4.2 The Realizability Interpretation
4.2.2 The Soundness Theorem
We come to the main result of this chapter, a soundness theorem for our reali- zability interpretation, which guarantees the correctness of program extraction. Definition 4.7 Given an MCICD-proof-term r we define the MCICD?-proof- term eras follows: e x := x λx.rg := λx.er e rs := rese h]r, si := her,esi g π1r := π1er πg2r := π2er g
inls := pack(inles) inrgs := pack(inres)
^
4.2. THE REALIZABILITY INTERPRETATION 121 ] ink,it := ink,iet ^ Itk(m, ~s, t~ ) := Itk(m,~~e s[m, ~s~ ],et) ^ Reck(m, ~s, t~ ) := Reck(m,~~e s[m, ~s~ ],et) ^
outk,it := outk,iet
^
CoItk(m, ~s, t~ ) := CoItk(m,~~e r[m, ~s~ ],packet)
^
CoReck(m, ~s, t~ ) := CoReck(m,~~e q[m, ~s~ ],packet)
^
outk−1(m, ~s~ ) := outk−1(m,~~e t[m, ~s~ ] )
where in the cases for (co)iteration, (co)recursion and inversion we have:
s[x, y] := λu.ey(ex(λv.v)u)
r[x, y] := λv.open v, w.xe(λu.packu)(ywe
q[x, y] := λv.openv, w.exλu.open u, v.case(v, v1.inlv1, v2.inr packv2)
(eyw)
t[x, y] := ex(λzz)ey
and we define~s[~x, ~y] :=s[x1, y1], . . . ,s[xk, yk](the same for r,q).
Definition 4.8 Given a proof-termt, and a subtermmoftsuch thatmoccurs in m~ for some subterm oft of one of the following forms
Itk(m, ~s, r~ ),Reck(m, ~s, r~ ),CoItk(m, ~s, r~ ),CoReck(m, ~s, r~ ),out−k1(m, ~s~ ), we say that m is an on-display monotonicity witness of t. The set of all on- display monotonicity witnesses of twill be denoted by W(t).
Observe for example that
W(Itk(m, ~s, r~ )) =W(m~)∪ W(~s)∪ W(r)∪ {m~}
Definition 4.9 Given a derivationΓ` s:A we define
(s) := {m(λzz) =λy.y|m∈ W(s)} ?(s) := ∪ (s) ?(~s) := ?(s1)∪. . .∪ ?(sk) The equations in
(s) represent the first functor law for every on-display monotonicity witnessmoccurring ins.
Given a context Γ ={x1:A1, . . . , xk:Ak}we set Γr:={x
1:x1rA1, . . . , xk :xk rAk}, where w.l.o.g. xi∈/F V(Ai).
We are now ready to prove the soundness theorem of our realizability inter- pretation.
Theorem 4.1 (Soundness of Realizability forMCICD) If Γ `MCICD, s : A thenΓr`
MCICD?, ?(s)es:srA Proof. Induction on `MCICD, .
Case (V ar) If Γ, x:A`x:Athen obviously also Γr, x:xrA`ex:xrA.
becausexe=x.
Case (→I). We have Γ`λxs:A→B coming from Γ, x:A`s:B. The IH yields Γr, x:xrA` ? (s)es:srB. which by (→I) yields Γr` ? (s)λxes:xrA→srB We have β `s= (λxs)x and w.l.o.g. x /∈F V(Γr, ?(s)). therefore we get Γr` ? (s)λxes:∀x.xrA→(λxs)xrB But as ?(s) =
?(λxs) this is the same as Γr` ?
(λxs)λxsg:λxsrA→B. Case (→E). We have Γ`st:B coming from Γ`s:A→B, Γ`t:A. The IH yields Γ` ?(s)se:srA→B, that is Γ` ?(s)se:∀z.z rA →sz rB, and
Γr ` ?
(t)et :trA. Instantiatingz:=t and eliminating the implication we get Γr` ?
(s)∪ ?(t)seet:strB, which is the same as Γr` ?(st)ste :strB.
Case (∀I). Assume Γ` s:∀xAcoming from Γ` s:A wherex /∈F V(Γ,
). The IH yields Γr ` ?
(s) es:srA. We can assume w.l.o.g. x /∈F V(Γr,
?(s)),
therefore by (∀I) we get Γr` ?
(s)es:∀x.srA, i.e. Γr` ?(s)es:sr∀xA.
Case (∀E). We have Γ ` s : A[x := r] coming from Γ` s : ∀xA. The IH yields Γr` ?
(s)es:sr∀xA, i.e. Γr` ?(s)se: ∀x.srA, which by (∀E) implies
Γr ` ?
(s) es : (s rA)[x := r]. As we can assume w.l.o.g. x /∈ F V(s) then, by lemma 4.7, we conclude Γr` ?
(s)es:srA[x:=r].
Case (∀2I). Assume Γ` s:∀XAcoming from Γ` s:A whereX /∈F V(Γ). The IH yields Γr` ?
(s)se:srA. AsX /∈F V(Γ) thenX+ ∈/F V(Γr) therefore (∀2I) yields Γr` ?
(s)se:∀X+.srA. But this is exactly Γr` ?(s)es:sr∀XA.
Case (∀2E). We have Γ ` s : A[X := F] coming from Γ ` s : ∀XA. The IH yields Γr` ?
(s)es:sr∀XA. i.e. Γr` ?(s)es:∀X+.srA, which by (∀2E)
yields Γr ` ?
(s) es : (s r A)[X+ := Fr], which by lemma 4.7, is the same as Γr` ?
(s)es:srA[X :=F].
Case (Eq). We have Γ ` s : A[x := t] coming from Γ ` s : A[x := r] and
` r = t. The IH yields Γr ` ?
(s) es : s r A[x := r]. Observe now that w.l.o.g. x /∈ F V(s) therefore we have Γr ` ?
(s) es : (s r A)[x := r]. Now by weakening we get
?(s)`r=twhich implies Γr` ?
(s)r=t, therefore by (Eq) we get Γr ` ?
(s) es: (sr A)[x :=t] which again asx /∈ F V(s) is the same as Γr` ?
(s)es:srA[x:=t].
Case (∧I). Assume Γ` hs, ti:A∧B from Γ`s:A, Γ`t:B. The IH yields Γr ` ? (s):se: s rA and Γr ` ?(t): et : t r B. As β `s = π1hs, ti, β ` t = π2hs, ti. then we have Γr ` ?(s):se:π1hs, tirA and Γr ` ?(t):te: π2hs, tirB
and by (∧I) we get Γr` ?
4.2. THE REALIZABILITY INTERPRETATION 123
Γr` ?
(hs,ti):h]s, ti:hs, tirA∧B.
Case (∧2E). We have Γ ` π2s : B from Γ ` s : A∧B. The IH yields
Γr` ?
(s)es:srA∧B, i.e., Γr` ?(s)se: (π1srA)∧(π2srB) which by (∧2E)
yields Γr` ?
(s)π2es:π2srB. But this is the same as Γr` ?(π2s)πg2s:π2srB.
Case (∧1E). Analogous to the previous case.
Case (∨LI) Assume Γ` inls:A∨B coming from Γ` s:A. The IH yields Γr` ?
(s)es:srA. from this and the obvious` inls=inls we get Γr ` ?
(s) es:srAinls=inls and (∨LI) yields
Γr` ?
(s)inles: (srAinls=inls)∨(srBinls=inrs) which is the same as
Γr` ?
(s)inles:
(zrAinls=inlz)∨(zrBinls=inrz)[z:=s] Therefore (∃I) yields
Γr` ?
(s)pack(inles) :∃z.(zrAinls=inlz)∨(zrBinls=inrz) But as
?(s) =
?(inls) this is exactly Γr` ?
(inls)inlgs:inlsrA∨B. Case (∨RI). Analogous to the previous case.
Case (∨E). Assume Γ` case(q, y.s, z.t) :C from Γ` q:A∨B, Γ, y :A`
s:C, Γ, z:B` t:C. The IH yields Γr` ? (q)eq:qrA∨B (4.36) Γr, y:yrA` ? (s)es:srC (4.37) Γr, z:zrB` ? (t)et:trC (4.38) SetD:= (urAq=inlu)∨(urBq=inru). We have
Γr, v:D[u:=y]`v: (yrAq=inly)∨(yrBq=inry) (4.39)
On the other hand we have
Γr, u:yrAq=inly`u:yrA
and by (4.37)
Γr, u:yrAq=inly, y:yrA`es:srC,
Now from
ands=case(inly, y.s, z.t)∈
β we get
Γr, u:yrAq=inly`s=case(q, y.s, z.t),
therefore
Γr, u:yrAq=inly, y:yrA`es:case(q, y.s, z.t)rC,
and by (Dsp1) (cf. lemma 4.1) Γr, u:yrAq=inly` ?
(s)es[y:=u] :case(q, y.s, z.t)rC. (4.40) Now using (4.38) and assuming w.l.o.g. y /∈F V(Γr, B, C) we get by (Dsp2)
Γr, z:yrB` ?
(t)[z:=y]et:t[z:=y]rC On the other hand using t[z:=y] =case(inry, y.s, z.t)∈
β we get
Γr, w:y rBq=inry` ?
(t)[z:=y]t[z:=y] =case(q, y.s, z.t). The two previous derivations imply by weakening and (Eq):
Γr, w:yrBq=inry, z:zrB` ?
(t)[z:=y]et:case(q, y.s, z.t)rC and from the obvious Γr, w :y rBq=inry ` ?
(t)[z:=y] w:y rB, (Dsp1) yields
Γr, w:yrBq=inry` ?
(t)[z:=y]et[z:=w] :case(q, y.s, z.t)rC (4.41) Derivations (4.40),(4.41) and (4.39) yield by (∨E):
Γr, v:D[u:=y]`case(v, u.se[y:=u], w.et[z:=w]) :case(q, y.s, z.t)rC,
which making explicity the equational contexts and byα-conversion is the same as
Γr, v:D[u:=y]` ?
(s)∪ ?(t)[z:=y]case(v, y.es, z.et) :case(q, y.s, z.t)rC.
Next observe that derivation (4.36) unfolds to Γr` ?
(q)eq:∃u.D. Therefore, as u /∈F V(Γr,case(q, y.s, z.t)rC,∃u.D), (∃E) yield
Γr` ?
(s)∪ ?(t)[z:=y]∪ ?(q)open(q, v.e case(v, y.es, z.et)) :case(q, y.s, z.t)rC.
Finally, as w.l.o.g. y /∈F V(Γr, s, q, C), (Dsp2) yield
Γr` ?
(s)∪ ?(t)∪ ?(q)open(q, v.e case(v, y.es, z.et)) :case(q, y.s, z.t)rC.
4.2. THE REALIZABILITY INTERPRETATION 125
Γr` ?
(case(q,y.s,z.t)) case(^q, y.s, z.t) :case(q, y.s, z.t)rC
Case (µI). We have Γ`ink,jt:µX(C1, . . . ,Ck)~j~scoming from Γ`t:Fj[X := µX(C1, . . . ,Ck)]~s. By IH we have Γr ` ? (t) et : t r Fj[X :=µX(C1, . . . ,Ck)]~s and by proposition 4.2 `λx.ink,jx: ∀~y∀z.zrFj[X :=µX(C1, . . . ,Ck)]~y → k jzr(µX(C1, . . . ,Ck))~j~y
Therefore instantiating~y, z:=~s, tand eliminating the implication we have Γr` ?
(t)(λx.ink,jx)et: kjtrµX(C1, . . . ,Ck)~j~s
Finally using subject reduction, the definition of ^ink,jt and observing that
?(in k,jt) = ?(t) and k jt=ink,jt∈ β we get Γr` ? (ink,jt) ^ ink,jt:ink,jtrµX(C1, . . . ,Ck)~j~s.
Case (µE). We have Γ`Itk(m, ~s, r~ ) :K~tfrom Γ`r:µX(C1, . . . ,Ck)~t,
Γ`mi:FimonX, Γ`si:Fi[X :=K]⊆ K~i, 1≤i≤k.
By IH we have
Γr` ?
(mi)mif :mirFimonX (1≤i≤k)
which by proposition 4.7 leads to Γr` ?
(mi)∪{mi(λz.z)=λy.y}mif :FirmonX+, (1≤i≤k)
therefore, by proposition 4.4, part (i), we get Γr` \ λ~x.λ~y .λz.It
k(m~,~s, z) :
rIndµX(C1,...,Ck) withmi:=mi,f si:= (λui.yi(xi(λv.v)ui)) and
\:=
?(m~)∪ {mi(λz.z) =λy.y|1≤i≤k}.
InstantiatingZ+:=Kr in
rIndµX(C1,...,Ck) (cf. formula (4.1), page 107) and using lemma 4.7 we get:
Γr` \ λ~x.λ~y .λz.It
k(m~,~s, z) : ∀~n. . . . , nirFimonX, . . .(1≤i≤k)→
∀f . . . . , fi~ rFi[X:=K]⊆ K~i, . . .(1≤i≤k)→
~n ~f rµX(C1, . . . ,Ck)⊆ K
Next instantiateni, fi:=mi, si: Γr` \ λ~x.λ~y .λz.It k(m~,~s, z) : . . . , mirFimonX, . . .(1≤i≤k)→ . . . , sirFi[X:=K]⊆ K~i, . . .(1≤i≤k)→ ~ m~srµX(C1, . . . ,Ck)⊆ K
By IH we have Γr` ?
(si)sie :sirFi[X:=K]⊆ K~i, hence we can eliminate
both implications with
\∪
?(~s) and apply subject reduction of the logic to
get: Γr` \ ∪ ?(~s)λz.Itk(m~, ~ts, z) : ~ m~srµX(C1, . . . ,Ck)⊆ K
wheremi:=mi,f tsi :=λui.sie(mif(λv.v)ui), that is,
Γr` \ ∪ ?(~s) λz.Itk(m~, ~ts, z) : ∀~y∀u.ur(µX(C1, . . . ,Ck))~y → ~ m~surK~y Again by IH we have Γr ` ? (r) re : r r µX(C1, . . . ,Ck)~t. Next instantiating ~y, u:=~t, rand eliminating the implication we obtain:
Γr` \ ∪ ?(~s)∪ ?(r) λz.Itk(m~, ~ts, z) e r: ~ m~s rrK~t
Finally, observing that
\∪ ?(~s)∪ ?(r) = ?(It k(m, ~s, r~ )) and ~ m~s r = Itk(m, ~s, r~ )∈
β, using subject reduction and the definitions of
,Itk^(m, ~s, r~ ) we get Γr` ? (Itk(m,~~ s,r)) ^ Itk(m, ~s, r~ ) :Itk(m, ~s, r~ )rK~t.
Case (µE+). Use the IH and part (ii) of proposition 4.4.
Case (νI). Use the IH and part (i) of proposition 4.5. Case (νI+). Use the IH and part (ii) of proposition 4.5.
Case (νIi). Use the IH and proposition 4.6.
De flores es la alfombra: muchas hay en tu casa y entre el musgo acu´atico canta y trina Xayacamachan: embriaga su coraz´on la flor de cacao.
Poema Nahuatl
Es gibt nichts praktischeres als eine gute Theorie.
Immanuel Kant (1724-1804)
5
Programming with Proofs
The applications of lambda calculus to computer science and logic via the Curry- Howard correspondence are well-known, see for example [Bar97, Ber97]. In this chapter we consider a nice application, namely a version of the progra- mming with proofs paradigm which was introduced by Krivine and Parigot in [KrPa90] forAF2(see also [Lei83] for a first explicit formulation of the method). Later in [Par92] Parigot extends the method to conventional inductive defini- tions whereas in [Raf94] Raffalli adds conventional coinductive definitions. Our contribution is to extend the paradigm to our system of clausular (co)inductive definitions, being this extension the main application of our realizability inter- pretation.5.1
Semantics
In this section we define a classical tarskian semantics forMCICD?, and therefore
for MCICD also, needed to present the important concept of data type in a
model, which is central for programming with proofs (see [Kri93, Par92]), and allows to establish a relation between modified realizability and our realizability concept.