. A lambda tree (V,lab) is called correct if (V,lab, 0,O) E Corr3. We note that (V,lab, 0,O)equals ( E , E , B ) if the character string B represents (V,lab). As always, E stands for the empty string, and we shall use the obvious notations for concatenation of character strings. We start by putting a set of triples ( R ,W,B ) into Corr3, in rule (i); the other rules produce new triples on the basis of old ones. (i)

If ( R ,E , 7)E Slam3 then ( R ,E , 7)E Corr3.

(ii) If z is a dummy, if ( R ,W , z ) E Slam3, and if (R,W,typ z) E Corr3 then ( R ,W,z) E Corr3. We have not defined typ z separately in this paper (it would not be a lambda tree but part of a lambda tree). But we can define ( R ,W,typ z) as the subdivided lambda tree that represents (V‘,lab‘, p , q ) , where (V‘,lab’) = typ( V,lab), and (V,lab, p , q ) is represented by ( R ,W,z). (iii) If ( R ,E , K ) E Corr3 and ( R ,W ( K ) ,B ) E Cox3 then ( R ,W,( K )B ) E Corr3. , : U ] B )E (iv) If ( R , E , U ) E Corr3, ( R [ z : V ] , c , B )E Corr3, then ( R , E [x Corr3. (v) If ( R , E , U )E Corr3, ( R ( K )[z : U ] ,W , B ) E Corr3, and if T P ( R , K , U ) holds, then ( R ,W ( K ) ,[x : U ]B ) E Corr3. Here T P stands for “type property”, and T P ( R ,K , V ) is the statement that if ( R ,E , K ) and ( R ,E , U ) represent (V,lab, p , p ) and (V’,lab’, p , p ) , respectively, then (V’,lab’) is equivalent to typ( V,lab). We remark that the conditions about Slam3 in rules (i) and (ii) guarantee that indeed Corr3 is a subset of Slam3. It may seem strange that in rule (i) there is no correctness requirement on R. Therefore we cannot claim that the correctness of ( R ,W,B ) implies the correctness of RWB. Nevertheless it can be shown that if we algorithmically check the correctness of a correct lambda tree (see Section 5.4), we will never enter into cases ( R ,W,B ) where ( E , E , RWB) is not correct, and the conditions on Slam3 in (i) and (ii) will always be satisfied. 6.4. Algorithmic correctness check

For every ( R ,W,B ) E Slam3 at most one of the rules (i)-(v) can be applied, and, apart from rule (i), these replace the question of the correctness by one or more uniquely defined other questions. If none of the rules can be applied

N.G. de Bruijn

330

we conclude to incorrectness. Those “other questions” are all about correctness again, apart from the T P ( R ,K , U ) arising in (v). This provides us with an algorithm for the task of the correctness check for a given lambda tree. We can think of the job as having been split into two parts: (i) Preparing a type check list. This means that we do not answer the question about the T P ( R ,K , U)’s with the various R, K , U turning up, but just put them on a list of jobs that still have to be done. The fact that all degrees are finite (see Section 3.4) guarantees that this job list is made in a finite number of steps. (ii) Establishing truth or falsity of the various T P ( R ,K , U)’s. The work under (i) can already lead to the conclusion that our lambda tree is incorrect. If we forget about syntactic errors that arise if we are presented with a structure that is not a lambda tree at all, this only happens in cases where we get to ( R ,W , T )with W # E , where none of our rules apply. 5.5. Remarks about the type check list The type check list can be prepared if we systematically apply the rules (i)-(v). In each one of the rules (iii), (iv), (v) there are two subgoals where something has to be shown to belong to Corr3. There are good reasons to tackle these subgoals in the order in which they are mentioned in the rules. This comes down to a lexicographical traversal of the lambda tree we have to investigate. This traversal can occasionally be interrupted by some application of rule (ii), which leads to an excursion in an extended tree. The type check list prepared by the algorithm hinted at in 5.4 can lead t o some duplication of work, by two causes: (i)

The given lambda tree can have one and the same substructure at various places. This will actually occur quite often if we represent a n Automath book as a lambda tree.

(ii) Application of rule (iv) of Section 5.3 leads us into asking questions about typ x that have already been answered before. The duplications mentioned in (ii) can be avoided to a large extent: see Section 5.8. We mention a shortcut that reduces the work needed t o prepare the type check list. It is obtained by splitting rule (ii) of Section 5.3 into (ii’) and (ii”): (ii‘) is as (ii), but with the restriction W # E , and


33 1

(ii‘) if ( R , & , z E ) Slam3 (where z is a dummy), then ( R , E , E ~ )Corr3.

5.6. Remarks about the type checks The type checks T P ( R ,K , U ) were introduced in 5.3 (vi). Given R, K , U , we can consider the question to establish by means of a n algorithm whether T P ( R ,K , V ) is true or false. The question comes down to establishing whether the (V,lab) of 5.3 (vi) has a type (which is simply a matter of degree) and whether (V’,lab’) and typ(V,lab) have a common reduct. It is quite easy to design an algorithm that does a tree search of all reducts of (V’,lab’) and typ(V,lab). If they do have a common reduct, that fact will be established in a finite time. But will “finite” be reasonably small here? And what if they do not have a common reduct? Are we able to establish that negative fact in a finite time, or at least in a reasonable time? And what if the tree search does not terminate? From a theoretical point of view we can say that our questions about the correctness of a given lambda tree are decidable. For the system A this was already shown by R. Nederpelt ([Nederpelt 7 3 (C.3)], (van Daalen S O ] ) , for A h by L.S. van Benthem Jutting (oral communication). It is done in two steps: (i) Between the notion of “lambda tree” and “correct lambda tree” there is a notion “norm-correct lambda tree”. For any given lambda tree it can be established in a finite time whether it is or is not norm-correct. For the notion of norm-correctness we refer to Section 5.9. In [Nederpelt 73 (C.3)] the term “normable” was used instead of “norm-correct”. (ii) For every norm-correct lambda tree we have the strong normalization property: there exists a number N (depending on the tree) such that no sequence of reductions is longer than N . As t o (ii) we note that if we have reduced both (V’,lab’) and typ(V,lab) to a point where no further reductions are possible, then the question becomes trivial: in that case, having a common reduct just means being equal. The strong normalization property guarantees that the question whether a given lambda tree is or is not correct is a decidable question.

5.7. Practical standpoint Apart from the cases of very small trees, the matter of decidability of correctness will not be of practical value: the number N mentioned in 5.6 (ii) will usually be prohibitively large. If a tree is incorrect, the finite time it takes to establish that fact may be hopelessly long. It is better to be more modest, and t o try to design algorithms with efficient strategies, by means of which we can

N.G. de Bruijn

332

show the correctness of the lambda trees we have to deal with in practice. If such algorithms are applied to an incorrect lambda tree, the fact that they have used an unreasonable amount of time without having reached a decision, may be considered as an indication that the tree is possibly incorrect. Sometimes we can apply quite easy checks by means of which an incorrect tree can be rejected fast: it might fail to be norm-correct, or might be no lambda tree at all. Or we might run into cases where the type of some (V, lab) is required but where deg(V, lab) = 1. 5.8. Avoiding double work

We can rearrange the definition of correctness in such a way that it leads to an algorithm that gives just a single type check corresponding to each A-node in the lambda tree we have to check the correctness of. If we just follow the algorithm sketched in Section 5.4, the cases where we have to treat ( R ,W ,typ z) will cause double work: what is involved in typ z has been earlier dealt with in the execution of the algorithm. The only thing that deserves to be checked is whether the A nodes in W match with the T-nodes that arise from typ z (possibly after one or more further applications of rule (ii)). Let us divide the waiting list into two consecutive parts. The first part is still called “white”, the second part is called “yellow”. For the yellow part the work load will be lighter than for the white part. A formal definition of these four-colored lambda trees is easily obtained by slight modification of Section 5.2. We have to consider (V, lab, p , s,q ) ; the points with p < n r ( u ) 5 s are white, those with s < n r ( u ) 5 q yellow. And the yellow main line points are required to have label A, just like the white ones. Let us denote the set of these four-colored lambda trees by Slam4. Its elements will be represented as ( R ,W,Y,B ) , just like those of Slam3 were represented by ( R ,W,B). We now formulate a new definition of correctness of lambda trees, equivalent to the old one. The difference is that the new definition leads to an algorithm that avoids the duplication we hinted at. It involves both a subset of Corr3 of Slam3 and a subset Corr4 of Slam4. The final goal is as before: (V,lab) is called correct is its character string P is such that ( E , E , P ) E Corr3. As rules we take (i), (iii), (iv), (v) as in Section 5.3, but we add new rules (vi)-(xii), where (iii) replaces the discarded rule (ii): (vi)

If ( R , E , E , TE) Slam4 then ( R ,E , E , T ) E Corr4.

(vii)

If z is a dummy, and ( R ,W ,E , z) E Corr4 then ( R ,W,z) E Corr3.


333

(viii) If z is a dummy, if ( R ,W,Y, z) E Slam4, and if ( R ,W,Y, typ z) E Corr4 z) E Corr4. The definition of ( R ,W,Y, typ z) is similar to then ( R ,W,Y, the one of ( R ,W,typ z) in 5.3 (ii). (ix)

If ( R ,W,Y ( K ) ,B ) E Corr4 then ( R ,W,Y, ( K )B ) E Corr4.

(x)

If ( R [ z :U ] , E , E , BE) Corr4 then ( R , E , E , [ zV: ] B )E Corr4.

(xi)

If ( R( K )[z : V ] W, , E , B ) E Corr4 and T P ( R ,K,V ) holds, then ( R ,W ( K ) , E[z , : V ]B ) E Corr4.

, Y,B ) E Corr4 then ( R ,W,Y ( K ) ,[z : V ]B ) E Corr4. (xii) If ( R ( K )[z : V ] W, At the end of Section 5.5 we mentioned the shortcut rule (ii’). There is a similar shortcut here: it can replace (vi) and (x): (x‘) If ( R ,E , E , B ) E Slam4 then ( R ,E , E , B ) E Corr4. However, the set of rules without shortcuts may be better for theoretical purposes. 5.9. Weaker notions of correctness

We can weaken the notion of correctness by weakening the requirement about T P ( R ,K , V ) in rule 5.3 (v). If in rule 5.3 (v) we omit the requirement of T P ( R ,K , V ) altogether, we get what we can call semicorrectness. For semicorrect lambda trees we can define a norm corresponding to Nederpelt’s norm for the system A (see [Nederpelt 73 (C.3)]).A norm is a particular kind of lambda tree: it has no labels A and all end-point labels are T . To every semicorrect lambda tree we attach such a norm. It can be defined algorithmically if we just follow the list of Section 5.8. First we define the norms of the (R, W,B)’s and ( R ,W,Y,B)’s: (i) and (vi): as norms of ( R , E , T )and ( R , E , E , Twe ) take the lambda tree consisting of just one node, labeled T . (iii): norm(R, W, ( K )B ) = norm(& W ( K ) ,B ) . (iv) and (x): as norm of (R,E,[z : V ]B ) (or of ( R , E , E[z , : V ]B ) ) we take the lambda tree with root labeled T , whose left-hand subtree is norm(R, E , U ) (or norm(& E , E , V ) ) ,and whose right-hand subtree is norm(R [z : V ] E, , B ) (or norm(R[z : V ] , E , E , B ) ) . (v): norm(& W ( K ) ,[z : V ]B ) = norm(R ( K )[z : V ] W, , B). (vii): norm(& W , z )=norm(& W , E , ~ ) . z) = norm(& W ,Y, typ z). (viii): norm(& W,Y, (ix): norm(R, W,Y,( K )B ) = norm(R, W,Y ( K ) ,B ) .

N.G. de Bruijn

334

(xi): n o r m ( R , W ( K ) , E , [ z : V ] B ) = n o r m ( R ( K ) [ z : V l , W , ~ , B ) . (xii): norm(R, W,Y ( K ) ,[z : V ]B ) = norm(R ( K )[z : U], W,Y ,B ) . The norms of ( R ,W,B ) or (R, W,Y,B ) are actually a kind of norm for W B or W Y B ; the role of R is only to provide the types of the dummies. Finally the norm of a semicorrect lambda tree (V, lab) is defined as the norm of the all-blue lambda tree (V, lab, 0,O) (which has the form (E, E, B ) ) . We can use a similar algorithm for finding the degree of a lambda tree: we just say in cases (i) and (vi) that the degree is 1, and in cases (ii) and (viii) that the degree is t o be increased by 1. Next we can define the notion of norm-correct lambda trees. We get that notion by replacing in rule 5.3 (v) the condition that the type of (V’,lab‘) is equivalent to typ(V,lab) by the condition that (V’,lab’) has the same norm as (V, lab). This condition is weaker than T P ( R , K , V ) ,and therefore every correct lambda tree is also norm-correct. For norm-correct lambda trees we have the strong normalization property (see Section 5.6). 5.10. Norms for lambda trees which are not necessarily semicorrect If (V, lab) is a lambda tree which is not semicorrect, that fact is established by the algorithm of Section 5.8 at some moment where we get to ( R ,W , T )or (R, W, Y ,r ) with W or Y non-empty. For such lambda trees we can nevertheless still define the norm, by the procedure of Section 5.9, if we just extend the action in cases (i) and (vi) by saying that (R, W,T ) and (R, W ,Y ,T ) have the single-noded tree (labeled by T ) as their norm, also in cases where W or Y are not empty.

6. AUTOMATH

BOOKS AS LAMBDA TREES

6.1. Some characteristics of Automath

We shall not explain Automath in detail here: we assume that the reader knows it from other sources (like [de Bruzjn 70a (A.Z)], [ d e Bruzjn 71 (B.Z)], [de Bruijn 73b],[de Bruzjn 80 (A.5)],[uanBenthem Jutting 77],[vanDaalen S O ] ) . In particular, we shall not try to be very precise in defining particular brands of Automath. Nevertheless we indicate a few characteristics, in order to get to the kind of Automath that corresponds to An. For a discussion that compares various forms of Automath in the light of such characteristics we refer to [de Bruijn 74al. (i)

Automath books are written as sequences of lines: primitive lines, ordinary


335

lines (= definitional lines), and context lines that describe the contexts of the other lines. (ii) We have the notion of typing, and that leads to the degrees. In standard Automath the only degrees are 1, 2 and 3, and it seems that for the description of mathematics no serious need for higher degrees ever turned UP. (iii) There are restrictions on abstraction. Contexts may be described as [z1 : All ... [z, : A,] where the Ai may have degree 1 or 2, but in expressions (also in the A;’s of the contexts) we only admit abstractors [z: A] where A has degree 2. (iv) In Automath we have instantiation: if the identifier p is the identifier of a line in a context of length n, then the “instantiations” p(E1, ...,E n ) ,where the Ei are expressions, can be admitted in other contexts. (v)

In some of the Automath languages (like AUT-QE) we admit “quasiexpressions”: expressions of degree 1 which are not just T .

(vi) In some of the Automath languages we have type inclusion: if E : [XI : All ... [z, : A,] T then we admit that E is substituted at places where a typing [z1 : All ... [zk: Ak] 7 (with some k < n ) is required. 6.2. Automath without type inclusion We can take Automath with quasi-expressions but without type inclusion (AUT-QE-NTI). Both AUT-QE-NTI and AUT-68 are sublanguages of AUTQE: we might say that in AUT-68 type inclusion is prescribed, in AUT-QE it is optional, in AUT-QE-NTI it is forbidden. In [ d e Bruzjn 78c (B.411 it was pointed out that AUT-QE-NTI can be used as a language for writing mathematics, somewhat lengthier than in AUT-QE. One might say that sacrificing type inclusion has to be paid by means of a number of extra axioms. But there is a disadvantage to type inclusion: type inclusion makes language theory considerably harder. The rules in AUT-QE-NTI are simple; we just mention that whenever A : B in the context [z : U ] , and U has degree 2, then [z : U ] A : [z : U ] B in empty context. 6.3. AUT-LAMBDA

In AUT-QE-NTI we still had restrictions: (i) the degrees are 1, 2 or 3, and (ii) in expressions abstractors [z : U ] are allowed only if U has degree 2.

N.G. de Bruijn

336

If we give up these restrictions, we get what we can call liberal AUT-QE-NTI. In liberal AUT-QE-NTI the role of instantiation can be taken over completely by abstractors and applicators. In order to make this clear we take a simple example: f := A : B in context [z : U ] . According to the liberal abstraction rules of AUT-LAMBDA we can write a new line F := [z : U ]A : [z : V ]B in empty context. Next, the instantiation f ( E ) is equivalent to ( E )F , so we can just replace the line f := A : B by the new one in empty context, and abolish the instantiation. Carrying on, we get books without instantiation, all written in empty context. Such books can be considered as having been written in a sublanguage of liberal AUT-QE-NTI; let us call it AUT-LAMBDA. In AUT-LAMBDA there are just two kinds of lines: (i) primitive lines

f := ‘prim’ : P and (ii) definitional lines g := Q : R .

(Note: ‘prim’ was written as PN in c her Automath public: ions.) 6.4. Turning AUT-LAMBDA into AA

We shall turn a book in AUT-LAMBDA into a lambda tree by a system that turns correct AUT-LAMBDA into correct lambda trees. It almost works in the opposite direction too, but it turns out that AA is a trifle stronger than AUTLAMBDA. The difference lies in some cases of what was mentioned in Section 5.1, but the difference is so small and unimportant that it seems t o be attractive to modify the definition of AUT-LAMBDA a tiny little bit, in order to make the correspondence complete. The transition is simple. We turn the identifiers of a book in AUT-LAMBDA into dummies. To a line f := ‘prim’ : P we attach the abstractor [f : PI, t o a line g := Q : R we attach the applicator-abstractor pair (Q)[g : R]. We do this for each line of the book, and put the abstractors and applicator-abstractor pairs into a single string, and we close it off by T. So to a book

f := ‘prim’

:

P R

g:=

Q

:

k : =

V

: W

h := ‘prim’ : 2

there corresponds the string

Generalizing Automath (€3.7)

337

and this corresponds to a lambda tree.

6.5. Checking algorithms If we start from an AUT-LAMBDA book, transform it into a lambda tree as in Section 6.4,and apply the checking algorithm of Section 5.4,then we have the advantage that the AUT-LAMBDA book is checked line by line. So even if the book is incorrect as a whole, the first k lines can still be correct, and the algorithm can establish that fact. The same thing holds if we take the weaker correctness notions discussed in Section 5.9. 6.6. Type inclusion If we want to add the feature of type inclusion to AUT-LAMBDA, the transition of a book to a lambda tree can no longer be made in the same way. Moreover we need essential changes in the notion of typing in Ah. 6.6. A variation of Ah

We mention a modification of the definition of correctness of a lambda tree, obtained by considering different kinds of A-nodes. Let us divide the set of all A-nodes of a lambda tree into two classes: strong ones and weak ones. We take it as a rule that whenever a part of a tree is copied (like in the definition of typing) the copies of weak nodes are weak again, and the copies of strong nodes are strong. For the weak A-nodes the rules are as in Section 5.3, but for the strong ones we modify rule 5.3 (iii) by not just requiring that ( R ,E , K ) and ( R ,W ( K ) ,B ) are in Corr3, but also ( R ,E , B ) . In connection to what was said in Section 5.1 we might say that A corresponds to the case where all A-nodes are taken to be strong, and that AA is the case where all A-nodes are weak. The case mentioned in Section 6.4lies between these two: if we want to close the gap between AUTLAMBDA and AA we have to make all main line A-nodes weak and all others strong. If we replace weak A-nodes by strong ones, a correct lambda tree may turn into an incorrect one, but it can be expected t o become correct again by reductions.


339

Lambda calculus extended with segments Chapter 1, Sections 1.1 and 1.2 (Introduction) H. Balsters 1. INTRODUCTION The A-calculus is concerned with axiomatizing the mathematical concept of function and the rules governing the application of functions to values of their arguments. In the A-calculus a function is seen as a rule for calculating values; this is a view which differs from the one held in set theory, where a function is t o be a set of ordered pairs and is identified with its graph. In axiomatizing the concepts of function and application we define (i) a syntax, consisting of a set of grammar rules, and (ii) inference rules. The A-calculus to be described in this section, called Aa, is an extension of the ordinary type free A-calculus (cf. [Barendregt 84al) and was originally conceived by N.G. de Bruijn (cf. [de Bruijn 78al). The main feature of Aa is the incorporation of a new class of terms called segments. These segments were originally devised in order to provide for certain abbreviational facilities in the mathematical language Automath. Automath is a typed A-calculus in which it is possible t o code mathematical texts in such a way that the correctness of each proof written in Automath can be verified mechanically (i.e. by a computer). There is much to say about the Automath system, much more than the topic of this thesis aims to cover. We shall mainly treat Aa as an interesting extension of the A-calculus in its own right and not pay very much attention t o connections with Automath. This thesis will be a rather technical treatise of the syntax and axiomatics of Xu-theory. For an introduction to the Automath project we refer to [de Bruajn 80 (A.5)] and [van Benthem Jutting 81 (B.l)];the latter paper offers an excellent introduction to a fundamental Automath-language called AUT-68. For a detailed treatise of the language theory of the Automath-languages we refer to [van Daalen 801. This introduction consists of three sub-sections. In Section 1.1 we shall give an informal description of the Ao-system and pinpoint major differences with

340

H . Balsters

ordinary type free A-calculus (for a very complete and up-to-date description of type free A-calculus we refer to [Barendregt 84a]). Section 1.2 contains an informal description of the XTu-system (Xu extended with types). The types in XTU are an extension of the types in Church’s Theory of simple types (cf. [Church 40]), the extension being that simple types are constructed for segments and segment variables. 1.1. An informal introduction t o the Xu-system

In this section we shall give an informal description of a system called Xu. We shall offer some explanation for the motivation behind the system and show in which way Xu is an actual extension of ordinary type free A-calculus. We start with a simple system called XV.

1.1.1. The system XV The system XV is the well-known type free A-calculus as described in [Barendregt 81 although there are some slight deviations in notation. Type free A-calculus has formulas like

The corresponding formulas in XV are written as

In XV functional abstraction is denoted by Xz( ...) (i.e. the function that assigns (...) to the variable x, where x may occur in (...)), and functional application is denoted by 6AB (i.e. the function B applied to its argument A, where A and B are XV-terms). Note that in XV arguments are written in front of functions, this in contrast with ordinary type free A-calculus where application of a function B to its argument A is usually written as B ( A ) . The syntax of XV is very simple and is given below.

Definition 1.1.1, (1) XV-terms are words over the following alphabet

Lambda calculus extended with segments (B.8)

...

X

variables abstractor

6

applicator

v1, ~ 2 ~ 0 3 ,

34 1

(2) The set of XV-terms is the smallest set X satisfying

xEX , for every variable x (ii) A E X + A, A E X , for every variable x (iii) A , B E X 6AB E X . (i)

*

As will be clear, XV-terms are written in prefix notation: each variable has arity 0, each abstractor A, has arity 1 and the applicator 6 has arity 2. Each term can be represented as a rooted tree. As an example we consider the term 6 2 A,

A, 6yx

(40

which we write in tree form as

6

l2 -

A,

-

A,

-

6

lY -

(4’’)

2.

The correspondence between terms like (4‘) and trees like (4”) is one-to-one. It certainly helps to think of XV-terms as such trees, and in particular t o see operations on terms as operations on their corresponding trees; especially when long terms are involved it is often useful to consider tree representation of terms.

1.1.2. Beta reduction In X-calculus we have the fundamental notion of application. The application of a function B to an argument A is written as 6AB. Apart from functional application we have the notion of functional abstraction. As said before, the intuitive meaning of A=( ...) is “the function that assigns (...) to the variable x”. This is illustrated in the following example (not a XV-term by the way) 63X,(2

*

x + 1) = 2 * 3 + 1

+

i.e., we substitute the number 3 for the variable z in 2 z 1. A formula of the form 6 A A, B is called a redex. Substitution of A for the free occurrences of z in B is denoted by C , ( A , B ) . The transition from 6 A A, B to C , ( A , B ) is called @reduction. We now proceed by giving a more formal description of substitution. We recall that an occurrence of a variable x in a term A is called bound in A if this occurrence of x lies in the scope of some abstractor A, in A ; otherwise this occurrence of x is called free in A . Note that a variable can occur both free and bound in the same term; as an example consider the two occurrences of the variable x in the following term written in tree form

H . Balsters

342

I”

6 - A,

-

6

I” -

y.

Definition 1.1.2. If A is a term and 2 is a variable and y is a variable with y # x then we define C , ( A , B ) inductively for terms B by (1) C , ( A , x ) = A W A ,Y) = Y (2) L ( A , Az C) = Xz C

(3) c,(A, A, C) =

I

A, &(A, C)

,

X,C,(A, C‘) ,

if x does not occur free in C, or: y does not occur free in A otherwise - where C’ is obtained by renaming of all free occurrences of y in C by some variable z which does not occur free in A, C.

(4) C,(A,6CD) = 6 C z ( A , C ) C , ( A , D ) .

Most of the four clauses in the definition given above are self-evident, with the possible exception of clause (3). Clause (3) is necessary in order to avoid that free occurrences of the variable y in A get bound by the A, of XyC after substitution, which would otherwise lead to inconsistencies. This renaming of bound variables is known as a-reduction. In our case it is said that XyC areduces to A, C’. Usually a-reduction is considered unessential. If a-reduction transforms a term A into A’ then A and A’ are considered to be equivalent in an informal way. This convention implies that the name of a bound variable is unessential; the “meaning” of a term is considered unaltered after performing an a-reduction on that term. Actually, in the definition of substitution given above, clause (3) does not introduce a proper term but rather an a-equivalence class of terms. 1.1.3. Name-free notation Renaming of bound variables can sometimes be very cumbersome; proofs involving a-reduction are notoriously tedious. But apart from this we have our own intrinsic reasons to avoid a-reduction. Later on we shall introduce the full Xa-system, an extension of XV. The main feature of Xa is the incorporation of a new class of terms called segments. Segments are discussed in Section 1.1.4. Substitution of segments for their corresponding variables can give rise to a large number of a-reductions, especially when the formulas are long. There is, however, a very simple way to avoid a-reduction. In [de Bruijn 78b], N.G. de


343

Bruijn introduced the concept of nameless dummies; he invented a A-calculus notation that makes a-reduction superfluous. The idea is that we just write X instead of A, A,, ... and every variable is replaced by a term of the form [ ( n ) , where n is some positive integer. Each J(n) is called a name-free variable and n is called a reference number. The reference number n of a name-free variable J(n) determines the X that binds a specific occurrence of J(n) in some term. The procedure is as follows. If the name-free variable J ( n ) occurs in some term t , we first form the tree representation o f t . We then descend from J ( n )towards the root of the tree and the n-th X encountered is the X that binds J(n). As an example consider the following name-carrying term in tree representation

X,

-

I"

lY

A,

-

6 - A, - 6 - A,

-

x.

The name-free equivalent of this term is

Remark. If a reference number n is larger than the number of X's lying on the path from an occurrence of J(n) to the root of the tree in which it occurs then we can interpret that occurrence as being free. The use of name-free notation has certain consequences for substitution of XJ-terms (XV-terms written in name-free form), which we now shortly describe. Substitution in a XJ-term t results in the replacement of free occurrences of a certain variable in t by some term u. We could also describe this situation in terms of trees by saying that certain end-points J ( n ) of the tree equivalent t^ of t have been replaced by some tree .iL. Consider the following example of such a substitution in a XJ-tree. Let t be the XJ-term

which has the following tree-representation

t^

1 J(4 16 X

-

X

-

6

-

-

J(1)

X - X -

This tree contains a redex, namely

x

- J(3)

H . Balsters

344

1 E(2) 1 6 - ((1)

6

-

x

-

x

-

x

- ((3)

and we can therefore perform a P-reduction on t^. By &reducing ((3) is a candidate for substitution of the sub-tree

t^, the end-point

/ ((2) 6

-

((1) *

Should we, however, simply replace ((3) by this sub-tree, as would have been the case if t^ had been written in name-carrying form, then this would result in the following tree t^’

x

-

x

-

x

-

x

- 6

/5(2) - ((1).

It is immediately clear that the variables ((1) and ((2) in t^’ refer to completely different A’s than in t^. This inconsistency is due to the fact that (i) ((1) and ((2) are external references in of the subterm 6((2)((1));

t^ (Lee,references t o

(ii) after replacement, the variables ((1) and ((2) in their left.

t^’

A’s to the left

have two extra A’S on

There is, however, a simple way t o resolve this inconsistency: by raising the reference numbers 1 and 2 in ((1) and ((2) by 2 in if,these variables refer t o the same A’s that they originally referred t o in t^. This example demonstrates that certain measures have to be taken in order to ensure that external references remain intact when we substitute a At-term. In Section 2, where we give a formal definition of substitution of name-free terms, we shall introduce so-called reference mappings, which see to it that reference numbers are suitably updated in order t o avoid inconsistencies as described above. We refrain from further discussion of these reference mappings here; they shall be described extensively, both informally and formally, in Section 2. In the following sections of this chapter we shall first stick to name-carrying notation of formulas. The major reason for this is to point out that namecarrying notation can possibly be maintained in Xu-calculus (XV-calculus extended with segments and segment variables), but we also want to show how awkward things can get in Xu-calculus by employing name-carrying notation. In the case of XV-calculus the name-free notation might seem exaggerated in preciseness, and we can imagine reservations towards this notation as far as readability of formulas is concerned. In the case of Xu-calculus we shall try to


345

show that the name-free notation has advantages over name-carrying notation, both in preciseness and readability. 1.1.4. Segments and abbreviations We may consider a variable as an abbreviation of a certain term if this variable can be replaced by that term by means of some suitable P-reduction. For example, consider the following term written in tree form -

/ A X

A,

-

6

-

A,

2 -

6

/" -

z .

(5)

By /3-reducing ( 5 ) we obtain the term

A,

-

6

I" -

A,

- 2 ,

(5')

i.e. a term in which the variable z has been replaced by the term A, x and the redex has vanished. If we would have more occurrences of the variable z , each bound by the A, of the redex, then each of these occurrences serves as a kind of abbreviation of the term A, x. In A n there are, however, still quite different things that we want to abbreviate. One such thing is a so-called &string like

I

A

/

B

6 - 6 - 6

C

/

.

If it occurs more than once in a certain term, we may wish to abbreviate it. Yet (6) is not a term, in the sense of a AV-term, but only part of a term; it becomes a AV-term if we place an arbitrary AV-term behind it. Such parts of AV-terms are called segments. Another example of a segment is a so-called A-string like A,

-

A,

- A,.

(7)

In Automath we have many cases where we would like to abbreviate segments. In this respect we mention an interesting Automath-language, namely Nederpelt's language A (cf. (Nederpelt 73 (C.3)]). The original idea of introducing such a language as A stems from N.G. de Bruijn who devised a language called AUT-SL (from Automath-Single Line) in which Automath texts can be represented as one single formula. The language A was devised as a fundamental and simple Automath-language which is very well suited for language-theoretical investigation. In typical codings of Automath texts in A we encounter very many copies of certain &strings and A-strings, copies which we would like to abbreviate. As a consequence, segments like &strings and A-strings will be treated

H. Balsters

346

as separate independent entities in Xa. In X u we shall even take a broader approach and allow for segments of a much more general form than &strings or A-strings alone. In the following section we shall give examples of such segments of a more general form. 1.1.5. S e g m e n t variables and s u b s t i t u t i o n Segments are terms with a kind of open end on the extreme right. From now on we shall use the symbol w to indicate the open end on the right. So

I

A

l

B

l

C

6 - 6 - 6 - w

is a segment as well as A,

A,

-

A,

-

- w .

As said before, segments are not XV-terms; a segment becomes a XV-term if we replace the w by an arbitrary XV-term. According to this scheme the following formulas can also be considered as segments:

lA

6 - A,

- A,

-

lA

Ax

-

w

lB

6 - A,

- 6 - w .

By replacing the w in both of these formulas by some XV-term we obtain a XVterm (provided, of course, that A and B are XV-terms). In X a we will go even one step further by allowing recursive nesting of segments, and as a consequence w’s can occur in other branches as well, like in

6

/ x x - w -

A,

-

I”

A,

-

6 - w

or / A X

,6

-

A,

-

w -

A,

I”

-

6 - w

I

6 - Xu

w .

All these occurrences of w in the foregoing formulas act as a kind of “holes”, which - once replaced by a XV-term - yield again a XV-term. All formulas having an w on the extreme right axe called segments in Xu. Along with segments we also add to our system a new kind of variables for which segments can be


347

substituted. These variables are represented by unary prefix symbols and are denoted, in name-carrying form, by o,o',a",... . An example of a Xo-term containing a segment and a segment variable is

6

I

- A,

A,

- A,

Xu - a -

-

- w

2.

This term is in redex form, where the segment variable o is bound by the Xu of the redex. Performing a P-reduction on this redex results in

A,

-

A,

A,

-

-

x

(8')

i.e., the prefix symbol o is replaced by the segment A, A, A, (where the w has been dropped). In Xu, segment variables can serve as a means to abbreviate segments, just like variables in AV can serve as a means to abbreviate XVterms. When using segment variables to abbreviate segments we must be careful, though. Consider for example the Xo-term (8). The variable x in that term refers to the abstractor A, hidden inside the segment variable o,as seen in (8') where x gets bound by A, after P-reduction of (8). This is an intended feature which we always have to take into account in Xo-calculus. If a segment variable o occurs in some Xo-term then after replacement of o by the segment s that o abbreviates in t , it can happen, as most often will be the case, that certain variables occurring in t get captured by abstractors lying on the main branch of the tree representation of s. This is to say that each occurrence of a segment variable o in a Ao-term t can contain abstractors - hidden inside o - which will capture certain variables in t after performing a P-reduction in t resulting in the replacement of o by the segment that o abbreviates in t. We now wish to discuss a situation in which there are more occurrences of the same segment variable o in some Xo-term. Consider the following Xo-term in tree representation - A,

/A"

6

Xu

-

-

o

-

-

w

1"

o - 6 - y

(9)

Performing a &reduction on this term results in

A,

-

A,

-

A,

- A,

-

6

I" -

y

(9')

where both instances of o have been replaced by the segment A, A., The variables x and y in (9') are bound by the last two abstractors A, and A, as indicated by the arrows in (9") shown below

*A,

- A,

-

A,

&'

- A,

-

7x y.

6

-

L d '

H . Balsters

348

Suppose, however, that we could want x and y to be bound by other occurrences of the abstractors A, and A, as indicated in / - - -

A,

Y

- A,

4

7x

6 - y. \ \ - - -/ - A,

- A,

-

(9y

In Aa we want to have the freedom to allow for such deviations in priority of binding power of A's, which appear when we have more than one occurrence of some segment variable in a Xu-term. One way of doing this is by renaming the abstractors in (9') in a suitable way; consider for example the following term

It is clear that the variables x and y are bound by the first two abstractors A, and A, just as we intended them to be bound in (9"'). This renaming, however, is done after substitution has taken place; i.e. the renaming has taken place after @-reductionof (9) to (9'). What we would like is that it can be seen beforehand (i.e. before @-reductiontakes place) how the abstractors inside segments shall be renamed. We would like t o have a means systematically indicating beforehand how this renaming of bound variables shall take place, instead of more or less arbitrarily renaming bound variables in segments after @-reduction. One way of doing this is by replacing the first, respectively the second, occurrence of a in (9) by a(x, y), respectively a(x1,yl). These parameter lists (x,y) and (x1,y1) serve as instructions indicating that the abstractors A, and A, are t o be renamed by A, A, and A, A,, in the first, respectively the second occurrence of a in (9) (actually only in the second occurrence of a real renaming takes place). In general if a segment has n ( n 2 0) A's lying on the main branch of its tree, and a is a segment variable referring to that segment then by say A,, ...,,,A, adding a parameter list (yl, ...,y,) to 0 we have an instruction indicating that the n abstractors A,, , ...,,A, are to be renamed by ,A, , ...,,A and in that order. Also the occurrence of the variables 21,...,x, in the segment which were bound by A,, ...,,A, are to be renamed by y1, ..., y,. We note that it is important that the parameter list added to a segment variable a has as its length: the number of A's lying on the main branch of the segment s that u refers to (this number is called the weight of 8 ) . By adding parameter lists to segment variables we have a means to bind occurrences of variables to a A hidden inside a segment exactly as we desire. There is still one problem, though, that we have to resolve. When performing a @-reductioninside a segment we are sometimes dealing with redices which, in


349

the substitutional process involved, have an effect on thew on the extreme right of that segment. Consider, for example, the following segment

A,

-

6

lA - A,

A,

-

-

A,

-

w

By @reducing the redex 6 A A, A, A, w occurring in (10) we are faced with evaluating C , ( A , A, A, w).By the clauses given in Definition 1.1.1 we know how to “shift” the C,-operator past the two abstractors A, and A,, but then we arrive at the w and have to decide how to evaluate C,(A, w). We could simply define C,(A,w) as w, but then certain vital information would get lost; a situation which we now explain. Suppose that (10) occurs as a segment in some term t and that (10) is referred to by some segment variable a(y1, y2,y3, y4) occurring in t. Suppose also that there is an occurrence of the variable y2 in t which refers to the abstractor A,* hidden inside a ( y l , y 2 , g 3 , y 4 ) . By ,&reducing (10) and defining C,(A, w) as w , this occurrence of y2 is no longer a candidate for substitution of the term A (which would have been the case prior to this @-reduction of (lo)), simply because the abstractor A, (or better: Ay2) has vanished. In order to avoid inconsistencies and to keep this candidate-role of substitution for such occurrences of variables 92 intact, we shall define such substitutions of a term A at an end-point w of a segment by

C,(A,w) = 6

lA -

A,

- w

.

In this way it remains possible to refer to the A, of the original redex in (lo), and occurrences of variables which referred indirectly to that lambda by means of a reference to a lambda hidden inside some segment variable remain candidates for substitution of the term A. There is still a problem, though, because the order of the A’s in the reduced segment is different from the order in which they appeared in the original segment. In our example, P-reduction of (10) results in

A,

- A,!

- A,,

lA

- 6 - A,

- w

where t and w have possibly been replaced by new variables z’ and w’, this in case that free occurrences of z or w in A would otherwise have been captured. The abstractors in (10) appear in the order A,, A,, A,, A, and in (lo‘) the order is A,, A,!, A,, A,. This difference has consequences when these segments are substituted for some occurrence of a variable a ( y l , y 2 , y3,y4). Consider, for example, the following two terms in which the segments (lo), respectively (lo’), occur

350

H . Balsters

6

A,

-

lA

6

-

1

A,

-

- A,

- A,

-

w r.,

- 4Yl,Y2,Y3,Y4) - yz

and

/ 6

A,

- A0

- A,,

A,!

-

-

- 6

lA -

A,

- w

- y2

4Yl,Y2,Y3,Y4)

These terms @-reduce to

A,,

-

6

A,,

-

A,,

I A’ -

A,,

-

A,,

-

Ay4 -

YZ

and - A,,

-

6

I A’ -

A,,

-

Y2

where A’ is obtained from A by renaming all free occurrences of z by y1. In (12) we see that A’ can be substituted for y2 by performing one more 0-reduction; this is, however, not the case in (12’). So by changing the order of the A’s in some segment s by performing a @-reduction inside s we can get the situation that occurrences of variables that originally (i.e. prior to this 0-reduction of s) referred to a certain A hidden inside some parameter-listed segment variable, afterwards refer to a completely different A. There is a way, however, in which such inconsisteixies can be resolved. By adding a n extra parameter, called a segment mapping (or segmap for short) to an w we can safely @-reduce a segment prior to substitution of that segment. A segmap is a permutation of some interval [l..n] of IN (n 2 0), and tells us how to restore the original order of the A’s occurring in a segment; i.e. by adding a segmap to the w on the extreme right of a segment we can determine the order in which the abstractors occurred before @-reductionof the original segment. Instead of writing w we now write w ( $ ) , where 1c, is some segmap. In our example we replace the w on the extreme right of (11’) by w ( +) , where is a permutation of [1..4] defined by

+

$0)= 1 $(2) = 3

*(3) = 4 $44) = 2

.

Let us denote this modification of (11‘) by (11”). If we rearrange the order of the parameter list ( y l , yz, y3, y4) in accordance to ?J, (i.e. the first parameter remains first in the list, the second becomes the third, the third becomes the fourth and


35 1

- most importantly - the fourth parameter becomes the second in the list) then we obtain a new parameter list (y1, y3, y4, yz). By replacing the parameter list (yl, y2, y3, y4) in (11’) by this new parameter list (yl, y3, y4, yz) we obtain the following modified version of (11”)

/ 6

A, - A,)

-

Xu -

- A,,

- 6

I A’ -

A,

-

w

0(Yl,Y3,94,92) - 92

( 11”)

which @-reduces to

I A’ A,,

- A,,

- A,,

-

6

-

A,,

- y2

(12“)

and we see that all occurrences of variables in (12) and (12”) refer t o the same A’s, just as we wanted. By adding parameter lists and segmaps we can take care of problems concerning references to A’s hidden inside segment variables in a suitable way. We shall now attempt to give a more formal description of substitution of a segment for a segment variable. We shall present this definition in name-carrying form, this in order to show that name-carrying notation can be maintained in principle but that employment of name-free notation provides for a more natural (and certainly more concise) means for dealing with substitution of segments for segment variables.

Definition 1.1.3. Let Aw($) be a segment with weight n (n E nV U {0}), $ be a permutation of [l..n] and B be a term. Substitution of Aw($) for u(y1, ...,gn) in a ( y 1 , ...,yn)B is defined by

6) (ii) (iii) where id(n) denotes the identity map on [l..n],(yi, ...,y;) is the result of rearranging (yl, ...,yn) as indicated by $ and A’ is the result of suitable renaming of bound variables in A as indicated by (yi, ...,y i ) . This definition is still rather vague since we have not defined ,Y,,~,l,.,,,,,,) ( A w ( $ ) ,B ) , and also because such descriptions as “rearrangement of a parameter list as indicated by a segmap” and “suitable renaming of bound variables in a term as indicated by a parameter list” can hardly be considered as descriptions with formal status. The transition from (ii) to (iii) is also a bit strange,

H . Balsters

352

since it is not clear from (ii) alone how the segmap $ in (iii) suddenly turns up again. Apparently, this is not a very good definition since it is too vague; but, as mentioned before, this definition was only intended as an attempt towards a formal definition. A precise formal definition of substitution for segment variables can of course be given, but such a definition would be rather involved. There is a more elegant and shorter way to define substitution for segment variables, namely by employing name-free notation for segments and segment variables. This notation is described in the following section.

1.1.6. Name-free notation for segments and segment variables There is another way of dealing with references t o A’s hidden inside segment variables than attaching parameter lists to segment variables, namely by employing name-free notation. What we shall do is the following. Segment variables are written in name-free form as u(n,m),where n denotes the reference number of o (which, like in E(n),determines the X that some specific occurrence of o(n,m)refers to) and m ( m 2 0) denotes the number of X’s lying on the main branch of the tree representation of the segment that o(n,m ) intends t o abbreviate (the number m is also called the weight of o(n,m ) ) .The number m in o(n,m) is to play the role of a parameter list in name-carrying notation; i.e. m indicates that there are m X’s hidden inside ~ ( nm). , As an example of a term in name-free notation containing a segment and a segment variable consider the following term written in tree form

X

- 6

I

/ 5(1) A - 6 - A - A - w

-

X

-

0(1,3)

-

t(5) I 6 - 5(2).

In this term we see that o(1,3) abbreviates a segment with three X’s lying on the main branch of its tree; so when determining the X that 5(5) refers to we descend from t ( 5 ) towards the root of the tree, subtract 3 from 5, subsequently subtract 1 and see that 5 ( 5 ) refers to the first X (from the left) of the tree. The variable 5(2) refers to the second X (from the right) hidden inside o ( l , 3 ) ; E ( 2 ) is thus bound by the second X (from the right) of the segment

/ ((1) X - 6 -

X - X - w .

By employing name-free notation we get a concise way of denoting segment vaxiables and can do without attaching (potentially long) parameter lists to these variables. There is still one problem, though; a problem which we discussed earlier on in the name-carrying version of Xo-calculus, which dealt with the performance of certain &reductions inside segments prior to substitution of those


353

segments for their respective segment variables. By performing a P-reduction inside a segment, the order in which certain A’s originally occurred in that segment can be disturbed and, as we have seen earlier, this can lead to problems when we substitute the reduced segment for certain occurrences of segment variables in a term in which that segment occurs. We solved those problems by adding segmaps to the w’s on the extreme right of the segments involved and we shall do so again in the name-free version of xu. We now shortly describe substitution of segments for segment variables and we shall give this description in an informal manner in terms of trees. The tree representation of a segment has an w ( $ ) - where II, is some segmap - on the extreme right of its main branch. When we substitute a segment we remove the w($) and put the remaining tree fragment in the place of some occurrence of a segment variable in a Xu-tree. Segment variables occur in Xa-trees as unary nodes and substitution of segments for segment variables thus gives rise to replacements at unary nodes inside a Xa-tree (which differs completely from A(-substitutions, where we could only perform replacements at end-nodes of trees). When such a substitution is performed, we again - as in the case of A(-substitutions - have to be careful and update external references in order to ensure that these references remain intact after substitution. But not only do we have to update external references when we substitute a segment for a corresponding segment variable, we also have to take into account the effect of the segmap $ attached to the end-point w of the segment involved, since such a segmap reallocates references to A’s lying on the main branch of the segment which we want to substitute. We now give a n example to demonstrate both of these features. Consider the following example of a Xa-tree containing a segment and a segment variable

1 x

-

6

I

x

-

-

x

x -

-

x

((3)

6 -

w($)

-

x

-

a(3,2)

-

((1)

where $ is the permutation of [1..2] defined by $(1) = 2 and $(2) = 1. This tree, which we shall refer to as t^, contains a redex, namely

6

I

1 ((3) X - X - 6

-

x

-

x

-

-

x

w($) - 0 ( 3 , 2 ) - ((1)

and we can therefore perform a P-reduction on t^. By P-reducing node u(3,2) is a candidate for substitution of the sub-tree

1 ((3) x

-

x

-

6 - w($).

t^,

the unary

H . Balsters

354

Should we simply replace a(3,2) by the tree fragment

/ ‘33) A - A - 6 then this would result in the following tree

t^’

/ ((3) A

-

A - A - A

-

A

-

6

- ((1).

It is immediately clear that the variables [( 1) and t(3) refer to different A’s then they originally referred to in t^. The variable ((3) is an external reference in t^ and, as in the case of At-substitutions, has to be suitably updated whenever the segment in which ((3) occurs is substituted for some segment variable. The variable ((1) in t^ refers to one of the two A’s hidden inside a(3,2); it seems to refer to the first A (from the right) lying on the main branch of the segment involved, but the segmap Ir, reallocates this reference to the second A (from the right). This means that correct P-reduction of t^ would result in the following tree P’

/ ((5) A - A - A - A -

A-6-((2).

In Section 2 we shall give a formal definition of substitution of Aa-terms. In this definition we shall use secalled reference mappings which see to it that reference numbers are suitably updated, like in our example in the transition from t^ to t^”. These reference mappings (or refmaps for short) and their interaction with Aa-terms are described extensively in Section 2, and we refrain from further discussion of refmaps here. The employment of name-free notation and segmaps makes it possible to give a formal definition of substitution of segments for segment variables in a very concise way, as we shall see in Section 2. In previous examples describing how substitution of segments for segment variables can take place we have restricted ourselves to rather simple situations. Our formal treatment of such substitutions, however, will take much more involved situations into account. Our formal definition of substitution will take into consideration certain accumulative effects which can occur when segments contain references to other segments, or even A’s which bind segment variables. 1.2. An introduction to the typed system ATU In this section we shall give a description of the Xa-system extended with types for terms. The types in AT a are a generalization of the types described in


355

Church’s Theory of simple types (cf. [Church 40]), the extension being that simple types are constructed for segments and that the description is given in namefree notation. The basic ideas for our description are taken from [de Bruijn 78a]. We shall start from a name-carrying calculus without segments - which, basically, is Church’s system of simple types - called ATV. We then gradually move on to a system in which operations on types are made more explicit and in which the name-free notation is incorporated. Finally, we shall describe the full AT a-system by offering, in name-free notation, a typing of segments. The definitions offered in this section will be followed by explanatory remarks.

Definition 1.2.1 (AT V ) . (1) Type symbols ( T ) The set of type symbols T is the smallest set X such that (i) e , @ E X ; (ii) a,P E X\{@}

* ( ~ 0E X) .

(2) Primitive symbols The set of primitive symbols consists of (i) variables: z, y, z,, (ii) the symbols

...

a E T\{@} ;

X (abstractor) and 6 (applicator).

(3) Terms ( X T V ) The set of terms AT V is the smallest set

X such that

X , for every variable z, ; (ii) t E X X za t E X , for every variable z, ; (iii) u, v E X * 6uv E X . (i)

2, E

*

(4) Types of terms

The function typ on AT V is defined inductively for terms t by (i)

tYPb) =a;

(4 @ , 7

(ii) typ(X z, u ) =

(iii) typ(6uv) =

P , @

,

if tYP(U) = P

otherwise

if typ(u) = cr otherwise

(5) The set of correct terms (AT V ) AT V = { t E AT V I typ(t) # @ } .

#@;

# @ and typ(v) = (4)

H. Balsters

356

Remarks. (1) e is some ground type, 8 is to be interpreted as the type of terms which are “incorrectly” typed.

(2) (a@ is to be interpreted as the type of those terms which map terms of type a to terms of type P. (3) If typ(t) = a then a is generally of the form ( ~ I ( Q z (... Q ~(a,&,+I) ... ))), where ( ~ 1 ..., , a,+1 are types. Speaking in terms of trees, this means that there are n abstractors X x a l , ...,X zanlying on the main branch of the tree representation t^ of t (and in that order) that cannot be removed by some &reduction in t ; i.e. for each abstractor Axai there is no matching 6 (or rather: 6 Ai ) such that this 6X-pair can be removed by means of a suitable sequence of P-reductions.

Before giving the next definition we introduce some notation concerning sequences. For an elaborate treatment of sequences we refer to Section 2.1. At this stage it is only important to know that a sequence is seen as a function with some interval [l..n] of N (n 2 0) as its domain, where n will be the length of the sequence in question.

Notation. Let C be some non-empty set (called an alphabet). - C* denotes the set of sequences over C (including the empty sequence denoted

by -

0 (the empty set)).

if c E C then ( c ) denotes the sequence of length 1 consisting of the “symbol” C.

-

-

if F,G E C’ then F & G denotes the concatenation of the sequences F and G, in particular if F is a sequence of length n (n 2 0) then F = (F(1)) ( W ) ) ... & ( F ( n ) ) . if F E C’ then E denotes the reversed sequence of F , i.e. if F = (F(1))& ( F ( 2 ) ) & ... & ( F ( n ) )then E = ( F ( n ) )& ... & ( F ( 2 ) )& (F(1)).

In the following definition we offer an alternative version of ATV in which operations on types are made more explicit.

Definition 1.2.2 ( A p , V ) . (1) Types ( T y ) The set of types T y is the smallest set X such that


357

(i) @ E X ; (ii) F E (X\{@})*

*y(F)E X ;

(2) Primitive symbols The set of primitive symbols consists of (i) variables: zf,y f , zf,... f E Ty\{@} ; (ii) the symbols X (abstractor) and 6 (applicator).

(3) Terms (AT-, V) The set of terms AT-, V is the smallest set X such that

zf E X , for every variable x f ; (ii) t E X + X z ~t fE X , for every variable zf ; (iii) u, v E X =+ 6uv E X . (i)

(4) Types of terms The function y-typ on AT-, V is defined inductively for terms t by

(i)

T-tYPbf) = f ;

(ii) y-typ(A zf u ) =

(iii) y-typ(6uv) =

I

{

;(f)

& G)

ify-tYP(u) = y(G), for some G E (Ty\{@})* ;

7

, y(G)

if y-typ(u) = f and y-tYP(v) = r((f)& G ) 1 for some f E Ty\{@} and

,

GE @

otherwise

,

(R\{@})* ;

otherwise

( 5 ) The set of correct terms (AT-, V) AT?

v = { t E AT-, v 1 ?typ(t)

# 8).

Remarks. (1) We note that the symbol y is of no particular interest in itself, and the reason for introducing it is basically historical in nature. In [de Bruijn 78a] types of AT-,-terms (i.e. non-segments) were called “green” types, whereas types of segments were called “red” types. The symbol y has been chosen for the construction of the type of a AT-, V-term purely for mnemonic reasons. In Definition 1.1.5 (XTQ) we shall construct types of segments, and these types will be of the form p(F, G, H ) . Here the symbol p is used in the construction of types of segments, again, purely for mnemonic reasons.

H . Balsters

358

(2) y(8) is the analogue of the ground type e in Definition 1.2.1. (3) y((f) & G) is the type of those terms which map terms of type f to terms of type y(G) (cf. clause (4) (ii) above). (4) In terms of trees, if y-typ(t) = y((f1) & ... & (f,,)), then this means that there are n abstractors Xxfl, ...,X zf,,lying on the main branch of the tree representation t^ of t that cannot be removed by means of a suitable sequence of P-reductions in t (cf. comment (3) in the remarks on Definition 1.2.1).

In the following definition we go one step further and introduce a new typeconstructor n which takes two arguments, both sequences of types. We recall that y ( F ) denotes the type of those terms with n abstractors lying on the main branch of their corresponding trees (we assume that F is a sequence ( f l ) & ... & (f,,) of length n) that cannot be removed by suitable P-reductions. In the case of segments, however, we can also have terms with applicators lying on the main branch of their tree representations which cannot be removed by means of suitable ,&reductions. When we write r( F, G), where F and G are sequences of types ( f l ) & ... & (f,,) and (91) & ... & (gm), respectively, then F denotes the sequence of n non-removable abstractors and G denotes the sequence of m non-removable applicators. We also introduce a product operation %” between 7r-types and y-types with which we can calculate types of terms. We note that terms in the system AT,^ V , defined below, are never typed as r-types; n-types in AT,^ V are only used as intermediate constructs for calculating the eventual type (a y-type) of a term. When we calculate the type of a AT,,-term t we first calculate the type of a beginning part of that term (such a beginning part is a segment and will thus have a n-type as its type), say that this results in the n-type r ( F ,G). Then we calculate the type of the remaining part of t (which is not a segment and thus has a y-type as its result type), say that this remaining part o f t has type y ( H ) . The product n ( F ,G) * y(H) will result in the eventual type of t. With the interpretation of r ( F ,G) as the type of a beginning part of a term with F as the sequence of non-removable X’s and G as the sequence of non-removable 6’s, Definition 1.2.3 should not be too hard to understand. After this definition we shall give an example of calculating the type of a AT,^ V-term.

Definition 1.2.3

AT^^ V ) .

(1) Quasi-types ( T r ) The set of quasi-types T, is defined as


359

(2) Products of quasi-types and types (*) Let F , G and H be elements of (Ty\{@})*. The product of a quasi-type and a type is defined as follows

(4) Types of terms The function ny-typ on X T V~is ~defined inductively for terms t by

(i)

v-tYP(xf) = f ;

(ii) “T-tYP(xxf ). = .((f ), 0)

*

TY-tYP(u) ;

(iii) Ty-typ(buw) = ~ ( 0(ny-typ(u))) , * Ty-typ(w). (5) The set of correct terms ( A T ~ ~ V )

A simple example of calculating the Ty-type of a ATny-V term Consider the following term t Xf

6 Xg xg xh

and assume that h = y ( H ) , where H is some element of (Ty\{@})*.According t o the rules given in Definition 1.2.3, the type o f t is calculated as follows ny-typ( x Zf 6 2 9 x Xg Xh) =

* w-tYP(6xgX2gxh) = T ( ( f ) , @ )* .(0,(9)) * T y - t d x Z g X h ) = T((f),0) * 7 4 , (9)) * T((gL0) * v-tYP(xh) = .((f)?fJ)* .(0,(9)) * 4 ( 9 ) , 0 ) * T ( ( f ) , @ )* 4,(9)) * Y((9) H) = .((f)>@)* y ( H ) = r((f) H )

= n((f),0) = =

= = = =

=

H. Balsters

360

and this result is indeed as expected: as mentioned earlier in comment (3) by Definition 1.2.2, y(( f ) & H ) is to be interpreted as the type of those terms which map terms of type f to terms of type y ( H ) ,and clearly t is a term of that type. Also note that t @reduces to the term A x f x , ( ~ )which, as expected, also has type r ( ( f 82 ) HI. The systems AT V , AT, V and AT*, V are, though different in their respective descriptions, essentially equivalent in the sense that the expressive power of each of these systems is exactly the same. The reason for deviating from the notations and constructs employed in the original system AT V is that we eventually want to give a description of a typing mechanism for AT (T,a simple-typed version of the name-free system X a . In XTCT we shall construct a completely new kind of types, called ptypes, for segments. What will be shown is that the employment of K-types, y-types and the *-operation provides for not only an exact but also a concise description of a typing mechanism for segments and segment variables written in name-free notation. We now proceed by defining a typed version AT ( of the name-free system A a N' and M rplN" > a N'. 0

>b, >b2 M , then there is an n >bl > Let K >b, L be generated by Q ( A )P [z : B ]C Lb,

Theorem 6.39. If K E A, K L and K such that M N and L >i2 N with n 1.

Proof.

Q ( A ) P [& : B ] (z := A)C, and K M by Q' (D) i)l [i: E] F >b2 Q'PlF. If ( D )PI [y : E ] F c A , we need n P2-reductions for the n A's in Q ( A )P [g : B] (z := A)C. If not, we need only one. The theorem easily follows.

>b2

0

Theorem 6.40. If K E A, K >p, L and K >p, M , there is an N such that M >pl N and L >p2 N . Proof. Apply Th. 6.39 repeatedly. This can be illustrated by the following diagram:

M

Figure

4

>bl

Here we assume that K 20, L can be decomposed into K 2bl L' L , and K 2 p 2 M into K M' M . In the diagram all edges (in the sense usual in graph theory) parallel to the edge from K t o L' represent single-step PI-reductions, those in the direction of K M' represent single-step &reductions. 0

>b2

>b2

>b2 rb2

Theorem 6.41. If K E A, K L and K L N OT L = N , and M N or M E N .

>b2

Proof. Let K

>b2 M , there is an N

such that

>b2 L be generated by Q ( A )P [& : B ]C 2b2QPC, and K 2b2

R.P. Nederpelt

438

M by Q' (D) PI

[i: E ]F >&2

Q'PlF. If (D) PI

[i: E] F

c A or c B then

>&, L ; if ( A )P [g : B]C C D or C E , then L >bz M . If (D) 4 [i: El F = ( A ) P [g : B] C then L = M . In all other cases there is clearly an N such that L >&, N and M >&, N . 0 M

Theorem 6.42 ( C R for P2-reduction). then L "pz M .

If K

E

A, K >pa L and K >pz M ,

Proof. Apply Th. 6.41 repeatedly. Theorem 6.43 ( C R for P-reduction). L "p M.

0

If K

E

A, K 2 p L and K >p M , then

Proof. As that of Th. 6.38.

0

Theorem 6.44. If K E A, K >p L and K >p M , then there are N , N" and N"' such that L 20, Nf' >pa N and M >p, N"' >p, N .

Proof. Decompose K L and K >p M , according to Th. 6.19, into K >pl L' >p, L and K >pl M' Zp, M respectively. The remainder of the proof is illustrated by the following diagram:

M

Figure 5 We find N' from Th. 6.38, N" and N"' from Th. 6.40 and finally N from Th. 0 6.42. 7. q-reduction, reduction and lambda equivalence

A third reduction in lambda calculus (apart from a- and P-reduction) is called q-reduction and denoted by &. We shall incorporate it in our system.

Strong normalization in a typed lambda calculus ((3.3)

439

We first define single-step 7-reduction, denoted by 2;:

Definition 7.1. Single-step 7-reduction is the relation generated by: (1) If Q [z : A] (2) B E A and ( 2 ) Let Q ( A )C and

2

(Z B, then Q [z : A] (z) B 2; QB.

Q ( A )D E A.

If QC 2; Q D , then Q ( A )C 1; Q ( A )D.

(3) Let Q [z : A]C and Q [z : B]C E A. If QA 2; QB, then Q [z : A] C 2; Q [z : B]C. (4) Let Q ( A ) C and Q ( B ) C E A. If QA 2; QB, then Q ( A ) C 2; Q ( B ) C . 0

Rules (2), (3) and (4) are called the monotony rules of single-step 7-reduction; they are similar to those of single-step P-reduction. Rule (1) is called the rule of elementary 7-reduction.

Definition 7.2. 7-reduction is the reflexive and transitive closure of singlestep 7-reduction. 0 If A and B are related by a (single-step) 7-reduction, we speak of “the (singleB”. The notions n-step 7-reduction and decomposition step) 7-reduction A of an 7-reduction are defined analogously to the corresponding notions for preduction. If the first derivation step of a single-step 7-reduction has the form Q [z : A] (z) B QB, we say that Q [z : A] (z)B generates the single-step 7-reduction.

>;

>;

Theorem 7.3. Let K E A . Then Q [z : A] (z) B generates a single-step 7reduction of the form K 2; L if and only if [x: A] (x)B c K and Q [z : A] (z) B = K 1 [z : A] (z) B. Proof. Similar to the proof of Th. 5.7.

0

Theorem 7.4. If K E A and K 2; L , then L Proof. Induction on the length of proof of K proof of Th. 5.8.

E

>;

A. L. The proof is similar to the

Theorem 7.5. If QE E A, QE 2; Q’F and 11Q11 = 11Q‘11, then (2)

Q = Q’,

(ii) E

= F , or

0

R.P. Nederpelt

440

= QO [z : A ] , E = (z) [y : B]E’, Q’ = QO[y : B ] , z [y : B]E’ and = E‘. In the second case Q = Q1 [z : K ] Q2, Q‘ = Q1 [z : L]Q2 and Q1K 2; Q1L. (iii) Q F

Proof. Induction on the length of proof of Q E 2; Q’F. The proof is comparable to the proof of Th. 5.11, except for the case in which Q E 2; Q’F is an elementary 77-reduction. In this case we have t o note the possibility that QE and Q’F are as in (iii). 0 Theorem 7.6. If Q E E A and Q E 2; K , then K and F‘ with 11Q’11 2 11Q11 - 1.

= Q’F’

for certain Q’

Proof. Similar to the proof of Th. 5.12. Theorem 7.7. If Q E E A and Q E 2; K

0

21 QG, then K

= QF.

Proof. If Q = Q1 [z : A] and Q E 2; K is Q1 [z : A] (z) B 2; Q l B , then the binding variable 2 of K has disappeared, and we cannot regain it by 77-reduction. Hence by Th. 7.6: K = Q’F and 11Q’11 = 11Q11, and the case expressed in Th. 7.5 (iii) does not hold. In the derivation steps leading to K 27 QG the final ones of the first 11Q11 abstractors cannot disappear by an elementary 11-reduction for the same reason as above. Assume that Q f Q’.Then by Th. 7.5 (ii): Q = Q i [z : K ]Q 2 , Q’ = Q1 [z : L] Q2 and Q1K 2; Q1L. It is clear that ILI < 1KI. Since the length of an expression cannot increase by 77-reduction it follows that we cannot regain Q from Q’. Hence Q = Q’. 0 Theorem 7.8. The monotony rules hold for 0-reduction.

Proof. Similar to the proof of Th. 5.15, using Th. 7.5. Theorem 7.9. If Q E , P E and P F E A, and Q E 27 Q F , then P E

Proof. Analogous to the proof of Th. 5.17; use Th. 7.7.

0

21 P F . 0

The converse of this theorem holds too. Given an 77-reduction Q K 21 M , it need not follow that M = Q’N’ with 11Q11 = 11Q‘11, since the find abstractors of Q may have been cancelled in 77reductions. For example: Let Q = Q’[z : A] and K G ( z ) ~then , Q K 2; Q’T, where 11Q’11 = 11Q11 - 1. This kind of 77-reduction plays an important r6le in the following. We shall call them g!-reductions. We shall prove a number of theorems concerning q!-reductions. In Th. 7.14 we shall show that we can postpone q!-reductions until after other 77-reductions. Cor. 7.17 will result from our discussions of q!-reductions.

Strong normalization in a typed lambda calculus (C.3)

441

Definition 7.10. (1) K 2; L is called a single q!-reduction (denoted by K

>$)

L ) if K

I

Q [z : A] (z)B and K generates K 2; L (i.e. if K 2; L is an elementary q-reduction). This reduction is called of order p if IIQ [z : All1 = p. (2) K L,, L is called a k-fold q!-reduction (denoted K 2':) L ) if there are K , =

... [xi : Ail (Zi)... ( 2 1 ) B

Q [z1 : All

8,

such that K

= Kk

2:) Kk-1 ...

>'I)

-,,! KO= Q B = L and Ki generates Ki 2:) Ki-1. This reduction K 2s) L is

called of order p if Kk

22)Kk-1 is of order p.

0

Theorem 7.11. If K E A and K 2s) L 2; N , then either K 2:) N or there is a reduction K 2; M 2s) N where K 2; M is not an q!-reduction.

Proof. K = Q [z : A] (z) B 2;' Q B Q B = L 2; N .

=

L. Consider the possibilities for 0

Theorem 7.12. If K E A and K 2s' L 2; N , where K 2s) L is of order where M 2:'

$')

N of orderp, or there is a reduction K 2; M 2s) N N is of order p and K 2; M is not an q!-reduction.

p , then either K

Proof. Compare with the previous theorem.

0

Theorem 7.13. Let K E A and K 2s' L 2,, N , where K 2s) L is of

K

>,,

>,,

L' 2;; N , where a decomposition of L contains no q!-reductions and L' 2;; N is of order p.

orderp. Then there is a reduction K

Proof. Decompose L 2,, N into L = El 2; ... 2; E, = N . We proceed with induction on T . If r = 1 there is nothing to prove. Let r > 1. Consider the reduction K L = El 2; E2. By the previous theorem we have either K

>$+l)

E2 or a reduction K 2; L" 2';) E2 where K

2; L" is

7.

not an q!-reduction. Applying the induction hypothesis on K 2s") E2 2,, N

>,,

or L" 2 ';' E2 N , we obtain K 7. K I,, L' contains no q!-reductions.

>,,

L' 2"; N , where a decomposition of rl.

0

Theorem 7.14. If QK E A and QK 2,, L , there is a reduction Q K 2,, I >(k) Q'K -,,! L where 11Q11 = 11Q'11, Q'K L is of order 11Q11, and where a decomposition of QK Q'K' contains no q!-reductions of order 11Q11.

>,,

Proof. Decompose QK

L into single-step q-reductions Q K

= L1 2; ... 2;

R.P. Nederpelt

442

L,

E

L. Let i be the smallest integer such that Li 2: Li+l is an q!-reduction

of order 11Q11. Apply the previous theorem on L; 2:’ L;+1

z,, L,

>‘I

L’ 2‘:) L as desired. The fact that L‘ obtain a reduction Q K ‘I. 11Q’11 = 11Q11 follows from Th. 7.5.

E

L. We

= Q’K’ with 0

>,,

Theorem 7.15. If Q K E A, Q K Q‘K‘, 11Q11 = 11Q‘11 = p and a decomposition of Q K Q’K’ contains no q!-reductions of order p , there is a reduction Q K 2oQK’ Q’K’ and a reduction Q K Q’K Q’K’.

>‘I

Proof. See Th. 7.5.

0

>,,

>,,

Theorem 7.16. If Q I K E A, Q2L E A, Q1K M , Q2L M , QI = [q : All ... [zp: AP] and Q2 = [q : B1]... [zp: BPI, there is an N such that Q1K 1,, QIN and Q2L 2,, Q2N.

>‘I

Proof. By the aid of Th. 7.14 and Th. 7.15 we can find reductions Q1K Q1 K’ lo QiK’ 20’ M and Q2L Q2 L‘ >‘I QbL‘ 2“) M , where Q‘,K’ 2“) M

>’I

’I!

‘I!

and QiL’ ;2 : M are of order p . Note that Q: = [XI : A:] ... [zP : A;] and Q; = [XI : Bi] ... [xp: EL]. Now both QiK‘ and QhL‘ E A, so k = 1: assume k > 1, then M = [q: A’,]... [+k : Ak-J M’ = [z1 : B i ] ... [+k : B’P- k ] ... [+I : L3k-J M”; it follows that [+I : BL-.l] occurs in M’, hence also in K’; this contradicts the fact that Q{K’ E A, since we found two binding variables xp-l in Q: K‘. It follows that K’ = L’; we can take 0 N = K’ = L’. Corollary 7.17. If Q K , QL E A, Q K QN such that QK Q N and Q L QN.

>,,

Theorem 7.18. If Q D E A, Q D Q’ = [q: A;] ... [xp: A;], then QD

>,,

M and Q L

>’I Q’E, Q E

>,,

M , there is a 0

[q : A11 ...[x, : Ap] and

QE.

Proof. Resulting from Th. 7.14 we can find a reduction Q D

>‘I Q”D’ 2‘:’ Q‘E ‘I.

where Q”D’ 2s) Q’E is of order 11Q11. Now Q” = [ZI: Ayl ... [zp: A:], hence k = 0 (because &I’D’ E A; see the proof of Th. 7.16). Then also QD Q E by Th. 7.15. 0

>,,

We shall now prove a theorem concerning the so-called “postponement of rpreductions” for A. What we want t o prove is that every reduction K 2 M which takes place by means of single-step p- and 7-reductions in arbitrary order, M , in which all &reductions precede can be replaced by a reduction K 2 p L all 7-reductions.


443

It is easy t o show that each reduction A 2; B 2; C can be replaced either by a reduction A 2; B’ 26 C (where r 2 0) or by a reduction A 2; B’ 2; C. But this does not suffice to prove the theorem. It is not sure that this process of interchanging 17’s and /3’s terminates for a given reduction K 2 M . In [Curry and Feys 58, Ch. 4,D2] a compound /3-reduction is introduced for the purpose of proving the above mentioned theorem. In our opinion there is an error in their proof (viz., the case that R is MkN and L is some Mjyj for j 5 k is missing). Nevertheless, their idea can be extended in such a manner that the theorem on the postponement of 17-reductions can be proved. We have carried this out by defining a ‘‘compound /3-reduction” A 2; B with the property that each reduction A Z,, B 2; C can be replaced by a reduction A 2; B’ >-,, C. However, this compound P-reduction looks rather complicated. Barendregt suggested to us another way of proving the theorem (private communication). He proposed a ‘‘nested” 17-reduction (which we call &-reduction and denote by 2;) with the property that a reduction A 2; B 2 p C can be replaced by a reduction A 2 p B’ 2; C. The nested character of this &-reduction is comparable to that of y-reduction discussed in the previous section. We prefer the latter way of proving because it is easier to understand.

Deflnition 7.19. Single-step &-reduction, denoted by tion generated by

>;,

is the reflexive rela-

(1) If Q [z : A] (z) B E A, z !$ B and Q B 2; QC, then Q [z : A] (2) B 2; QC. (2) If Q ( A )C E A, Q A 2; QA’ and QC 2; QC’, then Q ( A )C 2; Q (A’)C‘.

(3) If Q [ z : A ] C E A, Q A 2; QA’ and Q [ z : A ] C 2; Q [ z : AIC’, then 0 Q [z : A]C 2; Q [z : A’] C’.

We call rule (1)in this definition the rule of elementary single-step &-reduction, rules (2) and (3) the monotony rules for &-reduction. The following two theorems deal with the relation between 17- and &-reduction.

Theorem 7.20. If K E A and K 2; L , then K 2; L. Proof. Induction on the length of proof of K 2; L. Theorem 7.21. If K E A and K 2; L , then K

>,,

0

L.

Proof. Induction on the length of proof of K 2; L. For example, if K 2; L is Q [z : A] (z) B 2; QC, as a direct consequence of Q B 2; QC, then by induction Q B QC, and Q [z : A] (z) B 2; Q B >,, QC.

>,,

0

R.P. Nederpelt

444

We shall now prove a number of theorems which are lemmas for the theorem on the postponement of 77-reductions (Th. 7.28).

Theorem 7.22. If K E A and K 2; L , then L E A. Proof. Follows from Th. 7.21 and Th. 7.4.

0

Theorem 7.23. If Q E E A and Q E 2; Q[y : G] H , then Q E = Q [xi : Ail (xi) [ ~ :2 A21 ( ~ 2 ... ) [z, : An] (5,) [y : G’] H’, with QG‘ 2; QG, Q [y : G’] H’ 2; Q [y : G’] H and zi @ [zi+l: Ai+l] ... (zn)[y : G‘] H’. Proof. Induction on the length of proof of Q E 2; Q[y : GI H . If the latter reduction results from reflexivity, the proof is completed. (1) Let Q E 2; Q [y : GI H be Q’ [z : A] (z)B 2; Q’C, as a direct consequence of Q’B 2; Q’C. If Q‘ = QQ”, induction yields the proof. If Q = Q‘ [z : A], then C begins with [z : A]. This implies that [z : A] occurs in B (since 6-reduction can only omit abstractors and applicators without influencing the remainder of the expression), which is impossible since Q E E A. So this latter case cannot apply.

(2) Let Q E 2; Q [y : G] H be Q‘ (A) C 2; Q’ (A’) C‘. Then Q E = Q [y : G] F . (3) Let Q E 2; Q[y : GI H be Q’[z : A ] C 2; Q’[z : A’IC’, as a direct consequence of Q’k 2; Q’A’ and Q‘ [z : A] C 2; Q‘ [z : A] C’. There are the following possibilities: (a) Q = Q’, (b) Q = Q’ [z : A] Q1 and (c) Q’ = QQ1 with 11Q111 > 0. In all three cases the proof is easy.

0

Theorem 7.24. Let QA and Q [z : B]C E A, QA 2; QA’ and Q [z : B] C 2; Q [z : B] C’. Then Q(z := A ) C 2; Q(z := A’)C’. Proof. Induction on ICI. If C = 7, C

z or C

= y $ 2 , the proof is easy.

(1) Let C = [y : E] F . There are two possible cases: (a) Q [z : B] C 2; Q [z : B] C’ is Q [z : B] [y : E] F 2; Q [z : B] [y : E’]F’, as a direct consequence of Q [z : B] E 2; Q [z : B]E’ and Q [z : B] [y : E] F 2; Q [z : B] [y : E] F’. By induction: Q(z := A ) E 2; Q(z := A’)E’, and Q[y : (z := A)E] (z := A ) F 2; Q [y : (z := A)E] (z := A’)F’ (the latter because Q [y : (z := A)E] [z : B]F 2; Q [y : (z := A)E] [z : B] F’). Hence

Q(z := A ) C 2; Q(z := A’)(?‘.


445

(b) Q [z : B]C 1; Q [z : B]C‘ is Q [z : B ] [y : E] (y) G 2; Q [z : B]G’, as a direct consequence of Q [ z : B]G 2; Q [ z : BIG’. By induction Q ( z := A)G 2; Q ( z := A’)G’, SO Q ( z := A ) [y : El (y) G Q [y : (5 := A ) E ](y) (z := A)G 2; Q ( z := A’)G’.

(2) Let C = ( E )F . Then Q [z : B ]C 2; Q [ z : B ]C’ is Q [z : B ] ( E )F 2; Q [z : B ] (E‘)F’, as a direct consequence of Q [z : B] E 2; Q [z : B] E’ and Q [z : B]F 2; Q [z : B ]F‘. The theorem results from the induction. (Note that Q [z : B]C 2; Q [z : B ]C’ cannot be Q [z : B ] (z) G 2; QG‘.) 0

Theorem 7.25. Let A E A and A 2; B 2; C. Then A >p B‘ 2; C. Proof. Induction on the length of proof of A 2; B. If the last derivation step results from reflexivity, nothing remains to be proved. (1) Let A 2; B be Q [z : D] (z) E 2; QE‘ as a direct consequence of Q E 2; QE‘, and let B $ C be generated by Q’ ( F ) [y : G]H Q’(y := F ) H . The following cases may apply:

>b

(a) ( F ) [y : GI H C Q. There is clearly a reduction A >p B’ 2; C.

>b

(b) ( F ) [y : G]H C E’. Let B C be QE’ >b QE”’, then by induction there is a reduction Q E 2 0 QE” 2; QE”’, hence Q [z : D] (z) E 2 p Q [z : D ] (z) E” QE”‘.

>;

(2) Let A 2; B be Q ( D )E 2; Q (D‘) E‘ as a direct consequence of Q D 2; QD’ and Q E 2; QE’, and let B 2; C be generated by Q’ ( F ) [y : GI H Q’(y := F ) H . The following cases may apply:

>b

(a) ( F )[y : GI H C Q. Clearly A >p B‘ 2; C. (b) ( F )[y : G]H = (D’)E’. Then QE’ = Q [y : G]H , so Q E = Q [q: All ( 2 1 ) ... [zCn : A,] (zn)[y : G’]H’, with QG’ 2; QG, Q [y : G‘]H’ 2; Q[y : G’]H and zi [zi+l : Ai+l]... (z,) [y : G’]H’ by Th. 7.23. Then Q ( D )E 2 p Q(y := D)H’. By Th. 7.24: Q ( y := D)H’ 2; Q(y := F)H E C .

p QD“ 2; QD”’, hence Q ( D ) E >p Q (D”)E 2; Q (D”’) E‘ G C.

(d) ( F ) [y : GI H c E’. Then C EZ Q (D’) E”’ with QE’ 2; QE”‘, and by induction Q E >p QE” 2; QE”’, hence Q ( D ) E 2 p Q ( D )El’ 2; Q (D’) E“’ = C.

R.P. Nederpelt

446

(3) Let A 2; B be Q [x : D] E 2; Q [x : D’] E’ as a direct consequence of QD 2; QD’ and Q [x : D] E 2; Q [ x : D] E’, and let again B 2b C be generated by Q’ ( F ) [ y : GI H 2b Q’(y := F ) H . The following cases may apply:

c Q. Clearly A 2 p B’ 2; C. ( F ) [ y : G]H c D‘. Then C = Q [z : D’”]E’

(a) ( F ) [ y : G]H (b)

with QD’ 2b QD”’. By induction: QD 2 p QD” 2; QD”‘, so Q [x : D] E 2 p Q [x : D”]E 2; Q [z : D”‘]E’ (where we require the lemma: Q [z : D] E 2; Q [z : D] E‘, then Q [z : D”]E 2; Q [z : D”]E’).

(c) ( F ) [ y : G]H c E’. Then C = Q [z : D’] E”’. Also: Q [z : D] E’ Q [z : D] E”’, so by induction Q [x : D] E >p Q [x : D] E” > K Q [x: D]E”‘. Hence Q [z : D] E >p Q [z : D] E” 2nQ [z : D‘] E”’ = C.

>b 0

Theorem 7.26. Let A E A and A 2; B 2; C . Then A 2 p B 2; C Proof. Induction on p , using the previous theorem.

0

Theorem 7.27. Let A E A and let A 2 C b y means of a number of single-step IC- and P-reductions in arbitrary order. Then there is a reduction A 2 p B > K C. Proof. Induction on the number of single-step &-reductions in A 2 C. If this number is zero, the proof is completed. Else, let A 2 C be A 2 A’ 2; B 1; C. Apply the previous theorem, obtaining A 2 A’ 2~ B’ 2; C, and apply the 0 induction on A 2 A’ 2 p B‘.

Theorem 7.28. Let A E A and let A 2 C b y means of a number of single-step 77- and P-reductions in arbitrary order. Then there is a reduction A 2 p B L,, C. Proof. Since each g-reduction c m be considered as a &-reduction (Th. 7.20), we can apply the previous theorem, obtaining A 2 p B 2, C. But B InC 0 implies B > n C (Th. 7.21), so A >p B C.

>,,

The remainder of this section will concern (general) reduction, defined as a sequence of single-step a-,P- and g-reductions.

Definition 7.29. Single-step reduction (denoted by 2’) is the relation obeying: 0 A 2’ B if and only if A >b, B, A 2b B or A 2; B. Definition 7.30. Reduction (or general reduction, denoted by 2 ) is the reflex0 ive and transitive closure of single-step reduction.


447

Theorem 7.31. The monotony rules hold for reduction. Proof. Use Th. 5.15 and Th. 7.8.

0

We shall prove a theorem (Th. 7.33) which expresses that the Q is in a cerQ E : it can be replaced by any P tain sense irrelevant in a reduction QC such that PC and P E E A. This corresponds with general usage in lambda calculus to define reduction for expressions which may contain free variables. Our choice to define reductions inside A is apparently not in disagreement with that general usage.

>

Theorem 7.32. If QC E A and QC 2 Q E b y means of there is a reduction QC >p Q D & Q E .

p - and rpreductions,

Proof. There is a reduction QC >p K & Q E by Th. 7.28. Now by Th. 5.12: K = Q’D with 11Q11 = 11Q’11. If Q = [ X I : All ... [zP: A p ] ,then Q’ E [x1 : A’,]... [x, : A;], so by Th. 7.18: Q‘D >17Q’E. From Th. 5.21: QC 2 p QD, and from Th. 7.9: QD >17Q E . 0 Theorem 7.33. If Q C , PC and P E

E

A, and QC 2 Q E , then PC

> PE.

Proof. See Th. 7.32, Th. 5.17 and Th. 7.9.

0

Reduction is a non-symmetric relation between expressions in A, which is reflexive and transitive. We shall define lambda equivalence. The definition of beta equivalence was given in Def. 5.22. In Th. 7.35 we shall prove that beta equivalence is the symmetric closure of beta reduction.

Deflnition 7.34. Let A and B E A. We call A lambda equivalent t o B (denoted: A N B ) if there is an expression C such that A 2 C and B 2 C . 0 Theorem 7.35. Beta equivalence is reflexive, symmetric and transitive. Proof. Reflexivity and symmetry are trivial. Transitivity follows from Th. 6.43 (CR for &reduction): let A -p B and B -p C , then there are D and E such that A >p D , B >p D , B >p E and C >p E. Moreover, there is an F such that D 2 p F and E >p F (Th. 6.43), so A >p F and C 2 p F . Hence A -p C . 0 Unfortunately, there is no similar theorem for lambda equivalence. Of course lambda equivalence is symmetric and reflexive, but not necessarily transitive.

R.P. Nederpelt

448

The reason for this is that CR does not hold for (general) reduction: for example, let K L and K M , let K = Q [z : A] (z) [y : B ] C where z [y : B ]C, let K 2 L be Q [ z : A] (z) [y : B ]C Q [y : B]C and let K M be Q [z : A ] (z) [y : B]C >p Q [z : A] (y := z)C (la Q [y : A] C ) . Now we cannot in general find an N such that L 2 N and M 2 N , since we know nothing concerning a relation between A and B.

>

>

>,,

>

We note the following. We can embed ordinary lambda calculus into A, since there is a one-to-one correspondence between expressions from lambda calculus and those expressions in A in which only abstractors of the form [z : T ] occur. If we restrict ourselves in A to the latter expressions, the example above changes into K = Q [z : T ] (z) [y : T ] C, L E Q [y : T ] C and M Q [y : T ] C. Now there is no problem as regards CR. Indeed, in lambda calculus the Church-Rosser property holds (see [Barendregt 71, Appendix 111). The following theorem expresses that lambda equivalence of Q K and QL implies the existence of an N such that Q K 2 QN and Q L 2 QN or, otherwise stated: the abstractor chain Q can remain unaffected.

Theorem 7.36. Let Q K and QL E A . If Q K that Q K 2 Q N and Q L 2 Q N .

-

Q L , there exists an N such

>

Proof. There must be an M : Q K 1 M and Q L M . By postponement of q-reductions we obtain reductions Q K >p M I 2,, M and Q L 2 0 M2 Z q M . Th. 5.12 implies that M I = QlK', M2 2 Q2L', 11Q11 = 11Q111 = 11Q211. Then, according to Th. 5.21, we also have Q K I p QK' 2 p Q1K' l qM and Q L 2 p QL' Lp Q2L' I,,M . It is easy t o show that Q1 and Qz have the form as required Q1N and Q2L' Lq Q2N. in Th. 7.16, hence there is an N such that Q1K' From Th. 7.9 it follows that QK' > q QN and QL' Q N . So Q K 2 QN and QL 2 QN. 0

>,,

>,,

The monotony rules also hold for lambda equivalence:

Theorem 7.37. (a) If QC, Q D , Q ( A ) C , & ( A )D E A and QC Q ( A )D.

-

Q D , then Q ( A ) C

(b) I f Q C , QD, Q [ z :A ] C , Q [ z :A ] D E A a n d Q C - Q D , thenQ[z : A J C Q [z : A ] D.

(c) If QA, Q B , Q ( A ) C , Q ( B ) C E A and Q A

Q ( B )C . (d) If Q A , Q B , Q [z : A] C,Q [z : B]C E A and Q A Q [z : B]C .

-

Q B , then Q ( A ) C

-

Q B , then Q [z : A] C

-

-


449

Proof. See Th. 7.36 and Th. 7.33.

0

Theorem 7.38. If QC , Q D , PC and P D E A and QC

N

Q D , then P C

Proof. Th. 7.36 and Th. 7.33.

-

PD. 0

8. Type and degree The notions introduced in the preceding sections are from lambda calculus (as reduction, lambda equivalence) or applicable to lambda calculus (factors, bound expressions), since the types played no essential r6le. We shall now look into the typing of an expression in A. With every A E A for which Tail A f 7 we define a type, denoted as Typ A, as follows:

Definition 8.1. Let A E A and Tail A Typ A G Pi [X : B]P ~ F T B .

= z, so A = PI [z : B]P ~ x .Then 0

Informally speaking, we may say that B is the type of z in the above expression. Note, however, that we allow Typ to operate only on expressions in

A. Theorem 8.2. If A E A and Tail A f

7,then

Typ A E A.

Proof. Let A = P1 [z : B]P2x and let Alx f Q1 [z : B]Q2z. We prove that Typ A is a bound expression. All non-binding variables in PI [z : B] P2 are clearly also bound in Typ A . Consider a non-binding variable z c F T B c is a corresponding y c B, and Aly = Q1Q3y. So Q1 [z : B]Q ~ F T B There . Typ Alt = Q1 [z : B]Q2Qiz where Q$z is a renovation of Q3y. Case 1: if y was bound in Aly by a binding variable in Q3, z is bound in Typ Alz by the corresponding binding variable in 96. Case 2: if y was bound in Aly by a binding variable in Q1, z E y is still bound by the same binding variable in Q1 since all binding variables of [z : B]Q2Qb are different from y. So Typ A is bound. Clearly Typ A is also distinctly bound by the renovation 0 of B. We define repeated application of Typ inductively as follows:

Definition 8.3. Let A E A. Then Typ'A n 2 1 and if Tail Typn-' A f 7, then Typ" A

= A;

if Typ"-'A is defined for 0 A).

= Typ(Typn-'

If A E A and TypnA is defined, we call n permissible for A ( n = 0 is always permissible for A E A).

R.P. Nederpelt

450

Theorem 8.4. Zf A E A and A & B , then Typ" A permissible for A and B. Proof. It is sufficient to prove: if A The latter proof is easy.

rb,B and TailA f

T,

>a

Typ" B for all n

then TypA

>a

TypB. 0

With each expression A in A we define a degree, denoted Deg A: Definition 8.5. (1) If A E A and Tail A = 7 ,then Deg(A) = 1. (2) I f A E A , T a i l A = x a n d A = P l [ z :B]P2x,thenDeg(A)=Deg(PlB)+l. 0

Induction on the length of A shows that Deg(A) is well-defined by Def. 8.5. Clearly Deg A = 1 if and only if Tail A = T . We shall now prove a number of theorems, leading to the theorem: if TailA f T , then Deg A = Deg Typ A 1 (Th. 8.12). We could have taken this property as a definition of Deg. In that case, however, the well-definedness of Deg would have been harder to prove.

+

Theorem 8.6. Zf PC E A and P ( K )C E A, then Deg PC = Deg P ( K )C. Proof. Induction on IPC1.

0

Corollary 8.7. If A E A and A = P C , then Deg A = Deg(A1C).

0

Corollary 8.8. If A E A, Tail A Deg A = Deg Q1B 1.

+

=x

and Alx

=

Q1 [x : B]Q2z, then 0

Theorem 8.9. Zf PC E A and P [x: K ]C E A, then Deg PC = Deg P [z : K ]C. Proof. By Th. 3.8: x @ C. The rest of the proof follows from induction on

WI.

0

Theorem 8.10. Zf PC E A and PP'C E A, then Deg PC

= Deg PP'C.

Proof. Induction on IIP'II, using Th. 8.6 and Th. 8.9. Theorem 8.11. Zf A E A and A

B , then Deg A = Deg B.

Proof. Take A >b, B ; induction on /A]. Theorem 8.12. Zf A E A and Tail A

0

$ 7 , then

0

Deg Typ A = Deg A - 1.


451

Proof. Let Tail A = z and A = PI [z : C ]Pzz, so Typ A = PI [z : C]PzFrC. Then, P1FrC E A and Deg PIFrC = Deg PIC by Th. 4.5 and Th. 8.11. By Th. 8.10: Deg PIFrC = Deg Typ A. So Deg A = Deg PIC 1 = Deg Typ A + 1.

+

0

Corollary 8.13. If A E A, then Tail(TypDegA-' A ) I 7.

0

This optimal exponent of Typ with a certain A E A is of special importance. We shall introduce an abbreviation:

Definition 8.14. If A E A, then Typ* A

= TypDegA-' A .

0

We stress that the asterisk replaces an exponent n dependent upon A . Moreover, note that Typ is a partial function on A, but Typ' is a total function on

A. We proceed with a number of theorems on Typn, Typ' and Deg:

Theorem 8.15. If A E A , Deg A = 1 and A 1 B, t h e n Deg B = 1. Theorem 8.16. If PC E A, then for permissible n T y p n P C particular Typ* PC = PC".

=

0

PC'; in

Theorem 8.17. If PC E A, PP'C E A, and for a permissible n Typn PC PC', t h e n n is permissible f o r PP'C, and Typn PP'C 2, PP'C'.

CI G

Proof. It is sufficient to assume Tail PC $ 7 and n = 1. Let Tail PC = z and ( P C )I z = Q1 [z : B]Q22, then (PP'C)12 = Qi [z : B]Q;z, and [z : B] appears in either P or C. The remainder follows. 0 Theorem 8.18. If PC E A, PP'C E A and for a permissible n Typn PP'C PP'C', then n is permissible for PC and Typ" PC 1, PC'. Proof. Similar to the previous proof.

= 0

R.P. Nederpelt

452

CHAPTER 111. THE FORMAL SYSTEM A 1. Legitimate expressions The “meaning” of (A) B is the application of function B t o argument A. So far this application was unrestricted: any expression could serve as an argument. Besides, it was of no interest whether B really was a function or not. In the formal system A, which we shall introduce in this chapter, we only admit the expressions of A which obey the applicability condition. (For an informal introduction of the applicability condition: see Section 1.4.) We call this kind of expressions legitimate expressions. Since A is a part of A, we again provide expressions with abstractor chains Q, as we did with expressions in A (cf. the beginning of Section 1.6). We begin with the definitions of function, domain and applicability with respect to an abstractor chain Q:

Definition 1.1. Let Q B E A. We call Q B a Q-function if there are x, K and L such that Typ* QB 2 Q [x : K] L. The expression Q K is called a Q0 domain of QB. Definition 1.2. The expression Q B is called Q-applicable to QA if Q B is a Q-function with Q-domain Q K , Deg QA > 1 and Typ QA 2 Q K . In that 0 case Q ( A )B is a legitimate Q-application of Q B to QA. The formal system A is inductively defined by:

Definition 1.3. (1)

T

E A.

(2) If QA E A and if z does not occur in QA, then Q [ x : A]. Q [x: A] T E A.

E A and

(3) If QA and Qy E A, if x does not occur in QA and if x f y, then Q [z : A] y E A. (4) If QA and Q B E A, if the binding variables in A and B are distinct and if 0 Q B is Q-applicable to QA, then Q (A) B E A. The only difference to the (second) definition of A as given by Th. 11.3.10 lies in the applicability condition in (4): Q B must be Q-applicable t o QA, i.e. Typ*QB 2 Q[y : K ] L and Typ Q A 2 Q K . These reductions are defined for expressions in A (cf. the following Th. 1.4 and Th. 11.8.2). Note that the


453

applicability condition does not state that the reductions mentioned concern expressions in A only. The applicability condition has the powerful consequence that all expressions in A normalize (cf. Section 1.2), which we shall prove later in this chapter, whereas in the wider system A normalization is not guaranteed.

Theorem 1.4. If A E A, then A E A. Proof. Induction on the length of proof of A E A.

0

Restricting ourselves to a- and &reductions, we can weaken the applicability condition in the sense that we replace 2 by -:

Theorem 1.5. If Q A and Q B E A , Q [y : K ]L E A, Typ* Q B -p Q [ y : K ] L , Typ Q A -p Q K and if the binding variables in A and B are distinct, then Q ( A )B E A . Proof. Let Typ* Q B = QB’ (Th. 11.8.16). Since QB’ -p Q [y : K ]L , there is an M such that QB’ z p QM and Q [ y : K ] L I p Q M (Th. 11.5.12 and Th. 11.5.16). From Th. 11.5.16 and Th. 11.5.20: QM E Q [y : K’] L’ such that Q K I p QK’. Let Typ Q A = QA’. Since QA‘ -p Q K , there is a K” such that QA’ >p QK’’ and Q K I p QK”. Hence (Church-Rosser theorem for P-reduction, Th. 11.6.43) QK’ QK”, so there is a K”’: QK’ 2 p QK”’ and QK” >p QK“’. Also Q [y : K’] L’ >p Q [y : K”‘]L’. Resuming: Typ* Q B >p Q [ y : K”’]L’ and Typ Q A 2 QK”’. So Q ( A )B E A.

-

0

Note that the above theorem does not hold if we use lambda equivalence (-) instead of P-equivalence (-p). Let Q A E A and TypQA 2 QA’. Let Q B E A for some B. Then Typ* Q B = QB‘ Q [y : A‘] (y) B’ for some fresh y, since Q [y : A’] (y) B‘ & QB‘. If the above theorem were to hold with instead of -0, it would follow that Q ( A ) B E A. Note that A and B are arbitrary. This can clearly not generally be the case. As a counterexample, take Q = [z : 71, A = B = z. Then Q ( A )B = [z : T ] (z)z, which does not belong to

-

-

A. We shall prove a number of theorems concerning A.

Theorem 1.6. If A E A and A 2, B , then B E A.

0

As with A, it holds for A that, given K E A, only one of the derivation steps in Def. 1.3 can yield K E A as a conclusion (unique A-constructibility).

R.P. Nederpelt

454

Theorem 1.7.

If Q ( A )B E A, then Q A and Q B E A.

Proof. Follows from the unique A-constructibility.

0

Theorem 1.8. If Q [x : A]B E A , then QA E A.

Proof. Induction on IBI, using the unique A-constructibility. Let B = [yl : B I ]... [yk : B k ] Ps,where P f [ z : E ] PI, and s = T, s G y f z or s = x.

case 1. P = 8,k = 0. Then QA E A from rule (2) of Def. 1.3 for all possible s. case 2. P = 8, k 2 1. Then Q [z : A ] [yl : B1]... [ y k - l : Bk-11 Bk E A from rule (2) or (3), so Q A E A by induction. case 3. P = ( E )PI. Then Q [x : A] [ y ~: B1]... [yk : B k ] E E A by Th. 1.7, hence QA E A by induction. Theorem 1.9. Zf QA E A , then Qr E A.

Proof. Induction on [ A [ .If A E 7, there is nothing to prove. If A G z, then Q = Q1 [y : B ] or Q f Q1 [x : B ] . In both cases Q1B E A , so also Qr E A. I f A = ( B ) C or A = [ z : B ] C , then Q B E A by Th. 1.7 or by Th. 1.8, so by induction Qr E A . 0 Theorem 1.10. ZfA E A and B

c A , then AIB E A.

Proof. Induction on IAl. If A = r then the proof is trivial. Let A = (21: All ... [zk : Ak] Ps, where P f [ z : E ] PI. (1) If B

= [xj : Aj] ... [zk: Ah]Ps or B = Ps, then AIB 3 A E A.

( 2 1 : Ail ...[zi-i : Ai-I] (AilB) : All ... [ ~ i - 1 : Ai-11 Ai E A by ( [ x i : All ... [zi-i : Ai-l] Ai)lB and Th. 1.8, so by induction AIB E A.

( 2 ) If B C Ai, then AIB

(3) Let B C Ps, B f Ps. If P = 0 then B = s and AIB = A E A. So assume P = ( K )PI. Distinguish the cases B c K and B c PIS. In both cases we may conclude AIB E A by a similar reasoning as in (2). 0

Corollary 1.11. ZfA E A and x

c A, then Alz E A.

0

Theorem 1.12. Zf Q A and Q B E A , Q [x : A] B E A, then Q [z : A ]B E A.

Proof. Induction on IBI. Let B case 1. P case 2. P

= [y1 : B1]... [yk : Bk]Ps, where P f

= 8, k = 0. Then Q [z : A]B E A by Def. 1.3 (2) or (3). = 8, k 2 1. Call [y1 : B1]... [yk-l : Bk-11 E Q’.

[ z : El PI.


455

(1) Assume s = Y k . Then QQ’Bk E A by Th. 1.8, and Q [z : A] Q’Bk E A (Th. 11.3.8 and Th. 11.3.9), so by induction Q [ z : A]Q’Bk E A, hence Q [z : A] B E A. (2) Assume s f Y k . Then QQ‘Bk and QQ’s E A (by the unique A-constructibility), Q [ z : A]Q’Bk and Q [ z : A]Q’s E A (Th. 11.3.8 and Th. 11.3.9), so by induction Q [z : A]Q’Bk and Q [ z : A]Q’s E A. It follows that Q [z : A] B E A.

case 3. P I ( E )P’. c a l l [ y :~B l ] ... [Yk : Bk] = Q”. Then QQ”E and QQ”P’s E A by Th. 1.7, Typ* QQ”P’s = QQ”F‘ 2 QQ” [ z : K ] L and Typ QQ”E = QQ”E‘ 2 QQI’K. It follows from Th. 11.7.33, Th. 11.8.9 and Th. 11.8.17 that T y p * Q [ z : A]Q”P’s z Q [ z : A]Q”F‘ 2 Q [ z : A ] Q ” [ z : K ] L and Typ Q [ z : A]Q” E = Q [ z : A]Q”E’ 2 Q [ z : A ] Q ” K . By Th. 11.3.8 and Th. 11.3.9 Q [ z : A]Q”P’s and Q [ z : A]Q”E E A, so by induction they also 0 belong to A, hence Q [z : A ] B E A. Theorem 1.13. Zf Q [z : A ] B E A and Q B E A, then Q B E A. Proof. Induction on 1BI. The proof is similar to the proof of Th. 1.12, with 0 the use of Th. 11.3.10 instead of Th. 11.3.11. We shall use the following theorem as a lemma for the important Th. 1.15. Theorem 1.14. Let PP’K, P L E A, PP’L E A and Typ* PP’K Typ* PP’L. Then PP’L E A. Proof. Induction on IlPP‘Il. If PP’

I I, the

la

proof is trivial.

case 1. Assume P = Q ( E )P“. Then QPl‘P’K E A, Q E E A, Typ* QP‘IP’K 2 Q [ y : M ] N and Typ Q E 2 Q M . Also: QP”L E A and QPI’P’L E A. We now prove that Typ* QP”P‘K 2, Typ* QP‘IP‘L. Let Typ* PP’K = PP’K’ and Typ* PP‘L I PP’L‘, then by hypothesis Q ( E )P“P’K‘ = PP’K’ PP’L‘ = Q ( E )P”P‘L‘, so also QPI’P‘K’ la QPI’P’L’ (Th. 11.4.6). But Typ*QP“P’K = QP”P‘K’ and Typ*QP”P’L = QP’‘P’L’ by Th. 11.8.6 and Th. 11.8.18. It follows by induction that QP’IP’L E A. Also Typ* QPI’P‘L 2 Q [ y : MI N , so Q ( E )PI’P’L I PP’L E A. case 2. Assume P = Q and P’ = Q’ ( E )P”. Then QQ‘P‘IK E A, QQ’E E A , Typ’ QQ‘P‘IK 2 QQ’ [y : M ] N and Typ QQ‘E 2 QQ’M. Also: QQ’PI’L E A and Typ* QQ‘PI‘K Typ* QQ‘PI‘L (which can be proved as in case l),so by induction QQ’P”L E A. Since Typ’ QQ’PI’L 2 QQ‘ [ y : M ] N it follows that QQ’ ( E )P”L I PP’L E A. case 3. Assume P I Q and P’ = Q’. If Q’ = 0 there is nothing to prove. Let

R.P. Nederpelt

456

Q’ [zl : MI]... [z,, : Mn]for n 2 1. Since QL and QQ’L E A, z, cannot occur in QL (Th. 11.3.8) or in Q [z1 : M i ] ... [zi-l : Mi-11 Mi.It follows from QQ’K E A (Th. 1.8) that QMi, Q [xi : Mi] M2, ..., Q [xi : M I ]... [zn-1 : Mn-11 Mn E A. SO also Q [XI : M i ] L , Q [xi : M i ] [Q : M2] L , ...,QQ’L E A by Th. 11.3.11 and Th. 1.12. 0 Theorem 1.15. If A E A, then Typn A E A for all permissible n. Proof. Let A = Pi [z : B]P ~ xthen , Typ A = PI [z : B]PZFrB. Since A E A: P1B E A (Th. 1.8), so PlFrB E A (Th. 1.6). Also Typ A E A (Th. 11.8.2) and Typ* A > a Typ*(Typ A). Now, applying Th. 1.14, we obtain Typ A E A. The theorem follows directly. 0 2. The normalization theorem In this section we shall prove the normalization theorem: if A E A, there is a B in normal form such that A 2 B ( B is said to be in normal form if there are no reductions B 2; B‘ or B 2; B’). We do this by the aid of a norm p, which is a partial function from expressions in A to expressions in A, and which has the following powerful properties with relation to A: (1) If A E A, then p(A) is defined.

(2) If A E A and A 2 B , then p(A) & p(B). (3) If A E A and Deg A

> 1, then p ( A )

p(Typ(A)).

Hence this norm is invariant (apart from a-reduction) with respect to reduction and typing. We first define P A for every A E A. This P A is a partial function from subexpressions of A to expressions. It is rather in contradiction to our philosophy to define the norm with respect to subexpressions, which need not belong to A. We could have avoided this by giving a definition of the norm in the line of our second definition of A, only considering norms of expressions in A. This, however, would have impaired understanding of the following and would have led to laborious descriptions. On the other hand, in this section the context of a subexpression will always be clear, so that no confusion can arise. In the following inductive definition of PA we do not explicitly indicate which occurrence of a subexpression in an expression is meant, since this will be clear from the context.

Definition 2.1. Let A E A. (1) If

7

c A then

=

~ A ( T ) 7.

Strong normalization in a typed lambda calculus (C.3) (2) If z c A , Alz

457

= Q1 [z : B]Q 2 x and if p A ( B ) is defined, then PA(Z) = ~ A ( B ) .

(3) If [z : B]C c A, and if both ~ A ( Band ) ~ A ( Care ) defined, then P A ( ( . : B] [x : p A ( B ) ] P A ( C ) .

c)

=

(4) If ( B )C c A , if both P A ( B )and P A ( C )are defined and PA(C) [y : D] E where D ~ A Bthen , ~A((B C)) G E. 0

From this definition it can easily be seen that, if ~ A isAdefined for A E A,

P A Acontains no bound variables. The following theorem is obvious:

The binding variables in P A A will be irrelevant t o our purposes. We might as well do without them. Our reason for retaining them is personal taste: we find the property ~ A ( AE) A agreeable. ) a certain A E A, we apply the four rules of In trying to calculate ~ A ( Afor Def. 2.1; the only event in which this calculation can break down prematurely (before ~ A ( Ais) obtained), is when we encounter a subexpression ( B )C c A for which the conditions stated in Def. 2.1 (4) are not fulfilled. These conditions may be considered as a weaker form of the applicability condition (cf. Section 1.6, where this is explained in an informal manner): (1) C must have a norm with a functional character: PAC= [y : D] E , and (2) B has a norm which behaves as an appropriate argument for the “function” PAC:PABL a D. If these conditions are fulfilled, the norm of ( B )C is defined as the result of the application of the “function” PACto the “argument” ~ A B~: A ( ( B C)) 2 E ; if these conditions are not fulfilled, the norm of ( B )C is not defined, and neither is the norm of A . Note that the norm of a bound variable is defined as the norm of its “type”: if [x : B ] is the binding abstractor of x, then P A ( Z ) = P A ( B ) . The existence of P A A for a certain A E A indicates that some weak functional condition is fulfilled. Suprisingly enough, the existence of ~ A already A guarantees that there is a normal form for A . We shall prove this in Th. 2.17. We are especially interested in normalization properties of expressions in A. We note that expressions in A have, so to say, a much stronger functional character than is required for the existence of the norm of expressions. Th. 2.7, stating that P A Aexists for A E A, is not hard to prove.

R.P. Nederpelt

458

If in the following we speak of the norm of a subexpression B of a certain expression A , it will be clear which A we mean, even if we do not state this explicitly. In such cases we shall write p(B) instead of ~ A ( B ) . If A E A, B c A and ~ A ( Bis) defined, we call B pA-normable. Here, too, we speak of “p-normableB” if it is clear which A (with B c A E A ) we mean. If Qr E A, if Qr is pnormable and ~ ( Q T=)Q‘r, we call Q p-normable, and we abbreviate p(Q) = Q’.

Theorem 2.3. If A E

A, A is p-normable and B c A , then B is p-normable.

Proof. Induction on lAl, with the use of the definition of B

cA

(Def. 11.2.5). 0

Theorem 2.4. If Q A E A and Q A is p-normable, then Q and A are pnormable and p(QA) G (pQ)pA; if Q A E A, and if Q and A are p-normable, then Q A is p-normable and p(QA) = (pQ)pA.

Proof. Induction on 11Q11.

0

Theorem 2.5. If A E A, if A is p-normable and A 2 B , then B is p-normable and pA > a pB.

Proof. First assume that A 2’ B. We proceed by induction on the length of proof that A 2’ B. If A 2; B then the proof is trivial; this case is expressed in Th. 2.2. (I)

(a) A 2’ B is Q ( C )[z : D ] E 2; Q ( z := C ) E . Since A is p-normable: p ( [ z : D]E ) = [z : p D ] p E and pC 2, p D = pz (see Th. 2.3 and Th. 2.4). Moreover, pA = p(Q ( C )[z : D] E ) = (pQ)pE. We now prove for this 2, C and E:

Lemma. If K c E, then (z := C ) K is p-normable and p(z := C ) K 2, p K .

Proof of the lemma. Induction on 1KI.

=

(1) (a) If K z z, then (z := C ) K = FrC and p ( z := C ) K pFrC 2, pC 2, pz = p K . (b) If K y f z or K z T , then (z := C ) K K and p(z := C ) K = p K . (2) If K = [y : FIG, then pK [y : pF]pG. Note that y f z. By induction: (z := C ) F and (z := C ) G are pnormable, p(z := C ) F la pF and p(z := C ) G 2, pG. So (z := C ) K is p-normable and p(z := C ) K [y : p(z := C ) F ] p ( z:= C ) G > a [y : pF] pG pK.

=

=

=

=

=


459

(3) If K = ( F )G , then pG = [y : L] H and L la p F , and pK = H . By induction: (z := C ) F and (z := C)G are p-normable, p(z := C ) F pF and p(z := C)G 2, pG. It follows that p(z := C)G = [ z : L'] H' and L' La L La pF l ap(z := C ) F , so (z := C ) K is p-normable and p(z := C ) K I H' H G pK. 0 It follows that B is pnormable (since E c E ) , and p B = (pQ)p(z:= C ) E l a(pQ)pE= PA. (b) A 2' B is Q [z : C ](z) D 2; QD. Since A is pnormable: QC is p-normable, pz = pC, pD = [a, : L ] H and L > a pz = pC, so pA = ( P Q ) [z : PCI H l a bQ) : PC]H La (pQ)pD= PQD PB. (11) A 2' B is a direct consequence of a monotony rule. It depends on the monotony rule which of the following three cases applies: (a) A 2' B is Q ( C )E 2' Q (C)F as a direct consequence of Q E 2' QF. Since A is p-normable: Q E is p-normable. By induction: QF is p normable, and pQE = (pQ)pE 2, (pQ)pF = pQF, so pE 2, pF. Moreover, pE = [a, : L] H and pC La L, so also pF = [z : L'] HI, where L' > a L and HI La H . It follows that (C) F is p-normable, and p(C) F = H' H . So pB (pQ)pH = pA. (b) A 2' B is Q [z : C ]E 2' Q [x : D] E as a direct consequence of QC 2 ' Q D . Then pA = (pQ)[z : pC]pE. By induction: Q D is p-normable and (pQ)pD = pQD, so pC la pD. Hence B is pQC = (pQ)pC pnormable and pA l a(pQ)[z : pD]pE = pB. (c) A 2' B is Q ( C )E 2' Q ( D )E as a direct consequence of QC 2' QD. Then pE = [z : L] H and L l apC. By induction: Q D is pnormable and pQC = (pQ)pC la (pQ)pD zz pQD, so pC > a pD. Hence B is p-normable and pB = (pQ)H = pA. Finally, if A 2 B is a multiple-step reduction, decompose the reduction and apply the above. 0

Theorem 2.6. If A E A, Deg A p-normable and pA la p Typ A.

>

1 and A is p-normable, then Typ A is

Proof. Let A = PI [z : B ] P ~ z then , Typ A = PI [z : B ] P2FrB. It is not hard to show that pFrB la pB = px. Let PI [x : B]P2 = PIP''. Next prove by induction on IIP"II that P"FrB is p-normable, and p(P"FrB) 2, p(P"x). 0 Theorem 2.7. If A E A, then A is p-normable (i.e. p is a total function on A).

R.P. Nederpelt

460 Proof. Induction on the length of proof of A E A. (1) A

= 7: trivial.

(2) A = Q [ z : B ] z or Q [ z : BIT E A as a direct consequence of QB E A. Then by induction QB is p-normable, hence Q is pnormable and pB = pz. Hence A is pnormable.

(3) A = Q [z : B]y E A as a direct consequence of QB E A and Qy E A. By induction: QB and Qy are pnormable, hence Q, B and y are pnormable, so A is pnormable.

= Q ( B )C E A as a direct consequence of QB E A, QC E A, and the Qapplicability of QC to QB. Then QB and QC are p-normable (induction), and so are Q, B and C. The Q-applicability implies that Typ* QC 2 Q [z : K ]L and Typ QB 2 QK. From Th. 2.5 and Th. 2.6: Typ* QC and Q [z : K ] L are pnormable, pQC p Typ* QC 2, (pQ)[z : p K ] p L (so PQK (so P B 2, pK). PC [z : PKI p L ) and PQB Za p TYPQ B 0 Hence ( B )C is p-normable and so is A .

(4) A

Instead of p is total on A , we also say: A is p-normable. F’rom Th. 2.5 we derive:

Theorem 2.8. If A , B E A and A

-

B , then p A

pB.

0

We shall now prove the normalization theorem for p-normable expressions.

Definition 2.9. A E A is normal (or in normal form) if there are no reductions A 2b B or A & B ; A is normalizable (or A has a normal form) if there exists a normal C such that A 2 C (C is called a normal form of A ) . 0 Definition 2.10. A E A is @-normal if there is no reduction A 2; B ; A is @-normahable (or A has a @-normalform) if there exists a @-normalG such 0 that A 20 C (C is called a @-normalform of A ) . Hence A is normal if A admits of neither @-, nor 77-reductions; A is @-normal if A admits of no @-reductions (except trivial ones).

Theorem 2.11. If A E A is normal and A B , then B is normal. If A E A as @-normaland A B OT A > q B , then B is @-normal. Proof. The only non-trivial statement is that B is @-normalif A is p-normal


46 1

and A zs B. It can, however, easily be seen that a single-step g-reduction of a pnormal expression cannot introduce the possibility of a single-step /3-reduction. 0 We restate the following well-known theorem:

Theorem 2.12. If A E A is @-normalizable,then A is nonnalizable.

Proof. As a result of Th. 2.11, g-reductions of A do not cancel the /3-normal character. But the possible number of single-step g-reductions applicable to A 0 is finite, since the expression becomes shorter with each step. Theorem 2.13. If A E A is @-normalizable,the p-normal form of A is unique but for a-reductions.

Proof. Let C and D be P-normal, A >p C and A >p D. Then, by the ChurchRosser theorem for &reduction (Th. 11.6.43): there is an E such that C 2 p E 17 and D >,,p E. Hence C la D. Theorem 2.14. Assume that Q (Ak)... ( A l )B is in A and p-normable. Then k

i=l

Proof. Induction on k . If k = 0 the proof is trivial. Let k > 0. Then ( A l )B is p-normable, hence p B = [z : M ] N and pA1 >, M , so IpAll = IMI. Moreover, k

p ( A 1 )B

G

N , hence IN( >

(pAi(by induction. It follows that i=2

= Q (Cn)...(GI) F IpCi(. If A = Qs (with 3 = z

Definition 2.15. Assume that A is in A and pnormable, A for some n

> 1 and F f

n

( M )N . Then o ( A ) = i=l

or s E T), then a ( A )= 0.

0

Theorem 2.16. Assume that A as in A and p-normable, A E Q (Cn) ... (Cl) F , F f ( M )N , and let QCi (for 1 5 i 5 n ) and QF be @-normal. Then A is pnormalizable.

Proof. Induction on o ( A ) . (1) If a ( A ) = 0, then n = 0 and A = Q F in p-normal form.

( 2 ) Let a ( A ) > 0. Then n 2 1. We proceed by induction on IF(. If F = y, then A is in @-normal form ( F = T cannot occur since A is p-normable).

R.P. Nederpelt

462

So let IF1

> 1. Then F z [z : D]E .

Assume that E = ( H m ) ... ( H I )y where y f z and m 2 0. Then A 2 Q ( C n )...(C2) ((z := C1)Hm)...((z := C1)Hl)y. Now note that Q (C1)[z : D]H , E A, pnormable, and a ( &(C1)[z : D] H,) = JpClJ5 a(A). Moreover, IH,I < [El,so by induction Q(C1)[z : D]H , is P-normalizable. Since QC,, QD and QH, are P-normal, the pnormalization of Q (C1)[z : D]H , must commence with Q (C1) [z : D] H , 2; Q ( z := C1)H,, so Q ( z := Cl)H,is P-normalizable; say Q ( z := C l ) H , 2 Q K z in p-normal form. It follows that A 2 Q (Cn)... (C2) ( Km )... (K1)y in ,&normal form.

(i)

(ii) Assume that E z ( H m )... ( H I )T where m 2 0. Again, analogously to (i), A is P-normalizable. (Moreover, m must be 0 since A is p normable.) (iii) Assume that E = (Hm)... ( H I )z where m 2 0. Then A 2 A’ = Q (Cn)... ((72) ( K m )... (K1)FrCl, where we obtain the @-normalQKr as in (i). If now FrC1 is a variable or if FrCl begins with an applicator, we have obtained a p-normal form. If FrC1 E [y : M ]N , then

g(A’)=

2 r=2

IpCzl

+

m

lpKzl < IpFrCl) (by Th. 2.14 and Th. 2.5) = p 1

IpClI 5 a ( A ) ,so by the induction hypothesis: A’ is 0-normalizable, so A is P-normalizable too, or n = 1 and rn = 0, whence A’ is p-normal. (iv) Assume that E = [y : H I ]H2. Then A 2 Q (Cn)... (C2) [y : (Z := Ci)Hl](Z := C1)H2 2 Q (Cn)... (C2)[y : K1]K2, where we again obtain the p-normal Q [y : K1]K2 as in (i). Since a(Q(C,) ... (C2)[y : K1]Kz) = n

IpC,l

< cr(A), it follows by induction that A is P-normalizable, or

2=2

n = 1 and Q [y : K1]K2 is P-normal.

0

Theorem 2.17 (@-normalizationtheorem). If A E A is p-normable, then A is P-normalizable. Proof. Induction on the length of proof of A E A.

(1) A

=

T;

trivial.

(2) A = Q [z : B ]z or A E Q [z : B]T E A ils a direct consequence of Q B E A. Then by induction Q B is P-normalizable, so QB 2~ Q’B’ in @-normal form, and A I p Q’ [z : B’]z or A >p Q‘ [z : B‘]T in P-normal form.


463

(3) A = Q [ z : B ]y E A as a direct consequence of Q B E A and Qy E A. Then by induction Q B >p Q’B‘ in p-normal form, so A Q’ [z : B’]y in O-normal form.

>

= Q ( B ) C E A as a direct consequence of Q B E A and QC E A. Then by the induction hypothesis: Q B >p Q’B’ in P-normal form (with 11Q11 = 11Q’11) and QC >p Q”C’ in P-normal form (with 11Q11 = 11Q”11). From Th. 2.13 and induction on 11Q11 it follows that Q”C’ la Q’C’. Also Q ( B )C >p Q’ (B‘)C’, which is in p-normal form if C’ $ [z : D] E. So all that is left to prove is that Q’ (B’)[z : D] E is P-normalizable. But this 0 follows from Th. 2.16 and Th. 2.5.

(4) A

Theorem 2.18 (normalizationtheorem for A). If A E A then A is P-normalizable and normalizable. Proof. Follows from Th. 2.17, Th. 2.12 and Th. 2.7.

0

In fact we proved that A E A is efectively normalizable, since all our proofs are constructive, which implies that the normal form of A E A is effectively computable.

3. Strong normalization In the previous section we have proved normalization for A. This guarantees that for every A E A there is a reduction which leads to a normal form. However, we do not yet know whether an arbitrary sequence of single-step reductions, beginning with A , terminates (in a normal form). We shall prove this in this section. The property that an arbitrary sequence of single-step reductions, beginning with some A , terminates, will be called the property of strong normalization. In the proof we shall use ,&-reduction and &reduction, introduced in Section 11.6. A feature of PI-reduction is that “scars” of old ,&-reductions are retained. We shall first prove strong normalization for A as to ,&-reduction, and derive strong normalization for A as to P-reduction; finally, we shall incorporate qreductions.

Definition 3.1. A E A is P1-normal (or in pl-normal form) if there is no B such that A B; A is P1-normalizable (or A has a 01-normal form) if there exists a pl-normal C such that A Ip, C (C is then called a P1-normal form of A ) . The concepts &normal, &normal form and P2-normalizable are defined analogously. 0

R.P. Nederpelt

464 Theorem 3.2. If A E A, A is pl-normal and A

>a

B , then B is pl-normal.0

Theorem 3.3. If A E A is pl-normalizable, the 01-normal form is unique but for a-reduction. Proof. This follows from CR for P1-reductions (Th. 11.6.38).

0

Theorem 3.4. If A E A, A is p-normable and A >pl B , then B is p-normable and pA > a pB. Proof. First assume that A B. of proof of A

>bl

(I)

>bl

B . We proceed with induction on the length

Let A = Q ( C )P [x : D]E >pl Q (C) P [i: D](x := C ) E = B. Then P [x : D ] E is pnormable. It is easy to see (induction on IIPII) that [x : pD] pE. So pC > a pD. As in the p ( P [ x : D] E ) E p ( [ x : D ] E ) lemma occurring in the proof of Th. 2.5 we can prove that (x := C ) E is pnormable and that pE > a p ((x := C ) E ) .It follows that B is p-normable and pA 2, pB.

>bl

(11) A B is a direct consequence of a monotony. In all three cases the proof is identical to that given in part I1 of the proof of Th. 2.5. Finally, if A >pl B is a multiple-step reduction, decompose the reduction 0 into single-step PI-reductions and apply the above.

We shall now prove the PI-normalization theorem. We do this in quite the same manner in which we proved the p-normalization theorem. In fact, if we had begun by proving the pl-normalization theorem, the P-normalization theorem would have been a corollary. We have not chosen this order because in the following proof the main lines are obscured by the presence of a number of P-chains Pi. In contrast to this, the line of thought in the proof of the pnormalization theorem, given in the previous section, is much more lucid. Definition 3.5. Let A E A, A E P1PB and let P be such that, for each [x : C] for which P E Pz [x : C ]P3, it holds that x $ P3B. Then we call P an 0

ineffective P-chain, and write A

= PI P B.

0

Theorem 3.6. If A E A is pl-normal and B c A , then B has the form 0

B =PO

0

[XI

: All

PI

... [x, : A,]

0

0

P , ( B I ) Pi

0

... ( B L )Pis,

with s

= zi

or

9 E 7.

Proof. Induction on IBI.

0


465

(Ak)Pk (Ah-1) P k - 1 ... ( A l )P1B belong to A and be

Theorem 3.7. Let

k

>

p-normable. Then lpBl

IpAil. i= 1

Proof. Analogous to the proof of Th. 2.14. Note again that for p-normable 0 PC it holds: p(bC) = pC. Definition 3.8. Let A E A and assume that A is pnormable. Let A = 0 0 0 Q Pn+1 (Cn)P n ... ( C i ) P i F , where F T , F x or F E [y : M ]N with n

y

c N . Then a l ( A ) =

JpCiI if n

1 1, and a l ( A ) = 0 in case n = 0 and

i=l 0

P,+lf 0. Moreover, q ( A ) = 0 if A

= QT or Qx.

0

Theorem 3.9. Let A belong to A and be p-normable, let 0 0 0 A E Q Pn+1 (Cn) Pn ... (Ci) P i F , where F f T , F = x or F

[x : D]E

0

wzth x c E . Let QC,,QF and Q P , r be pi-normal. Then A is pi-normalizable.

Proof. Induction on q ( A ) . The proof is analogous to that of Th. 2.16. How0

ever, some modifications are required due to the P,. We shall briefly comment 0 0 0 on this: As to (2) (i): E = P k (H,) ... P i ( H I ) Pby, and

A2Q

(cn)i

in+i

n

... (

~ 2 F )2 ( ~ 1 F ) 1

[g: I)] ; :(K,,J ... Fy (

~ 1 , y:;)

0

where the K , are obtained as in the proof of Th. 2.16 and where Q P!T are the 0

. can be obtained since either ,&-normal forms of Q(z := Cl) P ~ TThese 0

0

0

(1) if x CP;: P! =Pi, or 0

0

(2) if x CP;: q ( Q (CI) [X : D] P t r ) = (pC1I 5 g ( A ) and I P ~ T&,B .

Then IAl 5 IB(.

Proof. Induction on the length of proof of A

>&,B .

0

Definition 3.13. Let A E A. We write Pl-nf A for the PI-normal form of A which we obtain from the effective computation as suggested by Th. 3.10 and used in Th. 3.11. 0 Note. This PI-normal form is unique (Th. 3.3). Definition 3.14. We call K E A strongly P-normalizable if there is an upKZ ... Kl. per bound for the length 1 of reduction sequences K = K1 Analogously we define the concepts strong PI-, Pa- or 17-normalizability of K . 0

>& >& >&

Theorem 3.15 (strong Pa-normalization theorem for A). If A E A, then A is strongly -normahable. Proof. Induction on IA(. Definition 3.16. Let A E A, and let A = A1 A2 >k2 ... >L2 A, be the longest possible sequence of single-step P2-reductions beginning with A. Then 0 @(A) = p .

>b2

Note that p 5 (A[. Theorem 3.17. If A E A and A Proof. Follows from Th. 3.3.

>&, B , then &(P1-nf A) = OZ(P1-nfB ) . 0


467

Theorem 3.18. If A 2bl B , then & ( A ) < 0 2 ( B ) .

>,;

B. The only interesting case is A = Q ( C )p [z : D] E >&,Q ( C )P [g : D] (3 := C ) E = B , where, indeed, we have at least one single-step P2-reduction more on the right hand side. The rest

Proof. Induction on the length of proof of A

of the proof is easy.

0

Corollary 3.19. If A E A, then 02(A) 5 @ @ l - n f A ) .

0

Theorem 3.20 (strong pl-normalization theorem for A). If A E A, then A is strongly ,f31-normalizable. Proof. Follows from Th. 3.17, Th. 3.18 and Cor. 3.19.

0

Definition 3.21. Let A E A, and let A = A1 >b, A2 2&, ... A, be the longest possible sequence of single-step PI-reductions beginning with A. Then 0 01(A) = p .

>bl

Theorem 3.22. Let A E A, let A be in &-normal f o r m and let A >p, B . Then B is also i n PI-normal form. Proof. If B were not in PI-normal form, then B >b, C for some C. In that B’ >p, C according to Th. 11.6.17. Concase there would be a reduction A 0 tradiction.

>bl

Theorem 3.23. If A E A, then there is a n upper bound for the length 1 of A1 2’ A2 2’ ... 2’ Al, where each Ai 2’ Ai+l is a reduction sequences A single-step p1- or /32-reduction. Proof. Induction on @ l ( A ) . If 01(A) = 0, then A is in pl-normal form. If we can apply ,&-reductions on A such that A B (n 2 l ) , then B is also in pl-normal form (Th. 3.22). The number of possible single-step &reductions applicable is finite (5 &(A); cf. Th. 3.15). So let 01(A) = p > 0, and assume that the theorem holds for all K with Q l ( K ) < p . Let A 2 D be a reduction sequence consisting of single-step PIand &-reductions. If no PI-reductions occur in the reduction sequence, the length of the reduction sequence can be at most 02(A). Else, let A 2 D be A B C D. Then by Th. 11.6.17 there is also a reduction seB’ >p, C D . Each B” such that A B“ has by induction quence A (since 01(B”) < &(A)) an upper bound for the length of reduction sequences B” 2’ ... >’ E in which each single-step reduction is either a PI- or a p2reduction. Let m be the maximum of these upper bounds. Then the length of the reduction sequence B’ 20, C D, hence of C D, cannot be more than

>z2

>,;

>b,

>&, >

>

>b,

>

>

R.P. Nederpelt

468

m. It follows that the length of any reduction sequence A 2 D can be at most 0 @2(A) m 1.

+ +

Theorem 3.24 (strong P-normalization theorem for A). If A E A, then A is strongly P-normalisable. Proof. Each P-reduction sequence of A can be decomposed into single-step PI0 and Pz-reductions by Th. 11.6.15. So Th. 3.23 yields the desired result.

>&

>& >&

Definition 3.25. Let A E A, and let A = Al’ A2 ... A , be the longest possible sequence of single-step @reductions beginning with A . Then @ ( A )= p . 0 Theorem 3.26 (strong 7-normalization theorem for A). If A E A, then A is strongly rpnormalizable. Proof. Induction on IAl.

0

Definition 3.27. We call K E A strongly normalizable if there is an upper bound for the length 1 of reduction sequences K = K I K2 _>’... >’ Kl 0 where each reduction Ki >’ K;+1 is a single-step P- or 7-reduction.

>‘

Theorem 3.28 (strong normalization theorem for A). If A E A, then A is strongly normalizable. Proof. Induction on @ ( A ) . The proof is similar to that of Th. 3.23. Use Th. 3.26 instead of Th. 3.22, and instead of Th. 11.6.17, use the theorem: If K E A, K lo L M , then K L’ >_ M . The latter theorem is easy to prove, since each reduction A 2; B C can be replaced either by a reduction A >&B‘ 2; C (where r 2 0) or by a reduction A B’ _>; C (see the discussion after Th. 7.18; see also Th. 7.25).

>b

>b

>&

>&

469

Big Trees in a A-Calculus with A-Expressions as Types* R.C. de Vrijer

0. Outline

The abstract term system AX studied in this paper is a close relative of the Automath family of languages. In the investigation of normalization and decidability properties of these languages, AX came up as a natural generalization of AUT-QE, the language currently in use for mechanical proof checking at the Automath project in Eindhoven. For introductory reference, see [van Daalen 73

~4.311. The introduction, Section 1, is an informal account of the system AX and its relation to other systems. The formal description of AX is given in the Sections 2 and 3. In 4 the main results are stated, mostly without proof. Section 5 is devoted to proving that the big trees are well founded (BT).

1. Introduction 1.1. Heuristic description Before describing the main results of the paper we make a few heuristic comments, especially on the generalized type structure involved. Here we use the “formulas-as-types” notion for interpreting mathematical statements and proofs, originated independently in [ d e Bruzjn 70a ( A . 2 ) and [Howard 801 (the term comes from Howard). Further references are given in 1.4.

1.1.1. Type structure To illustrate the transition from the type structure of traditional type theory, e.g. the typed A-calculus exhibited in [Hindley et al. 721, to the types we have here, we consider mnstructive versions of propositional and predicate logic respectively. If we identify a proposition a with the type of its constructions (or *Reprinted from: Bohm, C., ed., A-Calculus and Computer Science Theory, p. 252-271, by courtesy of Springer-Verlag, Heidelberg.

R.C. de Vrijer

470

proofs), then the implication a + p will be the type of constructions that map constructions of a to constructions of /3. That is, a + p corresponds essentially to the Cartesian power pa. In predicate logic a construction c of Vz.P(z) will map any object t from the domain of quantification a to a construction of the proposition P ( t ) . Hence the type of c(t) depends on the choice o f t . The notion of power doesn’t suffice any longer; we need that of Cartesian product: II P ( z ) . XECX

1.1.2. Abstraction and application, two interpretations Automath exploits the formal similarity between two kinds of abstraction: functional abstraction to form the functionlike construction Xz E a.c(z)and the product construction ll P ( z ) . It is convenient to unify these principles in XECX

the notations [z : a]c(z) and [z : a]P ( z ) , respectively. Observe that now functional application in the former case corresponds to specification of coordinate axis in the latter. Also here we use the same notations: ( t )[z : a]c(z) and ( t )[z : a]P ( z ) ,which reduce to c(t) and P ( t ) ,respectively. Now this uniform syntactical treatment of both kinds of abstraction, very convenient for our purposes, may cause some confusion in interpretation. For example, vis i vis the formula-type analogy it amounts to using the same notation for both the predicate, i.e. “propositional function”, Xz E a.P(z) and its universal quantification

vz E a.P(z). 1.1.3. Supertypes, type inclusion We further introduce the constant type as a %upertype” of types. Then, e.g. [z : a]type will be the supertype of all those types p, such that whenever t is an element of type a (notation: t E a ) , ( t )p is a meaningful type. Hence, carrying on the example from 1.1.2, we have [z : a]P ( z )E [z : a]type. Moreover, because of the possibility of interpreting [z : a]P ( z ) as a proposition Vz E a.P(z), we require that [z : a]P ( z )E type. This motivates the facility in AX (and in AUT-QE) to pass here from [z : a]type to type, known as the principle of type inclusion: [z : a]type C type (cf. [van Daalen 73 (A.311, [de Bruzjn 7Oa (A.2)] and 3.5.2 below). In order to clarify this slightly ambiguous situation one could for the product construction introduce the II’s again, and obtain II [z : a]P ( z )E type for the product and [z : a]P ( z )E I I [z : a]type for the type-valued function, respectively (cf. [Zucker 77 (A.d)]).

1.1.4. AX-theories Expressions are built up by using the principles of abstraction and application mentioned above, starting from variables, parameters and constants. A

Big trees in a A-calculus (C.4)

471

particular choice of the constants and their (super) type assignments will depend on the interpretation one has in mind. Such a choice is formally fixed by a base (cf. 3.1). Each base determines a specific AX-theory. In informal mathematics new notions are always introduced in a context, possibly indicated by the presence of certain parameters and assumptions. This observation is reflected in AX by the fact that constants are allowed to depend on parameters. We now illustrate the treatment of constants in AX and the parameter mechanism involved. Let Cl(a,p) be a type constant, t o be interpreted as the proposition 3s E a.(s)p, where p is supposed to represent a predicate on the type a. Informally introducing C1(a, p ) one might stipulate: (1) “Let P be a type, and Q be a predicate on P. Then we will consider C1( P ,Q) as a proposition.”

In AX the (super) types of parameters are indicated by superscripts and hence the corresponding axiom reads: (2)

Cl(PtYPelQ[s’pltype) Etype .

The rule of existence introduction can now be formalized by adding another constant Cz(a,p) together with the axiom (3)

C2(PtJPe,Q[s:pltJrpe) E [X : P] [y : (s) Q]Cl(P, Q)

.

When actually given a E type and p E [s: a]type, the statements c1(a, p) E type and Cz(a,p) E [x : a][y : (x) 01 Cl(a,p) can now be obtained as instances of (2) and (3), respectively. Moreover, for objects t E a and s E ( t ) P application and P-reduction yield: (s) ( t )Cz(a,p)ECl(a,p). For further explanation on the subject of interpretation we refer to the treatment of AUT-QE in [van Daalen 73 (A.3)] and to [van Benthem Jutting 773. [Note. We can be somewhat more explicit on the relation between the formats of AX and AUT-QE. Axioms like (2) and (3), which in a AX-theory are given by a base, correspond to PN-lines in an AUT-QE book:

* P *

P Q

Q * Q *

c1

:= := :=

c 2

:=

type [ x : Pltype : type : [s: PI [y : (s) Q] type

: :

PN PN

.

In this manner a AX-theory (or rather, its base) corresponds to an AUT-QE book in which all constants are introduced as primitive notions. Vice versa, each such AUT-QE book gives rise to a AX-theory. Defined constants are not considered in AX.]

R.C. de Vrijer

472 1.2. Applicability

Usually, in type theory as in the Automath languages, term application is subjected to the applicability condition: ( t )f is a term iff there are types Q and p such that tEa and f E [ z : alp. Now in typed A-calculus this condition is easy to formulate. The type structure and the assignments of types to terms are given in advance, i.e. all of the syntax precedes the generation of theorems. In our case, however, types depend on objects and the type assignments are themselves treated as theorems in AX. Hence here the applicability condition would make derivability interfere with term formation. A common way of dealing with this complication (cf. Automath, Martin-Lof, etc.) is to generate the terms (including the types) simultaneously with the theorems. By contrast we take the approach of allowing unrestricted application in AX, but instead now subjecting the rule of @reduction

(4)

( t )[z : a]c --t c [z := t]

to the condition tEa. We can then formulate an applicability condition by referring to derivability in AX and so define the set of legitimate terms. The legitimate fragment AX - 1 of AX is the system one obtains by restricting AX to the language containing only legitimate terms. Hence AX - 1 may be considered as the part of AX that is significant for interpretation. (Though, of course, the illegitimate terms do have a computational interpretation in the term model.) The justification for the above sketched procedure lies in the following result: AX is a conservative extension of AX - 1 , (5) This property may be regarded as a soundness criterion for the notion of legitimacy as defined above, and hence for AX: if the equality of two significant (read: legitimate) terms can be proved in AX, it can be done using only significant terms. The proof of (5) uses the result on “big trees” described below. 1.3. Decidability, big trees

We now turn to a second desirable property of the systems: (6)

AX and hence AX - 1 are decidable.

Decidability of the typed A-calculus is an easy corollary of the strong normalization property (SN) and the Church-Rosser property (CR). Every term reduces effectively to its normal form (nf) and two terms are equal iff their nf’s are identical. However, although both SN and CR go through for AX, they are not sufficient for the decidability, as we will now explain. In the discussion we make use of an effective function T ,which assigns canonically t o every object a type such that t ~ T ( t ) Then, . since we have uniqueness of types (cf. 3.3.5):


(7)

473

tE a -3T ( t ) = ct

(where by CR, = is equivalent to having the same nf). So, in order to see if (4) holds, we must first determine if ~ ( tand ) a have the same nf (by (7)). Then in the process of reducing these terms questions of the form (4) may arise again, and so on. To deal with this problem, we proceed as follows. Let -‘bt be the improper reduction relation generated by (i)

usual &reduction,

(ii) applying T , (iii) taking proper subterms. Call the tree of -’bt-reduction sequences of a term C the “big tree” of C. Then we prove instead of SN the stronger property:

(BT)

big trees of terms in AX are well founded.

Together with CR this result easily implies the decidability. Further, as mentioned above, it is also used in the proof of ( 5 ) . In his thesis Nederpelt [Nederpelt 73 (C.3)] stated as a conjecture for his sytem A, the closure property: (8)

Legitimate terms reduce to legitimate terms.

It turns out that B T (for A) implies (8). Further it seems that BT can be proved for A by a method, similar to the one used here. (Note that by contrast (8) for AX is a simple consequence of the formulation of the system and its proof does not require BT.) We feel that, apart from the applications described, BT may have some interest on its own. 1.4. Historical remarks

The first proof of normalization of an Automath system was given in [van Benthem Jutting 71b (C.l)]. Nederpelt (Nederpelt 73 (C.3)] proved strong normalization for his system A. He made two conjectures: the above mentioned closure property for A and CR for the system with 77-reduction. The latter conjecture was proved in [van Daalen 80, (C.5)]. The result is assumed in this paper. Scott [Scott 701 suggested to use the ideas of de Bruijn [de Bruijn 70a (A.2)] for the formalization of an intuitionistic theory of constructions. At about the same time Howard [Howard 801 came up with similar ideas. The line is pursued

R.C. de Vrijer

474

in [Martin-Lof 75aJ. His theory of types is claimed t o be a natural framework for intuitionistic mathematics. The different accents in motivation - Automath more practical, Martin-Lof more philosophical - might be responsible for some of the differences in the investigated systems.

2. The language, expressions In this paragraph we specify the language of a AX-theory. ‘This language is affected by the choice of a base (cf. 3.1). A similarity type (defined below) codes the information, which is relevant for the formation of expressions. Hence for each similarity type s we define the language 12,. 2.1. Alphabet All formal symbols used are from the alphabet consisting of the symbols for variables parameters const ants binary relations

...

2,? 2, I,

P, Q,R, ... C1, Cz, C,, ... and type

=, +, ++, -+, E , (, ), (, ), ,.

and the auxiliary symbols [, 1, Variable symbols will be indexed by types to become (object-) variables, parameter symbols by types and supertypes to become object- and type-parameters, respectively. The set of variables is assumed to be such that whenever needed, we are able to choose uniquely a “new” variable of the desired type, not yet occurring in the context. The enumeration of the constant symbols is meant to show the order in which they can be introduced in a particular interpretation (cf. 1.1.4 and the notions of date and base). In Automath this would be the order in which they appear in a “book” (cf. [ v a n Daalen 73 (A.3)]). 2.2. Similarity type

A similarity type s is a triple (SO,Sl,o), where So and S1 are disjoint sets of natural numbers and o is a function from SOU 51 ’ to (0, l}”,the set of finite (possibly empty) sequences of zeros and ones. Here SOindicates the set of constant symbols used for object-constants, S1 the set of constant symbols used for type-constants and if i E SOU 4 ,then o(i) determines the positions of object- and type-parameters of Ci (cf. 2.3.1 (ii)).


475

2.3. Expressions The expressions fall into three sorts: objects, types and supertypes. These are simultaneously defined in 2.3.1. In the definition we use already the notion of closed expression, to be defined in 2.3.4. However, it is clear that the definitions could have been given simultaneously.

2.3.1. Definition. Given a similarity type s, the sets of variables, parameters, constants, objects, types and supertypes, building together the set E, of expressions is defined by simultaneous induction. If z is a variable symbol, P a parameter symbol, a a type, ,O a closed (cf. 2.3.4) type and p* a closed supertype, then za is a variable, PP is an object-parameter and Po' is a type-parameter. Let o(i)= 61, ...,6, and C1, ...,C, be expressions such that Cj is an object if 6 j = 0 and Cj is a type if 6 j = 1, then Ci(C1, ...,C,) is an object-constant if i E SOand a type-constant if i E S1. Variables, object-parameters and object-constants are atomic objects. Typeparameters and type-constants are atomic types and type is the only atomic supertype. If f and t are objects, a and ,O are types, a* is a supertype and za a variable, then ( t )f and [za: a]t are objects, ( t )p and [xa : a]p are types 0 and ( t )a* and [xa : a]a* are supertypes.

2.3.2. Convent ions As syntactical variables we use C, r, ... for expressions in general, f , g , t , s,... for objects, a,& ... for types and a*,p*,... for supertypes. The symbols for variables, parameters and constants are used themselves as syntactical variables for their respective categories as well. As long as no confusion arises we will freely add and omit indexes. In particular the superscripts of variables and parameters are suppressed where possible, e.g. we write [z : a]z instead of [za: a]za. Vectorial notation is introduced for sequences of expressions; e.g. 3 is short for the sequence a l , ...,an,where the number n is either known or not essential. As = is a symbol of the language, we use = for syntactic equality between expressions. Now follow some more technical and notational definitions concerning expressions.

R.C. de Vrjer

476

2.3.3. Complexity, length and date According to Definition 2.3.1 each expression has a construction, easily seen to be unique, consisting of a finite number of applications of the rules (i) t o (iv). The complexcity c ( C ) of an expression C is the number of steps in its construction. By induction on c ( C ) we define two more measures on C: its length l ( C ) and date d(C). 1(C) = 1 if C is either

a variable, a parameter or t y p e ;

l(C(C1, ...,C,)) = max(l(&), ...,l(C,))

+

+ 1;

l ( ( t )r) = max(l(t), l ( r ) ) 1; l([x : a]r) = max(l(a), l ( I ' ) )

+ 1.

d(type) = o ; d(z*) = d(a); d ( P ) = d ( r ) ; d(C;(&, ...,C,)) = max(i,d(C1), ..., d(C,)) ; d ( ( t )I?) = max(d(t), d ( r ) ); d( [x: a]r) = max(d(a), d ( I ' ) ) . Notice that d ( C ) is the greatest natural number i, such that Ci appears in the construction of C. 2.3.4. Free variables, parameters, special variables By induction of l ( C ) we define the sets FV(C) of free variables and Par@) of parameters of C . FV(type) = 0

; Par(type)

FV(z) = {z}

; Par(x) = 0

FV(P) = 0

; Par(P)={P}

FV(C(C1, ...,C,)) =

U FV(Ci)

=0

; Par(C(C1, ...,C,)) =

i1 :syntactic identity of :A

D.T. van Daalen

494

51 > 2 A 1B

-

one-step-reduction - several, disjoint, redices m a y be contracted in one step : generic form of one-step reduction, e.g. >1 or 31 : more-step reduction, the transitive and reflexive closure of > 1 :A and B are confluent, i.e. have a c o m m o n reduct :definitional equality, the equivalence relation generated by >1 . : disjoint

For each of the above reduction related symbols, subscripts m a y indicate what types of elementary reductions are included, e.g. >l,p or 'PJ. D. Properties :Normalization

N SN CR CRi

property

: Strong normalization property : Church-Rosser property B 5 A 2 C =+ B 1 C :Weak Church-Rosser B I C B 1C ij -PP : ij-postponement A 2ij B =+ 3 c A Li C 2j weak ij-pp :weak ij-postponement A rij B

*

+

3 c ,A~ 2i

c 2j

B

D 5i B .

Properties N, SN, CR and CR1 are also prefixed to indicate what types of elementary reductions are included, e.g. /3-N and Pq-CR.]

11.8. An informal analysis of CRI 8.1. In presence of SN, the weak CR-property CR1 is sufficient for CR. Anyhow, for the heuristics of a CR-proof an analysis of CR1 is indispensable. Let i and j indicate kinds of elementary reduction, such as p, q etc. Let C be a n expression, with an i-redex R c C and a j-redex S C C. By contracting R t o R' (resp. S to S') we get C >l,i r (resp. C > l , j A). We want to find out whether r and A have a common reduct C' and if so, by what kind of and by how many contractions, C' can be reached from r and A. In the informal discussion below all possible cases are systematically treated, according to the relative positions of the redices R and S. The first point is of course, that either (a) R and S are disjoint, (b) R = S , (c) R sub S or (d) S sub R. In case (a), the contractions just commute: 8.2.

C=

r z ...R'...s... > l , j ...R' ...S'... l,i

l,i

r

>1j

C’ Z1,i A

l,i

r = ( A )[Z: B]R’

>l,p

C ’ z R ‘ [ A ]l,i r = (R‘)iZ : B]...Z...x... C’ = ...R’ ...R‘ ... l,i r >l,i I?’ > 1 j C’ l,i I?’ = (Rill,Ri2,) >I+, C‘ R’ I,* (Q, A, B)(p) 1

(0.1

(p=1orp=2).

+

The case of E v. is more complicated. First, there is an additional P-reduction needed. Secondly, there are problems with the type-labels. (E+)

R 3 ([x: B1J( i i ( 0~1, ) ) C) CB ( [ z: B2] ( i 2 ( 0~2, ) ) C ) ,

S (ip(A,0 3 ) ) R ,

R’= C ,

S’= ( A )[ Z : BPI (iP(5,D p ) )C , ( p = 1 or p = 2, z $ FV(C)) ,

(ip(A,&))C

I,+ 5’’

>1,p

(ip(A,Dp[A]))C .

The language theory of Automath, Chapter 11, Section 8 (C.5)

497

So, in this case, r I,+ A >1,p A‘ with I? = A‘ but for the type labels. Hence, without type-labels, C’ = I? = A’ can serve as a common reduct. But with type-labels type-restrictions have to be imposed in order to guarantee that D, [A] and D3 are definitionally equal (and may have a common reduct).

+

8.6. Case (c22) covers p v. 77, 7~ v. u, v. E and p v. E . In the first two cases CR1 holds but for the type-labels. In the third case additional q-contractions are needed (compare with 8.5, E v. +), but in the fourth case CR1 (so CR) simply does not hold at all.

So here, I? = A but for the type-labels. Regarding R v. u,the situation compares with the twincase in 8.4: an additional .rr-reduction is needed.

=

So, r’ 1j,

;for

sl,i.

D.T. va.n Daalen

498 start with 1...j i...i

case a. redices disjoint b. redices equal c. i-redex sub j-redex c l . i-redex non-essential part c l l . j not twin case c12. j twin case c2. i-redex essential part c21. i-redex in intro form

1

j...i

... (*I +

1...j i...j

i , j ...a

r]...P

...

j...i

U*..T

...

E...+

...p (**I

... (**I

P-4

c22. i-redex in eli-form

I d. just like c, with i and j

complete with

T...U

T...

+...E

+, 7, v... (i.e. +, q...)

... P..,.

x x x

interchanged.

Notes to 8.7 and 8.8: (*) Provided there is one defining axiom for each defined constant. (**) But for the type-labels.

8.8. Alternatively, we can arrange our results in a table, according to the kinds of reduction i , j . We write i" for >y,i, the reflexive closure of >l,i. In the first column below one finds values of ( i , j ) . In the second column is indicated by what kind of reductions can be completed (i.e. can be reached a common reduct) if one starts with i...j. complete with j " .,.i"

j' ...i"

(**)

;...;(*I io, jO...io

(**)

io,j'...io i", j"...jo,i"

+", E'...

+O

or ...P

(**)

or

+, r ] , 17..

x x x 11.9. An informal analysis of postponement

9.1. A discussion, similar to the analysis of CR1 in the preceding section, can be devoted to the question of postponement. Let J? contain a j-redex R; by contracting R to R' one gets C. Let C contain an i-redex S; by contracting S one arrives at A.

The language theory of Automath, Chapter

IT, Section 9 (C.5)

499

Essential for ij-postponement is that the j-contraction does not create the i-redex S . Of course, for most of the cases for i , j , essentially new i-redices are indeed created by the j-contractions. E.g., how a ,&redex is created by a n-contraction:

( 4(1.

: BI

c,a ( 1 )

>l,x

( A ).I

:

BI c 3

or by a +-contraction: (ii(a)) ([x : B ] C @ D )

>I,+

( A )[z : B ] C

I

Below we just consider the possibility of ij-PP where i is an 1.E.- and j is an ext-reduction, and the possibility of weak 6j-PP in general. 9.2. Ext-postponement 9.2.1. Let i refer to an 1.E.-reduction and let j refer to an ext-reduction. The

schemes for ext-reduction have a single expression variable as contractum. So R’ is an instance of such an expression variable. If (a) R’ and S are disjoint (in C), or (b) S c R‘ and ( b l ) the expression variable of which R’ is an instance occurs once in the j-redex (so, in fact, j must be 7-reduction), then the i- and the j-contraction can be interchanged. Example of (bl): [X : A] (x)B > I , ~B > l , i

B’

< I , ~[Z

: A] ( x ) B’ l,o

B

>l,i

B‘

l,i and finish with some disjoint j-contractions, compare case (cl) of the CR1-analysis. Example:

( R )[X : B]...x...x...

>1,j

...R‘...R’... Z1,j ...R...R...

(R’)[ X : B ]...X . ..x... >1,p 1,E

(il(.)) [YI C ) @ ([I.

(i2(.))

[?I1 C))

( 4 [YI c >l,P C[AI .

Indeed, in all but the last case, the i-redex is not essentially new: (T,T (i.e. > I , ~ > I , ~ can ) be simulated by T , T ; v,P by P,P; E , by +,PI and v, by P, But PE-PP (so (~+)-E-PP) is false.

+

+.

+

+

9.2.4. We resume the results of this sections in a table

simulate by case

(b2)

(cl)

P,77 P,v

(a)

-

P,ii

+,v

+,7)

-

+,vo

r,v

r,77

-

T,VO

010

+,E

-

T,E

-

T,T,E

T,E

PIE

-

P,P,E

P,Z

+,c7

T,U

(*)

(bl)

PIPlO

+,+,u

P,Z +,(To

T1X,U

7r,(To

+,+,E

+,EO

Assuming certain type restrictions.

9.3. Weak &advancement 9.3.1. Since the presence of b-redices is only dependent on the presence of defined constants, apparently no essentially new b-redices are created by the other reductions. However, we can only hope for weak &advancement (i.e. weak 6j-PP for all kinds of reductions j , distinct from 6) in view of the PG-example:

( d ( E ) )[Z : A]...z...~...>1,p ...a!(,!?)...d(,!?)...

>1,6

...D [E]...42)...

The language theory of Automath, Chapter 11, Section 10 (C.5)

501

where d(y3 := D is the defining axiom of d. If we start with >I,& here, then possibly too many &redices are contracted. Actually, the situation compares very well with the situation with the twin reductions w.r.t. CR1.

9.3.2. Let r, C, A, R, R‘, S be as in 9.1. R is an arbitrary non-&redex, S is a &redex d(@ (defining axiom as above, say). If (a) R’ and S are disjoint in C then the contractions can be interchanged:

r=...R...S...

>l,j

...R’ ...S’...

...R‘ ...S... >I,& ...R...S’...

+,j

If (b) R’ sub S , then R‘ 51,j.Example:

C

l,j>1,6

by

>1,6

d(R) >1,j d(R’) >I,&

...R’ ...R’ ... 71,j ...R...R...

I,& ...F [A]...F [A]...

( A )[ X : B]...F...F...

1,p

C

>1,6

A 31,6 A’

C or C

> B)

525

j

A q C.

Note: This is indeed the most restricted version of Q. see Sec. 1.2. 2.6. The strengthening rule This is a technical rule, which we use in the proof of q-CL, but afterwards, i.e. after having proved CL and (with help of CL) CR, as in Sec. 1.6, prove superfluous. It is called strengthening rule because it permits to remove assumptions from the context. We say that q is a subcontext of B', Fi+' ( A ) B, ki+' (A') B'. It is no restriction to assume that both ( A ) B and (A') B' originate from the extended application rule of 2.16.1: A E a, A' E a', B E c1 E ... E cl E [z : a]D,B' E ci E ... E E [z : a']D' with degree(D) = degree(D') = k and 1 = 1'. Then by the ind. hyp. we have B' E C1, so by UTi+l C1 q Ci and by LQi Ci E (32. Then follows C2 q Cl and C; E C3 etc. Finally we have [z : a ] D p [z : &'ID'and by UDk a a' so A' E a. Hence {A') B' E (A')C1 < ( A )C1, so (A') B' E ( A ) C1, q.e.d. From PT;" and UT*+' we get LQi+', and UTi+2. So by induction, we get PT1, LQ, (*) and UT.

c;,

3.1.6. It is clear that SAi++' can be distilled from the proof of PTi+', but it can alternatively be given as follows. First, we have LQi+l U D ~

,

mi++'

so we have UD. Now let k*+' ( A ) [z : B]C. Then (see Sec. 2.15.2) either A E a , [z : B]C E [z : a]D,or [z : B]C E E , k ( A )E . Further [z : B]C E [z : B]F . So by UT we have Q B, or by (*) we have k ( A ) [z : B]F . So from LQ, UD and UT we get SAi 3 SAi+l

and by induction SA.

3.2. Closure for Pv-AUT-QE 3.2.1. For definiteness we present a rather detailed version of our closure proof here for Pq-AUT-QE, i.e. AUT-QE without definitional constants and without &reduction. So the admitted degrees are 1, 2 and 3, the value degrees are 1, 2 and 3, the domain degree is 2 and the argument degree is 3. The function degrees are just 2 and 3, so &-AUT-QE is a non-+-language. So the reasoning of Sec. 3.1.5 is valid, but for additional problems due t o the presence of type-inclusion (viz. that UT is not true and that not immediately (PT1 j LQ) and (UD =+ EUD)). These problems are overcome by the introduction of a "canonical type" in Sec. 3.2.4 below. This canonical type also plays a role in the 0-case of PT1. Later we include definitional constants and &reduction, and application expressions of degree 1, thus extending our result to Pq6-AUT-QEf (in Section 3.3). A closure proof of &-AUT-68 can easily be imitated from the proof below and is in fact somewhat easier because there is no type-inclusion.

D.T. van Daalen

538

3.2.2. We specify a set of rules (in shorthand, omitting contexts) for Pq-AUTQE, which according to the properties in 2.10-2.15 are equivalent t o the rules indicated previously. I-T

... , z E a , ... k z (Ea) z E a I- A (EB)

* I-

[z : a ] A ( E [z : a ] B )

+ I-

A E a, k 2 B E [ z : cy]C AE

(Y,

BE

( A ) B( E C [ A ] )

c E [z : a10 * I-

A E z[d,.'E z * p(.')

( A )B (E ( A )C )

E P is a scheme

(Wd)

I- P ( 4

* AEC

AEBcC I- A, A

> B or B > A, I- B + A B

+

AqBqC

+

(where > is 51,i.e. disjoint one step Pq-reduction)

AqC

A q B =s A c B I-'A =+ A C T z E a I-

A

C

B =+

AcBcC

[[z : a ] A1[z : a ] B

AcC

strengthening.

On 1-expressions and type-inclusion 3.2.3.1. Since there are no 1-application expressions and no definitional constants all 1-expressions are of the form '.[ : ZIT, with .'possibly empty. And, if I-' [z : &]A,I-' [z : P]B, [z : a ] A > [z : BIB, then a > P, A > B so cy q P and z E a I- A 9 B. So, by induction on 9, we can show UD'

l - ' [ z : a ] A p [ z : P ] B+ a q p

(andzEat-AqB).

Then, by induction on C, we get I-'[. : a ] Ac [z : P]B

*a

P

(and z E a I- A C B )

I

3.2.3.2. We introduced UTi, uniqueness of types for expressions of degree i (i > 11,

The language theory of Automath, Chapter V (C.5)

UT~

P A E B A,

*

EC

539

BQC.

For i = 3 this will be proved below, but for i = 2 it is simply false in view of type-inclusion. Now we define

B 0 C : e BcCorCcB. Below we shall prove that the new symbol covers the relationship between B and C whenever A E B and A E C. Clearly on the non-1-expressions 0 is just Q. We have k1[z:a]A0[z:P]B

aQP,

(zEakAOB).

Further 0 satisfies a strengthening rule, and is substitutive: AEQ, z E a k B O C

+

B[A]OC[A].

3.2.3.3. We also want to show

FIBoC

@

forsomeA, A c B a n d A c C .

Proof. + is trivial. So let B I1 A C C. Then A = [t: 71 [y’ : [Z : Z]T, h’= [.?: 711 [y’: C = [.?: 721. (or similar with B and interchanged), with 0 “7 Q T~ Q 72”, Y E 7 F Q f i l , l . SO B c c (or c c B ) .

B~]T,

c

B

3.2.4. The canonical type 3.2.4.1. It is possible, for each A with ki+’ A to indicate a n (1)

is a minimal representative - w.r.t. IT - of the categories of A, i.e. A E QO and: (A E Q + QO C a)

(2)

FV(a0) c FV(A)

QO

such that

a0

.

We call this (YO the c a n t y p of A (with respect t o a context). The definition of c a n t y p is like the definition of t y p in [van Daalen 80, Sec. IV.3.21 [ t y p is like c a n t y p but with rule (iv) for B of all degrees, and without rule (v)], but slightly modified in order t o stay in the correct fragment, as follows:

= tYP(.)

(i)

CantYPb)

(ii)

CantYP(P(4) = tYP(P”1

(iii)

cantyp([z : o ] B )= [z : a ] c a n t y p ( B ) - w.r.t. to extended context

(iv)

cantyp((A) B ) = (A) c a n t y p ( B ) if degree ( B )= 3

(v)

cantyp((A) B ) = C [ A ]if degree ( B )= 2 and c a n t y p ( B ) = [z : Q]C.

-

D.T. va,n Daalen

540

Clearly, typ(A) 2 cantyp(A) so property (2) above is immediate. Now we prove a lemma corresponding to property (1). Lemma. If LQ' and I-'+' A E a then A E cantyp(A) C a. 3.2.4.2.

Proof. By induction on the length of A. The more interesting cases are (i)

A = [z : crl]Al, z E a1 I- A1 E 0 2 , [z : al]a2 c a. By the ind. hyp., z E 01 I- A1 E cantyp(A1) C C Y ~ ,SO [Z : a l ] A E [Z : 011 c a t y p ( A 1 ) cantyp(A) c [z : a1Jcr2I I a,q.e.d.

(ii) A = (Al) A2, A1 E a1, I-2 A2 E [z : al]C, C[A1] C a. By the ind. hyp., A2 E cantyp(A2) c [z : al]C so cantyp(A2) s [z : ai]C'. Hence cantyp(A) is indeed defined, a1 0 a;, z E a1 I- C' C C, so (Al) A2 E C'[Al] C a, q.e.d. (iii) A = (Al) Az, A1 E 01, F3A2 E B E [z : al]C, (Al) B 0 a. By the ind. hyp. A2 E cantyp(A2) Q B. By Lq* we can use property (*') of Sec. 3.1.5 and 0 get cantyp(A) 9 ( A l )B 9 a , q.e.d. 3.2.4.3. Corollary.

(a)

I-'A E B, A E C =+ B O C (this is, for A of degree 2, the desired property of 0 ) .

(ii) k 2 [x : a ] A E [x : P]B =+ a Q p,

2 E

cr I- A E B (this includes EUD2).

(iii) S A ~ . Proof. (i) LQ1 is vacuously fulfilled, so B 7 cantyp(A) c C, so by 3.2.3.3 0 B 0 C. (ii) and (iii) are immediate. 3.2.5.1. Now that we have introduced cantyp we can use it in the proof of PT. We define the property of preservation of cantyp.

PCT'

!-'A,

A 2 A'

,

I- A' =+ cantyp(A)

cantyp(A')

.

Similarly PCT';; PCT is the conjunction of all the PCTi. We first prove some lemmas for PCT2. 3.2.5.2. Lemma (substitution lemma for cantyp): Let B* stand for B[x/A]. Then z E a , $ E /? I-2 C, k3 A E a cantyp(C)* cantyp(C*) where the cantyp's are taken w.r.t. (z E a,$E $) and ($E p't) resp.

=

Proof. Induction on C. Note that C f z, because degree(z) = 3. Some cases are:


54 1

= [z : C1]C2, cantyp(C)* = [z : C;]cantyp(Cz)* (w.r.t. z E a , y ’ p, ~ z E c 1 ) E (by ind. hyp.) [ z : cr]cantyp(Cz) (w.r.t. a E p*,z E c;) -a

(i) C

G

cantyp(C*), q.e.d. (ii) C

=

(Cl)C2, cantyp(C)’

=

D[Cl]*= D*[Cr] where cantyp(C2) = cantyp(C,’), so cantyp(C*)

=

[ z : 710 and, by ind. hyp., [ z : 7*]D*

=

D*[C;] as well, q.e.d.

0

3.2.5.3. Corollary. z E a k2 C, k3A E a

*

cantyp(C)[A] = cantyp(C[A]). 0

3.2.5.4. Corollary (p-PCT;): CantYP(C[Al).

k2 (A) [z : B] C

+-

cantyp((A) [z : B] C)

Proof. By SA2 we have A E B, so even cantyp( (A) [z : B]C) G cantyp(C)[A] = 0 c U t Y P(C [A1). 3.2.5.5. Lemma (Q-PCT:): k2[z : a](.) A , z $! FV(A) =+ cantyp([z : a](.) A)

cantyp(A)

.

Proof. Let cantyp(A) = [y : p]D and let k2 [z : a](.) A be based upon z E a’, A E [y : a’]D’. By 3.2.4.2 [y : p]D c [y : &’ID‘ and z $2 FV([y : BID), so a Q a‘ Q p and cantyp(A) = [z : p]D[y/z] Q [z : a]D[y/z] = cantyp([z : a](z)A). 0 3.2.5.6. Theorem. PCT:.

Proof. Let I-2 A, I- A’, A > A’. For a main reduction use 3.2.5.4 or 3.2.5.5. For inside reductions use induction on the length of A. Some cases are:

=

[z: A’,]A;, A1 > A;, A2 > A;. By ind. hyp. (i) A G [z : AlIA2, A’ cantyp([z : A1]A2) Q c m t y p ( [ z : AlIA’,) = [z : Al) cantyp(A;) Q [z : A:] cantyp(Ak), by the substitution property 3.2.5.3.

= (Al) A2, A’ = (A;)

A;, A1 > A‘,, A2 > A;. Since (Al) A2 is correct, A1 E a1,A2 E cantyp(A2) = [z : PIC C [z : a l ] D . So a1 Q p. Similarly A’, E a’,, A; E cantyp(A;) = [z : p’]C’ C [z : a’,]D’. So a{ Q p’. By the 0 ind. hyp. [z : PIC [z : p’]C’, so C[Al] Q C’[Al] Q C’[A’,], q.e.d.

(ii) A

D.T. van Daalen

542

3.2.5.7. Corollary. (i)

PT?,

(ii) Lq2, (iii) U D ~ .

0

3.2.6.1. By Lq2 we can apply 3.2.4.2 to expressions of degree 3 now. We get: (i)

F3A E a

+

A E cantyp(A) Q

0.

(ii) UT3 : k 3 A E a , A E p + a O p (i.e. a Q of 0 for A of degree 3).

p) (this is the announced property

(iii) SA3 (e.g. as in 3.1.6). Notice that by UT3 the properties PCT3 and PT3 are equivalent.

3.2.6.2. We introduce CLPTZ: FiA(Ea) , A 2 A’

+ FiA’(Ea)

and similarly CLPT!. Here follow some lemmas for CLPT;.

3.2.6.3. Lemma (PLCLPTB): k3(A) [z : B]C E D

+

C[A] E D.

Proof. Let A E a, [z : B] C E F E [z : a ] G , (A) F Q D , and let z E B I- c E H. [z : B]H F . By SA3 we have A E B and by (*’) (A) [z : B] H Q (A) F . By 0 the substitution theorem for correctness C[A] E H[A] Q D.

3.2.6.4. Lemma (vLCLPT7): F3[z : a](.) A E B , z @ FV(A)

+

A E B.

Proof. cantyp([z : 0](z) A) G [z : a](.) cantyp(A) Q cantyp(A) (by 77-re0 duction), by strengthening I- A, so by 3.2.6.1 A E B.

3.2.6.5. Now we are ready for CLPT. Theorem (CLPT1) : I- A ( E ~ )A, > A’

+ I- A ‘ ( E ~ ) .

Proof. If A > A’ is a main reduction use SA, strengthening, PT2 and the preceding two lemmas. Otherwise use induction on the length of A. (i)

A = [z : al]A1, A’ = [z : a:]Ai, a1 > a:, A1 > A;, 2 E a1 I- A 1 ( ~ a 2 ) , ([z: a1102 c a ) . By ind. hyp. I- a: and z E a; I- A ~ ( E ~ Y ~ ) . So I- [z : a’,]A’, (E[z : ai]a2 Q [x : al]a2 C a ) - read this twice, one time with and one time without the symbols in parentheses -.


543

(ii) A = (Al)Az, A’ = (A;)Ai, A1 > A;, AZ > A;, Al E a1, A2 E [z : a l ] C , C[A] c a. By ind. hyp. A: E 011, A; E [x : al]C. So A’ E C[A{]Q C[Al].

(iii) As in (ii), but A2 E B E [z : al]C, ( A l )B C a. By ind. hyp. A’, E q , Ah E B , SO A’ E (A:) B Q ( A * )B. (iv) A = p(B1, ...,B k ) , A’ = p(Bi ,...,B i ) , 2 > I?’, B1 E P I , Bz E Pz[B1],..., Bk E Pk[Bl,...,Bk-11, P [ B ]c a, where y ’ E p’ * p(y’) E P is a scheme. By ind. hyp. B; E P i , Bi E P2[B1]9 P2[B:],...,Bk E P k [g1Q Pk[g’], so 0 p ( B i , ...,Bk) E P [ B { ..., , B;] Q P [ g ] .

3.2.6.6. Corollary. (i)

CLPT,

(ii) LQ, (iii) UD.

0

3.2.6.7. Corollary (Rule V . 2 , See. 2.11): F A , F B , A J. B

+

A 9 B.

0

3.3. Extension to Pr&AUT-QE+ 3.3.1. Now we consider P$-AUT-QE+, i.e. Pq-AUT-QE extended with 1application expressions, with definitional constants and with definitional reduction. The additional rules are 1.3

A E ~ F, I B Q [ z : a ] C +I-’(A)B

(vi’)

A E a[A],2 E 3 * d ( 2 )

:= d($) := D(E E ) is a scheme =+

k d(A)(EE [ A ] )

(cf. Sec. 3.2.2 and Sec. 2.3 respectively). If we try to repeat the previously given proof, we first come in trouble because not all the compound 1-expressions are abstraction expressions anymore. This makes the proof of UD1 from Sec. 3.2.3 fail, though the property itself remains valid. Furthermore there is the problem with definitional 2-constants and typeinclusion (mentioned in Sec. 1.7), which makes Lq2 fail. Below we give an indirect proof instead which runs as follows: first we show (Secs. 3.3.3-3.3.8) that the indicated extension is a so-called unessential extension. Then we use this fact to transfer the desired properties from Pq-AUT-QE t o the new system (Sec. 3.3.9). Finally (in Sec. 3.3.11) we briefly discuss an even larger system than AUT-QE+, which we call AUT-QE*.

D.T. van Daalen

544

3.3.2. Some terminology Consider two systems of correct expressions with typing and equality relation, (k, E, Q ) and (k+,E+, Q+) respectively. (F+, E+, Q+) is an extension of (k,E,Q) if t- =% k+, E + E+ and Q =% Q+, i.e.:

B -I resp. B;E

I- resp.

B;[ I- A

(E/Q

B)

+

B k+ resp. B; [ k+ resp. B;E k+ (E+/Q+ B ) . We further just write t-+ A E/Q B instead of k+ A E+/Q+ B. The “new” system k+ is said to be conservative over the “old” system k if all new facts about old objects are old facts, i.e. if UEO

F A , I- B , k + A E/Q B + t - A E/Q B .

An extension is unessential if no “essentially new” objects are formed, i.e. if all new objects are equal t o old ones. This means that the new system can be translated into the old one by a mapping-, working on expressions, books and contexts, such that

+k+AqA-

t-+A

UE2

B I-+ resp. B;[ I-+ resp. B;[ I-+ A + B- k resp. B-; [- I- resp. B-;[- I- A-

UE3

B;[k+ A

E/Q

B

+

and k A

+

UE1

B-;[- F A -

A=A-

E/Q

B- .

Clearly unessential extensions are conservative. Property U E 3 means that new formulas inply their old counterparts. Unessential extensions also satisfying UE3/, the converse of UE3, UE3’

+ + A , F+B, t - A - E / Q B -

+~+AE/QB

are called definitional extensions. In a definitional extension new formulas are equivalent to old ones. All unessential extensions satisfy the Q-part of UE3’, but for the E-part we need property LQ for the larger system (at least if the smaller system satisfies LQ). For that matter, if the +-system satisfies LQ, we have UE1,UEZ

UE3’

and: UEO,UEl,UE2

+ UE3 ,

3.3.3. The translation Of course, we take Pg-AUT-QE for our smaller system I- and we take Pqb-AUT-QE+ as the extension k+. We are going to prove that k+ is a n unessential (but not a definitional) extension.


545

For an expression A we intend its translation A- to be the normal form w.r.t. a certain reduction relation In order to make A- well-defined and in view of UE1, UE2 we require

>-.

(0) 2- normalizes and satisfies CR. (1) 2- just affects the new elements of expressions (1-application parts and definitional constants) and removes them.

(2) 2- is part of the reduction relation of the new system and satisfies CLPT.

:. Notice that for degreecorrect A the degree of A' above is j as well (cf. Sec. 2.7). Now, in view of requirement (1) above, we define 2- to be the reduction relation generated from 2; and 2 6 .

--SN and >--CR (whence requirement (0)above). Clearly >--normal forms d o not contain defined constants anymore; a simple normability argument shows that removes the 1-application parts as well.

>-

3.3.5. A further property we want 2.- to satisfy is CLPT. Since 6-CLPT1 follows from the simultaneous substitution theorem (cf. 2.9.4) we just want to know SA1 -I:

( A ) [z : B] C

+ I-+

AEB

or, equivalently, U D ~ [z : B]

c Q [z : a]D + k+ B Q a .

Here turn up the problems with 1-expressions, announced in 3.3.1. To overcome these we seemingly modify our system:

D.T. van Daalen

546 (1) We exclude ql-reduction. (2) We change our 1-application rule into

1.3’

A E a , F I B red- [ z : a ] C

+ k!+(A)B

where red- is 2- restricted to the correct expressions, i.e. generated by

t-+A, F + A ’ , (A

>b

A’orA

>6

A’) + F + A r e d - A ‘ .

Clearly 1.3 1.3’, so the modification is a restriction. However, after having proved >--CLPT (whence UE1, see Sec. 3.3.6), UE2 and UE3 (Sec. 3.3.7) for the modified version, we shall be able to show that both 1.3 and $-equality: t-+ A, A >: A’, F+A’ + F + A A’ are derived rules. Hence the two versions of F+ are equivalent, and we have the desired properties for the original +-system.

3.3.6.1. For the modified system the property SA’ is clear, so we have the theorem (2- -CLPT): F + A (Ea),A 2- A’ + F+A’ (Ea).

>b

Proof. Since we know b-CLPT, and is just [i.e. identity] on the non-lexpressions we only need to consider A of degree 1. Use, e.g., a double induction, viz.

(1) on O-(A) - i.e. the length of the >--reduction tree of A, (2) on length(A). The only interesting case is when A = (Al) AS, A1 E a , A2 red- [z : a]C. If A1 2- A’, then A1 >6 A‘, so by 6 - CLPT A’, E a. If A2 Ah then by the ind. -CR A’, red-[z : a‘]C’, [z : a ] C red-[z : A’IC’. So A: E a’ hyp. and by and t-+ (A’,) A;. If A2 = [z : As]A4 then A1 E A3 (this is SA1) and t-+Aq[Al]. Since a reduction A 2 A’ starts with an inside or with an outside reduction, we are finished by the first ind. hypothesis.

>

>-

3.3.6.2. Corollary (UEI): F + A

+ F+A 9 A-.

0

3.3.7. Theorem (UE2 and UE3): Consider the system without 77’ and with rule I . 9 . Then

B t-+, resp. B ; [ t-+, resp. B;[F+ A ( E / Q B )

+

B- F, resp. B-; [- I-, resp. B-; [- F A - ( E / QB - ) . Proof. By induction on F+, using >--CLPT.

The interesting rules are :

The language theory of Automath, Chapter V ((2.5)

(i)

547

Appl. rule 1.3‘: let E+ A E a , E+ B red- [z : a]C. By ind. hyp. t- A- E a-. Clearly B- = [z : a-]C- and by ind. hyp. E B - , so 2 E a- I- C - , so I- ((A) B ) - = C-[A-], q.e.d.

(ii) Instantiation rule (vi’): let B contain a scheme y’E fi * d(y’) := D (possibly followed by *d(y’) E C). Let B1 be the book preceding this scheme. By ind. hyp. B;;y’Ep’- I- D-(EC-). Now if B ; < E dEfi[g],then by ind. hyp. B-;,$- E B’- E (p’[l?])[k], so B-; C. By ind. hyp. E A- B-, E C.Since 2- commutes with all other reductions, except possibly $ which we have forbidden, we find B- 2 C- so by CL for pq-AUT-QE I- B- C- and I- A- C - , q.e.d. The case that C > B instead is completely similar. 0

3.3.8.1. Now we prove that 1.3 is a derived rule in the modified system. So assume I-+A E a , I - i B [z : a]C.By 3.3.7 E’B[z : a-]C-, whence B- must p and k+ a p. Further, by 3.3.6.1, I-+B red- Bbe [z : P]Bl with I- aand by 1.3’ E+ (A) B, q.e.d. 3.3.8.2. Similarly, $-equality is a derived rule. Let E+ A, I-+A’, A >: A’. We can assume that degree(A) = 1. By induction on length(A) we prove that k+ A A’. The interesting case is when A = [z : 0111 (z) A’, z $! FV(A’). As in 3.3.8.1, z E 011 I-+ A’ r e d - [ z : a2]Al with z $! FV(a2). By SA1 z E a1 I-+ a1 q a2 and by strengthening I-+a1 9 012. So E+ A q [z : (~1]A1 q [z : az]Al q A‘, q.e.d. 3.3.8.3. Hence the system with 1.3 and 7’-equality is equivalent to the system with 1.3’ and without ql-equality. So we have SA1, >_--CLPT, UE1, UE2 and UE3 for the original system of ,L?r&AUT-QE+ now. 3.3.9. The proof of CLPT 3.3.9.1. As in 3.2.6.5, we can prove CLPTl from outside-CLPT1, by induction on correctness. Clearly 6-CLPT (and a fortiori 6-outside-CLPT1) is included in >--CLPT, so we just need p- and q-outside-CLPT1. In the next section we infer PT3 and SA from our UE-result, which leaves us to prove the p2- and q2-case of outside-PT1 only. These two cases are dealt with in 3.3.9.3.

3.3.9.2. Consider the properties mentioned in 3.1.5. In this section we distinguish the two versions of a property (viz. for the smaller and the larger system)

D.T. van Daalen

548

by providing the latter with a UTg

+ below. It is clear that +

UTft and UTft,PTi

whence UT,:

LQft

.

PT; and LQ$

The property UD is also preserved in passing to the larger system, and in fact, as in 3.2.3.1, k + [ ~a :] A Q [z:P]B

+ k + a Q P,(xE a F + A Q B ) .

By LQ: we have (*;). SA: we knew already. Now we show SA!+ for i # 1: let (A) [I : B]C. Since i # 1, ((A) [z : B]C)- = (A-) [z : B-]C-, so by UE2, I-' (A-) [z : B-]C- and by SA, F A- E B-. Hence by LQ; again, we have SA!+ for i # 1 as well. 3.3.9.3. In Sec. 3.2.5 we used c a n t y p in proving P- and q-outside-PT?. The same procedure applies in the +-system, but with t y p [see 3.2.41 instead of c a n t y p now. In particular we have

ii')

typ(d(/i))

E typ(d)[Af

for defined constants of degree 2 and 3 now, and (i.1

tYP((A) B ) = (A) tYP(B)

for both B of degree 2 and 3.

As in 3.2.4.2 we get I-:A

Ea

+ F + A E typ(A) C a

and, as in 3.2.5.2, k: A E a , (z E

IY

I-' C)

+ typ(C[A]) G typ(C)[A] .

So, as in 3.2.5.4 and 3.2.5.5, we get I-?(A) [z : B1

c*

whence P-outside-PT:,,,

and

k i [z : a I ( 4 A ,

whence q-outside-PT:,,

tyP((A) [z : B1 c)Q tyP(C[Al)

@ FV(A)

* ~ Y P ( [ Z: a I ( 4 A) 9 typ(A)

.

3.3.10.1. In 3.3.9.2 we have carefully avoided the properties which do not hold in the larger system, in particular LQ2 and (*'). For a counterexample


549

let d ( z ) be defined by z E 7 * d ( z ) := [y : 212, with typ(d) = 7. If a E 7 , then d ( a ) Q [y : a]a E [y : a]7,but certainly not d ( a ) E [y : a]7,so not LQ2. If, furthermore, A E a , then I- (A) [y : a]a but not I- (A)d(a), whence not (*'). Consequently, the +-system is not a definitional extension of the old system.

3.3.10.2. Besides, if we stick t o our counterexample, z E d ( a ) I- t E [y : a]a,so z E d ( a ) k (A) z E a, but not z E d ( a ) I- (A) d ( a ) (= t y p ( ( A ) z ) ) . This shows that t y p applied t o 3-expressions can lead us out of the correct expressions (in contrast with the situation in the smaller system), and that not:

F3A

+

A E typ(A)

.

3.3.10.3. In the next section we restore (*) and LQ2 by a further extension of the 1anguage.But first we give a theorem stating some very weak versions of LQ2 to hold in P$-AUT-QE+ instead of LQ'. Recall the symbol 0 from Sec. 3.2.3 and the result (Sec. 3.2.4.3, 3.2.6.1) for Pq-AUT-QE:

I-AEB, I-AEC =sI-BDC. Theorem. Let

~ + A E B I,- + C E D , I - A q C . Then

I - + A E D or I - + C E B . Proof. By UE we get I- A- E B-, I- C- E D - , I- AQE we get I-C- E B- SO I- B- 0 D-, sok+B Q Bi.e. B c D or D c B, q.e.d.

Q

0

C-. By LQ for Pq-AUTD- Q D , i.e. F + B o D , 0

3.3.11.1. The aforementioned anomalies can partially be removed by properly extending PoG-AUT-QE+ to a language P@-AUT-QE*. In this new system we first replace the application rules by [z : a]C, A E a =+ I- (A) B

(1)

B

(2)

B E C, k (A) C =+ I- (A) B E (A) C

Rule (1) is simply 1.3 (Sec. 2.3) without the restriction to degree 1. Rule (2) is III.3.B' (Sec. 2.15). So, indeed, AUT-QE* extends AUT-QE+.

3.3.11.2. By this modification we gain the property k3A =s I- typ(A)

, so it is a proper extension .

Furthermore, by 0-reduction we get

D.T. van Daalen

550

B E [z : a]C

+

B

[z : a ] ( z B )

, which yields property (*)

for the new system. Our counterexample, however, shows that there are still problems: LQ2 does not hold, so we do not yet have a definitional extension of AUT-QE. Besides, now the new 2-expressions (e.g. ( A )d(a) in the example, which is correct now) do not have a correct t y p l and not even an E-formula.

3.3.11.3. The following theorem shows that the difference between AUT-QE+ and AUT-QE* just lies in the particular role of the definitional 2-constants, and that AUT-QE* is an unessential extension of AUT-QE+ (though it is no definitional extension). Theorem. Let t-* stand for correctness in AUT-QE*, and let A’ be the b2normal form of A . Then I-* A(E/QB ) t-+ A’(E/QB‘)(so I- A-(E/Q El-)).

*

Proof. Induction on I-*.

0

3.3.11.4. A drastic way of combining 2-constants with type-inclusion and still preserve LQ, is to add LQ explicitly to the language definition, or at least something like k2A, C E B , A r Z C

*

AEB.

Adding this rule to P@-AUT-QE+ produces the smallest definitional extension of AUT-QE which includes P@-AUT-QE+, and it gives us AUT-QE* plus all the missing E-formulas. An alternative way of defining this new system (we still call it AUT-QE*) is by ignoring the type-assignment part of definitional 2-schemes, and by defining the t y p of a definitional 2-constant to be the t y p of its definiens (compare the way norms have to be introduced for AUT-QE, [van Daalen 80, Ch. IV.4.41). From the latter definition of this new system it will be clear that our desirable properties (except UT2, of course) can be proved for it by the same methods as used in the closure proof of AUT-QE+.

3.3.12.1. Up till now we have, for definiteness, just compared Pv-AUT-QE with P@AUT-QE+ (and P@-AUT-QE*), i.e. we made the extension in one step and added the definitional constants and the 1-appl-expressions simultaneously. One can as well, of course, consider intermediate languages like Pq-AUT-QE+ and Pqb- AUT-QE. Then one notices that the problems with (*), LQ2 and t y p are exclusively due to the 6 (in particular b 2 ) and not to the in P$-AUT-QE+. Thus Pq-AUTQE+ satisfies LQ and (*), and is a neat definitional extension of PO-AUT-QE, whereas P$-AUT-QE has all the unpleasant features of PT&AUT-QE+. In

+


551

fact, PgG-AUT-QE+ is a definitional extension of PgG-AUT-QE, and PgG-AUTQE can only be made into a definitional extension of Pg-AUT-QE (call this new system from now on AUT-QE‘) by adding a rule like in Sec. 3.3.11.4.

3.3.12.2. If one takes AUT-68 instead and adds an application rule: AECI,

[ z : a l c Q B E+ ~ (A)BET

(compare 3.3.11.1, rule (1)) one gets the corresponding +-language (i.e. smallest value degree = smallest function degree), AUT-68+. These systems are easier to handle than AUT-QE: both AUT-68 and AUT-68+ satisfy UT, LQ and (*), even in the presence of definitional constants, and AUT-68+ is a definitional extension of AUT-68. Without definitional constants, AUT-68+ is already contained in AUT-QE, but PgG-AUT-68+ is not contained in Pg6-AUT-QE. It is contained, though, in the system AUT-QE’ of 3.3.12.1. Closure for AUT-68+ can, e.g., be proved by the methods of the next section (see 3.4.5).

3.4. Some easier closure proofs (for simpler languages) 3.4.1. There are various ways of proving closure for simpler languages, such as Pq-AUT-68 or PG-AUT-QE. First, one can take the closure proof of the previous sections and adapt it to the language under consideration. Since g-reduction, type-inclusion and liberal degree specification (in particular for function degree) are responsible for many technical details in the proof, the simpler languages allow some obvious simplifications. E.g. if a language lacks q-reduction we can clearly skip the g-closure part and, besides, we can freely use CR. Or, if a language has more restricted function degrees (AUT-68 vs. AUT-QE, non-+-languages vs. +-languages), we have to push SA, LQ, UD etc. through less degree levels. And, if a language lacks type-inclusion (AUT-68 and Nederpelt’s A), we simply have PT + LQ, and do not need to introduce something like cantyp for this purpose. A second approach is suggested by the fact that our language definition contains some technicalities which are only introduced to make the closure proof (i.e. this kind of closure proof, for a complicated language like Pg-AUT-QE) possible. In particular, I intend the use of the restricted Q-rule V.2 instead of the more liberal V.2’, i.e. the use of the restricted system type I, instead of the liberal system type I1 (see Sec. 1.2). Recall that after having proved closure for I, I and I1 can be proved t o be equivalent, and that, after all, we are more interested in system I1 than in system I. Now it turns out that, for the simpler languages, the modifications in the language definition (and the detour via system I) are superfluous, and that we can give a direct closure proof for a type I1 language definition.

D.T. van Daalen

552

Such direct closure proofs are presented below for all the regular languages which either lack 7-reduction, or have just function degree 3: p(b)-AUT-68(+), P(G)-AUT-QE(+) and PQ-AUT-68. A mere sketch is given for Pq(G)-AUT-68+ (for the definition of AUT-68+ see Sec. 3.3.12). 3.4.2. So we give these languages by a n E-definition with 9-rule

A Q B , B J C , I-C

V.2'

+

AqC

which a priori is stronger than V.2 but later turns out to be equivalent. The properties in Secs. 2.9, 2.10 such as the substitution theorem, correctness of categories, and the property: a of domain degree, A of value degree, z E a I- A ($ F [z : a ] A simply go through. As in Sec. 3.1, we essentially just need SA for proving closure. So below we confine ourselves to SA and, in connection with this, UD for the various languages. We start with the 17-less languages. 3.4.3.1. Theorem. UD for V-less languages.

Proof. Let [z : a ] B [z : PIC. Then by CR, [z : a ] B 1 [z : PIC so a B 1C, whence a 9 P and z E a I- B 9 C.

1P

and 0

3.4.3.2. Corollary. SA' for P ( b ) - A UT-QE+, SA2 for P ( b ) - AUT-68+.

Proof. Let A E a,[z : B] C 9 [z : a ] D . Then B p a so A E B.

0

Let c be defined as in Sec. 2.14. We need a lemma. I- F C G, G 2 [Z: 40 s-F 2 [ Z : G]C with Id1 = lpl and 6 1 b (2.e. a1 1 PI, a2 1 P2, 3.4.3.3.

etc.).

Proof. Induction on

c.

0

3.4.3.4. Corollary. SA2 for P(b)-A UT-QE(+), SA3 for O(b)-AUT-68(+).

Proof. Let A E a,[z : B] C E [z : cr]D. Then [z : B ] c E [z : B] F So by the previous lemma B 9 cr and A E B .

C [Z: a ] D .

0

Now in order to get SA3 for P-AUT-QE(+) we need a lemma again. Notice that the proof of this lemma fails when there are definitional constants. Lemma. I - ~ A E B B , ~ [ z ' : ~ D , A > [ z I:G~I = cI @, I ZJB. 3.4.3.5.

Proof. Induction on the length of A. The interesting cases are: (1) A

[XI

: al]A1, A1

[ ~ :1 P i ] [&

:

2 [&

,&ID, IS21 =

:

&]C,

I- A1 E B1, [ x i : al]B1 C B 2 E 3.4.3.3 0 1 1 P i and B1 2 [& : &]Bl

21

1B-21.By


&.

with 8 2 1 By the ind. hyp. (a1,a)1 ( P I ,d ) q.e.d.

(2) A

f

32

= B,

( A i )A2, Ai E 7,A2 E [z : TI&,

553

184 so d2 1 8 2 and (j; = B i [ A i ] C B 1 [.’:

,BID.

0

By 3.4.3.3 again, B l [ A l ] 2 [Z : p’D1 with 1 p”. Because B1 has degree 1 and A1 has degree 3, B1 2 ’.[ : ~ o ] D with o &[A11 2 fl. Similarly, since A2 has degree 2, if ( A l )A2 2 ’.[ : 6]Cthen A2 2 [ z : 7’1[z : &]COwith d o [ A l ]1 6 , Co[A1]2 C . By the ind. hyp. 60180 0 so d 5 do[Al] 1 Po[A1] 2 B a n d by CR d 1 q.e.d.

8,

3.4.3.6. Corollary. SA3 for

P - A UT-QE(+).

Proof. Let A E a, [z : B]C E D E [z : a ] F . Then [z : B]C E [z : B]G Q D whence D 2 [z : B’]G’ with B 1 B‘. By the lemma B 1a , so B Q Q and A E B. 0

3.4.3.7. So we have SA for P(S)-AUT-68(+) and 0-AUT-QE(+). In order to tackle the PG-case of AUT-QE we first prove 6-CLPT, which give us an unessential extension result. Then we can either extend SA directly, or first extend the lemma 3.4.3.5 to P6-AUT-QE+ and proceed as before. 3.4.4.1. Now consider PQ-AUT-68. We cannot use CR anymore. Theorem. UD2 for P7-A UT-68.

Proof. All 2-expressions are of the form ’.[ : cr]y or ‘.[ : ZIP((?). So if 3 [z : P ] B , then A 3 [z : a]A1 with a 2 P. By ind. on 9 we can 0 prove: if F2A Q [z : P]Bthen A [z : a]A1 with a Q 0. This gives UD2. k2 A

3.4.4.2. Corollary. SA for

PQ-AUT-68.

Proof. Immediate.

0

3.4.4.3. The same proof works as well for Pq6-AUT-68, as follows. Lemma. F2A 26 [a::a ] A l , F2B, A 1 B + B 26 [ z : P]B1, a 1 P .

Proof. Since 2 6 commutes with 2, [a: : a ] A l 2 [z : Q’]A{ 56 E 5 B. By . the &advancement (Sec. 11.9.3), B 26 C 2 [z : a”]A;’ 5 6 [z : Q ’ ] A ~Here reduction C 2 [a: : cr’’]A: does not contain &reductions so C = [a: : P]Bl with 0 0 2 a” 5 a’5 a,q.e.d. 3.4.4.4. By the simultaneous substitution theorem we have 6-CLPT again. Then by induction on Q we can prove:

E 2 F Q [ z : P ) B=+ F

1 6

[z:Q]A, a Q P .

This gives us UD2 whence SA, as before.

554

D.T. va,n Daalen

3.4.5. It is possible to extend these results (for pq(b)-AUT-68) to the corresponding +-languages Pq(b)-AUT-68+, but it is rather complicated. We can use a mixture of the methods in 3.4.4.3 and 3.4.4.4 and the methods in Sec. 3.3. Thus we start with leaving v2-reduction out of consideration, and restricting the appl-rule of degree 2 to: A E a,I-* B 2 [z : p ] D , a! 2 p k ( A )B. Later on these two restrictions prove to be immaterial. For the restricted system SA2 is immediate and p2-closure is guaranteed. Then we need b-p2advancement and the fact that bP2-reduction commutes with 2 , and get

*

k 2 F Q [ z : P ] B+ F l a p a [ z : a ] A , a Q P .

This yields UD2, and SA3 and we are finished.

V.4. The equivalence of the E-definition with the algorithmic definition 4.1. Introduction

4.1.1. Since in the E-definition the correctness of expressions and formulas (relative to a correct book and a correct context) was given by an ordinary inductive definition, the correctness relation is a priori just recursively enumerable and not necessarily recursive i.e. effectively decidable. In this section V.4, though, we prove the decidability and discuss some related topics. First we give some introductory considerations leading to a sketch of a decision procedure (Secs. 4.1.3-4.1.6). The whole verification process is, in principle, reduced to the verification of 9-formulas, for which the decidability follows from the normalization property N and the Church-Rosser property. We can use normalization freely because we proved N for a very large system in IV.4.5, but Pq-CR we d o not know yet. Therefore we assume throughout V.4 property CR for the correct expressions, for the proof of which we refer to Ch. VI. Then (see 4.2.2) we present the actual algorithmic definition, to be adapted for the various languages by a suitable choice of a reduction relation, of a typing function cantyp and of a domain function dom for the computation of domains (Sec. 4.2.3, 4.2.4). The equivalence proof in Sec. 4.3 is organized as sketched in Sec. 1.2 and 1.6, with the following effects: 4.1.2.

(1) The strengthening rule can be skipped from the E-definition. (2) The E-systems are decidable. (3) The algorithmic system satisfies the nice properties of the E-system: closure, etc.


555

The final sections concern the verification of Automath languages in practice. This is a matter completely different from the theoretical decision procedure discussed before. Particularly some remarks are made on suitable reduction strategies for deciding @formulas.

4.1.3. Deciding 9 and C No matter whether a system has &rule V.2 or @rule V.2', there holds A q B e-I-A,I-B,AJB

=+. By induction on 9, using CR. +. This is precisely rule V.2' so either it

Proof.

holds by definition or it follows

from CL.

0

So, by N (as in 11.5.4), for correct A and B , A 9 B is decidable. In P(v)-AUT-QE all 1-expressions are of the form [Z : 317. We have

ACT e - F I A and (Sec. 3.2.3.1) I-'A

c [z : P]B1 e-

A = [z : o ] A l ,

Q

9 p and x E

Q

I- A1 C

B1

.

So, for correct 1-expressions A and B , A c B is decidable (use induction on the length of B ) . Since on non-1-expressions c is just 9, this is true for A and B of other degrees as well. Let k stand for correctness in P(q)-AUT-QE, I-+ for some larger system, like P$-AUT-QE+ or P$-AUT-QE* and let - denote the P'6-normal form. By UE (Secs. 3.3.2, 3.3.3) we have

I-+B, I - A - c B -

I-+AcB *I-+A,

So, in the larger systems, too, A c B is decidable, for correct A and B. Deciding E-formulas In principle, E-formulas A E B , for correct A and B are going to be decided by the equivalence

4.1.4.

A E B e typ(A)

C

B

which reduces the E-formula to a C-formula. However, there is some trouble with typ. First, t y p can lead us out of the correct expressions of the language we consider. There are two ways to solve this problem: first one can introduce for each language a specified modified typefunction cantyp (for: canonical type) which does not suffer from this defect. Then we get what we want (as in 3.2.4 for AUT-QE) A E B e - I - A , I-B, c a n t y p ( A ) C B .

D.T. van Daalen

556

Alternatively, one can use the fact that the new, possibly incorrect expressions created by t y p in general are correct in some larger system (e.g. the corresponding +-system). Then one can decide the E-formula in the larger system:

I-B, I-+typ(A)cp

A E B *FA,

where I-+ stands for correctness in the larger system. If we make sure that I-+cantyp(A) 9 typ(A) then, by conservativity, the two approaches are clearly equivalent. A second difficulty with t y p occurs exclusively in AUT-QE’ and AUT-QE*. These languages have the rule: I-2B, I- C E D , B 2; C + I- B E D, and for the new category D of B the property t y p ( B ) c D (even if t y p ( B ) is correct) is not necessarily true anymore. This problem can be solved by taking a type-function which first eliminates all the b2-constants. For a b2-constant d we have then cantyp(d(A)) =

cantyp(b2-nf (d(A))). 4.1.5. Deciding correctness of expressions All correct expressions relative to a correct B and a correct 6 have to be B; B' + ( [ A ,B] > A' and [A,B] > B ' ) ] )and that weak rrP-postponement holds: A >pr B + A >,>p C 5, B. 4.6.3.2. PPSN conditions These are again quite similar to the P-SN conditions. The interesting clauses are: (1) A Prr-SN, B Prr-SN

+

[x : A ] B and [A,B1 Prr-SN.

( 2 ) A Prr-SN, B PT-SN and ( B Pn-SN.

[ x : a]D

+

D[A]Prr-SN)

+

(A)B

So, again, we want the substitution theorem for Prr-SN. 4.6.3.3. Square brackets lemma for 2 p n . Let B be Prr-SN. Let * stand for [x/A].Let B* >pT [y : PIC. Then either

The language theory of Automath, Chapter VII ((7.5)

(1)

611

B I p , [Y:PoICOwith& I p T P, C$ >p, C , or

(2) B

>pn

Z)* 2 [Y PIC. (Bk) (B1)2, ((2)

Proof. AS in IV.2.4.3, by induction on (I) lilp,(B), (11) the length of B. The new case is [Bl,Bz],B* G [Bi,B,*l. Then either B,* >p, [ y : PIC 0 or B,* &, [ y : PIC, and we can apply ind. hyp. I to B1 or B2. Remark: An alternative proof is provided by Barendregt’s lemma, which is still valid for >p, (see 11.11.3.5).

4.6.3.4. Substitution theorem for Pr-SN. Let B be normable, p(x) = p ( A ) , A and B are ,hr-SN. Let * stand for [ x / A ] . Then B* Pr-SN. Proof. As in IV.2.4.4, by ind. on (1) P ( A ) , (11) %r(B), (111) length of B. [ B l ,B21, B* The new case concerns B Pr-SN by ind. hyp. I1 so B* is Pr-SN.

E

[Bi, €I,*]. Both Bf and B; are

4.6.3.5. Corollary. B normable =$ B Pr-SN.

0

0

4.6.3.6. Notice that the r-expansion of normable A is again normable, so A normable T-exp(A) normable. Corollary. A normable 3 A Pr-SN ( b y 6.2.6). 0

*

Corollary. BT.

0

VII.5. Closure and Church-Rosser for A v 5.1. Introduction 5.1.1. Here we consider the constant-less part of Aq, defined as in Sec. 2.12, but with 2 standing for Pq-reduction. It is easy t o derive a strengthening rule (Sec. V.1.6) for such an algorithmic system, so q-CL does not cause major difficulties. The problems with closure for Aq, as compared to A, are rather due t o the fact that CL and CR appear to be heavily interwoven. Namely, a proof of CL (see, e.g., VII.3) seems to make quite essential use of CR, while in turn we seem to need CL in the course of the CR-proof - because Pq-CR holds for correct expressions only. The solution is of course to prove CR and CL (and a number of other properties) simultaneously, by induction on big trees. In Sec. 5.2, below we prove indeed that BT extends to the present situation.

612

D.T. van Daalen

5.1.2. We introduce some notation that enables us to make the structure of the proof more explicit. Here 5 is as in VII.3.4. Definition. If P is a property of expressions then P* and Po' are given by (1) P*(A) :-+ A 5 B

=$

P(B).

(2) Po(A) :-+ (A properly &-reduces to B )

+

P(B).

0

Using this notation, we can express our induction step by

F A , CR;(A),

CLg(A)

+

CR(A), CL(A)

for which, of course, it is sufficient to prove

t- A , CRg(A), CL;(A)

+ C R ~ ( A ) ,C L ~ ( A.)

The properties SA, PD, PT and P*T from 3.1 play again a role in the proof, and further property SC, substitutivity of correctness, here defined by S C ( B ) :-+ .( E a B, t- A,tYP(A) 1tYP(.),tYP*(A) 1tYP*(.) I- B[AI).

*

5.1.3. Now the proof below is organized as follows. First we present some preliminary facts, among which Pq-BT (Sec. 5.2), strengthening and Q-PT (Sec. 5.3). Section 5.4 contains the actual closure proof. First we assume t- A, CR;(A), CL;(A), and prove SA(A) and PD(A) (in Sec. 5.4.1), PTl(A), SC(A) and CR1(A) (in Sec. 5.4.2-5.4.4) respectively by a separate induction on big trees, and by simple induction on length. Then we complete the proof by proving PT(A), P*T(A) and CL1(A) simultaneously, by induction on the big tree of A again. 5.2. Extension of BT t o the Pq-case 5.2.1. A postponement result Let &,, and 2p7,, be the straightforward extensions of Z7 and >p7, as defined in 4.4.2. Mere verification shows that

A pretyped, A

>1,,,>1,~ B 3

A

%,, B

>I,~

whence 777-postponement:

A pretyped, A 2,,7 B

A

&>,,

B.

Combining this with Pq-pp [P~ppostponernent] we get

A pretyped, A >-p7,, B

+

A 2p7>,, B

.

5.2.2. Pqr-SN and Pq-BT In 4.6.3 we proved Pr-SN, which - [induction o n 79p7], as in [ v a n Daalen 80, 11.7.3.51 - together with (Pr)-q-pp and 7-SN gives us Pqr-SN, for normable expressions. Then Pq-BT follows, as in 4.4.3.

The language theory of Automath, Chapter VII (C.5)

613

5.3. Some simple facts 5.3.1. Strengthening If B is a (t,x E a,G E B)-expression, but x $! FV(B) and x $? FV(B), then B is a (t,G E B)-expression as well, and the t y p (if degree(B) # 1) and typ' of B w.r.t. both contexts are syntactically equal (E). So, by induction-on the definition of correctness, we get strengthening: if x E a,G E PI- ( B ) ,x fZ FV(B) (and x fZ FV(B)) then G E @I-( B ) - read this twice, with and without the parts concerning B -. As a corollary we have: x E a I- A, x $! FV(A) + I- A, whence q-outsideCL1: I- [x : a](z)A, 2 $? FV(A) I- A.

*

5.3.2. q-PT and q-P*T For pretyped A there holds A

>9

B

* typ(A) tYP*(A)

>9 >9

typ(B) (if degree(A) # 1) , tYP*(B)

Proof. Induction on the length of A. So, induction on 29 gives A 29 B

* tYP(A) 2 9 tYP(B)

(if degree(A) # 1) 1

tYP*(A) 2s tYP*(B) and, a fortiori, we have y P T and q-P*T A

27

B

* tYP(A) 1tYP(B)

(if degree(A) # 1) ,

5.3.3. From 3.2.1 we recall the property of correctness of types I- A =+ I- typ(A)

and the substitution properties from 3.2.2

5.3.4. Property. Let degree(A) = 1, p(A) = [ul]... [ v ~ ] E Then . A 2 [x1 : a11 ... [xk : ak]C. Proof. Induction on the length of A. E.g. let A = (Al)A2, then p(A2) = [ ~ ( A I )[UI] ] ... [a]&, so by ind. hyp. A2 2 [x : P] [xl : a11 ... [xk : a k ] C and 0 A 2 [zl : a:] ... [xk : a;]C', q.e.d.

D.T. van Daalen

614 Corollary. Degree(A) = 1, p(A)

= [v1]v2 *

Corollary. I-' A, A E [z : a]C,A 2 F

+

A 2 [z : a]C.

0

F 2 [z : p]D.

Proof. If A correct, then A normable, so F normable, with

Corollary. I-l A, A E [z : a]C, A

1 F + F 2 [z : p]D.

5.4. The actual closure proof 5.4.1. Lemma. Let I- A, Cg(A), CL;(A). Then PD(A) and SA(A).

Proof. By induction on the big tree of A. (PD). Let A = [z : A1]A2, A 2 [z : B11B2. If A1 2 B1, A2 2 B2, then certainly A1 1 B1. Otherwise A2 2 (z)[z : The latter expression is correct, satisfies CR* and CL*, so we can use SA and get A1 1 B1, q.e.d. (SA). Let A = ( A l ) [ z : A2]A3. Then I- Al, typ(A1) 2 cp, I- [z : AzlA3, typ*([z : Az]A3) = [z : A2]typ*(A3) >_ [z : cp]C. By correctness of types I- [z : Az]typ*(A3), which also satisfies CR* and CL* so we can apply PD and get 0 A2 1 'p, whence typ(A1) I AS, q.e.d. 5.4.2. Lemma. Let I- A, CG(A), CL;(A). Then P T ~ ( A ) .

Proof. Induction on length(A). q-PT1 we know already (Sec. 5.3.2). For Pkmtside-PTl let A (Al) [z : A2]A3. By 5.4.1 typ(A1) 1 A2 and by the substitution property 5.3.3.1) typ(A) = (Al) [z : AzItyp(A3) > 0 typ(A3)[Al] 1typ(A3[A1]), q.e.d. The other cases are immediate.

=

5.4.3. Lemma. Let z E a, G E F B , C q ( B ) , CL:(B), I- A, typ(A) typ*(A) 1typ*(a). We write * for [z/A]. Then ( S C ( B ) ) a E p'* I- B*.

1 a,

Proof. Induction on length(B). The crucial case is: B = (BI) B2, typ(B1) Icp, typ'(B2) 2 [u : 'p]$. By ind. hyp. I- B1, I- B2. We do not know CR or CL for the substitution results, so we use a trick. Distinguish: (1)

B1

does not end in z, then typ(B1)

= typ(B1)"

2

'p*.

(2) Otherwise, let B1 = ...z ...z and form C1 from B1 by just replacing the final z, C1 = ... z...typ(A). Then C1 1 typ(B1) and by CR, C1 1 9. So t y p ( B f ) 3 Cf 1 v*.

Anyhow, in both cases t y p ( B f ) 2 Further distinguish:

'p'*,

with

'p'

1 'p.

The language theory of Automath, Chapter V I I (C.5)

(1) B2 does not end in z, then typ*(Bz)

615

= typ*(Bz)*2 [u : cp*]$*.

...z ... z, C2 (2) Otherwise form Cz from Bz by replacing its final z, B2 ... z... typ*(A) 1 typ*(Bz). Then, by CR (typ*(Bz)), C2 1 [u : cp]$ and, by 5.3.4 C2 2 [u : cp”]$” with, by PD, cp 1 $,”. Now typ*(B,”)= C,” 2 [u : cp’f*] $”* . So in both cases typ*(B,*)2 [u : cp”*]$”*, with cp 1 cp”. Now use CR(cp), this gives cp’ 1 p f f ,whence cpf* 1 cpf’* and typ(B,*)-1 cpIf*. So I- (€3;) B,”,q.e.d. 0 5.4.4. Lemma. Let I- A, CR;(A), CL;(A). Then CRl(A).

Proof. Again by induction on length. The crucial case is the critical &-case: A [X : All (x)[Z : AzIA3, z @ FV(A2). By 5.4.1 SA((Z) [Z: AzIA3) SO A1 1 Az, 0 [z : A1]A3 1 [z : AzIA3, q.e.d. 5.4.5. Lemma. Let I- A, CR;(A), CL:(A).

Then C L ~ ( A )PT(A) , and P*T(A).

Proof. Induction on the big tree of A. (1) (CL1). Let A > B, we must prove t- B. The 7-outside case we know already. Consider, e.g.: A = (Al) [Z: Az]As, B A3[A1]. By 5.4.1 typ(A1) 1 A2. By P*T - ind. hypothesis - we get typ*(Al) 1 typ*(z) as well, so by 5.4.3 we are done. This is P-outside CL1. Or consider: A E (Al) Az, A1 > B1, A2 > B2, B = (B1)B2, typ(A1) 2 cp, typ*(Az) 2 [u : cp]$. By (e.g.) the ind. hyp. we get I- B1, I- B2, typ(A1) 1 typ(B1) and typ”(A2) 1 typ*(Bz). Now use CR, this gives tYP(B1) 1 cp and tYP*(B2) 11. : cpl$. So, by 5.3.4, typ*(B2) 2 [u : cpf]$’I and by 5.4.1 cp 1 cp‘. Finally CR(cp) yields typ(B1) 1 cp’, so I- (B1)B2, q.e.d. The remaining case of CL1 is trivial.

=

(2) (PT). PT1 we know already. Now let A > I B 2 C. By CL1 I- B and by ind. hYP. PT(B), so by CR(tYP(B))l tYP(A) 5. tYP(C), q.e.d. (3) (P*T). Let degree(A) = 1. Then by PT, if A 2 B , typ(A) 2 F 5 typ(B). By C L ~ ( A(this ) implies CL(A))I- B, so by correctness of types, I- typ(A) and k typ(B). Now apply the ind. hyp.: typ*(A) 1 t y p * ( F ) 1 typ*(B) and 0 use CR: typ*(A) 1 typ*(B), q.e.d. 5.4.6. Theorem.

If k A, then CR(A),CL(A).

Proof. By induction on the big tree of A. The ind. hyp. reads CR;(A), CL;(A), and the preceding lemmas produce CR1(A) and CL1(A). As we noticed before, 0 this yields CR(A) and CL(A).

616

D.T. vaa Daalen

5.4.7. Corollary. If k A, then SA(A), PD(A), PT(A), P*T(A) and SC(A). 0

Note: The separate inductions on big trees in 5.4.1, 5.4.5 and 5.4.6 can of course be compressed into a single induction on big trees. 5.4.8.

VII.6. Various equivalence results 6.1. Introduction In V11.2 we introduced A(r]) with and without (definitional) constants. The results in VII.3-5 are derived for the constant-less system. In this section we extend these results in an indirect way to the remaining systems, by showing that, in a certain sense, they can be embedded in the constant-less version. Sec. 6.2 is devoted to primitive constants only. First we give a translation which eliminates the constant-expressions. Then we explain the relations between (a) the system with constants, (b) its image under the translation, and (c) the constant-less system. Afterwards we easily extend our nice properties (CL, CR, BT) to the system with constants. Sec. 6.3 covers the additional extension with definitional constants. In 6.4 we prove another equivalence: between Nederpelt’s single line presentation with abstractor strings Q and our presentation, with contexts E. In this case too, the correspondence is close enough to show that Nederpelt’s original system satisfies the required properties.

6.2. Eliminating primitive constants 6.2.1. The translation ‘ For the system with constants (for short: c-system) we use the notations A ( V ) ~and Fc. Now we define a translation of the c-system into the system without constants. The translation (notation ‘) is characterized by: (1) it transforms constants p into variables p’, (2) it converts constant-expressions p(A1, ...,A h ) into appl. expressions

(4)... (4)P’,

d*

(3) it eliminates schemes y’ E p($ E y one by one from the book by including an additional assumption p’ E [y’ : $17’ in the context,


617

(4) it commutes with the other formation rules (for expressions, strings and contexts). Thus a statement B ;

‘

r]

F-

,

resp.

r]

b- B :*q E

B

B

+

A

> Bo, BA E B , SO

(2) A ’ ? B’ =+ A > B , and

(3) A ‘ 1 B’

+

A

B.

’ and rl-reduction With ?-reduction, (1) above does not hold any more: ([z: a]p(Ak, ...,A1,z))’ E [x : a’](x)(.&p’ may reduce to (2)~’. Lemma. A’ & B’ + A 2q B. 6.2.5.

Proof. Ind. on the length of A. E.g. let A = [z : a ] C , so A’ E [x : a’]C’. If B’ z [x : p’]D’ with a’ 2, p’, C’ & D’ use the ind. hyp. Otherwise C’ & (z) B’. The latter expression is ((x)B)’ so by ind. hyp. C (x)B and 0 A 1, B , q.e.d.

z7

Now let A’ 2 B‘ then by pq-pp: A’ >p C & B‘. This C 2 Ch so Co & B by the lemma, and A 2 B. This is property (2) above. Property (3) can be proved in the same fashion. 6.2.6. Something about typ* Lemma. -I B’ + (I- typ*(B)‘,typ*(B)’ J. typ*(B’)).

Proof. The translation ’ preserves the degree, of course. We use induction on degree(@). The degree 1 case is immediate. Otherwise typ*(B’) = typ*(typ(B’))and typ*(B)’ = typ*(typ(B))’. By correctness of types I- typ(B’), reducing to typ(B)’ and by P*T typ*(B’) J. typ*(typ(B)’). By CL I- typ(B)’ so by ind. hyp. I- typ*(B)‘, q.e.d., and typ*(B)’ 1 typ*(typ(B)’). By correctness 0 of types k typ*(typ(B)’) so by CR typ*(B)’ -1 typ*(B’), q.e.d. Now that we know CL, CR, PD and SA for h(7) we can extend property 5.3.4

The language theory of Automath, Chapter V I I ((7.5)

619

to: klA, I-’ [z : a]C,A 1[z : a]C =+ A 1~ [z : ,DID, a 1 P. So, as alternative application condition, equivalent to the one used in the original application rule: F A , I - B , t y p ( A ) > a , t y p * ( B ) > [ z : a ] C+ - I - ( A ) B we can as well use, e.g.

tYP(4

1a ,

tYP*(B)

Lp [. : @IC

or typ(A) J, a , typ*(B) 1 [z : a ] C , I- [x : a]C .

6.2.7. The proof of the correspondence Theorem. B;[ kc A & B‘, E’ I- A’. Proof. +. By induction on correctness. The formation of the context B’ is allowed, due to the liberal degree conventions of A(7). Consider, e.g. the appl. rule: let kc A, kc B , typ(A) 1 a, typ*(B) 1 [z : a]C. By ind. hyp. I- A’, I- B’, further typ(A’) 1 typ(A)’ 1a’ and by the lemma in 6.2.6 I- typ*(B)’, typ*(B‘) 1 typ*(B)’ 2 [z : a‘]C’. By CR, typ*(B’) 1 [z : a’]C’. By CL, I- [z : a’]@ so, by the alternative appl. rule I- (A‘) B‘. Or consider the instantiation rule: kcB1, ...,kcBk, y’E p p ( f ) E y is a scheme in B , Id_=k and typ(B,) -1 pZ[L?] for i = 1,...,k . The translated scheme reads p’ E [y’: P’ly’. By ind. hyp. I- Bi, ...,k BL. Now typ(B{) 1 typ(B1)’ 1Pi, typ*(p’) = [y~ : Pi] ... 7,so k ( B i ) p ’ . Further typ(Bb) 2 typ(B2)’ 1 ,&[BI]’= P;[Bi]and typ*((Bi)p’) (Bi)typ*(p’) > [ y :~P6[Bi]]... 7 ,SO I- (Bb)(Bi)p’. Etc. UP to I- (Bk),..(Bi)p’= p ( z ) ’ , q.e.d. e.Also by induction on correctness. E.g. consider an appl. expression. Either it is ((A) B)‘ or it is p ( @ . First case: if I- (A‘) B’ then I- A‘ (so kcA), I- B’ (SO I - c B ) , ~ Y P ( A I ) ’ typ(A’) 1 a (SO typ(A)’ I a ) , typ*(B)‘ 1typ*(B’) 1 [x : a ] C (so typ*(B) J, [ x : a]C). Hence typ*(B)’ 2 p [z : p ] D = [x : &,]DL = ([z : /30]00)’ with a 1p. By CR typ(A)’ -1 &, so typ(A) J, PO,and typ*(B) 1 [z : Po]Do, so kc (A) B. Second case: I- (Bh)... ( B i )p’ so kcBk,...,kc B1. Let y’E * p(y3 E y be the scheme of p . Typ(Bi) 2 P I , typ*(p‘) = [ y ~: Pi] ...7 2 [YI : PI]...^ so typ(B1)’ 1 Pi, typ(B1) 1 PI. Further typ(Bb) 2 (02, and [YZ : Ph[BilI...7 < (B;)typ*(p’) = typ*((Bi)p‘j 1 [YZ : P Z ] . . . ~so , 0 typ(B2) 1Pz[BII.Etc. UP to typ(Bk) I Pk[zI and k C p ( B )q.e.d. 6.2.8. The required properties Theorem. The strictly normable constant-expressions [see the comment to 2.1.41 satisfy BT. Proof. Strictly normable c-expressions transform into strictly normable expressions without constants under the translation ‘. And all 5-sequences of c-expressions A transform into subsequences of 5-sequences of A’:

D.T. van Daalen

620

(1) tYP(A’)

(2) A

>1

(3) A c B

1 tYP(A)‘,

B

+- A‘

+

>1

B’,

A ‘ c B‘.

So by BT for the constant-less version we are done.

0

Theorem. A ( Q ) ~satisfies CR.

Proof. Let F c A, A 2 B, A 2 C. By the =+-part of the correspondence I- A’ and by CR for A(0) B’ 1C’, so B 1C, q.e.d. Theorem. A ( Q ) ~satisfies CL.

Proof. Let k c A l A

> B.

Then k A’, A’

> B’ so by CL I- B‘. So kcB.

0

Theorem. A ( Q ) ~satisfies SA, PD, PT, P*T, SC etc.

Proof. Either from CL and CR, or using the correspondence.

0

6.2.9. An unessential extension result Now we explain the connection between the I---system and the ordinary I--system of A(q) without constants. Recall

I--A’ e F c A , i.e. F - A

t-,Ao

.

The first half of the correspondence result shows I-- + I-, i.e. a simple extension result. Now we define a translation’ from the larger into the smaller system, as follows: if c‘E ~5’* p ( z ) E y is a scheme in B, 151 = k, i < k then ((Ai) ... (A1)p’)- :F [zi+l : ai+l[K-]] ... [zk : ai[2-]](zk)... (zi+l) (AT) ... (A;)p’, i.e. we 77-expand until p’ gets enough arguments in front. For the rest acts as identity. Clearly A- l e A, A- 3 (A;)‘. Viz. ((Ai) ... (A1)p’)i = + [zi+l : (ri+l[AJ] ... [zk : ak[&]]p(&,zi+l, ..., zk). The translation is a bit intricate, because ((A) B)- is not necessarily (A-) B-. In general (A-) B- >p ((A) B)- and B-[A-] >p (B[A])-. Further typ(A-) Le typ(A)-, and also typ(A-) Jp typ(A)-. Without proof we state that A 1 B + A- 1 B - , and that typ*(A-) 1 typ*(A)-. From these facts, it can be proved that: -l A F A-, so by the second part of the correspondence I- A + k- A-. In case of &reduction, this is a typical unessential extension result.

-

6.3. The case of definitional constants 6.3.1. We have three main possibilities to incorporate definitional constants in our theory. The first one studies the new system (we call it A(77)d, with correctness predicate kd, and also speak about the d-system etc.) independently, as a


621

separate subject, the second one considers it as an extension of A ( Q ) ~and , the third one embeds it into h(q),by extending the translation ' from the previous sections in order to cover definitional constants. Here we actually use the second method, and just mention some points on the third one. But we start by proving the big tree theorem for A ( Q ) ~for , reasons of completeness and as an indispensable prerequisite for the separate study of the system (method one above). 6.3.2. The big tree theorem for A(7])d In 6.2.8we proved BT for A ( V ) ~ by means of the embedding ' into A(Q). It is indeed possible to extend ' to the case of definitional constants, but (see 6.3.3)the translation does not reflect the type-structure sufficiently, which makes this method fail here. so instead we revise the BT-proof of 5.2 (for A(Q)) and adapt in to the h ( 7 ) d case, which is relatively easy. First we mention the BT-condition (see 4.3.2):

* BT(Al), ...,BT ( A d , BT(tYP(P) [4). (6) BT(d(2)) * BT(A1), ...,BT(Ak), BT(typ(d) [A]), BT(def(d) [A)). (5) BT(P(4)

The P6r-SN conditions are quite analogous, and, as in 4.4.3, we have: Theorem. P&r-SN(A) =+ BT(A).

0

This suggests that, in this case as well, the substitution property of PSrSN is crucial. We choose to adapt the first BT-proof (Sec. 4.5) so need the

replacement theorem (see 4.5.6)instead: Let * denote [z/p(A)lLR, let B be normable, p ( z ) = p(A), A, B PGr-SN. Then:

C E B*

+

C Ph-SN.

Proof. As in 4.5.6.We consider a single reduction step C >1,$67 D. For all &steps and all r-steps concerning variables (not constants), P&SN(D) can be proved as in 4.5.6. The remaining steps, i.e. &steps and r-steps of constants, can only fall into the categories (1)and (2a) so we get P~T-SN(D)by ind. hyp. I1 or ind. hyp. 111. So we have a list of corollaries: (1) B normable, p ( z ) = p(A), A, B P6r-SN

(2) B normable, p ( q )

= p(Ai), Ai

+

B[A] PGr-SN.

(i = 1,...,lE) and B PSr-SN

+

B[A]

Ph-SN.

Proof. The simultaneous substitution can be simulated by iterated single substitution. 0

(3) B normable

+ B PGr-SN.

622

D.T. van Daalen

Proof. Induction on pretyped expressions. For the new cases use the previous 0 corollary. (4) B normable

+ B Oq67-SN.

Proof. ~ q - p pextends to the present case (see 5.2.1), 6q-pp we knew already 0 (see 11.7.4). This gives (p6.r)-q--pp and, by q-SN, Pq&-SN. (5) B normable =+ pqG-BT(B).

(3

6.3.3. The translation into A ( q ) Here we show how the translation ’ can be extended to the d-case. Viz. an expression d(A)transforms into (A:) ... (A;) [Z : G’ID‘, where Z E G * d ( Z ) := D * d(2) E y is the scheme of d. This translation behaves nicely w.r.t. to reduction: A > B =+ A’ 2 B‘. But of course it is possible that an expression A’ P-reduces t o a n expression which is not some B‘. This is in contrast with the situation with primitive constants where this could only occur by q-reduction. The best we can get is: A’ > l ,p B =+ B >p C , A >l,ps C . So, e.g. by ind. on 19p(A’), we get A’ >p B =+ B 2 p C‘, A 2 C . For the rest the translation seems t o be not too useful, because properties like A’ J, B’ =+ A J B (at least where q-reduction is allowed) and typ(A’) 1 typ(A)’ are only valid in the correct fragment. Note that typ(A’) >_ typ(A)’ is simply wrong here. 6.3.4. Some properties of h ( ~ Translation ) ~ of A(q)d into A ( V ) ~just requires the elimination of abbreviations, which can be done by &normalization. In the next sections we show that this actually constitutes a translation, i.e. that it preserves correctness. Here we first give some properties of A ( Q ) ~which we need in the - rather complicated - proof below. The single substitution result (of A ( q ) , and of A ( Q ) too) ~ I - A , t y p ( A ) l a , ( z ~ a , q I - B =+ ) v[Al~BB[Al

can, by induction on 131,be extended to a simultaneous substitution result I-

A, typ(Ai) 1cui[A]- for i = 1,...,IA(, ( 2E G I- B ) + I- B [ q .

The properties of Sec. 3.2.2 concerning the t y p of substitution results can be generalized t o (1) the simultaneous substitution case,

(2) successive application of typ, resulting in:

The language theory of Automath, Chapter VII (C.5) typJ(Ai) 1 typj(zi) tYPW

623

* [A], for i = 1,...,

[A1 1t Y P j ( B [ d )

9

for all relevant j, where typ3 stands for j successive applications of typ. This holds for A ( q ) but also for A ( V ) ~and A(7)d. Notice, that in case B does not end in one of the xi we even have t y p j ( B [ d ) = typj(B)[A] .

6.3.5. The translation into A ( V ) ~ Our notation for the translation is 7 For expressions'amounts just to taking &normal form. It is clear how-acts on strings and contexts. It is intended that the book B- is formed from B by &normalizing and by skipping the abbreviational schemes. The translation is of course not 1 - 1. We recall that B [ d - = B-[A-],that d ( 2 ) - E def(d)-[A-], and that 6reduction commutes with pq-reduction. The latter implies A 2 B

+

A-ZB-

and A J B

+

A-IB-.

6.3.6. The translation preserves correctness Theorem. B;( k d A + B-; (- kc typ'(A)-, typ'(A)i = 0, ...,degree(A) - 1 (thas ancludes kcA- ztself).

1 typ'(A-)

for

Proof. By induction on kd. Crucial cases are:

=

(1) The application case: A (Al) A2, kdA1, kdA2, typ(A1) 2 a, typ*(A2) 2 [z : a]C. By the ind. hyp. kc A;, kc typ(A1)-, typ(A1)- 1 typ(A;), kc typ'(Az)-, typ'(A2)- 1 typ'(A,). Clearly typ(A1)- 2 a- so by CR typ(A;) 1 a-. Similarly, typ*(A2)- 2 [z : a-16, and tYP*(tYPZ(A2)-)1 tYP'(tYPYA2)) = tYP*(A,) 1tYP*(A2)- (by P*T)¶ so by CR, typ*(typ2(A2)-) 1 [z : a-]C-. Hence kctyp'((A1) A2)- (= (AT) typZ(A2)-). See 6.2.6 for the alternative appl. condition. The property typ'((A1) A2)- 1 typ'(((A1) A2)-) is trivial.

(2) The definitional constant case: A = d(@, kdB3, typ(B,) 1 p3[3]for J' = 1, ...,14, where y ' E ,8*d($ := D * d(y') E y is the scheme of d. By ind. hyp. k c B y and typ(B;) 1 typ(B,)- 1 &[g].Also by ind. hyp. y ' E ,8- I-, D - , 3 E p'- kc y-, y ' E ,8- kc typ(D)- and typ(D)- 1 typ(D-). So, by the simultaneous subst. property, kcD-[g-] ( 5 A-), kcy-[g-] (= typ(A)-). We know that y 1 typ(D), soy- 1 t y p ( D ) - so by CR t y p ( D - ) 4 y-, whence typ(D-)[&] Jy-[g-] and, again by CR, typ(A-) 1 typ(A)-. Now there is left t o prove, for i = 2, ...,degree(A) - 1:

D.T. van Daalen

624

(a) kctypi(A)- (= typi-'(y[l?])-), (b) typZ(A)-

1 typ'(A-),

and

i.e. typi-'(y[d])-

1 typZ(D-[d-]).

The ind. hyp. gives us kctypi-l(y)-, kctypi(D)-, typZ-'(y)- 1 typi-'(y-), typZ(D)- 4 typi(D-) for these i, and kc typ'((Bj)- (1 typk(BjT)), for i = 0, ...,degree(Bj) - 1, for j = 1, ...,Id. Now (2) is simple: typa-'(y[J]) 1 typi-'(y) [d]so typi-l(y[J])- 1 typi-'(7)-[J-] 4 t y p y y - ) [J-] 1 t y p i ( d - ) [&I 1typi(D-[&]). Here we use PT and the substitution property of types. By CR we get (2). Property (1) we formulate in the form of a lemma.

Lemma. Let G E p k d y, i-dBj, for j = 1, ..., kctypi(y[d])-, for i = 0, ...,degree(y) - 1.

with y and

B' as above.

Then

Proof. If y does not end in some of the yj then typZ(y[d])- = typi(y)-[&] which is correct by the simultaneous subst. property. This also covers the case i = 0 (which we knew already ). For the rest we use the length of y. The case y = yj is true by assumption. Further consider the application case: Y (Ti)?'z, kd 71, Ed 7 2 , tYP(7i) 2 cp, tYP*('Yz) 2 [ z : VIE. BY ind. hYP. kcyi[B]-, kct y p ( r i [ 8 ] ) - , kc typi(rz[J])- for all i. We have typ(y;[g-]) 1 ~YP(T;) [J-I I_~YP(YI)-[J-I 2 C P - [ ~ - ] , SO by CR t ~ p ( y l [ g ] - )1 C P [ ~ ] - Sim. ilarly typ*(rz[B])- I typi(yz)-[8-] 1 typi(y;)[z-]. So, by CR and P*T, tYP'(tYP"(yz[fl)-) 1t Y P * ( t Y P W 1 t ? P * ( 3 i ) [J-I 1 typ*(_rz)-[J-I 2 [ z : cp[d]-]E[B]-.Again by CR, typ*(typi(yz[B])-) 1 [ z : cp[J]-]E[B]-,whence k c t y p i ( ( n [ @ yz[B])-, q.e.d. The abstr. case is straightforward. This finishes the proof of the lemma. 0

[a-1)

This finishes the definitional constant case of the theorem. Now the remaining cases of the theorem are straightforward. This finishes the proof of the theorem. 0

6.3.7. Is A(7)d a definitional extension of A ( V ) ?~ The above corollary amounts to the unessential extension properties UE2 and UE3 (see V.3.2.2). Of course, we also have kcA + A z A- and it is tempting t o conclude the other half of of UE1: B;(kdA

+

B;tkdA-

from the corollary. This is, however, not immediate as yet: we can conclude

B;< kd A

+

B-; CI, B2 > CZ. By ind. hyp. kdC1, kdC2. By 6.3.6 k c (B;) BT, and B; > C;, B, > CF, SO kc (C;) CT SO 0 k d (C1)C2. Similarly for const. expressions. Theorem.

A(7))d

satisfies CL.

Proof. As usual, by ind. on 2.

0

6.4. Nederpelt's original formulation 6.4.1. Nederpelt's original definition of A [Nederpelt 73 (C.311 used single-line presentation. 1.e. instead of defining correctness of expression relative to a context, he defined correctness of expressions having a n abstractor string '.[ : G] (notation Q) in front. ~ correctness in his system. For definiteness we give his rules. We write k j for But for certain provisions making sure that no confusion of variables occurs, the rules read:


627

6.4.2. Apart from the use of abstractor strings instead of contexts, there are two other points that make the two approaches not completely parallel. The first point concerns abstraction; our abstraction rule has no counterpart in Nederpelt’s system. Nederpelt rather follows a combinatory (in the sense of combinatory logic) way of building expressions. In the language of combinatory logic, rule (2) above is the rule for la,the identity in a, and rule (3) is the rule for Kay,the constant function on a with outcome y . Alternatively, rule (3) might be called a rule of weakening (see V.2.9.3). 6.4.3. The second point that requires attention is that an abstractor string can get involved in a reduction (notably an 17-step), whereas contexts are of course immune to reduction. First some notation. We write IQI for the number of abstractors in Q. We write Q 2 Q’ if Q = [Z : d ] ,Q’ = [Z : $1 and d 2 6‘in the obvious sense. Now we have the following lemma: QA 2 Q’A‘, IQI = IQ‘I A 2 A’. Proof: If there are no 77-steps involving the border line between Q and A, then clearly Q 2 Q , A 2 A‘. Otherwise Q = Q l [ z: a ] ,a 2 a’, Q1 2 Q;, A 2 (z) B with z g‘ FV(B) and Q’,B 2 QY[z : PIA‘. 1.e. Q A = Q1[z: a ] A 2 Qi[z : a‘](z) B >, QiB 2 QY[z : P]A’. Now we can, e.g., use ind. on t9(QA) and conclude that B 2 (z : PIA’. But then A 2 A’, q.e.d. 6.4.4. The equivalence proof Now we are ready for the equivalence proof. Theorem. Let

Q = [ Z : Z ] ,( E Z E G . Then FNQA

* (FA.

Proof. The +-part is immediate. We use induction on F. E.g. consider our variable rule: from 3 E Z k we conclude ? E d F zi. If zi is the most “recent” variable then we must use rule (2). Viz. Z E Z I- is itself a result from 2 1 E a1,...,zi-1 E ai-1 F ai. By ind. hyp. we get FN [z1 : a11 ... [zi-l: ai-1]ai. Otherwise we must insert the abstractors inbetween [xi : ail and the end of Q by successive applications of rule (3).

628

D.T. van Daalen

Now consider the =+part. The crucial case is the application clause. So let I-N QA, I-N QB, typ(QA) 1 Qa,typ*(QB) 2 Q[z : aIC. BY ind. ~ Y PI. A, I I- B. Now typ(QA) Q typ(A) 2 Q a so by the lemma typ(A) 2 a. Simi0 lady typ*(B) 2 [z : a]C. So we conclude I- (A) B , q.e.d. 6.4.5. The nice properties for Nederpelt’s system One of the consequences of the theorem is:

I-NA * I - A so the N-system can be considered a part of our system. This gives CR and CL for FN immediately. From this one can get the other properties SA, PD, PT etc. as usual. 6.4.6. Alternative way of embedding Ad into AN Resuming the results of the preceding sections: we have constructed an embedding of A ( q ) d (via A ( V ) ~ and A) into AN. Here we introduce a n alternative way (due to Nederpelt [Nederpelt 71al) of embedding A(q)d directly into AN. Our notation for the translation is, again, ’. Let a statement B ; t Ed A be given. Primitive schemes j? E * p ( 2 ) E y are, as is to be expected, turned into abstractors [p’ E [Z: d’ly’]. The context I is of course transformed into an abstractor string t’ G Q. Essentizl is the translation of definitional constant schemes. A scheme 2 E 6 * d(Z) := D * d(Z) E y is translated into an expression “segment” ( [ 2 : .‘’ID‘) [d‘ : [j? : 6’1 7’1. All constant expressions c(A) are now translated into (A:) ... (A:) c’. So B; k d A is translated into a single expression B’t’A‘, where B’ is a string of abstractors and applicators, and I’ consists solely of abstractors. For expressions the translation is quite similar to the translation ‘ in 6.2.1. In particular we have (as in 6.2.4) typ(A’) > p typ(A)‘. However, w.r.t. to &reduction the correspondence is not too close: it is not possible t o eliminate occurrences of d’ one at a time. So in order t o establish A 1 B =+ A’ 1 B‘ we need a partial &normal form again. FN B’E’A’. Anyhow, it is indeed possible to prove B;[ kd A

The language theory of Automath, Chapter VIII, Section 3 (C.5)

629

VIII. SOME RESULTS ON AUT-II VIII.3. A short proof of closure for AUT-11 3.1. Proving closure for AUT-II is not very different from proving it for AUTQE. So we just sketch how to modify the proof in V.3.2. We start with a version without the extensions mentioned in 2.4 and 2.7, but we include all reductions (also 6l-reduction). 3.2. For the terminology see V.3.1. Let > denote disjoint one step reduction. [See the comment to 11.8.1 By the properties in [van Daalen 80, 11.7.4.31 [or, alternatively, b y weak 6-advancement and induction on da(A)]we have A

>B

* 6-nf(A) > 6-nf(B) .

By the substitution theorem we have 6-CLPT. The 6-nf’s of 1-expressions are of the form n([z : a ] A )or 7 . Reductions of these expressions can only be internal, so by induction on p we get (including what might be called UD1 here): I-ln([z:a ] A )9 n([z :PIE)

*a

p and

(z E a I- A

B) .

3.3. From this follows SA2 (whence Pkmtside-CL:) and P-outside-PT:. Viz. let A E a , I-2[x : B]C E n([x: a]D). with conclusion I- ( A )[z : B]C. Then, for some E , z E B I- C E E and I- n([z : B ]E ) II([z: a]D). So a B and x E B I- E D whence A E B (i.e. SA2) and z E B I- C E D. So C[A]E D[A]

(i.e. @-outside-CLPT:)

.

The proofs of UT2 and the inside cases of PT: are by ind. on I-.

3.4. The strengthening rule gives Iputside-CL1. Here follows a proof of outside-PT: different from the proof in V.3.2.5. Viz. let k2 [z : a](z) A E y , z $ FV(A). Then, for some C, [z : a] (z) A E n([z : a ] C [ y / z ] ) y , where z E a I- A E ll([y : a’]C),a’ q a. So, as well, E a I- A E ll([y : a]C). By weakening z E a, y E a A E n([y : a]C) and z E a, y E a I- (y) A E so x E a t- [y : a](9) A E n([y: a]C).Again by weakening x E a I- [z : a](z) A E y , so by UT2 z E (Y I- y Q n ( [ y : C Y ] ~ ) Hence . x E a t- A E y and by strengthening A E y, q.e.d.

c

3.5. This completes the proof of PTT. Then PT2 and LQ2 follow by ind. on 2 and respectively. Now we come to CLPT3. For properties like SA3 we need

630

D.T.

vi~n Daalen

3.6. To this end we study P2-reduction and, in particular, P2-head-reduction, for short Pi (for the definitions see V.3.3.3 and V.4.4.5). We know already P2outside-CLPT1 (this is P-utside-CLPT:). From this follows P2-CLPT1 by ind. on I-, and P2-CLPT by ind. on 2. Now we use the fact that 3 is the only argument degree and that, hence, P2-reduction does not create new P2-redices. Compare v.3.3.4, VI.2.4. As a consequence, P2-SN is quite easily provable (for degree correct expressions) even without using norms: namely, if A P2-SN, B P2-SN then A [ B ]P2-SN, by ind. on (1) %34B), (2) length ( B ) . So, as usual, P2-SN by ind. on length (see IV.2.4.1). A fortiori, Pi-SN. Besides satisfies CR, so we can speak about Pi-nf’s. E.g., degree(@ = 2 , &nf Clearly

( B )= [x : a]C

+- &nf

( ( A )B ) = C [ A ].

and 6 commute, so PE6-CR and Pi6-nf’s are defined too.

C(cp) =+ @G-nf(A) = C(+), cp 9 $. Sketch of proof. Ind. on 9. For the induction step we need the following property: F2A , PiS-nf ( A ) = C(cp), A > C or C > A , F C =+ /3;6-nf(C) = C($), cp Q $. If C > A it is easy, (Pi)-i-pp holds here for all kinds of reduction i (see 11.9), so PiS-nf (C) = C($), $ > cp. Otherwise, A > C. Now Pi6 commutes with all other kinds of reduction, except 77; (see 11.8). And it even commutes

3.7. Theorem. F2A

with the latter, except for “outside” domains. Where we define the latter to be the airP j , etc. in (A)[Z : Z] (3)[y’: P] ..., with (A)possibly empty. But there are no “outside” domains left in C(cp). So, in any case, Pib-nf(C) = C($), cp > $. In fact, if A >$, C then cp = $. By Pi6-CL we know that both C(cp) and C($) are correct so from (cp > 11, or 0 > cp) we can conclude cp Q $. This proves the wanted property.

+

Corollary. C(p)

Q

C($)

cp Q $.

0

3.8. Both the theorem and the corollary can be proved in precisely the same manner for II and $, yielding the properties in 3.5. Remark: The theorem above is a kind of minimal result for the desired properties, E.g., we can, alternatively, prove a kind of weak CR2-result as in VI.2.4, or prove a similar but stronger theorem in the spirit of V.3.3, V.3.4.


631

3.9. Now we are able to prove the outside cases of CLPTQ. E.g. for +-reduction. Let ( i l ( A , p ) ) ( F @ G )E y . T h e n i l ( A , P ) E 6 , F @ G EIZ(cp), c p E 6 + r , y’, ( i l (A, p)) cp y. And A E a,a @ p 6, F E a’ + y‘,G E p’ (a’@ p‘) -7’ II(cp). So [x : a’ $ ,O‘]y’ cp, and [x : a‘ @ p’]y’ E 6-7. So (a’ @ p’) q 6 (a@ p), whence a a’,p p’. So (A) F E y’. Further y’ (il(A,P)) [x : a’ @ ply‘ 9 (il(A,p)) cp y, whence (A) F E y too. Similarly for the other variant of +.

-

3.10. Then follows full CLPTl by ind. on F and CLPT by ind. on 2. Besides, we have of course UT and LQ. And we can freely make the language definition somewhat more liberal, as follows. First we can change the &propagation rule into AqB, BJC, FC

AqC.

Secondly we can add the appl. rule, with i 2 1 A E ~ F, * + ’ B q [ x : a ] C =sl-(A)B and drop the degree restriction in the appl. rule 1 (i.e. rule 1.4).

3.11. Now we shall say something about proving CL for AUT-IZ with the extension of Sec. 2.4. Just adding abstr. expressions of degree 1 does not matter at all, we still can get UD’ without any difficulty. Making the language into a +-language (i.e. adding appl-1-expressions too) causes some trouble with the domains in case v-reduction is present. Which can, however, be circumvented as in V.3.3: First leave q1 out, then prove &CL and add 77’ again, 3.12. Finally the extension of Sec. 2.7, i.e. where @-2-expressions are present. If there is also E2-reduction the situation is essentially more complicated, because p and E interfere nastily. But without E~ the proofs of 3.3-3.8 just need some modification: (p+)’-SN can be proved as easy as P2-SN, +‘-CLPT is not difficult either. Then Theorem 3.7 can be proved for (P+)’-b-head-nf’s instead. 3.13. Requirements for the pp-results in 11.9 were: (1) The result of outside-o-reduction is never a $-,an inj- or an abstr-expression.

(2) The result of outside 77 or

E

is never an inj-expression or a pair.

Now we can easily verify them for AUT-IZ using the results of this section. First let (cp,A(l),A(2)) > o A. 1.e. degree(A) = 3, A E C(cp). If A were an C(cp). Theorem abstr-term, then A E n($) for some +. UT states that II($)

D.T. van Daalen

632

3.7 states that n($) 2 C ( x ) for some x. This is impossible. Similarly for injor $-expressions. Or let [z : a](z)A >, A. By PT A E II(cp0) for some cp. If A were an inj-expression, then degree(A) = 3, A E (P @ y) for some lo, y. By UT !J(cp) Q ( p @ y). Use the suitable variant of Theorem 3.7 again (Sec. 3.8), this gives a contradiction.

VIII.4. A first SN-result for an extended system 4.1. I n t r o d u c t i o n The word “extended” in the title of this section refers to the presence of other formation rules than just abstr and appl (and possibly instantiation) and other reduction rules than just P and q (and possibly 6). In the case of AUT-II we are concerned with the additional presence of: (1) pairs and projections, with reductions K and (2) injections and $-terms, with reductions

CT.

+ and

E.

In IV.2.4 we gave some versions of a “simple” (as compared to a proof using computability) proof of P-SN. Then we extended it to Pq using Pq-pp. Afterwards we included 6 as well. Here we stick to the separation of 6 from the other reduction rules. Below we first show (4.6) that addition (1) mentioned above does not cause any trouble: the first version of the “simple” proof of P-SN immediately covers the pn-case. And afterwards, we can include 6 and q by a postponement result again. However, the second addition essentially complicates matters. The presence makes the first P-SN proof fail here, because the important induction on of functional complexity (norm) goes wrong (see Sec. 5.1.2). We add new, so-called permutative reductions (Sec. 4.3.1, (111) in order to save the idea of the proof (5.1.3). These permutative reductions, in turn, complicate the SN-condition, and a way to keep them manageable consists of adding (in 5.1.5) still another kind of reduction, viz. improper reductions (Sec. 4.3.1, (IV)). Our second P-SN proof of Ch. IV can fairly easy be adapted for the present situation, however. We just have to add improper reductions to make the proof work (see Sec. 5.2). For completeness we also include a proof based on the computability method (Sec. 5.3). However, these three proofs just cover the situation with p + ~ - r e d u c t i o nand can, by ext-pt be extended to P K 6 q . Alas, we have not been able to handle E too. We cannot use pp anymore, so we have to include E from the start of the proof on. And none of our methods can cope with this situation. The problems with @ (or V) are well known from proof theory. E.g. Prawitz in [Prawitz 651 first proves normalization for classical propositional logic, where he avoids the problem with V, by defining V in terms of “negative” connectives.

+

+


633

Then, when studying intuitionistic propositional logic, he also needs permutative reductions for proving normalization. By the way, our improper reductions turn out t o be identical with the semi-proper reduction used in the SN proof for arithmetic in [Leivant 751.

4.2. The system AUT-IIo 4.2.1. For brevity and clarity we study a system of terms with the same “connectives” and reductions as AUT-II (so the essential problems with SN become clear) but with a simplified type-structure. It can be compared with the normable expressions of Ch. IV. Later (Sec. 5.4) we extend our results to AUT-II. 4.2.2. Reduced type structure The reduced types or norms (syntactical variables a,P, y, v) are inductively given by:

(1)

T

is a norm.

(2) if a and p are norms, then also a 8 PI a --* /3 and a @ P.

Note: If we write [a]@instead of a + P it is clear that t h e norms of Ch. IV form a subset of the present norm system. We write a --* /3 with the purpose to show that our norms form a simple type structure over a single fixed type, T . This is also true of the norms in Ch. IV. Hence normability results (as in Ch. IV, or as given earlier in [van Benthem Jutting 71b ((?.I)], [Nederpelt 73 (C.3)]for certain Automath variants) can alternatively be proved as follows: the generalized systems under consideration are not essentially richer than simple, non-generalized type theory, in the sense that they do provide the same set of terms of free A-calculus with a type as does a simple, non-generalized system. Compare [Ben-Yelles 811.

4.2.3. Terms of AUT-IIo All terms (syntactical variables A , B, C, ...) have a norm. The norm of A is denoted p(A). We also write A E a for p ( A ) a. Terms are constructed according to: (i)

variables x, y, z, ... of any norm.

(ii)

~ E ~ , A E ~ , B E[ xP: A ] B E a + P .

(iii)

C E ~ + P , A E ~ , B E P( C , A , B ) E ~ ~ P .

(iv)

A E a,B E P

(v) (vi)

*

*

* i l ( A , B ) E a $ P , iz(A,B) E Pea. B E ~ - + P , A E*~ ( A ) B E p . B E a 8 P * B(I)E a,B(z) E P.

D.T. van Daalen

634 (vii‘) [z : A]C E a

+

7 , [y : BID E

0

-+

y

*

([z : A]C @ [y : BID) E

( a $0) 7 . +

These terms can be compared with the 3-expressions of AUT-II. However, there are no constants, no instantiation (and no 6),it has simpler type structure and it has only $-terms of the form [z : A]C $ [y : BID. Below we also consider a variant AUT-lll which has general @-terms. Instead of rule (vii’) it has rule (vii)

B ~ a + y , C ~ p - ++ y B$CE(~$P)+T.

Below, we often omit type-labels in [z : A]B, il(A, B ) ,&(A,B ) and (C, A, B ) , just writing [z]B,il(A), i2(A) and (A, B). 4.3. The reduction rules 4.3.1. We consider four groups of reduction rules.

(I)

The introduction-elimination rules (IE-reductions) 0,7~ and

+‘ (see 2.6).

Rule +‘ is particularly appropriate for AUT-no, i.e. in connection with rule (vii’). For AUT-II1 we rather use rule

+.

(11) The ext-reductions 7,0 and

E.

Here we use the simple unrestricted version of

0: (C,A(l), A(2))

>A

(111) Permutative reductions (p-reductions).

(-+) (A) ( B )([zIC@ [VlD) > ( B )([.I

(4c @ [YI (A) D ) .

(8) ((4([zIC@ [ ~ 1 0 ) ) ( 1 )> (A) (bIC(1)@ [YI D(1))- similarly for (’4-projection. (63) D

=E @F

=+ ( ( A )( [ 4 B@ [zlc))D

> (A) ([XI ( B )D @ [z] (C) D ) .

The general pattern of these rules looks like

O((A)“ZIB @ [YIC))> ( A )([zlC3(B)€3 [YlO(C)) where 0 is an operation on expressions, given in one of the following ways: U ( B )= (A) B , O ( B )= ( B )( E $ F ) , O ( B )= B(1) or O ( B )= B(2). The norms of these B’s are respectively a -+ p, a $ 0 and a 8 p. That is why the rules are coded (-+), ($) and (8). In case the argument of U allows outside (i.e. $-reduction), the p-step does ) $ [y]C) > O ( B [ A ] )= U ( B )[A] < not produce a new equality: U ( ( i l ( A ) [z]B (il(A)) ([z]U(B)$[y]O(C)).Below (6.2), it turns out that, generally, p-equality is generated by 077 &-reduction.

+

The language theory of Automath, Chapter Vlll, Section 4 ((2.5)

635

The above mentioned rules are the standard ones from proof theory. There it is formulated like this: if the conclusion of an V-elimination rule forms the major premise of an elimination rule, then the latter rule can be pushed upward through the V-elimination rule. E.g. our +-rule can be compared with the following proof theoretic reduction:

B

avp

1.1

C Y+6

lo1 D

A

7-6

A

Y

V E

Y

>

C

7-6

[PI A D Y 7 4 6

B

avp

7-6

1.1

6

6

+ E 6 6 Both here and in proof theory the p-reductions are primarily introduced for technical reasons. However, as Pottinger [Pottinger 771 points out there is some intuitive justification for them too. Part of it, that in some cases they do not extend the equality relation, is stated above. It has been suggested to allow other permutative reductions as well ([Pottinger 771, [Leivant 751). However, in [Zucker 741 it has been shown that this spoils SN. (IV) Improper reductions (im-reductions).

( A ) ( [ z : B ] C $ [D y :] E ) > C , (im)

( A )([z : B]C @[y : DIE) > E .

Notice that the set of free variables of the expression can be enlarged by performing an im-reduction. If an inside im-reduction takes place inside the scope of some bound variable, the latter variables have to be renamed in order to avoid any confusion. These reductions can be compared with Leivant’s [Leivant 751 semi-proper reductions, They degenerate to what Prawitz calls immediate simplifications, when z FV(C), resp. y $2 FV(E).

4.3.2. One-step and many-step reduction One-step reduction > 1 is, as well, generated from the main or outside reductions given above, by the monotonicity rules. Then follows many-step reduction 2 from reflexivity and transitivity. 4.3.3. The usual substitution properties are valid, e.g.,

B

>1

B’

A

>1

A’

+ B[A] > I B’[A] and + B[A]1 B[A‘] etc.

D.T. van Daalen

636

4.4. Closure for AUT-IIo 4.4.1. First notice that AUT-IIo is certainly not closed under 0, because of the restrictive rule (vii’). So the proof below is intended for the 77-less case. 4.4.2. Due to the simple type structure it is quite easy to show that norms are preserved under substitution and reduction and hence that AUT-IIo is closed under reduction. 4.4.3. Substitution lemma for the norms. E

2 E

a, A E a, B E

P

+ B[z/A]

p (and B[z/A] a term).

Proof. Ind. on length of B.

0

4.4.4. Reduction lemma for norms. A E a, A

> A’

*

A’ E a (this

includes CL1). Proof. Ind. on the definition of >. For /3 and +’ use the substitution lemma. E.g. let A = (il(A1)) ([z]Az @ [y]A3), A E a , A’ = A2[A1]. Then, for a , so [z]A2 E a1 a, some a t , a 2 , A1 E ai, ([z]A2 @ [y]A3) E (01 @ a 2 ) z E al, A2 E a. So Az[Al] E a , q.e.d. Or a permutative reduction: A = ((Ai) ([$]A2 @ [YIA3))(1), A E a , A’ = (Ai) ( [ ~ l A z (@~ )[Y]AB(,)).Then for Some P, Q I , 0 2 , (Al) ([zc]Az@[~]A3) E Q@P,x E 01, E a2, Ai E L Y I @ ( Y Z , A2 E a@P,

-

+’:

+

A ~ E c Y @ S@O. A ’ E C Y . 4.4.5. Theorem (Closure). A E a , A 2 A’ (without 77)

0

+ A’ E a.

Proof. Ind. on 2.

0

4.5. The system AUT-II1 4.5.1. Instead of rule (vii‘) it has the rule

BEa-y,

+

C€@+-, + B@CE(a@P)-y

and it has instead of +‘. Of course (vii’) (vii), so indeed AUT-II1 contains AUT-no. We can define a translation cp from AUT-IIo to AUT-II1 such that cp(A) & A and which shows that AUT-II is not a very essential extension of AUT-IIo. The translation is given by ind. on length. The only nontrivial clause is cp(C1 @ C2) = [z : Ma] (z) cp(C1) @ [z : M p ] (z) cp(C2), where C1 @ C2 E ( a @ 0) -+ y and Ma, M p are suitable fixed expressions of norms a , P and z, y are chosen of norm a , P such that z 6 FV(Cl), y 6 FV(C2), respectively, A. On variables, cp acts like identity. For the rest, cp just commutes with the formation rules. Clearly, cp leaves the norm invariant and is indeed a translation into AUT-IIo.

*

The language theory of Automath, Chapter VIII, Section 4 ((2.5)

637

4.5.3. In the sequel we prove SN for some versions (i.e. with and without p-red. etc.) of AUT-no. By the above properties we can easily extend the pand im-less case to AUT-IIl: AUT-IIo SN (with +') =+ AUT-II1 SN (with +). Proof. Let A be an AUT-lI1 term. Use ind. on 6(cp(A)).

+

0

+

But, from SN with follows SN with and +', because each +'-step can be simulated by a and a &step, so I?+decreases under +'-reduction, And, because AUT-IIl contains AUT-IIo we also get SN for AUT-IIo with and

+

+

+'.

4.5.4. The postponement requirements For AUT-no- and AUT-II1expressions it is quite straightforward to show the requirements (l),(2) of 3.13. E.g. let (A(*),A(z)) > A. Then A E Q @ p. So A is not an inj-term, a @-term, or an abstr-term. Etc. 4.6. The first order character of the systems 4.6.1. In [van Daalen 80, IV.1.51 we emphasized the importance of the property

p((A1) B ) = p((A2) B ) , in particular p((A1) [XI&)

= p(A2)

i.e. the functional complexity of (A) B does not depend on the argument A. Alternatively stated: it is of course possible that the different values of B have different types, but apparently there is a strong uniformity in these types, for the functional complexity of all the values is the same. In fact, we defined a system to be first-order if this property was present.

D.T. van Daalen

638

Generally, the introduction of $-types and $-terms might spoil this uniformity: we might be able to define functions completely different on both parts of their domain. So, by “general” $-functions the first-order property above gets lost. However, in AUT-Ilo, AUT-IIl and in AUT-II the domain of $-functions is explicitly restricted in such a way, that the first-order property can be maintained, viz. by requiring

4.6.2.

(1) in AUT-IIo that p ( B )= p(C) when forming [ z ] B~3[y]C. (2) in AUT-Ill that B E

cy

(3) in AUT-II that B E a

-+

-+

y,C E /3

-+

y when forming B

$ C.

y,C E ,B -+ y when forming B $ C.

As a consequence we still have p((A1)B ) = =4C).

= p ( ( A 2 )B ) and

in particular

P ( ( A )([4B63 [YlC)) P(B)

4.6.3. Now it will be clear that the generalized $-rules of 2.7 would spoil the first-order character. Example: let A E T , B E T , C E T , D E T , then [z : A]C E A -+ T , [z : B ]D E B -+ T . So [z : A]C @ [z : B]D E ( A @ B ) + T . So, if E E A -+ C , F E B -+ D , then ( E $ F ) E Il([z: A]C$ [z : B]D ) . Clearly the functional complexity of ( i l ( G ) () E $ F ) for G E A and ( i z ( H ) )( E @F ) for H E B can be completely different, viz. that of C and D respectively.

It is possible that a notion of norm (i.e. simplified type) can be defined which is manageable and measures functional complexity of these general $-terms, but the present norm (and the corresponding SN proof) is certainly not suitable for this situation. 4.6.4.

4.6.5. Remark: Strictly speaking, the suggested connection between the typing relation in AUT-II and the norms in AUT-Ilo has not yet been accounted for. The preceding statements have to be understood on an intuitive, heuristic level. 4.7. A proof of Pmp-SN 4.7.1. Here we show that the first P-SN proof of Ch. IV straightforwardly carries over to the case of Pqa-SN. As our domain of expressions we take, e.g.,

the terms of AUT-IIl. SN-conditions for PT For non-main-reducing expressions (also called immune forms or IFs) it is sufficient for SN if all their proper subexpressions are SN. Incidentally this is also true for projection expressions (because main .ir-reduction amounts to picking a certain subexpression). So we have: A SN A(l) SN, and the funny property: A(l) SN e A(2) SN. 4.7.2.

*


639

We recall the SN condition for appl expressions in this case:

( A )B SN e A SN, B SN and ( B 2 [x]C + C [ A ]SN) . 4.7.3. Heuristics: the dead end set of P So, the substitution theorem for SN is again sufficient for proving SN (see IV.2.4). The crucial case of the substitution theorem for P-SN was where A is SN, B = ( B I )B2 is SN, B2[Az]2 [y]C,but B2 2 [y]Co. 1.e. the reduction to square brackets form depends essentially on the substitutions. Then we used the square brackets lemma: B2 2 ( F ) x ,

[A1 2 [YlC. We define the set &, of these expressions ( F )x symbolically by a recursion equation Ex = x (U)Ex,where U stands for the set of all expressions and it is of course understood that all expressions in Ex are in AUT-IIl again. The expressions (p) x can be considered as dead ends when one tries to copy in Bz the contractions leading from B2[A]to [y]C,i.e. when one tries to come “as close as possible” to an abstr expression. We do not bother to make the concept of dead end more precise, or more general, but just give this informal explanation for naming Ex the dead end set w.r.t. x, P-reduction, and abstr expressions. (($)XI

+

4.7.4. The dead end set of PT When one tries to copy a @r-reduction sequence of B[A]in B one need not end up with an expression in Ex,but, e.g., . following theorem states that F defined by can also end in x ( ~ )The

3=2

+ 3 ( 1 ) + F(2)+ ( U )7

is the dead end set w.r.t. x, PT and immune forms (IF’S).Let 2 stand for 2 p r , and let * stand for [z/A]. Theorem. If B SN, B* 2 C , C E IF then B 2 CO, C; 2 C with either (i) C; non-main reduces to C, or

(ii)

co E 7 .

Proof. Just like the square brackets lemma (second proof, IV.2.4.3), by ind. on

(1) d ( B ) , (2) 1(B). Let B* main-reduce to C (otherwise take B = CO). Then B = z, (and take Co = B , Co E IF), B = D(1),B = D(2)or B = (01)D2. E.g. let B = D(l). Then D* 2 ( D I ,D z ) , D1 2 C. Apply ind. hyp. (2) to D. In case (i), D 2 ( E l ,Ez), Ef 2 D1, E,* 2 Dz,so B 2 E l , E; 2 C. Then apply ind. hyp. (1)t o E l . In case E F,E o ( ~=; E;(,) 2 C , so (ii), D 2 Eo, EO E 3,E6 2 (D1,Dz)and B 2 Eo(,, 0 case (ii) holds for B too.

640

D.T. van Daalen

Remark: (1) Similarly we can prove a more general outer-shape lemma (see 11.11.5.4) for Pr, where the condition “C E IF” simply has been dropped.

(2) It is probable that such “standardization-like” theorems can also be proved without using SN (as in 11.11).

4.7.5. Heuristics: the norms of dead ends The point of the P-SN proof is:

B E EZ

* G 4 B ) )I@(z))

-where 1 is the length of the norm -. So, if B[A]2 [y]C,then 1 ( p ( y ) ) < l ( p ( z ) ) , and we can use ind. on norms in the crucial case of the substitution theorem. We are lucky that the same method works for Pr-reduction too. Namely

4.7.6. The substitution theorem for PA-SN Theorem. A Or-SN, B Pr-SN B [ x / A ]Pr-SN. Proof. Ind. on (1) p ( A ) ,(2) 19pT(B),(3) l ( B ) . Let 2 be 2 p r . If B = z then B[A] = A so SN. If B E IF or B = C(l) or B = use ind. hyp. (3). If B = (B1)B2 proceed as for P-SN, using the norm properties of the dead end set F. 0 4.7.7. Pr-SN and Prqu-SN An immediate corollary of the substitution theorem for Pr-SN is Pr-SN itself. Now we can extend this to Prqo-SN (as in 11.7.2.5) using (Pr)-(qa)-pp, a case of ext-pp (see 11.9.2). The requirement for pp is indeed fulfilled (see 4.5.4). VIII.5. Three proofs of Pr+-SN, with application to AUT-II 5.1. A proof of P.rr+-SN using p- and im-reductions 5.1.1. Here we show how the preceding SN-proof (based on the first version of the simple P-SN proof in Ch. IV) has to be modified in order to cope with (or +’). First we shall see how the norm considerations of that proof do not go through.

+

The language theory of Automath, Chapter VIII, Section 5 ((3.5)

5.1.2. The dead end set for ,Or+ Let 2 be 2pA+. The following theorem states that the set

64 1

G defined by

G = x + G(1) + G(2) + (U)G + (0) (UCB U) is the dead end set w.r.t. x , / 3 ~ +and IF’S. Let * stand for [z/A]. Theorem. Let B be SN, B’ 2 C , C E IF, then B 1 Co with either ( 1 ) C$ non-main reduces to C , or

(2)

c,. 2 c, co E G .

Proof. As in 4.7.4, by ind. on

(9 (ii) 1(B).

CI

Similarly, we can prove the corresponding outer shape lemma. The problem is now that the norm of the expressions in G is not related t o the norm of x. E.g. consider the typical +-dead end (z) ( B CB C ) .

5.1.3. Improving the dead end set by p-reduction We restrict our doBesides main of consideration to AUT-&. Instead of rule we choose rule we add permutative reductions. Then a great deal of the “bad guys” among the dead ends, i.e. whose norm is not related to that of x , can be main reduced by a p-reduction. This will (in the next section) result in an improved dead end set ?-tdefined by

+

+ (F)(U@ U)

? =F i

+‘.

with F as in 4.7.4 .

5.1.4. Let 2 be p+’p-reduction. The direct reducts of a p-main step are of the (see 4.3.1 for the definition of U ) ,so never are in form ( A )( [ z ] Q ( B@) [g]O(C)) one of the immune forms (abstr, inj, pair, plus). Lemma. p-main reduction steps in a reduction to IF can be circumvented.

Proof. The last p-main step in a reduction t o I F must be followed by a +’-main step. However, this combination can be replaced by a single internal +’-step. 0 Corollaries. ( 1 ) ( B )([.]GI @ [ x I C ~2) D , D E IF

(2) ( B ) C 2 D , D E IF

+

+

B 1i j ( A ) ,Cj[A]2 D ( j = 1,2).

Either (i) C 2 [PIE,E [ B ]2 D or (ii) B 2 i j ( A ) ,

C L ([x]C1@ [z]Cz),Cj[A]2 D,( j = 1,2). (3) B(j) 2

D,D E I F

*

B 2 (C1,Cz), Cj 2 D ( j = 1,2).

D.T. van Daalen

642

Proof. Each of these reductions to I F can be replaced by one without p-main 0 steps. Part of the two corollaries can be summarized (with U as in 4.3.1) by: if

U ( B ) > D , D E I F then

B>C, CEIF, O(C)>D

This gives another lemma. Lemma. ZfU((B) ([z]C1@ [z]C2))2 D , D E IF, then

( B )([.10(Cl)

@

[.lc3(CZ)) 2 D.

Proof. (B) ( [ z ] G fB [z]C2)2 E , E E IF, U ( E ) 2 D. So B 1 i j ( A ) ,Cj[A]2 E . 0 But then (B) ( [ z ] O ( C l@) [z]U(C2)) 2 U ( C j [ A ]2) U ( E )2 D , q.e.d. This proof amounts to: if an expression allows both p- and IE-main reduction then we can insert p-main followed by +'-main before performing the IE-main step. Now we prove the theorem about the improved dead end set H. Let * stand for [ z / A ] . Theorem. Zf B SN, B* 2 C , C E IF, then B 2 CO,C$ 2 0 with (1)

c$non-main reduces to c,or

(2)

co E H.

Proof. As in 4.7.4, by ind. on (i) O(B), (ii) 1(B). Here 19 refers to the current reduction PT+' p. let B* main reduce to C , B f z. If the first main step can be mimicked in B use ind. hyp. (i). Otherwise, by ind. hyp. (ii) B 2 U ( D ) ,D E H , U ( D ) * 1C. If D E 3,then O ( D ) E 3-1 and we are done. Otherwise D = ( 0 3 ) ([y]D1@ [y]D2),0 3 E 3. Then B properly reduces t o E = ( 0 3 ) ([y]U(D1) @ [y]U(Dz)), E E H , and by the previous lemma E" 2 C , q.e.d. 0 5.1.5. Improving the SN-conditions by im-reduction The crucial SNcondition for @T+' (in AUT-IIo) is: If

(1) A SN, B SN, (2) B 2 [ z ] C =+ C [ A ]SN and for j = 1 , 2

(3) B

1 [.]Ci

@ [.]Cz,

A 2 ij(D)

* Cj[D]SN,

then is ( A )B SN. Now the p-reductions have improved our dead end set, but the problem is that

The language theory of Automath, Chapter Vlll, Section 5 (C.5)

643

they make the SN-conditions quite complicated. E.g. in order to prove that ( A )( B )([x]Cl@[x]Cz) is SN we need that ( A )C1 is S N , in particular if C1 2 [y]E we need that E[A]is SN etc. 1.e. the SN-condition of ( A )B ceases t o be easily expressible in terms of direct subexpressions of reducts of A and B. In order t o solve this problem we add im-reduction. But at first we show that the dead end set is not changed by this addition.

5.1.6. T h e dead end set of Pr+'p,im Luckily the dead end set remains 3-1. Let 2 stand for 2pn+fp,im. The first lemma of 5.1.4 can be maintained. For let a p-main step be followed by an im-main step. Then we can skip the main p-step and just apply the im-step internally. The next corollaries need a n obvious modification, in particular: If ( B )([z]C1@ [z]Cz)2 D , D E IF, then either (1) B 2 ij(A),Cj[A]2 D (for j = 1 or j = a), or (2) Cj 2 D (for j = 1 or j = 2). And the property thereafter becomes: E IF,then either

If O ( B )2 D , D

(1) B 2 C , C E IF, O ( C ) 2 D ,or (2) O ( B )E (€3) ([z]Cl@ [x]Cz),Cj 2 D (for j = 1 or 2). But the second lemma of 5.1.4 remains unchanged. Namely, if an expression allows p-main reduction but also im-main reduction, then we can insert p-main followed by im-main before performing the im-main step. E.g.

So, the theorem of 5.1.4, that the dead end set is still 3-1, carries over too. 5.1.7. The new SN-conditions The point of the im-reduction is that the SN-conditions for Pr+'p,im are identical with those for PT+' (see 5.1.5). First we give the SN-conditions of ( B )([x]C1C6 [x]C2).These are (1) B S N , C1 SN and Cz SN, and

(2) B 2 ij(A)

*

Cj[A]SN (for j = 1 and 2).

D.T. van DaaJen

644

Proof. Let the above condition be fulfilled. Use ind. on (1)f l ( B ) , (2) l(B). The interesting case is when the first main step in a reduction is a p-step. So let B 2 (B3)([y]B1@[ Y ] & ) , to prove that ( B 3 )( [ Y ](BI)C @[Y] ( B z )C ) is SN, with C E [x]Cl@ [x]C2.By ind. hyp. (1) or (2) we just need that B3 is SN (trivial), that ( B j )C SN for j = 1 , 2 and that ( B j [ D ]C) is SN, where B3 2 i j ( D ) . Since B properly reduces to both Bj and Bj[D](in case B3 2 i j ( D ) ) we can use ind. 0 hyp. (1) and get what we want. Theorem. The SN-conditions for P.ir+’p,im are identical with those of PT+’ (see 5.1.5). Proof. Let ( A )B fulfill the SN-conditions (l),(2), (3) of 5.1.5. We use ind. on fl(B). The interesting case is when the first main step is p. The case that B 2 [x]B1@ [x]B2has been done before, so let B 2 (B3)([5]B1@ [z]B2),to prove that (B3)( [ z ]( A )B1 @ [x]( A )B2) is SN. 1.e. that B3 SN, that ( A )B1 and ( A )B2 SN and that ( A )B1[D],( A )&[D] are SN whenever B3 2 i j ( D ) ( j = 1 or 2). Now B properly reduces to both Bj and Bj[D](if B3 2 i j ( D ) ) so we use the ind. hyp. and get what we want. In other words: we just need that the direct subexpressions and the IEmain reducts (not all the main reducts) are SN for proving that a n expression is SN. 5.1.8. The substitution theorem for SN Notation: We just write p(A) < (resp. 5 )p ( B ) to abbreviate < (resp. 5 )W B ) ) . G@)) B[x/A]SN. Theorem. B SN, A SN, p(x) = p(A)

*

Proof. Ind. on (1) F(A), (11) fl(B), (111) l ( B ) . The crucial case is when B = (B1)B2 and B[A]IE-main reduces. If this first main step can be mimicked in B use the second ind. hyp. Otherwise we end up with ( B i )C or (C)Bb with C E 7-l and BI 2 B: or B2 2 B: f [y]D1@[y]Dz, respectively. If C E 9, then p ( B i ) < p(C) 5 p ( x ) so a first main reduction of ( ( B i )C) [A]involves a substitution [ z / E ]with p ( z ) 5 p ( B i ) < ~ ( 5 )And . a first main-IE reduction step of ((C)Bb) [A]must be a +’-step, so involves a substitution [ z / E ]with C[A]2 i j ( E ) . So in that case too p ( z ) = p ( E ) < p(C) 5 ~ ( 5 ) . Anyhow if C E 8, we can use ind. hyp. (I). Otherwise C = ((73) ([y]C1@ [y]C2),


645

with C, E B. Then a p-step is possible and can be inserted before doing the main IE-step. This p-step can be mimicked in the reduction of B, so we can use 0 ind. hyp. (11). 5.1.9. SN for AUT-IIo and AUT-IIl Like before, an immediate corollary is Pr+’p,im-SN for AUT-no, so Pr+’-SN for AUT-no, whence Pr+-SN for AUTII1. Then by pp we can extend the AUT-II1 result to PT va-SN. (Not for E . )

+

5.1.10. An alternative method Actually im-reduction can be avoided in this proof. Namely the effect of p-reductions on the SN-conditions can be expressed by means of certain inductively defined sets. We define a set of expressions B! by

B! = B

+ ( U )([XI( B ! )@ U ) + ( U )(U @ [XI ( B ! ) )

1.e. B! contains all those expressions that im-reduce to B. Then the SN-conditions for PT+’ become: If (1) B SN,

c SN,

(2) B 2 B’ E A!,C 2 C‘ E ([y]D)! + D[A]SN, and (3) B

L B’ E (ij(A))!, C 2 ( [ ~ ] C CB I[ ~ ] C Z* ) ! Cj[A]SN ( j = 1,2),

then ( B )C SN. 5.2. A second proof of Pr+’-SN, using im-reduction 5.2.1. This proof is based on the second instead of the first P-SN-proof of Ch. IV (Sec. IV.2.5, see also VII.4.5). There we did not use the square brackets lemma, and no dead end set, so we can do without p-reduction. Our language is AUT-IIo, again, and >_ stands for >_ Pr+’,im. 5.2.2. Replacement theorem for SN As explained in VII.4.5, the kernel of this type of proof is a replacement theorem, rather than a substitution theorem, for SN. Theorem. If B SN, A SN, ~ ( 2I)p ( A ) , then B[z/A]LRSN. Proof. By ind. on

(1) fi(A), (11) d ( B ) , (111) l(B).

646

D.T. va.n Daalen

We write * for [x/A]LR. Consider a reduction sequence B* >1 ... >1 F >1 G, where the contraction leading from F to G is the first contraction not taking place inside some reduct of one of the inserted occurrences of A. Realize first that the number of those inside-A contractions is finite, because A is SN. Now we prove that G is SN. Distinguish two possibilities: (a) The step F > I G does not essentially depend on the inserted A's and can be mimicked in B. 1.e. B >1 Go, G: 2 G. In this case we use ind. hyp. (11). (b) Otherwise some reduct of some inserted A plays a crucial role in the redex ~ ) B* E contracted. If G F > G is a r-step, then, e.g., B = ...x . . . x c ( ..., ... A ...A(l) ..., F = ...A' ... (Cl,C2)(,)..., G = ... A' ... C1 .... Now form BOE ...x ...y ... from B by replacing x ( ~by) a fresh y, with p ( y ) = a1 (wherea! E a ! ~x a2). And B _= Bo[y/z(l)] so BOis SN, ~ ( B o 5 )8(B),~ ( B o ( E , F ) + C > E , D > F .

D.T. van Daalen

648

(3) ij(C) 2 i j ( D ) =+ C 2 D (j= 1 , 2 ) .

(4) C @ D > E @ F =+ C > E , D > F . Proof. Without main reduction it is trivial. Otherwise it is or cr. E.g. if (C, D ) 2 ( E , F ) ,then C 2 ( E , F ) ( 1 )2 El D 2 ( E , F ) ( 2 2 ) F q.e.d. By the 0 way, Property (4) even holds in the presence of E . Lemma (computability conditions). (0) variables are in C .

(1) A S N , C E C , D E C =+ ( A , C , D ) E C . (2) A SN, C E C

*

il(C,A ) E C , i2(C,A ) E C .

(3) C E C , D E C =s C @ D E C .

(4)

cEc *

C(1) E

c, C(2) E c .

+

(B)CEC.

(5) B E C , C E C

Proof. (0) is clear. ( l ) , (2), (3) by the previous lemma. (4) as follows: Let C E C , then C SN so C(j) SN. If C(j) 2 [y]D,then C 2 (C1,Cz) with Cj 2 [y]D. Each of the Cj is in C , so [y]Dsatisfies the required condition. Similar if C(j) 2 (01, D z ) ,C(j)2 i l ( D ) etc. Proof of (5): Let B , C E C so B, C SN. Induction on ,u(B). We first check the SN conditions. Let C 2 [y]Dlthen D[B]E C so SN. Or let B 2 i j ( D ) ,C 1 C1@C2, to prove that ( D ) C j is SN. Well, both Cj’s are in C , D E C and we can use the ind. hyp. to prove that ( D ) C j E C (so SN). Further, if ( B ) C 2 [ y ] E(or reduces t o ( E ,F ) etc.), this is only possible after a main step, so either via some D [ B ]with C 2 [y]Dor some ( D )Cj where B 2 i j ( D ) , C 1 C1 @ C2. Those expressions were in C so [ y ] E(and ( E ,F ) etc.) satisfy the required conditions. 0

5.3.5. Computability under substitution For expressions [y]Csuch simple computability conditions cannot be given. We define an even stronger notion than computability. Definition. B is said to be computable under substitution (cus) if

A ~..., , A, E

c,

p(zi)

=p

( ~for~ i )= 1,...,

=s

B[z/A’I E c .

Some easy properties are (1) B Cus

+ B E C (e.g. take n = 0), and

(2) B Cus, B 2 C =s C E C .

0

The language theory of Automath, Chapter VIII, Section 5 (C.5) Then a lemma. Let p ( C ) G

c E C,l+,Z

+ QZ

and let F E C,,

+

649

(F)C E Ca2. Then

.

Proof. Clearly C is SN. We use ind. on l(a1). If C 2 [ y ] D ,F E C,,, we must prove D [ F ]E CaZ. This holds because ( F )C 2 D [ F ] . If C 2 D @ E we must prove that D , E E C. For il(F) E C,,, ( i l ( F ) ) C E C so (F)D E C. Now use the 0 ind. hyp. Similar for E. 5.3.6. Lemma. B Cus, C Cus j[y : B ] C Cus.

Proof. Let C Cus, B Cus, A' E C of the right norms. Abbreviate [?/A'] by *, We must prove that [y : B*]C*E C. Well, B* E C, C* E C so [y : B*]C*E SN. If [y : B*]C* 2 [p : DIE, F E C of the right norm, then we need that E [ F ]E C. Because C is Cus, C[3,y / x , F ] E C, which expression reduces to E [ F ] q.e.d. , In particular, if C* L (y) (El @Ez), y $! FV(E1 @Ez),we have that (F)(EICBE~) E C, so by the previous lemma El@&E C, El E C, EZ E C, q.e.d.0 Theorem. All AUT-II1 expressions are Cus. Proof. Variables are Cus by definition. Further use induction on length. For the abstr case use the previous lemma. For all the other cases use the lemma in 5.3.4. E.g. to prove that ( B ) C is Cus. Let * be as in the previous lemma. By 0 ind. hyp. B* E C, C* E C, so ( B * )C* E C. Corollaries. (1) All AUT-nl expressions are computable.

(2) All AUT-nl expressions are PT

+ qa-SN.

0

5.4. Strong normalization for AUT-II 5.4.1. The normability of AUT-II In order to extend our results from AUT-IIl to AUT-II we must first extend our definition of norm (see 4.2.3), and implicitly, of normability, as follows: p(7) E 7

p(A) G

Q + /3

p(A) = a

+

+

p ( I I ( A ) )G Q

,B =+ @ ( A ) )

+

,B

= a 8 ,B

A , B of degree 2 + p ( A @ B ) = p ( A ) @ p ( B ) . And we must say what the norms of the variables are P(2)

:= P ( t Y P ( X ) ) .

D.T. vaa Daalen

650

Our definition of normability, here, is modelled after the normability definition of AUT-QE (weak normability), in particular as far as the handling of 2-variables is concerned. For details see IV.4.4-IV.4.5. First we define norm inclusion c: (1) a a norm (2) a c

P

*a c

7.

=+ ( Y - + @ )

c (-/-+PI.

Then we say that A fits in B (notation A f i n B ) if degree(A) = 3

* p(A) = p ( B )

degree(A) = 2 =+ p(A) c p ( B ) . Now we define the norm of constant expressions Afin

c‘[A +

p(c(A))

:= p( typ( c)[A)

Afin

c‘[d *

p(d(A))

:= p ( t y p ( d ) [A])

where 5 E c‘ is the context of the scheme, in which c (resp. d ) was introduced. We want to show that correct expressions are normable, and of course that whenever A E B , A fits in B. In view of the instantiation rule and the fact that norms can change under substitution (for 2-variables) we prove, as in Ch. IV.4.5 a kind of normability under substitution. Theorem. If f i n g[A, f E B’ I- C E D , then C [ d f i n D [ A (note that “fitting in” implies the normability of the expressions involved).

A

Proof. Ind. on correctness.

0

Corollary. I- C E D

0

C f i n D (so, C, D normable).

5.4.2. Note: By the above defined concept of normability lots of expressions become normable which are certainly not correct in AUT-ll. E.g. p ( B ) , and (C(B))(i),with p ( B ) Pi P2. (A) (n([z: BI C)), with p(A) This is a consequence of the fact that AUT-II is handled just like AUT-QE: IIk are (as regards norms) ignored, and C’s are in some sense identified with pairs. +

E x t e n d i n g the SN-result to AUT-ll Clearly the presence of nonreducing constants such as C, II (for 2-expressions), and T does not harm the SN-results of the previous sections. We just have to add &reduction. The substitution (resp. replacement) theorem for SN can easily be extended because &contractions in B [ x / A ] ( L Reither ) take place inside A or can be mimicked in B already. Then we can proceed as in IV.4.6 or directly prove B normable B SN, by ind. on 5.4.3.

*


65 1

(1) date(B). [For a definitional constant, date(d) = date(def(d))+l. The date of an expression is the maximum of the dates of the definitional constants that occur in it. So, induction on date can be considered “induction on definitions ”.] (2) l ( B ) . [The length of B.] The new case is when B = d ( 6 ) . The Ci’s are SN by ind. hyp. (2). Further we want that def(d) [C?] is SN. Well, def(d) is SN by ind. hyp. (1) and def (d) = def(d) [Cl]... [Cn]. So by iterated use of the substitution theorem we are done. Later we can add q , by pp. Alternatively we can extend the SN proof by computability to the present case, viz. by leaving the definition of computability unmodified and prove computability under substitution by ind. on (1) date, (2) length. In particular let A l l ...,Ah E C of the right norms, let * stand for let B,*,...,B; E C. Then we must prove that d(@* E C. The Ba’s are SN. By ind. hyp. (1) def(d) is Cus, so def(d) ($1 E C, so SN. Further, if d(B*) 2 [y]E or (ElF ) etc.) then this reduction passes through def (d) [B*](which was in C). So, finally we have PT uq6-SN for AUT-ll.

[e]

[Z/d,

+

VIII.6. Some additional remarks on AUT-II 6.1. The connection between AUT-QE and the abstr part of AUT-II Here the abstr part of AUT-II is the part generated by the general rules (2.2.1, 2.2.2) and the specific rules group I (2.3). If it were not for the role of rI,and the rule of product formation, this part of AUT-II would be identical to AUT-QE. In the introduction to this chapter we mentioned already that the rule of type-inclusion is somewhat stronger than the rule of product formation. This means that the obvious translation of AUT-II, viz. just skipping the II’s produces correct AUT-QE, but not all of AUT-QE. Namely without II, the rule of product formation becomes

+

cpE[z:a]~

(1)

VET

which is just a specific instance of the type-inclusion rule cpE[$:fl[x:a]~+ cpE[y’:fl~.

(11)

Let us see whether sensible use of (I) can yield something like (11). So let +

cp E [y’ :

p’ I- (5) cp E [z : 1217 (where Y consists of the yi’s So by (I) y’E $ I- ( i cp ) E 7 ,and by iterated use of the

[z : 1217.Then y’ E

in the reversed order). abstr rule we get k cp+ E

= [y’: P] (Y) cp. - 9 -

T

with cp+

Clearly

D.T. van Daalen

652

cp+

1; cp

which indicates that AUT-QE is not a very essential extension of the image of AUT-II under the translation. Compare [de Bruijn 771, [de Bruijn 78c (B.4)]. 6.2. The CR problem caused by E In Ch. I1 we gave a counter example for PE-CR. Namely [z]z and [y]il(y)@ [y]iz(y)are distinct PE-equal normal forms (just two different ways to write identity on a @-type). This suggests to save CR by adding E alt (see 2.6)

[.]B[i1(z)] @ [z]B[iz(z)l> [ z ] B*

+

However, E alt and interfere in a nasty way: [z](... (z) F ...) @ [z](... (z) G ...) s [z] (... (z) (FBG) ...), so this does not help. In principle, CR is not too important for our purpose, we rather need a good decision procedure for definitional equality. Just like (in V.4) we suggested to implement 17-equality by the rule (z) F 9 G

*

F 9 [z]G

we conjecture here that we would generate full equality (including

E)

by adding

( i i ( ~ )F) Q (z)G , ( i z ( ~ )F) Q (z) H =+ F Q G @ H . But in order to guarantee the well-foundedness of such an algorithm, we need of course some kind of strong normalization result, which applies in the present situation. The general pattern of the counterexample to E alt-CR reads

[z10((4F ) @ [510((5)G) Q [z10((4(F@ GI) where 0 is a very general operation on expressions. This shows that extensional equality generates the equality induced by permutative reductions (Sec. 4.3) O ( ( 4([ZIB@ [zIC))Q ( 4[40((4 ([zIB@ [zlC))Q ( 4([z10((4[zIB)@ [z10((4[zIC))Q (’4([zIO(B)@ [z10(4). E.g.3

( D ) ( A )([zIB@ blc)
+’+’ ( 4([XI ( D )B @ I.[ ( D )4,q.e.d. Conversely, we might generate part of the &-equalityby adding general permutative reductions, paying due attention to the thus arising SN problem.

6.3. The SN-problem caused by E We strongly believe that SN holds for the full AUT-ll reduction (including E ) , and that there are just some technical problems which prevent the proofs of


653

the preceding section to apply to that situation. We briefly sketch why each of the three proofs fails in presence of E . The problem with the first proof (5.1) is that the dead end set for, e.g., PE-reduction is not so easy to describe. E.g. [ y ]((il(y)) z) F @ [y]( i 2 ( y ) )F is a typical dead end for PE. Of course Pv- or Do-dead ends are not manageable either, but a77 can be included afterwards, using pp. Then the second proof (5.2). An c-redex [ y ]( i l ( y ) )F @ [y]( i z ( y ) )F can be created by substitution [z/A]in two different ways:

(1) from z @ [y](iz(y)) F , A part) 1

[ y ]( i l ( y ) )F (and similar with the right hand

(2) from [Y]( i l ( y ) )FI @ [yl ( h ( y ) )Fz, F l [ A ]= F , F2[AI = F . In case (1) we are suggested t o replace z @ [ y ]( i l ( y ) )F by a single variable z , and t o introduce a new substitution [ r / F ] . However, l ( p ( z ) ) > l ( p ( z ) ) ,which does not fit in the proof at all. But we can remove this case by just considering AUT-no. Case (2) does not pose a problem: the substitution plus reduction can be simulated by reduction plus substitution, starting from [y](il(y)) Fo @ [ y ]( 2 2 ( y ) ) Fo, where both F1 and F2 can be constructed from FO by substituting A for some of free z’s. Besides, the second proof is based on replacement. This means that the E-redex above can also be created from, e.g., (3) [YI

(4F @ [YI (i2(v))F , with A = i l ( Y ) , or

These two expressions do not reduce, unless we switch to a generalized form of (which does not solve the problem, though - see below). Finally the computability method (5.3) fails because the property: F E C, G E C + F @ G E C is not so easy anymore. For, let F 2 [z]( i l ( z ) [) y ] D ,G 2 [z]( i ~ ( z[)y)] D .Then we just know that A E C D [ i l ( A ) ]E C , D [ i z ( A ) ]E C , but we want that D [ A ]E C for general A E C. We have tried to adapt the second SN-proof to this situation, viz. by restricting to AUT-no, and by introducing a liberal version of &,It, named 8.

Ealt

*

E’

:

> [YIF. [ p ] F ( i i ( y )@] G > [ y ] F G @ [P]F[~(Y)I

This can be considered a kind of improper reduction in the sense that it identifies expressions which in the intuitive interpretation do correspond to different objects. A typical way of creating a new &-redex is, e.g., from (y]z @ G by the replacement [ z / 2 1 ( y ) ]reducing ~~, to [yly. One can indeed mimick this by first reducing to [ylz, and then apply a new replacement, viz. [z/y].But the norm of this new z is longer than that of the old one.


655

The Language Theory of A,, a Typed A-Calculus where Terms are Types L.S. van Benthem Jutting 1. INTRODUCTION

In the present paper we present the theory of a system of typed A-calculus A,, which is essentially the system introduced in [Nederpelt 73 (C.3)]. Its characteristic feature is that any term of the system can serve as a type. The main difference between the two systems is that our system only allows for @-reduction, while Nederpelt’s system has 7-reduction as well. The importance of A, lies in the fact that it may be considered as basic to the Automath languages. Therefore its theory can also be seen as basic to the theory of Automath [ d e Bruijn 80 (A.5)], [van Daalen 801. In our notation we will follow the habits of Automath, that is: for terms u and v, types

(Y

and variables z we will denote

Azauby[s:a]u and

(u.1

by

(4..

The system consisting of such terms will be called A. The system A, is the subset of A to which a term ( u ) v belongs only if v is a function, and if the domain of u and the type of u have a common (@-)reduct. Our main theorems will be:

(1) Church-Rosser for A. This will be proved along the lines of well-known proofs by Tait and Martin-Lof [Martin-Lof 75al. (2) Strong normalization for a subsystem of “normable terms” in A. Our proof will be along the lines of proofs in [Gandy 801 and in [de Vrijer 87c] for strong normalization in simply typed A-calculus.

(3) Closure of Am under (@)-reduction. For this we have a new direct proof, though the theorem has been proved previously in [van Daalen 801, see [C.5].


656

Moreover, we prove that the terms of Am are “normable” in the sense intended above; therefore those terms strongly normalize. This, together with correctness of types, implies that Am is decidable. In our presentation we will use “nameless variables’’ as suggested in [de Bruzjn 72b (C.2)]. That is, our variables will not be “letters from an alphabet” but “references to a binding A”, or rather, because of our notational habits, “references to a binding square brackets pair”. In order to grasp the use of nameless variables one should note that terms can be interpreted as trees. Consider e.g. the term:

.1 : 4 (4[v : PI (9)2 The corresponding tree is

.

Figure 1 In this tree the bindings may be indicated by arrows, omitting the names of the variables:

Figure 2

The language theory of A,

(C.6)

657

And here, again the arrows may be replaced by numbers, indicating the depth of the binding node to which the arrow points as seen from the node where the arrow starts (only binding nodes, indicated by c‘o”,are counted!):

Figure 3 This last tree can again be represented in a linear form:

1.1

(1) [Dl (1)2

*

Note that the same variable x in the first term (or tree) is represented in the “nameless” term (or tree) once by 1 and once by 2, whereas the same reference 1 in the “nameless” representation once denotes x and once y. Both the name carrying and the nameless linear representation can be considered as formalizations of the underlying intuitive notion of “tree with arrows”. The presentation with nameless variables makes the notion of a-conversion superfluous (and even meaningless). Thereby the definition of operations where “clash of variables” might arise (e.g. substitution) becomes more definite, and the proofs more formal. The drawbacks of this presentation might be a loss of “readability” of the formulas, and the need of a number of technical lemmas for updating references involved in certain formula manipulations. In our presentation frequent use will be made of inductive definitions (e.g. the definition of term, of substitution, of reduction and of A,). Subsequently, proofs are given with induction with respect to these definitions. This should always be understood in the sense of “induction with respect to the number of applications of a clause in the definition”, or, in other words, “induction with respect to the derivation tree”. This concept is not formalized here.

L.S. va.n Benthem Jutting

658

2. PRELIMINARIES AND NOTATIONS In our theory we will use some notions of intuitive set theory. N will denote the set of natural numbers { 0 , 1 , 2 , 3 , ...}, N+ the set of positive natural numbers {1,2,3, ...}, and IF'= N U {oo}, the set nV extended with infinity. The predecessor function is extended to N- by defining oo - 1 := 00. For n E N we define N,, := {k E N+I k I n}, so NO = 0, the empty set. Let A and B be sets. Then A x B denotes the Cartesian product of A and B, that is the set of pairs [a,b] where a E A and b E B; and A -+ B denotes the set of functions with domain A and values in B. If f E A --* B and a E A then ( a )f will denote the value of f at a; and if for a E A we have b(a) E B then [a E A ] b ( a )will denote the corresponding function, that is the set{[a,b(a)l E A x B ~ u E A } . As a consequence of our notation for the values of a function our notation for the composition of functions will be a little unusual: i f f and g are functions with domains A and B respectively, then

f 0 g = [z E C] ((z)f ) g ,

where C = {z E A I (z)f E B }

So (z) ( f o g ) = ((z)f ) g for z E C. If A is a collection of sets then U A denotes the union of A . If A is any set and n E N then A(") denotes N,, + A , i.e. the set of finite sequences of elements of A with length n. In particular A(O) = {0}, where 0 denotes the empty sequence. A* will denote U {A(")I n E N}, that is the set of all finite sequences of elements of A . If s E A* then L ( s ) is the length of a; and if s l 5 A* and 92 E A* then 81&82 denotes the concatenation of s l and 92. In particular, 0&s = s for s E A*. If a E A we will often confuse a with {[l,al}, that is the element of A(') with value a. In particular, if a E A and s E A*, then a&s E A', and moreover:

+

(1)(a&s) = a , and (n 1) ( a h )= (n) s for n 5 L ( s ) . Where no confusion is expected we will often omit the symbol "&". For the updating of references we will use the following functions and operations on functions:

For m E N

vrn = [nE N+] (n+m) For m E N

where


T(m,n)=

Form E

In

(C.6)

659

n+l

ifnsm

1

ifn=m+l if n

>m

+ 1.

N and $ E N+ + N+ $(m)

= [n E M+]~ ( $ , m , n, )

where

It follows that cpo = 290 = [n E N + ] n , the identity on Nv+,and that for E N + + N+ we have +(') = +. Note that ( P and ~ 19', are injective, and that if $ is injective then so is +("). Simple computation shows that the following lemmas hold:

+

Lemma 2.3. If k E +l(k)

0

N and $1,$2 E N+ -+ N+ then

+2@) = ($10 $ 2 ) ( k )

Lemma 2.4. If k, m E

( n )' : 9

=

("

.

M and n E N+ then

n+m

ifnsk ifn>k


660

Lemma 2.5. Zf k,1, m E N then

3. TERMS, TRANSFORMATION AND SUBSTITUTION

We define the set of terms A inductively as follows:

Deflnition 3.1. (1) T E A (2) if

TI

E N + then

nEA

(3) if u,v E A then (u)v E A (4) if u, v E A then [u] v E A

0

Transformation, i.e. adaptation of the references in terms by means of a function $ is defined as follows:

0

Clearly if u E A then $21 E A. Moreover qU=T

iff u = ~ ,

@=m

iff u = 21 and

- = (vl)v2 $u

iff u = (ul)u2, $ul = v l and $2~2= v2

- = [vl] v2 $u

iff u = [ul]212, $u1= v l and $(l)u2 = v2

( T I ) $=

m

, ~

It follows that for injective $, $JU = $v implies u = v. -

Lemma 3.1. Zf$1,@2 E N + -+ N + , u $1 $2u = $2 0$1u

--

~

*

E

A then

, .

The language theory of Am (C.6)

66 1

Proof. By induction on u.

0

For u, v E A, k E N + we define substitution of u in v at k , denoted by as follows:

xi v

Definition 3.3.

xi

Clearly, again, if u,u E A then v E A. Now we have the following technical lemmas: L e m m a 3.2.

xi v = x r

LPk-lu

29k-1~. __

Proof. By induction on v. L e m m a 3.3.

11 ~7

-

v=

0

tltu

@v.

Proof. By induction on v. L e m m a 3.4. If m

1 then xi &v

-

=(P;-~V.

Proof. By induction on v. Corollary 3.5. Zf m 2 k then

xi -~ pmv = vm-lv.

These lemmas are used to prove the following theorem: T h e o r e m 3.1. Substitution theorem.

Z f m 2 k thenx:

xi w = x kE L + l x1+1W '

Proof. By induction on w.


662

The relevant case is when w = 12. If n = k then

and on the other hand

If n = rn

+ 1 then

c:+1

x;-k+l'

'w

= Ck

vnu = 'p.,-?u

-

For other values of n the proof is straightforward.

by Lemma 3.5

. 0

4. REDUCTION

We define on A the relation -+,called one step reduction. Definition 4.1. (1)

(4['wl v

+

CY

2,.

If u --* v then

The relation

-,,on A is the reflexive and transitive closure of +, defined by

Definition 4.2. (1) u+u.

(2) If u + v and v

+

w then u + w


on

(C.6)

663

It is easily seen that the relation ++is transitive and monotonic. By induction $v, the following technical lemma is proved: 21 -+ v, respectively $u + -

Lemma 4.1. If u + v then for any $ we have - implies u + v . if 4 is injective then $u - + +v

$21 .

+

$v ; 0

Another technical lemma: Lemma 4.2. If $u -

+v

then for some w we have v = $w - and u + w.

Proof. By induction on $u -

+ v.

0

Finally it is easily shown that if [ u l ] u 2 u 2 * v2.

+

v then v = [vl]v2, u1

+

v l and

5. THE CHURCH-ROSSER THEOREM

We define on A the relation

> called

nested one step reduction.

Definition 5.1. (1) u > u . If u 2 u1 and v 3 v l then (2)

(414v 3 EY1v l

(3) (u) v 3

(211)

vl 5

(4) [u]v 3 [ U l ] v l .

2 denotes the transitive (and - of course - reflexive) closure of easy inductive argument it is seen that u 2 v iff u --H v. The following technical lemma is proved by induction on u 3 v.

>. By

Lemma 5.1. If u 3 v then for any $ $u 3 +v. -

an

5

Now we are able to prove two lemmas on substitution. Lemma 5.2. If u 3 u l then

xt v 3 xi1V.

Proof. By induction on v it is proved that

xt v 3 Ct1v for any k.

0


664

Lemma 5.3. Substitution lemma for >. Zf u 3 u1 and v 2 v l then v> vl.

xi

xi1

Proof. By induction on v 3 v l it is proved that Lemma 5.2 and Theorem 3.1 are used.

xi v 3 xi1v l for any k.

Using these lemmas we can prove the diamond property for

0

>.

Lemma 5.4. Diamond lemma for >. If u 2 u l and u 3 u2 then there exists a term v such that u l

> v and u2 3 v.

Proof. By induction on u 3 u1 and u 2 u2,using Lemma 5.3.

0

As a corollary we have:

Theorem 5.1. Church-Rosser theorem for +. If u -M u1 and u + u2 then there exists a term v such that u1 +,v and u2 + v.

0

6. NORMS, NORMING FUNCTIONALS AND MONOTONIC

FUNCTIONALS A term u E A is called normal if u -n v implies u = v. A reduction sequence of u is a finite or infinite sequence uo, ul,212, ... such that uo = u and un-l -+ un for n E lN+. We say that u strongly normalizes if all reduction sequences of u are finite. This is the case, by Konig’s lemma, iff there is a uniform upperbound to the lengths of the reduction sequences of u. We will prove strong normalization for a subset of A, the set of normable terns. Our proof extends proofs in [Gandy 801 and [de Vrijer 87c] for strong normalization in simple type theory. It is based mainly on de Vrijer’s “quick proof”; we refer also to that proof for comments. We define the set F of norms recursively as follows:

DeAnit ion 6.1. (1) lN E F

(2) if a , @E F then a

-@

:= ( a

-+

0)x EV

E F.

It is clear that, for a,@€F , a =par a n p = 0 . The elements of UF will be called norming function&.

0

For any norming


(C.6)

665

functional f the norm to which f belongs is denoted by the projection operators:

fT.

Moreover, we define

if f = n, n E N then f' = n , if f = [g,nl, [g,nl E a

- p then f' = g and f'

=n.

Let f be a norming functional, m a natural number. We define the norming functional f m as follows:

+

Definition 6.2.

+ m = n + m.

(1) If f E N , f = n then f

(2) If f E a

- P, f = [g,nl then f + m

Thus for f E a we have f

= [ [ hE a]((h)g

+ m),n + ml.

0

+ m E a and

(f + m)' = 'f + m , ( h )(f + m)' = ( h )f'+ m if a = p

-

y and h E

0.

Note that + extends addition on the natural numbers. For a E F and n E IV we define the norming functional c; E a.

Definition 6.3. (1) :c

(2)

=n

4-7 = "h E PI

C;[.+n,

n1'

Thus c;*

=n ,

( h )(@-7)'

= c;.+~

if h E

,

Note that c;

+ m = c+;,

.

Now let a be a norm. We define a subset ao of a and a relation simultaneous inductive definition.

Definition 6.4. (1) N O = N ;for f,g E

N o , f < g iff 'f < g*

< on ao by a


666

We define G := {aola E F } ; the elements of G will be called monotonic functionals. Note that < on N o is the order on the naturals. The following facts are easily proved: If f , g , h E a', f < g and g < h then f < h. Iff,gEoo,mEMthenf+mEaoandiff 1 then U = w&V and Now we have [w, Vl E L i , hence by the induction hypothesis w, U E Ci by clause 2. E L, and therefore

xg

xi

xi

xI Vl

Clause 4: v = (vl ) v2. We know that typ(v, U ) = 0,[vl, Ul E Li, rv2, ul E Li, typ(v1, U ) -n w l

and v2 + [wl] w2

.

By Lemma 8.6 we have:

The induction hypothesis gives us:

Also by Lemma 8.6 we see that

Now by Lemma 5.3 it follows that

hence by the Church-Rosser theorem

w 0 a w and E i w 1 - n ~forsome w , Therefore we have: typ(Cg

x;v2

vl,Ci U ) -n w0 -n w

+

and

[Xi 2011 Cbl w2 -w bl C;+l w2

From (i), (ii) and (iii) we conclude by clause 4 that

*

(iii)


679

Clause 6.1: v = 12. We know that [typ(v,U),U] = rpn - (n)U,Ul E Li-1. We discern two cases: n = k and n # k . Suppose n = k. As L ( U ) 2 k we may put U = U1&U2 with L(U1) = k . Then U= U l ) & U 2 by Lemma 8.5 and L ( x ; U1) = k - 1. Moreover, U E Ci. Hence by Corollary it can be shown, just as under clause 3, that 9.1.1 we have [u, U21 E Li and by the same corollary also v, Ul =

(xi

x;

r(Pk+a;

Ul E Li.

Now suppose n # k. v either equals 12 (if n < k ) or n-l (if n Lemma 3.4 (for n < k ) or Corollary 3.5 (for n > k ) we see that tYP(C; u, C; U ) =

> k ) . Using

x;(pn (4u .

By the induction hypothesis we have by clause 6.1 [C; v,Ci Ul E Li. Clause 6.2: v = ( v l ) v2. We know that [ ( v l ) typ(v2, U ) ,U l E tion hypothesis it follows that

[C; __ pn (n)U ,

Li-1

x;U l E

Li-1

and therefore

and that [v2, U l E Li. By the induc-

By Lemma 8.6 it is known that for some w0 E A

x;typ(v2, U )

--H

w0 and typ(E; v2, C; U )

+

w0 .

(ii)

And from (*) we conclude by Lemma 9.4 that rtYP(C;

GC;

w,c;Ul E

.

Li-1

(iii)

From (i), (ii) and (iii) it follows by Lemma 9.6 that rtYP(C;

v , c ; % C i Ul E Li-1

7

and this, together with (*) gives us by clause 6.1:

rc;

v,Ci Ul E Li .

We leave the other clauses to the reader.

0


680

Proof. Take k = 1 and U = vl&V in Lemma 10.2.

0

Our next lemma implies that for i E N the set A, is closed under reduction. In order to word it we use the relation -H between contexts, which has been defined in Section 8. In order to prove the lemma we assign t o every context U the number M ( U ) which is the sum of the lengths of the terms in U : if L ( U ) = n then M ( U ) = L((1) U ) L((2) U ) ... L ( ( n )U ) .

+

Lemma 10.3. If i E N , u&U

-n

+ +

v&V and [u, U l E

Ai

then [v, Vl E A i .

Proof. By induction on i. If i = 0 then A, = 0, so the lemma holds. Suppose i > 0. We prove the following: Proposition. If u&U

+

v&V and [u,U l E A, then [v, Vl E A,.

Proof. By induction on M(u&U). If M ( u & U ) = 1 then u&U + v&V is impossible, so the proposition holds. Now suppose M ( u & U ) > 1. As u&U + v&V we have either u + v and U = V or u = v and U + V. Suppose u + v and U = V. We inspect the clauses for 21 --+ 0.

(1)

u = ( ~ 1[u3] ) u2

v = Cyl u2

,

.

By Lemma 9.2 we have typ(u1,U) + w and u3 -H w for some w , and by Lemma 9.5 we have “2131 212, Ul E A, so [u2, u3&U1 E Ai by Lemma 9.8. Apply Corollary 10.2.

(2)

21

= ( u l ) v2

,

u1 + v l

,

v = (vl) u2

.

By Lemma 9.5 we have [ul, Ul E A,. Moreover ul&U + vl&U and M ( u l & U ) < M ( u & U ) . Therefore by our induction hypothesis we have [ v l , U l E Ai and hence [v, U l E A, by Lemma 9.7.

(3)

u = (211) u2

,

u2

--+

v2

,

v = ( u l ) v2

.

[v, Ul E A, by a similar argument, where Lemma 9.6 is used instead of Lemma 9.7. (4)

u=

[vl]v 2 ,

u1 + v l

,

v = ( v l ] u2

.

By Lemma9.8 we have [u2, ul&U1 E A,. Moreover u2&ul&U + u2&vl&U and M(u2&ul&U) < M(u&U); in fact M ( u & U ) = M(uZ&ul&U) 2. Therefore our induction hypothesis gives us [u2, vl&U1 E A, and it follows that [v, Ul E A, by Lemma 9.8.

+


(5)

'11 =

[v,Ul

[ul] u2

E Ai by

,

u2

v2

,

21

= [ul] v2

.

a similar argument as under 4.

Now suppose u = v and U

(3)

+

68 1

+

V. We inspect the clauses for [u, Ul E A i ,

u= 7.

We have to prove that V E ri. As U -+ V it is impossible that U = 8, so we may put U = ul&U1 and V = v l & V l . As U E ri we have [ul, U l l E Ai and also M ( U ) < M(u&U). Therefore we have by our induction hypothesis [ v l , V l l E Ai, hence V E ri.

u = ( ~ 1~2 ) ,

(4)

typ(u, U ) = 0

typ(u1, U ) +,v l and 212

-+

,

[ ~ Ul l , E hi

,

[ ~ 2U, l E

Ai

[vl]v2 .

By Lemma 8.7 we know typ(u, V) = 0 . Moreover, we have ul&U + u l & V and M ( u l & U ) < M ( u & U ) so by our induction hypothesis [ul, Vl E A i , and by a similar argument we see that ru2, V1 E A i . Also by Lemma 8.7 it is seen that typ(u1, U ) --* typ(u1, V) so by the ChurchRosser theorem we have: v l - w and typ(u1, V)

It follows that u2 -,, [vl]v2 = [ul] u2

(5)

,

-+

-+

w for some w

.

[w] v2, hence [u, Vl E Ai by clause 4.

typ(u, U ) = 0

,

[u2, ul&U] E A,

.

We know that u2&ul&U + 212&ul&V and that M(u2&ul&U) < M ( u & U ) . It follows that [u2, ul&V] E Ai, hence [u, Vl E A, by Lemma 9.8.

(6)

[ ~ Y P ( u , U ) , UE] Ai-1

.

By Lemma 8.7 we have typ(u, U ) -+ typ(u, V), hence typ(u&U)&U -+ typ(u&V)&V. Now by our induction hypothesis on i it follows that [typ(u, V), Vl 0 E Ai-1 and therefore [u, Vl E Ai by clause 6.

So our proposition is proved, and it follows immediately that u&U [u, Ul E A, imply [v,Vl E A i . This proves our lemma. Corollary 10.3. Closure for Ai. If i E N , [u, U l E Ai and u v then [v,Ul E -+

As a consequence we have:

Ai.

-+

v&V, 0

0


682

Theorem 10.1. Closure fOT Am. If [u, U l E Am and u --H v then [v,Ul E Am.

0

11. NORMABILITY FOR Am In this section we will prove that ru,Ul E Am implies that u is normable. It then follows from Theorem 7.1 that u strongly normalizes. In order t o prove that u is normable we will assign to certain sequences U E A* a sequence s ( U ) E (UG)*. If the assignment is not possible then we will write as before, s ( U ) = 0.

Definition 11.1. (1)

40) = 0 cg&s(U)

(2) s(u&U) =

if

s(U)#

fn(u,s(U)) # 0

0,

and fn(u, s(U))t = a otherwise

0

,

Proof. By induction on U.

0

Our second lemma gives a relation between norms and typing.

Lemma 11.2. If U E A*, s ( U ) # 0 and typ(u, U )# 0 then either fn(typ(u, U),s ( V ) )= fn(u, s ( U ) )= 0

or fn(typ(u, U), s ( U ) ) t = fn(u, W ) t

'

Proof. By induction on u. We consider the case that u = (ul]u2. Then typ(u, V ) = (2111 typ(u2, ul&U) and typ(u2, ul&U) # 0 . If fn(u1, s ( U ) ) = 0 then fn(typ(u, V ) ,s ( U ) ) = fn(u, s ( U ) )= 0 . Now assume that fn(u1, s ( U ) ) # 0 and put fn(ul,s(U))t = a. Then it follows that s(ul&U) = c$&s(U) # 0. If fn(typ(u2, ul & U ), s(ul&U)) = 0 then also fn(u2, s(ul&U)) = 0 by the induction hypothesis, and therefore fn(typ(u, V ) ,U ) = fn(u, V ) = 0 . SO let us assume fn(typ(u2, uI&U), s(ul&U)) # 0 . Putting fn(typ(d2, ul&U), s(ul&U))T = /3 we have by the induction hypothesis


683

(C.6)

fn(u2, s(ul&U))T = p and also fn(u2, g&s(V))j = ,B for g E a. Hence fn(typ(u, U ) ,s ( U ) ) t = fn(u, s(U))T = a + 0.

Lemma 11.3. If [u, Vl E

Ai

then s ( U ) #

0

0

and fn(u, s ( U ) ) # 0 .

Proof. By induction on [u, Crl E A i . We consider clause 3: u = 7. We only have to show that s ( U ) # 0 . If U = 0 then s ( V ) = 0, and if U = v&V then we have [v,V1 E hi, so by the induction hypothesis s ( V ) # 0 and fn(v,s(V)) # 0 and therefore s ( U ) # 0. We will also consider clause 4: u = ( u l ) u2. We have typ(u,U) = 0 , [ u l , U ] E A;, [u2,U] E A i , typ(u1,U) --H v l and 212 -H [vl] v2. By the induction hypothesis fn(u1, s ( U ) ) # 0 and fn(u2, s ( U ) ) # 0 . Putting fn(ul,s(U))T = a we have fn(typ(ul,U),s(U))T = a by Lemma 11.2 and fn(vl,s(U))T = a by Lemma 7.5. Also by Lemma 7.5 we have fn(u2, s ( U ) ) t = fn([vl]v2, s ( U ) ) t = a + p for some p, hence fn(u, s ( U ) )# 0. 0 We leave the other cases to the reader. As a consequence we have

Theorem 11.1. Strong normalization for A,. If [u, Ul E A, then u strongly normalizes.

0

ACKNOWLEDGEMENT

I want to express my gratitude to R. Nederpelt for his encouragement and his careful reading of the original text, where he suggested some improvements and detected a serious error.


PART D Text Examples


687

Example of a Text written in Automath N.G. de Bruijn

[Editor’s comments This early text is written in the first full-fledged version of an Automath language, later to become known as AUT-68. It covers some elementary logic and the notions of set, powerset and set inclusion. An introduction to the language AUT-68 can be found in this Volume flvan Benthem Jutting 81 (B.l)]). First a f e w remarks on features that are particular of this text and on the way at has been reproduced here. (1) Early 1968 d e Bruijn still used the term sort instead of type. We have

not changed this terminology.

(2) In the original text one finds vertical lines as indicators of the scope of the variables, like in Natural Deduction in the style of Fitch [Fitch 521. These lines are redundant, although they enhance readability. They have been deleted in this reproduction. (3) In some places, especially at the opening of each new section, you will find a few lines that have been placed between brackets. These lines are superfluous in the sense that deleting them would affect neither the correctness nor the meaning of the text. They redefine a context that could have been just picked up from the preceding sections. De Bruijn included these lines as reminders, saving the reader the trouble of searching the text for the proper identifiers. Since they definitely contribute to the readability, we have reproduced both the lines and the brackets.

(4) The division

of the text in sections with descriptive headers is from the original. So are the comments between the lines.

(5) The text has never been checked on a computer. A few obvious mistakes

have been corrected.

688

N.G. de Bruijn

We.continue with a few short comments on the handling of logic in terms of bool and T R U E . Once this mechanism is understood, it is not dificult to read the plain Automath text. Consult on this subject also the rCsumCs of [D.1] and [A.2] in the Introduction. Section 12 of [van Benthem Jutting 81 ( B . l ) ] , entitled ‘Logic’, contains a more recent text fragment developing some logic. It may be instructive to compare the two texts. 1.1-1.3. The primitive type bool of propositions (here called ‘booleans’) is introduced, and for each boolean x the connected assertion type T R U E ( x ) . The idea is that a boolean will be true if its assertion type is inhabited. 1.4 C O N T R is defined as the type of functions that attach to each boolean v an assertion of v. Such a function could of course be taken as an assertion of a contradiction, and in a pure propositions-as-types setting it would be natural to view the type C O N T R itself as the proposition that in a canonical way represents falsity. Here the corresponding proposition (boolean) can be obtained via the nonempty-construction that now follows. 1.9-1.13. To each type ksi corresponds a boolean nonempty(ksi). Its assertion type TRUE(nonempty(ksi)) is inhabited if ksi is. This construction may look a bit artificial: why is not ksi itself taken as the assertion type? The answer is that we already have the uniform construction of the TRUE-types as the assertion types of booleans, and there is no way to make ksi and TRUE(nonempty(ksi)) definitionally equal. It is noteworthy that i n the present text de Bruijn not always takes the trouble to explicitly construct the TRUE-type, or even the bool. A typical example is Section 2. Both the equality axioms and the reasoning on equality are entirely in terms of thc types IS(ksi,x,y). The corresponding boolean equal is defined in line 2,3, but never used, the assertion type does not occur at all. A s a matter of fact, the IS-types here already have taken the role of the propositions. A similar observation could be made e.g. on implication (IMPL, defined in line 4.7). I n other places the booleans are used in an essential way, though. I n particular the type [u : ksi] bool plays an important role. First, in Section 7 on quantification, as the type of predicates on ksi, and then again in Section 13, as the type of sets over ksi. A final remark seems in order on the kind of logic that is at issue. De Bruijn has always emphasized that Automath is neutral with respect to the logical principles that one wants to accept or reject. This view is reflected in the present text b y the manner i n which he handles non-constructive principles. Two such principles (or rather, corresponding types) are defined as PARADISE I and I 1 (line 7.15 and 1.19). Metaphorically speaking, a type ksi has an inhabited PARADISE I 1 if the double-negation law holds for ksi. However, there is no axiom ( P N ) stating that PARADISE II(ksi) is inhabited for each ksi. I n particular, this is not assumed for the TRUE-types, so that we obtain intuitionistic and not

Example of a text written in Automath (D.1)

689

classical logic for the inhabitants of bool. (The names bool and TRUE may be felt to be a bit misleading here.) In Section 12, line 12.1, the type EXCLTHIRD is defined. An inhabitant of EXCLTHIRD would yield that all TRUE-types are in PARADISE 11. Then in line 12.7 a non-constructive notion of truth, called VALID, is defined as truth on the assumption of EXCLTHIRD. The upshot is that intuitionistic and classical logic live happily together in the guises of TRUE and VALID.

R.C. de Vrijer]

1. BOOLEANS 1.1 0 1.2 0 1.3 x

@ bool

1.4 1.5 1.6 1.7 1.8 1.9 1.10 1.11 1.12 1.13 1.14 1.15 1.16 1.17 1.18

:= PN

: sort

@ X

.-.- _ _ - - -

@ TRUE

:= PN

: sort

0 0 a b 0 ksi ksi a ksi a

@ CONTR

:= [v:bool]TRUE(~)

: sort

ksi ksi x u x

Q EMPTY

@ a @ b @ then 1 @ ksi @ nonempty @ a Q then 2 @ a @ then 3

.-...-

_____ _____

:= (b)a

..-

_____

:

TRUE(b)

: : : : :

sort

:= P N := [u:ksi]CONTR

: sort

:= PN

.-.- _ _ _ - _ := PN

..- _ _ _ _ _

@ U

Q then 4 @ then 5

:= (x)u := [t:EMPTY (ksi)]

__--_

___-_

then 4 (t) 1.19 ksi

: CONTR : bool

bool ksi TRUE(nonempty) TRUE(nonempty) : ksi

.-..-

@ X

: bool

: ksi : EMPTY(ksi) : CONTR :

EMPTY(EMPTY( ksi))

@ PARADISE I1 := [t:EMPTY(EMPTY(

ksi))]ksi

: sort

N.G. de Bruijn

690 2. EQUALITY

0 ksi

Q (ksi Q (x

2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9

Q y x Q IS y Q equal y Q reflexive x y Q ass 1 ass 1 Q symm ass 1 Q z z Q ass 2 ass 2 @ transitive

2.10 2.11 2.12 2.13 2.14 2.15

ksi theta x1 P 1 x2 ass 3

: sort) :

ksi)

.- _ _ _ _ _ := P N

:= nonempty(1S) := PN

.-.-

_____

:= PN _____

...-

_____

:= PN

Q theta

: sort

Q x1

:

@ P 1 Q x2 Q ass 3 @ then 6

:

ksi [t:ksi]theta : ksi : IS(ksi,xl,x2) : IS(theta, (xl)P 1,

Q P2

: [x:ksi]theta

Q ass 4

:

(X2)Pl) 2.16 P 1 2.17 P 2

2.18 ass 4 Q then 7 2.19 P 2

0 ass 4a

2.20 ass 4a Q then 7a

:= PN

IS([x:ksi]theta, Pl,P2) : [x:ksi]IS(theta,

.-.-

: [x:ksi]IS(theta,

(X)Pl,(X)P2) _____

:= PN

:

( 4 P1,W 2 ) IS([x:ksi]theta, Pl,P2)

Example of a text written in Automath (D.1)

691

Za. Ifelse 2”.1 2”.2 2”.3 2”.4 2”.5 2”.6 2”.7 2”.8

0 ksi x a a ass 4b a ass 4c

@ @ @ @ @ @ @ @

(ksi (x a ifelse ass 4b then 7b ass 4c then 7c

: sort) : ksi) :

bool

: ksi : TRUE(a) : IS(ksi,ifelse,x) : IS(ksi,ifelse,x) : TRUE(a)

2b. Equality for two sorts 2b.l 0 2b.2 ksi 2b.3 eta 2b.4 a 2b.5 b 2b.6 b 2b.7 b 2b.8 ass4d 2b.9 eta 2 b . 1 zeta ~ 2b.lla 2b.12 b 2b.13 c 2b.14 ass 4e 2b.15 ass 4f

@ (ksi @ eta @ a @ b @ ISS @ equal1 @ ass 4d @ symmm @ zeta @ a @ b @ c @ ass 4e @ ass 4f @ transitivv

: sort) : sort : ksi :

eta

: sort

bool : ISS(ksi,eta,a,b) : ISS(eta,ksi,b,a) :

: sort :

ksi

: eta : zeta

ISS(ksi,eta,a,b) ISS(eta,zeta,b,c) : ISS(ksi,zeta,a,c)

:

:

C o m m e n t : T h e PN’s in 2.2, 2.6, 2.9 can n o w be replaced respectively b y ISS(ksi, ksi,x,y), symmm(ksi,ksi,x,y); transitivv(ksi,ksi,ksi,x,y,z). 2‘.

2‘.1 2‘.2 2‘.3 2c.4

Embedding 0 ksi eta p

@ @ @ @

(ksi (eta p EMBED

...-

_____

: sort)

_____ _____

: sort)

:=

[t:eta]ISS(ksi,eta,(t)p,t)

: sort

1-

:

[x:eta]ksi

N.G. de Bruijn

692 2'.5 p 2".6 w

@ w @ image

.- _ _ _ _ -

:

EMBED

:= [x:ksi]nonempty (

EXISTS(eta,[b:eta] equal( (b)P9x11

: [x:ksi]bool

[Note: EXISTS is still to be defined i n line 7.2. So this Section 2' should, as a matter of fact, be placed after Section 7.1

3. PAIRSORT 0 ksi

@ (ksi @ (theta

3.1 3.2 3.3 3.4

theta theta x y

@ @ @ @

3.5 3.6 3.7 3.8

theta u u u

@ u 0 first @ second @ then 8

pairsort x y pair

.-.- _ _ _ _ _ .- _ _ _ _ :=

PN

: sort) : sort)

:= P N

: : : :

ksi theta pairsort

.-.-

:

pairsort

.- _ _ _ _ _ .- _ _ _ _ _ ___--

sort

:= P N := P N := P N

: IS(pairsort,u,

:= P N := P N

: IS(ksi,x,first(pair)) : IS(theta,y,

: ksi :

theta pair(first,second))

3.9 y 3.10 y

@ then 9 @ then 10

second( pair))

4. BOOLEQUAL, IMPLICATION 4.1 4.2 4.3

0 a b

@ a @ b @ c

.- _ _ _ _ _ .- _ _ _ _ _ .- _ _ _ _ _

4.4 4.5

c b

@ then 11 @ d

:= P N

.-

_____

bool bool : pairsort( [t:TRUE (a)]TRUE(b),[s: TRUE(b)]TRUE(a)) : IS(bool,a,b) : IS(bool,a,b)

:

:

Example of a text written in Automath ( D. l) @ then 12

4.6

d

4.7 4.8 4.9 4.10

b @ b @ ass 1 @ ass 2 @

IMPL ass 1 ass2 modpon

:= PN

693

:

pairsort([t:TRUE (a)]TRUE(b),[s: TRUE(b)]TRUE(a))

:= [u:TRUE(a)]TRUE(b) : s o r t .- _ _ _ _ _ : TRUE(a) .- - _ _ _ _ : IMPL := (ass 1)ass 2 : TRUE(b)

..-

5. SOME LOGICAL CONSTANTS

5.3

0

5.4

0

@ contradiction := nonempty(C0NTR) @ OBVIOUSLY := IMPL(contradiction, contradiction) @ trivial := nonempty( OBVIOUSLY) @ now 1 := [u:TRUE(

5.5

0

@ now 2

:= then 2

5.6

0

@ now 3

:= [u:CONTR]u

: TRUE(trivia1) : EMPTY(C0NTR)

..-

:

5.1 5.2

0 0

contradiction)]^ (OBVIOUSLY,now 1)

: bool : sort : bool :

OBVIOUSLY

6. NON, A N D 6.1 6.2 6.3

0 b b

@ b @ NON @ non

6.4 6.5

b c

6.6

_____

bool

:= EMPTY(TRUE(b)) := nonempty(N0N)

: sort : bool

@ C

..-

: bool

@ AND

:= pairsort (TRUE(b),

c

@ and

:= nonempty(AND)

:

6.7 6.8

c if

@ if @ then 12a

.-.-

: AND

6.9

if

@ then 12b

_____

TRUE(c))

_____

: sort

bool

:= first (TRUE(b),

TRUE(c) ,if)

: TRUE(b)

:= second(TRUE( b) ,

TRUE(c),if)

: TRUE(c)

N.G. de Bruijn

694

6.10 b 6.11 if

@I

6.12 b 6.13 if

Q if @ then 12d

6.14 b 6.15 if

Q if

if @I then 12c

@I

then 12c

.-

_____

:= then 3(NON(b),if)

.-.-

_____ := then 2 (NON(b),if)

.- - _ _ _ _

: TRUE(non(b)) : NON(b) : NON(b) : TRUE(non(b))

:= then 5 (TRUE(b) ,if)

: TRUE(b) : EMPTY(NON(b))

.- _ _ _ _ _ .-

: sort)

7. EXISTS, ALL

(ksi

0

@I

7.1 7.2 7.3 7.4 7.5

ksi P P v ass 1

P @I EXISTS @I v @I ass 1 @I then 13

7.6 7.7 7.8

P ass 2 ass 2

@I

7.9 7.10 7.11 7.12

P P

@I

@I

@I @I

ass 2 then 13a then 13b

ALL @ (v v @ ass 3 ass 3 @I specialize

.-.-

_____ := PN

.- _ _ _ _ _ .- _ _ _ _ _ := P N

..-

_____

:= PN := PN

:= [u:ksi]TRUE((u)P) .- _ _ _ _ _

.- _ _ _ _ _ :=

(v)ass 3

: : : :

[u:ksi]bool sort

ksi TRUE((v)P) : EXISTS : EXISTS : ksi :

TRUE( (then 13a)P)

: sort : ksi) : ALL :

TRUE((v)P)

7.13 P 7.14 P

Q NONEXIST := [u:ksi]NON((u)P) : sort @I WEAKEXIST := EMPTY(N0NEXIST) : s o r t

7.15 ksi

@ PARADISE I := [Q:[u:ksi]bool] [t:WEAKEXIST( Q)] EXISTS(Q) @I a .-.- _ _ _ _ _ .- _ _ _ _ _ @ b @ then 14

7.16 P 7.17 a 7.18 b

: : : :

sort

PARADISE1 WEAKEXIST (P) EXISTSfP’I

Example of a text written in Automath (D.l)

695

8. CONSTANT FUNCTIONS 0 ksi

8.1 8.2

8.3 8.4 8.5 8.6

@ ksi @ theta

theta @ pi pi @ CONSTANT

g a b c

@ 0 @ @

a b c then 15

.- _ _ _ _ ...- _ _ _ - -

: sort : sort

.- _ _ _ - .-

: [t:ksi]theta

:=

[s:ksi][t:ksi]IS(theta, (t)Pi,(S)Pi)

..- _ _ _ _ -

..-.-

_____

____-

:= (a)(b)c

: sort : : : :

ksi ksi CONSTANT IS(theta,(a)pi, (b)Pi)

9. CONDITIONAL BRACING

9.1 9.2

0

@ (ksi

ksi

@ P @ h

P

9.3 9.4 9.5 9.6

h x x h

@ X

9.7 9.8 9.9

x a a

@ a @ then 17 0 then 18

9.10 a

@ then 19

@ sigma @ then 16 @ Q

.- _ _ _ - -

: [t:ksi]bool : [t:ksi][s:TRUE(

..-

(t)P)]boo1 _____

:= TRUE( (x)P) := EXISTS(sigma, (x)h) := [t:ksi]nonemtpy(

then 16(t))

.- _ _ _ - -

1-

:= then 3(then 16,a) := then 13a(sigma, (x)h ,

then 17)

@ a @ b @ then 20

: ksi : sort : sort : [t:ksi]bool : TRUE((x)Q) : then 16 : TRUE((x)P)

:= then 13b(sigma,(x)h,

then 17) 9.11 x 9.12 a 9.13 b

: sort)

..- - _ _ _ _ .-.- _ _ _ - _ := then 13(TRUE((x)P),

: TRUE(

(then 18)(x)h) : TRUE((x)P) : TRUE((a)(x)h)

N.G. de Bruijn

696

9.14 b 9.15 b

Q then 21 @ then 22

:= then 2(then 16, then 20) : TRUE((x)Q)

:= then 2(then 16, then 13

(sigma,(x)h,a,b))

:

TRUE((x)Q)

_____

: sort) : [t:ksi]bool)

10. DIRECT BRACING

0 ksi 10.1 P 10.2 Q

Q (ksi Q (P Q Q @ R

.-

.- _ _ _ _ _

.- - _ _ _ _ := [t:ksi] and ((t)P,(t)Q)

: [t:ksi]bool : [t:ksi]bool

11. NAMECHANGING @ NAME @ dash

:= PN := PN

Q ksi Q classin

:= pairsort ([t:ksi]bool,

11.5 ksi 11.6 c

@ C

.-

@ predicof

:= first([t:ksi]bool,

11.7 ksi 11.8 d

@ d @ classof

11.1 11.2 11.3 11.4

0 0 0 ksi

.- - - _ _ _

..-

NAME) _____

NAME,c) _____

11.9 0 11.10 0

@ NAME 2 @ dot

11.11 0 11.12 ksi

.- _ _ _ _ _ @ (ksi @ PREDICATE := pairsort([t:ksi]bool, NAME 2) .-.- _ _ _ _ _ 8 C

:= PN := PN

@ predicup

:= first([t:ksi]bool,

@ d @ predicdown

:= _ _ _ _ _

NAME 2,c) 11.15 ksi 11.16 d

: sort : classin : t:ksi]bool : [t:ksi]bool

:= pair([t:ksi]bool,

NAME,d,dash)

11.13 ksi 11.14 c

: sort

: NAME : sort

: classin(ksi) : sort :

NAME 2

: sort)

: sort : PREDICATE : [t:ksi]bool : [t:ksi]bool

:= pair([t:ksi]bool,

NAME S,d,dot)

: P,REDICATE

Example of a text written in Automath (D.l) 11.17 0 11.18 ksi 11.19 theta 11.20 P 11.21 a

@ (ksi @ (theta

@ P @ a @ then 25

.- _ _ _ _ _ .- _ - - _ _ .- _ _ _ _ _ .- _ _ _ _ _ 1-

697

: : : :

sort) sort)

:= [s:ksi]((s)P)a

[t:ksi]theta EMPTY(theta) : EMPTY(ksi) : EMPTY(ksi)

@ b

.- _ - - _ _

@ then 26

:= then 25(TRUE(

11.24 ksi

@C

11.25 c

@ then 27

nonempty(ksi)) ,ksi,[s: TRUE(nonempty(ksi))] : EMPTY(TRUE( then 3(s),b) nonempty (ksi))) .- _ _ _ _ _ : EMPTY(TRUE( nonempty (ksi))) := then 25(ksi,TRUE( nonempty(ksi)) ,[s:ksi] : EMPTY(ksi) then 2(s),c)

11.26 0 11.27 b 11.28 x

@ X

..-.-

@ then 28

:= then 3(EMPTY(

11.22 ksi 11.23 b

@ b

_____

_____

: boo1 : TRUE(non( non( b)))

TRUE(non(b)),x)) 11.29 x

@ then 29

:= then 27(NON(b),

11.30 x

@ then 30

:= then 29

: EMPTY(NON(b)) : EMPTY(EMPTY(

11.31 b

Q Y

.-

: EMPTY (EMPTY(

11.32 y 11.33 y

@ then 31 @ then 32

:= y := then 26(NON(b),

11.34 y 11.35 b 11.36 z

@ then 33 @ Z

:= then 2(NON(non(b)) ..- _ _ _ _ _

@ then 34

:= then 5(TRUE(b) ,z)

11.37 z

@ then 35

:= then 33(TRUE(b),

then 28)

_____

TRUE@))) TRUE(b))1

then 31)

then 34)

: EMPTY(NON(b)) : : : :

NON(non(b)) TRUE(non(non( b))) TRUE(b) EMPTY(EMPTY( TRUE@)1)

: TRUE(non(non( b)))

N.G. de Bruijn

698

12. EXCLUDED THIRD 12.1 0

@ EXCLTHIRD := [t:bool]PARADISE 11(

12.2 12.3 12.4 12.5 12.6 12.7

@ excl @I a @ if @ then 36 63 (b @ VALID

.- _ - _ _ _ .-.- _ - - _ _ .- _--__

: EXCLTHIRD : bool : EMPTY(NON(a))

:= (a)(if)excl

:

if @ then 37

.- ---__

:

:= [s:EXCLTHIRD]if

: VALID(b)

TRUE(t)) 0 excl b if 0 b

12.8 b 12.9 if

@I

.- _ - - _ _ :=

[s:EXCLTHIRD] TRUE(b)

: sort

TRUE(a)

: bool) : sort

TRUE(b)

Comment: VALID is the notion of truth in non-intuitionistic logic.

12.10 b 12.11 p 12.13 q 12.14 q 12.15 p

.-.-

@ P

@ q @ then 38 @I then 39 @I then 40

_-___

.- ---__ := (q)P := then 35(then 38)

@ P @ q @ then @I then @ then @ then

40a 41 42 42a

: :

TRUE(b) TRUE(non(non(b)))

:= [xEXCLTHIRD]

then 39(s) 12.16 b 12.17 p 12.18 q 12.19 q 12.20 q 12.21 p

: VALID(b) : EXCLTHIRD

: VALID(non(non(b)))

.- ---__ .-.- _ _ _ _ _

:

(q)P then 30(then 40a) := then 36(q,b,then 41) := [s:EXCLTHIRD] then 42(s)

:

:= :=

VALID(non(non(b)))

: EXCLTHIRD

TRUE(non(non(b)) )

: EMPTY(NON(b)) : TRUE(b) : VALID(b)

13. SETS

13.1 13.2 13.3 13.4 13.5 13.6 13.7

0 ksi ksi x s s ksi

(ksi @ set @I x

@I

s EST1 @ esti @ s @I @I

.- --_-_ .:= [x:ksi]bool

..-

_-___

--___

:= TRUE((x)s) := (x)s

.-.-

_-___

: sort)

: sort : ksi : set : sort : bool :

set

Example of a text written in Automath (D.1) 13.8 s 13.9 t

@ t @ INCL

..-

13.10 t 13.11 ksi 13.12 s 13.13 ksi 13.14 ksi 13.15 x 13.16 ksi 13.17 ksi 13.18 x 13.19 ass

@ incl

:= nonempty(1NCL) := _ _ _ _ _

@ then 43 @ emptyset QX @ assume @ then 44

:= now 2 := [x:ksi]contradiction := _ _ _ _ _

13.20 ass

Q then 45

:= then 3(CONTR,

13.21 x

@ then 46

:= [t:ESTI(x,emptyset)]

_____

(s @ powerset Q universe @ X

:= [x:set]incl(x,s) := [x:ksi]trivial

..-

_____

14. TRANSITIVITY

14.1 ksi 14.2 14.3 14.4 14.5 14.6 14.7 14.8

s t r

Q (s

@ t @ r

@ ass 1 ass 1 @ ass 2

ass 2 @ x x @ ass 3 ass 3 Q then48

14.10 ass 3 @ then 50

: : :

:

:= then 46

ESTI(x,universe) set ksi ESTI(x,emptyset) TRUE( contradiction)

: CONTR

EMPTY(ESTI( x,emptyset)) : NON(esti( x,emptyset)) :

OF SET-INCLUSION :=

...-.....-

__------_____ _____ ____-

____-

:= _ _ - - -

: set) : set : set : INCL(s,t) : INCL(t,r) : ksi :

TRUE((x)s)

:= then 3(IMPL( (x)s,(x)t) ,

(x)ass 1) 14.9 ass 3 @ then 49 @ refl 14.9” s

:

:= assume

then 45 @ then 47

: sort : boo1 : set) : set(set(ksi)) : set : ksi

..- -_-_-

then 44)

13.22 x

: set

:= ALL( ksi,[u:ksilnonempty

(IMPL((uh(u)t))) @

699

:= (ass 3)then 48 := [u:ksi]

: IMPL((x)s,(x)t) : TRUE((x)t)

then 2(IMPL((u)s, ( 4 s ) J Y :TRUE((u)s)ly) : INCL(s,s) := then 49(t,r,r,ass 2, refl(r),x,then 49) : TRUE((x)r)

N.G. de Bruijn

700 14.11 x

@ then 51

:= [p:TRUE((x)s)]

14.12 x

@ then 52

:= then 2(IMPL( (x)s, (x) r) ,

then 50(p)

: IMPL((x)s,(x)r)

then 51) 14.13 ass 2 @ then 53

:= [t:ksi]then 52(t)

15. INCLUSION INDUCED IN POWERSET 15.1 15.2 15.3 15.4 15.5

ksi s t ass 4 u

@ @ @ @

set) set) INCL(s,t) set : TRUE((u) powerset (s)) : TRUE(incl(u,s)) : : : :

(s

(t ass 4 u @ a

15.6 a 15.7 a

@ then 54 @ then 55

15.8 a

@ then 56

15.9 a

Q then 57

15.10 a

62 then 58

..- a := then then := then then := then then := then

15.11 u

@ then 59

:= [a:TRUE((u)powerset(

3(INCL(u,s), 54) 53(u,s,t, 55,ass 4) 2(INCL(u,t), 56) 57

: INCL(u,s) : INCL(u,t) : TRUE(incl(u,t)) : TRUE( (u)

powerset( t)) s))]then 58

: IMPL(

(u)powerset (s), (u) powerset (t)) 15.12 u

@ then 60

:= IMPL((u)powerset(s),

15.13 u

@ then 61

:= then 2(then 60,

(u)powerset (t)) then 59)

: sort : TRUE(nonempty(

then 60)) 15.14 ass 4 @ then 62

:= [t:set]then 61(t)

: INCL(set,

powerset (s), power set (t ) )

70 1

Checking Landau’s “Grundlagen” in the Automath System Parts of Chapters 0, 1 and 2 (Introduction, Preparation, Translation) L.S. van Benthem Jutting

CHAPTER 0. INTRODUCTION 0.2. The book translated At an early stage of the Automath project the need was felt to translate an existing mathematical text into an Automath language, first, in order to acquire experience in the use of such a language, and secondly, to investigate to what extent mathematics could be represented in Automath in a natural way. As a text to be translated, the book “Grundlagen der Analysis” by E. Landau [Landau 301 was chosen. This book seemed a good choice for a number of reasons: it does not presuppose any mathematical theory, and it is written clearly, with much detail and with a rather constant degree of precision. For a short description of the contents of Landau’s book see 2.0.

0.3. The language of the translation The language into which Landau’s book has been translated is AUT-QE. A detailed description and a formal definition of this language is given in [van Daalen 73 (A.3)]. I will use the notations introduced there whenever necessary. Where in the following text a concept introduced in [van Daalen 73 (A.3)] is used for the first time, it will be displayed in italics, with a reference to the section in [van Daalen 73 (A.3)] where it occurs. The language of the translation differs from the definition in [van Daalen 73 (A.3)] in one respect, viz. the division of the text into paragraphs [van Daalen 73 (A.3), 2.161. By this device the strict rule that all constants [van Daalen 73 (A.3), 2.6, 5.4.11 in an AUT-QE book [van Daalen 73 (A.3), 2.13.1, 5.4.41 should be different is weakened to the more liberal rule that all constants in one paragraph have to differ. Now, in a line [van Daalen 73 (A.3), 2.13, 5.4.41, reference to constants defined in the paragraph containing that line is as usual, while reference to constants defined in other paragraphs is possible by a suitable


702

reference system. For a more detailed description of the system of paragraphing, see Appendix 2 [not an this Volume]. In contravention of the rules for the shape and use of names in AUT-QE, we will in examples in the following text not restrict ourselves to alpha-numeric symbols, and occasionally we use infix symbols. (Of course, in the actual translation of Landau’s book, these deviations from proper AUT-QE do not occur.)

CHAPTER 1. PREPARATION In this chapter the logic which Landau presupposes is analysed and its representation in AUT-QE is described. 1.0. The presupposed logic

In his Vorwort fur den Lernenden” Landau states: “Ich setze logisches Denken und die deutsche Sprache als bekannt voraus”. Clearly, in the translation AUT-QE should be substituted for “die deutsche Sprache”. The proper interpretation of “logisches denken” must be inferred from Landau’s use of logic in his text. This appears to be a kind of informal second (or higher) order predicate logic with equality. In the following some characteristics of Landau’s logic will be discussed, and illustrated by quotations from his text. (i)

Variables have well defined ranges which are not too different from types [van Daalen 73 (A.3), 2.21 in AUT-QE. Cf.: -

On the first page of “Kapitel 1”: “Kleine lateinische Buchstaben bedeuten in diesem Buch, wenn nichts anderes gesagt wird, durchweg naturliche Zahlen” .

- In “Kapitel2, $5’’ : Grosze lateinische Buchstaben bedeuten durchweg,

wenn nichts anderes gesagt wird, rationale Zahlen”. (ii)

Predicates have restricted domains, which again can be interpreted as types in AUT-QE. Cf.: -

-

“Satz 9: Sind 2 und y gegeben, so lie@ genau eine der Falle vor:

(1) 2 = y. (2) Es gibt ein u mit 2 = y + u ...” etc. It is clear that u (being a lower case letter) is a natural number, or u E nat. “Definition 28: Eine Menge von rationalen Zahlen heiszt ein Schnitt, wenn ...”.

Checking Landau’s “Grundlagen”, Prepaxation (0.2)

703

Here it is apparent that being a “Schnitt” is a predicate on the type of sets of rational numbers. (iii)

When, for a predicate P , it has been shown that a unique x exists for which P holds, then “the x such that P” is an object. Cf.: - “Satz 4, zugleich Definition 1: Auf genau eine Art laszt sich jedem

Zahlenpaar x,y eine natiirliche Zahl, x+y genannt, so zuordnen dasz ... . x y heiszt die Summe von x und y”.

+

+

X > Y so hat X U = Y genau eine Losung U . Definition 23: Dies U heiszt X - Y”.

- “Satz 101: 1st

(iv)

The theory of equivalence classes modulo a given equivalence relation, whereby such classes are considered as new objects, is presupposed by Landau. Cf.: -

The text preceding “Satz 40”: “Auf Grund der Satze 37 bis 39 zerfallen alle Briiche in Klassen, so dasz x1 -

N

22

und

y1

dann und nur dann, wenn

Y2

21

-

22

derselben Klasse angehoren”. Y2

-

“Definition 16: Unter eine rationale Zahl versteht mann die Menge aller einem festen Bruch aquivalenten Bruche (also eine Klasse im Sinne des fj1)”.

(v)

The concepts “function” and “bijective function” are vaguely described. Cf.: - “Satz 4” (see (iii) above).

< y so konnen die m eineindeutig bezogen werden” .

- ‘‘Satz 274: 1st x

- “Satz 275: Es sei x fest, f(n)fur n

5 x nicht auf die n 5 y

5 x definiert. Dann gibt es genau

ein fur n 5 x definiertes gz(n)mit folgenden Eigenschaften ...” followed by the “explanation”: “Unter definiert verstehe ich: als komplexe Zahl definiert” , This explanation might be interpreted to indicate the typing of the functions f and g. (vi)

Landau defines and uses partial functions. Cf.: -

“Definition 14: Das beim Beweise des Satzes 67 konstruierte spezielle 211

-

212

heiszt

21

Y1 --

22

Y2

-

...‘I.

nition, only applies if

Here the construction. and therefore the defi21

-

> y1 -.

22

Y2

L.S.van Benthem Jutting

704

- “Definition 56: Das Y des Satzes 204 heiszt

-

r”. This definition deH

pends upon H # 0. - “Definition 71”,where Landau states explicitly: “Nicht definiert ist x” also lediglich fur x = 0, n 5 0”.

X > Y folgt X = ( X - Y )+ Y”. “Satz 240: 1st y # 0 so ist - . y = x”. Y

- “Satz 155: Beweis: 11) Aus -

X

- “Satz 291: Es sei

n > 0 oder

XI

# 0, xz #

0. Dann ist

( ~ 1 . ~= 2 ) ~

xy . x y . In these last three examples we see “generalized implications”: the terms occurring in the consequent are meaningful only if the antecedent is taken t o be true. A similar situation will be encountered in (vii). (vii) Definitions by cases, sometimes of a complicated nature, are used. Cf.: -

“Definition 52:

f -(Pl+IHl) 181- IHI

-=+H =

0

-(IHI - 1Bl) H+E H

wennBc0, HO, H < O , wennB O . wenn Z = 0 .

-

wenn H = 0”.

I

- “Definition 71:

IElX I”={

1

1

wenn n

> 0.

wennx#O,

n=O.

w e n n x # O , n, y + z bzw. x + z = y + z bzw. x + z < y + z

folgt x > y bzw. x = y bzw. x < y. Beweis: Folgt aus Satz 19 d a die drei FQle beide Male sich ausschlieszen und alle Moglichkeiten erschopfen” . A somewhat different example, which involves what might be called “metalogic”, is the text preceding “Definition 26”, where it is indicated how a number of theorems might be proved, without actually proving them. I will return to this in 2.1 (viii).

1.2. The representation of logic in AUT-QE The logic considered by Landau to be “logisches Denken”, as described in the previous section, has been formalized in the first part of the AUT-QE book, called “preliminaries”, which, unlike the other parts, does not correspond to an actual chapter of Landau’s book. A possible way of coding logic in AUT-QE has been described in [van Daalen 73 (A.3), 3, 41. In addition to this description we stress a few points on the interpretation of AUT-QE lines [van Daalen 73 (A.3), 2.13, 5.4.41. Adopting the terminology introduced in [Zucker 77 (A.4)] we shall call expressions of the form [ X I : a11 ... [xk : a k ] type (with k 2 0) (i.e. t-expressions of degree I) l t expressions and expressions of the form [ X I : a11 ... [xk : a k ] prop (again with k 2 0) lp-expressions. Expressions having I t - and lpexpressions as their types, will be called 2t-expressions and 2pexpressions, respectively. Finally, 3t- and 3pexpressions have 2t- and Ppexpressions as their types. Now a 2t-expression will be used to denote a type (or “class”). If its type is an abstraction expression [van Daalen 73 (A.3), 2.8, 5.4.21 then it denotes

Checking Landau’s “Grundlagen”, Preparation (0.2)

707

a type of functions. A 2pexpression denotes a proposition or a predicate. A 3t-expression denotes an object (of a certain type) and a 3pexpression a proof (of a certain proposition). The interpretation of an AUT-QE line having a certain shape (EB-line, PNline or abbreviation line [van Daalen 73 ( A . 3 ) , 2.13, 5.4.41) will depend on its category part [van Daalen 73 ( A . 3 ) , 2.13.11 being a It-, lp, 2t- or 2pexpression. So we arrive at the following refinement of the scheme in [van Daalen 73 (A.3), 4.51.

Shape of the line:

Category-part lt-expression introduces a type variable

lpexpression introduces a proposition or predicate variable

2t-expression introduces= object variable (of the stated type)

PN-line

introduces a primitive type constant

introduces a primitive object (of the stated type)

Abbreviation line

defines a type in terms of known concepts

introduces a primitive proposition or predicate constant defines a proposition or predicate in terms of known concepts

EB-line

defines an object (of the stated type) in terms of known concepts

2pexpression introduces the stated proposition as an assumption introduces the stated proposition as an axiom proves the stated proposition as a theorem

In the above scheme it is apparent that, if the category part of a line is a Ipexpression, then the interpretation of that line is an assertion. But also if the category part is a 2t-expression a , the interpretation has an assertional aspect; the line does not only introduce a new name for an object (as a variable, or a primitive or defined constant) but also asserts that this object has the type a.

1.3. Account of the PN-lines Here I will give a survey of the primitive concepts and axioms (PN-lines) occurring in the preliminary AUT-QE text. A mechanically produced list of

L.S.

708

vitn

Benthem Jutting

these axioms appears as Appendix 3 [see lD.5,11, in this Volume]. In this list the PN-lines appear numbered. References in parentheses below will refer to these numbers. (i)

Axioms for contradiction. Contradiction is postulated as a primitive proposition (l),the double negation law as an axiom (2).

(ii) Axioms for equality. Given a type S, equality is introduced as a primitive relation on S (3), with axioms for reflexivity (4)and for substitutivity (5) (i.e. if x = y , and if P is a predicate on S which holds at x, then P holds at y ) . Moreover, there is a n axiom stating extensionality for functions (8). The notion of equality so introduced is called book-equality (cf. [ v a n Daalen 73 (A.3), 3.61) in contrast to definitional equality of expressions ( [ v a n Daalen 73 (A.3), 2.12, 5.5.61). (iii) Axioms for individuals. Given a type S, a predicate P on S, and a proof that P holds at a unique x E S , the object 2nd (for individual) is a primitive object (6), to be interpreted as “the x for which P holds”. An axiom states that and satisfies P

(7). (iv) Axioms for subtypes. Given a type S and a predicate P on S, the type O T (for own-type, i.e. the subtype of S associated with P ) is a primitive type (9). For U E O T we have a primitive object in(u)E S (lo), and an axiom stating that the function [u : OT] in(u)is injective (12). Moreover, there are axioms to the effect that the images under this function are just those x E S for which P holds ((11) and (12)). (v) Axioms for products (of types). Given types S and T the type pairtype (the type of pairs (x,y ) with c E S and y E T ) is introduced as a primitive type (14). For p E pairtype we have the projections first(p)E S and second ( p ) E T as primitive objects (( 16) and (17)), and conversely, for x E S and y E T we have pair (x,y ) as a primitive object in pairtype (15). Next there are three axioms stating that pair (first(p),second ( p ) ) = p , first(pair (x,y ) ) = z and second (pair (x,y ) ) = y (where = refers to book-equality as introduced in (ii)) ((19), (20) and (21)). (Note: If a type U containing just two objects is available, and if S is a type, the type of pairs (x,y ) with x E S and y E S may be defined alternatively as the function type [x : V l S . In the translation this was done at

Checking Landau’s LLGrundlagen”, Preparation (0.2)

709

the end of Chapter 1, where we took for U the subtype of the naturals 5 2. Therefore the pairing axioms as described above were not used in the actual translation.) (vi) Axioms for sets. Given a type S, the type set (the type of sets of objects in S) is introduced as a primitive type (21), and the element relation as a primitive relation (22). Given a predicate P on S, there is a primitive object setof ( P ) E set (denoting the set of x E S satisfying P ) (23), and there are two axioms to the effect that P holds at z iff z is an element of setof ( P ) ((24) and (25)). These can be viewed as comprehension axioms for S. (As sets contain only objects of one type, such axioms will not give rise to Russell-type paradoxes.) Finally extensionality for sets is stated as an axiom (26). The axioms for sets permit “higher-order” reasoning in AUT-QE, since quantification over the type set is possible. 1.4. Development of concepts and theorems in Landau’s logic

Here we give a sketch of the development of the logic in [Landau 301 from the axioms described in the previous section. Starting from the axioms for contradiction, the development of classical first order predicate calculus is straightforward. In this development more than usual attention has been paid to mutual exclusion: ’ ( A A B ) , and trichotomy: ( A V B V C ) A ( - { A A B ) A i ( B A C) A -.(C A A ) ) , because these concepts are used frequently by Landau in discussing linear order. The properties of equality, e.g. symmetry, transitivity, and substitutivity for functions (i.e. if z = g and f is a function on S then f(z)= f ( y ) ) , follow from the axioms for equality. The development of the theory of equivalence classes (cf. 1.0 (iv)) requires the axioms for subtypes and for sets. It turns out here, when translating mathematics into AUT-QE, that Landau goes quite far in considering concepts and statements about those concepts to belong to “logisches Denken”. We had to choose how to describe partial functions in AUT-QE. As an example let us consider the function f on the type rl of the reals, defined for all 5 E rl for which z # 0, and mapping z to 1/x. There are (at least) four reasonable ways to represent f : (i)

The range of f may be taken to be rl*, the “extended type” of reals, containing, apart from the reals, an object und representing “undefined”. In this case (0) f will be (book-equal to) und, and rl may be defined as OT(rl*,[z : rl*] (z # und)).

710


(ii)

An arbitrary fixed object in rl, 0 say, may replace und. Then (0) f will be taken t o be 0.

(iii) f may be considered as a function on OT(r1,[z : rl]z the nonzero reals.

# 0), the subtype of

(iv) f may be represented as a function of two variables: an object x E rl and a proof p E z # 0. so

f E [x: T I ] [p, z # 01 rl (Then, given an 2 such that 2 # 0, i.e. given an z and a proof p that x # 0, we can use (p) (z)f t o represent I/z.) It is clear that the representations (i) and (ii) have much in common. The representations (iii) and (iv) are also related: in fact, we may construct, by the axioms for subtypes, for given z E r l and p E z # 0 an object out(z,p)EOT(rl, [z : rl]z # 0). Then, if fl

E [z : O T ( d ,[x: T I ] x

# O)] rl ,

then

[z::rl][p,z#O](out(z,p))fl~[x:rl][p,z#O]rl. On the other hand, if f2

E [z : rl] [p, z

# 01 rl

then [z : OT(r1,[z : rl]z

# O)] (OTAz(z))(in(z)) f2

E [z : OT(r1,[z : d ]z

# o)] rl

(for brevity some obvious subexpressions in the formula above have been omitted). After a careful examination of Landau’s language, I have decided that the fourth representation is closest to his intention, and have therefore adopted it. However, this leads to the following difficulty: Let, in our example, z E r l and y E r l be given, such that x = y, and suppose we have proofs pE (z # 0) and q E (y # 0). Now it is not a priori clear in AUTQE (though it is clear to Landau), that the corresponding values (p) (z) f and (q) (y) f will be equal. That is: it is not guaranteed in the language that the function values for equal arguments will be independent of the proofs p and q. This property of partial functions, which is called irrelevance of proofs, can be proved for all functions which Landau introduces. When discussing arbitrary

Checking Landau’s “Grundlagen”, Translation (D.2)

711

partial functions, however, irrelevance of proofs had to be assumed in some places (cf. gite below). For a further discussion we refer to 4.0.1. As a consequence of the chosen representation of partial functions, terms may depend on proofs, and therefore certain propositions are meaningful only if others are true. This gives rise to generalized implications (cf. 1.0 (vi)) and generalized conjunctions, such as: “2

> 0 * 1/x > 0”

and “x > 0 A

fi # 2” .

Logical connectives of this kind have been formalized in the paragraph iir’lin the preliminary AUT-QE text. The definition-by-cases operator ite (short for if-then-else, cf. 1.0 (vii)) can be defined on the basis of the axioms for individuals. As we have seen (1.0 (vii)), Landau admits partial functions in such definitions. For these cases a “generalized” version of the definition-by-cases operator gite (for generalized ifthen-else) is required, which has been defined only for partial functions satisfying the irrelevance of proofs condition. All set theoretical concepts used by Landau (cf. 1.0 (viii)) may be defined starting from our axioms for sets. The passages in Landau’s text which use more or less intuitive reasoning (cf. 1.0 (x)) could not very well be translated. In the relevant places straightforward logical proofs were given, which follow Landau’s line of thought as closely as possible.

CHAPTER 2. TRANSLATION In this chapter, we discuss the actual translation of Landau’s book, the difficulties encountered and the way they were overcome (or evaded). First, in Section 2.0, we given an abstract of Landau’s book; then, in Section 2.1, a general survey is given of the various reasons to deviate occasionally from Landau’s text. In the following sections we describe the translation of the Chapters 1 to 5 of Landau’s book. 2.0. An abstract of Landau’s book

(i)

“Kapitel 1. Natiirliche Zahlen”. Peano’s axioms for the natural numbers 1,2,3, ... are stated. ‘i+l’ is defined as the unique operation satisfying x 1 = x‘ and x y‘ = (x y)’. Properties of (associativity, commutativity) are derived.

+

+

+

+

L.S. van Benthern Jutting

712

+

Order is defined by z > y := 3 u(z = y u ] . It is proved to be a linear order relation and its connections with are derived. “Satz 27” states that it is a well-ordering. “.” (multiplication) is defined as the unique operation satisfying z . 1 = z and z.y’ = z.y z. Properties of “.” (commutativity, associativity) are derived, and also its connections with (distributivity) and with order.

+

+

(ii)

+

“Kapitel 2. Briiche”. Fractions (i.e. positive fractions) are defined as pairs of natural numbers. Equivalence of fractions is defined, and proved to be an equivalence relation. Order is defined, it is shown to be preserved by equivalence, and to be an order relation. Properties are derived (e.g. it is shown that neither maximal nor minimal fractions exist, and that the set of fractions is dense in it self). Addition and multiplication are defined, and proved to be consistent with equivalence. Their basic properties and interconnections are derived, and their connections with order are shown. Also subtraction and division are defined. Rationals (i.e. positive rational numbers) are defined as equivalence classes of fractions. Order, addition and multiplication are carried over to the rationals, and their various properties are proved. Finally the natural numbers are embedded, and the order in the rationals is shown to be archimedean.

(iii) “Kapitel 3. Schnitte”. Cuts in the positive rationals are defined. For these cuts, order, addition (with subtraction), and multiplication (with division), are defined, and again the various properties and interconnections of these concepts are proved. The rationals are embedded, and the set of rationals is proved to be dense in the set of cuts. Finally the existence of irrational numbers is proved, by introducing \/z as an example. (iv) “Kapitel 4. Reelle Zahlen”. The cuts are now identified with the positive real numbers, and to these the real number 0 and the negative reals are adjoined, in such a way that to every positive real there corresponds a unique negative real. The absolute value of a real number is defined. Order is defined, its properties are derived, and the predicates “rational” and “integral” (“ganz”) are defined on the reals. Now addition and multiplication are defined, and their properties and their

713

Checking Landau’s “Grundlagen”, Translation ( 0 . 2 )

connections with each other, with absolute value and with order are derived. In particular the minus operator (associating to each real its additive inverse) is discussed, as well as subtraction and division. Finally, in the “Dedekindsche Hauptsatz” , Dedekind-completeness of the order in the reals is proved. (v)

“Kapitel 5. Komplexe Zahlen”. Complex numbers are defined as pairs of reals. Addition, multiplication, subtraction and division, their properties and interconnections are discussed. To each complex number i s associated its conjugate, and also (following the definition of the square root of a nonnegative real) its modulus (as a real number). The connections of these two concepts with each other and with the previously introduced operations are derived. For an associative and commutative operator * (which may be interpreted as either or .), and for an n-tuple of complex numbers f ( l ) ,...,f(n), Landau denotes

+

f(1) * f ( 2 )

* ... *

f ( n ) by

@?=I

f(i) .

This concept is defined as the value at n of the unique function g (with domain {1,2,,..,n}) for which g(1) = f(1) and g ( i ’ ) = g ( i ) * f(i’) for i < n. The properties of @ are proved, in particular, for a permutation s of {1,2, ...,n} it is proved that

+

+

The definition of @ is extended to n-tuples f ( y ) , f ( y l),...,f ( y n - 1) (where y is an integer), and its properties are carried over to this situation. C is defined as the specialization of @ to the operation +, and as are its specialization to . (multiplication). Some properties of C and proved. For a complex number 2 and an integer n, with 2 # 0 or n > 0, zn is defined, and its properties and connections with previously defined concepts are discussed. Finally the reals are embedded in the set of complex numbers, the number i is defined, it is proved that i2 = -1, and that each complex number may be uniquely represented as a bi with a, b real.

n

n

+

2.1. Deviations from Landau’s text In our translation, deviations from Landau’s text appear occasionally. They may be classified as follows:


714

(i)

In some cases a direct translation of Landau’s proofs seems a bit too complicated. We list three reasons for this.

(a) Sometimes it is due to the structure of AUT-QE which does not quite agree with the proof Landau gives. E.g. in the proof of “Satz 6” Landau applies, for fixed y, induction with respect to x. As xE nut, y E nut is a common context in the translation, it is easier there to apply, for fixed x, induction with respect to y. (b) Sometimes the reason is that Landau uses a unifying argument. E.g. in the proof of the “Dedekindsche Hauptsatz” there are, at a certain stage, two real numbers E and H , such that E > 0 and Z > H . Here Landau needs a rational number z , such that E > z > H. Now it has been proved in “Satz 159” that between any two positive reals there is a rational. If H > 0 this may be applied immediately. If H 5 0

-

I

Landau defines HI= and again applies “Satz ‘159”, this time 1+1 with H I . This argument, however, is complicated, because, to apply “Satz 159”, first 0 < H I < Z has to be proved (which Landau fails to do). And it is superfluous because every z in the cut Z will meet the conditions in this case. ~

( c ) In one instance (the proof of “Satz 27”), Landau has given a complex proof, which may be simplified. In all these cases I have, in the translation, given a proof which follows Landau’s line of reasoning. However, in some cases, I have also given shorter alternative proofs. This means that the deviations are optional in these cases. (ii)

Some of Landau’s “Satze” really consist of two or three theorems. E.g. Tatz 16: Aus x 5 y, y < z oder x < y, y 5 z folgt x < 2”. In such cases the theorem has been split up: “Satz 16a: Aus x 5 y, y < z folgt x < z ” , “Satz 16b: Aus x < y, y 5 z folgt x < 2’.

(iii)

Very frequently Landau uses without notice a number of more or less trivial corollaries of a theorem he has proved. E.g. besides “Satz 93: ( X + Y ) + Z = X + ( Y + Z ) ” he uses “ X + ( Y + Z ) = ( X + Y ) + Z ” without quoting “Satz 79”. Sometimes such a practice is explicitly announced, e.g. in the Vorbemerkung” to “Satz 15”, where it is stated that, with any property derived for shall be used. In all such cases the corollaries have been formulated and proved after the theorems.

Checking Landau’s “Grundlagen”, Translation (0.2)

715

(iv)

Following the translation of the definition of a concept, we often added the specialization to this concept of certain general properties. E.g. after the introduction of +, substitutivity of equality was applied: “If x = y then x+z = y+z and z+x = z+y. If x = y and z = u then z+z = y+u”. This was done in order to make later applications easier.

(v)

In a few proofs of the last three chapters minor changes were made. E.g. in the proof of “Satz 145”, where Landau states: “AUS > 7 folgt nach Satz 140 bei passendem u E = q+u” but where, by “Definition 35” u can be defined explicitly by u := - q. This has been done in the translation, thus avoiding the superfluous existence elimination. Another deviation occurs in the proof of “Satz 284”. Here Landau writes the following chain of equalities:

Y

>y +z

+

bzw. x z = y bzw. x = y

+ z bzw. x + z < y + z bzw. x

< y.


716

Beweis: Folgt aus Satz 19 d a die drei FQle beide Male sich ausschlieszen und alle Moglichkeiten erschopfen” (where “Satz 19” asserts the inverse implications). Considering the fact that Landau regards this proof as belonging to “logisches Denken”, I have proved in the preliminaries three “logical” theorems to the effect that: D , B + E , C =+ F , If A V B V C , - ( D A E ) , 7 ( E ~ F )- (, F A D ) and A then D =+ A , E =+ B and F =+ C. These theorems were used in the translation. A second example: “Satz 17: Aus x 5 y, y 5 z folgt z 5 z . Beweis: Mit zwei Gleichheitszeichen in der Voraussetzung klar; sonst durch Satz 16 erledigt” (“Sazt 16” is quoted above under (ii)). Here the AUT-QE text, when translated back into German, might read: L‘Beweis: Es sei z = y. Dann ist, wenn y = z , auch x = z also z 5 z. Wenn aber y < z so ist x < z nach Satz 16a, also ebenfalls x 5 z . Nehme jetzt an x < y. Dan folgt aus Satz 16b x < z , also auch in diesem Fall x 5 z . Deshalb ist jedenfalls x 5 z ” . Another argument which is difficult to translate faithfully occurs in “Kapitel 5, $8’’ where sums and products are introduced. Landau uses here a symbol which he intends to represent either 6L+” or “.”, and in this simultaneously. In our translation we defined way defines “C” and iteration for arbitrary commutative and associative operators, and consequently our concept and the relevant theorems are essentially stronger than Landau’s. This generality is much easier to describe in AUT-QE and “.”. than a theory which applies only t o LL+”

*

“n”

(viii) Landau uses metatheorems whenever he embeds one structure into another, to show that the properties proved for the old structure “carry over” to the new. As an example I cite his treatment in Chapter 2 of the embedding of the natural numbers into the (positive) rationals.

folgt

x > y bzw. x = y bzw. x < y”.

“Definition 25: Eine rationale Zahl heiszt ganz, wenn under den Briichen, deren Gesamtheit sie ist, ein Bruch

X -

1

vorkommt”.

“Dies x ist nach Satz 111 eindeutig bestimmt, und umgekehrt entspricht jedem x genau eine ganze Zahl”.

Checking Landau’s “Grundlagen ”, Translation (0.2)

717

“Satz 113: Die ganzen Zahlen geniigen den fiinf Axiomen der natiirlichen 1 Zahlen, wenn die Klasse von - an Stelle von 1 genommen wird, und als 1 2

2’

Nachfolger der Klasse von - die Klasse von - angesehen wird”. 1 1 Landau adds the following comment: ‘LDa=, >, E2 P

> B,where > represents a boolean P P

then A := E2 else ... .

If a P-reduction is applicable to A (so A = ( A l ) [z : A21 A3) then B becomes 1[z/A1]lA3, and the procedure identifier gets the value true. If A has the form ( A l ) A z , where A2 does not have an abstraction shape, so that no direct P-reduction is possible, then the procedure tries to reduce A2 with 0-and/or &reduction so as to obtain the form [x : A31 Ad. At that point the actual O-reduction can be carried out. 6.2.1. Procedure text 6.2.1.1. boolean procedure A > B;

P

expression A , B; comment if A is reducible by P-reduction, then P-reduct of A ;

B becomes the

A verifying program for Automath ( E l )

791

begin i f shape(A) = ( P )Q then begin boolean possible; possible := shape(Q) = [z : R]T ; i f not possible then begin boolean continue; continue := true; while continue do ?(begincase shape(Q) of begin ( R ) S : continue := Q > U

P

d ( C ) : continue := Q > U 6 otherwise : continue := f a l s e ; end; i f continue then begin Q := U ; possible := shape(Q) = [z : R]T; continue := not possible; end; end)?; end; i f possible then begin B := BOUNDSUBST(z, P,T); > := true;

4

end else end else

>

0

> P

:= f a l s e ;

:= false;

end: 6.3. greduction

The whole procedure runs under cnntrol of the boolean “eta reduction allowed”, which may be set or reset by the user. When reset (eta reduction allowed = f a l s e ) , the verificator can only use a-,P- and &reduction. Interestingly enough, in the Automath texts, checked so far, q-reduction has almost never been used. The 7-reductor is written in the same form as the P-reductor: A > B. 77 We have for A the following cases. (i) A = [z : P] (Q) R. (a) If Q

2 z then the procedure

first tries t o reduce (Q) R.

I. Zandleven

792

(b) If Q 2 z, but z occurs in R then the procedure first tries to remove z in R by reducing R. (c) If Q 2 z and z does not occur in R , then the 77-reduct ( B ) becomes R and > gets the value true.

77

(ii) A = [x : P ] Q , Q = d ( C ) or Q = [y : R] S. Now the procedure first tries to reduce Q, and afterwards tests if an 77reduction is possible. In either case if no 7-reduction is possible, the procedure identifier > gets the 77 value false. There appear two procedures in > , which must still be explained. 77 D Firstly there is the procedure = to declare as boolean procedure El Ez; where El and E2 are expressions. This procedure investigates whether El and E2 are definitionally equal, and is described in 8. Secondly there is the procedure OCCURS IN, which searches an expression for occurrences of a specific bound variable. This procedure is defined as follows. 6.3.1. Procedure text for OCCURS IN 6.3.1.1. boolean procedure z OCCURS IN E ; boundvar x; expression E ; OCCURS IN := case shape(E) of begin boundvar : x = E ; : 3, x OCCURS IN Ci d(C) ( A )B : x OCCURS IN A or x OCCURS IN B; [y : A] B : z OCCURS IN A or z OCCURS IN B; otherwise : false; end; 6.3.2.1. Procedure text for the 77-reductor 6.3.2.1.1. boolean procedure A > B;

77

expression A, B; comment if A is reducible by 77-reduction then B becomes the areduct of A; if eta reduction allowed then


793

begin i f shape(A) = [x : P] Q then case shape(Q) of begin

D

( R ) T : i f x = R then i f not x OCCURS IN T then begin > *- t r u e ; B := T 77 *end else ? ( i f T 2 TI and not x OCCURS IN TI then begin > .- t r u e ; B := T

77

end else if Q

.-

> Q1 then := [z : P]Q1 $ B P e l s e > := f a l s e ) ? 77 e l s e i f Q > Q1 then > := [x : PI Q1 $ B P 77 e l s e > := f a l s e ; 77 d ( C ) : i f Q > Q1 then > := [x : P]Q1 $ B 6 77 e l s e > := f a l s e ; 77 [ x : R ] T : i f Q > Q ~ t h e n >:= [ z : P ] Q 1$ B 77 77 e l s e > := f a l s e ; 77 otherwise: > .- f a l s e ; 77

end else end else

>

77

>

77

.-

:= f a l s e ;

:= f a l s e ;

6.3.2.2. The part between ?( and )? has not yet been implemented. Although such cases are easily constructed (e.g. [x : XI (z) f(z,y), where f(z,y) > y), 6 in practice this has never occurred up to now. 6.4. &reduction

The b-reductor is written in the same way as the P- and 77-reductor, and tries to perform a single &reduction on the presented expression. If the presented expression has shape d(C), the procedure takes the middle expression of the line where d is defined (= MIDDLE(d)) and replaces the free variables in it (i.e. the elements of INDSTR(d)) by the expressions of C.

I. Zandleven

794

6.4.1. Procedure text 6.4.1.1. boolean procedure A > B;

6

expression A, B; comment if A reducible by &reduction then B becomes the b-reduct of A . begin i f shape(A) = d(C) then i f d represeids a n abbreviation then begin > .- true; B := SUBST(INDSTR(d), C, MIDDLE(d));

6 *-

end else else

>

6

> 6

:= f a l s e

:= f a l s e ;

end;

7. C A T A N D D O M As pointed out in [ v a n Daalen 73 (A.3), 6.41, we need two functions, CAT and DOM, to compute mechanically the category (type) and the domain of an expression respectively.

7.1. The ‘Lmechanicaltype” function CAT is defined by induction on the length of the expressions as follows. Let B be a correct book and (i)

If

0

= z1 E 01,

0

a correct context

...,zn E an then CAT(zi)

:= a1.

(ii) If d is an abbreviation constant, defined in a line of B by d := A E B, with indicator string I , then CAT(d(C)) := I[I/C]l B. (iii) CAT((A) B) := if CAT(B) G [z : PI Q then I[zclAII Q else (A) CAT( B) (iv) CAT([z : A] B) := [z : A] CAT(B) CAT is not defined for variables with shape = boundvar (see 5.1), because in the verification process there is no need for it (9.5). Further CAT is not defined for 1-expressions, of course. It is easy to see that, if the argument for CAT is a correct expression, the outcome will again be correct.

A verifying program for Autornath ( E l )

795

7.2. The procedure text of CAT reflects the given definition completely.

7.2.1. express ion procedure CAT( E ) ; Expression E ; CAT := case shape(E) of begin variable : CATEGORY(E); d(C) : SUBST(INDSTR(d),C, CATEGORY(d)); ( A )B : if shape(CAT(B)) = [z : P]Q then BOUNDSUBST(z, A, Q) else ( A )CAT(B) [z : A] B : [z : A] CAT(B); otherwise : undefined; end; 7.3. The “mechanical domain” f u n c t i o n DOM

This procedure has to yield (where possible), for a given expression A, an expression a , such that F A E [z : a]p or F A = [z : a]/3. For expressions A of the form [z : B ] C , the computing of the domain is trivial: DOM(A) = B. If A is a variable, we may compute the domain of the category of A. More difficult is the case where A has the shape d ( C ) or the shape ( B )C

.

If we try to reduce A, we may end up with a PN (e.g.: d(C) 2 f(I’), f := PN). On the other hand, if we take the category of A by computing CAT(A), we may obtain type or [q, c q ] ... (z, a,] type. To deal with this probem we use the following strategy. At first CAT(A) is computed, and presented t o DOM (N.B. This is a recursive call, so possibly CAT(CAT(A)) is computed.) If DOM(CAT(A)) does not yield a domain at all, then a 6- or &reduction on A is carried out (if possible), and the reduct is again presented to DOM. Since only 1, 2 and 3-expressions are investigated, the whole process can be given by the following tree figure:

796

I . Zandleven

Figure 1 7.3.1. Procedure text 7.3.1.1. expression procedure DOM(A); expression A; case shape(A) of begin [ z : B]C : DOM := B; variable : DOM := DOM(CATEGORY(A)); d ( C ) ,( B )C : begin D := DOM(CAT(A)); if undefined (D)then if A > A1 then DOM := DOM(A1) 6 else if A > A1 then DOM := DOM(A1)

P

otherwise end;

else DOM := undefined else DOM := D end; : DOM := undefined;

8. DEFINITIONAL EQUALITY To verify the correctness of a given =-formula we will use the Church-Rosser theorem: if A = B then A 2 C 5 B for some C (see also [van Daalen 73 (A.,?), 6.3.11).


797

D

This definition is the guide for the procedure = which we will introduce here.

D

8.1. Description of = The type of the procedure is boolean, and the identifier will be written in

D

infix notation, viz. A = B (in the same way as for

D

> > D’ 6

etc.).

Roughly speaking, in order to check A = B, the procedure tries to reduce A

D

and/or B until either the two expressions are identical or the decision A # B can be made. It is not always necessary for both complete expressions to be present during the whole reduction process. If, for example, A = d ( C l , C 2 , C 3 ) and B = d(C1, C4, C,) then the procedure needs only parts of both expressions, namely

D

and CQ,and will check C2 = E d . So, in general, the procedure uses recursive calls, applied to sub-expressions, following the monotonicity rules described in [ v a n Daalen 73 (A.3), 5.5.61. Recursive calls are also used for the reduction sequences. Firstly the p r e cedure tries, if necessary, to reduce one of the expressions A and B. Which is reduced is a matter of strategy. If one of the two expressions is reduced, one could continue the equality-check by using an iterative or a recursive method. A recursive method is chosen in order to make the algorithm more readable. C2

Example. If A = d(C) and B = ( P )Q then the procedure first tries to reduce B by P-reduction. If this succeeds, and the outcome is B1, then the definitional equality of A and B follows from that of A and B1.

D

Otherwise the procedure tries to reduce A to A1 (say) and checks A1 = B.

D

If this also fails, then the procedure identifier = gets the value f a l s e .

8.2. Type inclusion If we want to verify A E B , we check t- A and t- B, compute CAT(A) and

D

check CAT(A) = B ; so CAT(A) is the first parameter and B is the second parameter of the procedure call. D In order to accept type inclusion as well, we add a slight extension to =, namely:

D

[z : A] type = type

will be accepted as correct, but not

D

type = [z : A] type

.

I. Zandleven

798

The same holds for prop. So the procedure is no longer symmetrical for 1expressions. (Notice that calls are sometimes made with reversed order of the arguments D of =, but as one can see in the procedure text these cases can never refer to 1-expressions.) D Now the definition of = is exactly the same as that of E [van Daalen 73 (A.3), 61. 8.3. OLDER THAN

D D The procedure = needs, in one special case, namely d(C) = b ( r ) and d f b, the boolean procedure OLDER THAN, to decide which of d and b must be reduced. It seems a good strategy to start off by reducing the younger of the two, i.e. the constant which was the more recently, for in this way we have a chance of reducing it to the other. 8.3.1. boolean procedure d OLDER THAN b; def inedname d, b; comment OLDER THAN := the line in which b is defined, appears later in the book than the line in which d is defined;

D

8.4. Procedure text of = 8.4.1. D boolean procedure El = expression El, E2;

E2;

Q - ..case (shape(E1), shape(E2)) of begin (type, type) : true; (type, otherwise) : false; (prop, Prop) : true; (prop, otherwise) : false; (variable, variable) : El = E2

D

>

E22

then El =

Ez >

E22

then El =

E22

then El = E22 else f a l s e ;

(variable, d( C))

: i f E2

(variable, ( A )B )

: if

(variable, [z : A ] B )

: i f E2

(variable, otherwise)

: false;

6

P >

9

D

D

E22

else f a l s e ;

E22

else false;


799

(boundvar, boundvar) : El = E2; (boundvar, otherwise) : consider (variable, shape(&)) : i f d = b then

SD

if c = else ? ( i f El

r thentrue

> Ell then 6

Ell

D

=

E2 e l s e f a l s e ) ?

else i f d OLDER THAN b then i f E2

D

>

E22

then El = E 2 2 e l s e f a l s e

>

El1

then Ell = E2 e l s e f a l s e ;

6

else i f El

6

D

> E22 t h e n El D = E22 e l s e P D El > Ell then El1 = E2 e l s e f a l s e ;

: i f E2

if

6

: i f E2

>rl

E22

D

t h e n El = E 2 2 e l s e

D Ell t h e n Ell = E2 e l s e f a l s e ; 6 : consider reverse (i.e. (shape(E2), shape(E1))) D D : i f A = C and B = D then t r u e i f El

>

else ? ( i f El i f E2

> P > P

D

El1

then El1 = E2 e l s e

E22

t h e n El = E 2 2 e l s e f a l s e ) ? ;

D

> Ell then Ell D = E2 e l s e P D E2 > E22 t h e n El = E22 e l s e f a l s e ;

: i f El

if

77

: consider reverse;

:

B D = D B =

:

D D i f A = C then B = BOUNDSUBST(y, z, D )

:

E2; E2;

else false; : consider reverse;

end;

I . Zandleven

800

8.4.2.

sz

boolean procedure expressionstring C1, C2;

C2;

D

SD

comment = is the string analogue of =;

sg := if C1

3

else C;

0 then Cz

s$

0

C, and E:

D

= Xi;

9. CORRECTNESS OF EXPRESSIONS (k) 9.1. Correctness of an expression is checked by the boolean procedure “I-”, operating on an expression (say E ) and the indicator string (say I ) belonging to E. A procedure call is written like I I- E. Mentioning I is necessary, on account of the free variables in E which must all appear in I . Two non-trivial cases arise: (1) If shape(E) = ( A ) B, then the “applicability” (let us say) of B to A has to be checked. D This is done by looking at: CAT(A) = DOM(B) (see also [van Daalen 73 (A.3), 6.4.2.31).

(2) If shape(E) = d(C) then : all Ci must be correct, firstly secondly : all Ci must have the correct categories. In the case 2 there is a difficulty: Let us consider the following book:

0*

Q

:=

EB;type.

*a *f

:=

EB; Q

:=

0*P

:=

P N ;type EB;type

Q

a

P * b := E B ; P b

*g

:=

f(P,b);type.

Now: ( P , b ) I- f ( P , b ) , nevertheless the string of types expected by f is not definitionally equal t o the string of given types:


801

We may conclude that after checking the definitional equality of the first two categories, we have to replace, in the category string of (a, a ) , the variable Q by

0. This replacement (substitution) is, in a more general way, done by the procedure CORRECTCATS (see also [van Daalen 73 (A.3), 2.5 and 5.4.61).

9.2. boolean procedure CORRECTCATS(C, I ) ; expressionstring C, I ;

CORRECTCATS := if C = 8 then I = 8 else CORRECTCATS(C-, I-) and CAT@+)

SUBST(1-, C-,CAT(I+));

9.3. boolean procedure I I- E; expressionstring I ; expression E ; I- :=

case shape(E) of begin type : true; prop : true; variable : 3i(Ii E ) ; d(C) :I C and CORRECTCATS(C, INDSTR(d));

( A )B : I I- A and I I- B and CAT(A) DOM(B); [z : A] B : I I- A and ((I,.)) I- B; (see 9.5) otherwise : false; end;

9.4. boolean procedure I ks C; expressionstring I,C; comment FSis the string analogue of I-; i-* :=

if C E 8 then true else I Fs C- and I i- C+;

9.6. A comment on I I- [z : P] Q In this case, the checker, after checking I I- P , adds a “waste-line” to the book, of the form:

I. Zandleven

802

I

*

waste := E B ; P .

If we denote this new book by

B',then the checker checks the statement

B',( ( I ,waste)) I- I[z/waste]l Q . For this reason the correctness of a bound variable will never be asked for, and its CAT or DOM will never be computed. Only in D = can the shape boundvar occur.

10. THE CORRECTNESS OF LINES The checking for correctness of a n Automath line is now easy to describe in terms of already defined procedures:

10.1. boolean procedure CORRECT(L1NE); Automath line value LINE;

CORRECT := case form of the line is of begin

I I

I

* * *

N := E B ; E . : I t E ; N := P N ; El : I t - E ;

N := El ; E2 otherwise : false;

:

D I t - El and I t E2 and CAT(E1) =

E2;

end;

11. A PARAGRAPH SYSTEM As already mentioned in [wan Daalen 73 ( A . 3 ) , Section 2.161, the syntactical definition of AUT-68 (and AUT-QE) forces us to write mutually exclusive names (identifiers) for both variables and constants. This, of course, is very annoying to the writer of Automath. Therefore we have introduced a paragraph system. Each Automath text may be divided into sections, called paragraphs. A paragraph starts with:

+ paragraph name. and ends with: - paragraph name.


803

In a paragraph one may write Automath lines and other paragraphs (sub- paragraphs). Finally the whole book is contained in one big paragraph, so all paragraphs occur nested. Behind the identifier of a given constant one may write a so-called paragraph reference, t o indicate in which paragraph this identifier has been defined. An identifier b with paragraph reference to (say) paragraph P, is written in the form: b"P1 - P2 - ... - P,", where P2 is a sub-paragraph of P I , P3 is a sub-paragraph of P2, ... , and P, is the paragraph in which b is actually defined. An identifier, not followed by a paragraph reference, refers to a constant or variable defined in the same paragraph, or, if not found there, in the paragraph, which contains that one, and so on.

Example. ( a := ... denotes a definition of a ... ( a )... denotes a reference to a ) line nr

book

1

p :=

2 3

... (p"A")... ... (p"B")...

reference to line nr

+ A. ... + B. + c.

no good reference ( p has not been defined in B ) . 5 6 7

p := ... ... ( p ) ... ... ( p " A - B - C")... ... (p"A")...

8

... ( p ) ...

4

- c.

- 4

4 1 1

- B. - A.

12. FINAL REMARKS 12.1. We repeat that the procedures given here form only an outline of the actual verifier. Many more parameters are passed through the procedures to avoid duplication, to control critical passages, to permit communication with the user and so on.

804

I . Zandleven

12.2. With regard to efficiency, improvements may be possible. For example, D parts of the strategy, implemented in =, are more or less arbitrary, although suggested by reflexion and practical work. Experience and research may lead to better strategies. Also the use of the features of [de Bruijn 726 (C.2)] may lead to a more efficient verifier. 12.3. We are pleased to say, in any event, that the verifier has been working satisfactorily up t o now. 12.4. An example of a text checked with the described verifier is found in [van Benthem Jutting 731.

805

Checking Landau’s “Grundlagen” in the Automath System Parts of Chapter 3 (Verification) L.S. van Benthem Jutting

CHAPTER 3. VERIFICATION

In this chapter the verification of the AUT-QE text is described. features of the program and the possibility of excerpting are discussed.

Some

3.0. Verification of the text

The verification of the AUT-QE translation of Landau’s book was executed on the Burroughs BG700 computer a t t h e Eindhoven University of Technology. T h e last page of the book was checked in September 1975. T h e whole book was checked in a final run on October 18, 1973. The verifying program was conceived by N.G. d e Bruijn and implemented by I. Zandleven. For a description of this program we refer t o [Zandleven 7,?( E l ) ] .Zandleven also provided the program with input and output facilities, and extended it with a conversational mode for on-line checking and correcting of texts. The verification took place in three stages: (i)

First t h e AUT-QE text was fed into the system on a teleprinter. At this stage the main syntactical structure of the text was analyzed. It was checked, for example, t h a t the format of the lines was as it should be, that the bracketing of t h e expressions was correct, and t h a t no unknown identifiers occurred.

(ii)

Secondly t h e AIJT-QE text was coded. At this stage t h e correct use of the context structure, t h e validity of variables, t h e correct use of the shorthand facility [van Daalen 7’+?(A.:?), 2.151 and of the paragraph reference system (cf. Appendix 2 [not in this Volume]),were checked.

(iii) I’inally t h e text was checked with respect to all clauses of the language definition. At this stage t h e degree [van Daalen 7.“3(-4.3), 2.31 and types of

L.S. van Benthem Jutting expressions were calculated. and the correctness of application expressions and constant expressions was checked. Vital for this is t h e verificatioii of the definitional equality of certain types (cf. [aan Daulen 7.”)(.4.:1). 2.101. [Zandleveii 7.3 ( E . l ) ] ) . Runs of the stages (ii) and (iii) generally claimed much of the computers (virtual) memory capacity (over GOO K bytes were needed for the program together with t h e coded text). In order t o avoid congestion in the multi-programming system it was therefore necessary t o have the program executed a t night ( a n d off-line). As Automath texts are checked relative t o correct books. a mechanical provisional debugging device for off-line checking was implemented. by which lines which were found incorrect could be tentatively repaired. E.g., when the middle part [van Daalen 73 (-4..1)?2.13.11 of a line was found incorrect. the debugging device changed it temporarily into I”, thus turning an abbreviation line into a I”-line. T h e line so “corrected” was then again checked, and. if it was found correct. t h e lines following could then be checked relative t o the “corrected” book. By this device i t was not necessary t o stop the checking immediately after the first error had been found. Another feature of t h e verifying program was added because o f t h e fact that proving expressions t o be incorrect (especially proving expressions to be not definitionally equal) is often more difficult and more time-consuniing than proving correctness. Therefore during off-line runs a parameter in the program (viz. the number of decision points, t o be explained in 3.1) has been limited, and lines were considered provisionally incorrect when this limit was exceeded. When the later chapters were checked, we reduced the demands on the coniputers memory capacity by abridging the book relative t o which the text was checked, in t h e following way: In t h e chapters which had already been found correct, t h e proofs of theorems and lemmas were omitted, and t h e final lines of these proofs (where t h e theorems and lemmas are asserted) were changed into I”-lines. Each time a chapter was completely checked (relative t o the book so abridged) it was abridged in its turn. Texts which are correct relative to t h e abridged book will be correct with respect to t h e unabridged book too. On the other hand, as in classical mathematics there is no reference t o proofs but only t o assertions, it is unlikely t h a t texts which are correct relative t o t h e unabridged book will be rejected relative t o t h e abridged book. In actual fact this did not occur. When a chapter, after several off-line runs of t h e program, was found t o be “nearly correct”, the final verification of that chapter took place on-line. In such a n on-line run the remaining errors could be immediately corrected. Moreover, correct lines could be verified, which had been provisionally rejected because t h e number of decision points during verification in off-line runs had exceeded t h e chosen limit. The verification of such complicated lines could be shortened

(:hecking Landau's %rundlageii", L'erification (E.2)

807

by directing (in conversational mode) t h e strategy for establishing definitional equality. After all chapters were verified in this way, the integral AUT-QE text (coniplete and unabridged) was checked during a final on-line run, which took 2 hours (real time). Of this time '12 minutes were spent on verification (not including t h e time needed for coding). In a table we list some d a t a on this final run, concerning verification time, number of performed reductions and memory occupied. hapter hapter

preliiniiiary text

,hapter

~

107.3

secoiids cr-red iictioiis

:Iiapter

~

:hapter

total

text

~

~

verilicatioii time

haplei

1 2 3 4a 5 4 __ __ __ - __ ~

~

143.1

301.2

342.4

405.7

813.1

406.9

2519.7

752 832 1111

1077 460 1318

1455 466 1873

1644 414 27'4

3393 2749 9290

1533 529 3151

10485 6014 20063 2 13433 215138

iii

631 564 596

d-red tictioiis 6-retluctioiis r/-red tictiona iir.

I I ~ .of

-

1

1068 9388

of lines

expressions

886 12155

~

1603 25792

-

~

2181 30327

2779 42067

-

2690 60450

~

2226 34959

Since one coded expression occuL es 30 ytes (mainly used for references t o subespressions), the total nieniory required for t h e coded book is about ti500 K bytes (= 52000 K bits). 3.1. Controlling the strategy of the program

In ordertoestablish definitional equality of two expressions, t h e verification system tries t o find another expression t o which both reduce. T h e choice of efficient reduction steps for this purpose is a matter of strategy ([ziari Daaleii 73 ( A . 3 ) , 6.1.11). The programmed strategy is described in [Zandlcven 73 (/?.I,)], Under this strategy it is possible that intermediate results are obtained which strongly suggest a negative answer t o the question of definitional equality, without definitely settling it. Suppose, for example, that a ( p ) = a ( q ) has t o be established. T h e programs strategy is t o ascertain that t h e constants a and a are idrntical and t o verify whether p = y. If this is not the case, there is a strong sugge\tion that u ( p ) and u ( q ) are not definitionally equal either, but this is yet uncertain. Tor example. they are definitionally equal relative t o the book

* * * *

p

:= :=

y x

:= :=

71

x * * : : =

I" I" I" P

Etype E 71 E ?I E 71 E 11

808


It is a matter of strategy how t o proceed in such cases. We may either apply &reduction (in which case the issue will be eventually settled) or we may try t o continue the verification process without using n ( p ) = a ( q ) . Such a situation is called a decision poii2t. In on-line runs the verifiration may be controlled here by t h e human operator. (Actually. in the situation sketched above, information will be supplied, and the question will appear whether 0reduction should be tried.) In off-line runs &reduction will be applied in order t o get a definite answer t o the question, and it will be checked t h a t the total number of decision points passed during the checking of a line does not exceed t h e chosen limit (cf. 3.0).

809

An Implementation of Substitution in a X-Calculus with Dependent Types L.S. van Benthem Jutting 1. INTRODUCTION In this paper we describe an implementation of substitution, which makes use of de Bruijn indices [de Brzlijn 72% (C.211 and of structure sharing (cf. [Wadsworth 711, [Boyer & Moore 721, [Curien 861). This implementation was designed by I. Zandleven about 1972. He used it in the verifying program for Automath, which has been running at Eindhoven for over 10 years. As it was never properly described we have thought it worth while to give a formal description and to prove that the implementation really satisfies its specifications. The implementation of substitution which we describe does not really carry out substitutions, but implements them by considering pairs consisting of an environment and an expression. The environment in such a pair gives a meaning to the free variables which occur in the expression. Substitution for a free variable (or for more free variables) is implemented by changing the environment. Such an implementation is of interest in situations where (like in Automath) the issue is not to normalize an expression, but t o decide whether two expressions are equal, i.e. whether they have a common reduct. In such a situation time as well as space is saved because there is no copying involved in substitution. We start our description by briefly explaining the structure of the system. We also explain the mechanism of relative addressing, known by now as the system of de Bruijn indices. Our system (and also Zandleven’s implementation) makes essential use of this mechanism. We think, however, that similar implementations using absolute addressing might be possible. Then, in Section 2, we give a formal definition of our system of name-free Xcalculus. We formally define single and multiple substitution, stating theorems about commuting these operations. In Section 3 we discuss the implementation of substitution by structure sharing. We define environments, operations upon environments and an interpretation function, mapping pairs ( A ,E ) , where A is an expression and E an environment, to expressions. We prove that our implementation is sound, i.e. that

810


the interpretation of ( A , E ) is really the result of the substitution we meant to implement in constructing E . We carry out this program first for multiple substitution, then for single substitution and finally for a combination of both. Then, in Section 4, we treat the implementation of typing. We define a typing operator in the original system, which associates a type t o certain expressions. We give theorems about the connections between typing and substitution. After that we describe in our implementation a corresponding operator which produces a type for the expression denoted by the pair ( A ,E ) (if this expression has a type) and we prove this function to behave as described. We omit proofs, all proofs being by simple induction on the structure of expressions, possibly making use of earlier theorems. Finally we make some concluding remarks in Section 5. In that section we discuss briefly the possibilities of the system and the environment in which it has been used.

1.1. Automath First we give a short description of the main aspects of Automath which are relevant to our discussion. The Automath system is a proof checking system, which can be used for checking large mathematical proofs. As such it can be used also in checking correctness proofs for designs of computer programs. For an introduction into Automath we refer to [ d e Bruajn 80 (A.5)] and [van Daalen 73 (A.3)]. Automath is a typed A-calculus with dependent types. We assume the basic notions of A-calculus, such as substitution and &reduction, to be well known. Incorporated in the system is the notion of definition: if A is an expression and if the free variables of A are among X I ,...,x, (where n 2 0) then we can define an n-ary constant a such that a(x1,...,2), stands for A . Now if B1, ...,B, are expressions then a(&, ...,B,) is an expression, which should be interpreted as the expression obtained from A by simultaneous substitution of Bi for xi (where 1 5 i 5 n). The operation of eliminating a definition, replacing a defined constant by its definiens is called &reduction. In our system it gives rise to the implementation of simultaneous substitution. It is convenient for our description to forget about the arity of constants by postulating them to have infinite arity. We will therefore consider in the following sections expressions of the form a(@ where B’ is an infinite sequence of expressions. As we have said, Automath is a typed A-calculus: terms are typed A-terms, variables are typed. When the variable x has type A this is denoted by x : A . If A , B and C are expressions, x is a variable, and if for x typed by A the type

An implementation of substitution (E.3)

811

of B is C , then the function Ax : A.B has type IIx : A.C (where B and C may depend upon z). We adopt the practice (which is common use in Automath) to denote both expressions Ax : A.B and IIx : A.C in the same way: by [z : A]B and [x : A]C. In Section 4 we come back to this point. The value of the function A for the argument B will be denoted by A { B } . (This conflicts with the habit in Automath to put the argument before the function.) Thus we get the following description of Automath expressions: We assume two disjoint infinite sets C and V to be given: C = {a, b, c, ...} is the set of constants,

V = {z, y, z , ...} is the set of variables. Now if x is a variable then x is an expression, if a is a constant and

B’ is a sequence of expressions then a ( @ is an expression,

if A and B are expressions, and x is a variable then [z : A]B is an expression, if A and B are expressions then A { B } is an expression. On these expressions we can define single and multiple substitution. Also a-conversion and P-reduction can be defined, and for constants which have definitions we can define &reduction (i.e. application of a definition).

1.2. de Bruijn indices When defining substitution formally the main problem is to avoid clash of variables. This is usually done by introducing “fresh” variables where needed. In our presentation we avoid clash of variables by using relative addressing (nameless variables or “de Bruijn indices” [ d e Bruzjn 7 2 b (C.2)]; see also [Berkling & Fehr 821). This concept is important both in Zandleven’s actual implementation of the Automath verifier and in our formal treatment of substitution and its implementation by environments. We will now give an informal description of this representation of variables. As an example we choose the expression

[u: x { z } ][u : [w: u]w] z { u } .

(1)

This expression should be considered relative to a “context”, that is a sequence of distinct variables, containing all its free variables. In this case the context could be

x,y,z, ... .

(2)

L.S. vm Benthem Jutting

812

We represent the expression (1) on its context (2) by a planar tree.

Figure 1 In this tree the nodes labelled ab and ap represent abstraction and, respectively, application. The bold unary dots represent the place where variables are bound, the letters labelling the leaves are the (free and bound) variables. Note that every letter which labels a leaf should be bound by a bold dot, its binder, which is situated either on its path to the root of the tree or in the context. Now we replace every letter at a leaf by a number, which indicates the number of bold (binding) dots which lie on the path t o its binder. Or, in other words, we replace every occurrence of a variable by the number of scopes in which it is contained, and which are strictly contained in its own scope. Doing so we get the tree of Figure 2. It will be clear that, if we identify &-equivalent expressions, the letters labelling the binders are now irrelevant. Forgetting about these we get the “nameless” expression

Note that in this representation of (1) the number 0 denotes the different variables z, u and w, while the variable u is represented by 0 as well as by 1. Let us analyze which numbers denote the same free variable in a tree. Suppose n is a number labelling a node in a (nameless) tree and let m be the number of bold dots on the path from this node to the root. It is clear that n denotes


813

Y' X.

Figure 2

a free variable iff n 2 m. We will call the number n - m the depth of n in the tree. And we see that two labels denote the same free variable if they have the same non-negative depth. In the example this is the case with the labels 2 and 4 (which both denote z ; in fact there are two dots on the path from 2 to z , viz. the dots x and 8 , and four dots on the path from 4 t o z , viz. v , u, x and y). Both labels 2 and 4 have depth 2. It is easy to make algorithms which translate ordinary name-carrying expressions into nameless ones and back (given a certain context and forgetting about a-equivalence).

2. NAME-FREE A-CALCULUS 2.1. The language The structure of the expressions and the use of de Bruijn indices have been explained in the previous section. We will now give a formal definition of the language, which is essentially the Automath language defined in Section 1, but uses de Bruijn indices instead of variables. In the following N denotes the set of natural numbers {0,1,2, ...}.

Definition. We assume an infinite set C = {a,b, c, ...} of constants to be given. Now the set L = { A , B, C, ...} of expressions is defined by


814

if x E JVthen x is an expression,

if a E C and B’ is a sequence of expressions then a(@ is a n expression, if A and B are expressions then ( [ A ]B ) is a n expression, 0 if A and B are expressions then A { B } is a n expression.

We will omit parentheses around [A]B when this does not present parsing problems. The natural numbers occurring in an expression will be called references. It has been explained in the introduction how references can be interpreted as nameless (free or bound) variables, and that references having the same nonnegative depth can be interpreted as denoting the same free variable. There is, however, no need for defining formally the concept of depth; it will be used only in informal comments. 2.2. Operations 2.1.1. Updating When we substitute an expression A for the free variables in B with depth n we should add n to the references representing free variables of A in order t o preserve their original depth in the result of substitution. The corresponding updating operator is denoted by ug. When we are updating the expression A in this way we do not want the references denoting bound variables to be updated. If, for example, A is the expression [C]D then references in D with depth 0 should remain unchanged, and other references should be updated. Therefore we need operators u; (for every k E N ) which increase the references in A with depth k or more by n. This gives ug as a special case.

Definition.

uEA{B} = uEA{uEB]

u;E.a(A) = a(u;EA).

0

Remarks. In the last clause of this definition we have used @A, which is meant to denote the sequence of expressions obtained from A’ by applying UE


815

t o each item. It is possible, of course, to define this concept formally, but this would give rise to an extra clause in our definition. For brevity the present notation has been chosen in all definitions. The second clause of the definition is justified by the fact that references with depth k + 1 or more in B correspond to references in [A]B with depth k or more.

2.2.2. Single substitution We now define the operation s$ of single substitution. s$ A denotes the result of substituting C for the references in A with depth k . The variable denoted by the depth k in A is supposed to disappear from the context. Therefore the references with greater depth are decreased by 1.

Definition. s$ x

x $ [ A ]B

ifxk = [s$ A]";s B -

("

s $ A { B } = s$ A { s$ B }

s$a(A)

= a(s$A) .

0

Remark. The system defined here, with the operations u; and s$, is similar to the A-calculus treated in [Curien 861. 2.2.3. Multiple substitution We define the operation d$ of multiple substitution. That we use the symbol "d" to denote this operation suggests that its main use is in applying definitions (or, in Automath jargon, in &reduction). d$ A denotes the result of substituting C1, Cz, ... for the references in A with depth simultaneously the expressions CO, 0,1,2, ... respectively. We do not want the references denoting bound variables the operation d$ denoting in A to be changed. Therefore we need for k E simultaneous substitution for those references in A which have depth k or more.

Definition.

d$[A]B = [d2A]dF1B


816

d$A{B} = d$A{d$B}

dia(A)

= a(d$A) .

0

2.3. Theorems The following theorems treat the properties and relations of the operations defined above. Proofs proceed by easy induction on the structure of the expressions. For some theorems we give an intuitive justification.

Theorem 2.1. if 15 k 5 1 + m

0

ifk>l+m

Theorem 2.2. if 1 5 k

< 1+ m

if k 2 I + m

Theorem 2.3. 5kS1

c

D

-

1

k+l

- 5s;-1D5~

ifkzl

Remark. Theorem 2.3 corresponds to a well-known result on ordinary substitution: Sg S$ A = S:gD Sg A provided x $ y and x is not free in C

0

Theorem 2.4.

Remark. Theorem 2.4 can be understood as follows. Suppose k 2 1. Then, if we apply u r to an expression A, the references in A with depth 2 k are increased by m (together with all other references in A with depth 2 1 ) and become references with depth 2 k m. When we subsequently substitute the expressions 6 for these references, then they are updated with Uk+m , as may be seen in the definition in 2.2.3.

+


If, on the other hand, we first substitute

817

6 for

the references with depth

2 k, then the substitution will occur at the corresponding places in A and the expressions 6 are updated with ut. When we afterwards apply u r , all references with depth 2 1 (which now includes all outside references in 6) are increased by m, which gives the same result. Now suppose k 5 1. If we substitute c' for the references in A with depth 2 k then there are no references left originating from A itself with depth 2 1. Moreover, all expressions in 6 are now updated by u/j. If we subsequently apply this will affect precisely those references in the expressions from c' which had depth 5 1 - k before substitution. Therefore we can reverse the order, beginning 0 with updating c' and doing the substitution afterwards.

ur

Theorem 2.5a.

Theorem 2.5b. ifk>1

Theorem 2.6.

Remark. Theorem 2.6 corresponds to a well-known result on multiple substitution: S< S< A = s C D

; ~A

c provided all free variables in A which are among y' are also among 2

. 0

3. THE IMPLEMENTATION OF SUBSTITUTION

In this section we describe the implementation of substitution by structure sharing. This implementation is used in the Automath verifying program, and has been designed by I. Zandleven. In order to code substitution without really carrying it out (i.e. without constructing new expressions by copying existing expressions) we use environments.


818

Expressions can be interpreted with respect to such environments, and the interpretation will be an expression, which we will prove to be the intended result of substitution. By coding substitution in this way the amount of memory space required and the time for carrying out substitutions will decrease, while the time needed for comparison of expressions might increase. We will give in this section mathematical definitions of environments and of the interpretation function and state a theorem that these definitions meet the requirements formulated above. In order to make our description clear we will treat first multiple substitution, then single substitution, and finally the combination of both.

3.1. Multiple substitution In this section we define environments for multiple substitution, called d-

environments. The name suggests that these environments are used when 6reduction (i.e. application of definitions) is performed. We will also define two operations on these environments.

Definition. A d-environment A is a finite sequence of functions A l , A2, ...,Ah, where Ai : N -+ C for 1 5 i 5 k and k E N . The number k will be called the length of A. 0 Let us first explain informally what we intend to picture by such a d-environment. Suppose A is a d-environment of length 1. If we interpret an expression A with respect to A we intend that the free references in A with depth i shall be interpreted to denote the value of the function A1 at i. We could picture this in a diagram as follows:

Figure 3 If we want to interpret an expression A on a longer d-environment A of length k , say, then we think of the free references of A as pointing into &, but an expression &(i) should now be interpreted with respect to the d-environment


A l l Az, ...,& - I .

819

This situation is illustrated in the following diagram.

Figure 4 Note that a d-environment might be an empty sequence. The interpretation of an expression A on the empty d-environment is A itself.

3.1.1. Multiple substitution The operation 66 (where c' is a sequence of expressions) is called multiple substitution (because it codes multiple substitution). Its effect is to extend a d-environment with the sequence c'. Deflnition. Let A = A l l ...)Ak be a d-environment. Then 66A = A l l &+I where Ak+l(i) = c, for i E N .

Ahr 0

3.1.2. Cutting The operation y cuts the last segment from a (non-empty) d-environment. Deflnition. Let A = A I ~ . . . ~beA a~ d-environment, and k 2 1. Then 0 YA = All ...l Ak-1. 3.1.3. Interpretation We now define the interpretation ("on depth n") of an expression A with respect to a d-environment A. The definition formalizes our intentions as explained above. The parameter n for the depth is needed for interpreting the bound variables in A. It is intended that the interpretation of A is the result


820

of a certain multiple substitution for all free variables of A . Because nothing should be substituted for the bound references in A , these references should be unchanged by interpretation. In the definition recursion is used on the length of A and on A.

Deflnition. Let A = Al, ...,Ak be a d-environment.

We derive two theorems concerning this interpretation. Theorem 3.2 shows us that the interpretation which we have defined has the property we wanted, i.e. that d-environments indeed code multiple substitution.

Theorem 3.1. If1 5 n then

I(uf"A, A, n

+ m) = uf"I ( A ,A, n) .

0

Theorem 3.2.

I ( A ,6eA, n) = dz* A where

c'.= I ( C ,A, 0) .

0

3.2. Single substitution

Now we define another kind of environments, called s-environments, which code single substitution (as is suggested by the "s" in their name). Deflnition. An s-environment is a partial function C : N a finite domain.

+

(L x N ) with 0

Let us explain the intended interpretation of an expression A with respect to an s-environment C. A reference in A with non-negative depth k (which represents a free variable in A ) is intended to denote a variable (i.e. a reference) if k $Z dom(C). If k E dom(C) then this tells us that an expression has been


82 1

substituted for k . If C ( k ) is the pair [C,nl then C has been substituted, or rather the interpretation of C with respect t o the prepart of the original environment, which starts n places before the place k of C. We illustrate this in another diagram.

depth = 1

environment for C

C(2) Figure 5

The need for such a construction can be seen when we consider the expression

“A1

PI C ){ D ) {El

where A , B , C, D and E are expressions. We want to consider the interpretation of this expression with respect to a certain s-environment C, and to apply preduction. Let us draw a diagram of this initial situation.

environment C

Figure 6

So we consider the p-redex ([A] [B]C) { D } on the same environment. I t will be clear that its reduct should be represented by the expression [B]C interpreted on the environment C extended by D (where D should also be interpreted on C). The situation is pictured in Figure 7. Its interpretation is the result of substitution of D (or, rather, the interpretation of D ) for the free references of depth 0 in [BIG‘. Now we can reduce again by applying this expression to El i.e. by substituting E for the references with depth 0 in C. But E should be interpreted with respect to the original environment C, and we can indicate this by putting E into the environment with index 1, which will bring about that references in E will be considered as pointing beyond D. The situation is sketched again in the diagram of Figure 8.

L.S. vitn Benthem Jutting

822

.

0

0

.

0

,

cnvironmcnt C

Figure 7

.

.

.

.

*J

environincnt C

Flm

Figure 8 Both D and E are now interpreted with respect t o the original environment C, while references with depth 0 from C point to E and references with depth 1 point to D. Now let us look at the intended interpretation of a reference which does not point into the domain of C. We have seen that references are shifted when a substitution is made for a smaller reference (cf. Definition 2.2.2, the clause concerning s$ z where z > k ) . This indicates that the interpretation of a reference with depth z should be obtained from z by subtracting the number of elements of dom(C) which are below z. Therefore we give the following definition.

Definition. z m o d C := z - #{y

E dom(C) Iy < z} .

0

Then the intended interpretation of a reference with depth z not pointing into dom(C) will be z mod C. On s-environments we define three operations. 3.2.1. Substitution The operation 0 6 , ~ (called substitution because it codes (single) substitution), extends the domain of an s-environment to k, and associates to k as value


823

the pair [C,n1. (As has been explained above “n” indicates that C should be interpreted with respect to a shorter s-environment.)

Definition. If k @‘ dom(C) then (g&

C ) ( k )= YCl n1

(g&C)(i) = C(i)

if i E dom(C) .

0

3.2.2. Extension The operation E is called extension because it codes extension of a context with another free variable. Its effect is that the domain of the s-environment is shifted. Definition.

( & C ) (+ i 1) = C ( i )

if i E dom(C)

.

0

3.2.3. Cutting The operation yn, called cutting, codes the removing of variables from the context. Its effect is that the domain of the s-environment is shifted, and possibly becomes smaller. Definition. (yJ)(h)

= C(i

+ n)

if i

+ n E dom(C) .

0

3.2.4. Interpretation With the help of the operations on s-environments defined above we can describe the interpretation of an expression with respect to an s-environment C. As we have seen, the interpretation of a reference with depth x which does not point into dom(C) will be x mod C, which is x minus the number of elements of dom(C) which are smaller than x. First we state some properties of 2 mod C. Clearly the function Xz.(x mod C) is increasing. Moreover we have: Theorem 3.3. If.

$ dom(C) then

xrnodC=(a:+l)modC-l.

0

L.S. van Benthern Jutting

824

The following three theorems show us what the relation is between the three operations defined on C and the value of x mod C.

Theorem 3.4.

x mod C

x mod 0 5 , C~ =

ifx/c

xmodC-1

0 '

Theorem 3.5. xmodEC = (x - 1)modC

+1

0

I

Theorem 3.6. xmodykC=(x+k)modC-IcmodC.

0

Now we will define the interpretation of an expression A with respect to an s-environment C. We use recursion on dom(C) and A . Definition. I(x,C)

=

{

(s+k+l)modC

uo

I ( B ,yz+k+l C)

x mod C

if C(5) = [ B ,k] if x

dom(C)

0

We derive two theorems concerning this interpretation. Theorem 3.8 shows us that the interpretation which we have defined has the property we wanted, i.e. that s-environments indeed code single substitution.

Theorem 3.7.

I(u; A , E~ C) = u;""~' I ( A ,E' yn C) .

0

Corollary 3.7. I(u$ A , C) = u$"'OdC

I ( A ,^In C) .

0


Theorem 3.8.

Zf IF

825

@ dom(C) then

Z(A, &, C) = s;YodE Z(A, C) where

c*= U t m o d Y k + l C I(c,Yk+n+l c)

0

3.3. Combination of d-environments and s-environments Now we will combine the techniques described in the previous sections. For doing this we define another kind of environments, which we will call c-enuironments. Here “c” indicates that these environments combine the possibilities of d-environments and s-environments.

Definition. A c-environment is a partial function I? on if with a finite do0 main, and with values in (N --t C) U (C x N ) . The values N + C denote segments of a d-environment, the values in C x N denote values of an s-environment. Let us first sketch the intended interpretation of an expression A with respect to such a combined environment I?. As an example we present the following diagram.

.---

E I

Figure 9

As the diagram suggests, references from A are considered to point either into the first d-environment segment of I? or before that segment. In order to


826

picture the intended environments for C, D and E in the situation sketched above we look at the following diagram.

depth = 3

dcpth

=

0

~ ~ ) * j depth

k

c' at k .

for all 1 E d o m ( r ) then

(a$r)(k) = C (6$r)(i) = r(i)

if i E dom(r)

.


827

3.3.2. Single subst it ut ion The domain of the c-environment is extended to Ic, and its value at k is a pair [C,n1. As earlier the “n” indicates that C should be interpreted with respect to a shorter c-environment. Definition. If Ic $ dom(r) then

(4,n r ) ( k ) = [C, n1 (o&F)(i) = r

if i E dom(r)

0

3.3.3. Extension The c-environment is extended (as was previously done with s-environments). The domain of the environment is shifted.

Definition.

(Er)(i+ 1) = r ( i )

if i E dorn(r) .

0

3.3.4. Cutting From the c-environment the last n entries are cut.

Definition.

+

( T J ) ( i ) = r(i n)

if i

+ n E dom(r)

0

3.3.5. Interpret at ion The interpretation of a reference with depth z representing a free variable with respect to a c-environment l? is comparable to its interpretation on an senvironment C. Therefore we define again for z E N the possible interpretation z mod r as follows. Definition. z mod

I < Z} .

:= z - # {y E dom(r) y

0

As before, it is clear that the function X z . ( z m o d r ) is increasing. Also the analogous theorems hold.


828

Theorem 3.9. If x fZ dom(r) then x m o d r = (x

+ 1)m o d r - 1 .

Theorem 3.10. xmod6;r

=

x mod r xmodr- 1

ifxsk ifx>k

'

Theorem 3.11. x mod C

r=

T ~ , ~

x mod r xmodr - 1

ifxsk ifx>k

0 '

Theorem 3.12. x mod T k r = (x

+ k ) mod l- - k mod

.

0

Theorem 3.13. zmod&r=(x-l)modr+l

0

Now we will define the interpretation of an expression A with respect to a c-environment I?. We use induction on dorn(r) and A.

The following theorems hold. Theorems 3.15 and 3.16 show that the implementation is sound, coding single as well as multiple substitution.


Theorem 3.14. I f n

829

< a(r)then

I ( u ; A , e k r ) = u ; " " ~ ~ I ( A , E ~. ~ ~ I ' ) Corollary 3.14. I f n

< a(r)then

I ( u E A , r )= u ~ m o d r I ( A , ~ n. r ) Theorem 3.15. I f 1 > k for all 1 E dom(r) then

I(A,6; I?) = d'& A where

c*= I ( 6 ,yk+l r) .

Theorem 3.16. Zfk g' dom(r) then

I(A, where

~ 5I?) =, s~

$

I ( A~, I?)

~

c*= U0n m o d Y k + l r I ( c , Yk+n+l r) .

~

~

0

4. TYPING In this section we discuss the way in which certain expressions are typed. First we describe the typing of Automath expressions with named variables. Then we will define the typing of expressions in the name-free A-calculus L defined in Section 2. We will also state some theorems giving the relation between typing, updating and substitution. Finally we will indicate how to find a type for an expression which should be interpreted on a c-environment. And we will state a theorem to the effect that the type found in this way is really the type of the interpreted expression. We start by discussing types in Automath. Consider the expressions A , B and C and the variable x. We have remarked before that, if for x typed by A the type of B is C , then the function Ax : A.B has type IIx : A.C (where B and C may depend upon x). When we apply this function to a n argument D (of type A ) we get a value in SE C, that is the type C, where D is substituted for x. We could also describe this type by saying that it is the co-ordinate indexed by D of the product IIx : A . C . We use, as before, the notation F { D } for the value of the function F at the argument D , and we introduce here locally the notation P ( D ) for that coordinate of the product P which is indexed by D. Then we conclude that if F has type P then F { D } has type P ( D ) .

830


Moreover (Xz : A.B) { D } @reduces to Ss B , and also (Hz : A.C) ( D ) preduces to S g C . We see that the product constructor II together with coordinate selection ( ) have the same behaviour with respect to substitution and P-reduction as the functional abstractor X together with application { }. This is the reason for identifying them in our exposition (as is common use in Automath): Hz : A.B and Xz : A.B are both denoted by [z : A]B , and A { B } as well as A ( B )will be denoted by A { B } . Then, if the type of A is C , the type of A { B } will be C { B } . Now, as we are interested here in syntactical issues only, we will not treat the concept of correctness of expressions. We will, however, introduce a typing operator 7, such that for correct expressions A which have a type, it holds that A is of type 7 ( A ) . Let us first consider the proper Automath case, where all constants have a finite arity. We assume that for certain constants a their types are given; i.e. we presuppose a function 0 which associates to certain expressions a(.') a type (i.e. an expression). Here .'is a finite sequence of distinct variables and its length is the arity of a. This sequence should contain all free variables in the type @(a(Z)).We assume also that the notion of simultaneous substitution has been properly defined. If Z is a sequence of distinct variables and l? a sequence of expressions, and if these sequences have the same length, then S; A will denote the result of simultaneous substitution of the expressions for the variables .' in A. The typing operator 7 (which is a partial operator because not all constants have a type) is now defined as follows:

B'

Let A be an expression, let (a be a function associating a type (an expression) to every free variable of A. Now if A is a variable z then 7 ( A ,(a) = (a(z), if A is a(@ and a(.') in dom(@) then 7 ( A ,(a) = S$ @(a(.')), if A is [z : B]C then 7 ( A ,(a) = [z : B]7 ( C ,a*) (where @* is obtained from (a by changing its value at z t o B ) , if A is B {C} then 7 ( A ,@) = 7 ( B ,@){ C } .

Remark. This typing operator corresponds to the one described in [Nederpelt 73 (C.3)],as far as abstraction and application are concerned. The description of various typing operators for defined expressions a(@ can be found in [van Daalen S O ] . 0


831

4.1. Typing in name-free A-calculus; contexts Now we discuss typing in the name-free A-calculus C in Section 2. Expressions will be expressions in L. In particular constants are considered to have infinite arity and sequences of expressions are infinite. For typing such expressions we need types for constants and variables, just as in the case described above. Therefore we assume two functions to be given: a possibly partial function 0 : C + C and a total function @ : N

+C

.

The latter, which gives us the types of variables, will be called a context. The expressions of such a context, i.e. the values @(i), are expressions which may contain free variables (i.e. references). These references should be considered as being typed relative to the prepart of @. More precisely: the type of a reference with depth k in @(i) must be taken to be @(i k 1). We define two operations upon contexts.

+ +

4.1.1. Extension For a context @ we denote by E A @ the extension of @ by an expression A . The consequence is that references with depth 0 in the new context will have type A , while references with depth i > 0 will have the type which was originally the type of a reference with depth i - 1.

4.1.2. Cutting If @ is a context then -yn @ denotes the result of cutting from @ a segment of length n. Hence 71 is the left inverse to E A . Definition.

(m@)(i)

= @(i

+ n)

0

4.1.3. The typing operator We now a.ssume the (partial) function 0 : C + C, which gives the types of constants, to be given and fixed. We define for an expression A and a context @ the type of A relative to @, to be denoted by t ( A , a).


832

0

Remark. The update u;" in the first clause of this definition ensures that the type which is defined can be considered relative to the same context as the expression which is typed. The expression (a(.) points to a prepart of (a preceding z, as has been indicated above. 4.2. Theorems The following theorems hold for the relation between typing, updating and substitution. The theorems have been formulated so as to make the proofs (by induction) straightforward. The interesting properties are contained in the corollaries.

Theorem 4.1.

Corollary 4.1.

t(uE A, (a) = UE t ( A ,"ln (a) .

Theorem 4.2. If

t(C,(a) = D then


833

Corollary 4.2. If

t ( C , @= ) D then

t ( s $ A , @ )= & t ( A , ~ g @ ) .

0

Corollary 4.3. If

t(ci,a) = GI&+’ @(i)

for i E N

then t(d$ A, @) = d$ t ( A ,a) .

0

Remark. For typing to commute with multiple substitution, it is necessary that this substitution is, in some sense, correct. More precisely: it is needed that the type of the expression which is substituted for a reference of depth k is equal to the type of that reference. We have seen, however, that the type of a reference may itself contain free references. Now the substitution operator indicates substitution for all free variables, and therefore the correctness requirement regards the types of the variables with the substitution carried out. The situation resembles the requirement of “fitting of strings into contexts” in Automath languages (cf. [van Daalen 801 and [van Daalen 73 (A.311). 4.3. Typing of expressions in a c-environment In order to describe typing in a c-environment we need, just as above, a (possibly partial) function 0 : C + C describing the typing of constants. This function is implicit in the following. We also need a description of the types of free variables (i.e. references). In our representation we will not give these types explicitly by a function @ : N + C, as we did above, but we will code the types in such a way that they can be retrieved using the c-environment. Let us consider an expression A on a c-environment r. We picture the situation in the following diagram.


834

Figure 11 We denote the complement of d o m ( r ) by Fr. As we have explained in Section 3, references from A to Fr denote free references. In the diagram we have indicated that a reference to 1 from A denotes 0, a reference to 3 denotes 1. References from A to 5 are possible only via a reference into dom(P), e.g. by a reference into r ( 4 ) . In this case it will denote a reference 2, etc. Generally a reference t o a number x in F ( r ) will denote z m o d r . We have written down all these interpretations next to the dots which represent the elements of Fr. Looking at these interpretations, we see that they could be considered as an order preserving map from Fr onto n/. We will denote this map by vr and its inverse by $r. Clearly $r is an order preserving enumeration of Fp. Now, as references to Fr should be interpreted as free variables, we choose to code the types of those free variables as a function with domain Fr. We will put the type of the free reference with depth i on the place $ r ( i ) . But we will not put there the type itself of the free reference, but an expression which codes this type, and which should be interpreted itself relative to the environment r. This leads us to the following description. We suppose a function '$ : Fr + C to be given. We will interpret this function as coding the context @ which gives the types of the variables. That is: we will define the "interpretation" U ( Q ,I') of Q with respect to r and this interpretation will be @.

Definition. Let i E N then

U(XP,r)(i)= I ( @ ( j ) , y j + l r ' )

where j = $r(i)

.

0

An implementation of substitution (33.3)

835

It turns out to be necessary to define what is the influence on @ when the environment r is cut or extended. This is done in the following definitions. In the case of extension the type of the extra variable should be given of course.

Definition. (&A

w)(o)

= A

( & ~ 9 ) (1)i += Q ( i )

if i E dom(9)

.

Definition. (%) @(i) = @(i

+ n)

if i

+ n E dom(9) .

For these operations the following theorems hold.

Now we define the type T ( A ,I?, 9) of the expression A with respect to the c-environment I' and the function 9 (which codes the types of the free references in A ) .

836


4.4. The theorem on typing

We finish this description by stating the following theorem

Theorem 4.6. Let r be a c-environment and Q a function on Fr as described above, then we have:

5. CONCLUSIONS

The main conclusion which can be drawn from the description we have given is that the implementation of substitution we described is sound. It codes substitution without ever copying a given expression and as a consequence it is cheap both in execution time and in memory space, as far as pure substitution is concerned. In comparing expressions it might be slower than systems which use copying. We may add that it has been implemented and tried out extensively in the Automath checker, which has been used in Eindhoven since 1974. The system can be used to implement P-reduction, 77-reduction and so-called &reduction (i.e. application of definitions). Various strategies for deciding convertibility of typed expressions can be implemented using the system. Our description and also the implementation have made essential use of the concept of “de Bruijn indices”, that is of relative addressing of variables. We think, however, that similar implementations using absolute addressing might be possible. A remarkable feature of the system is the difference which is made between single and multiple substitution, as single substitution could be considered as a special case of multiple substitution. The main reason for the distinction is that, when multiple substitution is applied, it is never required to consider the terms which are substituted on a “shorter” environment, as in the case described in Section 3.2. Therefore we would burden multiple substitution with superfluous administration if we tried to incorporate single substitution as a special case. Looking back on the description it can be remarked that it uses the natural numbers for coding various tree-like structures. The advantage of this choice is that formal proofs of our theorems are possible, the disadvantage is that the intuitive background of our definitions is not as clear as might be possible in another presentation. This disadvantage is most obvious in Section 4. We have tried to compensate for it by giving informal explanations for our definitions.


837

Finally we situate this implementation into Landin’s SECD machine (for a reference see e.g. [Glaser et al. 841) in order to make clear what its status is. In fact our system is mainly a possible implementation of the E-part of that machine. The rest of the Automath checker has not been discussed here and is rather different from Landin’s machine, and also from the reduction machine for BRL (see [Berkling & Fehr 821)’ CATAR (see [Curien 861) and other functional programming languages. The reason is that the aims of these languages differ somewhat from those of the Automath checker: the latter aims at deciding convertibility of pairs of typed A-expressions, preferably without normalizing them, while Landin’s machine and similar A-calculus machines aim at normalization. Nevertheless our implementation of substitution could be used also for normalizing expressions.

ACKNOWLEDGEMENTS The incentive for writing this paper came from G. Huet and T. Coquand, who asked me (in 1986) how substitution was implemented in the Automath verifier. Of course the paper could not have been written without I. Zandleven who invented (and implemented) the system. I want to thank Rob Wieringa for many valuable comments which helped me in presenting my ideas, for patiently listening to many expositions and for invaluable technical support in preparing the text. Paul Gorissen and Frans Kruseman Aretz spent much effort in reading the manuscript and suggested major improvements in the presentation.


PART F Related Topics


841

Set Theory with Type Restrictions N.G. de Bruijn

1. It has been stated and it has been believed throughout this century that set theory is the basis of all mathematics. Usually (but not always) people think of the Cantor set theory, with some formalization like the one of Zermelo-F’raenkel. It describes a universe of things called sets, and everything discussed in mathematics is somehow interpreted in this universe. 2. It seems, however, that there is a revolt. Some people have begun to dislike the doctrine “everything is a set”, just at the moment that educational modernizers have pushed set theory even into kindergarten. It is not unthinkable that this educational innovation is one of the things that make others try to get rid of set theory’s grip for absolute power. Mostowski is reputed to have claimed a counterexample by declaring “I am not a set”. At the present state of science it seems to be impossible to find out whether this statement is true or false. Anyway, there is no safe ground for saying that everything is a set. Let us try to be more modest and say: “very many things can be coded as sets”. For example, Beethoven’s 9-th symphony can be coded as a set. But the coding is quite arbitrary, and we are not sure that nothing gets lost in the coding. To quote a more mathematical example: Gauss’ construction of the regular 17-gon may be interpretable as a set, but again such an interpretation is quite arbitrary and does not seem to be illuminating. An expression like “the intersection of the set of even integers with the set of all constructions of the 17-gon” makes sense only after the codings have been stated. Sets have become a very important part of our language. Until 1950 many rigorous texts on mathematical analysis were written with little or no use of the language and notation of sets. This has changed considerably, but quite often the change is very superficial. It is superficial as long as it is nothing but a translation from predicates to sets. One of the reasons for this translation may be that there is a vague opinion that a set is a mathematical object and a predicate is not. Accordingly, it is felt that someone who makes assumptions and proves theorems about predicates is a logician and not a mathematician.

N.G. de Bruijn Nevertheless, there still remains a tremendous use for sets in mathematics. Sets are here to stay, and we have to ask what kind of set theory we should adhere to. The question which set theory is the true set theory, is not a true question, of course. It is all a matter of taste: relevant things are whether a theory is beautiful, economic, powerful, easy t o manipulate, natural, easy to explain, etc. The fact that the Cantor-Zermelo-Fraenkel theory is interesting, correct, rich and deep, does not imply that it is necessarily the tool that should be available for every mathematician’s use. It has some disadvantages too. One is that it makes the foundation of mathematics rather hard for the non-specialist. We have the sad situation that late in the 20th century the average ordinary mathematician has rather vague ideas about the foundation of his science. Another unpopular feature in Cantor set theory is the admission of z E z, which seems t o be rather far away from possible interpretations. 3. The natural, intuitive way to think of a set, is to collect things that belong to a class or type given beforehand. In this way one can try to get theories that stay quite close t o their interpretations, that exclude z E z and are yet rich enough for everyday mathematics. Some of these theories may exclude large parts of the interesting, funny paradise of Cantor’s set theory which has been explored by so many expert mathematicians. For a survey of various type theories we refer to [Fraenkel et al. 581. 4. In this paper we shall try to make a plea for a kind of type theory where the use of types is very similar to the rBle of types in cases where the objects t o be discussed are not sets. Let us first note that natural languages are confusing when dealing with types. The word “is,’ is used for too many things. We say “5 is a number”, “5 is the sum of 1 and 5”, “5 is the sum of two squares”. It is only in the first sentence that “is” can refer to a type. We shall use the symbol E for this: 5 E number. We shall call such a formula a typing. 5. We think of a type theory where the type of an object is unique. If A E B then B is completely determined by A . This seems to drift us away from the idea that B is something like a set and that A is a member of B, and we have to be careful not to confuse the typing symbol E with the membership symbol E , although there is a conceptual similarity.

We of course run into circumstances where we want to say that our number 5 is also a complex number: 5 E complex number. We have t o make the distinction between the real number 5 and the complex number 5 in order to maintain that in A E E the B is completely determined by A . It is a bit awkward, we have to talk a great deal about identification and embedding (but in de Cantor-

Set theory with type restrictions (F.1)

a43

Zermelo-Fraenkel theory this is not any better). Yet it should be done; let us not forget that most mathematicians would hesitate to identify the real number 5 with the 2 x 2 matrix

(

), and the latter situation is really not

very

much different from the one with the complex numbers.

6. Let us first explain some other cases where E plays a r8le. If B is a theorem and if A is a proof for B, then we can write A E B. The theorem can have several proofs, but a proof proves just one theorem. Another example: Let B be a statement of constructibility of some geometrical figure that can be constructed by means of ruler and compass, and let A be a description of one of the constructions. We again write A E B. There can be several different A’s t o a given B , but if the construction A is given, there is no doubt about what it constructs. A third example: Let A be a computer program and let B be a description of what the execution of the program achieves (i.e., A describes the syntax and B the semantics). In all these cases the A’s and B’s may depend on several variables (of certain types), and the results A E B may be transformed into other results A’ E B’ by means of substitution. Moreover, in all these cases there is a possibility to introduce a name for a thing in B if we do not actually have that thing. There are two ways for this. (i) The thing can be introduced as something primitive and fixed. For example Peano’s first axiom says that there is a natural number t o be denoted by 1, and nothing is assumed about it at that stage. An example with a different interpretation is that B is a proposition and we say that its truth is assumed, i.e. that B is an axiom. From then on, B plays the same r61e as a theorem: we act as if we have a proof, i.e. we have something E B that we do not wish to describe. Let us now look at the case of geometrical constructions. We want t o express that the possibility t o connect the distinct points P and Q by a straight line is a primitive construction, i.e. a construction that cannot be described in terms of simpler constructions. That is, we act as if we have a fixed thing E B, where B is a statement of constructibility. (ii) The thing can be introduced as a variable. Its validity is restricted to a piece of text (a “block”) that is opened by the introduction of the variable; that is why we call it a block opener. The variable is introduced by stating its type: if its name is z, we write something to the effect of “let z E B”. If B is a type like “number”, “point”, then this phrase “let z E B” sounds quite familiar. If B is a statement, however, we may interpret the phrase “let x E B” as “assume that B is true”. That is, we act as if we have a proof for B. (This is not the same thing as the introduction of B as an axiom:

844

N.G. de Bruijn “let x E B” does not reach beyond the block opened by x, and secondly, we can substitute A for x if we later get any proof A for B.) There is a slightly unfamiliar feature: most mathematicians have not got used to giving names to proofs, and here we give names even to would-be-proofs.

7. The parallels between the various interpretations of typings are very strong indeed. The mechanism of substitution is the same for the various interpretations, and actually the various interpretations are happily intermingled. Everything that is said in mathematics is said in a certain context. That context consists of a string of variables (block openers), each one having been introduced as a thing of a certain type. The type of the second variable may depend on the first variable, etc. In such a string some of the variables have to be interpreted as conventional mathematical objects (like numbers, points), others as wouldbe-proofs for assumptions. The linguistic treatment makes no difference as to the interpretations. 8 . The above characteristics are the common root of the mathematical languages of the Automath family [ d e Bruzjn 70a (A.2)]. The definitions of these

languages hardly contain anything on logic or on the foundation of mathematics. Notions like “truth” , “theorem”, “proof”, “set”, “definition”, “and”, “implies”, “inference rule” are either things that can be explained by means of the language (like any other piece of mathematical material) or else they are only meant to emphasize pieces of text to a reader who likes to have a feeling for motivation. To mention an example: a definition, an abbreviation and a theorem have the same linguistic form. It would not be necessary to distinguish between these three, if it were not for the fact that “readability” has something to do with the relation to conventional modes of expressing mathematics. The languages of the Automath family have the property that books written in these languages can be checked for syntactic correctness by means of a computer. We emphasize that syntactic correctness guarantees that the interpretations of the text are correct mathematics. Note that various sets of the typing symbol E can occur on one and the same piece of text, and therefore we can pursue a kind of unification of mathematical theories. It is not the right place t o go into a complete exposition of these languages, but one thing should be made clear; just as they admit to introduce objects of a given type, and to build new objects by means of old ones, it is equally possible to introduce new types (by way of variables or of primitive notions) and to build new types in terms of old. For this purpose we create the extra symbol type and we write things like “number E type”, “let B E type”, etc. 9. Having such type languages available as relatively simple tools, we are in-

Set theory with type restrictions (F.1)

845

duced to base mathematics on a type theory where types can be constructed as abundantly as other mathematical objects, i.e., where types may depend on parameters, are defined under certain assumptions only, where types can be introduced as variables or as primitive notions.

10. There are various ways to do set theory in such a system. One possibility is that we take a primitive type called SET, and from then on, we write A E SET for every A which we want to consider as a set. We can write the complete Cantor-Zermelo-Fraenkel theory this way. The relations A E B, A C B are relations that have a meaning whenever A E SET and B E SET. There is not the slightest danger to confuse E and E. The E is a relational symbol just like any other; it does not occur in the language definition. There is a second, entirely different way, that implements set theory with types, in the sense of the “5 E number” mentioned before. Now the symbol E means something like E. If B is a type, and if P is a predicate on B , we form the set S of all A with A E B for which P ( A ) is true. So sets in B correspond to predicates on B. We write S C B , and we define E by saying that A E S means P ( A ) . Quite often we like to consider S as a new temporary universe, i.e. we wish to have A E S in the form of a formula with an E. To that end we create a type called OWNTYPE(B,P ) and a one-to-one mapping of that type onto S. Some of this work can be simplified by special notation we shall not develop here; such notation can be used both for ordinary and for automated reading. 11. In order to work with the predicates mentioned in the previous section, we want some kind of typed lambda calculus. It is roughly this. If B is a type, and if for every x E B we have a formula of the form A(z) E C(z), then we want t o write [z : B]A(z) E [z : B]C ( x )

The left-hand side is the function that sends x into A ( z ) , defined for all x E B ; the conventional notation in non-typed lambda calculus is X,A(x). The righthand side is slightly unconventional; in the case that C(z) does not depend on z one may think of the class of all mappings that send B into C. This kind of lambda calculus is part of the language definition, independently of the mathematical axioms we are going to write in our books. So there is a primitive idea of mapping available before sets are discussed. In particular, predicates are such mappings, so if sets are introduced by means of predicates, they already require the lambda calculus. Later, one can show that the concept of a mapping as a subset in a Cartesian product is equivalent to the notion of mapping provided by the lambda calculus.

846

N.G. de Bruijn

12. Cantor produced his paradise by means of linguistic constructions. (This created considerable controversies in his time, since he did not specify his language.) Now let us see what we get by linguistic constructions in our typed set theory. Assume we introduce (by means of an axiom) the type N of all natural numbers (and we take a set of axioms like Peano’s). Then we have, whether we want it or not, subscribed to N N , to N”, etc., since the lambda calculus prescribes that we accept the type of all mappings of N into N , etc. However, it seems (we use the phrase “it seems” since no formal proof has been given thus far) that we cannot form something of the strength of the union

The reason is not that we would not allow ourselves to form the union of a countable number of types. That will be provided, anyway, by an axiom we would not like to live without. The reason is that we are unable to index the sets of the sequence (1) in our language. The indexing we want is N1 = N , N2 = ”1, N3 = ” 2 , ... , and this is in terms of our metalanguage, since it requires a discussion of something like the length of a formula. This is a little detail Cantor never made any trouble about. The fact that the union (1) is “inaccessible” does not mean that bigger types are forbidden. After all, we can just start saying “let B be any type (i.e. B E type)” and we can make assumptions about B that cannot be satisfied by the types N , N N ,... . The world where we have N , N N ,... , but where (1) is L‘inaccessible’’,is a world most mathematicians will doubtlessly find big enough to live in. For those who want to have a bigger world, where they cannot be troubled by people asking for interpretations, there is a simple way out: they just take a type SET and provide it with Zermelo-Fraenkel axioms. If they want to have the picture complete, they will not find it hard to embed the types N , N N ,... into a small portion of their paradise.

13. Having discarded the idea that every mathematical object is a set, we should be careful not to fall into the next trap. We might like to say that a mathematical object is either some B with B E type or an A with A E B (where B E type). However, the situation can be more complex than this. Let us consider the notion “group” that occurs in the sentence “let G be a group”. What we want t o say is something like this: assume we have a type A , that we have in A a set B , that in B we have a multiplication rule, that the multiplication is associative, etc. The object we want to handle can be denoted by a string of identifiers 2 1 , ...,xk, where 11 E A l l 2 2 E A2, ...,x k E Ak, but where A2 may depend on 2 1 , A3 on X I and 2 2 , etc. It is not as if the string A1, ...,Ak were something type-like, and 51,...,xk were something chosen in it. Accordingly, we

Set theory with type restrictions ( F . l )

847

cannot write let “G be a group” as a single typing “G E group”. We can of course create, by means of a set of axioms, a new type “group”, but that is a poor remedy: we cannot afford to adopt axioms for every new notion we like to introduce.

14. In Section 10 we compared two different ways to talk about sets by means of typings. The choice between the two has a more general aspect; viz. the question whether we shall or shall not aim at minimal use of typings. The word “minimal” refers to the number of different uses of the typing symbol. In order to say what we mean, we describe a kind of minimal system that seems t o be in the spirit of basing mathematics on Zermelo-Fraenkel set theory. In the first place we use typings ...E SET (as in Section 10). Secondly we create a type called BOOL, and we use “ AE BOOL” in order to express that A is a proposition. Finally, for every X with X E BOOL we create a type called TRUE(X), and we use the typing P E T R U E ( X )for expressing that P is a proof for the truth of X . In this minimal system, the use of typings of the form ...E type is restricted to the above-mentioned three instances right at the beginning of the book of mathematics. The author thinks that talking mathematics in such a minimal system is not always the natural thing to do. There is much to be said for a more liberal use of typings, where typings of the form ...E t y p e are used throughout the book. Let us consider the geometrical constructions mentioned in Section 6. It seems natural to use A E B for saying that A describes a construction and that B says what has been constructed. Let us say that we have created, for every point P , a type CONSTR(P). Hence statement A E B has the form A E CONSTR(P). If we want to phrase this in our minimal system, we get something as follows. The point is a set ( P E S E T) , and so is some coded form A* of A (A* E SET). We form a proposition q(P,A*) (so q(P,A*) E BOOL) that says that A* is a construction for P. Finally we need a proof S for this proposition, whence we write S E TRUE(q(P,A*))

for what was A E CONSTR(P) in the liberal system. In the latter case it is not necessary t o provide a proof corresponding to S, since the type of A can be determined by a simple algorithm. This example shows two advantages of liberal use of typings: one is that many unnatural codings can be suppressed, the other one is that a higher degree of automation can be achieved. Yet there are many other advantages of which we mention two: (i) We are neither forced nor forbidden to introduce the types SET, BOOL and TRUE(X); (ii) There is a possibility that one and the same piece of text gives rise to various pieces of standard mathematics, just by the use of different interpretations.


849

Formalization of Constructivity in Automath N.G. de Bruijn

1. INTRODUCTION There are various systems in which a large part of mathematical activity is formalized. The general effect of the activity of putting mathematics into such a system is what one might call the unification of mathematics: different parts of mathematics which used to be cultivated separately get united, and methods available in one part get an influence in other parts. Very typical for twentieth century mathematics is the unifying force of the concepts of set theory. And today one might say that the language of mathematics is the one of the theory of sets combined with predicate logic, even though one might disagree about the exact foundation one should give to these two. Not everyone thinks of set theory and logic as being parts of a single formal system. Set theory deals with objects, and logic deals with proofs, and these two are usually considered as of a different nature. Nevertheless, there are possibilities to treat these two different things in a common system in a way that handles analogous situations analogously indeed. A system that goes very far in treating objects and proofs alike, is the Automath system (see [ d e Bruajn 80 ( A . 5 ) ] ) . In Automath there are expressions on three different levels, called degrees. Each expression of degree 3 has a “type” that is of degree 2, and each expression of degree 2 has a type of degree 1. Expressions of degree 1 do not have a type. There are two basic expressions of degree 1, viz. type and prop. The word type should not be confused with the word type used more or less colloquially when saying that each expression of degree 2 or 3 has a type. We denote typing by a colon. If A has B as its type, we write A : B. So we can have

A : B : type and also C : D : prop

.

The interpretation of (1) is that A is the name of an object (like the number 3), and that B is the name of the class from which that object is taken (it might be

850

N.G. de Bruijn

a symbol for the set of integers). The interpretation of (2) is that C is a name for a proof, and that D somehow represents the statement that is proved by C. The main profit we have from this way of describing proofs and objects is the matter of substitutivity. If we have described an object depending on a number of parameters, that description can be used under different circumstances by means of substitution: we replace the formal parameters by explicit expressions. The same technique is applicable to theorems: a theorem is intended for many applications, and such applications can be effectuated by substitution. The conditions of the theorem are modified by these substitutions too. If we study the matter more closely, we see that some of the parameters are object-like, and othere are proof-like. The substitution machinery is the same for both. All this is effectively implemented in the Automath system.

2. ORIENTATION ON GEOMETRICAL CONSTRUCTIONS On the fringe of mathematics there are mathematical activities which seem to be of a kind that does not fit into the pattern of objects and proofs. One such thing is the matter of geometrical constructions, a subject that goes back to Greek mathematics. A construction is neither an object nor a proof, but constructions are discussed along with geometrical objects, and along with proofs that show that the constructions construct indeed what is claimed to be constructed. Since these geometrical constructions can also admit substitution for formal parameters, there is a case for creating facilities which handle a new kind of things along with objects and proofs. So we can think of a system that handles objects, proofs and geometrical constructions in more or less the same way. If we think of geometrical constructions, there is a peculiarity that may not arise easily with other kinds of constructions: it is the matter of observability. Let us study a particular example in order to stress this point. Let there be given four points A , B, C and D in the plane. We assume that A , B and C are not on a line. Let M be the centre of the circle through A , B and C. We wish to construct the point P that is defined as follows. P is obtained from D by multiplication, with A4 as the multiplication center, and multiplication factor 1, 2 or 3. The factor is 1 if D lies inside the circle, 2 if D lies on the circle, and 3 if D lies outside the circle. If we want to carry out the construction of P , we have to know whether we are allowed to observe what the position of D with respect to the circle is. In particular this problem comes up for the practical question what should happen if there is insufficient precision for concluding whether D is inside or outside. If we think of a construction with actual physical means like paper, pencil,

Formalization of constructivity in Automath (F.2)

851

ruler and compass, then the case of D lying exactly on the circle is, of course, undecidable. The above construction problem may seem to be very artificial, but yet its main characteristic turns up in very many geometrical constructions: it is the fact that, at some point of the construction the result of some observation will decide the further course of the construction. An example where this will happen is the case of geometrical constructions that have to be carried out inside a given finite part of the plane. The naive approach t o observability may be formulated as the slogan “truth is observable’’ (see Section 4). Other possibilities will be sketched in Sections 8-10. A further thing one might like to formalize is selectability: one wants to be able to select a n object from a set of objects one has constructed. For example, a construction of the intersection of two circles may produce two points, and we may wish to be able to “take one of them”. In this case such a selection principle is not indispensable: one might describe the effect of the construction of the intersection as giving a labelled “first point” and a labelled “second point”. But there is a stronger reason for implementing a selection principle: so often we have to “take an arbitrary point” at some stage of a construction. It should be noted that in such cases the final result of the entire construction does not depend on the particular point that was taken. In Section 5 we come back to this, in particular to the matter of the difference between “giving” and “taking” arbitrary points. A description of all these features is possible in Automath. We have various options for doing it. The way we present this matter is necessarily arbitrary. It is certainly not the intention of this note to give a particular basis for geometrical construction theory. The only thing that will be attempted is to provide a framework into which such a basis might be placed. If we formalize a thing like constructability we of course dislike t o do it in the style of classical logic. We do not want to consider constructability of a point as a proposition in the ordinary sense. We do not want to admit arguments where we get a contradiction from the assumption that the point P is not constructable, and then conclude the constructability of P. Therefore we want to put constructability (and the same thing might apply to observability and selectability) in a framework of positive logic, where we have no negation at all. In fact we can be even more restrictive, and refrain from introducing the ordinary logical connectives (like A , V, +) for this logic. The only thing we want to do is to register statements about constructability, observability and selectability (possibly provided with a number of parameters), and to keep them available for later use.

852

N.G. de Bruijn

We can provide facilities for such a positive logic in Automath by adding a new expression of degree 1, to be called pprop (the first p stands for “positive”). For this pprop we shall not proclaim any logical axioms, and we shall not introduce the notion of negation. Moreover, we do not feel the need to have abstraction in the world of pprop. That is, if u: pprop we shall not take abstractors [x:u] like we would have in cases with prop or type. Accordingly, in this pprop world we shall not consider application (..) ... either. That means: we take pprop entirely in the style of PAL (see [de Bruzj’n 80 ( A . 5 ) ] ) . There is a case for doing something similar in the world of type. Let us create a new expression of degree 1, to be called ctype (the ‘c’ stands for ‘construction’, since we intend to use it in the world of constructions). The difference between ctype and type is similar to the difference between pprop and prop. In ctype we intend to be free from all the assumptions that might have been made about type. In particular we shall not necessarily implement set-theoretical notions. And we shall not even introduce the notion of equality. That is, if a : C : ctype and b : C : ctype, then we will not introduce the equality of a and b as a proposition. Moreover, we shall treat ctype entirely in the style of PAL: no application and no abstraction. For a description of Automath versions where various sets of rules apply to various expressions of degree 1, we refer to [de Bruijn 74al. It has to be admitted that geometry is not the easiest example for the study of constructions. It is not so much the fact that the geometrical universes like planes, spaces, are uncountable. The most troublesome thing is neither that in the geometrical plane there is no fixed origin and no fixed direction. The real course of trouble is that there are so many situations where we have to except some of the cases. If we want to say that points p and q have just one connecting line we have to exclude the case p = q. Such things cause a steady flow of exceptions, which even has distorted the meaning of the word “arbitrary”. In past centuries the word “arbitrary” often had the meaning: “arbitrary, but avoiding some obvious exceptions”, and these exceptions were usually unspecified. If one took an arbitrary point and an arbitrary line then the point should not be so arbitrary t o lie accidentally on the line! A full description of all these exceptions has the tendency to make geometrical construction theory unattractive. Yet there is still another source of irritation: so often we have to split into cases (two circles may have 0, 1 or 2 points of intersection), and these situations might pile up to an entangled mess. Nevertheless we may be grateful t o geometry for having confronted us with the notion of constructability. What we have learned from geometry might be applied t o other areas. Computer science might be one of them. Observability, as a formal element in geometrical construction theory, was considered by D. Kijne [Kijne 621. That paper also attempts a formal treatment


853

of selectability (with selection from finite sets only), and considers “giving arbitrary points” by means of a kind of algebraical adjunction operation.

3. THE BASIS OF FORMAL GEOMETRY

Before we discuss a formal basis for geometrical constructions we have to say what “formal geometry” or more generally, formal mathematics is. Here we are not concerned about the contents of formal geometry, but just about the spirit in which it is written. We may assume that it is written in an Automath book, using the full power of typed lambda calculus. And that it is written in a setting of logic and set theory, the details of which are still open to discussion. One might or might not take the rules of classical logic (e.g. in the form of the double negation law), and we might differ in taking or not taking a thing like the axiom of choice. Such distinctions hardly influence the spirit in which geometry is presented. They might influence the content, i.e. the set of all provable geometrical statements (but it should be remarked that there are areas of mathematics which are much more susceptible to foundational differences than classical geometry seems to be). Just to give an idea of the spirit, we give a small piece of Hilbert’s axiomatization of geometry. Hilbert starts with: there are things we call points and there are things we call lines (in Hilbert’s system the notion of a line is not presented as a special kind of point set). In Automath we say this by creating primitive types “line” and “point”. These types are undefined, just introduced as primitive notions (PN’s). As a primitive we also have the notion “incidence” of a point and a line. Next we can express axioms like: if two points are different, then there is exactly one line incident to both points. Something should be said about “different”. We take it that our geometry text is written in a mathematics book in which for any two objects a, b of type A there is a proposition that expresses equality of a and b, and that for any proposition we can form the negation. In this way the fact that a and b are different can be expressed in Automath by means of NOT(IS(A, a, b ) ) . But in order to keep this paper readable we shall just write a # b instead of this. We now give a piece of Automath text that can be considered as the start of a Hilbert-style geometry book (we display our Automath texts in a flag-andflagpole format: the block openers are written on flags, and the poles indicate their range of validity).

N.G. de Bruijn

854

point := PN : type line := PN : type

I

p : point

m : line

q : point

ax1 := P N : incident(p, conn) ax2 := PN : incident(q, conn)

m : line

I

ax3 := P N : m =conn So if p , q are points, and m is a line, then incident(p,m) is a proposition; if pr is a proof of p # q then conn(p,q,pr) is the connecting line of p and q . In Axioms 1 and 2 we have expressed that this line is incident to p and q, in axiom 3 it is stated that if a line m is incident to both p and q then m is equal to the connecting line. Although the above fragment is still a meagre piece of geometry it is hoped that it shows the spirit of a formalization. We shall refer to such a presentation of geometry as 0.

4. A NAIVE APPROACH TO OBSERVABILITY

What we shall call the naive approach is expressed by the slogan “Truth is Observable”. Let us explain what this means by mentioning two cases. In the first case we use knowledge obtained from geometrical theory 0 in order t o prove that some object we have to construct is already in our possession. We do not bother whether that proof is L‘constructive’’or not: truth is just truth. One might find this a poor example, since within the sope of usual geometrical theories and usual constructions it seems that “non-constructive” proofs can


855

always be replaced by very constructive ones, but it is easy to imagine fields where the situation is different. In the second case we have a construction that started from a point that was chosen arbitrarily. At some stage of the construction we have a point P and a circle c, and subsequently our course of actions is depending on whether P lies inside c, outside c or on c. The naive point of view says that on the basis of the theory in G we have exactly one of the three alternatives. We can observe which one of the three occurs, and we act accordingly. In Sections 6 and 7 we offer two different implementations for the naive point of view.

5. TAKING ARBITRARY OBJECTS Before going on, we have to make it clear that there are two entirely different situations where in traditional geometry it was said that an arbitrary object (like a point) was taken. Let us call these situations V and S, (these letters abbreviate “data” and “selection”). If we think of a problem where a teacher requires a pupil to construct something, then 2) is the case where the data have been chosen arbitrarily by the teacher. On the other hand, S is the case where the pupil, in the course of the construction, selects some point arbitrarily. Quite often the final result does not depend on the particular point that was chosen, but there may be other cases. It may happen that the final result itself has a kind of arbitrariness. An example: given points A , B and C, not on a line, construct a point inside the triangle formed by A, B and C. In the opinion of the pupil, the points taken in situation 2) are not called “arbitrary”: they are called “given” or possibly “arbitrarily given”. The pupil has no freedom in case V . In the S-case, however, the pupil is completely free, and the teacher has no say in the matter. In a formal presentation like in Automath the difference between V and S is very pronounced. 2) is effectuated by means of the introduction of a new variable, S is implemented by means of a primitive notion (PN). We shall show this in detail in Section 6 and 7. There is something about the PN-implementation of the S-situation that might be felt as strange. If we describe a construction by such a PN, then we select exactly the same point if we are requested to do the construction a second time. If the second time we would insist on selecting a point that is actually different from the one chosen the first time, then we have to do this on the basis of some new selection principle, of course. But if we just want to take a point again, without any restriction as t o its being different from or equal to the first one, our P N provides us with the same point we had before. This means that we

N.G. de Bruijn

856

get more information than we intended to have. Nevertheless, such information cannot possibly do any harm. What shall we do about this weirdness of the PN-implementation? Shall we invent unpopular remedies in order to cure a completely harmless disease? Let us not prescribe a definite attitude in this, and admit that there are several ways to live with the situation. Either we leave the harmless disease for what it is, or we take one of the remedies. Let us mention two remedies. The first one is to take a notion of time t , and adhere a value o f t to every construction step. The arbitrarily selected points will depend on t. If we have to repeat the construction some other day, t has a different value, so nothing is known about the selected point in comparison to the one selected the previous day. As a second remedy we suggest to implement arbitrary selection not by an axiom but by some axiom scheme. The scheme proclaims the right to create as many copies of the axiom as one might wish, each time with a different identifier. We leave it at these scanty remarks. The author’s opinion is that unless we invent a much simpler cure, we’d better learn to live with the harmless disease.

6. FIRST IMPLEMENTATION OF THE NAIVE POINT OF VIEW We have to express in some way or other that some of our mathematical objects have been constructed. This can be thought of as a property of those objects, but for reasons sketched in Section 2 we prefer to take this property as a pprop rather than as a prop. We shall create, for every type X and for every z of type X, the expression have(X,z) with have(X,z) : pprop. In particular we can abbreviate have(point,z) t o havep(z) and have(line,z) to havel(z). (Since we use “have” for points and lines only, one might think of taking just “havep” and “havel” as primitives, without taking “have” for general types.) We now give some Automath text. It is supposed to be added to a book that contains geometrical theory G (see Section 3) already. First we introduce “have”, and abbreviations “havep” and “havel”.

I I

have := PN : pprop


I

857

havep := have(point,u) : pprop

v : line have(line,v) : pprop Next we display how we take an arbitrary object in the sense of the D-situation of Section 5 (“given objects”). In order to talk about a given point we need two block openers, expressing (i) that u is a point, and (ii) that havep(u) holds; inside that context the point u can be considered as given. We shall now express: if u and v are given points and if u # v then we can construct the line connecting u and v. According to our naive point of view the condition that u and v are different is simply expressed in the terminology of 9.

I

J

u :point

-1

ass11 : havep(u)

v : point

1

Next we describe a case of “taking arbitrary points” in the S-situation of Section 5. We express that if m is a given line then we are able to take a point not on m (we use the identifier “up” to suggest “arbitrary point”).

I

m : line

I

ass14 : havel(m)

I

up := PN : point az12 := PN : NOT(incident(ap, m ) ) ax13 := PN : havep(ap)

N.G. de Bruijn

858

These pieces of text display the form in which the basic constructions are introduced. If we want to describe a more complicated construction, we mention the relevant objects one by one, in the order of the construction, and each time we express that we “have” them. We give a (still very simple) example.

assl6:p#q

1

L1 := conn(p, q, assl6) : line H1 := a z l l ( p , assl4, q, assl5, assl6) : havel( L1) P1 := ap(L1, H1) : point : NOT(incident(P1, L l ) ) N i l := az12(L1, H1) H2 := az13(L1, H1) : havep(P1) Here L1 is an abbrevation for the line connecting p and q; H1 can be used as a reference for the fact that we actually have that line. P1 is the result of the construction, N i l assures us that P1 does not lie on L1, and H 2 assures us that we actually have P1. Altogether the text line with identifier P1, Nil, H1 represent the “derived construction’’ expressing that if p and q are given different points then we can take a point P1 such that p , q, P1 are not on one line. This derived construction can be applied later without referring to how it came about. It can be constructed as a kind of “subroutine”. The example of a derived construction we gave here is ridiculously simple, of course. Yet the pattern is the same as in more complicated cases. It shows the old idea of subroutines, which existed in constructive geometry many centuries before it came up in computer programming.

7. SECOND IMPLEMENTATION OF THE NAIVE POINT OF VIEW In the second implementation we take a construction plane which we conceive as being different from the geometrical plane. We might think of the original geometrical plane as abstract, and the construction plane as concrete, consisting


859

of a piece of paper we can draw on. But, of course, our construction plane is still abstract: it is a mathematical model of a concrete plane. The objects in the constructed plane will be called cpoints and clines. In the back of our minds we think of a one-to-one mapping between the two planes: every cpoint has a point as its companion, and every cline has a line as its companion. Yet we shall not express all of this in our mathematical formalism. We shall just talk about a mapping (to be called semp) of cpoints to points and a mapping (to be called seml) of clines to lines. The reason for this reticence lies in the interpretation. If p l is a point, and if we are able to name a cpoint cpl that is mapped t o p l in our mapping, then for us this means that we “have” p l . We do not want to say that every point in the geometrical plane is a point we “have” just by being able to express that point mathematically. Therefore we do not want to be able to express the inverse mapping. Related to this reticence is the fact that we do not want to be able to discuss equality of two cpoints. Such equality has to be discussed for the companion points in the geometrical plane. And we do not want to admit as mathematical objects things like “the set of all cpoints” with some prescribed property. We achieve these restrictions by putting “cpoint” and “cline” into ctype, which is a world without equality, without set theory, without quantification. As a consequence we do not have constructability questions in our theory. A statement: “the point P is not constructable with ruler and compass” will not be a proposition in our Automath book. If we would be able to quantify over the construction plane we would be able to express that ‘‘there is no cpoint that is mapped onto P” and that would express the non-existence of the construction. Constructability questions belong to the meta-theory. They express that something “cannot be obtained on the basis of the PN’s displayed thus far”, and we cannot say such things in Automath itself. What we call our second implementation starts with the introduction of cpoint, cline and the mappings semp and semf. The latter abbreviations suggest the word “semantics”: we might say that the geometrical plane forms the semantics of the construction plane. If P is a cpoint then semp(P) is its semantics. Off we go: cpoint cline

:= PN : ctype

:= PN : ctype

1

c p : point

I

1

semp := PN : point

N . G . de Bruijn

860

I

I

cl : cline

1

semi:= PN : line

In order to take an arbitrary point in the construction plane, a single block opener “x : cpoint” plays the role of the pair “U : point”, “ass11 : havep(u)” of the first implementation. We show this with the fundamental construction that connects two points: x : cpoint

cconn := PN : cline ax21 := PN : seml(cconn) = conn(semp(x), semp(y), ass21) The fact that cconn is the line we are looking for, is expressed (in ax21) by means of equality in 4. If we have to take an arbitrary point in the S-situation we again get one PN less than in the corresponding case of Section 6. In order to express that, we can take a point outside a line, we write cm : cline := PN : cpoint ax22 := PN : NOT(incident(semp(acp),seml(cm)))

We also show the text corresponding t o the one with P1, N i l , H2 in Section 6: p : cpoint

:

Ni2 := ax22(CL1) N i 3 := ...

cpoint

: NOT(incident(semp(CPl),seml(CLl)))

: NOT(incident(semp(CPl),

conn(semp(p),semp(q) 1 ass221))


861

We have not displayed the proof N i 3 . It will depend on applying general axioms about equality, and will make use of N i 2 and ax21. Passages like the one from N i 2 to N i 3 might be superfluous in many cases, since it is practical to keep the discussion as long as possible in the construction plane. To that end we might copy notions from E to the construction plane. The simplest example is

7 x : cpoint

cincident := incident(semp(z),seml(y)) : prop

8. RESTRICTED OBSERVABILITY In Sections 4, 6, 7 we described the naive point of view, where every truth in the geometrical theory is considered to be “observable”. Observability has its meaning in the process of taking decisions about the course of our constructions. Let us describe two different motives for restricting observability. One is practical, the other one is fundamentalistic. We shall discuss these in Section 9 and 10, respectively.

9. PRACTICAL RESTRICTIONS ON OBSERVABILITY The practical point of view is connected to questions of precision. This can be compared t o the matter of rounding off errors in numerical analysis. If in a construction two points turn out to be so close together that our construction precision does not guarantee that they are different, then we can not claim to be able to connect them by a line. And even if the points are different, the line will be ill-defined. Although these practical matters give rise to quite complicated considerations, we cannot say that they are necessarily essentially different from what we did in Sections 6 and 7. One can still go on the basis that truth is observable: the question is just a matter of which propositions we consider the truth of. Instead of claiming the possibility t o connect two points p , q if p # q in the geometrical world G, we take a thing like d(p,q) > 1 (distance exceeds unity) as our criterion. Nevertheless we can make things a little livelier than this. Let us start from what we developed in the beginning of Section 7: just the four PN’s that were called cpoint, cline, semp and semi. We now introduce a primitive notion

N.G. de Bruijn

862 “obsdif” ( “observationally different”) in the construction plane: p : cpoint

obsdif := PN : prop And now instead of introducing the cconn, ax21, etc. of Section 7, we go on like this: z : cpoint

I

ass31 : obsdif(x, y)

1

cconnl := PN : cline ax31 := PN : 2 # y ax32 := P N : seml(cconn1) = conn(semp(z),semp(y),az31) Knowledge about obsdif can come from different sources. In the first place we can axiomatize things like: if d(semp(x),semp(y)) > 1 then z and y are observationally different. A second source arises if we axiomatize in the construction plane, in some situations, that if cpoints u and w are observationally different, then the cpoints z and y, derived from u and w in one way or other, are observationally different. A very simple case of this is an axiom stating that obsdif(s, y) implies obsdif(y, z). It will be clear that this subject will become very complicated without being very rewarding. Therefore it seems definitely unattractive.

10. FUNDAMENTALISTIC RESTRICTIONS ON OBSERVABILITY In Section 9 we still had the uncritical acceptance of all truth that can be obtained in the geometrical world. There is a clear reason for restriction. If we have to use geometrical propositions for taking decisions in the world of constructions, it is reasonable to require that we also have a “constructive” way for actually deciding whether such propositions hold or do not hold. We can implement such restrictions in Automath by selecting some “constructive” basis for logic and mathematics, like intuitionistic mathematics, and building our geometry G according to these principles. We might even mix


863

a constructive kind of mathematics with the ordinary kind, using pprop and ctype for the constructive kind. In particular it seems to be reasonable to take the “obsdif” we had in Section 9 as a pprop rather than as a prop. The latter remark suggests that it might be simpler to shift life entirely to the construction plane, and to forget 0 altogether. But this is not what we usually want. Let us imagine that we want to describe the theory of Mascheroni constructions (constructions with compass but without ruler). The subject matter concerns both circles and straight lines, the constructions deal with circles only. This difference can be implemented by discussing both circles and straight lines in 0, but just “cpoints” and “ccircles” in the construction plane.

11. COMPARISON WITH COMPUTER PROGRAM SEMANTICS It is very natural to compare the field of geometrical constructions with the one of computer programming. In both cases there is a number of actions that produce one or more objects, and in both cases it is very essential that it is proved that these objects satisfy the problem specification that was given beforehand. In a computer program we usually think of a “state space”; the input is an element of that state space and the output is again such an element. In the case of geometrical constructions one would say that the input is (vaguely speaking) the given figure, and the output is the required figure. Let us admit different spaces for input space and output space, and try to describe at least the specification of a geometrical construction in terms of input and output. As an example we take the following (trivial) construction problem. Given two different points P , Q and a line rn. Construct a line q that intersects m, passes through P but not through Q. Let us talk in the style of Section 7, and let us moreover decide to introduce a name R for a cpoint of intersection of q and m (otherwise we would need existential quantification). An element of the input space is a triple ( P , Q , m ) where P : cpoint, Q : cpoint, rn : cline, and where we have semp(P) # semp(Q). An element of the output space is a pair (9, R) where q : cline and R : cpoint. The problem specification is given by the conditions that seml(q) is incident with semp(P) and semp(R) but not with semp(Q). This kind of problem specification is entirely in the style of what is called “relational semantics’’ in computing science. If we deal with geometrical constructions, the role of “subroutines” is more or less the same as in computer programming. In particular we can say that descriptive geometry consists of a large body of subroutines. In computer programs we can have loops. Sometimes pieces of a program

N.G. de Bruijn

864

have to be repeated until some condition is satisfied. The geometrical constructions we discussed in the previous sections have no such loops. This reveals essential restrictions on the class of constructions we can describe in the various systems that were suggested in these sections. An example of a construction with loop is the following one. Let A , B , C be given points on a given line, B between A and C. It is required to construct a point D on that line, such that C is between B and D , and such that the length of the line segment BD is an integral multiple of the length of the segment AB. This construction requires a loop. Our treatment of geometrical constructions in Sections 3-10 might be called “operational” or anyway “functional”. All the time uniquely determined outputs are obtained step by step, and in the slightly more sophisticated case of the use of subroutines the only thing we actually do is taking sequences of steps together and considering them as a single step. The reason is that the treatment is based on what we shall call the interior approach. In the interior approach we talk in terms of the constructed objects. The constructed objects are treated in the same style as ordinary mathematical objects and (but this is a typical Automath feature) proofs. In our Automath book we discuss the objects, but the action of construction is felt as subject matter of some metalanguage. An entirely different way to deal with constructions is that we consider constructions as objects, seemingly more abstract than the ordinary objects, but nevertheless on the same linguistic level. Let us call this the exterior approach. (The name is suggested by the fact that if we work in the interior approach then the metalinguistic discussion of construction is felt as being something at the outside.) With the exterior approach we can get rid of the limitations of our “functional style” of construction description. Anyway we can remove the last differences there might be between geometrical construction and computer programming. We might try to start the exterior treatment with the introduction of a primitive notion “construction” like: construction := P N : ctype but it has to be more complicated than this. The notion of construction has to depend on the input space and the output space as parameters, and this is not so easy t o describe.

865

The Mat hernat ical Vernacular, A Language for Mathematics with Typed Sets N.G. de Bruijn

1. INTRODUCTION 1.1. The body of this paper is from an unpublished manuscript (“Formalizing the Mathematical Vernacular”) that was started in 1980, had a more or less finished form in the summer of 1981, and a revision in July 1982. [The Sections 1 to 17 were published for the first time i n [de Bruijn 87a (F.3)]. A t that occasion the (very essential) Sections 12-1 7 were revised in order to adapt them to typed set theory, and the Introduction was extended. For this 1994 version the old Sections 18-22 have been revised i n order to let them match the revised Sections 12-1 7.1 1.2. The word “vernacular” means the native language of the people, in contrast to the official, or the literary language (in older days in contrast to the latin of the church). In combination with the word “mathematical”, the vernacular is taken to mean the very precise mixture of words and formulas used by mathematicians in their better moments, whereas the “official” mathematical language is taken to be some formal system that uses formulas only. We shall use MV as abbreviation for “mathematical vernacular”. This MV obeys rules of grammar which are sometimes different from those of the “natural” languages, and, on the other hand, by no means contained in current formal systems. 1.3. It is quite conceivable that MV, or variations of it, can have an impact on computing science. A thing that comes at once into mind, is the use of MV as an intermediate language in “expert systems”. Another possible use might be formal or informal specification language for computer programs. 1.4. Many people like to think that what really matters in mathematics is a formal system (usually embodying predicate calculus and Zermelo-F’raenkel

866

N.G. de Bruijn

set theory), and that everything else is loose informal talk about that system. Yet the current formal systems do no adequately describe how people actually think, and, moreover, do not quite match the goals we have in mathematical education. Therefore it is attractive to try to put a substantial part of the mathematical vernacular into the formal system. One can even try to discard the formal system altogether, making the vernacular so precise that its linguistic rules are sufficiently sound as a basis for mathematics. An attempt to this effect will be made in this paper. We shall try to do more than just define what the formalized vernacular is: much of our effort (certainly in Sections 2, 3, 4) will go into showing its relation to standard mathematical practice. 1.5. Putting some kind of order in such a complex set of habits as the mathematical vernacular really is, will necessarily involve a number of quite arbitrary decisions. The first question is whether one should feel free to start afresh, rather than adopting all pieces of organization that have become more or less customary in the description of mathematics. We have not chosen for a system that is based on what many people seem to have learned to be the only reasonable basis of mathematics, viz. classical logic and Zermelo-Fraenkel set theory, with the doctrine that “everything is a set”. Instead, we shall develop a system of typed set theory, and we postpone the decision to take or not to take the line of classical logic to a rather late stage.

1.6. The idea to develop MV arose from the wish to have an intermediate stage between ordinary mathematical presentation on the one hand, and fully coded presentation in Automath-like systems on the other hand. One can think of the MV texts being written by a mathematician who fully understands the subject, and the translation into Automath by someone who just knows the languages that are involved. [For general information on Automath the following paper may be adequate: [de Bruijn 80 (A.5)l.l Experience with teaching MV was acquired in a course ‘ 1 for all x, but that does not help us to prove the lemma”. The only MV-part here is “f(z)> 1 for all z”.

1.9. In a system where we expect to have our mathematics checked by a machine it will certainly be worth while to take both the MV-part and the argumentations as essential parts of the formal language, as has been done in Automath. But even if that is considered as a sound basis for mathematical communication,

868

N.G. de Bruijn

it is questionable whether it can ever replace that communication. It has the disadvantage that it makes sense only for texts that have been elaborated in every silly little detail. For communication this is rather inconvenient. We wish to write in a style in which we omit what we think is trivial. What things can be considered to be trivial depends on the experience the reader is expected to have. Therefore we shall define correctness of MV in such a way that proofs where pieces of the derivation are omitted, can be considered as still correct. A text would become incorrect if we omit definitions of notions that are used in later parts of the book. A proof written in MV may be restricted to showing a sequence of resting points only. The derivation from point to point may be suppressed, or at least be treated quite informally. This seems to come close to the current ideal of mathematical presentation: impeccable statements, connected by suggestive remarks.

1.10. In contrast to what one might expect at first sight, the grammar of the mathematical vernacular is not harder, but very much easier than the one of natural language. We can get away with only three grammatical categories (the sentence, the substantive and the name), because mathematicians can take a point of view that is very different from the one of linguists. The main thing is that mathematical language allows mathematical notions to be defined; it can even define words and sentences. In choosing these new words and sentences we have almost absolute freedom, just like in mathematical notation. We hardly need linguistic rules for the formation of new words and new sentences. It usually pleases us to form them in accordance with natural language traditions, but it is neither necessary nor adequate to set linguistic rules for them. 1.11. The language definition of MV will be presented in two rounds. In the first round we express the general framework of organization of mathematical texts. It is about books and lines, introduction of variables, assumptions, definitions, axioms and theorems. All this is condensed in the rules BR1-BR9 in Sections 9 and 10. In the second round we get the rules about validity. These cover Sections 11-17. These two rounds describe a language for mathematics. It would go too far to call them the foundation of mathematics. The language of mathematics allows us to write mathematical books, and in these books we can axiomatize the rest of what we call the foundation of mathematics. Part of that axiomatic basis might be considered as foundation of mathematics as a whole, but other sets of axioms just serve for particular mathematical theories. The dividing line between the two is traditional, not essential. Part of the axiomatic basis in the book may be of logical nature, and that part will certainly be considered to

The mathematical vernacular (F.3)

869

belong to the foundation. Most of the validity rules of the second round have been put in that second round since they cannot be expressed in the books. In other words, they cannot be expressed in MV itself. But a very large part of what is called the foundation of mathematics can just be written in the books, more or less to our own taste. As examples we mention here: falsehood, negation, conjunction, disjunction, the law of the excluded middle, existential quantification, the empty set, the axioms for the system of natural numbers, the axiom of choice. One might try to reduce the second round to an absolute minimum and to put as much as possible in the MV books. We have not gone that far, in most cases because it seems to be nicer to keep things together that belong together. In the case of Section 15 (rules for Cartesian products) the reason to keep it in the second round may seem peculiar. It is just because of the fact that if we want to refer to elements ( a ,b) of the Cartesian product of A and B , we would hate to have t o mention A and B as parameters all the time. We would have to, if that section would be shifted to the book.

1.12. Let us try to compare MV and Automath. In the first place it must be said that MV has been inspired by the structure of Automath as well as by the tradition of writing in Automath. In that tradition elementhood, i.e. the fact that an object belongs to a set, is expressed by the typing mechanism available in Automath. So in order to say that p is an element of the set S, this is coded as p : S, so S is the type of p . This is in accordance with the tradition in standard mathematical language. If we say that p is a demisemitriangle, one does not think of the set or the class of all demisemitriangles in the first place, but rather thinks as “demisemitriangle” as the type of p . It says what kind of thing p is. In order to keep this situation alive, MV does not take sets as the primitive vehicles for describing elementhood, but substantives (in the above example semidemitriangle is a substantive). It is important to see the difference between substantives and names. Grammatically they play different roles. If we say that a b is an integer, then “integer” is a substantive and a b plays the role of the name of an object. Coming to a situation like a E b E c E d, the Automath style does not allow to write this as a chain of typings like a : b : c : d. If 6 is a set, then let us write 61 for the substantive “element of b”. The chain becomes a : 61, b : c l , c : dl. An important difference between Automath and MV is that in Automath typirigs are unique (up t o definitional equivalence), and in MV they are not. MV is adapted to the tradition of ordinary mathematical language in which 5 is a real number and at the same time the same 5 is an integer. One does

+

+

870

N.G. de Bruijn

not feel a conflict since “integer” is just a special kind of “real number”. In Automath it is always a bit troublesome to express that an object belongs to a subtype: The fact that 5 is a positive real number is described in Automath by two consecutive typings. The first one says that 5 is a real number, the second one says that some particular expression u is a proof for the statement that 5 is positive. This is often felt as a burden. A consequence of the way we treat typing by means of substantives in MV is that a typing like “5 : real number” has the nature of a proposition. This is one of the rules of MV (see T1 in Section 12), but is not done in Automath. Another difference between Automath and MV, already mentioned in 1.9, is that Automath has exact proof references inside the formal text, whereas MV either does not have them at all or has them informally in the margin. This provides a serious (but quite clear) task for those who implement MV into Automat h. There is another trouble with the implementation. In MV we have quite strong equality rules, more or less corresponding to the standard feeling that “between two equal things there is no difference at all, they are just the same”. In Automath it may cause quite some work to show the equality of two expressions whose only difference is that, somewhere inside, the first one has p and the second one has q, and where p is equal to q. One has to bring the equality from the inside to the outside, and that may cause a lot of Automath text. Fortunately the writing of that text can be automated. In our version of MV we have a strong set of equality axioms (in particular EQ10a-EQ10c of Section 13.2) which make all this much easier. 1.13. One might think of direct machine verification of books written in MV, but this will be by no means so “trivial” as in Automath. Checking books in MV may require quite some amount of artificial intelligence. In the first place MV allows us to omit parts of proofs, at least as long as no definitions are suppressed (see Section 1.9). But even if the steps in an MV book are ridiculously small, a checker may have a hard time, since in MV proof indications are not given in the formal text itself. To make a book in MV better readable, one can provide the text with proof references in the form of hints, so to speak in the margin. In order to make automatic checking of MV books feasible, one has to invent some system t o pass those informal hints to the artificially intelligent machine.

1.14. The formation rules of MV allow us to form sub-substantives to a given substantive. The relation is denoted by b” and “ p is divisible by 5” are statements, and the whole phrase is a statement. A substantive is a generic term for a class. Examples: “circle”, “positive integer with exactly three divisors”, “point”. A generic term for a class is not the same as a name for that class. The difference is small: it is only the way we use them. If C is the class of all circles, then the phrases “P is a circle” and “ P is an element of C” are intended to mean the same thing. A warning: sometimes a phrase has the grammatical form of a substantive without playing that role in a mathematical text. In the phrase “ P is the orthocenter of triangle ABC”, the word “orthocenter” is not t o be considered as a generic name for a class. One should not think that it had first been explained what an orthocenter is, and that later it was proved that a triangle has just one orthocenter, so that finally we can speak of “the orthocenter”. No: the phrase “the orthocenter of triangle ABC” can be used by virtue of a previous definition in the book, where it was introduced as a name with the same status as a name like Oc(A, B, C) would have had. Therefore there is no question of parsing it into separate components like “the” “orthocenter”, etc. A n a m e is a phrase we consider as a sufficient indication of an object. Without going into the question whether we have or do not have objects in mathemat,ics, we note that our linguistic handling of mathematics seems to treat mathematical names as if they were names of objects. Examples of names are “the center of the unit circle”, “the point M ” , “ M ” , “a b”. As to adjectives we mention that adjectives are always attached directly or indirectly to a substantive. Once we know what a triangle is we can say what it means that a triangle is “isosceles”. It can be used in two ways: (i) in statements like “triangle A B C is isosceles”, and (ii) in order to form the new substantive “isosceles triangle”. This humble role of adjective does not seem to suffice as a reason for taking them as building blocks in our rudimentary grammar of MV. Nevertheless there is a reason to take them seriously: mathematicians seem to like them so much. They seem to like definitions where a new notion is presented in the form of a new adjective. We shall say more about adjectives in Section 22.14.

+

3.6. In our version of MV we use typing on two levels: low typing and high typing. Low typing is used to express that some “object” is of a certain “kind” like “ p is an integer”. In MV we have a preference for writing a colon instead of “is a”, so we write “ p : integer”. This colon is the notation for a kind of relation between “p” (which is grammatically a name) and “integer” (which is grammatically a substantive). In the metalanguage smMV we say that “ p : integer” is a (low)

878

N.G. de Bruijn

typing. High typing is a thing that in most other systems would be put into the metalanguage rather than into the language itself. We denote it by a double colon. On the right we have either “statement” or “substantive”. Examples of ‘‘z > y :: statement”. high typings are “integer :: We can as well say right here that low typings “ p : q” will occur only in cases where the high typing “q :: substantive” has been established already. In this connection we mention that one might say in the metalanguage smMV that p is a name, or that p is the name of some ql but we do not express this in MV itself. We mention a question that often turns up among mathematicians: is 3 a number or is 3 the name of a number? We can agree to both alternatives, depending on the language we use. In MV we say “3 : number”, but in smMV we say that 3 is a name, and more precisely that 3 is the name of a number. For a moment we consider the word “object”. There is the old philosophical question whether mathematical objects exist. Those who believe in the existence are called platonists. One might suspect that all mathematicians are platonists, even those who fiercely deny it. The matter is clear for those who consider it as their job to provide useful communication language for mathematicians: platonism is not right or wrong, platonism is irrelevant. At least it is irrelevant for matters of truth and falsehood of mathematical statements. It may be relevant for mathematical taste, but that is a personal matter anyway. The most important thing to say about platonism is possibly that platonism is dangerous. It may seduce mathematicians in thinking that they can get away with incomplete definitions of objects since these objects exist anyway. And it might give the false suggestion that slightly different definitions of a mathematical object are not harmful since after all they refer to one and the same platonic object. Another danger of the idea of platonic existence is that many people find it hard t o understand the meaning of existence in mathematics. The statement in OMV that “there exists a positive number whose square equals 9” has nothing to do with the platonic existence of the number 3. We shall give a kind of linguistic interpretation to the word “object”. We take it as a word used in smMV. If S is a substantive, and if we have in MV that p : S, then we might say in smMV that “ p is the name of an object”. Continuing in smMV, one might ask “what kind of object?”. The answer t o this will be in smMV that p is the name of an S, and in MV itself that p : S (which expresses that p is an S). We of course have not expressed here what the word “object” means, but only how the word is used.

3.7. In the next section we will use the word clause (smMV). It will get its exact description in the language definition (from Section 6 onward), but we may as well say right here that a clause is either a typing or a statement. This


879

cannot serve as a definition of the word “clause”, however. We even note that Yyping” and “statement” belong to different languages. In order to give a preliminary idea, we say here that a clause will be either a high typing,

A :: substantive or

P :: statement or something of the form

P

(3.7.1)

in situations where

P

::

statement

(3.7.2)

had already been recognized as a valid clause. The interpretation of (3.7.2) is “P is a well-formed statement”, and the one of (3.7.1) is “P is true”. Note that in (3.7.1) and (3.7.2) P itself can be a low typing like “ a : A ” , where “ A :: substantive” has already been recognized as a valid clause. There will be cases where we establish that “ a : A” is a well-formed statement, and there will be cases where we establish that “u : A” is true. High typings will be different from low typings in the sense that they cannot be considered as statements. There will be no valid clauses of the form

( A :: substantive) :: statement (P :: statement) :: statement

4. STRUCTURE

OF MV BOOKS

4.1. In this section we give a first outline of what a book is. The following

terms will be all smMV: “book”, “line”, “older”, “younger”, “context”, “context item”, “declarational”, “assumptional”, “body of a line”, “context length”, “empty context”, “flag”, “flagstaff”, “flagstaff form”, “flagless form”, “block”, “block opener”, “nested blocks”, “sub-block”. A book is a finite partially ordered set of lines. The order relation is called “older than” (“line p is older than line q” and “line q is younger than line p” are synonymous). A line consists of two parts: a context and a body. A context is a finite sequence of context items. There are two kinds of context items: declarational items and assumptional items. The sequence of context

880

N.G. de Bruijn

items may be empty, and in that case we speak of the empty context. In general, the number of items in the sequence is called the length of the context; the empty context has length zero. This is all we say here about context items; for further information we refer to Section 6. We refer to Section 7 for a description of the body of a line; for the time being we do not need such a description. 4.2. We sketch the interpretation of the words introduced in Section 4.1 in terms of gL. A book is t o be interpreted as any connected piece of mathematics that starts from scratch. Lines are primitive building blocks of books. One aspect of lines is that if we omit the last line of a book then it is still a book, but if we omit just a part of that line then it is no longer a book. Usually we think of a book as a linearly ordered set (i.e.l a sequence of lines, and we were thinking that way when using the words “last line” in the previous sentence), where the first line is “the oldest” and the last line is “the youngest”, but we need not go so far as to prescribe this linearity. The meaning of old and young is that younger material may make use of older material, but not the other way round. Since every finite partially ordered set can be put into a linear order that is consistent with the partial order, we see that the generalization from linear t o partial is a very superficial one. Nevertheless, the presentation in a non-linear form may make a book easier to understand. In particular, if two pieces A and B are logically independent of each other, then this independence would be muffled if, only for the sake of typography, we would proclaim A to be older than B. Saying thct a book remains a book if we omit the last line (or in the case of non-linear order, if we omit a line that is not older than any other line in the book), means that it remains a book in the sense of syntactic structure; it need not be an interesting book. An assumptional context item is t o be interpreted as an assumption, like “assume p > q ” . A declarational context item is t o be interpreted as the introduction of a variable of a specified type, like “let y be a real number”. A context is to be interpreted as a sequence of such items, arranged in the order in which they were introduced. As an example (in OMV) we give a context of length 4: “let n be a positive integer, let S be a subset of the set of real numbers, assume that S has n elements, let s be an element of S”. The body of a line is interpreted as a piece of true information we provide in the considered context. As an example (in OMV) we give, with the above context of length 4, “if n > 1 then S contains an element different from s”. 4.3. In this section we present examples of the structure of a book. Throughout

Sub-sections 4.3, 4.4, 4.5 we think of a linearly ordered book. The examples are


88 1

abbreviated, in the sense that context items are replaced by symbols I1,12,13,... , line bodies by 61, bz, b3, ... . Contexts are represented as sequences of items separated by commas, and we write an asterisk between context and body of the line. Now a book can look like this:

The contexts in this example look a bit untidy. In a mathematics text the contexts usually do not change from line t o line, but are constant over a larger piece of text. And if the context changes, it is either by adding a few context items on the right or by deleting one or more from the right. So contexts grow and shrink on the right in the course of a mathematical discussion. Assumptions that were once introduced are no longer valid from a certain point onwards, and the same thing holds for variables: a variable is born, is alive during some time, and then dies. In OMV it is customary to announce birth of assumptions and of variables, but it is left to the reader to guess (possibly on the basis of the typographical layout, possibly on the basis of “understanding the author’s intentions”) at what point in the text they are dismissed. For the sake of further discussion we give a typical example:

4.4. The information contained in a book is completely preserved if we write

it in what we call its flagstaff form. In contrast to this, the form presented in Section 4.3 is called the flagless form. In the flagstafl form, the context items are written on flags. The staff of a flag is vertical, and marks the set of lines where the flag’s item is a part of the context. The following example, where the second example of Section 4.3 has been put into flagstaff form, speaks for itself.

N.G. de Bruijn

882

Needless to say, the way back from flagstaff form to flagless form is immediate. For every one of the bodies b l , ...,blo we get the context if we assemble the items on the flags carried by the flagstaffs we see on the left of that body. Later we shall use rectangular flags for assumptions and pointed flags for declarations, in order to make a clear distinction between those two kinds of context items. We did not do it here, since the relation between flagless form and flagstaff form is independent of such a distinction. In our formal presentation of MV we handle the flagless form; in examples we may switch to the flags (see Section 18). 4.5. Sometimes we use the word block (smMV) to denote the material to the right of a flagstaff, including the flag itself. So every flag determines a block, and the item on the flag is called a block opener (smMV). As an example we quote that

P

P


883

are blocks of the book of Section 4.4.The block openers are 1 4 and 16, respectively. The blocks are always nested, that is to say that if two blocks are not disjoint then one of the two is a sub-block of the other one.

5. IDENTIFIERS

5.1. In this section the following terms of smMV will be introduced: “identifier”, “fresh identifier”, “constant”, “parametrized constant”, “modified parametrized constant”, “variable”, “dummy”, “variables of a context”. Note that a word like “variable” is smMV, but that the variables themselves are sMV. Similar things hold for the other notions. 5.2. An identifier is a symbol or a string of symbols to be considered as an atomic piece of text. We might say that an identifier is a symbol, but since we need a very large number of symbols we use strings of symbols instead, taken from a relatively small collection. It is a matter of parsing how to isolate these identifiers in a given piece of text. We shall not go into these parsing questions since they are not very essential here: if we had an unlimited amount of useful identifiers the matter would not have arisen at all. We refer to Section 23 for further remarks. Examples of identifiers in OMV are “z”,“2”, “the complex number field”, “parallelogram”. We note that if we describe “the complex number field” as a string of symbols, then we have t o consider the empty spaces between the separate words as symbols too. These are produced by key strokes on a typewriter just like the letters, but they do not leave a visible imprint on the paper. Therefore it is better to replace the empty spaces by a visible character that is not used otherwise. One can take the underlining symbol for this, and write “the_complexnumberfield”. In our examples we shall not do this, however. It is one of the aspects in which the paper remains informal. 5.3. An identifier is called fresh at some specified place of the book if it has

not appeared yet at older places of that book. In MV and in OMV we often need fresh identifiers, but in practice this is taken with a grain of salt. Since the number of short identifiers is rather small, we are inclined to use some of them repeatedly, in different circumstances, with different meanings. We shall not pay attention to this matter and act as if there were an unrestricted amount of easily recognizable symbols.

N.G. de Bruijn

884

5.4. In an MV book there are various kinds of identifiers. First there are the pMV symbols that occur in the definition of MV, like

USUbStantiVe7,, LIStatement)!,

U:,l,

.. ,

U..!,

.- .

U.-ll

Another class of identifiers is the class of variables (the word “variable” is smMV, the variables in the book will be sMV). A variable is an identifier that occurs for the first time in an MV book in a declarational context item (see Section 6.3). Other identifiers are bound variables (also called dummies), for which we refer to Section 20. Finally we have identifiers that are called constants. They are the identifiers whose first occurrence in an MV-book is on the left of a symbol ‘?=”. The interpretation is that a constant is the name given to a defined object like “2”, “e” ( e is the basis of natural logarithms). 5.5. Related to the constants are the parametrized constants, which are not identifiers in the proper sense. A parametrized constant is a kind of finite sequence of symbols in which there occur variables at various places. The notion is relative with respect to a context. A context has a number of variables, i.e., the variables introduced in the declarational items of that context. These variables will be referred to as the “variables of the context”. It is essential that each one of the context variables occurs at least once in the parametrized constant. The constants of Section 5.4 can be considered as parametrized constants for the case that there are no declarational items in the context. If z and y are the variables of the context, then the following things may be parametrized constants:

“f(2, y)”,

“z

+ y”,

“the distance from z to y”.

A parametrized constant is called fresh (smMV) somewhere in the book if it has not appeared at older places in that book, not even with different variables. Parametrized constants can be used later in the book by repeating them, with the variables replaced by other expressions. We do not say here what kind of expression we have in mind, but just mention as examples

+

+ +

“f(a b, 3)”, ‘‘(a 6 ) 4”, “the distance from P to the center of c”.

In smMV such modified repetitions will be called modified parametrized constants. Clearly, these modified constants will generate new parsing problems, but again we lightheartedly neglect these.


885

The condition that in a parametrized constant all variables of the context occur, is usually taken with a grain of salt. We return to this in Section 21.6. 5.6. Many of the parametrized constants in our examples will have the form b(z1,...,x n ) , where X I , ...,zn are all the variables of the context, in the order in which they are introduced in the declarational context items. In these cases we often take the liberty to write just b instead of b(z1,...,z), on the left-hand side of the definitional line (and sometimes at other places where it is obvious what the abbreviation b stands for).

6. STRUCTURE OF CONTEXT ITEMS

6.1. A context item is a pair, consisting of a clause and a label. For a first orientation on what a clause is, we refer t o Section 3.7. The label is either “(asrn)” or “(dcl)”. See Section 6.4 for the reason why these labels are used. The phrases ‘‘context item”, “clause” and “label” are smMV; both “(asm)” and “(dcl)” are pMV. 6.2. An assumptional context item has the form “ P (asm)”. As a first orientation we say that this P is a clause, but that not every clause will be admitted: “P (asrn)” will only be allowed in cases where the high typing “P :: statement” can be established in the book, at least in the context formed by the sequence of context items preceding this item “ P (asrn)”. For details we refer to Section 9.

6.3. Declarational context items have one of the following forms: x : P (dcl) x :: substantive (dcl) z :: statement (dcl) where x is a fresh identifier and P is some expression. As said in Section 5.4, z is called the variable of the context item. Not every P will be admitted here, but only those P for which the high typing “ P :: substantive” can be established

in the book, in the context formed by the sequence of context items preceding this item “x : P (decl)”. For details we refer to Section 9. 6.4. It is essential that context items are explicitly labeled as being either declarational or assumptional. In the flagstaff form this can be done by using pointed flags for declarations and rectangular flags for assumptions (see Section 18). The reason for the use of labels that distinguish between the two kinds of

N.G. de Bruijn

886

items, is the fact that the form of the context item does not always reveal to which one of the two categories it belongs. The following example of a context of length 2 in OMV shows what we mean: “Let p be a quadrilateral, assume that p is a rectangle” (of course no one would say this in one breath, but quite often the various items of a single context are pages apart). The labels “let be” and “assume that” are no luxury, for if we would say “ p is a quadrilateral, p is a rectangle” then it would not have been made clear that in the first item p is introduced and that in the second item p is a thing we already know about.

7. STRUCTURE OF LINE BODIES

7.1. There are four kinds of line bodies: (i)

definitional line bodies

(Sections 7.2 and 7.6)

(ii) primitive line bodies


(iii) assertional line bodies


(iv) axiomatic line bodies


(all these terms are smMV). 7.2. The interpretation in OMV of lines of the type (i) is that they represent definitions. That word has to be taken in a wide sense, and contains much more than what a text in OMV would label as “Definition”. Whenever we select a new symbol to represent a longer expression, usually for the sake of brevity, we essentially have a definition. We consider three kinds of definitions, according to the syntactic category of the things to be defined. There are “name definitions”, where a new name is introduced for an “object”. Next there are k b s t a n t i v e definitions”, where a new substantive is introduced, and finally “statement definitions”, where a new phrase is coined to represent a statement. As examples of the three kinds of definitions we quote

“the orthocenter of triangle t is ...”, “A rhombus is ...”, “We say that the sequence s converges t o the real number c if

...”.

In MV these three categories will be represented by (7.6.1), (7.6.2), (7.6.3), respectively. For further examples and comments see Sections 7.7-7.9. Many definitions in OMV have the form of the introduction of a new adjective. We shall not put these into MV since they can be circumvented (cf. Sections 3.5 and 22.14).


887

7.3. The interpretation (in OMV) of lines with bodies of the type (ii) is that they introduce primitive notions. Such lines are rare in mathematics, and have the same status as axioms. Together with the axioms they may form the basis of a theory. As an example we quote from Hilbert’s axioms for plane geometry, which state “there are things we call points and things we call lines”, where the words “point” and “line” are introduced as new substantives but, in contrast to the substantive definitions of Section 7.6, without explanation in terms of known things. In MV the introductions of these primitives get the form (7.10.2). An example of a primitive of the form (7.10.3) is that, after points and lines have been mentioned, the notion “point A lies on line q” is introduced without explanation. Finally we give an example of what is expressed in (7.10.1). One of Peano’s axioms is: “there is a special natural number which we shall denote by the symbol 1”. Here the new object is introduced without definition. Instead of defining it we just say of what kind it is. 7.4. The interpretation of lines with bodies of the type (iii) is that assertions are made that follow from previous material. Some of these are called “theorems”, others L‘lemmas’l,but most of them (in particular the assertions inside proofs) do not get such a stately name. And it is certainly not common practice to apply words like “theorem”, “lemma” to cases with high typings like “ A :: substantive”, “P :: statement”, which are likewise admitted here (see Section 7.11). When saying that theorems and lemmas follow from previous material, we have to interpret the habit in OMV to print a proof after the announcement of the theorem instead of before. If we wish to have a similar announcement in MV, we might give a name to the thing stated in the theorem, claiming that it is a statement P , like in (3.7.2). The proof will end with the assertional line body P (see (3.7.1)). The interpretation of the first line in OMV is “ P is a well-formed proposition”, and of the last one ‘‘P is true”.

7.5. Lines with a body of the type (iv) are to be interpreted as axioms. They can be applied in the same way as theorems, but in the case of axioms we do not require that their content follows from previous material.

7.6. In MV, a definitional line body has one of the forms P : = Q : R P := Q :: substantive P := Q :: statement

(7.6.1) (7.6.2) (7.6.3)

where P stands for a parametrized constant. Note that “substantive” and

N.G. de Bruijn

888

‘‘statement” are pMV, as well as the symbols “:=”, Y’, “::”, but that Q is definitely not the pMV symbol “PN”.

7.7. We remark that it will be a consequence of our later rules that (7.6.1) appears only in situations where “R :: substantive” is valid. The interpretation of (7.6.1) is that the definition provides a new (possibly short) name P for an object of which the full description is Q. Example (in OMV): “Let S(n) denote the real number exp(1) ... +exp(n)”. In this example S ( n ) plays the role of P , “exp(1) ... exp(n)” the role of &, and ‘‘real number” the role of R. In MV we write it as “ S ( n ):= ... : real number” (we do not attempt right now to write exp( 1) ... exp(n) in official MV).

+ +

+

+ +

7.8. The interpretation of (7.6.2) is that it provides a (usually short) expression P for a (usually longer) description Q that represents a substantive. Example: the role of Q can be played by the substantive “positive integer with exactly two divisors” and the role of P by the new substantive “prime number”. 7.9. The interpretation of (7.6.3) is that the definition provides a new (usually short) expression for a (usually longer) statement. Example: “We say that p is orthogonal to q if the inner product of p and q is zero”. Here “ p is orthogonal to q” plays the role of P , and ‘the inner product of p and q is zero” plays the role of Q. 7.10. In MV a primitive line body has one of the forms

P := PN : R P := PN :: substantive P := PN :: statement

(7.10.1) (7.10.2) (7.10.3)

We note that “:=”, “PN”, “:”, “::”, “substantive” and “statement” are all pMV (“PN” has been chosen at mnemonic for the OMV-term “primitive notion”). P stands for a parametrized constant. In the case of (7.10-1) it will be required that “R :: substantive” is valid in the context in which (7.10.1) is written.

7.11. An assertional line body in MV is nothing but a single clause (cf. Section 3.7).

7.12. An axiomatic line body has the form c [Axiom]

(7.12.1)

where c is a clause, and the symbol “[Axiom]” is a pMV term. By virtue of language rules still to be formulated, there are two differences between axiomatic and assertional line bodies. In the first place, the assertional line body


889

has to “follow” from the previous part of the book, and secondly, in the axiomatic case the clause c has to be restricted to cases for which the high typing “c :: statement” can be established in the book. The latter is similar t o the restriction made on assumptional context items (Section 6.2).

7.13. We introduce the notion clause of a lane body (smMV). In the cases of Sections 7.10-7.12 the body has just one clause. In a n assertional line body that clause is the line body itself. In lines with axiomatic line body “c [Axiom]” the clause of the line is just that c. In lines with bodies (7.10.1), (7.10.2), (7.10.3) the clause of the body is ‘‘P : R”, “P :: substantive”, “P :: statement”, respectively. A definitional line body has two clauses. The old clauses of the lines of Section 7.6 are “Q : R”, “Q :: substantive” and “Q :: statement”, respectively. The new clauses of these lines are “ P : Q”, “P :: substantive” and “ P :: statement”, respectively.

8. GENERAL REMARKS ON RULES OF MV 8.1. In Section 4, 6 and 7 we have explained the structure of books, contexts and lines. The question is now: what contexts and what lines are allowed? It will not be trivial to state a complete set of rules for this. A part of these rules will be felt as rules for language manipulation; these rules will be explained in Sections 9 and 10. Another part (Sections 12-17) will be more like a piece of the foundation of mathematics. However, the rules of MV will not contain all of what is usually called the foundation of mathematics. Once we have reached a certain level, the language is strong enough to allow us to write the rest of the foundation of mathematics in an MV book. It is attractive to put as little as possible in the language definition and as much as possible in the books, but we shall not aim at extremes in this respect. The state of affairs can be compared to the way a ship is built. The ship is constructed ashore only until the stage that it is just able to float. Then it is launched, and after that, the construction goes on. The reason for this is, of course, that a ship cannot be launched if it is too heavy. In the case of MV the reason is different. The MV ship can be used by many different customers in different ways. After MV is launched, every customer can finish the construction according to his own wishes. After the launching of a ship, two things happen: (i) the construction is completed, and (ii) the ship will be sailing the seas. Here our analogy is less satisfactory. The action of the ship’s construction in the water near the shipyard is very different from the action of sailing the seas. In the case of MV these

890

N.G. de Bruijn

two actions are alike. To (i) there corresponds the writing of the fundamental portions of the book, and what corresponds to (ii) is writing a (possibly long) book or set of books based on that fundamental chapter. But all the time the action consists of writing books and nothing else. 8.2. As said before, our MV will be modelled after OMV, i.e. the way mathematicians write and speak today, but we cannot just copy OMV. There is no consensus in OMV about how things should be said. We are not in a position to derive all rules of MV by observation of OMV. We have to invent new rules, and that may mean making arbitrary choices. We have to give definitive shape to things which are not properly revealed in OMV. In particular this refers to the fact that this paper tries to interpret OMV as a typed language. One might argue that such an interpretation is not really called for, and that it is about as arbitrary as interpreting OMV as a non-typed language. The most-favored method of coping with life without types is to maintain that “everything is a set”. One might try to arrange a typed language in such a way that this set-loving point of view can be obtained by just creating a single type, viz. the type “set”. Yet we have not taken the trouble to keep this possibility open in our presentation of MV. Conversely, one might try to code typed material in terms of a non-typed language, but this seems t o be very unattractive.

8.3. We first say something about the notion of validity (smMV). The word valid (smMV) means: having been built according to the grammar of MV (and that grammar has still to be disclosed). The rules of that grammar will be production rules, in the sense that they all describe ways to extend a valid book by adding a new line. In the course of the description of how the new line is t o be built, we have certain resting-points where certain phrases are discussed as being acceptable ingredients of the line t o be added. Important resting points are clauses (see Section 3.7 and Section 7.13). In a given context there is a set of such clauses which are called valid clauses. The production rules explain how our knowledge about that set can be extended, describing how by means of a number of elements of that set a new one can be constructed. 8.4. Validity is expressed with respect to a book.

As already said in Section 4, a book is a partially ordered set of lines. For any given line we can consider the set of all lines which are older than the given line; this is again a partially ordered set of lines and therefore a book. We shall refer to the given line as “the new line” and to that book as “the set of old lines”. Whether a new line will be called valid, depends on the set of old lines, and not on what happens in other lines. The same remark applies to parts of


89 1

new lines, like clauses and contexts. Only for the identifiers, and more generally for the parametrized constants we have a condition that goes beyond the set of old lines: we have to stipulate that they are all different throughout the whole book. We usually think of a book as having been written line by line, where older lines precede newer lines in time. If this is the case, then the condition for the parametrized constants is that at each moment the parametrized constant introduced in a line (on the left of a sign :=) is different from all the parametrized constants used before. We still have to say how the context for the new line has to be built, and what clauses are valid in that context. This will be said in Sections 9 and 10. 8.5. From Section 9 onwards we shall give a formal definition of the notion of an MV book in flagless form. Except for the syntactic matters referred to in Section 8.6, we shall not make use of what was said in the preceding sections. Those sections were intended to give interpretations, and t o help the reader to get an insight into the complex set of definitions we shall display in the next sections. First a few things about the terminology. The smMV-terms “MV book” and “valid book” are synonymous. We shall not define notions “context” and “clause” as such, but we shall define “valid context with respect to a set of lines”, “valid clause with respect to a valid context and a set of lines” (in both cases that set is referred to as the set of “old lines”, and in the second caSe it will be required that the valid context is a valid context with respect to that same set of old lines), “valid book”, “line”, “body of a line”, “clause of the body of a line”, “context of a line”. The pMV symbols to be used are

.,

u.13

..

it..”,

“:=”, “substantive”, “statement”, “PN”, “[Axiom]”

and “(dcl)”, “(asm)”, %”. (The symbols of the second row do not appear in the flagstaff form: their role is taken over by the pointed and rectangular flags and flagstaffs.) A few general things can be said here about the format of things. A book is a finite (possibly empty) partially ordered set of lines. A line is a pair consisting of a (valid) context and a line body. A (valid) context is a finite (possibly empty) sequence of context items. 8.6. We mention some things that should have been formally discussed in the next sections, but are nevertheless treated very superficially. They are of a syntactical nature. We mention:

N.G. de Bruijn

892 (i)

substitution,

(ii) variables of a context, (iii) fresh identities and fresh parametrized constants, (iv) parsing. We take it that Section 5 (and 23) are sufficiently clear as an indication of how these notions are to be formalized. A complete formalized treatment of them would not quite fit into the general style of this paper.

9. VALID CONTEXTS AND VALID CLAUSES

9.1. Everything that has been said thus far is to be considered as introduction, providing an orientation about what we are going to describe. It also served to build up a feeling for the interpretation. From now on, however, we shall attempt a more complete and more formal description. Many things that have been referred to earlier in vague terms, will now get a more serious treatment. The rules are about books, lines and validity. They will get their content by means of rules BR1-BR9 (BR stands for “basic rule”). We need not say beforehand what these notions mean. These rules BR1 to BR9 are hardly of a logical or a mathematical nature. Or, rather, they describe how to handle logic and mathematics. In order to get to logic and mathematics themselves we have to add a number of rules in Sections 12-17 that describe more ways to produce valid clauses. As to the production of valid contexts and books no rules will be issued beyond these BR1-BR9. 9.2. The symbols c, C, 11, I,, P, A, x, 21, xk, X I , xk that are used in this section for explaining language rules are meta-variables. They are used in smMV in order to denote expressions occurring in an MV book. In the rules BR1-BR7 there is a set S of lines (“the set of old lines”), and “valid” stands for “valid with respect to S”.

9.3. BR1. If an old line has context C, and if c is a clause of the body of that line, then C is a valid context, and c is a valid clause in that context. 9.4. BR2. The empty context is valid. 9.5.

BR3. If 11,...,I, is a valid context (if n = 0 we mean the empty con-

text), and if


893

P :: statement is a valid clause in that context, then 11,...,I,, I,+l is a valid context, where stands for “P(asm)”. (As already explained in Section 6.3, the additional “(asm)” serves to label it as an assumptional context item; it is not superfluous since P may have the form of a typing.) In+l

9.6. BR4. If 1 1 , ..., I, is a valid context (if n = 0 it is the empty context), and if 2 is a fresh identifier, then the following contexts of length n 1

+

11, 11,

...,I,,z ...,I,, z

::

substantive (dcl) (dcl)

:: statement

are valid contexts. If, moreover,

A :: substantive is a valid clause in the context 11,

...,I,,z

:

A

11,

...,I,, then

(dcl)

is a valid context.

9.7. BR5. If 11,...,I,, is a valid context, and if one of these n items is 2 : A (dcl), then 2 : A is a valid clause in that context. Similarly, if one of the n items is 5 :: statement (dcl), then z :: statement is a valid clause in the context. If one of the items is P(asm), then P is a valid clause in the context. 9.8. BR6. Let C and CO be valid contexts, let 21,...,~k be the variables of the context CO (this notion was explained informally in Section 5.5), and let c be a valid clause in the context Co. Let X I , ...,xk be expressions with the property that if we replace 21,...,xkby X I , ...,xk,then all context items of CO, with the labels “(dcl)” and “(asm)” deleted, become clauses which are valid in the context C. Then the clause we get if we replace 2’s by X ’ s in c becomes a clause that is valid in the context C.

9.9. BR7. If 11, ...,I, is a valid context, and if k < n, then I1 ,...,I k is a valid context. If c is a valid clause in the latter context, then c is a valid clause in the context 11, ...,I,.

N.G. de Bruijn

894

10. VALID BOOKS 10.1. The notion of a valid book is obtained by saying that the empty book is valid and by explaining how a valid book can be extended.

10.2. BR8. The empty book is valid.

10.3. BR9. Consider a valid book, and take any set of lines as set of old lines. Let C be a valid context with respect to this set. The following list indicates what line bodies can be used to form, together with the context C, a line that produces a valid book again if it is added to the book, making the new line younger than all the old lines. The line bodies are on the right. In the cases (iii), (iv), (v), (vi), (vii), (viii) we require, as an extra condition, that the clause on the left is valid in the context C with respect to the set of old lines. P := P N :: statement P := P N :: substantive (iii)

Q

:: statement

(iv)

Q

::

(v)

c :: statement

substantive

(4

I ~

P := Q :: statement P := Q :: substantive c [Axiom] C

C

(vii)

R

(viii)

Q :R

:: substantive

P

:=

PN : R

P : = Q : R

In all cases P stands for some fresh parametrized constant, containing the variables of the context and no others. As the “clause of the line body” we take, in the cases (i) to (vii), respectively, (i)

P :: statement

(ii)

P :: substantive

(iii)

both P :: statement and Q :: statement

(iv)

both P :: substantive and Q :: substantive

(v)

c

(vi)

c

(vii)

P

(viii)

both P : R a n d Q : R.

:

R


895

10.4. We have a comment on case (ii) of BR9. Some people may say it is not customary to use, or to admit the use of, lines like this in any arbitrary context. They might like to admit them in the empty context only. Essentially this comes down to starting a mathematics book with the creation of a number of types, and then off we go. This restricted use of case (ii) has the advantage that it becomes much easier to describe the collection of all types that can occur in a book. Nevertheless we keep this rule (ii) as it stands, i.e. we allow it in any context. We leave it to the user of the language to make or not to make the more restricted use of the rule. It is as with roads: one can build a road that technically admits speeds of 200 mph, the legal authorities may prescribe a speed limit of 100, and the individual user may restrict himself to a maximum of 60. We note that if a substantive is introduced as primitive by means of a line of the type (ii), then this substantive is an archetype (see Section 12.1). And if the line has a context like the line z : A(dc1)

*

P ( z ) := P N :: substantive,

then the only way to make special instances P ( u ) and P ( v ) comparable, is to require 2~ = 21.

11. COMMON STRUCTURE OF FURTHER RULES 11.1. All further rules are about the validity of clauses, where “validity” is taken with respect to a set of old lines and with respect to a context (which in its turn is assumed to be valid with respect to that set of old lines). In the simplest case such a rule will be of the form

........................................................................ (11.1) Q .............................................................................

P

and will express the following: if P is a valid clause, then Q is a valid clause too. A variation on the scheme (11.1) is

.......................................................................... Pl p2

Qi

Q2 Q3

.............................................................................

N.G. de Bruijn

896

which means to express the rule that if PI and P2 are both valid, then Q1, Q2, and Q3 are valid.

11.2. Some of the rules will be slightly more intricate in the sense that they deal with context extension. This can happen in entries on either side. We take a case where it happens on the left only:

......................................................................... Pl

*

J

Pz

Q

p3

......................................................................... (the * is an smMV symbol here). The meaning of this is as follows. We are dealing with a set of old lines (which is not going to be changed in this rule), and a context C. Assume that PI is a valid clause in the context C, that P2 is a valid clause in the extended context C, J (if C = I1, ....I,, then C, J represents the context I1, ....I,, J ) , and finally that P3 is a valid clause in the context C. Then Q is a valid clause in the context C. The validity of J as a context item will not be open to doubt in the cases we present. This validity will always follow from the assumptions. In rule T6 there is a case where the role of J will be taken over by two context items (separated by a comma) instead of a single one. As remarked in Section 11.1,a rule like the one above is intended to hold in any context. If I is such a context, this means that the rule also includes the following one:

........................................................................ I * PI I,J * 9 I

*

I * &

P3

............................................................................. 11.3. In all our rules, the phrases that were represented above by P , P I , P2, P3, Q, Q1, Q2, 9 3 , J will be expressions in terms of one or more meta-variables. Actually all symbols that have not been introduced explicitly as pMV, are to be considered as meta-variables in this kind of rules. For example, in rule T8' the letters A and B are meta-variables. In applications of that rule, they may be replaced by any pair of expressions.

11.4. Except for rule EQ11, all rules to be presented in the next sections have the form sketched in Sub-sections 11.1 and 11.2.


897

11.5. We sometimes use the term derived rule (smMV). Derived rules are rules whose validity follows from earlier rules. In other words, what such a rule proclaims to be valid, can be shown to be valid already because of the other rules. We shall use a rule number with asterisk if we claim that the rule is a derived rule. The remaining rules are called fundamental rules, although we do not claim our set of fundamental rules to be minimal. In some cases one might be able to write such derived rules as theorems in an MV book, and then it is a matter of taste whether we present them as language rules or as theorems. There are derived rules whose derivation requires induction over the length of the book. As an example we take the observation that a : A can appear in the book only when A :: substantive. Another example is the observation that if A and B are substantives, and ( A = ) B :: statement, then there is a substantive C such that both A xist(A) := PN :: statement exist(A)

[ Axiom ]

exist(A)] :: statement

not (Vz:Ano)

not(tl,,Ano)I not exist A

913

N.G. de Bruijn

I

exist(A) no Vx:Ano no 2t (not(exist(A))) tist(A) st(A) = not(V,,A no) re is exactly one A := exist(S,,AVb,A (b = a ) ) :: statement iere is exactly one A I ie A := P N : A b =the A

A) Z}A :=fx:A

(x = a ) : A-set

X:>

e= {a}A

{ a , b}A :=fz:A (x = a or x = b) : A-set a E {a,

~IA

Ea,

b E {a,b)A

b ) and ~ not (c = a )

I

A :: substantive B :: substantive

IA

union(A, B , f ) :=fb:B 3,:Ab E

Vd(f, U )

: B-Set

:: substantive>

D

A) P :: statement> selected(A, a, b, P ) := S Z : ~ ( (= ( za ) and P ) or ((x = b) and not P ) ) :: substantive there is exactly one selected(A, a,b, P ) selection(A, a, b, P ) := the selected(A, a , b, P ) : A if P then (selection(A, a , b, P ) = a ) if not(P) then (selection(A, a, b, P ) = b)


915

natural number := PN :: substantive nat := natural number :: substantive N := nat T: nat -set 1 : = PN : n a t

suc(n) := successor of n : nat not(suc(n) = 1) [ Axiom ]

propagate(S) := V n : ~ ( ( nE S) -+ (suc(n) E S)) :: statement if start(S) and propagate(S) then S = N [ Axiom ]

m divides n := 3k:nat ( k m = n) divisor of n := Sk:nat ( k divides n) :: substantive (divisor of n) 5) that sends any natural number z into the statement z > 5. suggest ArInat(z It seems attractive, but we have not incorporated this into MV. It would not not quite fit into our system to attach a type to such a thing, and therefore it would not help us to create arbitrary predicates. 20.8.


925

The set-forming rules of Section 14 help us out. Instead of discussing a predicate in MV, we discuss the set of all objects satisfying that predicate. So instead of that A z : n a t ( ~ > 5) we talk about the set fz:A P ( z ) (cf. (20.7.2). And instead of taking arbitrary predicates we take an arbitrary A-set, as in formula (88) of Section 18.2.

20.9. MV does not allow the introduction of new quantifiers in the book. The reason is that the language is not equipped with means for saying ”an expression containing I”. Have only two basic quantifiers in the language definition, viz. the substantive binder S and the functional binder A. All other binders have to be expressed in terms of these two in the way indicated in Section 20.6. If we insist on using notations like (20.6.2), (20.7.1), (20.7.2), we have to treat them as typographical abbreviations, to be discussed in Section 21.

21. TYPOGRAPHICAL ABBREVIATIONS 21.1. Of course we like to use OMV notations in MV as much as possible. We can do this in an informal way by using what we shall call typographical abbreviations. We can agree that if we write (20.6.2) in an MV book, this is just an informal abbreviation for (20.6.3). The agreement to use that abbreviation cannot be made in the book itself, but has to be written in the margin somehow. A similar remark applies to (20.7.1) and (20.7.2). 21.2. As a further example we take the “despo” of Section 20.5. If A and B are substantives, and if P( ...I...)is an expression containing I such that for all z : A we have P( ...I...): B , then despoz:A P( ...z...) can be considered as typographical abbreviation of

21.3. The words “typographical abbreviations” indicate unofficial abbreviations, usually (but not always) invented for the sake of typography. When reading a text that uses such abbreviations we first have to translate them into what they stand for, and only after that translation we are assumed to be able t o understand the text as an M V book. Typographical abbreviations are superficial, when compared to the abbreviations we introduce in the MV book itself by means of definitional lines (see

N.G. de Bruijn

926

Section 7.6). Definition and theory of the language have t o take these definitional lines as essential parts of the language, but never deal with typographical abbreviations. As an example of a typographical abbreviation outside the world of quantifiers we quote the notation { 1,.. . , n } for the set of integers from 1 to n. We refer to the discussion in Section 19.5.

21.4. When studying mathematical notation, we discover many other cases of abbreviations that we would prefer t o consider as informal. Some examples are: (i)

We write a = b

< c = d instead of the conjunction of a = b, b < c, c = d.

(ii) We write a(l),a(2), . . . to denote an infinite sequence. (iii) We have baroque notations for 17-th and 18-th century mathematics, on integrals, derivatives, differential equations, etc. (iv) We have many unwritten conventions by which we omit things that, strictly speaking, would be necessary for parsing. These may be local conventions in a certain area of mathematics. In trigonometry one interprets sin z cos y as the product (sin z)(cos y); the alternative sin (z cos y) occurs in the theory of Bessel functions but not in trigonometry.

21.5. Many formulas in OMV are written in a form that do not fit into a single line. A simple example is the old notation for quotients by means of a horizontal bar. If we think of MV having to be processed by a computer it seems that such notations have to be avoided, but it is not a matter of principle. Formats which do not have the form of a string of characters might be admitted in MV just as well. As a simple example we note that sometimes the value that a function takes at the point n is denoted by using the letter n as a subscript, like in c,. This should not be confused with the habit of using cl, c2, . . . as new identifiers. The difference between the two is of the same type as the difference between the two ways to look at al, . . . ,a,, discussed in Section 19.5. 21.6. There will be many cases where one is easily tempted to interpret the rigid rules of MV with a little grain of salt. At least, as long as the texts are intended to be read by human beings only. If we present them to machines, we have to be much more careful. It was already mentioned in Section 5.3 that we often cheat with the rules that require identifiers to be fresh. But it is not necessary to be so rigid in


927

cases of variables introduced by means of declarations. It suffices to have them different from all previous variables of that same context and different from all previously introduced constants (either by definition or by PN). But the rule that all introduced constants should have different identifiers, will often be felt as a burden: in mathematics constants occurring in distinct subjects will often have the same name. When writing for human readers, there does not seem to be any harm. When writing for machines, we should do something like the paragraph system that was used in Automath, where identifiers are always interpreted in the sense given to them in the local paragraph. An old constant with the same name can only be referred to if we add some kind of paragraph indication. Another case for grains of salt was already mentioned in Section 5.5. The condition that all context variables occur in the name of a defined notion is quite different from habits in OMV. In Automath there is a systematic way to weaken this rule: in parentheses expressions like F ( A 1 , .. . , A n ) we may just omit the first k entries A 1 , . . . , Ak if t.hey are identical to the first k variables of the context. In particular that has the effect that in a definitional line in a context with variables 21,.. . ,zn the parametrized constant on the left of sign ":=" can be written as a single identifier (cf. Section 5 . 6 ) . But it should be noticed that in MV and in OMV not all parametrized constants have the form of such parentheses expressions. That makes it harder to formulate what liberties can be taken in the matter of omission of a number of context variables.

22. GETTING CLOSER TO NATURAL LANGUAGE 22.1. In the examples of Section 18.2 we inserted a small piece of what one might call natural language. On a small scale it showed how mathematics can be described in words and sentences, not just in symbols and formulas. If we want to insert more natural language, or even if we want our MV book to look like an ordinary mathematics book, we can do this on three levels:

(i)

the primary MV level (pMV),

(ii) the secondary MV level (sMV), (iii) the level of typographical abbreviations. 22.2. As to primary MV we can discuss how some of the basic notations on typing, on context and on quantification are to be expressed in terms of words. In several cases it is not quite clear how to do this: there may arise ambiguities,

N.G. de Bruijn

928

in particular just those which the MV notations intended to avoid. Right now we do not try to suggest how to solve all these difficulties. We hardly go beyond a first orientation. 22.3. The typing “p:prime number” can of course be pronounced “ p is a prime number”. A definitional line body “ p := Q : prime number” can be pronounced as “denote the prime number Q by p” (in this case Q is an expression and p is an identifier). The declaration ‘$:prime number” (the case of a pointed flag) is “let p be a prime”. The assumption “p:prime number” can be “assume that p is a prime number” (the case of a rectangular flag). The case of “assume...” is essentially different from “let...”: in the case of “let ...” the p is a new variable, in the case of “assume...” it is a variable or a constant that was introduced earlier in the book (cf. the assumption (89) in Section 18.2). Unfortunately there is not a very strong feeling in english OMV that “let ...” is to be restricted t o the case of declaration. One might consider to replace the “let ...” by something that cannot be misinterpreted, like “take any prime number p”. In OMV there is no clear way to tell where the flagstaffs end. Quite often it is suggested by the typographical layout, mainly by the subdivision of the text into sentences, paragraphs, sub-sections, sections and chapters. There is certainly a need for explicit rules for this. Right now there are just some unwritten conventions. One might express a rule like this: If an assumption is a part of a sentence, then it does not reach beyond that sentence. If it is the first sentence of a paragraph, and not a paragraph of its own, then it does not reach beyond its paragraph. Similarly, if a sequence of assumptions form the first sentence of a paragraph, and not a whole paragraph, then these assumptions are intended just for this paragraph. The rules for declarations are the same as those for assumptions. As an example we quote

(22.3.1)

If x is a real number then sin x

u

3,€n P(w,t , P,

.

If the set of all P+ with P E Pred(A) is denoted by Pred+(A), we have Predf(A)

c Pred*(A) c Pred(A) .

In determinietic cases there is no difference between P* and P+. To be more precise, if w , t are such that there is at most one pair w’,t’ with t‘ < co and P(w,t , ~ ‘t’), , then P+(w,t , w ’ , t’) = P*(w,t , ~ ’t’), for all w’, t‘. In general, if P describes the semantics of a program in the original version (where P ( w ,t , w’, co) means that the program can actually run for ever), then P+ is the liberal semantics (where P+(w,t ,w‘, co) means that there is no upper bound to the runtime). If we take the liberal semantics, then our prospects for proving the fixed point property for recursion become much more promising. The difference between P* and P+, and its being related to having nondeterminism and infinite state space, can be connected to Konig’s well known infinity lemma. In order to make the notation sufficiently clear for further discussion, we explain it in a few words. Let ( S , r , f ) be a rooted tree. That is, S is a set (the set of “points”), r is a special element of S (called the “root”) and f is a mapping of S\{r} into S (f(z)is called the “father” of x). It is assumed that for every z (z # r ) there is an integer n such that the n-th iterate f ” maps z into r . This n is uniquely determined, and is called the “level” of z. The level of r is zero. If z E S , the set of all y E S\{r} with f ( y ) = z is called the “offspring” of z, and denoted

Ob). If 3: E S we denote by IP(x) the proposition that there is an infinite path = zn starting from z, that is a sequence 20,z1, 2 2 , ... with zo = z and f(zCn+l) for n = 0 , 1 , 2 , ... . And by UL(x) (UL abbreviates “unbounded level”) we denote

N.G. de Bruijn

968

the proposition that for every natural number m there is a path 20,. . . l zm, again with zo = z, f(z,+l) = zn for n = 0, ...,m - 1. We note that for all z IP(2) + UL(2)

.

Finally we formulate the “finite offspring condition”. It says that for every z E S the offspring O(z) is a finite set.

Konig’s lemma expresses: If the finite offspring condition holds, and UL(T) is true, then we have IP(T). Coming back to semantics, we shall try to explain that IP(T)can be compared with infinite runtime, and UP(T) with unpredictably long runtime, in both cases with initial value T. And the finite offspring condition corresponds to a condition that says that the number of possible outputs is finite, for every given input. This condition is certainly guaranteed if the state space is finite, but also if the program is deterministic. We describe a typical case of a tree where UL(T) holds but IP(T) does not. Let us call it ( S , T , ~ ) The . points of S are the pairs ( i , j ) with integers i, j satisfying either 0 < i 5 j or i = j = 0. The point (0,O) is taken as the root. For all other points we define the “father” by

fo(i,j) =

{

< i 5 j ) A (i #

(i - 1,j)

if (0

(090)

ifl=i<j.

1)

The tree is depicted in Figure 1. In that figure the arrows run from points to their fathers.

Figure 1 Coming back to the general tree ( S ,T, f ) , we describe programs for which S is the state space. As a primitive program we take the program “step”. Its semantics is described by Totinf(step) = (t’ = t ) A (w’ E O ( w ) ) .

Computer program semantics in space and time (F.5)

969

Note that “step” is a non-deterministic program, at least if there exist points w where O ( w ) has more than one element. If O(w) is empty (such an w is called an end-point), then there is no possible output w’ to the input w . If this is considered unacceptable, one might take any arbitrary value of w’ as output, like w’ = w . That means that in the definition of Totinf(step) we replace w’ E O ( w )

by w’ E O ( w ) V ( ( O ( W= ) 8) A (w’ = w ) )

.

But actually the case of empty O(w) is unimportant since the program “step” will not be used there. Let us now discuss the program (see the beginning of Section 7) while E do s t e p , where E corresponds to the predicate B given by = (O(w)#

0) .

In the notation of Formula (2) of Section 7 this program denotes RECURS(cp), where cp is given by c p ( ~ )= i f

E then (step; T ) else skip

.

The “intuitive”, or, if one prefers, “operational” semantics of this program is the following one. Let w (the input) be any point of the tree. If w’ is an end-point such that fk(w’)= w for some lc 2 0 then w’is a possible output (and t’ = t k). If IP(w) holds then there is a non-terminating execution. If IP(w) is false but UL(w) still holds then there exist unpredictably long executions. If UL(w) does not hold then all executions starting with w terminate, and there is an upper bound to their runtime. Let us now investigate Totinf(RECURS(w)) as defined by (4) in Section 6. As far as terminating executions are concerned, it produces the same results as the intuitive semantics. For values of w where IP(w) holds, it proclaims the possibility that t’ = 00, as it should. But in points where UL(w) holds but IP(w) does not, the semantics of Section 6 still says that t’ = 00 is possible, and the intuitive semantics says it is not. The difference between these two kinds of semantics vanishes (at least for this program) if we identify “Unpredictably long runtime’’ and “non-termination” . In the tree program described here, it is also easy to illustrate that $(RECURS(cp))and RECURS(cp) can have different semantics in the system of Section 6. We take the special tree (SO,TO, fo). We have U L ( T ~ )but , UL(z) is false for all z with f(z)= TO. From this it can be derived that at (TO, t , d ,00) (where w‘ irrelevant) RECURS(cp) is true but $(RECURS(cp))is not.

+

N.G. de Bruijn

970

Things look much better in the non liberal Pred' semantics. We briefly discuss the changes that have to be made. First, in Section 2 we have to introduce Predf(A) instead of Pred*(A). We have to give up the idea of a J such that always P * J = P+, like in Formula (2) of Section 2, and it is not generally true that ( P * Q)+ = P * Q+. (A counterexample: 0 = N ,

P ( ~ , t , w ' , t ' ) =( t ' = t ) , Q ( w , t , ~ ' , t ' )= ( ( w ' = ~ ) A ( t ' = t + w ) ) . In Section 3 we have to introduce Totinf+ as a mapping of Prog(R) into Pred+(A). The changes in Section 4 are trivial. In Section 5 the semantics of the concatenation has to be described by Totinf(r; 0)= (Totinf(a)

* Totinf(o))+ .

In Section 6 the semantics of RECURS(9) can be given by Totinf(RECURS(9)) = R+

,

although the definition of R in (4) will guarantee that there is no difference between R and R+ as soon as we have monotonicity. We note that if PO2 PI 2 P2 3 ... with P, = P$ for all n, and if P = V, P,, then P = P+. In Theorems 1 and 2 of Section 7 the new semantics makes no difference, since they deal with cases with bounded runtime. In the non-termination example at the end of Section 7 there is neither any difference, since the program is deterministic. From the tree program discussed earlier in this section it can be seen that $(RECURS((p)) and RECURS(9) need not have the same Pred*-semantics in nondeterministic cases with infinite state space. If we turn to Pred+-semantics, however, it seems that we only need monotonicity properties in order to show that Totinft ($( RECURS(9))) = Totinf+( RECURS((p)) , which means that RECURS(9) can be considered as the maximal fixed point.

10. A COMMENT ON ABORTION

We have not yet described the notion of abortion in our semantical system. Here we first discuss an attempt to treat abortion in a way that seems to be promising at first, and we shall explain why it is not satisfactory. The attempt is this one. If R is a program, and w , t are initial state and time such that there do not exist any w', t' (not even with t' = m) such that Totinf(w, t , w', t') holds, then we might try to interpret this as abortion. This means: with the initial w , t the execution of T will have been interrupted at

Computer program semantics in space and time (F.5)

971

some point. The semantical system does not disclose at exactly which point further execution is refused by the machine, simply because it never discusses executional details. This point of view seems to be very promising for Dijkstra’s guarded command statement i f El

+ a1

0

... 0 E,++.ak

fi

(1)

where each Ei corresponds t o a predicate B (like in our discussion of the “ i f then e l s e ” in Section 4). The semantics is: “select at random an i such that Bi(w)holds, and then execute ai;if there is no such i then abort”. If abortion is interpreted in the style “no possible w’, t’” we indicated above, then the total information of the progam (1) is given by (&(w) A

Pi(W,t,w’, t‘))V ... V ( B ~ ( wA )P k ( ~ , t , w ’t’)) , ,

(2)

where Pi = Totinf(ai) (i = 1,...,Ic). The simplicity of (2) seems to be a positive point both for Dijkstra’s semantics and for the “no possible w’, t’ ” interpretation of abortion. t‘” interpretation Unfortunately we have to admit that the “no possible w’, of abortion conflicts with the idea of nondeterministic programs. We show this with a concatenation “a ; u” where a is a nondeterministic program and u is a program that sometimes aborts. Let b and c be two different elements of 0, and let Totinf(a)(w, t,w’, t’) = ((w’ = b) V (w’ = c)) A ( t = t’) Totinf(u)(w, t , ~ t’) ‘ , = (w

# b) A (w = w’) A ( t = t’) .

So u leads to abortion with the initial state 6, but is harmless with all other initial states. By our semantic rule on concatenation we have Totinf(a ; u ) ( w ,t , d ,t’) = (w’ = c ) A (t’ = t )

(3)

so here there is no abortion for any w ,t. Therefore (3) does not describe the situation adequately, since we expect that the semantics of “a ; u” is: whatever w , t is, we have either abortion or (w’ = c) A (t’ = t ) . A more satisfactory way to incorporate abortion into a semantical system is by means of a special boolean variable. Let us call it ab (for “abortion”). At the start of a program we add the assignment ‘lab := f a l s e ” (interpretation: no abortion thus far), and every sub-program u of the program is replaced by “ i f Tab then u e l s e skip”. If in the final state we have ab = t r u e then we interpret this by saying that the program execution has been aborted. In addition to this the sub-programs may contain assignments ‘lab := t r u e ” in those cases where we actually want abortion to take place. We might want to

972

N.G. de Bruijn

do this in the guarded command statement. Another example is overflow: if we do not wish to handle numbers exceeding m, we might transform “y := l/p” into “ i f Il/pl 2 m then y := l / p e l s e ab := true”. Let us use the word “refuser” for such an extra boolean variable like ab. The essential thing for a refuser T is that subprograms 0 are to be remodelled into “ i f -rr then 0 e l s e skip”. Refusers can be used for semantic discussion of forward goto’s as well.

Bibliography


975

References

[A.1] de Bruijn, N.G., Verification of mathematical proofs b y a computer, A preparatory study for a project AUTOMATH (formerly unpublished, 1967). [A.2] de Bruijn, N.G., The mathematical language AUTOMATH, its usage and some of its extensions, in: Laudet, M., Lacombe, D. and Schuetzenberger, M., eds., Symposium on Automatic Demonstration, IRIA, Versailles, 1968 (Berlin, Springer Verlag, 1970), 2 9 4 1 . (Lecture Notes in Math., 125). [A.3] van Daalen, D.T., A description of Automath and some aspects of its language theory, in: Braffort, P., ed., Proceedings of the Symposium APLASM (Orsay, 1973), Vol. I. Also in [van Benthem Jutting 771, 48-77. [A.4] Zucker, J., Formalization of classical mathematics in Automath, in: Colloque International de Logique, Clermont-Ferrand, France, 1975 (Paris, CNRS, 1977), 135-145. (Colloques Internationaux du Centre National de la Recherche Scientifique, 249). [A.5] de Bruijn, N.G., A survey of the project AUTOMATH, in: Seldin, J.P. and Hindley, J.R., eds., To H.B. Curry: Essays on Combinatory Logic, Lambda Calculus and Formalism (New York/London, Academic Press, 1980), 579-606. [A.6] van Daalen, D.T., The language theory of Automath, Ph.D. thesis (Eindhoven University of Technology, 1980), Chapter 1, Sections 1 - 5 (Introduction). [A.7] de Bruijn, N.G., Reflections on Automath (Eindhoven University of Technology, 1990). [A.8] Nederpelt, R.P., Type systems - basic ideas and applications, in: van de Goor, A.J., ed., Proceedings of CSN '90, Computing Science in the Netherlands (Amsterdam, Stichting Mathematisch Centrum, 1990), 367383. [B.1] van Benthem Jutting, L.S., Description of A UT-68(Eindhoven University of Technology, 1981). (Memorandum 1981-12, Dept. of Math.).

976

References

[B.2] de Bruijn, N.G., AUT-SL, a single line version of AUTOMATH (Eindhoven University of Technology, 1971). (Notitie 71-22, Dept. of Math.). [B.3] de Bruijn, N.G., Some extensions of AUTOMATH: the AUT-4 family (Eindhoven University of Technology, 1974). (Internal Report, Dept. of Math.). [B.4] de Bruijn, N.G., A UT-QE without type inclusion (Eindhoven University of Technology, 1978). (Memorandum 1978-04, Dept. of Math.). [B.5] van Benthem Jutting, L.S., Checking Landau’s LiGrundlagen”in the A UTOMATH system, Ph.D. thesis (Eindhoven University of Technology, 1977), Appendix 9 (AUT-SYNT). [B.6] van Daalen, D.T., The language theory of Automath, Ph.D. thesis (Eindhoven University of Technology, 1980), Chapter VIII, 1 and 2 (AUT-II).

[B.7]de Bruijn, N.G., Generalizing Automath by means of a lambda-typed lambda calculus, in: Kueker, D.W., Lopez-Escobar, E.G.K. and Smith, C.H., eds., Mathematical Logic and Theoretical Computer Science, Proceedings of the Maryland 1984/85 Special Year in Mathematical Logic and Theoretical Computer Science (New York, Marcel Dekker, 1987), 71-92. (Lecture Notes in Pure and Appl. Math., 106).

[B.8] Balsters, H., Lambda calculus extended with segments, Ph.D. thesis (Eindhoven University of Technology, 1986), Chapter 1, Sections 1.1 and 1.2 (Introduction). [C.1] van Benthem Jutting, L.S., A normal form theorem in a A-calculus with types, in: Mitt. d. Gesellsch. f. Math. u. Datenverarb. 17, Tagung ub. form. Sprachen u. Programmiersprachen, Oberwolfach, Germany (1971), 27-32. [C.2] de Bruijn, N.G., Lambda calculus notation with nameless dummies, a tool

for automatic formula manipulation, with application to the Church-Rosser theorem, Indagationes Math. 34, 5 (1972), 381-392.

[C.3] Nederpelt, R.P., Strong normalisation in a typed lambda calculus with lambda structured types, Ph.D. thesis (Eindhoven University of Technology, 1973). [C.4] de Vrijer, R.C., Big trees in a A-calculus with A-expressions as types, in: Bohm, C., ed., A-Calculus and Computer Science Theory (Berlin, Springer Verlag, 1975), 252-271. (Lecture Notes in Comp. Sc., 37). Also: de Vrijer, R.C., Surjective pairing and strong normalization, Ph.D. thesis (University of Amsterdam, 1987), Chapter 5.

References

977

[C.5] van Daalen, D.T., The language theory of Automath, Ph.D. thesis (Eindhoven University of Technology, 1980), Parts of Chapters 11, IV, V - VIII.

[C.6] van Benthem Jutting, L.S., The language theory of A,, a typed lambda calculus where terms are types (Eindhoven University of Technology, 1985). (Memorandum 1985-02, Dept. of Math. and Comp. Sc.). [ D . l ] de Bruijn, N.G., Example of a text written in Automath (formerly unpublished, 1968).

[0.2] van Benthem Jutting, L.S., Checking Landau’s “Grundlagen” in the A UTOMATH system, Ph.D. thesis (Eindhoven University of Technology, 1977), Parts of Chapters 0, 1 and 2 (Introduction, Preparation, Translation). [ 0 . 3 ] van Benthem Jutting, L.S., Checking Landau’s iiGrundlagenJJin the

A UTOMATH system, Ph.D. thesis (Eindhoven University of Technology, 1977), Chapter 4 (Conclusions).

ID.41 van Benthem Jutting, L.S. and de Vrijer, R.C., A text fragment from Zucker’s ”Real Analysis” (1994). [ 0 . 5 ] van Benthem Jutting, L.S., Checking LandauJs “Grundlagen” in the A UTOMATH system, Ph.D. thesis (Eindhoven University of Technology, 1977), Appendices 3 and 4 (The PN-lines from the preliminaries; Excerpt for “Satz 27”).

[E.1] Zandleven, I., A verifying program for Automath, in: Braffort, P., ed., Proceedings of the Symposium APLASM (Orsay, 1973), Vol. I.

[E.2]van Benthem Jutting, L.S., Checking Landau’s “Grundlagen” in the AUTOMATH system, Ph.D. thesis (Eindhoven University of Technology, 1977), Parts of Chapter 3 (Verification).

[E.3] van Benthem Jutting, L.S., An implementation of substitution in a Xcalculus with dependent types (Philips Research Laboratories Eindhoven, Eindhoven University of Technology, 1988). [F.1] de Bruijn, N.G., Set theory with type restrictions, in: Hajnal, A., Rado R. and Sos, V.T., eds., Infinite and Finite Sets, I, International Colloquium, Keszthely, Hungary, 1973 (1975), 205-214. (Colloquia Math. SOC.J&nos Bolyai, 10).

[F.2] de Bruijn, N.G., Formalization of constructivity in Automath, in: de Doelder, P.J., de Graaf, J. and van Lint, J.H., eds., Papers dedicated to J.J.

978

References

Seidel (Eindhoven University of Technology, 1984), 76-101. (EUT-Report 84-WSK-03).

[F.3] de Bruijn, N.G., The Mathematical Vernacular, a language for mathematics with typed sets, in: Dybjer, P. et al., eds., Proceedings of the Workshop on Programming Languages, Marstrand, Sweden 1987. Plus: Formalizing the Mathematical Vernacular (formerly unpublished, 1982), Examples of an MV Book.

[F.4] Wieringa. R.M.A., Relational semantics in an integrated system (Eindhoven University of Technology, 1980). (Internal Report, Dept. of Math.). [F.5] de Bruijn, N.G., Computer program semantics in space and time (Eindhoven University of Technology, 1983). (Internal Report, Dept. of Math. and Comp. Sc.). [Abadi et al. 911 Abadi, M., Cardelli, L., Curien, P.-L. and Lkvy, J.-J., Explicit substitutions, Functional Programming 1, 4 (1991), 375-416. [Andrews 711 Andrews, P., Resolution in type theory, Journ. of Symb. Logic 36 (1971), 414-432. [Backhouse et al. 891 Backhouse, R., Chisholm, P. and Malcolm, G . , Do-ityourself type theory, Formal Aspects of Computing 1 (1989), 19-84.

[Balsters 861 Balsters, H., Lambda calculus extended with segments, Ph.D. thesis (Eindhoven University of Technology, 1986). See also [B.8]. [Barendregt 711 'Barendregt, H.P., Some extensional models for combinatory logics and A-calculi, Ph.D. thesis (Utrecht University, 1971). [Barendregt 741 Barendregt, H.P., Pairing without conventional restraints, Zeitschr. f. math. Logik u. Grundl. d. Math. 20 (1974), 289-306. [Barendregt 771 Barendregt, H.P., The type free A-calculus, in: Barwise, J., ed., Handbook of Mathematical Logic (North Holland Publishing Co., Amsterdam, 1977), 1091-1132. (Studies in Logic and the Foundations of Math., VOl. 90). [Barendregt 811 Barendregt, H.P., The Lambda Calculus: Its Syntax and Semantics (North Holland Publishing Co., Amsterdam, 1981). [Barendregt 84a] Barendregt, H.P., The Lambda Calculus: Its Syntax and Semantics, Revised edition (North Holland Publishing Co., Amsterdam, 1984).

References

979

[Barendregt 84b] Barendregt, H.P., Introduction to lambda calculus, Nieuw Archief voor Wiskunde 4 , 2 (1984), 337-372. [Barendregt 911 Barendregt, H.P., Introduction to generalized type systems, Journal of Functional Programming 1, 2 (1991), 125-154. [Barendregt 921 Barendregt, H.P., Lambda calculi with types, in: Abramsky, S., Gabbay, D. M. and Maibaum, T., eds., Handbook of Logic in Computer Science (Oxford, Clarendon Press, 1992), Vol. 2, 117-309. [Barendregt et al. 761 Barendregt, H.P., Bergstra, J., Klop, J.W. and Volken, H., Representability in lambda algebras, Indagationes Math. 38 (1976), 377-387. [Barendregt and Hemerik 901 Barendregt, H.P. and Hemerik, C., Types in lambda calculi and programming languages, in: Jones, N., ed., European Symposium on Programming (Berlin, Springer Verlag, 1990), 1-36. (Lecture Notes in Comp. Sci., 432). [Barendsen 891 Barendsen, E., Representation of logic, data types and recursive functions in typed lambda calculus, Master’s thesis (University of Nijmegen, 1989). [van Benthem Jutting 71a] van Benthem Jutting, L.S., On normal forms in A UTOMATH (Eindhoven University of Technology, 1971). (Notitie 71-24, Dept. of Math.). [van Benthem Jutting 71b (C.1)] van Benthem Jutting, L.S., A normal form theorem in a A-calculus with types, in: Mitt. d. Gesellsch. f. Math. u. Datenverarb. 17, Tagung ub. form. Sprachen u. Programmiersprachen, Oberwolfach, Germany (1971), 27-32. [van Benthem Jutting 731 van Benthem Jutting, L.S., The development of a text in AUT-QE, in: Braffort, P., ed., Proceedings of the Symposium APLASM (Orsay, 1973), Vol. I. [van Benthem Jutting 761 van Benthem Jutting, L.S., A translation of Landau’s “Grundlagen” in AUTOMATH, Vol. 1-5 (Eindhoven University of Technology, 1976). [van Benthem Jutting 771 van Benthem Jutting, L.S., Checking Landau’s “Grundlagen” in the Automath system, Ph.D. thesis (Eindhoven University of Technology, 1977). Published as Mathematical Centre Tracts nr. 83 (Amsterdam, Mathematisch Centrum, 1979). See also [ B . 5 ] ,[ 0 . 2 ] , [ 0 . 3 ] , [D.5] and [E.2].

980

References

[van Benthem Jutting 81 (B.1)] van Benthem Jutting, L.S., Description of A UT-68 (Eindhoven University of Technology, 1981). (Memorandum 198112, Dept. of Math.). [van Benthem Jutting 85 (C.6)] van Benthem Jutting, L.S., The language theory of A,, a typed lambda calculus where terms are types (Eindhoven University of Technology, 1985). (Memorandum 1985-02, Dept. of Math. and Comp. Sc.). [van Benthem Jutting 88 (E,3)] van Benthem Jutting, L.S., An implementation of substitution in a A-calculus with dependent types (Philips Research Laboratories Eindhoven, Eindhoven University of Technology, 1988). [van Benthem Jutting and Wieringa 791 van Benthem Jutting, L.S. and Wieringa, R.M.A., Representatie van expressies in het verificatieprogramma VERA 1979 (Eindhoven University of Technology, 1980). (Memorandum 1979-15, Dept. of Math.).

[van Benthem Jutting and de Vrijer 94 (D.4)] van Benthem Jutting, L.S. and de Vrijer, R.C., A text fragment from Zucker’s ”Real Analysis” (1994). [Ben-Yelles 811 G-stratification is equivalent to F-stratification, Zeitschr. f. Math. Logilc u. Grundl. d. Math. 27 (1981), 141-150. [Berkling and Fehr 821 Berkling, K.J. and Fehr, E., A modification of the Acalculus as a base for functional programming languages, in: Nielsen, M. and Schmidt, E.M., eds., Automata, Languages and Programming, 9th International Colloquium, Aarhus (Berlin, Springer Verlag, 1982), 35-47. (Lecture Notes in Computer Science, 140). [Bishop 671 Bishop, E., Foundations of Constructive Analysis (New York, McGraw-Hill, 1967). [de Boer 751 de Boer, S., De ondefinieerbaarheid van Church’ 6-functie in d e A-calculus en Barendregt’s lemma, Master’s thesis (Eindhoven University of Technology, 1975). [Boyer and Moore 721 Boyer, R.S. and Moore, J.S., The sharing of structure in theorem-proving programs, Machine Intelligence 7 (Edinburgh, Edinburgh University Press, 1972), 101-113. [Boyer and Moore 881 Boyer, R.S. and Moore, J.S., A Computational Logic Handbook (Boston, Academic Press, 1988).

References

98 1

[ d e Bruijn 67 (A.1)] de Bruijn, N.G., Verification of mathematical proofs b y a computer, A preparatory study for a project AUTOMATH (formerly unpublished, 1967).

[ d e Bruijn 68a (D.l)] de Bruijn, N.G., Example of a text written in Automath (formerly unpublished, 1968). [de Bruijn 68b] de Bruijn, N.G., AUTOMATH, a language for mathematics (Eindhoven University of Technology, 1968). (T.H.-Report 68-WSK-05).

[ d e Bruijn 7Oa (A.Z)] de Bruijn, N.G., The mathematical language AUTOMATH, its usage and some of its extensions, in: Laudet, M., Lacombe, D. and Schuetzenberger, M., eds., Symposium on Automatic Demonstration, IRIA, Versailles, 1968 (Berlin, Springer Verlag, 1970), 29-61. (Lecture Notes in Math., 125). [de Bruijn 70b] de Bruijn, N.G., On the use of bound variables in AUTOMATH (Technological University, Eindhoven, 1970). (Notitie 70-9, Dept. of Math.). [ d e Bruijn 71 (B.Z)] de Bruijn, N.G., AUT-SL, a single line version of AUTOMATH (Eindhoven University of Technology, 1971). (Notitie 71-22, Dept. of Math.).

[de Bruijn 72a] de Bruijn, N.G., Some abbreviations in the input language for A UTOMATH (Eindhoven University of Technology, 1972). (Notitie 72-15, Dept. of Math.). [ d e Bruijn 72b (C.2)] de Bruijn, N.G., Lambda calculus notation with nameless dummies, a tool for automatic formula manipulation, with application to the Church-Rosser theorem, Zndagationes Math. 34 (1972), 381-392. [de Bruijn 73a] de Bruijn, N.G., A theory of generalized functions, with applications to Wigner distribution and Weyl correspondence, Nieuw Archief woor Wiskunde 3, 21 (1973), 205-280. [de Bruijn 73b] de Bruijn, N.G., AUTOMATH, a language for mathematics, A series of lectures at the SCminaire de mathkmatiques supbrieures, UniversitC de MontrCal, 1971, Lecture Notes by B. Fawcett (Les Presses de 1’UniversitC de MontrCal, 1973). [de Bruijn 73c] de Bruijn, N.G., The AUTOMATH Mathematics Checking Project, in: Braffort, p., ed., Proceedings of the Symposium APLASM (Orsay, 1973), Vol. I. Reprinted in: Kopania, J., ed., Studies in Logic, Grammar and Rhetoric, Humanities, Vol. I1 (Bialystok, 1983). (Papers of Warsaw University, 40).

982

References

[de Bruijn 73d] de Bruijn, N.G., A system for handling syntax and semantics of computer programs in terms of the mathematical language A UTOMATH (Eindhoven, unpublished, 1973). [de Bruijn 74a] de Bruijn, N.G., A framework for the description of a number of members of the A UTOMATH family (Eindhoven University of Technology, 1974). (Memorandum 1974-08, Dept. of Math.).

[ d e Bruijn 74b (B.3)) de Bruijn, N.G., Some extensions of AUTOMATH: the A UT-4 family (Eindhoven University of Technology, 1974). (Internal Report, Dept. of Math.). [ d e Bruijn 75a (F.1)]de Bruijn, N.G., Set theory with type restrictions, in: Hajnal, A., Rado R. and Sos, V.T., eds., Infinite and Finite Sets, I, International Colloquium, Keszthely, Hungary, 1973 (1975), 205-214. (Colloquia Math. SOC.Ja'nos Bolyai 10). [de Bruijn 75b] de Bruijn, N.G., The use of the language AUTOMATH for syntax and semantics of programming languages (Eindhoven, unpublished, 1975). [de Bruijn 761 de Bruijn, N.G., Modifications of the 1968 version of AUTOMATH (Eindhoven University of Technology, 1976). (Memorandum 197614, Dept. of Math.). [de Bruijn 771 de Bruijn, N.G., Some auxiliary operators in A UT-Pi (Eindhoven University of Technology, 1977). (Memorandum 1977-15, Dept. of Math.). [de Bruijn 78a] de Bruijn, N.G., A namefree lambda calculus with facilities for internal definition of expressions and segments (Eindhoven University of Technology, 1978). (T.H.-Report 78-WSK-03). [de Bruijn 78b] de Bruijn, N.G., Lambda calculus with namefree formulas involving symbols that represent reference transforming mappings, Indagationes Math. 40 (1978), 348-356. [ d e Bruijn 78c (B.4)] de Bruijn, N.G., AUT-QE without type inclusion (Eindhoven University of Technology, 1978). (Memorandum 1978-04, Dept. of Math.). [de Bruijn 78d] de Bruijn, N.G., A note on weak diamond properties (Eindhoven University of Technology, 1978). (Memorandum 1978-08, Dept. of Math.). [de Bruijn 79a] de Bruijn, N.G., Wees contextbewust in WOT, Euclides 55 (1979/1980), 7-12.

References

[de Bruijn 79b] de Bruijn, (1979/1980), 66-72.

983

N.G.,

Grammatica van WOT, Euclides 55

[de Bruijn 79c] de Bruijn, N.G., Van alles en nog wat over gebonden variabelen in wiskundige taal, Euclides 55 (1979/1980), 262-268.

[ d e Bruijn 80 (A.5)] de Bruijn, N.G., A survey of the project AUTOMATH, in: Seldin, J.P. and Hindley, J.R., eds., To H.B. Curry: Essays on Combinatory Logic, Lambda Calculus and Formalism (New York/London, Academic Press, 1980), 579-606.

[ d e Bruijn 83 (F.5)] de Bruijn, N.G., Computer program semantics in space and time (Eindhoven University of Technology, 1983). (Internal Report, Dept. of Math. and Comp. Sc.). [ d e Bruijn 84 (F.Z)] de Bruijn, N.G., Formalization of constructivity in Automath, in: de Doelder, P.J., de Graaf, J. and van Lint, J.H., eds., Papers dedicated to J . J . Seidel (Eindhoven University of Technology, 1984), 76101. (EUT-Report 84-WSK-03). [de Bruijn 86) de Bruijn, N.G., Checking mathematics with the aid of a computer, in: Howson, A.G. and Kahane, J.-P., eds., The Influence of Computers and Informatics on Mathematics and its Teaching (Cambridge, Cambridge University Press, 1986), 61-68. [ d e Bruijn 87a (F.3)] de Bruijn, N.G., The Mathematical Vernacular, a language for mathematics with typed sets, in: Dybjer, P. et al., eds., Proceedings of the Workshop on Programming Languages, Marstrand, Sweden 1987. Plus: Formalizing the Mathematical Vernacular (formerly unpublished, 1982), Examples of an MV Book. [ d e Bruijn 87b (B.7)] de Bruijn, N.G., Generalizing Automath by means of a lambda-typed lambda calculus, in: Kueker, D.W., Lopez-Escobar, E.G.K. and Smith, C.H., eds., Mathematical Logic and Theoretical Computer Science, Proceedings of the Maryland 1984/85 Special Year in Mathematical Logic and Theoretical Computer Science (New York, Marcel Dekker, 1987), 71-92. (Lecture Notes in Pure and Appl. Math., 106). [de Bruijn 891 de Bruijn, N.G., Machinale verificatie van redeneringen, in: Lemniens, P.W.H., ed., Bewijzen in de Wiskunde (Amsterdam, Centrum voor Wiskunde en Inforrnatica, 1989), 61-79. [de Bruijn 9Oa] de Bruijn, N.G., The use of justification systems for integrated semantics, in: Martin-Lof, P. and Mints, G., eds., Colog-88 (Berlin, Springer Verlag, 1990), 9-24. (Lecture Notes in Comp. Sc., 417).

984

References

[ d e Bruijn 906 (A.7’1 de Bruijn, N.G., Reflections on Automath (Eindhoven University of Technology, 1990). [de Bruijn 91a] de Bruijn, N.G., Telescopic mappings in typed lambda calculus, Information and Computation 91 (1991), 189-204. [de Bruijn 91b] de Bruijn, N.G., A plea for weaker frameworks, in: Huet, G. and Plotkin, G., eds., Logical Frameworks, Proceedings of the BRA workshop, Sophia Antipolis, 1990 (Cambridge, Cambridge University Press, 1991), 40-67. [de Bruijn 91c] de Bruijn, N.G., Checking mathematics with computer assistance, Notices American Mathematical Society, 8 , 1 (1991), 8-15. [de Bruijn 921 de Bruijn, N.G., On the role of types i n mathematics (to be published, 1992). [de Bruijn 931 de Bruijn, N.G., Algorithmic definition of lambda-typed lambda calculus, in: Huet, G. and Plotkin, G., eds., Logical Environments (Cambridge, Cambridge University Press, 1993), 131-146. [Bulnes-Rozas 791 Bulnes-Rozas, J.P., GOAL: A goal oriented commend language for interactive proof construction, Ph.D. thesis, Stanford A.I. Lab., Stanford (1979). (Memo AIM-328). [Cardelli and Wegner 851 Cardelli, L. and Wegner, P., On understanding types, data abstraction, and polymorphism, Computing Surveys 17,4 (1985), 471522. [Church 321 Church, A., A set of postulates for the foundation of logic, Ann. of Math. 33 (1932), 346-366 and 34 (1933), 839-864. [Church 361 Church, A., An unsolvable problem of elementary number theory, Amer. Journal of Math. 58 (1936), 345-363. [Church 401 Church, A,, A formulation of the simple theory of types, Journ. of Symb. Logic 5 (1940), 56-68. [Church 411 Church, A., The Calculi of Lambda Conversion (Princeton University Press, 1941). (Annals of Math. Studies, 6). [Constable et al. 861 Constable, R.L.et al., Implementing Mathematics with the NuPRL Proof Development System (Englewood Cliffs, Prentice-Hall, 1986). [Coppo and Dezani 781 Coppo, M. and Dezani-Ciancaglini, M., New type assignment for A-terms, Archiv. Math. Logik 19 (1978), 139-156.

References

985

[Coppo et al. 811 Coppo, M., Dezani-Ciancaglini, M. and Venneri, B., Functional characters of solvable terms, Zeitschr. f. Math. Logik u. Grundl. d. Math. 27 (1981), 45-58. [Coquand 851 Coquand, Th., Une the‘orie des constructions, Thkse de troisibme cycle (Paris, Universite Paris VII, 1985). [Coquand 861 Coquand, Th., An analysis of Girard’s paradox, Proceedings of the first Symposium on Logic i n Computer Science, Cambridge Mass. (Washington DC, IEEE Computer Society), 227-236. [Coquand 901 Coquand, Th., Metamathematical investigations of a calculus of constructions, in: Odifreddi, P.G., ed., Logic and Computer Science (London, Academic Press, 1990), 91-122. (APIC series, 31). [Coquand and Huet 851 Coquand, Th. and Huet, G., Constructions: a higher order proof system for mechanizing mathematics, in: Buchberger, B., ed., Computer Algebra, Proceedings of the European conference EUROCAL ’85, Linz (1985), 151-184. (Lecture Notes in Comp. Sc., 203). [Coquand and Huet 881 Coquand, T. and Huet, G., The calculus of constructions, Information and Computation 76 (1988), 95-120. [Curien 861 Curien, P.-L., Categorical Combinators, Sequential Algorithms and Functional Programming (London, Pitman, 1986). [Curry and Feys 581 Curry, H.B. and Feys, R., Combinatory Logic (Amsterdam, North Holland Publishing Co., 1958), Vol. 1. [Curry et al. 721 Curry, H.B., Hindley, J.R. and Seldin, J.P., Combinatory Logic (Amsterdam, North Holland Publishing Co., 1972), Vol. 2. [van Daalen 701 van Daalen, D.T., Verzamelingstheorie, de axioma’s van Zermelo-Frankel (Eindhoven University of Technology, 1970). (Internal Report, Dept. of Math.).

[van Daalen 73 (A.3’11 van Daalen, D.T., A description of Automath and some aspects of its language theory, in: Braffort, P., ed., Proceedings of the Symposium A P L A S M (Orsay, 1973), Vol. I. Also in [van Benthem Jutting 771, 48-77. [van Daalen 801 van Daalen, D.T., The language theory of Automath, Ph.D. thesis (Eindhoven University of Technology, 1980). See also [A.6], (B.6) and [ C. 51.

986

References

[van Dalen et al. 781 van Dalen, D., Doets, H.C. and de Swart, H., Sets: Naive, Axiomatic and Applied (Oxford, Pergamon Press, 1978). [Dowek et al. 911 Dowek, G., Felty, A., Herbelin, H., Huet, G., Paulin-Mohring, Ch. and Werner, B., The Cop proof assistant version 5.6, user’s guide (Rocquencourt, INRIA - Lyon, CNRS ENS, 1991). [Fitch 521 Fitch, F.B., Symbolic Logic, an Introduction (New York, The Ronald Press Co., 1952). [Fraenkel et al. 581 Fraenkel, A.A., Bar-Hillel, Y. and LBvy, A., Foundations of Set Theory (Amsterdam, North Holland Publishing Co., 1958). [Frege 18791 Frege, G., Begriflsschrift, eine der arithmetischen nachgebildete Formelsprache des reinen Denkens (Halle, Verlag von Louis Nebert, 1879). [Frege 18931 Frege, G., Grundgesetze der Arithmetik, begriflsschriftlich abgeleitet (Jena, H. Pohle, 1893, 1903). [Gandy 801 Gandy, R.O., Proofs of Strong Normalization, in: Seldin, J.P. and Hindley, J.R., eds., To H.B. Curry: Essays on Combinatory Logic, Lambda Calculus and Formalism (New York/London, Academic Press, 1980), 475477. [Gentzen 351 Gentzen, G., Untersuchungen uber das logische Schliessen, Math. Zeitschr. 39 (1935), 176-210, 405-431. [Gentzen 361 Gentzen, G., Die Widersprachsfreiheit der reine Zahlentheorie, Math. Annalen 112 (1936), 493-565. [Geuvers 881 Geuvers, J.H., The interpretation of logic in type systems, Master’s thesis (University of Nijmegen, 1988). [Geuvers 931 Geuvers, J.H., Logics and type systems, Ph.D. thesis (Catholic University of Nijmegen, 1993). [Geuvers and Nederhof 911 Geuvers, J.H. and Nederhof, M.J., A modular proof of strong normalization for the Calculus of Constructions, Journal of Functional Programming 1, 2 (1991), 155-189. [Girard 711 Girard, J.-Y., Une extension de l’interprktation de Godel a l’analyse, et son application A 1’Climination des coupures dans l’analyse et la thCorie des types, in: Fenstad, J.E., ed., Proceedings of the 2nd Scandinavian Logic Symp. (Amsterdam, North-Holland Publishing Co., 1971), 63-92.

References

987

[Girard 721 Girard, J.-Y., Interpre'tation fonctionelle et dimination des coupures dans l'arithm6tique d 'ordre supe'rieur, Thbse d ' Etat (Paris, UniversitC Paris VII, 1972). [Girard et al. 891 Girard, J.-Y., Lafont, Y. and Taylor, P., Proofs and Types (Cambridge, Cambridge University Press, 1989). [Glaser et al. 841 Glaser, H., Hankin, C. and Till, D., Principles of Functional Programming (Englewood Cliffs, Prentice-Hall, 1984). [Gordon and Melham 931 Gordon, M.J.C. and Melham, T.F., Introduction to HOL, A theorem proving environment for higher order logic (Cambridge, Cambridge University Press, 1993). [Gordon et al. 791 Gordon, M., Milner, R. and Wadsworth, C., Edinburgh LCF, A mechanised Logic of Computation (Berlin, Springer Verlag, 1979). (Lecture Notes in Comp. Sc., 78). [Hall 671 Hall Jr., M., Combinatorial Theory (Chichester, Wiley, 1967). (Blaisdell book in pure and applied mathematics). [Harper et al. 861 Harper, R., MacQueen, D. and Milner, R., Standard ML (Edinburgh University, 1986). (Report ECS-LFCS-86-2). [Harper et al. 871 Harper, R., Honsell, F. and Plotkin, G., A framework for defining logics, in: Proceedings of the second Symposium on Logic in Computer Science, Ithaca, N.Y. (Washington DC, Computer Society of the IEEE, 1987), 194-204. [Hichcock and Park 731 Hichcock, P. and Park, D., Induction rules and termination proofs, in: Nivat, M., ed., Automata, Languages and Programming (Amsterdam, North-Holland Publishing Co., 1973), 225-252. [Hilbert and Ackermann 19281 Hilbert, D. and Ackermann, W., GrundzGge der theoretischen Logzk (Berlin, Springer Verlag, 1928). [Hindley 691 Hindley, J.R., The principal type scheme of an object in combinatory logic, Transactions of the American Math. SOC.146 (1969), 29-60. [Hindley 791 Hindley, J.R., Combinatory reductions and lambda reductions compared, Zeitschr. f. Math. Logik u. Grundl. d. Math. 23 (1979), 169180. [Hindley et al. 721 Hindley, J.R., Lercher, B. and Seldin, J.P., Introduction to Combinatory Logic (Cambridge, Cambridge University Press, 1972).

References

988

[Hindley and Seldin 861 Hindley, J.R. and Seldin, J.P.,

Introduction to Combinators and A-Calculus (Cambridge, Cambridge University Press, 1986). [Howard 801 Howard, W.A., The formulae-as-types notion of construction, in: Seldin, J.P. and Hindley, J.R., eds., To H.B. Curry: Essays on Combinatory Logic, Lambda Calculus and Formalism (New York/London, Academic Press, 1980), 479-490. (Manuscript 1969). [Jervell 711 A normal form in first order arithmetic, in: Fenstad, J.E., ed., Proceedings of the 2nd Scandinavian Logic Symp. (Amsterdam, North-Holland Publishing Co., 1971), 93-108. [Kamareddine and Nederpelt 93) Kamareddine, F. and Nederpelt, R., On stepwise explicit substitution, Int. Journal of Found. of Comp. Sc. 4, 3 (1993), 197-240. [Kijne 621 Kijne, D., Construction geometries and construction fields, in: Algebraical and Topological Foundations of Geometry, Proceedings of a Colloquium held in Utrecht, 1959 (Oxford, Pergamon Press, 1962). [Kleene 521 Kleene, S.C., Introduction to Metamathematics (New York, Van Nostrand, 1952). [Klop SO] Klop, J.-W., Combinatory reduction systems, Ph.D. thesis (Utrecht University, 1980). [Klop 921 Klop, J.W., Term rewriting systems, in: Abramsky, S. Gabbay, D. M. and Maibaum, T. eds., Handbook of Logic in Computer Science (Oxford, Clarendon Press, 1992), Vol. 2, 1-116. [Kneale and Kneale 621 Kneale, W. and Kneale, M., The Development of Logic (Oxford, Clarendon Press, 1962). [Kreisel 721 Kreisel, G., Five notes on the application of proof theory to computer science (Stanford University, 1972). (Techn. report no. 182). [Landau 301 Landau, E., Grundlagen der Analysis (First ed.: Leipzig, 1930; Third ed.: New York, Chelsea Publ. Comp., 1960). [Landin 641 Landin, P.J., The mechanical evaluation of expressions, Computer Journal 6, 4 (1964), 308-320. [Lauchli 70) Lauchli, H., An abstract notion of realizability for which intuitionistic predicate calculus is complete, in: Kino, A., Myhill, J. and Vesley,

References

989

R.E., eds., Intuitionism and Proof Theory, Proc. Summer Conference at Buffalo, 1968 (Amsterdam, North-Holland Publishing Co., 1970). [Leivant 751 Leivant, D., Strong normalization for arithmetic (variations on a theme of Prawitz), in: Proof Theory Symposium Kiel1974 (Berlin, Springer Verlag, 1975), 182-197. (Lecture Notes in Math., 500). [LCvy 741 LCvy, J.J., Re'ductions sures dans le lambda-calcul, These 3' Cycle (Paris, 1974). [LBvy 751 LCvy, J.J., An algebraic interpretation of the APK-calculus and a labelled A-calculus, in: Bohm, C., ed., A-Calculus and Computer Science Theory (Berlin, Springer Verlag, 1975), 147-165. (Lecture Notes in Comp. sc., 37). [Luo 891 Luo, Z., ECC: An extended Calculus of Constructions, in: Proceedings of the fourth Annual Symposium on Logic in Computer Science, Asilomar, Cal. (Washington DC, IEEE Computer Society Press, 1989), 386-395. [Magnusson and Nordstrom 941 Magnusson, L. and Nordstrom, B., The ALF proof editor and its proof engine, in: Barendregt, H. and Nipkow, T., eds., Types for Proofs and Programs (Berlin, Springer Verlag, 1994), 238-262. (Lecture Notes in Comp. Sc., 806.) [Mann 731 Mann, C.R., The connections between proof theory and category theory, Ph.D. thesis (Oxford, 1973). [Martin-Lof 71a] Martin-Lof, P., A theory of types (1971). (Manuscript). [Martin-Lof 71b] Martin-Lof, P., Hauptsatz for the theory of species, in: Fenstad, J.E., ed., Proceedings of the 2nd Scandinavian Logic Symp. (Amsterdam, North-Holland Publishing Co., 1971), 217-233. [Martin-Lof 75a] Martin-Lof, P., An intuitionistic theory of types: predicative part, in: Rose, H.E. and Shepherdson, J.C., eds., Logic Colloquium '73 (Amsterdam, North-Holland Publishing Co., 1975), 73-118. [Martin-Lof 75b] Martin-Lof, P., About models for intuitionistic type theory and the notion of definitional equality, in: Karger, S., ed., Proceedings of the third Scandinavian Logic Symp. (Amsterdam, North Holland Publishing CO., 1975), 81-109. [Martin-Lof 821 Martin-Lof, P., Constructive mathematics and computer programming,' in: Logic, Methodology and Philosophy of Science, VI, 1979 (Amsterdam, North-Holland Publishing Co., 1982), 153-175.

990

References

[Martin-Lof 841 Martin-Lof, P., Intuitionistic Type Theory, Studies in Proof Theory (Napoli, Bibliopolis, 1984). [Mitchell and Plotkin 851 Mitchell, J.C. and Plotkin, G.D., Abstract types have existential type, in: Proceedings of the 12th Annual Symposium on Principles of Programming Languages (New York, ACM, 1985), 37-51. [Mitschke 761 Mitschke, G., A-Kalkul, 6-Konversion und axiomatische Rekursions- Theorie, Habilit. Schr. (Darmstadt, 1976). [Mohring 861 Mohring, Ch., Algorithm development in the calculus of constructions, in: Proceedings of the first Symposium on Logic in Computer Science, Cambridge, Mass. (Washington DC, IEEE Computer Society, 1986), 84-91. [Nederpelt 71a] Nederpelt, R.P., Lambda-Automath (Eindhoven University of Technology, 1971). (Notitie 71-17, Dept. of Math.). [Nederpelt 71b] Nederpelt, R.P., Lambda-Automath IZ (Eindhoven University of Technology, 1971). (Notitie 71-25, Dept. of Math.). [Nederpelt 72a] Nederpelt, R.P., Strong normalisation in a A-calculus uiith Aexpressions as types (Eindhoven University of Technology, 1972). (Notitie 72-18, Dept. of Math.). [Nederpelt 72b] Nederpelt, R.P., The closure theorem in A-typed A-calculus (Eindhoven University of Technology, 1972). (Notitie 72-22, Dept. of Math.).

[Nederpelt 73 (C.3)] Nederpelt, R.P., Strong normalisation in a typed lambda calculus with lambda structured types, Ph.D. thesis (Eindhoven University of Technology, 1973). (Nederpelt 771 Nederpelt, R.P., Presentation of natural deduction, Receuil des Travaux d e l’lnstitut Math., Nouvelle SCrie, tome 2, 10, Symp. Set Theory, Foundations of Math. (Beograd, 1977), 115-126. [Nederpelt 801 Nederpelt, R.P., An approach to theorem proving on the basis of a typed lambda-calculus, in: 5th Conference on Automated Deduction (Berlin, Springer Verlag, 1980), 182-194. (Lecture Notes in Comp. Sc., 87). [Nederpelt 871 Nederpelt, R.P., De Taal van de Wiskunde (Almere, Versluys, 1987).

[Nederpelt 90 (A.S)] Nederpelt, R.P., Type systems - basic ideas and applications, in: van de Goor, A.J., ed., Proceedings of CSN ’90, Computing Science in the Netherlands (Amsterdam, Stichting Mathematisch Centrum, 1990), 367-383.

References

991

[Nederpelt 921 Nederpelt, R.P., The fine-structure of lambda calculus (Eindhoven University of Technology, 1992). (Computing Science Notes, 92/07). [Newman 421 Newman, M.H.A., On theories with a combinatorial definition of “equivalence”, Ann. of Math. 2, 43 (1942), 223-243. [Nordstrom et al. 901 Nordstrom, B., Petersson, K. and Smith, J.M., Programming in Martin-Loj’s Type Theory (Oxford, Oxford University Press, 1990). [Osswald 731 Osswald, H., Ein syntaktischer Beweis fur die ZulGsigkeit der Schnittregel im Kalkul von Schutte fur die intuitionistischen Typenlogik, Manusc. Math. 8 (1973), 243-249. [Paulin-Mohring 891 Paulin-Mohring, Ch., Extraction des programmes dans le calcul des constructions, Thhse (Paris, UniversitC Paris VII, 1989). [Paulson 871 Paulson, L.C., Logic and Computation (Cambridge, Cambridge University Press, 1987). (Cambridge Tracts in Theor. Comp. Sc., 2). [Penning 771 Penning, P., Automath-bewijzen voor tautologieen (Eindhoven, unpublished, 1977). [Peremans 941 Peremans, W., Ups and Downs of Type theory (Eindhoven University of Technology, 1994). (Computing Science Notes, 94/14). [Plotkin 801 Plotkin, G., Lambda-definability in the full type hierarchy, in: Seldin, J.P. and Hindley, J.R., eds., To H.B. Curry: Essays on Combinatory Logic, Lambda Calculus and Formalism (New York/London, Academic Press, 1980), 363-373. [Pohlers 731 Pohlers, W., Ein starkes Normalisationssatz fur die intuitionistischen Typen, Manusc. Math. 8 (1973), 371-387. [Pottinger 771 Pottinger, G., Letter to Prawitz (unpublished, 1977). [Pottinger 791 Pottinger, G., On analysing relevance constructively, Studia Logica 38 (1979), 171-185. [Pottinger 801 Pottinger, G., A type assignment to the strongly normalizable terms, in: Seldin, J.P. and Hindley, J.R., eds., To H.B. Curry: Essays on Combinatory Logic, Lambda Calculus and Formalism (New York/ London, Academic Press, 1980), 561-577. [Prawitz 651 Prawitz, D., Natural Deduction, a Proof- Theoretical Study (Stockholm, Almquist and Wiksell, 1965).

992

References

[Prawitz 711 Prawitz, D., Ideas and results in proof theory, in: Fenstad, J.E., ed., Proceedings of the 2nd Scandinavian Logic Symp. (Amsterdam, NorthHolland Publishing Co., 1971), 235-307. [Reynolds 741 Reynolds, J.C., Towards a theory of type structure, in: Robinet, B., ed., Proceedings of the Colloque sur la Programmation (Berlin, Springer Verlag, 1974), 408-425. (Lecture Notes in Comp. Sc., 19). [Reynolds 851 Reynolds, J.C., Three approaches to type structure, in: Ehrig, H. et al., eds., Mathematical Foundations of Software Development (Berlin, Springer Verlag, 1985), 97-138. (Lecture Notes in Comp. Sc., 185). [Sanchis 671 Sanchis, L.E., Functionals defined by recursion, Notre Dame Journal of Formal Logic 8 (1967), 161-174. [Schulte Monting 731 Schulte Monting, H., Yet another proof of the ChurchRosser theorem (unpublished, 1973). [Scott 701 Scott, D., Constructive validity, in: Laudet, M., Lacombe, D. and Schuetzenberger, M., eds., Symposium on Automatic Demonstration, IRIA, Versailles, 1968 (Berlin, Springer Verlag, 1970), 237-275. (Lecture Notes in Math., 125). [Scott 731 Scott, D.S., Models for various type-free calculi, in: Suppes, P. et al., eds., Logic, Methodology and Philosophy of Science, IV, 1971 (Amsterdam, North Holland Publishing Co., 1973), 157-187. [Scott and Strachey 711 Scott, D. and Strachey, C., Towards a mathematical semantics for computer languages (Oxford, Oxford University, 1971). [Seldin 751 Seldin, J.P., Review of ‘Lambda calculus notation with nameless dummies, a tool for automatic formula manipulation, with application to the Church-Rosser theorem’, Journ. of Symb. Logic 40 (1975), 470. [Seldin 761 Seldin, J.P., A theory of generalized functionality I (unpublished, 1976). See also: Seldin, J.P., Progress report on generalized functionality, Ann. Math. Logic 17 (1979), 29-59. [Seldin and Hindley 801 Seldin, J.P. and Hindley, J.R., eds., To H.B. Curry: Essays on Combinatory Logic, Lambda Calculus and Formalism (New York/London, Academic Press, 1980). [Shoenfield 671 Shoenfield, J.R., Mathematical Logic (Reading MA, Addison Wesley, 1967).

References

993

[Smorynski 771 Smorynski, C., The incompleteness theorems, in: Barwise, J., ed., Handbook of Mathematical Logic (Amsterdam, North-Holland Publishing Co., 1977), 821-865. (Studies in Logic and the Foundations of Math., VOl. 90). [Staples 751 Staples, J., Church-Rosser theorems for replacement systems, in: Crossley, J.N., ed., Algebra and Logic (Berlin, Springer Verlag, 1975), 291306. (Lecture Notes in Math., 450). [Staples 771 Staples, J., A lambda calculus with naive substitution (Brisbane, unpublished, 1977). [Stenlund 721 Stenlund, S., Combinators, A-terms and Proof Theory (Dordrecht, Reidel, 1972). [Tait 671 Tait, W.W., Intentional interpretations of functionals of finite type I, Journ. of Symb. Logic 32 (1967), 198-212. [Troelstra 731 Troelstra, A S . , ed., Metarnathematical Investigation of Intuitionistic Arithmetic and Analysis (Berlin, Springer Verlag, 1973). (Lecture Notes in Math., 344). [Troelstra 771 Troelstra, AS., Aspects of constructive mathematics, in: Barwise, J., ed., Handbook of Mathematical Logic (Amsterdam, North Holland Publishing Co., 1977), 973-1052. (Studies in Logic and the Foundations of Math., Vol. 90). [Troelstra and van Dalen 881 Troelstra, AS. and van Dalen, D., Constructivism in Mathematics (Amsterdam, North-Holland Publishing Co., 1988), Vol. 1. [Trybulec 901 Trybulec, A., Introduction, Formalized Mathematics 1, 1 (1990), 7-8. [Turner 791 Turner, D.A., Another algorithm for bracket abstraction, Journ. of Symb. Logic 44 (1979), 267-270. [Udding 801 Udding, J.T., A Theory of Real Numbers and its Presentation in Automath, Vol. 1-3, Master’s thesis (Eindhoven University of Technology, 1980).

[de Vrijer 75 (C.4)] de Vrijer, R.C., Big trees in a A-calculus with A-expressions its types, in: Bohm, C., ed., A-Calculus and Computer Science Theory, (Berlin, Springer Verlag, 1975), 202-221. (Lecture Notes in Comp. Sc., 37). Also: de Vrijer, R.C., Surjective pairing and strong normalization, Ph.D. thesis (University of Amsterdam, 1987), Chapter 5.

994

References

[de Vrijer 87a] de Vrijer, R.C., Surjective pairing and strong normalization: two themes in lambda calculus, Ph.D. thesis (University of Amsterdam, 1987). See also [de Vrijer 75 (C.4)]. [de Vrijer 87b] de Vrijer, [de Vrijer 87al.

R.C.,

“Stelling” to

his Ph.D.

thesis.

See

[de Vrijer 87c] de Vrijer, R.C., Exactly estimating functionals and strong normalization, Proc. of the Koninklijke Nederlandse Akademie van Wetenschappen, Series A 90, 4 (1987), 479493. [Wadsworth 711 Wadsworth, C.P., Semantics and pragmatics of the lambdacalculus, Ph.D. thesis (Oxford, 1971). [Weyhrauch 771 Weyhrauch, R.W., A users manual for FOL (Stanford, Computer Science Dept., 1977). (Artificial Intelligence Project M235). [Whitehead and Russell 19101 Whitehead, A.N. and Russell, B., Principia Mathematica (Cambridge, Cambridge University Press, 1910-1913), Vol. 1-3. [Wieringa 761 Wieringa, R.M.A., Binaire optelling en vermenigvuldiging in AUT-QE (Eindhoven, unpublished, 1976). [Wieringa 781 Wieringa, R.M.A., Een notatie-systeem voor lambda-calculus met definities, Master’s thesis (Eindhoven University of Technology, 1978).

[ Wieringa 80 (F.4)] Wieringa. R.M. A., Relational semantics in a n integrated system (Eindhoven University of Technology, 1980). (Internal Report, Dept. of Math.). [Zandleven 73 (E.l)] Zandleven, I., A verifying program for Automath, in: BrafFort, P., ed., Proceedings of the Symposium APLASM (Orsay, 1973), VOl. I. [Zucker 741 Zucker, J . , Cut-elimination and normalization, Annals of Math. Logic 7 (1974), 1-112. [Zucker 77 (A.4)] Zucker, J., Formalization of classical mathematics in Automath, in: Colloque International de Logique, Clermont-Ferrand, France, 1975 (Paris, CNRS, 1977), 135-145. (Colloques Internationaux du Centre National de la Recherche Scientifique, 249).

Indexes


Index of Names Berkling & Fehr 119821, 811, 837 Bernays, P., 192 Beth, E.W., 26, 203 Bishop [1967], 130 de Boer, S., 503 - (19751, 503, 505 Bourbaki, N., 206 Boyer & Moore (19723, 809 - [1988], 12 Braun, W.C.P., 252 van Bree, L.G.F.C., 73 Brouwer, L.E. J., 26, 204, 236 de Bruijn, N.G., 6, 111, 127, 128, 133,139,163,164,169, 175177, 187, 194, 216, 230, 231, 235, 238, 240, 242, 252, 306, 339,345, 390,393,394,473, 590, 687, 688, 722, 729, 783, 805, 809, 811, 813, 836, 838 - [1968b],8, 15, 74, 141, 150, 394 - [197Oa], 8, 128, 141, 150, 169, 283, 285, 286, 334, 371, 387, 393, 394, 469, 470, 783,844, 938 - [1970b],277 - [1971], 147, 313, 334, 393, 590 - [1972a], 158, 737 - [1972b], 116, 156, 175, 177, 192, 319, 327, 390, 656, 673, 804, 809, 811 - [1973b],141, 283, 285, 286, 334, 396, 722, 783 - [1973~],127, 141 - [1973d], 53, 938, 947, 948, 951,

Abadi et al. (19911, 35, 50 Ackermann, W., 4 Aristotle, 3 Augustsson, L., 12 Balsters, H.,8 - [1986],35, 45, 170, 306, 368 Barendregt, H.P., 11, 229, 230, 235, 239, 243, 248, 376, 391,399, 443, 503, 505, 611 - [1971], 375, 376, 389-391, 427, 448 - [1981],327, 503 - [1984a],339, 340, 572 - 119921, 5, 11, 26, 27, 34, 36, 37, 46 - & Hemerik [1990], 5, 26 - et al. [1976], 503 von Beethoven, L., 841 Ben-Yelles [1981], 187, 633 van Benthem Jutting, L.S., 6, 73, 156, 169, 170, 216, 222, 247, 252, 303, 306, 331, 396, 508, 509, 578 - [1971a], 155, 396, 508 - [1971b],473, 633 - 119731, 101, 127, 160, 804 - [1976], 157, 159 - [1977], 7, 44, 141, 147, 157, 159, 163, 169,170,175, 188-190, 197, 198, 303, 306, 334, 471, 570, 578 - [1981], 339, 687, 688, 733 - (19881, 177 - & Wieringa [1979], 170, 177 997

Index of Names

998 952, 963, 964

- [1974a],289, 334, 852 - [1974b], 148, 159, 187 - [1975a], 144, 192

- & Feys [1958], 8, 150, 168, 175, 195,371,375,376,389,391393, 415, 443, 572, 585 - et al. [1972],195

- [1975b],53, 160, 938

- (19761, 159 - [1977], 159, 289, 306, 652

- [1978a], 33, 156, 160, 177, 339, 355

- [1978b], 177, 342 - [1978~],159, 306, 335, 652 - [1980], 163, 169, 171, 189, 197, 334, 339, 655, 673, 810, 849, 852, 866 - [1987a],865 - [1991a],11, 21, 44 - [1991b], 30, 32 Bulnes, J.P., 166 Bulnes-Rozas [1979],166, 170 Cantor, G., 203-205, 221, 229, 841, 842, 845, 846, 848 Church, A., 5, 34,36,37,41, 75, 168, 205, 229, 230, 232, 235, 246, 389, 391, 392, 503 - (19321, 5, 389 - [1936],5 - (19401, 5, 13, 135, 136, 340, 355 - [1941],375 Constable et al. [1986],9, 11 Coppo & Dezani [1978], 188 Coppo et al. [1981], 188 Coquand, Th., 12, 235, 837 - [1985], 10 - [1986], 8 - [1990], 10 - & Huet [1985], 10 - & Huet [1988], 10 Curien [1986], 809, 815, 837 Curry, H.B., 5, 128, 175, 195, 230, 232, 235, 248, 250

van Daalen,

D.T., 7, 252, 264, 396,

485, 783

- [1970], 144 - [1973], 127, 141, 155, 163, 172, 177,289,301,303,469-471, 474, 493, 517, 522, 523, 558, 591, 592, 701, 783, 787, 810, 833 - [1980], 7, 23, 31, 38, 155, 303, 314, 327, 331, 334, 339, 473, 508, 515, 526, 539, 545, 550, 574, 579, 590, 592, 612, 629, 637, 655, 830, 833 van Dantzig, D., 203 Dedekind, R., 713, 714 Dijkstra, E.W., 207 Dowek et al. [1991], 11 Erdos, P., 26, 204, 212 Euclid, 219, 717 Euler, L., 219 Fitch, F.B., 687 - [1952], 52, 687 Fleischhacker, L., 371 Fraenkel, A.A., 50, 220, 226, 841843, 845-847, 865, 866, 912 - et al. [1958],842 Frege, G., 3, 228 - [1879],3 - [1893], 3 Freudenthal, H., 205, 206 Gandy [1980],41, 655, 664 Gauss, C.F., 841 Geuvers [1993], 11 - & Nederhof [1991], 11

Index of Names Girard, J.-Y., 8, 111, 188, 200, 230, 235, 393 - [1971], 9, 188, 393 - [1972], 8, 9, 111, 123, 150, 168, 188, 520 Glaser et al. [1984],837 Godel, K., 9, 192, 229, 393 Gordon, M.J.C., 12 - & Melham [1993], 12 - et al. [1979], 9, 166 Gorissen, P., 837 Harper et al. [1987], 10 Helmink, L., 11 Heyting, A., 26, 204, 205, 211, 216, 218, 236 Hichcock & Park [1973], 943 Hilbert, D., 4, 52, 93, 94, 101, 142, 152, 163, 203, 205, 216, 217, 219, 728, 730, 733 853, 865, 887, 911, 922, 936 - & Ackermann [1928], 4 Hindley [1979], 177 - et al. [1972], 469 Howard, W.A., 8,111,128,235,248, 393, 469, 473 - [1980], 8, 111, 150, 168, 393, 469, 473 Huet, G., 235, 837 Kamareddine & Nederpelt [1993],50 Kijne (19621, 852 Klop [1980],36 - (19921, 36 Kneale & Kneale [1962], 3 Kolmogorov, A.N., 236 Kornaat, A., 7, 138, 156, 158, 170, 252, 303, 306, 733 Kramers, H.A., 203 Kreisel [1972], 395 Kronecker, L., 217, 218 Kruseman Aretz, F.E.J., 837

999 Lauchli, H., 161, 393 - [1970], 161, 393 LCvy, J.J., 503, 508, 509 - [1974],508 - [1975],503 Landau, E., 73, 144, 157, 159, 160, 169, 222, 223, 252,303,306, 578 701-706, 709-711, 713, 715, 723-725, 729-732, 805 - [1930],44 45 157 159701, 709 Landin, P.J., 243, 837 von Leibniz, G.W., 3 142 Leivant, D., 635 - [1975],633 635 Luo, z., 11 - [1989], 11 Magnusson & Nordstrom [1994], 12 Marcelis, J.G., 252 Martin-Lof, P., 8, 111, 128, 188, 194, 200,230,391,393,398,427429, 472, 474, 655 - [1971a], 8, 168, 194 - [1975a], 9, 25, 111, 123, 128, 130, 134, 150, 188, 192, 393, 474, 517, 520, 655 - [1984],9 Milner, R., 9, 166 Mitschke (19761, 503 Mostowski, A., 841 Nederpelt, R.P., 6, 28, 123, 165, 174, 175, 183, 186, 187, 193, 252, 264, 278, 281, 333, 371, 473, 517, 518, 551, 559, 577, 581, 591,592,596,605,616,626-

628, 655, 683, 783 - [1971a], 275, 393, 590, 628 - [1971b], 28, 393, 590 - [1972b], 400 - [1973], 123, 124, 147, 155, 163, 175, 177, 281, 314, 327, 331,

Index of Yames

1000 333, 345, 473, 482, 517, 518, 522, 577, 592, 626, 633, 655, 783, 830 - (19771, 144 - [1987],23, 52 von Neumann, J., 192 Nordstrom, B., 12 - et al. [1990], 9 Paulin-Mohring, Ch., 11 - [1989], 11 Paulson [1987], 10 Peano, G., 52, 137, 141, 218, 221, 228, 241, 246, 249, 711, 715, 717, 718, 720, 843, 846, 848, 887, 912, 922 Penning, P., 252 - [1977], 170 Plotkin [1980], 191 Pollack, R., 11 Pottinger, G., 635 - (19771, 305, 635 - (19793, 305 - [1980], 189 Prawitz, D., 111, 392, 393, 508, 632, 635 - [1965],305, 392, 509, 632 - [1971], 111, 123, 150, 168, 392, 393, 487, 488 Pythagoras, 3 Reynolds, J.C.,9 - [1974], 9 Rosser, J.B., 38, 42 Russell, B., 4, 229 Sanchis, L.E., 393 - (19671, 393 Schuh, F., 202, 203 Schulte Monting [1973], 391 Scott, D., 9, 26, 100, 161, 167, 169, 188, 193, 194, 216, 473

- [1970], 25, 168, 169, 188, 194,

200, 473

- [1973], 9, 128, 134 - & Strachey (19711, 943 Seidel, J.J., 6 Seldin, J.P., 177, 188, 195, 200, 230 - [1975], 177 - [1976], 25, 188, 195 - & Hindley (19801, 22 Shakespeare, W., 217 Smorynski [1977],5 Staples, J., 175 - [1977], 175

Tait, W.W., 118, 376, 391, 392, 396, 398, 427-429, 655 - [1967], 392, 396, 487 Tarski, A., 5 Thales, 3 Trybulec [1990], 12 Turing, A.M., 229 Turner [1979], 49, 177 Udding, J.T., 160, 252 - [1980], 160 de Vrijer, R.C., 7, 175, 185, 252, 396, 503, 517, 601, 647, 689 - [1975], 155, 163, 173, 175, 185, 517, 591, 601, 608, 647 .. . - [1987a], 37, 174 - [1987~],41, 655, 664 Wadsworth (19711, 177, 809 Weyhrauch, R.W., 166 - [1977], 166 Whitehead, A.N., 4, 229 - & Russell [1910],4 Wieringa, R.M.A., 8, 157, 160, 170, 177, 252, 837, 947 - [1976], 171 - [1978], 160

Index of Names - [1980], 947 Wittgenstein, L., 151

Zandleven, F., 7, 121, 126, 156, 158, 169, 170, 176, 252, 725, 805, 809,811, 817, 837 - 119731, 101, 115, 121, 127, 156, 169, 570, 572, 805-807 Zermelo, E., 51, 144, 220, 226, 841843, 865, 866, 912 Zucker, J., 7, 147, 158, 160, 169, 170, 224, 252, 303, 306, 724, 729, 733,736, 737,739-742,746, 748, 749 - [1974],635 - [1977], 158, 163, 169-171, 177, 188, 189, 197,289,303,305, 306,470, 706, 722, 724,729, 733, 736, 741, 742, 746

1001


Index of Notations +, 309, 493

a,116

+’, 311

P, 108

C9, 304

Pq-CR, 577 PTVU-SN, 638 p r , 603 bool, 688 bool, 16, 41, 723 b o o l , 53 BOUNDSUBST, 790 BT, 38 BT, 600, 601

507 >, 494, 518 >1,493 > p , 790 >6, 794 >,, 792 51,494 2 , 494, 518 A sub B, 493 A 1 B, 494, 519 A c B, 493 [ti : V ] ,149 E [z := p ] , 148 E, 52 00, 53 P I r 11 486 +, 599 -‘btr 473 ,: 599 c,583 El 493 N, 518 =, 494

cantyp, 539, 558 CAT, 49, 125, 795 CAT, 299, 739 CAT, 31 CATEGORY, 788 CL, 519, 534 CL1, 534 CL’, 612 CL& 612 CLPT, 534 CLPT1, 535 CORRECT, 802 CORRECTCATS, 801 CR, 494 CR’, 612 CR;, 612 CR1, 494 cus, 648

El 798 $ ’,

800 T, 747 I-, 723, 801 I-N, 626 I-*,801 :, 52 ::, 52

Deg, 399, 450 6 , 108, 493 dn, 594 dnc, 594 1003

1004

DOM, 48,795, 796 DOM,739 DOM, 31 dom, 561 E, 116

EB, 109 E , 304, 493 Eait, 311 77, 108 EUD, 519, 536 IF, 638 ij-pp, 494 INDSTR, 787 i n t , 53 IS,41

Lq, 519, 536 LR, 605 MIDDLE, 787 F , 39 N, 494 nonempty, 688

OCCURS IN, 792 OFF, 940 OLDER THAN,798 w , 346 %(x)4 89 ON,940 P'T, 596 PD, 596 n, 32,306,736 K , 304, 493 PN, 109 PROP, 723 prop, 19, 22, 43, 152,196,728 PT, 519, 534, 536,596 PT1, 534

Index of Notations

9, 116

&-, 518 r, 601 RECURS, 955 p, 38, 399,457 rst, 601 rt, 601 s, 601 519, 596 sc, 597 C,11, 736 6 ,304,493 SN, 494 STRINGSUBST, 789 SUBST, 789 SYNT, 739 synt, 31, 299 SA,

T,53 t, 601 r , 34,260,603 r', 482 381 0,468 el,467 0 2 , 466 Totinf, 53 TRUE, 688 TRUE, 16,41, 53,87, 723 Typ, 399, 450 Typn, 449 Typ', 399, 452, 482 typ, 184, 186 typ', 593 type, 16, 19, 22, 43, 75, 148, 181, 258, 395, 728 UD, 519,536 UT, 519,536 weak ij-pp, 494

Index of Subjects function -, 231 functional -, 90 - index, 294 lambda -, 18 abstractor, 398, 403 abstractor chain, 398, 403 abstractor string, 616, 626 absurdity, 236 acceptable, 84 adequacy, 10 adjective, 52, 872, 876, 877 ALF, 12 ALGOLGO, 206, 279, 937 algorithm, 387 algorithmic correctness check, 329 algorithmic definition, 172, 517, 554, 558, 563, 591 all-quantifier, 93 a--conversion, 116 modulo -, 175 -equality, 107 -equivalence, 390 -reduction, 47, 413, 790 alphabet, 401 ancestor, 738 anonymous archetype, 871 Another Logical Framework, 12 applicability condition, 37, 39, 395, 452, 472 application, 28, 148, 178, 231, 377, 396 - condition, 234, 592 -expression, 129, 178, 255, 736

+-language, 185, 309, 526 +-reduction, 40, 493 +‘-reduction, 311 rst-reduction, 601 rt-reduction, 601 r-reduction, 601 s-reduction, 601 t-reduction, 601 1-expression, 258, 371 2-expression, 258, 371 3-expression, 258, 371 Cexpression, 722 lpexpression, 706 It-expression, 706 Ppexpression, 706 2t-expression, 706 3pexpression, 706 3t-expression, 706 V-elimination, 46 $-function, 304 $-type, 304 (-context, 360 ij-postponement, 494 abbreviating expression, 737 abbreviation, 105, 179, 241 abbreviation system, 76, 147 abbreviation-line, 707 abortion, 940, 970 abstract algebra, 139 abstract data type, 28, 245 abstract linear order, 138 abstraction, 28, 148, 178, 231, 396, 470 - expression, 129, 178, 254 1005

Index of Subjects

1006 function -, 231 legitimate Q-,452 - restriction, 19, 107 - rule, 532 self -, 392, 530 applicator, 403 applicator chain, 403 arbitrary, 52, 204, 852, 855 archetype, 205, 871, 898 argument degree, 186, 525 arithmetical typed A-calculus, 168 artificial intelligence, 870 ascendant, 32, 321 assertion, 875 assertion category, 87 assertion type, 688, 722 assertional line body, 886 assignment, 53, 54 assumption, 153, 240, 844, 875 assumptional context item, 880, 885 assumptional item, 879 AT-couple, 324 AT-pair, 32, 324 AT-removal, 33, 37, 325 attachment, 157 AUT-Ah, 30, 32 AUT-A, 36, 37 AUT-II, 31, 40, 44, 127, 147, 158, 289, 294, 303, 724, 733 AUT-II line, 734 AUT-no, 633 AUT-IIl, 634, 636 AUT-4, 187, 284 AUT-68, 41, 147, 251, 687, 721, 722 AUT-LAMBDA, 335 AUT-QE, 127, 147, 183, 230, 276, 289, 303, 396, 469, 471, 701, 72 1 AUT-QE-NTI, 289, 294, 335 AUT-SL, 28, 32, 147, 154, 186, 275, 314, 393

AUT-SYNT, 30, 43! 158, 299, 725, 737 ACT-synt, 169 Automath, 6, 230, 393, 394, 869 Automath book, 127 Automath project, 169 Automath verifier, 47, 49 automatic expression simplifier, 946 automatic formula manipulation, 375 automatic theorem proving, 23, 98, 157, 221, 240 axiom, 88, 153, 234, 241, 843, 888 axiom of choice, 94, 152, 205, 216 axiom of reducibility, 4 axiomatic line body, 886 Barendregt's cube, 235 Barendregt's lemma, 505 base, 401, 478, 479 Begriffsschrift, 3

P-chain complex, 432 -conversion, 421 -equality, 107, 108 -equivalent, 421 -normal, 460 -normal form, 460 -normalizable, 460 -reduction, 47, 49, 122, 242, 257, 288, 326, 382, 386, 390, 417, 789 n-step -, 417 P1-

-equivalence, 424 -nf, 466 -normal, 463 -normal form, 463, 466 -normalizable, 463 -normalization theorem, 466 -reduction, 36, 398, 422, 424 n-step -, 425

Index of Subjects

P2-

-equivalence, 424 -normal, 463 -normal form, 463 -normalizable, 463 -reduction, 36, 422, 424 n-step -, 424 Pq-Church-Rosser , 577 Or-reduction, 603 big tree, 37, 473, 484, 519, 577, 600 big tree theorem, 38, 175, 485, 486, 591, 600, 601 binary predicate, 132 binary sum, 40 binary tree, 316 binary union, 311 binder, 922 binding abstractor, 407 binding influence, 408 binding instance, 318 binding occurrence, 406 binding variable, 176, 233 block, 15, 75, 843, 882 - opener, 76, 145, 882 - mechanism, 14 - structure, 53, 939 body of a line, 880 Bolzanc-Weierstrass theorem, 138 book, 28, 29, 74, 108, 144, 253, 474, 872, 879 Automath -, 127 correct -, 172 correct PAL -, 84 empty -, 894 - equality, 16, 19, 22, 41, 112, 154, 159, 219 MV -, 879, 891, 911 nested -, 79 valid -, 891, 894 zero abstraction index -, 294 bookkeeping pairs, 601, 607

1007 bool, 87 bool-style, 153, 213 boolean convolution, 950 borderline between language and metalanguage, 873 bound expression, 406 bound instance, 318 bound occurrence, 406 bound variable, 76, 89, 175, 375, 884 Boyer-Moore Theorem Prover, 12 Brouwer-Heyting-Kolmogorov interpretation, 236 de Bruijn index, 49, 809, 811 but for a-reduction, 418 calculated type, 31 Calculus of Constructions, 9, 10, 235 calculus of lambda conversion, 389 calculus ratiocinator, 3 Cambridge LCF, 9 CAML, 11 canonical type, 28, 39, 48, 539, 555 Cantor’s paradise, 205, 846 capacity, 606 Cartesian product, 131, 244, 736 case-construction, 245 category, 15, 48, 75, 76, 128 - of all propositions, 131 - of all types, 130 cc, 10 chain, 403 Characteristica Universalis, 3 chastity belt system, 223 checker, 156 checking, 142, 251, 337 Church’s thesis, 5 Church-numeral, 246 Church-Rosser, 326 h-,577 weak -, 494 - for hq, 596

Index of Subjects

1008

- property, 36, 123, 391, 472, 494 - for PI-reduction, 427

- theorem, 35, 155, 171, 371, 386,390,485, 655,663 Church-typing, 232 clash of variables, 605, 788 class, 372, 872 classical 17 rule, 133 classical logic, 133, 152, 236,866 classical mathematics, 133 classical real analysis, 136 clause, 875,878, 885 clause of a line body, 889 closed expression, 406 closure, 11, 40,418,519,655,676 - for AUT-II, 629 - for Pv-AUT-QE, 537 - for P@-AUT-QE+, 543 - for A, 596 - proofs for simpler languages, 551 - property, 37, 123, 173, 473, 517 - theorem, 155,483 combinatorics, 138 combinatory logic, 177 comment, 739 comment line, 739 common reduct, 173 compatibility condition, 180 compatibility of def and typ, 523, 595 compatible, 231 complete linear order, 139 complete ordered field, 139 completion, 82 complex, 432 composite &reduction, 417 compound notion, 76 comprehension, 136

computability, 5, 489,647 computability under substitution, 648 computable functions, 229 computer program semantics, 843, 863 computer programming, 858 concatenation, 54,954 condition, 875 confluent, 494 confusion of variables, 415 conjunction, 132 conservative extension, 544 constant, 60,230, 377,471, 883 - at infinity, 949 - function, 756 - symbol, 474 constructibility, 51 construction, 470 construction irrelevance, 288 constructive existence, 202 constructive reasoning, 167 constructive validity, 25 constructivist, 87 constructivity, 50 Constructor, 11 content, 253 context, 15, 28, 77, 103, 104, 144, 222, 233, 253, 879 E-, 360 assumptional - item, 880, 885 declarational - item, 880,885 empty -, 128,880 - extension, 734 - indicator, 75, 734 - item, 879,885 - line, 128,265, 734 - mechanism, 14 renaming of -s, 581 valid -, 891,892 variable of a -, 883,884 continuity, 44,748

Index of Subjects continuous, 965 continuum problem, 221 contractum, 179 contradiction, 28, 45, 236, 708 conversion, 28, 390 a-, 116 modulo -, 175 p -, 421 calculus of lambda -, 389 - rule, 234 type -, 308, 530 convertibility, 179 conveyor belt, 209 coq, 11 correct, 372 - book, 172 - PAL book, 84 - expression, 172 - formula, 172 - term, 34 correctness, 172, 263, 327, 328 algorithmic - check, 329 degree -, 307, 312 degree norm -, 593 mathematical -, 166 - in h, 592 - in AUT-QE, 119 - of a 9-formula, 524 - of an E-formula, 524 - of a category, 524, 528 - of an expression, 523, 800 - of a line, 802 partial -, 54, 956 program -, 53 semi -, 333 substitutivity of -, 597 total -, 54, 958 - of strings, 801 - of types, 597 CR for &-reduction, 427, 436 CR for ?-reduction, 436

1009 CR for full 07-reduction, 581 criteria for a good notation, 376 cube of typed lambda calculi, 11 Curry-Howard isomorphism, 235 Curry-typing, 232 d-system, 620 data bank, 164 data type, 10, 53, 938 daughter, 738 dead end set, 639 decidability, 37, 102, 173, 265, 472, 518, 554, 569 feasible -, 18, 25, 167, 173 formal -, 25, 173 decidable, 485 deciding @formulas, 124 decision procedure, 172, 555 declarational context item, 880, 885 declarational item, 879 decomposition, 417, 439, 571 defined constant, 493 defined constant-expression, 493 definiendum, 735 definiens, 735 defining line, 734 definite article, 920 definition, 14, 76, 88, 202, 225, 241, 735, 875, 876 algorithmic - , 172, 517, 554, 558, 563, 591 E-, 39, 172, 517, 554 inductive -, 402 language -, 872 - line, 128 - scheme, 493 unfolding a -, 242 definitional, - constants in h, 620 - equality, 19, 22, 28, 83, 90, 108, 133, 154, 219, 257, 281,

Index of Subjects

1010 394,494, 796

- extension, 185,522, 544 - line, 146

- line body, 886

- reduction, 47 degree, 16, 29, 32, 103, 130, 148, 181,283,307,320-322, 324, 393,450 argument -, 186, 525 - correctness, 307,312 domain -, 186, 525 function -, 185, 525 higher -, 148 - norm, 593 - norm correct, 591 - norm correctness, 593 value -, 185,525 6-equality, 107 -reduction, 39, 50, 154, 219, 256,493, 793, 794 -string, 345 -lambda, 327 A, 36,40,397 -constructible, 409 Ah, 33,313,327 denotational semantics, 943 dependent product, 234 derivation rule, 154 derivation step, 402 derivative, 137, 744,751,753,756 derived rule, 897 descendant, 738 despecify, 923 despo, 923,925 Dialectica interpretation, 9 diamond property, 123 didactics, 251 difference quotient, 744, 750 differentiable, 745 differentiation, 44,733,744,750,756

direct consequence, 417 disjoint one-step i-reduction, 496 disjoint one-step reduction, 527 disjoint reduction, 494 disjoint sum, 132,244, 736 disjoint union, 32,304 disjunction, 28,305 distinction between replacement and substitution, 605 distinctly bound, 397,407 domain, 126,232 - degree, 186,525 - function, 561 mechanical -, 795 - of a term, 48 preservation of -s, 596 Q-, 453 uniqueness of -s, 126,174,519, 535 extended -, 519,535 double negation axiom, 236 double negation law, 216, 728, 748 dummy, 231,318, 883,884 dummy-binding, 376 EB-line, 707 ECC, 11 Edinburgh LCF, 9 E-definition, 39, 172, 517, 554 - for A, 533 E-formula, 116,119, 177,517,524 elementary &reduction, 416 elementary PI-reduction, 424 elementary Pz-reduction, 424 elementary q-reduction, 439 elementary tc-reduction, 443 elementary mathematics, 143 elimination of primitive constants, 616 elimination rule, 234 embedding, 41 empty block opener, 109

Index of Subjects empty book, 894 empty context, 128, 880 empty line, 739 end-point, 316 environment, 49, 817 €-reduction, 40, 304, 493 &,It -reduct ion, 311 equality, 46, 135, 293, 708, 900 Q-, 107 0-, 107, 108 book-, 16,19,22,41,112,154, 159, 219 definitional -, 19, 22, 28, 83, 90, 108, 133, 154, 219, 257, 281, 394, 494, 796 extended -, 583 6-, 107 rj-, 107, 108 intensional -, 192 left hand - rule, 178, 536 - of booleans, 41 - of elements, 41 - of proofs, 306 - on types, 46 right hand - rule, 178 equivalence, 327 equivalence proof, 554, 563 equivalent, 172 77--equality, 107, 108 -reduction, 39, 43, 47, 48, 288, 382, 390, 726, 791, 792 n-step -, 440 T!-reduction, 441 k-fold -, 441 qd-system, 620 excerpt, 45, 48 excluded middle, 205 excluded third, 45, 216, 285 existence, 93 existential quantification, 132, 748

1011 existential quantifier, 237 existential type, 246 expert system, 865 explicit substitution, 50 explicit typing, 232 exponential function, 138 expression, 28, 59, 254, 402, 736, 875 1-, 258, 371 2-, 258, 371 3-, 258, 371 4-, 722 lp-, 706 It-, 706 2p-, 706 2t-, 706 3 p , 706 3t-, 706 abbreviating -, 737 abstraction -, 129, 178, 254 application -, 129, 178, 255, 736 bound -, 406 closed -, 406 correct -, 172 defined constant -, 493 fix -, 736 head -, 254, 736 inhabitable -, 307 lambda -, 736 legal -, 233 legitimate -, 452, 482 name carrying -, 380 NF -, 172, 379 normable -, 507 p, 20, 130 n-, 736 plus -, 493 primitive constant -, 493 pseudo -, 233 quasi -, 114, 149, 286 saturated -, 59 C-, 736

1012 t-, 20, 130 ext-postponement, 499 ext-reduction, 493, 496 extended definitional equality, 583 extended reduction, 583 extended system, 24 extended typed /\-calculus, 168, 303 extended uniqueness of domains, 519, 535 extension, 172, 544 definitional -, 185, 522, 544 unessential -, 185 extensional reduction, 175, 493 extensionality, 47, 136, 192 extensions of Automath, 98 exterior approach, 864 external reference, 322 factor, 404 failure of &-SN, 652 feasibility, 21, 24 feasible decidability, 18, 25, 167, 173 field, 139 finite product, 32 finite sum, 32 first-order language, 158 first-order system, 114, 637 fix expression, 736 fix symbol, 735 fixed point, 965 fixed point semantics, 54 flag, 891 flagless form, 881 flagstaff, 891 flagstaff form, 52, 881, 891 FOL, 166 formal decidability, 25, 173 formula, 875 correct -, 172 E-, 177 Q-, 177

Index of Subjects formulae-as-types, 8, 199, 393, 469 fourth degree identification, 283 fragment p-, 196 t-, 189 free occurrence, 406 free variable, 76, 118 fresh, 884 fresh identifier, 883 fresh variable, 412 function, 17, 231, 389, 908 - abstraction, 231 - application, 231 - degree, 185, 525 - like, 113 - type, 17 type-valued -, 131 - value, 17, 389 functional abstraction, 90 functional binder, 923 functional interpretation, 111 functional interpretation of logic, 19 fundamental rule, 897 y-equivalence, 430 y-type, 357 Godel’s general recursive functions, 5

general language rules, 177 general reduction, 446 generalized - Cartesian product, 239 - conjunction, 132, 711 - functionality, 25 - if-then-else, 711 - logic, 171 -implication, 131, 197, 704, 711 - product, 17, 40, 234 - sum, 32, 40 - typed A-calculus, 40, 168 generate, 402, 417, 424, 439

Index of Subjects

generic form, 494 geometrical construction, 50,54?226,

843,850,960 Girard’s paradox, 8 gL, 874 GOAL, 167 grains of salt, 927,931 grammatical category, 876 graph reduction, 177 Grundlagen, 157 Hall-Konig theorem, 138 hardware verification, 12 head expression, 254, 736 head reduction, 571 heading, 739 Heine-Bore1 theorem, 138 high typing, 871, 877 higher degree, 148 higher mathematics, 143 higher order language, 158,187 Higher Order Logic, 12 higher order system, 200 higher order typing, 50 Hilbert operator, 93,728 Hilbert’s &-operator, 152 Hilbert’s axiomatization of geometry, 853,922 Hilbert’s axioms, 887 Hilbert’s program, 5 Hilbert’s selection operator, 205 HOL, 12 identifier, 15, 58, 75, 76,735, 883 identity - function, 758 syntactic -, 175 IEreduction, 493,496, 634 if-then-else, 41, 54,711 illative combinatory logic, 195 immune form, 571,638 imMV, 874

1013 implantation, 32! 322 implementation, 809 - of substitution, 809,817 implication, 41,45,91,132,152,153,

205, 211, 236 generalized -, 197 implicit typing, 232 impredicativity, 8 improper reduction, 585,632 improper symbol, 401 improved dead end set, 641 incomplete information, 53,943 incompleteness theorem, 12 increasing reduction, 36 indicator, 15, 75-77 - string, 79 individual, 45, 136,708 - variable, 401 induction, 46 - on p , 508 - on reducts, 598 - on subexpressions, 598 - on the length of proof, 402 inductive definition, 402 Inductive Definitions, 11 ineffective P-chain, 464 inference rule, 87 infinite binary tree, 315 inhabitability condition, 307 inhabitable, 186,309 - degree condition, 523 - expression, 307 inhabitant, 17 inhabited, 235 injection, 32,40,304,493 instantiate, 129 instantiation, 149,180,193,222,308 - condition, 593 integers, 137 integrated, 938 integration, 227

Index of Subjects

1014 intensional equality, 192 interactive program. 47 interior approach, 864 internal reference, 322 internalization, 218 interpretation, 143 interpretation-oriented meta-MV, 874 introduction of a variable, 240 introduction rule, 234 introduction-elimination reduction, 493 introduction-elimination rule, 634 intuitionism, 205, 236 intuitionistic Irule, 133 intuitionistic logic, 236 intuitionistic reasoning, 41 intuitionistic type theory, 8,25, 230 inverse mapping theorem, 138 irrelevance of objects, 134 irrelevance of proofs, 20,29,43,132, 133, 169,710,722,724 justification, 240 ereduction, 443 Konig’s lemma, 968 kind, 236 knowledge frame, 328 label, 316,885 labeling, 317 lambda abstraction, 18 Lambda Automath, 393 lambda equivalence, 399,447 lambda expression, 736 lambda notation, 389 lambda phrase, 403 lambda phrase chain, 403 lambda term, 231 lambda tree, 32, 317 A, 40, 186,314, 393, 397, 452, 473, 590,591 A,, 41, 655,673

Aq, 591 Aqc, 616 Avdr 620 Ac, 616 Ad, 620 A-Automath, 275 A-Calculus, 5, 229 arithmetical typed -, 168 cube of typed -, 11 extended typed -, 168,303 generalized typed -, 39, 168 A-typed -, 313 name-free -, 156,813 polymorphic -, 9, 193 polymorphic predicate -, 10,167 pure typed -, 168 second order -, 230, 235 typed -, 232,845 untyped -, 230 A-definability, 5 A-definable functions, 5 A-typed lambda calculus, 313 A-SEMIPAL, 146 AV, 340 A+, 34 A+-Church, 34 AX, 38, 175, 185,469, 601 AX-1, 185,472 AX-p, 486 AX-theory, 471,478 Xu, 33,339, 340 ATU, 340, 354 A(-term, 343 language, 143 -, 185 non -, 525 closure proofs for simpler -s, 551 - definition, 872 first order -, 158 general - rules, 177

+

Index of Subjects higher order -, 158, 187 meta -, 4, 143, 208, 873 object -, 4 programming - semantics, 23, 160 regular -, 181, 525 specification -, 865 superimposed -, 97 - theory, 155, 171, 172 type in a programming -, 244 large category, 130, 134 lazy evaluation, 49 LCF, 9, 167 left hand equality, 519 - rule, 178, 535 left projection, 736 legal expression, 233 legitimate expression, 452, 482 legitimate Q-application, 462 legitimate term, 38, 39, 472 LEGO, 11 length, 402 length of proof, 424 let-construction, 28, 244 level of a variable, 379 lexicographical order, 321 library, 251 life without types, 890 limit, 743 line, 28, 108, 128, 253, 734, 879 linear order, 139 list, 243 literary replacement, 513, 605 local P-reduction, 242, 244, 325, 382 local reduction, 32 logic, 268, 688, 706, 721, 909 classical -, 236 combinatory -, 177 functional interpretation of -, 19 generalized -, 171

1015 illative combinatory -, 195 intuitionistic -, 236 minimal predicate -, 166 predicate -, 236 propositional -, 236 Logic for Computable Functions, 9 logical constant, 241 Logical Framework, 10 logical paradox, 4 loops, 863 loss factor, 23, 44, 160 low typing, 877 machine verification, 18 macro-operation, 60 main line, 328 main reduct, 572 main reduction, 506 many-step reduction, 122 Mascheroni constructions, 863 mathematical correctness, 166 Mathematical Vernacular, 23, 27, 52, 161, 211, 224, 865 mathematics produced in Automath, 159 mechanical domain, 795 mechanical type, 31, 125 memory, 48 meta language, 4, 143, 208, 873 meta-MV, 874 meta-typing, 871 metalingual discussion, 376 metric space, 138 micro-operation, 61 mimicking, 159 mini-reduction, 33, 242, 326 minimal logic, 132 minimal predicate logic, 166 mixed string, 401 MIZAR, 12 ML, 9, 167, 230

1016 mMV, 874 mock typing, 150, 289 modified parametrized constant, 883 modulo a-conversion, 175 modulo a-reduction, 493 Modus Ponens, 45,91,214, 236,917 monotonic functional, 666 monotonicity, 390 monotonous, 231 monotony rule, 416, 425, 430, 439, 443,447 more-step reduction, 494 mother, 738 multi-step proof, 152 multiple P-reduction, 382, 384 multiple substitution, 39, 49, 501, 512, 815 MV, 52, 865, 874 - book, 879, 891, 911 name, 52, 253, 266, 376, 875-877 -carrying expression, 380 - clash, 33, 35, 47, 156 - of the proof, 47 named variable, 35 name-free, 35, 379 - A-Calculus, 156, 813 - notation, 34, 231, 342 - variable, 25, 343 nameless dummy, 33, 343, 375 nameless variable, 40, 49, 50, 656, 811 natural deduction, 14, 238, 721, 875, 916 natural language, 927 natural number, 46, 137, 241 nearness, 742 Nederpelt’s norm, 278 negation, 28 nested book, 79 nested one step reduction, 663

Index of Subjects nested reduction, 428 new clause of a line, 889 NF expression, 379 non-+-language, 525 non-termination, 53, 54, 940, 947 nonempty, 41 norm, 34, 37,371, 373,456, 507, 664 -correct, 331, 334 normability, 40 normable, 41, 331, 601 - expression, 507 - term, 664, 666 normal, 460 - reduction, 572 - term, 664 normal form, 82, 155, 173, 277, 281, 371, 391, 456, 460 uniqueness of -s, 173 - theorem, 155, 373 normalizable, 460 normalization, 123, 173, 391 - for 0-reduction, 508 - property, 494 strong -, 29, 36,37, 39-41, 123, 173, 391, 463, 472, 649, 655, 664 - theorem, 463 weak -, 34, 39 norming functional, 41, 664 notation rule, 401 Kuprl, 9, 230 object, 128, 130, 878 - language, 4 - name, 76 observability, 51, 850, 854, 861 occurrence, 401 old, 880 old clause of a line, 889 OMV, 874 one-step 0-reduction, 231

Index of Subjects one-step preservation of types, 534 one-step reduction, 121,493 order, 441 order-completeness, 137 ordered field, 139 osmosis, 202, 223 outer shape lemma, 506 p-expression, 20, 130 p-fragment, 196 p-part, 25 p-reduction, 634 pair, 31, 131,244,304,493, 736,907 pair rule, 310 pairing, 40 PAL, 15, 74,79, 146, 148,852 PAL-FT, 146, 147 paradox, 4,208 paragraph, 701 - closing line, 738 - indicator, 738 - line, 734, 737 - marker, 45 - opening line, 738 - reopening line, 738 - system, 44,48,110,147,156, 802 parameter, 128 parametrized constant, 883 parsing, 876,883,926,934 Part P,25 t-, 25, 191 partial correctness, 54,956 partial function, 137, 709, 724, 733, 742,744 Peano’s axioms, 137,241, 846,887 permissible, 449 permutative reduction, 632,634 phrase, 875 ?r-

1017

n-

-reduction, 40, 304, 493, 607 -type, 358

-expression, 736 -operator, 289 -type, 40 platonism, 203, 217,220,878 plus-expression , 493 pMV, 874 PN, 253 PN-line, 16,43, 146, 707 pointed flag, 882,885 polymorphic A-calculus, 9,193 polymorphic predicate A-calculus, 10, 167 polymorphism, 28, 243 positive logic, 851 postponed substitution, 176 postponement, 39,498 - of 1.)-reduction,399,442 power series, 44, 138 powertype, 21, 136 PPA, 10, 167 predicate, 41,93, 132,135, 196,875 predicate logic, 236 predicativity, 9 preservation - of domain, 596 - of types, 174,310, 519,834 - of C u t Y p , 540 - of typ, 596 - of typ*, 596 primary MV, 873 primitive constant-expression, 493 primitive line body, 886 primitive notion, 17, 76, 104, 109, 241 primitive notion line, 128, 734 primitive program, 952 primitive program construct, 953 principal type scheme, 230,232

1018 procedure, 54 processing, 143 processor, 73, 96, 570 product, 28, 45 - formation, 305 - type, 17, 233, 306, 708 program, 279, 951 - abortion, 54 - correctness, 53 - specification, 951 -to-program function, 954 programming language semantics, 23, 160 programming variable, 937 projection, 32, 304, 493 - function, 244 - of pairs, 40 - rule, 310 proof, 88, 128, 131, 242, 251, 919 - by cases, 966 - checking, 166, 167 - class, 211 - irrelevance, 22, 159 - object, 235 - type, 152, 153 proofs-as-objects, 5, 211 prop-inclusion, 114 prop-style, 153, 213 prop-type, 235 propagation, 525 proper identifier, 76 proper reduction sequence, 122, 585 proper subexpression, 403, 493 proposition, 87, 131, 153, 240, 872, 875 propositional logic, 236 propositional variable, 153 propositions-as-types, 5, 16, 18, 22, 27, 41, 111, 150, 168, 196, 198, 211, 235 pseud+expression, 233

Index of Subjects PTS, 11, 27, 233 PTS-rules, 37 pure system, 24, 517 Pure Type System, 11, 27, 233 pure typed A-calculus, 168 Q-applicable, 452 Q-domain, 452 Q-function, 452 @formula, 116, 120, 177, 517, 524 &propagation, 308, 529 quadruple, 53 quantification, 59. 106, 185, 396, 923 quantifier, 135, 225 quasi-expression, 114, 149, 286 quasi-type, 358 quasi-variable, 940 ramified theory of types, 4 rationals, 137 real analysis, 21, 733 realizer, 196 reals, 137 reasoning, 85, 150 rectangular flag, 882, 885 recursion, 21, 28, 53, 246, 963 recursive algorithm, 572 recursive procedure, 942 redex, 179 reduction, 28, 155, 390, 446 +-, 40, 493 +’-, 311 Q-, 47, 413, 790 single-step -, 414 modulo -, 493 p-, 47, 49, 122, 242, 257, 288, 326, 382, 386, 390, 417, 789 composite -, 417 elementary -, 416 local -, 325 multiple -, 382, 384 n-step -, 417

Index of Subjects one-step -, 231 single-step -, 416 PI--, 36, 398, 422, 424 elementary -, 424 n-step -, 424 CR for -, 427, 436 single-step -, 424 P2-, 37, 423, 425 elementary -, 424 n-step -, 424 single-step -, 424 PT-, 603 CR for ,&-, 581 definitional -, 47 delta -, 219 6--, 39, 50, 154, 219, 256, 493, 793, 794 disjoint -, 496 disjoint one-step i-, 496 disjoint one-step -, 527 E-, 40, 304, 493 Ea1t-r 311 7-, 39, 43, 47, 48, 288, 382, 390, 726, 791, 792 elementary - 439 n-step - 439 restricted - 578 single-step -, 439 ?!-, 441 k-fold - 441 extensional -, 175, 493 ext -, 493, 496 extended -, 583

Y-

CR for -, 436 single-step -, 429 graph - , 177 head -, 571 IE-, 493, 496, 634 improper -, 585, 632 increasing -, 36

1019 introduction-elimination -, 493 6-, 443 elementary -, 443 single-step -, 443 local -, 32 main-, 506 many-step -, 122 mini-, 33, 242, 326 more-step -, 494 - of order p , 441 nested one-step -, 663 nested -, 428 single-step -, 428 normal -, 572 P-, 634 permutative -, 632, 634 A-, 40, 304, 493, 607 r-, 601 rst-, 601 rt-, 601 9-, 601 - sequence, 122, 173, 390 proper -, 122, 585 U-, 40, 304, 493 single-step -, 446 - step, 173 - strategy, 125, 173, 570 t-, 601 twin -, 495 - under substitution, 39, 503, 505 redundancy, 167 reference, 814 - depth, 176, 378 - mapping, 34, 344, 354 - number, 33, 35, 343 - transforming mapping, 177 reflexivity, 136 refmap, 354 refuser, 940, 972 regular language, 181, 525

1020 regular system, 517 relation, 132 relational semantics, 53, 938 relative addressing, 49 remark, 739 renaming, 48, 375 - of contexts, 581 renovation, 411 reopening of a paragraph, 46 replacement, 411 - property, 606 - theorem for P ~ T - S N , 621 - theorem for PT-SN, 606 restricted q-reduction, 578 pnormable, 399, 458, 460 pA-normable, 458 ptype, 360 right hand equality rule, 178 right projection, 736 root, 316 rule of the excluded third, 41 rules of grammar, 872 runtime, 947 saturated expression, 59 scar, 422 scheme, 193 second order lambda calculus, 230, 235 secondary MV, 873 segmap, 350 segment, 23, 33, 241, 339, 345 - calculus, 44 - mapping, 350 semantically equivalent, 952 semantics, 171, 859, 960 -of computer programs, 51, 54 - of programs, 937 semicorrectness, 333 SEMIPAL! 15, 74, 81, 146 sentence, 52, 872, 875

Index of Subjects sequential composition, 53, 54 set, 41, 45, 136, 240, 709, 871, 904 - extensionality, 136 - theory, 50, 138, 841 - type, 236 shape, 571, 786 shorthand facility, 110 C-expression, 736 o-reduction, 40, 304, 493 C-type, 11, 40, 246 similarity, 431 simple replacement, 411 simple theory of types, 5 simple type, 34 simple type theory, 4 simultaneous substitution, 118 simultaneous substitution theorem, 5 14 single line, 29, 32, 40, 590 single line Automath, 590 single substitution, 49 single-step a-reduction, 413 single-step P-reduction, 416 single-step PI-reduction, 424 single-step ,&-reduction, 424 single-step q-reduction, 439 single-step ?-reduction, 429 single-step &-reduction, 443 single-step nested reduction, 428 single-step proof, 152 single-step reduction, 446 skip line, 734, 738 smMV, 874 sMV, 874 sort, 234 sound applicability, 519, 596 soundness of applicability, 535 specification, 53 - language, 865 square brackets lemma, 503,505,510 square brackets lemma for >or, 610

Index of Subjects

stack, 245, 939 standardization, 391 - theorem, 503 Stanford LCF, 9. state space, 937 state transformation, 939 statement, 233, 872, 875, 876 strategy, 156 strengthening, 308, 613 - rule, 521, 525 string, 44, 158 strong ,@normalizability, 466 strong &normalization, 509 strong &normalization theorem, 468 strong PI-normalizability, 466 strong PI-normalization theorem, 467 strong Pz-normalizability, 466 strong ,&-normalization theorem, 466 strong 7-normalizability, 466 strong q-normalization theorem, 468 strong existence, 134 strong normal form theorem, 155 strong normalizability, 468 strong normalization, 29, 36, 37,3941, 123, 173, 391, 463, 472, 649, 655, 664 - property, 494 - theorem, 468 strongly normalize, 123 structure of line bodies, 886 structure sharing, 49, 809, 817 subdivided lambda tree, 328 subexpression, 403, 493 subroutine, 858, 863 substantive, 52,210,870, 871, 875877 sub-, 870, 897 substitution, 14, 28, 47, 49, 51, 59, 89, 118, 129, 380, 414, 809, 815 - lemma, 41

1021 - lemma for

P-N,

509

postponed -, 176 - theorem for P-SN, 509 - theorem for Pr-SN, 611 substitutivity, 136, 747 - of correctness, 597 subtype, 41, 45, 708 successor, 137, 241, 246 sugaring, 226 sum, 28 - rule, 310 - type, 304 superimposed language, 97 supertype, 114, 236, 303, 470 suppression mechanism, 167 surjectivity of pairing, 40 syllogism, 3 symmetry, 747 syntactic identity, 175, 493 syntactic similarity, 583 syntactic variable, 401 syntax, 54, 960 syntax checker, 571 syntax-oriented meta-MV, 874 system F, 9, 230, 235 t-expression, 20, 130 t-fragment, 189 t-part, 25, 191 tail, 405 r-expansion, 607 r-redex, 603 taxonomy of type systems, 229 teaching, 223, 224 telescope, 11, 21, 44, 139, 158, 224, 729 telescopic mapping, 11 term, 390 termination of verification algorithm, 573 text, 872

1022 theorem, 88, 241, 875 theorem proving, 167 theory of real numbers, 733 Theory of Types, 8 time space, 53 to fit in, 650 total correctness, 54, 958 transitivity, 747 translation, 711 translator, 570, 786 tree, 77, 314 tree of knowledge, 78 truth, 747 truth value, 916 twin case, 496 twin occurrence, 495 twin reduction, 495 type, 15, 32, 76, 128, 130, 210, 232, 258, 395, 449, 708, 735 $-, 304 abstract data -, 28, 245 anonymous arche-, 871 arche-, 205, 871, 898 assertion -, 688, 722 - assignment, 179, 478 calculated -, 31 canonical -, 28, 39, 48, 539, 555 category of all -s, 130 - check list, 330 - conversion, 308, 530 correctness of -, 597 data -, 10, 53, 938 equality on -s, 46 existential -, 246 extended -d A-calculus, 168,303 function -, 17 y-, 357 - in a programming language, 244 - inclusion, 19, 25, 30, 32, 39,

Index of Subjects 114, 150, 184, 285, 289, 305, 314, 335, 470, 479, 483, 531, 538, 651 intuitionistic - theory, 8, 25, 230 - label, 493, 497 -d lambda calculus, 313, 845 lambda -d lambda calculus, 313 mechanical -, 31, 125 - of a lambda tree, 320, 323 - of pairs, 131

II-, 40 358 power-, 21, 136 preservation of -s, 174,310, 519, 534 one-step -, 534 principal - scheme, 230, 232 product -, 17, 233, 306, 708 proof -, 152, 153 prop-, 235 quasi-, 358 ramified theory of -s, 4 - reduction, 285 - restriction, 50 P-, 360 -d set theory, 871 set-, 236 C-, 11, 40, 246 simple theory of -s, 5 simple -, 34 simple - theory, 4 - structure, 469 sub-, 41, 45, 708 sum-, 304 super-, 114, 236, 303, 470 - system, 229 taxonomy of - systems, 229 - theory, 5, 229 ultimate -, 19 uniqueness of -s, 11, 19, 102, T-,

Index of Subjects 174, 178, 306, 312,472, 519, 535, 869 - valued function, 131, 303 typing, 232, 449, 897 Church-, 232 Curry-, 232 explicit -, 232 - function, 554 high -, 871, 877 higher order -, 50 implicit -, 232 low -, 877 meta -, 871 mock -, 150, 289 - operation, 50 - operator, 260 ultimate -, 19 typographical abbreviation, 224, 905, 910, 921, 925 ultimate type, 19 understanding, 143 unessential extension, 185, 521, 522, 544 unfolding a definition, 242 unification of mathematics, 849 uniqueness - of domains, 126, 174, 519, 535 extended -, 519, 535 - of normal forms, 123, 173, 392 - of types, 11, 19, 102, 174, 178, 306, 312, 472, 519, 535, 869 - quantifier, 136 universal generator, 391 universal quantification, 132,290, 748 universal quantifier, 237 unstability, 174 update function, 34

1023 updating, 814

val, 908 valid, 60, 81, 890 - book, 891, 894 - clause, 891: 892 - context, 891, 892 - inference, 3 validity, 109 valuation, 423 value degree, 185, 525 variable, 230, 377, 402, 843, 875, 883 binding -, 176, 233 bound -, 76, 89, 175, 375, 884 clash of -s, 605, 788 confusion of -s, 415 free -, 26, 118 fresh --, 412 individual -, 401 introduction of a -, 240 level of a -, 379 name-free -, 25, 343 named -, 35 nameless -, 40,49, 50, 656, 811 - of a context, 884 programming -, 937 propositional -, 153 quasi -, 940 segment -, 33, 346 syntactic -, 401 verification, 23, 155, 556, 569, 805 - algorithm, 572 - of E-formulas, 574 - program, 47-49, 570 verifying program, 170,783,805,809 vernacular, 865 vicious circle, 4 waiting list, 328 weak ij-postponement, 494 weak 6-advancement, 500 weak Church-Rosser, 494

1024 weak disjunction, 134 weak existence, 20, 134 weak functional behaviour, 34 weak normalization, 34, 39 weakening, 527, 581 weight, 348,352 where-construction, 28, 244 while-statement, 54,945,955 Wiener Kreis, 203 word, 875 WOT, 161, 211 young, 880 Zermelo-Fraenkel axioms, 51, 846 Zermelo-Fraenkel set theory, 50,866 zero abstraction index book, 294 Zorn's lemma, 138

Index of Subjects

Selected Papers on Automath (Studies in Logic and the Foundations of Mathematics)

Selected Papers on Automath (Studies in Logic and the Foundations of Mathematics)

Selected Papers on Automath (Studies in Logic and the Foundations of Mathematics)