Computation and Deduction

Frank Pfenning Carnegie Mellon University

Draft of February 27, 1997

Draft notes for a course given at Carnegie Mellon University during the fall semester of 1994. Please send comments to fp@cs.cmu.edu. Do not cite, copy, or distribute without the express written consent of Frank Pfenning and the National Football League.

Copyright \begin{matrix}c \\ ◯ \end{matrix} Frank Pfenning 1992–1997 ii

Contents

1 Introduction 1 1.1 The Theory of Programming Languages . . . . . . . . . . . . . . . . 2 1.2 Deductive Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.3 Goals and Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

2 The Mini-ML Language 9 2.1 Abstract Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 2.2 Substitution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.3 Operational Semantics . . . . . . . . . . . . . . . . . . . . . . . . . . 13 2.4 A First Meta-Theorem: Evaluation Returns a Value . . . . . . . . . 17 2.5 The Type System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 2.6 Type Preservation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 2.7 Further Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 2.8 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

3 Formalization in a Logical Framework 37 3.1 The Simply-Typed Fragment of LF . . . . . . . . . . . . . . . . . . . 38 3.2 Higher-Order Abstract Syntax . . . . . . . . . . . . . . . . . . . . . 40 3.3 Representing Mini-ML Expressions . . . . . . . . . . . . . . . . . . . 45 3.4 Judgments as Types . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 3.5 Adding Dependent Types to the Framework . . . . . . . . . . . . . . 53 3.6 Representing Evaluations . . . . . . . . . . . . . . . . . . . . . . . . 56 3.7 Meta-Theory via Higher-Level Judgments . . . . . . . . . . . . . . . 63 3.8 The Full LF Type Theory . . . . . . . . . . . . . . . . . . . . . . . . 71 3.9 Canonical Forms in LF . . . . . . . . . . . . . . . . . . . . . . . . . . 74 3.10 Summary and Further Discussion . . . . . . . . . . . . . . . . . . . . 76 3.11 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 4 The Elf Programming Language 81

4.1 Concrete Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 4.2 Type and Term Reconstruction . . . . . . . . . . . . . . . . . . . . . 84 4.3 A Mini-ML Interpreter in Elf . . . . . . . . . . . . . . . . . . . . . . 88 4.4 An Implementation of Value Soundness . . . . . . . . . . . . . . . . 97 4.5 Dynamic and Static Constants . . . . . . . . . . . . . . . . . . . . . 101 4.6 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

5 Parametric and Hypothetical Judgments 107 5.1 Closed Expressions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 5.2 Function Types as Goals in Elf . . . . . . . . . . . . . . . . . . . . . 118 5.3 Negation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 5.4 Representing Mini-ML Typing Derivations . . . . . . . . . . . . . . . 123 5.5 An Elf Program for Mini-ML Type Inference . . . . . . . . . . . . . 127 5.6 Representing the Proof of Type Preservation . . . . . . . . . . . . . 133 5.7 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

6 Compilation 145 6.1 An Environment Model for Evaluation . . . . . . . . . . . . . . . . . 146 6.2 Adding Data Values and Recursion . . . . . . . . . . . . . . . . . . . 158 6.3 Computations as Transition Sequences . . . . . . . . . . . . . . . . . 168 6.4 Complete Induction over Computations . . . . . . . . . . . . . . . . 180 6.5 A Continuation Machine . . . . . . . . . . . . . . . . . . . . . . . . . 181 6.6 Relating Relations between Derivations . . . . . . . . . . . . . . . . 192 6.7 Contextual Semantics . . . . . . . . . . . . . . . . . . . . . . . . . . 194 6.8 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199

7 Natural Deduction 205 7.1 Natural Deduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206 7.2 Representation in LF . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 7.3 Implementation in Elf . . . . . . . . . . . . . . . . . . . . . . . . . . 224 7.4 The Curry-Howard Isomorphism . . . . . . . . . . . . . . . . . . . . 229 7.5 Generalization to First-Order Arithmetic . . . . . . . . . . . . . . . 233 7.6 Contracting Proofs to Programs^{∗} . . . . . . . . . . . . . . . . . . . . 239 7.7 Proof Reduction and Computation^{∗} . . . . . . . . . . . . . . . . . . 241 7.8 Termination^{∗} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241 7.9 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241

8 Logic Programming 243 8.1 Uniform Derivations . . . . . . . . . . . . . . . . . . . . . . . . . . . 244 8.2 Canonical Forms for the Simply-Typed λ-Calculus . . . . . . . . . . 255 8.3 Canonical Forms for Natural Deductions . . . . . . . . . . . . . . . . 266 8.4 Completeness of Uniform Derivations . . . . . . . . . . . . . . . . . . 272 8.5 Resolution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279 8.6 Success and Failure Continuations . . . . . . . . . . . . . . . . . . . 286

9 Advanced Type Systems^{∗} 289 9.1 Polymorphism^{∗} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291 9.2 Continuations^{∗} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292 9.3 Intersection and Refinement Types^{∗} . . . . . . . . . . . . . . . . . . 292 9.4 Dependent Types^{∗} . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293

10 Equational Reasoning^{∗} 295 10.1 Cartesian Closed Categories^{∗} . . . . . . . . . . . . . . . . . . . . . . 295 10.2 A Church-Rosser Theorem^{∗} . . . . . . . . . . . . . . . . . . . . . . . 295 10.3 Unification^{∗} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295

Bibliography 296 vi CONTENTS

Chapter 7

Natural Deduction

Ich wollte zunächst einmal einen Formalismus aufstellen, der dem wirklichen Schließen möglichst nahe kommt. So ergab sich ein ,,Kalkül des natürlichen Schließens“.

— Gerhard Gentzen

Untersuchungen über das logische Schließen [Gen35]

In Chapter 2 we introduced the functional language Mini-ML. This language was defined by its type system and its operational semantics, both specified via deductive systems. The type system gives us a means to verify some properties of Mini-ML programs. Assume, for example, we can show that e : nat for some expression e. Then we know that if e evaluates to v (that is, e ↪ v is derivable) then v is a value by Theorem 2.1. We know furthermore that v : nat by type preservation (Theorem 2.5). It is then easy to show that v must have the form s (s … (s z) …). In other words, v must represent a natural number. As another example, consider an expression e of type nat → nat. Then e represents some partial function from natural numbers to natural numbers: for each argument v : nat the expression e v either evaluates to some v′ which represents a natural number or does not have a value. The uniqueness of v′ is the subject of Exercise 2.16.

The type system can only capture simple properties. It can express that some program e represents a partial function from natural numbers to natural numbers, but it cannot express which partial function. This simplicity has a great advantage: the question if an expression has a given type is effectively decidable, and thus a compiler can mechanically verify program properties expressed as types. In order to reason about more complex properties of programs within some formal system, we need a more expressive language of specifications and some way of connecting programs to the specifications they satisfy. Designing more expressive type systems, usually called type theories, is one path which is the subject of much current research. For some of these systems, type checking remains decidable; for others it becomes undecidable.

We will take a different path and consider predicate logic as a means of expressing specifications. The connection to programs will later be made via the so-called Curry-Howard isomorphism which interprets constructive proofs as programs and formulas as types. There are many ways a logical system can be specified, and relationships between them have been intensively investigated. The most important styles of presentation are axiomatic systems (often associated with Hilbert [HB34]), systems of natural deduction, and sequent calculi (the latter two are due to Gentzen [Gen35]). In an axiomatic system, the logic is described by some axioms and a minimal set of inference rules in order to derive new theorems from the axioms and prior theorems. Systems of natural deduction on the other hand try to explicate the meaning of the logical connectives and quantifiers by means of inference rules only. This is in the same spirit as the approach of LF whose design was based on natural deduction. Sequent calculi can instead be considered as calculi for proof search. For the investigation of the connections between proofs and programs a system of natural deduction is most appropriate.

In Chapter 8 we will have occasion to consider logic programming, which is based on a different computational mechanism than functional languages. Rather than evaluation via substitution, computation is based on the notion of search for a proof in a logic following a particular strategy. There, too, the system of natural deduction will be of great importance.

7.1 Natural Deduction

The system of natural deduction we describe below is basically Gentzen’s system NJ [Gen35] or the system which may be found in Prawitz [Pra65]. The calculus of natural deduction was devised by Gentzen in the 1930’s out of a dissatisfaction with axiomatic systems in the Hilbert tradition, which did not seem to capture mathematical reasoning practices very directly. Instead of a number of axioms and a small set of inference rules, deductions are described through inference rules only, which at the same time explain the meaning of the logical quantifiers and connectives in terms of their proof rules. This is often called proof-theoretic semantics, an approach which has gained popularity in computer science through the work of de Bruijn [dB80] and Martin-Löf [ML80, ML85a].

A language of (first-order) terms is built up from variables x, y, etc., function symbols f, g, etc., each with a unique arity, and parameters a, b, etc. in the usual way.

Terms t ::= x | a | f(t_{1}, …, t_{n})

A constant c is simply a function symbol with arity 0 and we write c instead of c(). Exactly which function symbols are available is left unspecified in the general development of predicate logic and only made concrete for specific theories, such as the theory of natural numbers. However, variables and parameters are always available. We will use t and s to range over terms.

The language of formulas is built up from predicate symbols P, Q, etc. and terms in the usual way.

Formulas A ::= P (t_{1}, …, t_{n}) | A_{1} ∧ A_{2} | A_{1} ⊃ A_{2} | A_{1} ∨ A_{2} | ¬A | ⊥ | ⊤
| ∀x. A | ∃x. A

A propositional constant P is simply a predicate symbol with no arguments and we write P instead of P (). We will use A, B, and C to range over formulas. Exactly which predicate symbols are available is left unspecified in the general development of predicate logic and only made concrete for specific theories.

The notions of free and bound variables in terms and formulas are defined in the usual way: the variable x is bound in formulas of the form ∀x. A and ∃x. A. We use parentheses to disambiguate and assume that ∧ and ∨ bind more tightly than ⊃. It is convenient to assume that formulas have no free individual variables; we use parameters instead where necessary. Our notation for substitution is [t/x]A for the result of substituting the term t for the variable x in A. Because of the restriction on occurrences of free variables, we can assume that t is free of individual variables, and thus capturing cannot occur.

The main judgment of natural deduction is the derivability of a formula C, written as ⊢ C, from assumptions ⊢ A_{1}, …, ⊢ A_{n}. We will model this as a hypothetical judgment. This means that certain structural properties of derivations are tacitly assumed, independently of any logical inferences.

Assumption. If we have an assumption ⊢ A than we can conclude ⊢ A. For example, ⊢ A by itself represents a deduction of ⊢ A from assumption ⊢ A.

Weakening. If ⊢ C is derivable from ⊢ A_{1}, …, ⊢ A_{n} then ⊢ C is also derivable from ⊢ A_{1}, …, ⊢ A_{n}, ⊢ A_{n+1}. Alternatively, we could say that assumptions need not be used. For example, ⊢ A by itself also represents a deduction of ⊢ A from assumptions ⊢ A and ⊢ B, even through B is not even mentioned.

Duplication. Assumptions can be used more than once.

Exchange. The order of assumptions is irrelevant.

In keeping with general mathematical practice in the discussion of natural deduction, we will omit the turnstile ⊢ and let a formula A itself stand for the judgment ⊢ A. It is important to keep in mind that this is merely a shorthand, and that we are defining a judgment via inference rules in the same manner as in earlier chapters in this book.

In natural deduction each logical connective and quantifier is characterized by its introduction rule(s) which specifies how to infer a conjunction, disjunction, etc.

The elimination rule for the logical constant tells us how we can assumptions in the form of a conjunction, disjunction, etc. The introduction and elimination rules must match in a certain way in order to guarantee the consistency of the system: if we introduce a connective and then immediately eliminate it, we should be able to erase this detour and find a more direct derivation of the conclusion. The rules are summarized on page 7.1.

Conjunction. A ∧ B should be derivable if both A and B are derivable. Thus we have the following introduction rule.

\begin{aligned}A B \\ & ∧I \\ A ∧ B \end{aligned}

If we consider this as a complete definition, we should be able to recover both A and B if we know A ∧ B. We are thus led to two elimination rules.

\begin{aligned}A ∧ B \\ & ∧E_{L} \\ A \end{aligned}  \begin{aligned}A ∧ B \\ & ∧E_{R} \\ B \end{aligned}

To check our intuition we consider a deduction which ends in an introduction followed by an elimination:

\begin{aligned}\begin{matrix}D \\ A \end{matrix} & & \begin{matrix}E \\ B \end{matrix} \\ & & & ∧I \\ & A ∧ B \end{aligned}

∧E_{L}
A

Clearly, it is unnecessary to first introduce the conjunction and then eliminate it: a more direct proof of the same conclusion from the same (or fewer) assumptions would be simply

\begin{matrix}D \\ A \end{matrix}

Formulated as a transformation or reduction between derivations we have

\begin{aligned}\begin{matrix}D \\ A \end{matrix} & & \begin{matrix}E \\ B \end{matrix} \\ & & & ∧I \\ & A ∧ B \end{aligned} ; ∧E_{L} ; A ⟹_{L} \begin{matrix}D \\ A \end{matrix}

and symmetrically

\begin{aligned}\begin{matrix}D \\ A \end{matrix} & & \begin{matrix}E \\ B \end{matrix} \\ & & & ∧I \\ & A ∧ B \end{aligned} ; ∧E_{R} ; B ⟹_{L} \begin{matrix}E \\ B \end{matrix}

The new judgment

D :: ⊢ A ⟹_{L} E :: ⊢ A

relates derivations with the same conclusion. We say D locally reduces to E. Later in Section 7.7 we will define a another judgment of reduction in which local reductions can be applied to any subderivation.

Implication. To derive A ⊃ B we assume A and then derive B. Written as a hypothetical judgment:

\frac{u}{A} ; ⋮ ; B ; ⊃I^{u} ; A ⊃ B

Thus a derivation of A ⊃ B describes a construction by which we can transform a derivation of A into a derivation of B: we substitute the derivation of A wherever we used the assumption A in the hypothetical derivation of B. The elimination rule expresses this: if we have a derivation of A ⊃ B and also a derivation of A, then we can obtain a derivation of B.

A ⊃ B A ⊃E

B

The reduction rule carries out the substitution of derivations explained above.

\begin{aligned}\frac{u}{A} ; D ; B ; ⊃I^{u} ; A ⊃ B & \begin{matrix}E \\ A \end{matrix} \\ & & ⊃E \\ B \end{aligned} ⟹_{L}  \begin{aligned}E \\ & u \\ A \end{aligned} ; D ; B

The final derivation depends on all the assumptions of E and D except u, for which we have substituted E. An alternative notation for this substitution of derivations for assumptions as introduced in Chapter 5 is [E/u]D :: ⊢ B. The local reduction described above may significantly increase the overall length of the derivation, since the deduction E is substituted for each occurrence of the assumption labeled u in D and may thus be replicated many times.

Disjunction. A ∨ B should be derivable if either A is derivable or B is derivable. Therefore we have two introduction rules.

\begin{aligned}A \\ & ∨I_{L} \\ A ∨ B \end{aligned}  \begin{aligned}B \\ & ∨I_{R} \\ A ∨ B \end{aligned}

If we have an assumption A ∨ B, we do not know how it might be inferred. That is, a proposed elimination rule

\begin{aligned}A ∨ B \\ & ? \\ A \end{aligned}

would be incorrect, since a deduction of the form

\begin{matrix}E \\ B \end{matrix} ; ∨I_{R} ; A ∨ B ; ? ; A

cannot be reduced. As a consequence, the system would be inconsistent: if we have at least one theorem (B, in the example) we can prove every formula (A, in the example). How do we use the assumption A ∨ B in informal reasoning? We often proceed with a proof by cases: we prove a conclusion C under the assumption A and also show C under the assumption B. We then conclude C, since either A or B by assumption. Thus the elimination rule employs two hypothetical judgments.

A ∨ B  \frac{u_{1}}{A} ; ⋮ ; C \frac{u_{2}}{B} ; ⋮ ; C

∨E^{u_{1},u_{2}} C

Now one can see that the introduction and elimination rules match up in two reductions. First, the case that the disjunction was inferred by ∨I_{L}.

\begin{aligned}\begin{matrix}D \\ A \end{matrix} ; ∨I_{L} ; A ∨ B & & \frac{u_{1}}{A} ; E_{1} ; C & \frac{u_{2}}{B} ; E_{2} ; C \\ & & & ∨E^{u_{1},u_{2}} \\ & C \end{aligned} ⟹_{L}  \begin{aligned}D \\ & u_{1} \\ A \end{aligned} ; E_{1} ; C

The other reduction is symmetric.

\begin{aligned}\begin{matrix}D \\ B \end{matrix} ; ∨I_{R} ; A ∨ B & & \frac{u_{1}}{A} ; E_{1} ; C & \frac{u_{2}}{B} ; E_{2} ; C \\ & & & ∨E^{u_{1},u_{2}} \\ & C \end{aligned} ⟹_{L}  \begin{aligned}D \\ & u_{2} \\ B \end{aligned} ; E_{2} ; C

As in the reduction for implication, the resulting derivation may be longer than the original one.

Negation. In order to derive ¬A we assume A and try to derive a contradiction. Thus it seems that negation requires falsehood, and, indeed, in most literature on constructive logic, ¬A is seen as an abbreviation of A ⊃ ⊥. In order to give a selfcontained explanation of negation by an introduction rule, we employ a judgment that is parametric in a propositional parameter p: If we can derive any p from the hypothesis A we conclude ¬A.

\frac{u}{A} ; ⋮ ; p ; ¬I^{p,u} ; ¬A  \begin{aligned}¬A  A \\ & ¬E \\ C \end{aligned}

The elimination rule follows from this view: if we know ¬A and A then we can conclude any formula C. In the form of a local reduction:

\begin{aligned}\frac{u}{A} ; D ; p ; ¬I^{p,u} ; ¬A & \begin{matrix}E \\ A \end{matrix} \\ & & ¬E \\ C \end{aligned} ⟹_{L}  \begin{aligned}E \\ & u \\ A \end{aligned} ; [C/p]D ; C

The substitution [C/p]D is valid, since D is parametric in p.

Truth. There is only an introduction rule for ⊤:

\frac{⊤I}{⊤}

Since we put no information into the proof of ⊤, we know nothing new if we have an assumption ⊤ and therefore we have no elimination rule and no reduction. It may also be helpful to think of ⊤ as a 0-ary conjunction: the introduction rule has 0 premisses instead of 2 and we correspondingly have 0 elimination rules instead of 2.

Falsehood. Since we should not be able to derive falsehood, there is no introduction rule for ⊥. Therefore, if we can derive falsehood, we can derive everything.

\begin{aligned}⊥ \\ & ⊥E \\ C \end{aligned}

Note that there is no local reduction rule for ⊥E. It may be helpful to think of ⊥ as a 0-ary disjunction: we have 0 instead of 2 introduction rules and we correspondingly have to consider 0 cases instead of 2 in the elimination rule. Even though we postulated that falsehood should not be derivable, falsehood could clearly be a consequence of contradictory assumption. For example, ⊢ A ∧ ¬A ⊃ ⊥ is derivable.

Universal Quantification. Under which circumstances should we be able to derive ∀x. A? This clearly depends on the domain of quantification. For example, if we know that x ranges over the natural numbers, then we can conclude ∀x. A if we can prove [0/x]A, [1/x]A, etc. Such a rule is not effective, since it has infinitely many premisses. Thus one usually retreats to rules such as induction. However, in a general treatment of predicate logic we would like to prove statements which are true for all domains of quantification. Thus we can only say that ∀x. A should be provable if [a/x]A is provable for a new parameter a about which we can make no assumption. Conversely, if we know ∀x. A, we know that [t/x]A for any term t.

\begin{aligned}[a/x]A \\ & ∀I^{a} \\ ∀x. A \end{aligned}  \begin{aligned}∀x. A \\ & ∀E \\ [t/x]A \end{aligned}

The superscript on the inference rules is a reminder the parameter a must be “new”, that is, it may not occur in any uncancelled assumption in the proof of [a/x]A or in ∀x. A itself. In other words, the derivation of the premiss must parametric in a. The local reduction carries out the substitution for the parameter.

\begin{matrix}D \\ [a/x]A \end{matrix} ; ∀I ; ∀x. A ; ∀E ; [t/x]A ⟹_{L} \begin{matrix}[t/a]D \\ [t/x]A \end{matrix}

Here, [t/a]D is our notation for the result of substituting t for the parameter a throughout the deduction D. For this substitution to preserve the conclusion, we must know that a does not already occur in A. Similarly, we would change the assumptions if a occurred free in any of the undischarged hypotheses of D. This might render a larger proof incorrect. As an example, consider the formula ∀x. ∀y. P (x) ⊃ P (y) which should clearly not be derivable for all predicates P. The following is not a deduction of this formula.

\frac{u}{P (a)} ; ∀I^{a}? ; ∀x. P (x)

∀E P (b)

⊃I^{u} P (a) ⊃ P (b)

∀I^{b} ∀y. P (a) ⊃ P (y)

∀I^{a} ∀x. ∀y. P (x) ⊃ P (y)

The flaw is at the inference marked with “?,” where a is free in the assumption u. Applying a local proof reduction to the (incorrect) ∀I inference followed by ∀E leads to the the assumption [b/a]P (a) which is equal to P (b). The resulting derivation

\frac{u}{P (b)} ; ⊃I^{u} ; P (a) ⊃ P (b)

∀I^{b} ∀y. P (a) ⊃ P (y)

∀I^{a} ∀x. ∀y. P (x) ⊃ P (y)

is once again incorrect since the hypothesis labelled u should read P (a), not P (b).

Existential Quantification. To conclude that ∃x. A is true, we must know that there is a t such that [t/x]A is true. Thus,

\begin{aligned}[t/x]A \\ & ∃I \\ ∃x. A \end{aligned}

When we have an assumption ∃x. A we do not know for which t it is the case that [t/x]A holds. We can only assume that [a/x]A holds for some parameter a about which we know nothing else. Thus the elimination rule resembles the one for disjunction.

∃x. A  \frac{u}{[a/x]A} ; ⋮ ; C

∃E^{a,u} C

The restriction is similar to the one for ∀I: the parameter a must be new, that is, it must not occur in ∃x. A, C, or any assumption employed in the derivation of the second premiss. In the reduction rule we have to perform two substitutions: we have to substitute t for the parameter a and we also have to substitute for the hypothesis labelled u.

\begin{aligned}\begin{matrix}D \\ [t/x]A \end{matrix} ; ∃I ; ∃x. A & \frac{u}{[a/x]A} ; E ; C \\ & ∃E^{a,u} \\ C \end{aligned} ⟹_{L}  \begin{aligned}D \\ & u \\ [t/x]A \end{aligned} ; [t/a]E ; C

The proviso on occurrences of a guarantees that the conclusion and hypotheses of [t/a]E have the correct form.

Classical Logic. The inference rules so far only model intuitionistic logic, and some classically true formulas such as A ∨ ¬A (for an arbitrary A) are not derivable (see Exercise 7.10). There are three commonly used ways one can construct a system of classical natural deduction by adding one additional rule of inference. ⊥_{C} is called Proof by Contradiction or Rule of Indirect Proof, ¬¬_{C} is the Double Negation Rule, and XM is referred to as Excluded Middle.

\frac{u}{¬A} ; ⋮ ; ⊥ ; ⊥_{C}^{u} ; A  \begin{aligned}¬¬A \\ & ¬¬_{C} \\ A \end{aligned}  \frac{XM}{A ∨ ¬A}

The rule for classical logic (whichever one chooses to adopt) breaks the pattern of introduction and elimination rules. One can still formulate some reductions for classical inferences, but natural deduction is at heart an intuitionistic calculus. The symmetries of classical logic are much better exhibited in sequent formulations of the logic. In Exercise 7.2 we explore the three ways of extending the intuitionistic proof system and show that they are equivalent.

Here is a simple example of a natural deduction. We attempt to show the process by which such a deduction may have been generated, as well as the final deduction. The three vertical dots indicate a gap in the derivation we are trying to construct, with assumptions and their consequences shown above and the desired conclusion below the gap.

⋮ ; A ∧ (A ⊃ B) ⊃ B  ⇝ \frac{u}{A ∧ (A ⊃ B)} ; ⋮ ; B ; ⊃I^{u} ; A ∧ (A ⊃ B) ⊃ B

⇝ \frac{u}{A ∧ (A ⊃ B)} ; ∧E_{L} ; A ; ⋮ ; B ; ⊃I^{u} ; A ∧ (A ⊃ B) ⊃ B ⇝  \frac{u}{A ∧ (A ⊃ B)} ; ∧E_{L} ; A  \frac{u}{A ∧ (A ⊃ B)} ; ∧E_{R} ; A ⊃ B ; ⋮ ; B ; ⊃I^{u} ; A ∧ (A ⊃ B) ⊃ B

⇝  \begin{aligned}\frac{u}{A ∧ (A ⊃ B)} ; ∧E_{R} ; A ⊃ B & \frac{u}{A ∧ (A ⊃ B)} ; ∧E_{L} ; A \\ & ⊃E \\ B \end{aligned} ; ⋮ ; B ; ⊃I^{u} ; A ∧ (A ⊃ B) ⊃ B

⇝  \begin{aligned}\frac{u}{A ∧ (A ⊃ B)} ; ∧E_{R} ; A ⊃ B & \frac{u}{A ∧ (A ⊃ B)} ; ∧E_{L} ; A \\ & ⊃E \\ B \end{aligned} ; ⊃I^{u} ; A ∧ (A ⊃ B) ⊃ B

The symbols A and B in this derivation stand for arbitrary formulas; we can thus view the derivation generated below as being parametric in A and B. In other words, every instance of this derivation (replacing A and B by arbitrary formulas) is a valid derivation.

Below is a summary of the rules of intuitionistic natural deduction.

Introduction Rules  Elimination Rules

\begin{aligned}A  B \\ & ∧I \\ A ∧ B \end{aligned}  \begin{aligned}A ∧ B \\ & ∧E_{L} \\ A \end{aligned}  \begin{aligned}A ∧ B \\ & ∧E_{R} \\ B \end{aligned}

\begin{aligned}A \\ & ∨I_{L} \\ A ∨ B \end{aligned}  \begin{aligned}B \\ & ∨I_{R} \\ A ∨ B \end{aligned}  \begin{matrix}A ∨ B  \frac{u_{1}}{A} ; ⋮ ; C \frac{u_{2}}{B} ; ⋮ ; C \\ ∨E^{u_{1},u_{2}} \\ C \end{matrix}

\frac{u}{A} ; ⋮ ; B ; ⊃I^{u} ; A ⊃ B  \begin{aligned}A ⊃ B  A \\ & ⊃E \\ B \end{aligned}

\frac{u}{A} ; ⋮ ; p ; ¬I^{p,u} ; ¬A  \begin{aligned}A  ¬A \\ & ¬E \\ C \end{aligned}

\frac{⊤I}{⊤}

\begin{aligned}⊥ \\ & ⊥E \\ C \end{aligned}

\begin{aligned}[a/x]A \\ & ∀I^{∗} \\ ∀x. A \end{aligned}  \begin{aligned}∀x. A \\ & ∀E \\ [t/x]A \end{aligned}

\begin{aligned}[t/x]A \\ & ∃I \\ ∃x. A \end{aligned}  \begin{matrix}∃x. A  \frac{u}{[a/x]A} ; ⋮ ; C \\ ∃E^{a,u} \\ C \end{matrix}

7.2 Representation in LF

The LF logical framework and its implementation in Elf are ideally suited to the representation of natural deduction, and we will exploit a number of the encoding techniques we have encountered so far.

The representation of terms and formulas employs the idea of higher-order abstract syntax so that substitution and side-conditions on variable occurrences required for the inference rules can be expressed directly. Recall the basic principle of higher-order abstract syntax: represent object-level variables by meta-level variables. As a consequence, object-language constructs that bind variables are represented by meta-level constructs that also bind variables. Parameters play the role of variables in derivations and are thus also represented as variables in the metalanguage. As in Section 3.2, we write the representation function as ⌜·⌝. First, we declare the type of individuals (i) and the type of formulas (o).

i : type
o : type

The structure of the domain of individuals is left open in the development of predicate logic. Commitment to, say, natural numbers then leads to a formalization of arithmetic. Our encoding reflects this approach: we do not specify that any particular individuals exist, but we can give the recipe by which function symbols can be added to our encoding. For every function symbol f of arity n, we add a corresponding declaration

f : \underbrace{i → ⋯ → i →}_{n} i.

The representation of terms is then given by

\begin{aligned}⌜x⌝ & = & x \\ ⌜a⌝ & = & a \\ ⌜f(t_{1}, …, t_{n})⌝ & = & f ⌜t_{1}⌝ … ⌜t_{n}⌝. \end{aligned}

Note that each parameter a of predicate logic is mapped to an LF variable with the same name.

This kind of encoding takes advantage of the open-ended nature of signatures: we can always add further declarations without invalidating judgments made earlier. Predicate symbols are dealt with in a similar manner: The general recipe is to add a declaration

p : \underbrace{i → ⋯ → i →}_{n} o

for every predicate symbol P of arity n. The representation function and the remaining declarations are then straightforward.

⌜P (t_{1}, …, t_{n})⌝ = p ⌜t_{1}⌝ … ⌜t_{n}⌝
⌜A_{1} ∧ A_{2}⌝ = and ⌜A_{1}⌝ ⌜A_{2}⌝  and : o → o → o
⌜A_{1} ⊃ A_{2}⌝ = imp ⌜A_{1}⌝ ⌜A_{2}⌝  imp : o → o → o
⌜A_{1} ∨ A_{2}⌝ = or ⌜A_{1}⌝ ⌜A_{2}⌝ or : o → o → o
⌜¬A⌝ = not ⌜A⌝  not : o → o
⌜⊥⌝ = false  false : o
⌜⊤⌝ = true  true : o
⌜∀x. A⌝ = forall (λx:i. ⌜A⌝)  forall : (i → o) → o
⌜∃x. A⌝ = exists (λx:i. ⌜A⌝)  exists : (i → o) → o

The formulation of an adequacy theorem for this representation is left to the reader (see Exercise 7.4). We only note the substitution property which holds due to the use of higher-order abstract syntax:

⌜[t/x]A⌝ = [⌜t⌝/x]⌜A⌝ ≡ (λx:i. ⌜A⌝) ⌜t⌝.

The representation of the derivability judgment of natural deduction follows the schema of Chapter 5, since natural deduction makes essential use of parametric and hypothetical judgments. We introduce a type family nd that is indexed by a formula. The LF type nd ⌜A⌝ is intended to represent the type of natural deductions of the formula A.

nd : o → type

Each inference rule is represented by an LF constant which can be thought of as a function from a derivation of the premisses of the rule to a derivation of the conclusion. The constant must further be applied to the representation of the formulas participating in an inference in order to avoid possible ambiguities.

Conjunction.

⌜ \begin{aligned}\begin{matrix}D \\ A \end{matrix} & & \begin{matrix}E \\ B \end{matrix} \\ & & & ∧I \\ & A ∧ B \end{aligned} ⌝ = andi ⌜A⌝ ⌜B⌝ ⌜D⌝ ⌜E⌝

from which it follows that we declare

andi : ΠA:o. ΠB:o. nd A → nd B → nd (and A B).

For derivations ending in one of the two elimination rules we have the similarly obvious representations

⌜ \begin{matrix}D \\ A ∧ B \end{matrix} ; ∧E_{L} ; A ⌝ = andel ⌜A⌝ ⌜B⌝ ⌜D⌝

⌜ \begin{matrix}D \\ A ∧ B \end{matrix} ; ∧E_{R} ; B ⌝ = ander ⌜A⌝ ⌜B⌝ ⌜D⌝

where

andel : ΠA:o. ΠB:o. nd (and A B) → nd A
ander : ΠA:o. ΠB:o. nd (and A B) → nd B

Implication. The introduction rule for implication is somewhat less straightforward, since it employs a hypothetical judgment. The derivation of the hypothetical judgment in the premiss is represented as a function which, when applied to a derivation of A, yields a derivation of B.

⌜ \frac{u}{A} ; D ; B ; ⊃I^{u} ; A ⊃ B ⌝ = impi ⌜A⌝ ⌜B⌝ (λu:nd ⌜A⌝. ⌜D⌝)

The assumption A labelled by u which may be used in the derivaton D is represented by the LF variable u which ranges over derivations of A.

⌜ \frac{u}{A} ⌝ = u

The elimination rule is simpler, since it does not involve a hypothetical judgment. The representation of a derivation ending in the elimination rule is defined by

⌜ \begin{aligned}\begin{matrix}D \\ A ⊃ B \end{matrix} & & \begin{matrix}E \\ A \end{matrix} \\ & & & ⊃E \\ & B \end{aligned} ⌝ = impe ⌜A⌝ ⌜B⌝ ⌜D⌝ ⌜E⌝

where

impe : ΠA:o. ΠB:o. nd (imp A B) → nd A → nd B.

As an example which requires only conjunction and implication, consider the derivation of A ∧ (A ⊃ B) ⊃ B from Page 215:

\frac{u}{A ∧ (A ⊃ B)} ; ∧E_{R} ; A ⊃ B  \frac{u}{A ∧ (A ⊃ B)} ; ∧E_{L} ; A
⊃E
B
⊃I^{u} A ∧ (A ⊃ B) ⊃ B

This derivation is represented by the LF object

impi (and ⌜A⌝ (imp ⌜A⌝ ⌜B⌝)) ⌜B⌝
(λu:nd (and ⌜A⌝ (imp ⌜A⌝ ⌜B⌝)).
(impe ⌜A⌝ ⌜B⌝
(ander ⌜A⌝ (imp ⌜A⌝ ⌜B⌝) u)
(andel ⌜A⌝ (imp ⌜A⌝ ⌜B⌝) u)))

which has type

nd (imp (and ⌜A⌝ (imp ⌜A⌝ ⌜B⌝)) ⌜B⌝).

This example shows clearly some redundancies in the representation of the deduction (there are many occurrence of ⌜A⌝ and ⌜B⌝). The Elf implementation of natural deduction in Section 7.3 eliminates some of these redundancies.

Disjunction. The representation of the introduction and elimination rules for disjunction employ the same techniques as we have seen above.

\begin{aligned}A \\ & ∨I_{L} \\ A ∨ B \end{aligned}  \begin{aligned}B \\ & ∨I_{R} \\ A ∨ B \end{aligned}  \begin{matrix}A ∨ B  \frac{u_{1}}{A} ; ⋮ ; C \frac{u_{2}}{B} ; ⋮ ; C \\ ∨E^{u_{1},u_{2}} \\ C \end{matrix}

The corresponding LF constants:

oril : ΠA:o. ΠB:o. nd A → nd (or A B)
orir : ΠA:o. ΠB:o. nd B → nd (or A B)
ore : ΠA:o. ΠB:o. ΠC:o.
nd (or A B) → (nd A → nd C) → (nd B → nd C) → nd C.

Negation. The introduction and elimination rules for negation and their representation follow the pattern of the rules for implication.

\frac{u}{A} ; ⋮ ; p ; ¬I^{p,u} ; ¬A  \begin{aligned}¬A  A \\ & ¬E \\ C \end{aligned}

noti : ΠA:o. (Πp:o. nd A → nd p) → nd (not A)
note : ΠA:o. nd (not A) → ΠC:o. nd A → nd C

Truth. There is only an introduction rule, which is easily represented. We have

⌜ \frac{⊤I}{⊤} ⌝ = truei

where

truei : nd (true).

Falsehood. There is only an elimination rule, which is easily represented. We have

⌜ \begin{matrix}D \\ ⊥ \end{matrix} ; ⊥E ; C ⌝ = falsee ⌜C⌝ ⌜D⌝

where

falsee : ΠC:o. nd (false) → nd C.

Universal Quantification. The introduction rule for the universal quantifier employs a parametric judgment and the elimination rule employs substitution.

\begin{aligned}[a/x]A \\ & ∀I^{a} \\ ∀x. A \end{aligned}  \begin{aligned}∀x. A \\ & ∀E \\ [t/x]A \end{aligned}

The side condition on ∀I states that the parameter a must be “new”. In the spirit of Chapter 5 the derivation of a parametric judgment will be represented as a function of the parameter. Recall that ⌜∀x. A⌝ = forall (λx:i. ⌜A⌝).

⌜ \begin{matrix}D \\ [a/x]A \end{matrix} ; ∀I^{a} ; ∀x. A ⌝ = foralli (λx:i. ⌜A⌝) (λa:i. ⌜D⌝)

Note that ⌜A⌝, the representation of A, has a free variable x which must be bound in the meta-language, so that the representing object does not have a free variable x. This representation determines the type of the constant foralli.

foralli : ΠA:i → o. (Πa:i. nd (A a)) → nd (forall A)

In an application of this constant, the argument labelled A will be λx:i. ⌜A⌝ and (A a) will be (λx:i. ⌜A⌝) a which is equivalent to [a/x]⌜A⌝ which in turn is equivalent to ⌜[a/x]A⌝ by the substitution property on Page 218.

The elimination rule does not employ a hypothetical judgment.

⌜ \begin{matrix}D \\ ∀x. A \end{matrix} ; ∀E ; [t/x]A ⌝ = foralle (λx:i. ⌜A⌝) ⌜D⌝ ⌜t⌝

The substitution of t for x in A is representation by the application of the function (λx:i. ⌜A⌝) (the first argument of foralle) to ⌜t⌝.

foralle : ΠA:i → o. nd (forall A) → Πt:i. nd (A t)

We now check that

⌜ \begin{matrix}D \\ ∀x. A \end{matrix} ; ∀E ; [t/x]A ⌝ : nd ⌜[t/x]A⌝,

assuming that ⌜D⌝ : nd ⌜∀x. A⌝. This would be an important part in the proof of adequacy of this representation of natural deductions. First we note that the arguments have the expected types and find that

foralle : ΠA:i → o. nd (forall A) → Πt:i. nd (A t)
foralle (λx:i. ⌜A⌝) : nd (forall (λx:i. ⌜A⌝)) → Πt:i. nd ((λx:i. ⌜A⌝) t)
foralle (λx:i. ⌜A⌝) ⌜D⌝ : Πt:i. nd ((λx:i. ⌜A⌝) t)
foralle (λx:i. ⌜A⌝) ⌜D⌝ ⌜t⌝ : nd ((λx:i. ⌜A⌝) ⌜t⌝).

Now we have to recall the rule of type conversion for LF (see Section 3.8)

Γ ⊢_{Σ} M : A  A ≡ B  Γ ⊢_{Σ} B : type

conv

Γ ⊢_{Σ} M : B

and note that

(λx:i. ⌜A⌝) ⌜t⌝ ≡ [⌜t⌝/x]⌜A⌝

by β-conversion. Furthermore, by the substitution property for the representation we have

[⌜t⌝/x]⌜A⌝ = ⌜[t/x]A⌝

which yields the desired

foralle (λx:i. ⌜A⌝) ⌜D⌝ ⌜t⌝ : nd (⌜[t/x]A⌝).

Existential Quantification. The representation techniques are the same we used for universal quantification: parametric and hypothetical derivations are represented as LF functions.

⌜ \begin{matrix}D \\ [t/x]A \end{matrix} ; ∃I ; ∃x. A ⌝ = existsi (λx:i. ⌜A⌝) ⌜t⌝ ⌜D⌝

⌜ \begin{matrix}∃x. A  \frac{u}{[a/x]A} ; D ; C \\ ∃E^{a,u} \\ C \end{matrix} ⌝ = existse (λx:i ⌜A⌝) ⌜C⌝ (λa:i. λu:nd ⌜[a/x]A⌝. ⌜D⌝)

where

existsi : ΠA:i → o. Πt:i. nd (A t) → nd (exists A)
existse : ΠA:i → o. ΠC:o. nd (exists A) → (Πa:i. nd (A a) → nd C) → nd C.

Once again, we will not formally state or proof the adequacy theorem for this encoding. We only mention the three substitution properties which will be important in the formalization of reduction in the next section.

⌜[t/a]D⌝ = [⌜t⌝/a]⌜D⌝ and ⌜[C/p]D⌝ = [⌜C⌝/p]⌜D⌝ and ⌜[E/u]D⌝ = [⌜E⌝/u]⌜D⌝.

Each of the rules that may be added to obtain classical logic can be easily represented with the techniques from above. They are left as Exercise 7.7.

7.3 Implementation in Elf

In this section we summarize the LF encoding of natural deduction from the previous section as an Elf signature, and also give the representation of the local reduction rules from Section 7.1. We will make a few cosmetic changes that reflect common Elf programming practice. The first is the use of infix and prefix notation in the use of the logical connectives. According to our conventions, conjunction, disjunction, and implication are all right associative, and conjunction and disjunction bind stronger than implication. Negation is treated as a prefix operator binding tighter than the binary connectives. For example,

A ∧ (A ⊃ B) ⊃ ¬B ⊃ C

is the same formula as

(A ∧ (A ⊃ B)) ⊃ ((¬B) ⊃ C).

As an arbitrary baseline in the pragmas below we pick a binding strength of 10 for implication.

  i : type.  % individuals
  o : type.  % formulas
  %name i T S
  %name o A B C
  and    : o -> o -> o.  %infix right 11 and
  imp    : o -> o -> o.  %infix right 10 imp
  or     : o -> o -> o.  %infix right 11 or
  not    : o -> o.       %prefix 12 not
  true   : o.
  false  : o.
  forall : (i -> o) -> o.
  exists : (i -> o) -> o.

The %name declarations instruct Elf’s printing routines to prefer names T and S for unnamed variables of type i, and names A, B, and C for unnamed variables of type o. This serves to improve the readability of Elf’s output.

The second simplification in the concrete presentation is to leave some Π-quantifiers implicit. The type reconstruction algorithm always interprets free variables in a declaration as a schematic variables (which are therefore implicitly Π-quantified) and determines their type from the context in which they appear.^{1}

1[pointer to full discussion]

nd : o -> type.  % proofs
%name nd D E
andi    : nd A -> nd B -> nd (A and B).
andel   : nd (A and B) -> nd A.
ander   : nd (A and B) -> nd B.
impi    : (nd A -> nd B) -> nd (A imp B).
impe    : nd (A imp B) -> nd A -> nd B.
oril    : nd A -> nd (A or B).
orir    : nd B -> nd (A or B).
ore     : nd (A or B) -> (nd A -> nd C) -> (nd B -> nd C) -> nd C.
noti    : ({p:o} nd A -> nd p) -> nd (not A).
note    : nd (not A) -> {C:o} nd A -> nd C.
truei   : nd (true).
falsee  : nd (false) -> nd C.
foralli : ({a:i} nd (A a)) -> nd (forall A).
foralle : nd (forall A) -> {T:i} nd (A T).
existsi : {T:i} nd (A T) -> nd (exists A).
existse : nd (exists A) -> ({a:i} nd (A a) -> nd C) -> nd C.

As a consequence of omitting the quantifiers on some variables in these declarations, the corresponding arguments to the constants also have to be omitted. For example, in the input language the constant andi now appears to take only two arguments (the representation of the derivations of A and B), rather than four like the LF constant

andi : ΠA:o. ΠB:o. nd A → nd B → nd (and A B).

The type reconstruction algorithm will determine the two remaining implicit arguments from context. The derivation of A ∧ (A ⊃ B) ⊃ B from Page 220 has this very concise Elf representation:

impi [u:nd (A and (A imp B))] (impe (ander u) (andel u))

where A and B are free variables of type o. The use of variable A and B indicates the generic nature of this derivation: we can substitute any two objects of type o for A and B and still obtain the representation of a valid derivation. Incidentally, in this example the type of u is also redundant and could also have been omitted.

Next we turn to the local reduction judgment

D :: ⊢ A ⟹_{L} D′ :: ⊢ A.

We used this judgment to check that the introduction and elimination rules for each logical connective and quantifier match up. This higher-level judgment relates derivations of the same formula A. We have already seen such judgments in Section 3.7 and subsequent representations of meta-theoretic proofs. The representing LF type family would be declared as

redl : ΠA:o. nd A → nd A → type.

We will not show this representation in pure LF, but immediately give its concrete syntax in Elf.

  ==>L : nd A -> nd A -> type.  %infix none 14 ==>L
  %name ==>L L

Note that the quantifier over A is once again implicit and that ==>L must be read as one symbol.

Conjunction. The local reductions have the form

\begin{aligned}\begin{matrix}D \\ A \end{matrix} & & \begin{matrix}E \\ B \end{matrix} \\ & & & ∧I \\ & A ∧ B \end{aligned} ; ∧E_{L} ; A ⟹_{L} \begin{matrix}D \\ A \end{matrix}

and symmetrically

\begin{aligned}\begin{matrix}D \\ A \end{matrix} & & \begin{matrix}E \\ B \end{matrix} \\ & & & ∧I \\ & A ∧ B \end{aligned} ; ∧E_{R} ; B ⟹_{L} \begin{matrix}E \\ B \end{matrix} .

Because of type reconstruction, we can omit the formulas entirely from the straightforward representations of these two rules.

  redl_andl   : (andel (andi D E)) ==>L D.
  redl_andr   : (ander (andi D E)) ==>L E.

Implication. This reduction involves a substitution of a derivation for an assumption.

\begin{aligned}\frac{u}{A} ; D ; B ; ⊃I^{u} ; A ⊃ B & \begin{matrix}E \\ A \end{matrix} \\ & & ⊃E \\ B \end{aligned} ⟹_{L}  \begin{aligned}E \\ & u \\ A \end{aligned} ; D ; B

The representation of the left-hand side in Elf is

  (impe (impi D) E)

where E = ⌜E⌝ and D = λu:nd ⌜A⌝. ⌜D⌝. The derivation on the right-hand side can be written more succinctly as [E/u]D. The substitution property for derivations (see Page 7.2) yields

⌜[E/u]D⌝ = [⌜E⌝/u]⌜D⌝ ≡ (λu:nd ⌜A⌝. ⌜D⌝) ⌜E⌝.

Thus the representation of the right-hand side will be β-equivalent to (D E) and we formulate the rule as

  redl_imp    : (impe (impi D) E) ==>L (D E).

Disjunction. The two reductions for disjunction introduction followed by elimination are

\begin{aligned}\begin{matrix}D \\ A \end{matrix} ; ∨I_{L} ; A ∨ B & & \frac{u_{1}}{A} ; E_{1} ; C & \frac{u_{2}}{B} ; E_{2} ; C \\ & & & ∨E^{u_{1},u_{2}} \\ & C \end{aligned} ⟹_{L}  \begin{aligned}D \\ & u_{1} \\ A \end{aligned} ; E_{1} ; C

and

\begin{aligned}\begin{matrix}D \\ B \end{matrix} ; ∨I_{R} ; A ∨ B & & \frac{u_{1}}{A} ; E_{1} ; C & \frac{u_{2}}{B} ; E_{2} ; C \\ & & & ∨E^{u_{1},u_{2}} \\ & C \end{aligned} ⟹_{L}  \begin{aligned}D \\ & u_{2} \\ B \end{aligned} ; E_{2} ; C .

Their representation follows the pattern from the previous case to model the substitution of derivations.

  redl_orl    : (ore (oril D) E1 E2) ==>L (E1 D).
  redl_orr    : (ore (orir D) E1 E2) ==>L (E2 D).

Negation. This is similar to implication.

\begin{aligned}\frac{u}{A} ; D ; p ; ¬I^{p,u} ; ¬A & \begin{matrix}E \\ A \end{matrix} \\ & & ¬E \\ C \end{aligned} ⟹_{L}  \begin{aligned}E \\ & u \\ A \end{aligned} ; [C/p]D ; C

  redl_not    : (note (noti D) C E) ==>L (D C E).

Universal Quantification. The universal introduction rule involves a parametric judgment. Consequently, the substitution to be carried out during reduction replaces a parameter by a term.

\begin{matrix}D \\ [a/x]A \end{matrix} ; ∀I^{a} ; ∀x. A ; ∀E ; [t/x]A ⟹_{L} \begin{matrix}[t/a]D \\ [t/x]A \end{matrix}

In the representation we exploit the first part of the substitution property for derivations (see page 223):

⌜[t/a]D⌝ = [⌜t⌝/a]⌜D⌝ ≡ (λa:i. ⌜D⌝) ⌜t⌝.

This gives rise to the declaration

  redl_forall : (foralle (foralli D) T) ==>L (D T).

Existential Quantification. This involves both a parametric and hypothetical judgments, and we combine the techniques used for implication and universal quantification.

\begin{aligned}\begin{matrix}D \\ [t/x]A \end{matrix} ; ∃I ; ∃x. A & \frac{u}{[a/x]A} ; E ; C \\ & ∃E^{a,u} \\ C \end{aligned} ⟹_{L}  \begin{aligned}D \\ & u \\ [t/x]A \end{aligned} ; [t/a]E ; C

The crucial equations for the adequacy of the encoding below are

⌜[D/u][t/a]E⌝ = [⌜D⌝/u][⌜t⌝/a]⌜E⌝ ≡ (λa:i. λu:nd ⌜[a/x]A⌝. ⌜E⌝) ⌜t⌝ ⌜D⌝.

  redl_exists : (existse (existsi T D) E) ==>L (E T D).

7.4 The Curry-Howard Isomorphism

The basic judgment of the system of natural deduction is the derivability of a formula A, written as ⊢ A. If we wish to make the derivation explicit we write D :: ⊢ A. It has been noted by Howard [How80] that there is a strong correspondence between the (intuitionistic) derivations D and λ-terms. The formulas A then act as types classifying those λ-terms. In the propositional case, this correspondence is an isomorphism: formulas are isomorphic to types and derivations are isomorphic to simply-typed λ-terms. These isomorphisms are often called the propositions-as-types and proofs-as-programs paradigms.

If we stopped at this observation, we would have obtained only a fresh interpretation of familiar deductive systems, but we would not be any closer to the goal of providing a language for reasoning about properties of programs. However, the correspondences can be extended to first-order and higher-order logics. Interpreting first-order (or higher-order) formulas as types yields a significant increase in expressive power of the type system. However, maintaining an isomorphism during the generalization to first-order logic is somewhat unnatural and cumbersome. One might expect that a proof contains more information than the corresponding program. Thus the literature often talks about extracting programs from proofs or contracting proofs to programs.

The first step will be to introduce a notation for derivations to be carried along in deductions. For example, if M represents a proof of A and N represents a proof of B, then the pair ⟨M, N⟩ can be seen as a representation of the proof of A ∧ B by ∧-introduction. We write M :· A to express the judgment M is a proof term for A. We also repeat the local reductions from the previous section in the new notation.

Conjunction. The proof term for a conjunction is simply the pair of proofs of the premisses.

\begin{aligned}M :· A  N :· B \\ & ∧I \\ ⟨M, N⟩ :· A ∧ B \end{aligned}  \begin{aligned}M :· A ∧ B \\ & ∧E_{L} \\ fst M :· A \end{aligned}  \begin{aligned}M :· A ∧ B \\ & ∧E_{R} \\ snd M :· B \end{aligned}

The local reductions now lead to two obvious local reductions of the proof terms.

\begin{matrix}fst ⟨M, N⟩ & ⟶_{L} & M \\ snd ⟨M, N⟩ & ⟶_{L} & N \end{matrix}

Implication. The proof of an implication A⊃B will be represented by a function which maps proofs of A to proofs of B. The introduction rule explicitly forms such a function by λ-abstraction and the elimination rule applies the function to an argument.

\frac{u′}{u :· A} ; ⋮ ; M :· B ; ⊃I^{u,u′} ; (λu:A. M) :· A ⊃ B  \begin{aligned}M :· A ⊃ B  N :· A \\ & ⊃E \\ M N :· B \end{aligned}

The binding of the variable u in the conclusion of ⊃I correctly models the intuition that the hypothesis is discharged and not available outside deduction of the premiss. The abstraction is labelled with the proposition A so that we can later show that the proof term uniquely determines a natural deduction. If A were not given then, for example, λu. u would be ambigous and serve as a proof term for A ⊃ A for any formula A. The local reduction rule is β-reduction.

(λu:A. M) N ⟶_{L} [N/u]M

Here bound variables in M that are free in N must be renamed in order to avoid variable capture.

Disjunction. The proof term for disjunction introduction is the proof of the premiss together with an indication whether it was inferred by introduction on the left or on the right. We also annotate the proof term with the formula which did not occur in the premiss so that a proof terms always proves exactly one proposition.

\begin{aligned}M :· A \\ & ∨I_{L} \\ inl^{B} M :· A ∨ B \end{aligned}  \begin{aligned}N :· B \\ & ∨I_{R} \\ inr^{A} N :· A ∨ B \end{aligned}

The elimination rule corresponds to a case construction.

M :· A ∨ B  \frac{u′_{1}}{u_{1} :· A} ; ⋮ ; N_{1} :· C \frac{u′_{2}}{u_{2} :· B} ; ⋮ ; N_{2} :· C

∨E^{u_{1},u_{2},u′_{1},u′_{2}} (case M of inl u_{1} ⇒ N_{1} | inr u_{2} ⇒ N_{2}) :· C

Since the variables u_{1} and u_{2} label assumptions, the corresponding proof term variables are bound in N_{1} and N_{2}, respectively. The two reduction rules now also look like rules of computation in a λ-calculus.

case inl^{B} M of inl u_{1} ⇒ N_{1} | inr u_{2} ⇒ N_{2} ⟶_{L} [M/u_{1}]N_{1}
case inr^{A} M of inl u_{1} ⇒ N_{1} | inr u_{2} ⇒ N_{2} ⟶_{L} [M/u_{2}]N_{2}

The substitution of a deduction for a hypothesis is represented by the substitution of a proof term for a variable.

Negation. This is similar to implication. Since the premise of the rule is parametric in p the corresponding proof constructor must bind a propositional variable p, indicated by μ^{p}. Similar, the elimination construct must record the formula so we can substitute for p in the reduction. This is indicated as a subscript in ·_{C}.

\frac{u′}{u :· A} ; ⋮ ; M :· p ; ¬I^{p,u,u′} ; μ^{p}u:A. M :· ¬A  \begin{aligned}M :· ¬A  N :· A \\ & ¬E \\ M ·_{C} N :· C \end{aligned}

The reduction performs formula and proof term substitutions.

(μ^{p}u:A. M) ·_{C} N ⟶_{L} [N/u][C/p]M

Truth. The proof term for ⊤I is written ⟨ ⟩.

\frac{⊤I}{⟨ ⟩ :· ⊤}

Of course, there is no reduction rule.

Absurdity. Here we need to annotate the proof term abort with the formula being proved to avoid ambiguity.

M :· ⊥ ⊥E

abort^{C} M :· C

Again, there is no reduction rule.

In summary, we have

Terms M ::= u  Hypotheses
| ⟨M_{1}, M_{2}⟩ | fst M | snd M  Conjunction
| λu:A. M | M_{1} M_{2}  Implication
| inl^{A} M | inr^{A} M  Disjunction
| (case M_{1} of inl u_{1} ⇒ M_{2} | inr u_{1} ⇒ M_{3})
| μ^{p}u:A. M | M ·_{C} N  Negation
| ⟨ ⟩  Truth
| abort^{A} M  Falsehood

and the reduction rules

π_{1}  fst ⟨M, N⟩ ⟶_{L} M
π_{2}  snd ⟨M, N⟩ ⟶_{L} N
β  (λu:A. M) N ⟶_{L} [N/u]M
ρ_{1} case inl^{B} M of inl u_{1} ⇒ N_{1} | inr u_{2} ⇒ N_{2} ⟶_{L} [M/u_{1}]N_{1}
ρ_{2} case inr^{A} M of inl u_{1} ⇒ N_{1} | inr u_{2} ⇒ N_{2} ⟶_{L} [M/u_{2}]N_{2}
μ  (μ^{p}u:A. M) ·_{C} N ⟶_{L} [N/u][C/p]M

We can now see that the formulas act as types for proof terms. Shifting to the usual presentation of the typed λ-calculus we use τ and σ as symbols for types, and τ × σ for the product type, τ → σ for the function type, τ + σ for the disjoint sum type, 1 for the unit type and 0 for the empty or void type. Base types b remain unspecified, just as the basic propositions of the propositional calculus remain unspecified. Types and propositions then correspond to each other as indicated below.

Types τ ::= b | τ_{1} × τ_{2} | τ_{1} → τ_{2} | τ_{1} + τ_{2} | 1 | 0
Propositions A ::= p | A_{1} ∧ A_{2} | A_{1} ⊃ A_{2} | A_{1} ∨ A_{2} | ⊤ | ⊥

We omit here the negation type which is typically not used in functional programming and thus does not have a well-known counterpart. We can ¬A as corresponding to τ → 0, where τ corresponds to A (see Exercise ??). In addition to the terms, shown above, the current set of hypotheses which are available in a subdeduction are usually made explicit in a context Γ. These are simply a list of variables with their types. We assume that no variable is declared twice in a context.

Contexts Γ ::= · | Γ, u:A

We omit the · at the beginning of a context or to the left of the typing judgment. The typing rules for the λ-calculus are the rules for natural deduction under a shift of notation and with explicit contexts. The typing judgment has the form

Γ ▷ M : τ M has type τ in context Γ

Γ ▷ M : τ Γ ▷ N : σ pair

Γ ▷ ⟨M, N⟩ : τ × σ

Γ ▷ M : τ × σ ; fst ; Γ ▷ fst M : τ Γ ▷ M : τ × σ snd Γ ▷ snd M : σ

\begin{aligned}Γ, u:τ ▷ M : σ \\ & lam \\ Γ ▷ (λu:τ. M) : τ → σ \end{aligned}  \begin{aligned}u : τ in Γ \\ & var \\ Γ ▷ u : τ \end{aligned}

Γ ▷ M : τ → σ Γ ▷ N : τ app

Γ ▷ M N : σ

Γ ▷ M : τ

inl

Γ ▷ inl^{σ} M : τ + σ

Γ ▷ N : σ

inr

Γ ▷ inr^{τ} N : τ + σ

Γ ▷ M : τ + σ  Γ, u:τ ▷ N_{1} : ν  Γ, u:σ ▷ N_{2} : ν case

Γ ▷ (case M of inl u_{1} ⇒ N_{1} | inr u_{2} ⇒ N_{2}) : ν

\frac{unit}{Γ ▷ ⟨ ⟩ : 1}

Γ ▷ M : 0

abort

Γ ▷ abort^{ν} M : ν

7.5 Generalization to First-Order Arithmetic

We have not yet made the connection between local reduction and computation in a functional programming language. Before we examine this relationship, we investigate how the Curry-Howard isomorphism might be generalized to first-order arithmetic. This involves two principal steps: one to account for quantifiers, and one to account for natural numbers and proofs by induction. The natural numbers here stand in for arbitrary inductively defined datatypes, which are beyond the scope of these notes. We begin by generalizing to first-order logic, that is, without any particular built-in datatype such as the natural numbers.

Terms and Atomic Formulas. A well-formed first-order term f(t_{1}, …, t_{n}) where f is an n-ary function symbol corresponds to the application f t_{1} … t_{n}, where f has been declared to be a constant of type i → ⋯ → i. In the propositional case, atomic formulas are drawn from some basic propositions and propositional variables. In first-order logic, well-formed atomic formulas have the form P (t_{1}, …, t_{n}), where P is an n-ary predicate. This corresponds directly to the familiar notion of a type family p indexed by terms t_{1}, …, t_{n}, all of type i. In summary: under the Curry-Howard isomorphism, predicates correspond to type families.

Universal Quantification. Recall the introduction and elimination rules for universal quantification:

\begin{aligned}[a/x]A \\ & ∀I^{a} \\ ∀x. A \end{aligned}  \begin{aligned}∀x. A \\ & ∀E \\ [t/x]A \end{aligned}

where a is a new parameter. This suggests that the proof term should be a function which, when given a well-formed first-order term t returns a proof of [t/x]A. It is exactly this reading of the introduction rule for ∀ that motivated its representation in LF. The elimination rule then applies this function to the argument t. This reasoning yields the following formulation of the rules with explicit proof terms.

\begin{aligned}[a/x]M :· [a/x]A \\ & ∀I \\ (λx:i. M) :· ∀x. A \end{aligned}  \begin{aligned}M :· ∀x. A \\ & ∀E \\ M t :· [t/x]A \end{aligned}

This formulation glosses over that we ought to check that t is actually well-formed, that is, has type i. Similarly, we may need the assumption that a is of type i while deriving the premiss of the introduction rule. This leads to the following versions.

\frac{u}{a : i} ; ⋮ ; [a/x]M :· [a/x]A ; ∀I^{a,u} ; (λx:i. M) :· ∀x. A  \begin{aligned}M :· ∀x. A  t : i \\ & ∀E \\ M t :· [t/x]A \end{aligned}

It has now become apparent, that we have not unified the notions of propositions and types: these rules employ a typing judgment t : i as well as a proof term judgment M :· A. The restriction of the universal quantifier to terms of type i is quite artificial from the point of view of the Curry-Howard isomorphism. If we drop this distinction and further eliminate the distinction between variables and parameters we obtain the rules for abstraction and application in the LF type theory, written in the style of natural deduction rather than with an explicit context.

\frac{u}{x : B} ; ⋮ ; M : A ; ∀I^{x,u} ; (λx:B. M) : ∀x:B. A  \begin{aligned}M : ∀x:B. A  N : B \\ & ∀E \\ M N : [N/x]A \end{aligned}

Thus the universal quantifier corresponds to a dependent function type constructor Π under a modified Curry-Howard isomorphism. Following this line of development to its logical conclusion leads to a type theory in the tradition of Martin-Löf. Thompson [Tho91] provides a good introduction to this complex subject. We will only return to it briefly when discussing the existential quantifier below; instead we pursue an alternative whereby we contract proofs to programs rather than insisting on an isomorphism.

The local reduction rule for the universal quantifier

\begin{matrix}D \\ [a/x]A \end{matrix} ; ∀I ; ∀x. A ; ∀E ; [t/x]A ⟹_{L} \begin{matrix}[t/a]D \\ [t/x]A \end{matrix}

corresponds to β-reduction on the proof terms.

(λx:i. M) t ⟶_{L} [t/x]M

The language of proof terms now has two forms of abstraction: abstraction over individuals (which yields proof terms for universal formulas) and abstraction over proof terms (which yields proof terms for implications). In a type theory such as LF, these are identified and the latter is seen as a special case of the former where there is no dependency (see Exercise 3.9).

Existential Quantification. The proof term for existential introduction must record both the witness term t and the proof term for [t/x]A. That is, we have

\begin{aligned}[t/x]A \\ & ∃I \\ ∃x. A \end{aligned}  \begin{aligned}M :· [t/x]A \\ & ∃I \\ ⟨t, M⟩ :· ∃x. A \end{aligned}

In the type-theoretic version of this rule, we generalize the existential quantifier to range over arbitrary types, and we must check that the witness has the requested type.

N : B M : [N/x]A

∃I ⟨N, M⟩ : ∃x:B. A

In analogy to the dependent function type, the existential forms a type for dependent pairs: the type of the second component M depends on the first component N. This is refered to as a sum type or Σ-type, since it is most commonly written as Σx:A. B. There are some variations on the sum type, depending on how one can access the components of its elements, that is, depending on the form of the elimination rule. If we directly equip the logical elimination rule

∃x. A  \frac{u}{[a/x]A} ; ⋮ ; C

∃E^{a,u} C

with proof objects we obtain a case construct for pairs (with only one branch).

M :· ∃x. A  \frac{u′}{u :· [a/x]A} ; ⋮ ; [a/x]N :· C

∃E^{a,u,u′} (case M of ⟨x, u⟩ ⇒ N) :· C

Here, x and u are bound in N which reflects that the right premiss of the existential elimination rule is parametric in a and u. In type theory, this construct is sometimes called split or spread. The local proof reduction

\begin{aligned}\begin{matrix}D \\ [t/x]A \end{matrix} ; ∃I ; ∃x. A & \frac{u}{[a/x]A} ; E ; C \\ & ∃E^{a,u} \\ C \end{aligned} ⟹_{L}  \begin{aligned}D \\ & u \\ [t/x]A \end{aligned} ; [t/a]E ; C

translates to the expected reduction rule on proof terms

case ⟨t, M⟩ of ⟨x, u⟩ ⇒ N ⟶_{L} [t/x][M/u]N.

The language of proof terms now has two different forms of pairs: those that pair a first-order term with a proof term (which form proof terms of existential formulas) and those that pair two proof terms (which form proof terms of conjunctions). In type theory these are identified, and the latter is seen as a special case of the former where there is no dependency.

Certain subtle problems arise in connection with the existential type. Because of the difference in the elimination rules for conjunction and existential, we cannot apply fst and snd to pairs of the form ⟨t, M⟩. Moreover, snd cannot be defined in general from case for dependently typed pairs (see Exercise 7.8). Perhaps even more significantly, proof terms no longer uniquely determine the formula they prove (see Exercise 7.9). In the theory of programming languages, existential and sum types can be used to model abstract data types and modules; the problems mentioned above must be addressed carefully in each such application.

Natural Numbers. If we fix the domain of individuals to be the natural numbers, we arrive at first-order arithmetic. We write nat instead of i and we have a constant z (denoting 0) and a unary function symbol s (denoting the successor function). The fact that these are the only ways to construct natural numbers is usual captured by Peano’s axiom schema of induction:

For any formula A with free variable x,

[z/x]A ∧ (∀x. A ⊃ [s(x)/x]A) ⊃ ∀x. A.

Our approach has been to explain the semantics of language constructs by inference rules, rather than axioms in a logic. If we look at the rules

\frac{NI_{z}}{z : nat}  t : nat ; NI_{s} ; s(t) : nat

as introduction rules for elements of the type nat, then we arrive at the following elimination rule.

t : nat  [z/x]A  \frac{u}{[a/x]A} ; ⋮ ; [s(a)/x]A
NE^{a,u} [t/x]A

Here, the judgment of the third premiss is parametric in a and hypothetical in u. The local reductions follow from this view. If t was inferred by NI_{z} (and thus t = z), the conclusion [z/x]A is proved directly by the second premiss.

\begin{aligned}\frac{NI_{z}}{z : nat} & \begin{matrix}E_{1} \\ [z/x]A \end{matrix} & \frac{u}{[a/x]A} ; E_{2} ; [s(a)/x]A \\ NE & a,u \\ & [z/x]A \end{aligned} ⟹_{L} \begin{matrix}E_{1} \\ [z/x]A \end{matrix}

If t was inferred by NI_{s} (and thus t = s(t′)), then we can obtain a derivation E′ of [t′/x]A by NE. To obtain a derivation of [s(t′)/x]A we use the parametric and hypothetical derivation of the rightmost premiss: we substitute t′ for a and D′ for the hypothesis u.

\begin{matrix}D′ \\ t′ : nat \end{matrix} ; NI_{s} ; s(t′) : nat \begin{matrix}E_{1} \\ [z/x]A \end{matrix}  \frac{u}{[a/x]A} ; E_{2} ; [s(a)/x]A
NE^{a,u}
[s(t′)/x]A

⟹_{L}  \begin{aligned}\begin{matrix}D′ \\ t′ : nat \end{matrix} & \begin{matrix}E_{1} \\ [z/x]A \end{matrix} & \frac{u}{[a/x]A} ; E_{2} ; [s(a)/x]A \\ NE & a,u \\ & [t′/x]A \end{aligned} ; [t′/a]E_{2} ; [s(t′)/x]A

In order to write out proof terms for the NE rule, we need a new proof term constructor prim.

t : nat  N_{1} :· [z/x]A  \frac{u′}{u :· [a/x]A} ; ⋮ ; [a/x]N_{2} :· [s(a)/x]A
NE^{a,u,u′} prim t N_{1} (x, u. N_{2}) :· [t/x]A

Here, x and u are bound in N_{2}. The local reductions can then be written as

prim z N_{1} (x, u. N_{2}) ⟶_{L} N_{1}
prim (s(t′)) N_{1} (x, u. N_{2}) ⟶_{L} [t/x][(prim t′ N_{1} (x, u. N_{2}))/u]N_{2}

An analogous construct of primitive recursion at the level of first-order terms (rather than proof terms) is also usually assumed in the treatment of arithmetic in order to define new functions such as addition, multiplication, exponentiation, etc. From the point of view of type theory, this is a special case of the above, where A does not depend on x. The typing rule has the form

t : nat  t_{1} : τ  \frac{u_{1},}{x : τ} \frac{u_{2}}{y : τ} ; ⋮ ; t_{2} : τ
NE^{x,y,u_{1},u_{2}} prim t t_{1} (x, y. t_{2}) : τ

and the local reduction are

prim z t_{1} (x, y. t_{2}) ⟶_{L} t_{1}
prim (s(t′)) t_{1} (x, y. t_{2}) ⟶_{L} [t′/x][(prim t′ t_{1} (x, y. t_{2}))/y]t_{2}

Here we followed the convention for type systems where parameters are not used explicitly, but the same name is used for a bound variable and its corresponding parameter.

In ordinary primitive recursion we also have λ-abstraction and application, but the result type τ of the prim constructor is restricted to be nat. The more general definition above is the basis for the language of primitive recursive functionals, which is at the core of Gödel’s system T [Göd90]. Strictly more functions can be defined by using primitive recursion at higher types. A famous example is the Ackermann function, which is not primitive recursive, but lies within Gödel’s system T. The surface syntax of terms defined by prim can be rather opaque, their properties are illustrated by the following formulation. Define

\begin{aligned}f & = & λx. prim x t_{1} (x, y. t_{2}) \\ g & = & λx. λy. t_{2}. \end{aligned}

7.6. CONTRACTING PROOFS TO PROGRAMS^{∗} 239

Then f satisfies (using a notion of equivalence ≡ not made precise here)

\begin{aligned}f(z) & ≡ & t_{1} \\ f(s(x)) & ≡ & g x (f(x)). \end{aligned}

If we think in terms of evaluation, then x will be bound to the predecessor of the argument to f, and y will be bound to the result of the recursive call to f on x when evaluating t_{2}.

In order to make arithmetic useful as a specification language, we also need some primitive predicates such as equality or inequality between natural numbers. An equality should satisfy the usual axioms (reflexivity, symmetry, transitivity, congruence), but it should also allow computation with functions defined by primitive recursion. Furthermore, we need to consider Peano’s third and fourth axioms.^{2}

\begin{matrix}∀x. ¬s(x) ≐ z \\ ∀x. ∀y. s(x) ≐ s(y) ⊃ x ≐ y \end{matrix}

These axioms insure that we can prove that different natural numbers are in fact distinct; all the other axioms would also hold if, for example, we interpreted the type nat as the natural numbers modulo 5. We can formulate these additional axioms as inference rules and write out appropriate proof terms. We postpone the detailed treatment until the next section, since some of these rules will have no computational significance.

In the realm of Martin-Löf type theories, the best treatment of equality is also a difficult and controversial subject. Built into the theory is an equality judgment that relates objects based on the rules of computation. We have an equality type which may or may not be extensional. For further discussion, the interested reader is referred to [Tho91].

[ insert equality rules here, but which formulation? ]

7.6 Contracting Proofs to Programs^{∗}

In this section we presume that we are only interested in data values as results of computations, rather than proof terms. Then a proof may contain significantly more information than the program extracted from it. This phenomenon should not come unexpectedly: it usually requires much more effort to prove a program correct than to write it. As a first approximation toward program extraction, we postulate that the type extracted from an equality formula should be the unit type 1, and that the proof object extracted from any proof of an equality should be the unit element ⟨ ⟩. The extraction function |·| for types then has the following shape.

2[a note on negation]

\begin{aligned}|t_{1} ≐ t_{2}| & = & 1 \\ |A ∧ B| & = & |A| × |B| \\ |A ∨ B| & = & |A| + |B| \\ |A ⊃ B| & = & |A| → |B| \\ |⊤| & = & 1 \\ |⊥| & = & 0 \\ |∀x. A| & = & nat → |A| \\ |∃x. A| & = & nat × |A| \end{aligned}

As examples we consider two simple specifications: one for the predecessor function on natural numbers, and one for the integer division of a number by 2. For the first example, recall that ¬A is merely an abbreviation for A ⊃ ⊥.^{3}

Pred = ∀x. ∃y. ¬x ≐ z ⊃ x ≐ s(y)
|Pred| = nat → (nat × ((1 → 0) → 1))
double = lam x. prim x z (x′, y. s (s y))
Half = ∀x. ∃y. x ≐ double y ∨ x ≐ s (double y)
|Half | = nat → (nat × (1 + 1))

These types may be surprising. For example we would expect the predecessor function to yield just a natural number. At this point we observe that there is only one value of the unit type 1. Thus, for example, the function ((1 → 0) → 1) can only ever return the unit element ⟨ ⟩. Therefore it carries no new information can can be contracted to 1. We reason further that a value of type nat×1 must be a pair of a natural number and the unit element and carries no more information that nat itself. In general we are taking advantage of the following intuitive isomorphisms between types.^{4}

\begin{matrix}τ × 1 ≅ τ & 1 × τ ≅ τ \\ τ → 1 ≅ 1 & 1 → τ ≅ τ \end{matrix}

Some other isomorphisms do not hold. In particular, the type 1 + 1 cannot be simplified: It contains two values (inl ⟨ ⟩ and inr ⟨ ⟩), while 1 contains only one. In order to make programs more legible, we will abbreviate

1 + 1 = bool
inl ⟨ ⟩ = true
inr ⟨ ⟩ = false
if e_{1} then e_{2} else e_{3} = case e_{1} of inl x ⇒ e_{2} | inr y ⇒ e_{3}

3[this must be fixed for proper treatment of negation]

4Some further isomorphism may be observed regarding the void type 0, but we do not consider it here. For a detailed treatment, see [And93].

7.7. PROOF REDUCTION AND COMPUTATION^{∗} 241

In the modified type extraction, we use the isomorphisms above in order to concentrate on computational contents.

[ The remainder of this section and chapter is under construction. ]

7.7 Proof Reduction and Computation^{∗}

7.8 Termination^{∗}

7.9 Exercises

Exercise 7.1 Prove the following by natural deduction using only intuitionistic rules when possible. We use the convention that ⊃, ∧, and ∨ associate to the right, that is, A ⊃ B ⊃ C stands for A ⊃ (B ⊃ C). A ≡ B is a syntactic abbreviation for (A ⊃ B) ∧ (B ⊃ A). Also, we assume that ∧ and ∨ bind more tightly than ⊃, that is, A ∧ B ⊃ C stands for (A ∧ B) ⊃ C. The scope of a quantifier extends as far to the right as consistent with the present parentheses. For example, (∀x. P (x) ⊃ C) ∧ ¬C would be disambiguated to (∀x. (P (x) ⊃ C)) ∧ (¬C).

1. A ⊃ B ⊃ A.

2. A ∧ (B ∨ C) ≡ (A ∧ B) ∨ (A ∧ C).

3. (Peirce’s Law). ((A ⊃ B) ⊃ A) ⊃ A.

4. A ∨ (B ∧ C) ≡ (A ∨ B) ∧ (A ∨ C).

5. A ⊃ (A ∧ B) ∨ (A ∧ ¬B).

6. (A ⊃ ∃x. P (x)) ≡ ∃x. (A ⊃ P (x)).

7. ((∀x. P (x)) ⊃ C) ≡ ∃x. (P (x) ⊃ C).

8. ∃x. ∀y. (P (x) ⊃ P (y)).

Exercise 7.2 Show that the three ways of extending the intuitionistic proof system are equivalent, that is, the same formulas are deducible in all three systems.

Exercise 7.3 Assume we had omitted disjunction and existential quantification and their introduction and elimination rules from the list of logical primitives. In the classical system, give a definition of disjunction and existential quantification (in terms of other logical constants) and show that the introduction and elimination rules now become admissible rules of inference. A rule of inference is admissible if any deduction using the rule can be transformed into one without using the rule.

Exercise 7.4 Carefully state and prove adequacy of the given representation for for terms, formulas, and natural deductions in LF.

Exercise 7.5 Give an interpretation of the classical calculus in the intuitionistic calculus, that is, define a function \overline{()} from formulas to formulas such that A is deducible in the classical calculus if and only if \overline{A} is deducible in the intuitionistic calculus.

Exercise 7.6 Give the representation of the natural deductions in Exercise 7.1 in Elf.

Exercise 7.7 Give the LF representations of the rules of indirect proof, double negation, and excluded middle from Page 214.

Exercise 7.8 [ on problems with typing of snd on dependently typed pairs ]

Exercise 7.9 [ failure of uniqueness of types with existential or Σ types ]

Exercise 7.10 Using the normalization theorem for intuitionistic natural deduction (Theorem ??) prove that the general law of excluded middle is not derivable in intuitionistic logic.