A Typed Operational Semantics for Type Theory

Healfdene Goguen

Doctor of Philosophy University of Edinburgh

Abstract

Untyped reduction provides a natural operational semantics for type theory. Normalization results say that such a semantics is sound. However, this reduction does not take type information into account and gives no information about canonical forms for terms. We introduce a new operational semantics, which we call typed operational semantics, which defines a reduction to normal form for terms which are well-typed in the type theory.

The central result of the thesis is soundness of the typed operational semantics for the original system. Completeness of the semantics is straightforward. We demonstrate that this equivalence between the declarative and operational presentations of type theory has important metatheoretic consequences: results such as strengthening, subject reduction and strong normalization follow by straightforward induction on derivations in the new system.

We introduce these ideas in the setting of the simply typed lambda calculus. We then extend the techniques to Luo’s system UTT, which is Martin-Löf’s Logical Framework extended by a general mechanism for inductive types, a predicative universe and an impredicative universe of propositions. We also give a proofirrelevant set-theoretic semantics for UTT.

Acknowledgements

My supervisors Rod Burstall and Zhaohui Luo have been invaluable, and I greatly admire both of them. Rod was open and welcoming from when I first met him, and his balance between practical and theoretical interests and his ability to see important directions for research are impressive. Luo taught me most of what I know about type theory and more generally gave me an ability to appreciate detail. He was always friendly and open for discussion.

The LFCS provided an excellent environment for doing research, and the LEGO club in particular stimulated my interest in type theory. I had interesting discussions with Matt Fairtlough, Philippa Gardner, Martin Hofmann, John Longley, Randy Pollack and Alex Simpson. Randy Pollack’s LEGO proof assistant made learning type theory easier by providing a good implementation of type theory. I would also like to thank Savi Maharaj for submitting the thesis for me.

Two people who had a more substantial influence on this thesis are Thorsten Altenkirch and James McKinna. I had many beneficial discussions with Thorsten about type theory in general and the metatheory of type theories. James explained a broad range of topics to me over innumerable cups of coffee and tea. Both also read a draft version of this thesis and suggested useful improvements.

My step-father gave me my initial enthusiasm for computer science and taught me valuable problem-solving techniques. My mother gave me essential financial support and was encouraging throughout.

My father has had a large influence on this thesis. He first encouraged me to study theoretical computer science and suggested studying at the University of Edinburgh. In addition to letting me live with him for several months during a difficult period of my work, he was supportive of my technical work and sympathetic to the difficulties involved in writing a thesis.

This thesis would almost certainly not have been written without the longstanding support of Ted Kowalski at AT&T Bell Laboratories. Ted hired me for many years, and he taught me valuable technical and research skills as well as having an infectuous enthusiasm for his work and a wonderful ability to work with people. I spent a valuable summer working for Amy Felty and Elsa Gunter at AT&T Bell Laboratories.

I was supported financially for two years by an Overseas Research Students Award. The Science and Engineering Research Council and the European Community TYPES Basic Research Action provided funding for my last six months in Edinburgh. The CROAP project at INRIA Sophia-Antipolis also supported me while I finished the last parts of this thesis.

I would also like to thank my examiners, Alan Smaill and Jan Smith, for their careful reading of the thesis and their helpful comments.

The long time that I took in writing my thesis was made much more pleasant than it might have been because I lived with people who were both patient and supportive. I would like to thank Gail Durie, my parents in Oxford and my sister Alice, Thorsten Altenkirch and the Bath Street Housing Co-op, Sophie and Zazou Smith, and Penny Anderson.

Declaration

I declare that this thesis was composed by myself, and the work contained in it is my own except where otherwise stated.

Healfdene Goguen

Table of Contents

1. Introduction 1

1.1 A Brief Description of Type Theory . . . . . . . . . . . . . . . . . . 3 1.1.1 The Semantic Explanation of Judgements . . . . . . . . . . 3 1.1.2 Judgements with Hypotheses . . . . . . . . . . . . . . . . . 4 1.1.3 General Presentation of Types . . . . . . . . . . . . . . . . . 5 1.1.4 The Propositions-as-Types Embedding . . . . . . . . . . . . 6

1.2 Type Theory and Computer Science . . . . . . . . . . . . . . . . . . 9 1.2.1 Language Design and Semantics . . . . . . . . . . . . . . . . 9 1.2.2 Specification and Verification . . . . . . . . . . . . . . . . . 10 1.2.3 Inductive Types . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.2.4 Implementations of Type Theory . . . . . . . . . . . . . . . 11

1.3 A Computational View of Type Theory . . . . . . . . . . . . . . . . 12 1.4 An Overview of the Thesis . . . . . . . . . . . . . . . . . . . . . . . 15 1.5 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

2. The Simply Typed Lambda Calculus 20

2.1 The Proof System . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 2.1.1 Types and Terms . . . . . . . . . . . . . . . . . . . . . . . . 21 2.1.2 Judgements and Derivations . . . . . . . . . . . . . . . . . . 22 Table of Contents vi

2.1.3 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 2.2 λ^{S}: A Typed Operational Semantics . . . . . . . . . . . . . . . . . 26

2.2.1 Standard Reduction . . . . . . . . . . . . . . . . . . . . . . 26 2.2.2 Judgements and Derivations . . . . . . . . . . . . . . . . . . 28 2.2.3 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

2.3 Metatheory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 2.3.1 Basic Definitions . . . . . . . . . . . . . . . . . . . . . . . . 33 2.3.2 Basic Metatheory . . . . . . . . . . . . . . . . . . . . . . . . 37 2.3.3 λ^{S} and Reduction . . . . . . . . . . . . . . . . . . . . . . . . 43

2.4 Soundness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 2.4.1 Normalization Proofs . . . . . . . . . . . . . . . . . . . . . . 49 2.4.2 The Interpretation . . . . . . . . . . . . . . . . . . . . . . . 51 2.4.3 Properties of the Interpretation . . . . . . . . . . . . . . . . 53 2.4.4 Soundness . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 2.4.5 Consequences of Soundness . . . . . . . . . . . . . . . . . . 58

2.5 Discussion and Related Work . . . . . . . . . . . . . . . . . . . . . 59

3. UTT 63 3.1 Structure and Intended Use . . . . . . . . . . . . . . . . . . . . . . 63 3.2 The Logical Framework . . . . . . . . . . . . . . . . . . . . . . . . . 65

3.2.1 Contexts and Substitution Rules . . . . . . . . . . . . . . . 66 3.2.2 The Kind Type . . . . . . . . . . . . . . . . . . . . . . . . . 67 3.2.3 Judgemental Equality . . . . . . . . . . . . . . . . . . . . . 69 3.2.4 Dependent Product Kinds . . . . . . . . . . . . . . . . . . . 70

3.3 Inductive Data Types in UTT . . . . . . . . . . . . . . . . . . . . . 71 Table of Contents vii

3.3.1 An Example: The Natural Numbers . . . . . . . . . . . . . . 71 3.3.2 Schemas for Inductive Types . . . . . . . . . . . . . . . . . . 74

3.4 An Impredicative Universe of Propositions . . . . . . . . . . . . . . 79 3.5 Universes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84

4. Basic Metatheory for UTT 86

4.1 Metatheory for Type Theories . . . . . . . . . . . . . . . . . . . . . 86 4.1.1 Presentations of Type Theory . . . . . . . . . . . . . . . . . 87 4.1.2 Reduction and Equality . . . . . . . . . . . . . . . . . . . . 89 4.1.3 Syntax for Inductive Types . . . . . . . . . . . . . . . . . . 92 4.1.4 Metatheory for Inductive Types . . . . . . . . . . . . . . . . 94

4.2 Definitions for the Logical Framework . . . . . . . . . . . . . . . . . 95 4.3 An Alternative Induction on Terms . . . . . . . . . . . . . . . . . . 97

4.4 UTT^{−} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

4.5 Metatheory for UTT . . . . . . . . . . . . . . . . . . . . . . . . . . 99 4.6 Environments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 4.7 Definitions for the Metatheory . . . . . . . . . . . . . . . . . . . . . 100

4.7.1 Reduction and Normal Forms . . . . . . . . . . . . . . . . . 100 4.7.2 Labels and Untyped Reduction . . . . . . . . . . . . . . . . 104 4.7.3 Pre-Substitutions . . . . . . . . . . . . . . . . . . . . . . . . 105

4.8 UTT^{S} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

4.8.1 Judgements and Derivations . . . . . . . . . . . . . . . . . . 106 4.8.2 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

4.9 Metatheory for UTT^{S} . . . . . . . . . . . . . . . . . . . . . . . . . 112 4.9.1 Basic Metatheory . . . . . . . . . . . . . . . . . . . . . . . . 112 Table of Contents viii

4.9.2 Results About Reduction . . . . . . . . . . . . . . . . . . . . 118 4.9.3 Admissible Rules . . . . . . . . . . . . . . . . . . . . . . . . 123

4.10 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

5. A Set-Theoretic Model Construction 127 5.1 The Interpretation . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 5.2 Properties of the Interpretation . . . . . . . . . . . . . . . . . . . . 136 5.3 Soundness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

6. Soundness 147 6.1 Normalization Proofs . . . . . . . . . . . . . . . . . . . . . . . . . . 148 6.2 An Overview of the Proof . . . . . . . . . . . . . . . . . . . . . . . 150 6.3 Semantic Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 6.4 Valuations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160 6.5 The Interpretation . . . . . . . . . . . . . . . . . . . . . . . . . . . 161 6.6 Properties of the Interpretation . . . . . . . . . . . . . . . . . . . . 177 6.7 Soundness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183 6.8 Consequences of Soundness . . . . . . . . . . . . . . . . . . . . . . . 198

7. Conclusions and Further Work 200 7.1 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200 7.2 Further Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201

A. A Complexity Measure for UTT ^{−} 204 A.1 Set-Theoretic Preliminaries . . . . . . . . . . . . . . . . . . . . . . . 205 A.2 An Alternative Interpretation of Propositions . . . . . . . . . . . . 206

A.3 UTT^{∗} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207

Chapter 1

Introduction

Many specification and verification systems are based on traditional mathematical formalisms such as first-order logic and set theory. However, although these formalisms are well suited to the tasks for which they were designed, they have shortcomings when used in this setting. In recent years type theory, originally designed as a basis for formalizing constructive mathematics, has been put forward as an alternative.

Type theory views computation as fundamental. A type is defined by giving its canonical elements and defining when two canonical elements are equal. We also introduce non-canonical elements corresponding to induction or recursion over the canonical elements of a type. The process of reducing non-canonical elements to canonical ones provides a natural operational semantics for programs written in type theory. Furthermore, the importance of computation in the formulation of type theory leads to implementations that are more straightforward than those of traditional logics.

In type theory, propositions are themselves types whose elements are their proofs. Because proofs are objects in the system, it is easy to check their correctness, which provides a convenient way to study program extraction. Furthermore, because computation and logical inference are dealt with in a unified framework, the gap in other specification languages between the programming language and the specifications is absent. Hence type theory offers an implementable formalism with theoretical benefits over more traditional systems.

One significant shortcoming of type theory from the perspective of computer science has been the lack of a well-behaved, uniform mechanism for understanding datatypes. One system with datatypes that is uniform and intuitively clear is Martin-Löf’s extensional type theory. This theory explains datatypes as wellorderings and assumes that functions are extensional—that is, two functions are equal if their domain and range are equal and their result is equal for all elements in the domain. Unfortunately, the system with extensionality fails to have some important properties: for example, type-checking in the system is not decidable.

Zhaohui Luo has proposed a system, which he calls a Unifying Theory of Dependent Types or UTT, that avoids this problem. He uses a logical framework to describe the type theory, much as one uses such frameworks to describe conventional logics. However, instead of adding new types individually, such as the type of pairs, he gives a schema for describing all types of a certain form. These types correspond closely to those used in programming. The schema uses only the syntactic notion of an expression with holes in it that is provided by the logical framework. This system is based on formulations by Backhouse [6], Dybjer [25] and Coquand and Paulin-Mohring [19].

In this thesis we shall show that desirable properties, such as consistency and termination of computation, hold for this calculus. In doing so, we shall introduce a new system to help us understand the computational behavior of type theory. This system is an operational semantics which combines a special reduction relation which is universal with respect to all reductions with type information. We shall see that this new system leads to considerable technical improvements in the study of the relationship between logic and computation. Our primary interest throughout the thesis will be the exploration of the application of this idea to our understanding of the metatheory of type theories.

1.1 A Brief Description of Type Theory

We shall begin by introducing the basic ideas of type theory, giving substance to the general description in the opening paragraphs. We present the kinds of statements that we can make in type theory and give an explanation of how we understand these statements. The explanations of the meanings of the statements justify the formal rules in the system. We also explain the general structure of the presentation of a new type in type theory. Finally, we describe how propositions can be understood within the type-theoretic framework.

Our description here is based on the work of Martin-Löf, in particular Martin-Löf’s book [54] and Nördstrom, Petersson and Smith’s book describing Martin-Löf’s type theory [63]. Martin-Löf calls the entities in his theories “sets” where we have called the entities “types.”

1.1.1 The Semantic Explanation of Judgements

Type theory is a formal language based on a conceptual organization of objects. A type is a collection of objects with some common property: we have types of pairs, types of functions and the type of natural numbers. The basic statements we make in type theory are concerned with the validity of some property or whether some object has a property. We are also interested in whether different expressions denote the same object in a type.

Less informally, we have two basic entities, objects and types. We shall say that an object is canonical or in canonical form if its outermost constructor is an introduction constant. We make statements or judgements about the relationship between objects and types. The type theories we shall be interested in have four forms of judgement, each with a corresponding semantic explanation:

A type This means that we know the canonical objects that are elements of A, and furthermore we have some notion of equality for any two objects in canonical form in A. The equality relation for the type A must be a decidable equivalence relation.

A = B This judgement says that the types A and B have the same canonical objects as elements, and furthermore the equalities associated with A and B are the same.

M: A This says that M is a method or program which when executed yields a canonical object which is an element of the type A. We must already know that A is a type in order for this to make sense.

M = N: A We take this to mean that M and N are methods which when executed yield canonical objects associated with them which are both elements of the type A, and furthermore the canonical objects are equal relative to the notion of equality for A.

We shall call the presentation of the type theory which arises out of these semantic explanations the semantic presentation of the type theory.

Hence succ(1 + 1) is a canonical element of the natural numbers, because succ is a constructor for the natural numbers and 1 + 1 is a natural number, since we can reduce it to a canonical natural number as well. The method of finding a canonical form from a non-canonical form, the notion of computation, is taken as a primitive notion in type theory. We assume that this method of evaluation proceeds from the outside of a term.

1.1.2 Judgements with Hypotheses

We also want to make judgements under assumptions. We explain the meaning of judgements under one assumption using the previously given explanation of judgements with no assumptions. Each of these judgements with a single assumption assumes that the type associated with the assumption is already well-typed, that is we must already know C type below: z:C ⊢ A type If we know this judgement then we know that [P/z]A type holds

for every P such that P: C. Furthermore, we know that [P/z]A = [Q/z]A if P = Q: C, where we take [P/z]A to be the result of substituting P for each free occurrence of z in A.

z:C ⊢ A = B This judgement means that [P/z]A = [P/z]B for every P: C.

z:C ⊢ M: A This judgement means that we know that [P/z]M: [c/z]A for every P: C, and furthermore that [P/z]M = [Q/z]M: [P/z]A if P = Q: C.

z:C ⊢ M = N: A This judgement means that [P/z]M = [P/z]N: [P/z]A for every P: C.

This explanation of judgements under a single assumption can be extended to judgements with finite sequences of assumptions in a straightforward manner.

We shall add to these judgement forms another judgement form, that

⊢z_{1} : C_{1}, …, z_{n}: C_{n}

which we take to mean that

• C_{1} type,

• …,

• [P_{1}, …, P_{n−1}/z_{1}, …, z_{n−1}]C_{n} type for any

– P_{1} ∈ C_{1},

– …,

– P_{n−1} ∈ [P_{1}, …, P_{n−2}/z_{1}, …, z_{n−2}]C_{n−1}.

1.1.3 General Presentation of Types

There is a common pattern in the rules for introducing types in type theory. Each type will be defined by giving rules in each of four general categories:

Formation Rules These rules, one for each type, will dictate how to form the new type from other types, families of types and elements of types. We also need to say under what circumstances the new type is equal to other types.

Introduction Rules These rules introduce the canonical elements of the type being defined and when two canonical elements are equal. It is these rules which give meaning to the type, in the sense that we have fulfilled the requirements for knowing how to judge that we have a type.

Elimination Rules These rules allow us to define functions or programs on the type which has been defined by the introduction rules.

Equality Rules The equality rules relate the introduction and elimination rules. They show how the function defined by the elimination rule behaves on the canonical elements of the type, the canonical elements having been defined by the introduction rules.

In Section 3.3.1 we give an example of how this general pattern is used by explaining in depth the introduction of the type of natural numbers.

1.1.4 The Propositions-as-Types Embedding

A fundamental idea in the justification of type theory as a foundation for constructive mathematics or as a basis for specification and verification of programs is the principle of propositions as types. This principle is based on the observation by Curry [20] and Howard [39] of the close correspondence between systems of natural deduction for intuitionistic logical inference and type systems.

The underlying idea of this principle is that we can relate propositions to types by understanding a proposition as the type of proofs of the proposition. We can see the similarity between the traditional reading of the intuitionistic connectives and the canonical objects we have discussed above: to have a proof of A ∧ B we must have a pair of proofs, one of A and one of B; a canonical element of the type of proofs of A∧B is a pair of an element of the type of proofs of A and an element of the type of proofs of B. Similarly, to have a proof of A ⊃ B we must have a map from proofs of A to proofs of B; an element of the type of proofs of A ⊃ B is a function from elements of the type of proofs of A to elements of the type of proofs of B.

In this context the method of evaluating a term to find a canonical form corresponds to the process of proof normalization or cut elimination in systems of natural deduction. This says that we can remove inessential elimination–introduction pairs in proofs, resulting in a proof which can be recognized directly as a proof according to the intuitionistic reading of the connectives.

Dependent types or families of types allow us to understand quantification under the propositions-as-types paradigm. A proof of the proposition ∀x: A.P, where x can occur in P, will be a function which for each M: A returns an element of the type of proofs of [M/x]P. Here we have formed the judgement P type under the assumption that x: A, a process which was explained above in Section 1.1.2.

The systems studied by Curry and Howard were systems for which there was an equivalence between propositions and types. This equivalence holds for various logics and type theories: for example, an extension of the simply typed lambda calculus corresponds to full intuitionistic first-order logic, as developed by Howard [39]; and System F corresponds to second-order propositional logic, where the former type theory and the equivalence were studied by Girard [32]. For this reason the propositions-as-types embedding is also referred to as an isomorphism.

Second-order logic includes the powerful logical principle of impredicativity. This principle allows us to quantify over all propositions to form a new proposition. The basic type theory with impredicativity or polymorphism, System F, was introduced independently by Girard [32] and Reynolds [67].

The mechanisms of impredicativity and dependent types were combined by Coquand and Huet [18] in the Calculus of Constructions. This system is a type system corresponding to a powerful higher-order logic and provides a strong basis for the formalization of mathematics.

Martin-Löf has extended the equivalence of propositions and types by identifying the two concepts for more complex theories. Hence in Martin-Löf’s type theory, the judgement “A is a proposition” is simply understood as another way of saying that A is a type, and to know that a proposition A is true is simply to know that A is inhabited.

An alternative view is that although type theory provides a framework in which to understand both logical inference and computation, we need not identify these two ideas. We can indeed treat propositions as types, but we do not need to see types as propositions as well. Luo’s book [47] lists several reasons for viewing the identification of propositions and types as unnatural: first, the logic of our system should be independent of the objects studied in it; secondly, certain types such as the natural numbers do not intuitively correspond to propositions; thirdly, type theory is often considered open to the addition of new types representing new computational or mathematical objects, but the addition of these objects should not change the way we reason in the logic. Furthermore, results about the conservativity of type theories which identify propositions and types over their related logics [9,45] show that this identification does not correspond to the traditional way of formulating logics. Therefore, we shall have a formal distinction between propositions and types in the formulation of the type theory we shall study in this thesis.

An important property of a logic is that we should be able to recognize that a proof does indeed prove the proposition it purports to. According to the propositions-as-types embedding, we have mapped proofs of a proposition to elements of the type of proofs of the proposition. The judgements of our type theory must therefore be decidable, so that we can tell from the form of a judgement M: A that M is indeed an element of the type A. In other words, if we put forward M as a proof of the proposition A then we should be able to recognize that M does prove A.

1.2 Type Theory and Computer Science

The above discussion has described type theory as a general formalism for understanding mathematical structure. There is an alternative interpretation of the judgements of type theory which is more closely related to computer science: we can view the types as specifications of programs and the elements of types as programs. A canonical object under this interpretation of type theory is a program which has been fully evaluated or run. This interpretation of type theory has given rise to a significant amount of interaction between type theory and computer science.

1.2.1 Language Design and Semantics

Type theory is close enough to programming languages and motivations that we can use it as a tool to help us to design and understand programming languages. This is similar to the influence of the untyped lambda calculus on programming languages, leading to the development of LISP and the field of denotational semantics. We give a brief indication of some of the applications here.

Type theory has been used in the design of modern programming languages. A good example is the language Standard ML [37]. Standard ML is a programming language with weak polymorphism, based on the polymorphism of impredicative type theories. The language has type inference, which allows the user to give terms with no type annotations and the type checker finds a most general type. System F or the polymorphic lambda calculus was itself discovered independently as a type theory and as a programming language, as we mentioned above. Furthermore, the modules system in Standard ML has been designed from the basis of a typetheoretic understanding of modularity and abstraction, as discussed by MacQueen [49].

There is considerable interest in using type theories with subtyping to give a semantics for object-oriented programming. We can hope that this effort will lead to a cleaner design of object-oriented languages, similar to the development of the modules system for Standard ML.

1.2.2 Specification and Verification

The problems of modularization and abstraction are major areas of concern in computer science. The conceptual clarity of the type-theoretic approach suggests that type theory may provide a good basis for mechanisms to deal with these problems.

The combined mechanisms of polymorphism and dependent types provide a good environment for studying modularity. Polymorphism allows us to abstract over types, and the dependency allows us to specify program modules over these abstracted types and morphisms between modules.

The internal logic in type theory allows us to consider specification and verification as well. We can formulate predicates over structures, specifying the properties that implementations of the specification should satisfy, as objects within the type theory. Proofs that these predicates hold are also internal to the type theory. Furthermore, the standard operations on specifications can be implemented in type theory. This uniformity of presentation is different from the traditional style of program verification, where a logical language is developed on top of a programming language. There is similarly a gap in the algebraic approach to specification between the operational and algebraic semantics of programs.

1.2.3 Inductive Types

If we are to pursue this relationship between type theory and computing, we must have a mechanism for inductive types in type theory. The ties between programming and type theory are only interesting if the programs we develop in type theory are able to use the types commonly found in programming, such as natural numbers, lists and trees. Also, if we consider type theory as a possible foundation for constructive mathematics, as inspired by Bishop’s effort to develop constructive analysis [10], then type theory can only be seen as adequate if it is able to formalize fundamental mathematical concepts captured by inductive types.

We should both be able to write programs with the inductive types and have induction principles which allow us to reason about the programs written using the types. Although the computational principles for inductive types have long been understood, finding a formulation of type theory with a general mechanism for inductive types with an adequate representation of the induction principles has been difficult. We discuss some of the formulations of systems with inductive types in Section 4.1.3.

One of the main contributions of this thesis is that we show that important properties hold for programs written in a type theory with an adequate representation of data types. This provides us with a strong theoretical basis for the study of the practical aspects of the type theory UTT with respect to modularity and the specification and verification of programs.

1.2.4 Implementations of Type Theory

An early implementation of type theory with many important contributions is de Bruijn’s Automath project [22]. de Bruijn introduced the idea of using type theory as a system which can serve as a framework for implementing logics, by giving a system which formalizes the underlying principles which mathematicians agree upon. Significant formal developments of mathematics were done in the system, for example the development of Landau’s Grundlagen by van Bentham Jutting [79].

Coq [23] is an implementation of a system based on the Calculus of Constructions, with a distinction between propositions and types, proof irrelevance and inductive types. ALF [5] is a structure editor for Martin-Löf’s type theory in the Logical Framework, including a window-based user interface. Coquand’s system of pattern matching [16] is also supported on an experimental basis. NuPRL [12] implements Martin-Löf’s extensional type theory.

LEGO [48] is an implementation of several different type theories: the Edinburgh Logical Framework [36]; the Pure Calculus of Constructions [18]; ECC [44]; and one similar to UTT, the formal system we explore in this thesis and also described in Luo’s book [47]. This implementation is a type checker and proof assistant for these type theories extended with explicit definitions (discussed further in Section 7.2), existential variables and a mechanism for defining inductive types.

1.3 A Computational View of Type Theory

We have already said that untyped reduction provides a natural operational semantics for type theory. Normalization results say that such a semantics is sound. However, the untyped reduction does not take into account type information, despite the importance of the relationship between computational equality and welltypedness, and furthermore it gives us no information about canonical objects. In this thesis we introduce a new kind of operational semantics, which we call typed operational semantics, which defines a reduction to normal form for terms which are well-typed in the type theory. We prove that this new semantics is equivalent to the semantic presentation of type theory, and we shall see that this equivalence between the declarative and operational presentations of type theory will have important metatheoretic consequences.

We shall study a specific typed operational semantics related to the notion of standard reduction in the untyped lambda calculus. However, this is not the only possible operational view of type theory: there are many other reduction strategies for the type theory, and these too may offer useful analyses of the theory. For example, we can easily define a typed operational semantics corresponding to callby-value reduction, and it seems that the soundness proof for this system would be easier than the proof we are able to use for our system. We have restricted ourselves to studying our particular semantics because it seems to be a good system for studying the most basic metatheoretic properties for a type theory.

Our typed operational semantics will have the following judgement forms:

Γ ⊢^{S} A →^{nf} B type Informally this judgement means that A and B are types under the assumptions in Γ and that the type A is associated with the canonical type B. This will mean that we know which canonical objects are elements of the type B.

Γ ⊢^{S} M →^{nf} P : B This judgement means that the object M is associated with the canonical form P and that P is an element of the type B under the assumptions in Γ, where B is itself a canonical type.

Γ ⊢^{S} M →^{wh} N : A This judgement means that we can perform a step of outermost computation on the term M, and this computation yields the term N, where both M and N are elements of A under the assumptions in Γ.

We do not intend this explanation of the judgements to justify the presentation of the system in the same way that the explanations in Section 1.1 justify the rules of inference for Martin-Löf’s presentation of type theory. We merely give an informal explanation to give some indication of the motivations for the formal system. Our main interest in the system is as a tool for studying the metatheory of the semantic presentation.

However, informally our description of the meaning of these judgements differs from the description of the meaning of the judgements of the semantic presentation in two fundamental ways:

• We have removed the unexplained concept of how to find the canonical form associated with an object. This method is described to us by the rules of inference of the theory.

• We have taken as primitive the notion of a judgement holding under assumptions. Unlike in the semantic presentation of type theory, the rules of substitution cannot be justified in this calculus.

The typed operational semantics will be a powerful tool for studying the relationship between reduction and type information. We shall be able to show all of the important properties about typed terms and reduction by reasoning in this typed operational semantics. Strengthening, often a difficult result for type theories with dependent types, will also be straightforward. Finally, we shall see that our typed operational semantics provides a good induction principle for showing results about reduction in general, related to the notion of type closed predicate introduced by Mitchell [62].

It is straightforward to establish that the typed operational semantics is a complete interpretation of its semantic presentation. We can view this result as saying that the typed reduction or evaluation relation defined by the typed operational semantics is subsumed by the equality of the semantic presentation. Since reduction is essentially the transcription of the rules of equality excluding symmetry, and because we have included type information in our semantics, it is not surprising that this is straightforward.

The most difficult result concerning our typed operational semantics will be to show that it is a sound interpretation of the semantic presentation. The operational semantics, being a system motivated by computation, will have no general rules for application or substitution, and even at the level of judgements it is difficult to see how these rules could be defined. The soundness result will say that the rules for application and substitution are admissible. It is not a coincidence that the standard technique for proving strong normalization is also very well suited to establishing this result—our definition of the typed operational semantics was largely motivated by our study of strong normalization proofs. Through the soundness and completeness results, we can transfer the development of the metatheory for the typed operational semantics to the semantic presentation of the type theory.

Typed operational semantics are interesting for their applications to the metatheory of type theories, and in particular in the study of the relationship between reduction and well-typedness, rather than as a practical, implementable system. For implementations, there are other presentations that are considerably more efficient for checking whether a term is well-typed. Also, unlike the operational semantics for programming languages, untyped reduction is considerably more efficient in computing normal forms than the typed operational semantics.

1.4 An Overview of the Thesis

Chapter 2 introduces the idea of typed operational semantics in the context of the simply typed lambda calculus. We present the simply typed lambda calculus and its typed operational semantics, the formal system λ^{S}, and we prove the important metatheoretic results for these systems. This chapter is intended to be independent of the rest of the thesis, although the structure of the presentation in this chapter is reflected in the thesis as a whole.

In Chapter 3 we introduce the calculus UTT, also presented in Luo’s book [47]. We give both a formal presentation of the judgements and rules of inference and a more informal description of the system and how it can be used.

In Chapter 4 we develop the basic metatheory for UTT. We introduce the formal system UTT^{S}, the typed operational semantics for UTT, and prove basic results about the system. We also give a general discussion of different ways of presenting type theories and how these different presentations lead to different approaches to the metatheory.

We give a set-theoretic semantics for UTT in Chapter 5. The model is proof irrelevant, interpreting propositions as either true or false, and types are interpreted as their intuitive set-theoretic counterparts. The construction used is closely modeled on Dybjer’s construction [26].

Chapter 6 is devoted to the central result of the thesis, soundness of UTT^{S} for UTT. This proof is closely related to traditional proofs of strong normalization, although the complexity of the calculus and the fact that we prove soundness for a typed notion of reduction mean that we introduce some refinements to the usual proof technique.

Finally, in Chapter 7 we summarize the contributions of this thesis and mention some areas for further research.

1.5 Related Work

Much of the discussion in this introduction is given in more detail by Martin-Löf [53,54] and Luo [47]. The latter presents the calculus UTT and gives a full account of this system, the metatheory for the simpler ECC and a general discussion of type theory. There is also a thorough treatment of ECC in Luo’s thesis [44]. UTT is formulated in Martin-Löf’s Logical Framework, as presented by Nördstrom, Petersson and Smith [63]. Harper, Honsell and Plotkin [36] give a different Logical Framework, intended as a framework for presenting traditional logics rather than type theories with added computational types.

Mitchell [62] and Coquand [15] were both influential in our development of a typed operational semantics for type theory. The first of these defines a general class of predicates on typed terms by giving conditions which the predicates must satisfy and shows that any such predicate is true for all well-typed terms. The second paper gives an algorithm for deciding conversion for a particular type theory with βη-equality. We discuss these two papers and their relation to our typed operational semantics in Sections 2.5 and 4.10. Harper and Pollack [38] and Constable et al. [12] give explicit definitions of weak head reduction for type systems, a notion which we use in our typed operational semantics.

The basic metatheory for the system UTT^{S} in Section 4.9 is similar to other such developments. Our work was influenced by Luo [44,47], who gives an excellent treatment of the metatheory for ECC, including an early treatment of strengthening for systems with dependent types. The metatheory for Pure Type Systems [8,31,80] has also influenced our work.

Gentzen [29] and Prawitz [66] give early proofs of cut-elimination for the sequent calculus and for systems of natural deduction. The latter corresponds via the principle of propositions as types to a proof of normalization for the corresponding type theory.

There is a large body of work on normalization proofs for type theory. Tait [76] first developed the technique of reducibility to prove strong normalization for Gödel’s System T, which is essentially the simply typed lambda calculus with recursion over natural numbers. Girard [32] extended this technique to System F, which includes impredicative quantification. There is also a discussion of these proofs and the relationship between type theory and proof theory in the book by Girard, Lafont and Taylor [33].

Systems with dependent types add another dimension of difficulty to normalization proofs. Martin-Löf [52] gives a proof of strong normalization for one of his early type theories and contains many important insights. This paper presents the type theory using an untyped notion of reduction and equality. His later paper [53] considers a weaker notion of reduction. This paper also uses judgemental equality and gives one of the few proofs of normalization for a typed notion of reduction. More recently, Pottinger [65] and Coquand and Gallier [17] address problems similar to those of the original Martin-Löf paper in the context of the Calculus of Constructions using two different but related techniques based on Kripke-style reasoning. Coquand [15] shows the decidability of type checking for the Logical Framework with a universe and Π-types, and Luo’s thesis [44] shows strong normalization for a significant subsystem of UTT. Catarina Coquand [13] gives an excellent explanation of a proof of normalization for the simply typed lambda calculus. We shall discuss many of these works in more detail when we consider our proof of soundness.

The above proofs construct models with well-typed terms. There are also proofs of normalization for the Calculus of Constructions and related systems which interpret types simply as sets of normalizing terms with no type information [30,8,83].

Less work has been done on the metatheory for systems with inductive types. Martin-Löf’s original proofs mentioned above are for a theory with his wellordering type, which allows many inductive types to be defined. Tait’s original proof was for Gödel’s System T, with primitive recursion over natural numbers. Werner’s abovementioned work shows normalization for a type theory with impredicativity, natural numbers and the so-called “large” eliminations. Löfwall and Sjödin [43] prove strong normalization for Martin-Löf’s type theory with natural numbers and universes. Mendler [59] gives a proof of strong normalization for inductive definitions in the polymorphic lambda calculus. Werner’s recent thesis gives a proof for a system with a general class of inductive types, but this work has not been made available to me.

The present thesis was developed in a time period overlapping with Altenkirch’s thesis [4]. This work gives a proof of normalization for the Calculus of Constructions using terms with fully typed application and abstraction under β-reduction. The proof uses a model with untyped terms and is done via an intermediate soundness proof for a modification of a realizability model. There is also an outline of how to extend the proof to a general class of inductive types. Although I benefited considerably from discussions with the author of this work, the approaches taken and the systems considered are significantly different: my work gives a proof for typed terms and uses the new technique of giving a typed operational semantics, and also my result is for an extension of Martin-Löf type theory presented in the Logical Framework with βη-equality, with an impredicative universe of propositions, a general class of inductive types and a single predicative universe.

For βη-equality, van Dalen’s thesis [81] is an early proof of the Church–Rosser property for βη-equality in the Automath project. Salvesen [70] uses applications with type labels to show the Church–Rosser and subject reduction properties for Pure Type Systems which are normalizing. Geuver’s thesis [30] studies Church– Rosser and strong normalization for various Pure Type Systems and in particular the Calculus of Constructions.

Constructing models for the Calculus of Constructions with βη-equality is discussed in detail in Streicher’s book [75], with close attention to the syntax. Salvesen [69] and Dybjer [26] give set-theoretic semantics for Martin-Löf’s intensional type theory. Ore [64] and Fu [27] also discuss models for type theories with inductive types. Smith [72] interprets Martin-Löf type theory with judgemental equality and a predicative universe in Aczel’s Frege structures [2], and we would Chapter 1. Introduction 19 need a similar technique if we did not interpret equality as syntactic identity. Allen [3] gives a non-type theoretic interpretation of Martin-Löf’s type theory.

The Simply Typed Lambda Calculus

In this chapter we shall introduce the idea of typed operational semantics for type theory by considering the full metatheoretic development for the simply typed lambda calculus. This chapter can be read separately from the rest of the thesis. However, many of the important ideas for typed operational semantics are illustrated and discussed in this chapter, and at many points later in the thesis we shall refer to discussions here.

As we discussed in the introduction, a typed operational semantics will be a calculus in which only terms that are normalizing via a standard reduction sequence are well-typed, and in which the judgement forms contain the normal forms of all well-typed terms. As such it is closely related to operational semantics for programming languages. It turns out that this system is very useful for reasoning about the relationship between type information and reduction.

We shall not explain the simply typed lambda calculus in detail. We instead refer the reader to Mitchell’s thorough introduction to the calculus [62]. He also gives a good account of the usual development of the metatheory for this system, and we shall use both his work and the book by Girard, Lafont and Taylor [33] as sources with which to compare our work.

This chapter is organized as follows. We give a brief introduction to the simply typed lambda calculus and present the syntax of the system in Section 2.1. In Section 2.2 we introduce the typed operational semantics, give an intuition for the rules and discuss some of the design decisions involved in our choice of rules of the system. Section 2.3 contains the basic development of the metatheory, both for the simply typed lambda calculus and for the typed operational semantics. In Section 2.4 we give a proof of soundness of the typed operational semantics for the simply typed lambda calculus, the most difficult result relating the two presentations of the type theory. This proof is closely related to the proof of strong normalization for the simply typed lambda calculus. Finally, we discuss work related to typed operational semantics in Section 2.5.

2.1 The Proof System

We begin by presenting the simply typed lambda calculus using what we have called the semantic presentation in Section 1.1.1. This presentation follows the semantic explanation of judgements given by Martin-Löf, and hence differs from the usual presentation of the simply typed lambda calculus [62] in having rules for thinning of hypotheses and for substitution. This is similar to the presentation of Martin-Löf’s Logical Framework [63].

2.1.1 Types and Terms

We first introduce the types of the simply typed lambda calculus. For simplicity we shall assume that there is only one base type o. We also have the type of functions from A to B, A → B, for any two types A and B.

We assume the existence of an infinite set V of variables. The terms of the simply typed lambda calculus are defined inductively:

• If x ∈ V then x is a term.

• If x ∈ V, A is a type and M is a term then the abstraction of M by x and A, λx:A.M, is a term. We call M the body of the abstraction.

• If M and N are terms then the application of M to N, M(N), is a term.

We identify terms which are equivalent up to the renaming of bound variables. We denote the free variables in a term M, those variables not bound by abstractions, by FV(M). We denote the substitution of N for the free variable x in M by [N/x]M, where this substitution is defined to avoid the capture of free variables.

A sequence Γ ≡ x_{1}:A_{1}, …, x_{n}:A_{n} of pairs of variables x_{i} ∈ V and types A_{i} is a pre-context. We write dom(Γ) for the set {x_{1}, …, x_{n}}. The empty pre-context is denoted by ().

A context is a pre-context where the x_{i} are distinct.

2.1.2 Judgements and Derivations

Because of the simplicity of the calculus, we can assume that we know what the canonical elements of any type are and when two canonical elements of any type are equal before we define the well-typed terms. This is the same as saying that we have a judgement A type which we know holds for any type.

We have two judgement forms in our presentation of the simply typed lambda calculus, which are informally described as follows:

• Γ ⊢ M : A. We take this to mean that the canonical form associated with M is an element of A. In words we say that “M has type A in context Γ” or “Γ yields M in A.”

• Γ ⊢ M = N : A. We take this to mean that we know what the canonical forms of M and N are and that these canonical forms are equal under the equality for A. We say that “M and N are equal objects of type A in context Γ” or “Γ yields M equals N in A.” We call this judgement form judgemental equality.

The rules of inference for the calculus are given in Figures 2–1 and 2–2. Notation We shall write Γ ⊢ J for an arbitrary judgement in the simply typed lambda calculus.

(Var) \frac{Γ context x:A ∈ Γ}{Γ ⊢ x : A} (Thin) \frac{Γ_{0}, Γ_{1} ⊢ M : A z ∉ dom(Γ_{0}, Γ_{1})}{Γ_{0}, z:C, Γ_{1} ⊢ M : A}

(λ)  \frac{Γ, x:A ⊢ M : B}{Γ ⊢ λx:A.M : A → B}

(App)  \frac{Γ ⊢ M : A → B Γ ⊢ N : A}{Γ ⊢ M(N) : B}

(Subst)  \frac{Γ_{0}, z:C, Γ_{1} ⊢ M : A Γ_{0} ⊢ N : C}{Γ_{0}, Γ_{1} ⊢ [N/z]M : A}

Figure 2–1: Typing Rules

2.1.3 Discussion

The rules of inference (Thin), (Subst) and the substitution rules for equality are not in the standard presentation of the calculus [62]. We have included these rules in order to follow the semantic explanation of the judgements in Section 1.1, where judgements with hypotheses are explained by substitutions into judgements with fewer hypotheses. However, because these rules are admissible rules in the usual presentation (that is, if there are derivations of the premisses then there is a derivation of the conclusion), adding them does not constitute an essential change to the system.

Derivations of judgemental equality can only follow sequences of well-typed terms, in contrast to conversion, which is defined to be the least equivalence relation containing reduction. In Section 2.3, on the metatheory for the simply typed lambda calculus, we shall define what for us is the auxiliary notion of reduction. We shall also see that using judgemental equality instead of conversion affects the metatheory even for simple calculi. In Section 4.1.2 we shall discuss the consequences of the different presentations for more complex calculi with dependent types.

(Refl) \frac{Γ ⊢ M : A}{Γ ⊢ M = M : A} (Sym) \frac{Γ ⊢ M = N : A}{Γ ⊢ N = M : A}

(Trans)  \frac{Γ ⊢ M = N : A Γ ⊢ N = P : A}{Γ ⊢ M = P : A}

(β)  \frac{Γ, x:A ⊢ M : B Γ ⊢ N : A}{Γ ⊢ (λx:A.M)(N) = [N/x]M : B}

(η)  \frac{Γ ⊢ M : A → B}{Γ ⊢ λx:A.M(x) = M : A → B}

(λ-Eq)  \frac{Γ, x:A ⊢ M = N : B}{Γ ⊢ λx:A.M = λx:A.N : A → B}

(App-Eq) \frac{Γ ⊢ M = P : A → B Γ ⊢ N = Q : A}{Γ ⊢ M(N) = P (Q) : B}

(Subst Eq) \frac{Γ_{0}, z:C, Γ_{1} ⊢ M : A Γ_{0} ⊢ P = Q : C}{Γ_{0}, Γ_{1} ⊢ [P/z]M = [Q/z]M : A}

(Eq Subst) \frac{Γ_{0}, z:C, Γ_{1} ⊢ M = N : A Γ_{0} ⊢ P : C}{Γ_{0}, Γ_{1} ⊢ [P/z]M = [P/z]N : A}

Figure 2–2: Judgemental Equality

The derivations for the judgement form Γ ⊢ M = N : A are defined after the derivations for the judgement form Γ ⊢ M : A. This will allow us to establish the relationship between the two judgement forms easily. Again, this will be more complicated for calculi with dependent types.

We have followed the conventional presentation by identifying abstractions up to the renaming of bound variables. However, for the formal development of type theory we do not view this as an acceptable presentation, and we would prefer to use one of the presentations of de Bruijn indices [21], Stoughton’s α-normal forms [74] or Coquand’s distinguishing between parameters and bound variables [15,58]. Our choice of presentation does not affect the correctness of our proofs, but instead we do not believe that the identification of terms which are syntactically different is a reasonable way to present a formal system.

We do not present variables with type labels, differing from other presentations of the simply typed lambda calculus [33]. Not having type labels for variables is the usual practice for systems with dependent types, because having labels on variables in these systems would make the term structure more complex: for example, it would no longer be immediate that variables are normalizing. Because we are interested in studying more complex calculi than the simply typed lambda calculus, we use a term structure which generalizes easily.

2.2 λ^{S}: A Typed Operational Semantics

A typed operational semantics is a system for reasoning about reduction and normal forms for terms which are well-typed in the type theory. In this section we relate our typed operational semantics to the notion of standard reduction for the untyped lambda calculus and we introduce the calculus λ^{S}, the typed operational semantics for the simply typed lambda calculus.

2.2.1 Standard Reduction

Standard reduction is an important notion in the untyped lambda calculus (see for example Barendregt’s book [7]). The idea is that any reduction sequence can be expressed as a standard, or left to right, reduction sequence. Our typed operational semantics for a type theory will be a synthesis of this notion of standard reduction and the rules of inference of the semantic presentation of the type theory. It is because the reduction used in our typed operational semantics is universal with respect to other reductions that the important results about the relationship between typed terms and reduction follow easily by reasoning in the typed operational semantics.

We can see the typed operational semantics as the type theory presented from the perspective of computation instead of from the perspective of logical inference. We still need the full type information to derive the well-typedness of any term, but we replace the logically clear rules for application and abstraction by rules which instead express the reduction behavior of terms in the calculus. Hence we shall not have one single rule for application but several rules, one for applications with no outermost redex, one for outermost β-redices and one for β-redices on the left side of applications. Similarly we shall have two rules for abstraction, depending on whether the normal form of the body yields an abstraction which is an η-redex.

We shall only be able to give our particular typed operational semantics corresponding to standard reduction for a type theory which is strongly normalizing. This is because while standard reduction for the untyped lambda calculus contracts redices from left to right, which means some redices may not be contracted, we instead always contract the leftmost redex until the process terminates. The property that any reduction sequence can be expressed as a standard one is true for our presentation as well, for any reduction sequence to a normal form. This obviously fails for an arbitrary reduction sequence, since the reduction could simply contract a redex which is not the leftmost one.

Another important property of our typed operational semantics is that it is syntax directed, in the sense that the structure of a derivation is determined by the structure of the subject. This property of our typed operational semantics will be important in the treatment of type theories with dependent types.

There is a strong relationship in the untyped lambda calculus between weak head reduction or leftmost reduction and ordinary reduction, which Altenkirch [4] shows for weak head reduction on untyped terms: namely, if M weak head reduces to N and M reduces to M′ then M′ ≡ N or M′ weak head reduces to N′ and N reduces to N′. For the untyped lambda calculus this property does not extend to standard reduction, which as we have mentioned does not necessarily contract all redices. We can prove this property for the reduction in our system, but it would require a formal presentation of one-step standard reduction, which is not the reduction we need for our normalization proof. However, this property is used implicitly in the proof of the central result stating the relationship between well-typedness and reduction, Lemma 2.3.27.

Because our reduction is always to a normal form, we shall also have a novel treatment of the η-postponement property. We shall be able to include the postponed η-reductions as part of the inductive definition of standard reduction. The simplicity of this definition allows an elegant and concise study of metatheoretic properties for normalizing type systems with η-equalities.

We have used a different notion of canonical form in defining our typed operational semantics than Martin-Löf uses in explaining his type theory. Martin-Löf only requires that the outermost constructor correspond to an introduction rule for the type, as we described in Section 1.1. In our typed operational semantics we have instead required that each of the subterms be in canonical form as well, so canonical forms must be normal forms with no further reductions. Hence succ(1+1) is not a canonical natural number but succ(succ(succ(0))) is, the latter being an element which we can directly recognize as a natural number.

We have not modeled this usual explanation of canonical forms and equality in our typed operational semantics only for practical reasons. The system we are studying has simple syntactic identity as the equality on normal forms, rather than a more sophisticated equality involving canonical elements. The metatheoretic proofs for the system are easier if we only consider a relation between terms and types and not the added equivalence relation for judgemental equality. In conjunction with the stricter notion of canonical form, we have not allowed a type to have an equality over its canonical elements.

We can imagine combining the typing judgement with some other notion of reduction, corresponding to another evaluation strategy. For example, it seems that the soundness proof in Section 2.4 might be easier if we were to use call-by-value reduction, a notion of reduction which reduces both terms in an application to normal form and then performs a β-reduction if the resulting term is a redex. We can also prove strengthening by considering this reduction. However, we would not be able to prove strong normalization or subject reduction using this reduction, because it is not canonical with respect to all reductions.

2.2.2 Judgements and Derivations

We now define the calculus λ^{S}. For our choice of presentation, the term structure for the typed operational semantics will be the same as the term structure for the semantic presentation of the system.

The judgement forms for λ^{S} and their intuitive meanings will be:

• Γ ⊢^{S} M →^{nf} P : A, meaning that M has canonical form P which is a canonical element of type A in context Γ.

• Γ ⊢^{S} M →^{wh} N : A, meaning that M weak head reduces to N of type A in context Γ. This judgement gives us no indication of what the canonical form of N is, so a derivation of this judgement will only make sense in conjunction with a derivation that Γ ⊢^{S} N →^{nf} P : A for some P.

We shall also use the abbreviation Γ ⊢^{S} M : A for Γ ⊢^{S} M →^{nf} P : A when the normal form P is not important.

Weak head reduction is defined by the rules of inference for the judgement form Γ ⊢^{S} M →^{wh} N : A. Intuitively weak head redices are outermost redices: either a β-redex or a weak head redex on the left of an application. Weak head reduction is an important notion used implicitly in Martin-Löf’s type theory, and for example Harper and Pollack [38] define it as a tool for efficient type checking.

In order to define λ^{S}, we first need to introduce the auxiliary definition of weak head normal form. A term is weak head normal if it has no weak head reductions, but we define it separately from the judgements of λ^{S} because we need this property as a side condition in order to test which application rule to use. If a term is in weak head normal form then to find its normal form we only do internal reductions, but if it is not then we must first reduce outermost redices in the definition of the typed operational semantics.

Definition 2.2.1 (Base Term) A term is a base term if it is a variable or it is an application M(N) and M is a base term.

The base terms are simply the terms with a variable at the head of the term.

Definition 2.2.2 (Pre-redex) We say that a term M is a pre-redex if M is an abstraction.

The pre-redices are terms which when applied to another term yield a redex.

Definition 2.2.3 (Weak Head Normal) We say that a term is weak head normal or in weak head normal form if it is a base term or a pre-redex.

The typed operational semantics λ^{S} is defined by the rules of inference in Figures 2–3 and 2–4.

(S-Var)  \overline{Γ ⊢^{S} x →^{nf} x : A}  if x:A ∈ Γ and Γ is a context

(S-λ) \frac{Γ, x:A ⊢^{S} M →^{nf} P : B}{Γ ⊢^{S} λx:A.M →^{nf} λx:A.P : A → B} if P ≡ Q(x) implies x ∈ FV(Q)

(S-η)  \frac{Γ, x:A ⊢^{S} M →^{nf} P (x) : B Γ ⊢^{S} P →^{nf} Q : A → B}{Γ ⊢^{S} λx:A.M →^{nf} Q : A → B}

(S-App)  \frac{\begin{matrix}Γ ⊢^{S} M →^{nf} P : A → B \\ Γ ⊢^{S} N →^{nf} Q : A \end{matrix}}{Γ ⊢^{S} M(N) →^{nf} P (Q) : B}  if M(N) is weak head normal

(S-WH)  \frac{Γ ⊢^{S} M →^{wh} N : A Γ ⊢^{S} N →^{nf} P : A}{Γ ⊢^{S} M →^{nf} P : A}

Figure 2–3: Canonical Forms

(W-β) \frac{Γ ⊢^{S} λx:A.M : A → B Γ ⊢^{S} N : A}{Γ ⊢^{S} (λx:A.M)(N) →^{wh} [N/x]M : B}

(W-App) \frac{Γ ⊢^{S} M →^{wh} P : A → B Γ ⊢^{S} N : A}{Γ ⊢^{S} M(N) →^{wh} P (N) : B}

Figure 2–4: Weak Head Reduction

Notation We shall write Γ ⊢^{S} J for an arbitrary judgement in λ^{S}.

2.2.3 Discussion

The relations we define in a typed operational semantics are essentially evaluation relations. The intuitive reading of the judgements is that the subject of the judgement reduces to the normal form in the judgement. Because of the way we have chosen the rules of inference, this system is a good one to use in reasoning about the simply typed lambda calculus in general. It is also specifically designed to give a strong induction principle. We shall discuss the rules of inference of λ^{S} in order to illustrate the basic idea of the system and to explain some choices in the presentation.

First, the variable rule simply says that variables evaluate to themselves: they are already normal. Because we are interested in a typed evaluation relation, we need to know that x occurs in the context.

The rules (S-λ) and (S-η) depend on the normal forms included in the judgement forms. To know the canonical form of an abstraction, we must first know the canonical form of the body of the abstraction. The rule (S-λ) is purely structural: we know that if the body of an abstraction reduces to some normal form, and if that normal form does not create an η-redex, then the normal form of the whole abstraction is the abstraction of the normal form.

There are two premisses in the rule (S-η). The second premiss, requiring that the canonical form of the body have a canonical form in the context Γ, is unnecessary from the point of view of our reduction, although it removes the need for a side condition requiring x to be distinct from the free variables of P. We have deliberately weakened this rule by strengthening the premisses in order to simplify proofs by induction on derivations of λ^{S}. Strengthening the premisses corresponds to strengthening the inductive hypothesis for such proofs. As a particular example, to show completeness of this rule for the simply typed lambda calculus, in other words to show that if Γ ⊢^{S} λx:A.M →^{nf} P : A → B where Γ, x:A ⊢^{S} M →^{nf} P (x) : B and x ∉ FV(P) then Γ ⊢ λx:A.M = P : A → B, we shall need the normal form P to be well-typed in context Γ instead of Γ, x:A. This is exactly what the second premiss gives us.

Furthermore, our development of the metatheory for λ^{S} will show that the normal form of a term already in normal form (as P must be if P (x) is normal) is that term, and also we shall be able to show strengthening for λ^{S}. Using these two results, we shall be able to show the admissibility of the more natural η-reduction rule:

(S-η’) \frac{Γ, x:A ⊢^{S} M →^{nf} P (x) : B}{Γ ⊢^{S} λx:A.M →^{nf} P : A → B} if x ∉ FV(P)

The rules (S-λ) and (S-η) for abstraction implicitly introduce η-postponement and preserve normality of the right-hand side of the reduction. The rules first fully reduce the body M of λx:A.M, and by analysis of the resulting normal form either a final η-reduction takes place or the abstraction is already in normal form. This will mean that when we show that our typed operational semantics is adequate for reduction (in other words, that Γ ⊢^{S} M →^{nf} P : A implies M ▷^{∗} P), we shall further be able to demonstrate that the reduction sequence factors into βreductions followed by η-reductions.

We have several rules for application in λ^{S}. The first rule, (S-App), is the one which is purely structural. This rule says that if M(N) is weak head normal, which means that M is a variable applied to some sequence of terms, then the way to evaluate M(N) is to evaluate M and N separately. We could have no other way of evaluating such terms.

The second rule for application, the rule (W-β), is as follows:

(W-β) \frac{Γ ⊢^{S} λx:A.M : A → B Γ ⊢^{S} N : A}{Γ ⊢^{S} (λx:A.M)(N) →^{wh} [N/x]M : B}

Although we have not used the normal forms of either [x:A_{1}]M_{0} or N, it is important from the point of view of reduction that we know that the two terms are normalizing, and from the point of view of typing that we know that the two terms are well-typed. By using the second judgement form Γ ⊢^{S} (λx:A.M)(N) →^{wh} [N/x]M : A, we also require that the reduct [N/x]M of the redex (λx:A.M)(N) is well-typed. This is because the only rule incorporating derivations of this judgement into the main judgement Γ ⊢^{S} M →^{nf} P : A is the rule (S-WH). This rule ensures that we know that if Γ ⊢^{S} (λx:A.M)(N) →^{nf} P : B then Γ ⊢^{S} (λx:A.M)(N) →^{wh} [N/x]M : B and Γ ⊢^{S} [N/x]M →^{nf} P : B.

We have not used the rule

(S’-β) \frac{\begin{matrix}Γ ⊢^{S} λx:A.M : A → B & Γ ⊢^{S} N : A \\ Γ ⊢^{S} [N/x]M →^{nf} R : B \end{matrix}}{Γ ⊢^{S} (λx:A.M)(N) →^{nf} R : B}

This is because the system corresponding to standard reduction cannot be presented using a rule of this form: this β-rule reduces the outermost β-redex but gives no strategy for reducing leftmost redices. Hence this rule would give a different reduction strategy.

The final rule of the system, (W-App), allows us to reduce β-redices which are on the left of applications. This corresponds exactly to the usual definition of weak head reduction.

2.3 Metatheory

In this section we prove the essential properties for derivations of judgements in the simply typed lambda calculus. This presentation is influenced by Luo’s thesis [44] and developments of Pure Type Systems [8], although the formal system is considerably different. Since we shall eventually show the equivalence of λ^{S} and the simply typed lambda calculus, all of the results for λ^{S} will transfer to the simply typed lambda calculus as well.

2.3.1 Basic Definitions

We first introduce several notions for terms which will be important in the presentation of the typed operational semantics. Some of these definitions will be simple for the simply typed case but more complex for systems with dependent types, which we study later.

Definition 2.3.1 (Compatible Closure) Let R be a relation on terms. Then the compatible closure of R, notation M ▷_{R} N, is the least relation satisfying the following rules:

(R-Inc)  \frac{MRN}{M ▷_{R} N}

(ξ)  \frac{M ▷_{R} N}{λx:A.M ▷_{R} λx:A.N}

(App-L) \frac{M ▷_{R} P}{M(N) ▷_{R} P (N)} (App-R) \frac{N ▷_{R} P}{M(N) ▷_{R} M(P)}

Definition 2.3.2 (Untyped Reduction) We introduce the following one-step reduction relations:

\begin{matrix}(β) & (λx:A.M)(N) & β & [N/x]M \\ (η) & λx:A.M(x) & η & M & if x ∉ FV(M) \end{matrix}

Let untyped reduction, M ▷ N, be M ▷_{βη} N, the compatible closure of (β) and (η).

A term M is an R-redex if there is some N such that MRN. A term M is a redex if M is a βη-redex.

Notation If R is a relation then we denote the transitive closure of R by R^{+} and the reflexive and transitive closure of R by R^{∗}.

Reduction plays no role in the definition of either the semantic presentation of the simply typed lambda calculus or the calculus λ^{S}. It is instead an auxiliary definition which captures our intuition of how untyped computation operates on terms. Theoretically, we shall use it as a convenient tool to help us with the metatheoretic development of the simply typed lambda calculus. Pragmatically, it is much nicer to implement reduction without reference to type information. For both of these points the subject reduction property, which says that the typing judgement is closed under untyped reduction, will be essential.

Definition 2.3.3 (Normal Form) We define inductively the terms which are normal or in normal form:

• Variables are normal,

• λx:A.M is normal if M is normal and not of the form N(x) with x ∉ FV(N), and

• M(N) is normal if M and N are normal and M(N) is not a redex.

Lemma 2.3.4 If M is normal then M has no reductions.

Proof By induction on terms in normal form. □

Definition 2.3.5 (Strongly Normalizing) A term is strongly normalizing if all reduction sequences starting from that term terminate.

Definition 2.3.6 (Diamond Property) We say that a term M satisfies the diamond property if whenever M ▷^{∗} N and M ▷^{∗} P then there is a Q such that N ▷^{∗} Q and P ▷^{∗} Q.

The following facts about terms are easy to establish:

Lemma 2.3.7

• If M is normal then M is weak head normal.

• If M(N) is weak head normal and M and N are normal then M(N) is normal.

• If M is weak head normal and M ▷^{∗} N then N is weak head normal.

Proof Straightforward. □

We shall need a more general notion of substitution, that of parallel substitution, at several points in the proof. We introduce the basic definitions and show some simple properties here.

Definition 2.3.8 (Pre-Substitution) A pre-substitution for a finite set of variables S is a function from S to terms.

Notation Suppose δ is a pre-substitution for dom(Γ). Then:

• We write δ̂(M) for the result of simultaneously substituting the values for the variables in the domain of δ:

δ̂(M) =_{df} [δ(x_{1}), …, δ(x_{n})/x_{1}, …, x_{n}]M

• We write δ[x := M] for the extended pre-substitution for dom(Γ, x:A).

• If Δ has all components of Γ then we write weak_{Γ}^{Δ} for the substitution weak_{Γ}^{Δ}(x) = x for dom(Γ).

• id_{Γ} =_{df} weak_{Γ}^{Γ}.

• If δ is a pre-substitution for Δ and ϕ is a pre-substitution for Φ then the composition of ϕ and δ, ϕ ∘ δ, is

ϕ ∘ δ(x) =_{df} ϕ̂(δ(x))

Definition 2.3.9 (Substitution) A substitution δ from Δ to Γ, where Δ and Γ are contexts, is a pre-substitution for dom(Γ) such that for each x:A ∈ Γ we have Δ ⊢^{S} δ(x) →^{nf} P : A for some P.

This definition of substitution is for substitutions to λ^{S}. We could also define substitutions to the simply typed lambda calculus, but these will not be necessary in our metatheoretic development.

We do not know in general that if δ is a substitution from Δ to Γ and ϕ is a substitution from Φ to Δ then ϕ ∘ δ is a substitution from Φ to Γ. This will only be the consequence of the final soundness theorem. However, we shall know closure under composition for the following restricted class of substitutions.

Definition 2.3.10 (Renaming) A renaming δ from Δ to Γ is a substitution from Δ to Γ such that δ(x) = y, where y ∈ V, for each x:A ∈ Γ.

Lemma 2.3.11

• If δ is a renaming from Δ to Γ and ϕ is a renaming from Φ to Δ then ϕ ∘ δ is a renaming from Φ to Γ.

• If M is weak head normal and δ is a renaming from Δ to Γ then δ̂(M) is weak head normal.

• [N/x]M ≡ { \atop id_{FV(M)−\{x\}}[x := N]}(M).

• δ̂(ϕ[x := N])M ≡ { \atop δ ∘ ϕ[x := δ̂(N)]}(M).

• ϕ̂ ∘ δ(M) ≡ ϕ̂(δ̂(M)).

2.3.2 Basic Metatheory

In this section we establish the basic metatheoretic properties we need for the two calculi presenting the simply typed lambda calculus. Most of the results will be for the system λ^{S}, because we shall transfer the results from this system to the semantic presentation by soundness and completeness results.

An essential technique in showing metatheoretic properties is the principle of induction on derivations. Often this principle is taken as natural number induction on the height of derivation trees, which allows us to know the inductive hypothesis for any shorter derivation tree. We shall instead use complete structural induction, which allows us to know the inductive hypothesis for any subderivation of a derivation.

The definition of the system λ^{S} is a mutual inductive definition. We shall often want to prove different statements for the different judgement forms. For example, in Free Variables (Lemma 2.3.15), we prove that if Γ ⊢^{S} M →^{nf} P : A then FV(M) ⊆ dom(Γ) and FV(P) ⊆ dom(Γ), and that if Γ ⊢^{S} M →^{wh} N : A then FV(M) ⊆ dom(Γ). In this as in many other cases, we only need to prove the result for the term M in the judgement Γ ⊢^{S} M →^{wh} N : A, because the rule (S-WH) is the only one to incorporate this judgement into the judgement Γ ⊢^{S} M →^{nf} P : A, and we know the inductive hypothesis for N in this rule.

Lemma 2.3.12 If Γ ⊢ M = N : A then Γ ⊢ M : A and Γ ⊢ N : A.

Proof By induction on derivations of Γ ⊢ M = N : A. □

Lemma 2.3.13 (Generation) Any judgement which is derivable in λ^{S} has a uniquely determined last rule of inference.

Proof By induction on derivations. □

We have not written the full information we are interested in from the Generation Lemma. We shall in fact want to know for each judgement what the last rule of inference is and what the forms of the premisses are. For example:

• If Γ ⊢^{S} M(N) →^{nf} P : B and M(N) is weak head normal then there are Q, R, and A such that P ≡ Q(R), Γ ⊢^{S} M →^{nf} Q : A → B and Γ ⊢^{S} N →^{nf} R : A.

• If Γ ⊢^{S} M →^{nf} P : A and M is not weak head normal then there is an N such that Γ ⊢^{S} M →^{wh} N : A and Γ ⊢^{S} N →^{nf} P : A.

• If Γ ⊢^{S} M(N) →^{wh} P : B and M is not weak head normal then there are Q, R and A such that P ≡ Q(N), where Γ ⊢^{S} M →^{wh} Q : A → B and Γ ⊢^{S} N →^{nf} R : A.

• If Γ ⊢^{S} λx:A.M →^{nf} P : A → B then Γ, x:A ⊢^{S} M →^{nf} Q : B, and either Q ≡ R(x) with x ∉ FV(R), Γ ⊢^{S} R →^{nf} S : A → B and P ≡ S, or P ≡ λx:A.Q.

Lemma 2.3.14 (Uniqueness of Normal Forms) If Γ ⊢^{S} M →^{nf} P : A and Γ ⊢^{S} M →^{nf} Q : B then P ≡ Q and A = B.

Proof By induction on derivations, using Generation and the inductive hypothesis in each case for the second derivation. □

This lemma states that the operational semantics is deterministic. In fact we could have showed the stronger result, which we called “syntax directed” above, that there is a unique derivation associated with any context and term. This is equivalent to saying that the operational semantics is deterministic at the level of derivations. However, we do not need to reason about derivations in this way in our study of the metatheory.

We can show that A = B because there is no notion of α-equivalence for types in the simply typed lambda calculus. This is not the case for systems with dependent types.

Lemma 2.3.15 (Free Variables)

• If Γ ⊢^{S} M →^{nf} P : A then FV(M) ⊆ dom(Γ) and FV(P) ⊆ dom(Γ).

• If Γ ⊢^{S} M →^{wh} N : A then FV(M) ⊆ dom(Γ).

Proof By induction on derivations. □

Lemma 2.3.16 (Context) If Γ ⊢^{S} J then Γ is a context.

Proof By induction on derivations. □

Lemma 2.3.17 (Completeness)

• If Γ ⊢^{S} M →^{nf} P : A then Γ ⊢ M = P : A.

• If Γ ⊢^{S} M →^{wh} N : A then Γ ⊢ M = N : A.

Proof By induction on derivations.

We only consider (W-β). By Generation we know that there is a subderivation of Γ, x:A ⊢^{S} M →^{nf} R : B for some R. Hence by inductive hypothesis we know that Γ, x:A ⊢ M = R : B and Γ ⊢ N = Q : A, so Γ, x:A ⊢ M : B and Γ ⊢ N : A by Lemma 2.3.12. Hence Γ ⊢ (λx:A.M)(N) = [N/x]M : B by (β). □

We shall now show that any judgement for a context Γ also holds in all contexts which have all components of Γ. We follow Barendregt [8] in calling this property “thinning” and reserving the name “weakening” for adding fresh variables at the end of the context.

We first prove a general lemma using a technique inspired by McKinna and Pollack’s treatment [58], where we allow names of variables in the context to change. This statement strengthens the inductive hypothesis for the rules which introduce new bound variables, in particular (S-λ). In such cases, if the bound variable already occurs in the new context then a direct induction on derivations fails. The lemma is only true up to changes in bound variables, as can be seen in our illustration of the rule (S-λ).

We shall have the usual Thinning lemma as a corollary.

Lemma 2.3.18 (Renaming) If δ is a renaming from Δ to Γ then

• If Γ ⊢^{S} M →^{nf} P : A then Δ ⊢^{S} δ̂(M) →^{nf} δ̂(P) : A.

• If Γ ⊢^{S} M →^{wh} N : A then Δ ⊢^{S} δ̂(M) →^{wh} δ̂(N) : A.

Proof By induction on derivations. We show several cases:

• (S-Var). We know that δ(x) = y, so Δ ⊢^{S} y →^{nf} P : A for some P. By Generation we know that P ≡ y.

• (S-λ). Let δ be a renaming from Δ to Γ, y be fresh in Δ and w =_{df} weak_{Δ}^{Δ,y:A}. Then w ∘δ is a renaming from Δ, y:A to Γ by Lemma 2.3.11 and (w ∘ δ)[x := y] is a renaming from Δ, y:A to Γ, x:A, so by inductive hypothesis

Δ, y:A ⊢^{S} { \atop (w ∘ δ)[x := y]}(M) →^{nf} { \atop (w ∘ δ)[x := y]}(P) : B

Hence

Δ ⊢^{S} δ̂(λx:A.M) ≡ λy:A.{ \atop (w ∘ δ)[x := y]}(M)
→^{nf} λy:A.{ \atop (w ∘ δ)[x := y]}(P) ≡ δ̂(λx:A.P): A → B

Finally, we need to show for all Q that { \atop w ∘ δ[x := y]}(P) ≡ Q(y) implies that y ∈ FV(Q), where we already know for all Q that if P ≡ Q(x) then x ∈ FV(Q). Suppose { \atop w ∘ δ[x := y]}(P) ≡ Q(y). Then there is a z such that P ≡ P_{1}(z) by the definition of pre-substitutions and renamings. Because y is fresh in Δ and we know for all z ∈ dom(Γ) that (w ∘ δ)(z) ≠ y, we have z = x. Hence x ∈ FV(P_{1}), and y ∈ FV({ \atop δ[x := y]}(P_{1})) = FV(Q).

• (S-η). We are able to establish the first premiss as for the case (S-λ), where δ is a renaming from Δ to Γ, y is fresh in Δ and w =_{df} weak_{Δ}^{Δ,y:A}. By inductive hypothesis we also know that Δ ⊢^{S} δ̂(P) →^{nf} δ̂(Q) : A → B, so by Contexts x ∉ dom(Γ) and by Free Variables x ∉ FV(P) ⊆ dom(Γ).

Hence δ̂(P) ≡ { \atop (w ∘ δ)[x := y]}(P), so

{ \atop (w ∘ δ[x := y]}(P (x)) ≡ ({ \atop (w ∘ δ[x := y]}(P))(y) ≡ (δ̂(P))(y)

Hence Δ ⊢^{S} λy:A.{ \atop (w ∘ δ)[x := y]}(M) ≡ δ̂(λx:A.M) →^{nf} δ̂(Q) : A → B.

• (S-App). By inductive hypothesis and Lemma 2.3.11.

• (W-β). By inductive hypothesis we know that

Δ ⊢^{S} λy:A.{ \atop δ[x := y]}(M) ≡ δ̂(λx:A.M) →^{nf} δ̂(P) : A → B

and Δ ⊢^{S} δ̂(N) →^{nf} δ̂(Q) : A. Hence, for y fresh in Δ,

Δ ⊢^{S} δ̂((λx:A.M)(N)) ≡ (λy:A.{ \atop δ[x := y]}(M))(δ̂(N))
→^{nf} [δ̂(N)/y]{ \atop δ[x := y]}(M) ≡ δ̂([N/x]M): B
□

Lemma 2.3.19 If Δ is a context with all components of Γ then weak_{Γ}^{Δ} is a substitution from Δ to Γ.

Proof By induction on the structure of Γ. □

As we mentioned, Renaming has the following corollary:

Corollary 2.3.20 (Thinning) If Γ ⊢^{S} J and Δ is a context with all components of Γ then Δ ⊢^{S} J.

Proof By Renaming and Lemma 2.3.19. □

Strengthening for the simply typed lambda calculus is a straightforward result. However, we shall see later that proving strengthening for the typed operational semantics rather than the semantic presentation makes the proof much easier for systems with dependent types.

Lemma 2.3.21 (Strengthening)

• If Γ_{0}, z:C, Γ_{1} ⊢^{S} M →^{nf} P : A and z ∉ FV(M) then Γ_{0}, Γ_{1} ⊢^{S} M →^{nf} P : A.

• If Γ_{0}, z:C, Γ_{1} ⊢^{S} M →^{wh} N : A and z ∉ FV(M) then Γ_{0}, Γ_{1} ⊢^{S} M →^{wh} N : A.

Proof By induction on derivations.

We check (S-λ). By Contexts we know that z ≠ x, so by inductive hypothesis Γ_{0}, Γ_{1}, x:A ⊢^{S} M →^{nf} P : B. Hence Γ_{0}, Γ_{1} ⊢^{S} λx:A.M →^{nf} λx:A.P : A → B by (S-λ). □

Proving a substitution or cut lemma for λ^{S} directly seems to be difficult. Indeed, substitution on the judgements of λ^{S} is difficult to define, because we shall need to know the normal form of the substituted term. For example, if we know that Γ, x:A ⊢^{S} M →^{nf} P : B and Γ ⊢^{S} N →^{nf} Q : A then we shall need to know that there is an R such that Γ ⊢^{S} [N/x]M →^{nf} R : B, and we need normalization to know what R is.

Substitution is therefore closely related to soundness for the simply typed lambda calculus. By the soundness result, we shall know that if Γ ⊢ M : A then there is a P such that Γ ⊢^{S} M →^{nf} P : A, so we can establish the above substitution property by the rule (Subst). We shall discuss the relationship between substitution and normalization in more detail in Section 2.4.1.

2.3.3 λ^{S} and Reduction

The calculus λ^{S} is a synthesis of standard reduction and the typing rules from the simply typed lambda calculus. We are able to use this to considerable advantage in showing results about the relationship between typing in λ^{S} and untyped reduction.

Lemma 2.3.22 (Adequacy for Reduction)

• If Γ ⊢^{S} M →^{nf} P : A then M ▷^{∗} P and P is normal, and furthermore there is an N such that M ▷_{β}^{∗} N ▷_{η}^{∗} P.

• If Γ ⊢^{S} M →^{wh} N : A then M ▷_{β} N.

Proof By induction on derivations. We consider the two interesting cases:

• (S-η). By Contexts Γ ≡ x_{1}:A_{1}, …, x_{n}:A_{n} and x_{1} through x_{n} are distinct from each other and from x. By Free Variables FV(P) ⊆ dom(Γ). Hence x ∉ FV(P).

Then by inductive hypothesis M ▷_{β}^{∗} N ▷_{η}^{∗} P (x), so λx:A.M ▷_{β}^{∗} λx:A.N ▷_{η}^{∗} λx:A.P (x), and furthermore λx:A.P (x) ▷_{η} P. Because P (x) is normal P must be normal as well, so by Lemma 2.3.4 has no reductions. Since by inductive hypothesis P ▷^{∗} Q, we know that P ≡ Q.

• (S-App). By inductive hypothesis both P and Q are normal and M ▷^{∗} P and N ▷^{∗} Q, so M(N) ▷^{∗} P (Q), where P (Q) is both weak head normal and normal by Lemma 2.3.7.

□

Corollary 2.3.23 If Γ ⊢^{S} M →^{nf} P : A and M is normal then M ≡ P.

Proof By Adequacy for Reduction M ▷^{∗} P. Furthermore M has no reductions by Lemma 2.3.4, so M ≡ P. □

We now prove a general lemma about the relationship between untyped reduction and the system λ^{S}. This lemma will imply the important properties of strong normalization, subject reduction and the diamond property.

Definition 2.3.24 The predicate S_{Γ}^{P,A}(M) is defined as the least relation such that S_{Γ}^{P,A}(M) holds if:

• Γ ⊢^{S} M →^{nf} P : A,

• for all N which are subterms of M there are B and Q such that Γ, Δ ⊢^{S} N →^{nf} Q : B, where Δ is the sequence of binders which N occurs under in M, and

• M ▷ N implies S_{Γ}^{P,A}(N) for all N.

C_{Γ}^{P,A}(M) will be the same as S_{Γ}^{P,A}(M) except that in the last clause instead of M ▷ N we use M ▷^{+} N.

This definition is closely related to the definition of strong normalization in Altenkirch’s thesis [4], although we have added type information. We have used this definition because of the similarity of the proofs of subject reduction, strong normalization and the diamond property in this setting. The predicate is welldefined because it is strictly positive. We shall also have the following induction principle on this predicate: if S_{Γ}^{P,A}(M), for all N such that M ▷ N we have P(N), and for all N which are subterms of M we have P(N), then P(M) for all M such that S_{Γ}^{P,A}(M).

Lemma 2.3.25 The following properties hold for S_{Γ}^{P,A}(M):

• If S_{Γ}^{P,A}(M) then Γ ⊢^{S} M →^{nf} P : A.

• If S_{Γ}^{P,A}(M) then M is strongly normalizing.

• If S_{Γ}^{P,A}(M) and M ▷^{∗} N then S_{Γ}^{P,A}(N).

• S_{Γ}^{P,A}(M) iff C_{Γ}^{P,A}(M).

• If S_{Γ}^{P,A}(M) and N is a subterm of M then there are Q and B such that S_{Γ}^{Q,B}(N).

• If z is a variable such that z ∉ FV(Γ_{1}), S_{Γ_{0},x:C,Γ_{1}}^{B}(A) and z ∉ FV(A) then S_{Γ_{0},Γ_{1}}^{P,A}(M).

Proof By induction on proofs of S_{Γ}^{P,A}(M), using Strengthening for the last property. □

We need one final auxiliary lemma about η-reduction.

Lemma 2.3.26 (Subject Reduction for (η)) If Γ ⊢^{S} λx:A.M(x) →^{nf} P : A → B and x ∉ FV(M) then Γ ⊢^{S} M →^{nf} P : A → B.

Proof By Generation we know that Γ, x:A ⊢^{S} M(x) →^{nf} N : B, and either N ≡ P (x), x ∉ FV(P) and Γ ⊢^{S} P →^{nf} P : A → B (by Adequacy for Reduction and Corollary 2.3.23) or P ≡ λx:A.N and N ≡ Q(x) implies x ∈ FV(Q). By induction on the proof that Γ, x:A ⊢^{S} M(x) →^{nf} N : B we show that Γ ⊢^{S} M →^{nf} P : A → B:

• (S-App). Then, because M(x) is weak head normal, we know by Generation that Γ, x:A ⊢^{S} M →^{nf} Q : C → B, Γ, x:A ⊢^{S} x →^{nf} x : C and N ≡ Q(x). By Generation again A = C, and since x ∉ FV(M) we know by Strengthening that Γ ⊢^{S} M →^{nf} Q : A → B, so x ∉ FV(Q) implies that P ≡ Q, because P (x) ≡ N ≡ Q(x).

• (W-β). Then Γ, x:A ⊢^{S} λy:C.Q →^{nf} R : C → B, Γ, x:A ⊢^{S} x →^{nf} x : C and Γ, x:A ⊢^{S} [x/y]Q →^{nf} N : B. By Generation A = C, so Γ ⊢^{S} λy:A.Q ≡ λx:A.[x/y]Q →^{nf} P : A → B by either (S-η) or (S-λ).

• (W-App). By inductive hypothesis, Strengthening and (S-WH).

□

Lemma 2.3.27 (Reduction)

• If Γ ⊢^{S} M →^{nf} P : A then S_{Γ}^{P,A}(M).

• If Γ ⊢^{S} M →^{wh} N : A and S_{Γ}^{P,A}(N) then S_{Γ}^{P,A}(M).

Proof By induction on derivations. We show two cases:

• (S-λ). We need to show that:

– Γ ⊢^{S} λx:A.M →^{nf} λx:A.P : A → B,

– there are C and Q such that S_{Γ,Δ}^{Q,C}(N) for all subterms N of M, and – λx:A.M ▷ N implies S_{Γ}^{P,A→B}(N).

The first follows directly and the second follows by inductive hypothesis.

For the last, by induction on S_{Γ,x:A}^{P,B}(M) we know that M ▷ N implies that S_{Γ,x:A}^{P,B}(N) for all N. Hence, suppose λx:A.M ▷ N. Then:

– M ▷ N implies that λx:A.M ▷ λx:A.N. By inductive hypothesis S_{Γ}^{λx:A.P,A→B}(λx:A.N).

– λx:A.M(x) ▷ M by (η), where x ∉ FV(M). Since M is a subterm of λx:A.M(x) we know that S_{Γ,x:A}^{Q,C}(M) for some Q and C, and by the Strengthening component of Lemma 2.3.25 we know that S_{Γ}^{Q,C}(M). Furthermore, by Lemma 2.3.26 we know that Γ ⊢^{S} M →^{nf} P : A → B, so by Uniqueness of Normal Forms S_{Γ}^{P,A→B}(M).

• (W-β). We know that S_{Γ}^{P,A→B}(λx:A.M) and S_{Γ}^{Q,A}(N) by inductive hypothesis. Also S_{Γ}^{R,B}([N/x]M) by assumption. Hence C_{Γ}^{R,B}([N/x]M) by Lemma 2.3.25.

The result follows again by induction on the normalization premisses, where if λx:A.M(x) ▷ M by (η) with x ∉ FV(M) then M(N) ≡ [N/x]M(x), and S_{Γ}^{R,B}([N/x]M(x)) by assumption.

□

Without η-equalities this presentation would be somewhat simpler. In particular, we would not need Lemma 2.3.26 or the condition for subterms in the definition of S_{Γ}^{P,A}(M). Lemma 2.3.26 deals with the extra cases we need to verify for the diamond property.

However, the important point is that we have a proof of the diamond property for a system with βη-equality. It is well-known that this property with βηreduction on non-well-typed terms with type labels fails. The counterexample is that the term λx:A.(λy:B.M)(x) reduces to either λx:A.[x/y]M by (β) or λy:B.M by (η), and if A and B are not the same then there is no common reduct for them. On the other hand, this counterexample does not hold for well-typed terms, because by the rules of inference the type labels A and B must be identical for any well-typed term.

It seems that subject reduction cannot be proved straightforwardly by induction on derivations in λ^{S}, because of the transitive closure in the diagram discussed in Section 2.2.1, which arises from the rule (W-β). A direct proof of subject reduction would have to be proved for the transitive closure of reduction, which is more difficult than one-step reduction. However, strong normalization can in any case be proved directly in the current presentation.

All of the important results about reduction are corollaries to Lemmas 2.3.25, Adequacy for Reduction and Reduction.

Corollary 2.3.28 (Strong Normalization for λ^{S}) If Γ ⊢^{S} M →^{nf} P : A then M is strongly normalizing.

Corollary 2.3.29 (Subject Reduction for λ^{S}) If Γ ⊢^{S} M →^{nf} P : A and M ▷^{∗} N then Γ ⊢^{S} N →^{nf} P : A.

Corollary 2.3.30 (Diamond Property for λ^{S}) If Γ ⊢^{S} M →^{nf} Q : A, M ▷^{∗} N and M ▷^{∗} P then N ▷^{∗} Q and P ▷^{∗} Q.

Finally, we show the admissibility of several rules which will be important in showing the soundness of λ^{S} for the simply typed lambda calculus:

Proposition 2.3.31 (Admissibility of (S-η’)) If Γ, x:A ⊢^{S} M →^{nf} P (x) : B and x ∉ FV(P) then Γ ⊢^{S} λx:A.M →^{nf} P : A → B.

Proof By Adequacy for Reduction and Reduction we know that Γ, x:A ⊢^{S} P (x) →^{nf} P (x) : B and P (x) is normal. Hence the only rule which applies is (S-App), so by Generation there is a C such that Γ, x:A ⊢^{S} P →^{nf} Q : C → B and Γ, x:A ⊢^{S} x →^{nf} x : C. By Generation for the variable we know that A = C. We also know by Corollary 2.3.23 that P ≡ Q, since P must be normal by definition. Finally, by Strengthening Γ ⊢^{S} P →^{nf} P : A → B and Γ ⊢^{S} λx:A.M →^{nf} P : A → B by (S-η). □

We shall also use the lemmas Adequacy for Reduction and Subject Reduction in an essential way in the proof of soundness for the equality rules of the simply typed lambda calculus.

2.4 Soundness

In this section we shall prove the fundamental result of soundness, which relates the simply typed lambda calculus to its typed operational semantics λ^{S}. Specifically, we show that if Γ ⊢ M : A then there is a P such that Γ ⊢^{S} M →^{nf} P : A. As we have mentioned before, the soundness result is crucial to our treatment of the metatheory of the simply typed lambda calculus. It is through soundness and completeness that we transfer the metatheoretic development of the typed operational semantics to the simply typed lambda calculus.

An important first step in a proof of normalization is to elicit the reduction behavior of the system being studied. Our typed operational semantics serves this purpose: the rules of inference show that the well-typed terms are exactly those constructed with variables and abstraction and a series of weak head expansions. The technique we use to show soundness is closely related to existing proofs of normalization because these proofs do construct such reduction sequences, although this is not always clear. Furthermore, the reasoning used to show strong normalization is applicable to other important results about reduction as well, for example the diamond property as we have seen above, and the rules of inference for the typed operational semantics provide a general structure for showing such results.

2.4.1 Normalization Proofs

There are several techniques for proving normalization for the simply typed lambda calculus. One proof [33] interprets types as sets of well-typed terms and shows that any term is in the interpretation of its type relative to any parallel substitution fulfilling certain conditions.

Although this proof does not discuss variables and contexts in detail, it seems that it relies on an infinite number of variables of each type. The problem is that in the proof we shall often need a variable of some certain type, and it is simplest to assume that this variable always exists in an infinite context. However, this technique seems cumbersome to use for proving soundness of the calculus λ^{S}, because we are interested in knowing that if Γ ⊢ M : A then Γ ⊢^{S} M →^{nf} P : A in the same context Γ. If we were instead proving simple normalization this would not be a problem, because untyped reduction is independent of contexts.

Therefore, our proof instead follows Coquand and Gallier’s [17] and uses finite contexts and the general notion of substitutions. A substitution from Δ to Γ is an assignment of a term well-typed in Δ to each variable in Γ such that the types are preserved, and the application of a substitution to a term or kind is the parallel substitution of the terms for the variables. This is our Definition 2.3.9. The general soundness result we shall prove says that if a term is well-typed in the simply typed lambda calculus then that term is well-typed in λ^{S}, relative to all substitutions. This result can also be shown by first showing the soundness of the Kripke interpretation of the simply typed lambda calculus, so we shall call this proof method a Kripke-style model.

The generalization of simple substitution is necessary because of the behavior of β-reduction. For example, for the term (λx:A.λy:B.M)(N, P) in context Γ, we need to know that M, [N/x]M and [P/y][N/x]M are all normalizing. Intuitively, these three cases are covered by three substitutions to the context Γ, x:A, y:B.

For the treatment of abstractions, which are binders of variables, it is important that we can pass from a substitution from Δ to Γ to another from Δ, x:A to Γ for any x fresh in Δ and any type A. This is simply a property of substitutions, because there is always such a weakening of contexts corresponding to the identity substitution on variables. We need this weakening because we can only know that Δ ⊢^{S} λx:A.M →^{nf} P : A → B if Δ, x:A ⊢^{S} M →^{nf} N : B, and we shall need to establish this by the inductive hypothesis for the rule (λ) in the semantic presentation.

It is the lack of the general notion of substitution that limits an early presentation of Martin-Löf’s type theory [53]. An essential point of his proof of normalization for this system is that the reduction is very restrictive: there is no equality or reduction allowed beneath binders, unlike our rules (λ-Eq) in the judgemental equality or (ξ) in untyped reduction. The problem is that his proof is for normalization in the empty context, and there may be no terms of the appropriate type to allow descent beneath the binder in the empty context.

In fact, the need for either infinite contexts or Kripke-style models in normalization proofs seems to relate to the need to prove the general substitution lemma as part of the larger proof. This is related to our inability to prove substitution directly as a property for λ^{S}, as we discussed in Section 2.3.2. Each of the proof techniques mentioned allows us to choose a fresh free variable and hence to descend beneath binders such as abstractions. This suggests that the substitution lemma will be a corollary to our soundness proof, and indeed the proof of soundness for the system with substitution rules is only a minor modification of the proof for the system without these rules.

Interestingly, the proof of the substitution property embedded in the Kripkestyle normalization proof is different from the standard proof of substitution for Pure Type Systems. Omitting the parts of the proof which deal with normalization, we are left with the statement that if ϕ is a substitution from Δ to Γ such that δ ∘ ϕ is a substitution from Δ′ to Γ for all renamings δ from Δ′ to Δ, and if Γ ⊢ J, then Δ ⊢ ϕ̂(J). We can show this directly by induction on derivations in the presentation of the simply typed lambda calculus without rules of inference for thinning or substitution. Furthermore, we do not need to prove the thinning or renaming lemma before showing this, so we can prove this lemma once by induction on derivations, and derive renaming and substitution as corollaries.

Another technique for showing normalization for simple type systems uses terms which need not be well-typed. Gallier [28] discusses the proof of normalization for System F using untyped interpretations, following Tait [77] and Mitchell [61]. However, in our proof we are interested in soundness for the formal system λ^{S} instead of simple normalization, so by definition we need to construct a model with well-typed terms. In our view, the improvements this approach leads to in the study of the metatheory, as developed in Section 2.3, justify the added complexity of a full soundness proof.

We have mentioned that our proof will be a Kripke-style model construction. Catarina Coquand [13] gives a formal proof of normalization for the simply typed lambda calculus with explicit substitutions, that is substitutions which are in the syntax of the system, via a Kripke model. We feel that our normalization proof could be improved by first proving a soundness result for a more general class of models such as Kripke models and then showing that our semantic objects satisfy these more general conditions.

2.4.2 The Interpretation

We shall prove soundness by interpreting types as sets of terms well-typed in λ^{S} in a given context and then showing that well-typed terms in the simply typed lambda calculus are in the interpretation of their type.

Definition 2.4.1 (Semantic Object) A semantic object for Δ and A is a term M such that Δ ⊢^{S} M →^{nf} P : A for some term P.

We emphasize that semantic objects are always normalizing. Therefore, the fact that an element of the interpretation or of a saturated set is normalizing will require no proof, unlike many proofs of normalization [33,62,76].

Definition 2.4.2 (Interpretation) Let Δ be a context. The interpretation of a type A in Δ, [[A]]Δ, is given by induction on the structure of types:

• [[o]]Δ =_{df} {M | M is a semantic object for Δ and o}.

• [[A → B]]Δ is the set of semantic objects M for Δ and A → B such that for any renaming δ from Δ′ to Δ and any N ∈ [[A]]Δ′ we know that δ̂(M)(N) ∈ [[B]]Δ′.

Tait’s original proof of normalization [76] gives the following interpretations of types:

• [[o]] =_{df} {M | M is strongly normalizing}.

• [[A → B]] =_{df} {M | M(N) ∈ [[B]] for all N ∈ [[A]]}.

Tait’s proof shows that terms are normalizing by induction on the structure of types. If M is a term of functional type, he applies it to a constant N. Since by inductive hypothesis the application M(N) is normalizing, M must be normalizing as well.

Martin-Löf [52] instead requires a term to be normalizing as a condition for being in the interpretation. The important difference is that Martin-Löf proves normalization of abstractions by descending beneath the binder. It is clear that this technique is structural, and it is therefore easier to use and more general. Indeed, this seems completely natural in our context of showing a soundness result: we immediately consider the semantic objects to be terms which are well-typed in the typed operational semantics, and the natural way to know that an abstraction is well-typed is to consider typing the body of the abstraction in an extended context.

Using this structural technique makes our soundness proof simpler. We shall also see in Section 2.5 that the rules of inference we have developed for λ^{S} are more natural than the rules of inference which result from considering Tait’s original proof.

Catarina Coquand [13] interprets the base type o at a world w as a family of objects indexed by worlds w′ ≥ w; and A → B at a world w as a family of functions, again indexed by worlds w′ ≥ w, from the interpretation of A at w′ to the interpretation of B at w′. Although in our model we could follow this practice of indexing the objects by worlds, which for us would be contexts, in fact the indexing operation is simply the application of a renaming, as we see above.

Definition 2.4.3 (Interpretation of Contexts) The interpretation of a context Γ, [[Γ]]Δ, is a set of substitutions from Δ to Γ defined by induction on the structure of Γ:

• [[()]]Δ =_{df} {ϵ}.

• [[Γ, x:A]]Δ =_{df} {ρ[x := M] | ρ ∈ [[Γ]]Δ and M ∈ [[A]]Δ}.

2.4.3 Properties of the Interpretation

In this section we show the basic properties of the interpretation of terms and contexts.

Definition 2.4.4 (Saturated Set) A set S of semantic objects for Δ and A is a saturated set for Δ and A if:

(S1) If M is a base term then M ∈ S.

(S2) If N ∈ S and Δ ⊢^{S} M →^{wh} N : A then M ∈ S.

The reason we need to show that base terms are always in the interpretation of a type is that we shall need to extend a substitution underneath a binder, which we can always do by adding a new variable to the context. We shall want this variable to be in the interpretation of its type.

We emphasize again that the definition of semantic object enforces the condition that elements of saturated sets are normalizing. We therefore do not have the usual condition that if M ∈ S then M is strongly normalizing as an explicit condition on saturated sets.

Lemma 2.4.5 (Saturated Set) [[A]]Δ is a saturated set for any context Δ and type A.

Proof By induction on the structure of A:

• A = o. By the definition of semantic objects and (S-WH).

• A = B → C. We need to show conditions (S1) and (S2):

(S1) Suppose M is a base term such that Δ ⊢^{S} M →^{nf} P : B → C, and let δ be a renaming from Δ′ to Δ and N ∈ [[B]]Δ′ such that Δ′ ⊢^{S} N →^{nf} Q : B. By Renaming Δ′ ⊢^{S} δ̂(M) →^{nf} δ̂(P) : B → C, and δ̂(M)(N) is a base term and weak head normal, so Δ′ ⊢^{S} δ̂(M)(N) →^{nf} δ̂(P)(Q) : C by (S-App). Hence δ̂(M)(N) ∈ [[C]]Δ′ by inductive hypothesis and (S1), so M ∈ [[B → C]]Δ.

(S2) Suppose Δ ⊢^{S} M →^{wh} N : B → C and N ∈ [[B → C]]Δ, and let δ be a renaming from Δ′ to Δ and P ∈ [[B]]Δ′ such that Δ ⊢^{S} P →^{nf} R : B. We know that Δ′ ⊢^{S} δ̂(M) →^{wh} δ̂(N) : B → C by Renaming, so Δ′ ⊢^{S} δ̂(M)(P) →^{wh} δ̂(N)(P) : C by (W-App). Finally, δ̂(N)(P) ∈ [[C]]Δ′ by definition, so δ̂(M)(P) ∈ [[C]]Δ′ by inductive hypothesis and (S2). Hence M ∈ [[B → C]]Δ.

□ Lemma 2.4.6 (Monotonicity) If M ∈ [[A]]Δ and δ is a renaming from Δ′ to Δ then δ̂(M) ∈ [[A]]Δ′.

Proof By induction on the structure of A:

• A = o. By Renaming δ̂(M) is a semantic object for Δ′ and A.

• A = B → C. We again know by Renaming that δ̂(M) is a semantic object for Δ′ and B → C. Furthermore, suppose δ′ is a renaming from Δ′′ to Δ′ and N ∈ [[B]]Δ′′. Then by definition

δ̂′(δ̂(M))(N) ≡ { \atop δ′ ∘ δ}(M)(N) ∈ [[C]]Δ′′

□

Lemma 2.4.7 (Monotonicity for Contexts) If ρ ∈ [[Γ]]Δ and δ is a renaming from Δ′ to Δ then δ ∘ ρ ∈ [[Γ]]Δ′.

Proof By induction on the structure of Γ, using Lemma 2.4.6. □

2.4.4 Soundness

Finally, we can show the soundness result.

Lemma 2.4.8 (Soundness) If Γ ⊢ M : A and ρ ∈ [[Γ]]Δ then ρ̂(M) ∈ [[A]]Δ.

Proof By induction on derivations of Γ ⊢ M : A:

• (Var). By definition ρ(x) ∈ [[A]]Δ.

• (Thin). Suppose ρ ∈ [[Γ_{0}, z:C, Γ_{1}]]Δ and z ∉ FV(M). Then ρ = ρ_{0}[z := N]ρ_{1} for some ρ_{0} ∈ [[Γ_{0}]]Δ, N ∈ [[C]]Δ and ρ_{1} ∈ [[Γ_{1}]]Δ, so ρ_{0}ρ_{1} ∈ [[Γ_{0}, Γ_{1}]]Δ. Hence ρ̂_{0}ρ_{1}(M) ∈ [[A]]Δ by inductive hypothesis, and { \atop ρ_{0}[z := N]ρ_{1}}(M) ≡ ρ̂_{0}ρ_{1}(M) because z ∉ FV(M).

• (λ). By inductive hypothesis we know that ρ̂′(M) ∈ [[B]]Δ′ for any ρ′ ∈ [[Γ, x:A]]Δ′.

We first need to show that λx:A.M is a semantic object for Δ and A → B, in other words that there is a Q such that Δ ⊢^{S} λx:A.M →^{nf} Q : A → B. Let ρ ∈ [[Γ]]Δ and y be fresh in Δ. Then weak_{Δ}^{Δ,y:A} is a renaming from Δ, y:A to Δ, and y ∈ [[A]]Δ, y:A by Lemma 2.4.5 and (S1), so weak_{Δ}^{Δ,y:A}∘ρ ∈ [[Γ]]Δ, y:A by Lemma 2.4.7 and

(weak_{Δ}^{Δ,y:A} ∘ ρ)[x := y] ∈ [[Γ, x:A]]Δ, y:A

by definition. We therefore know that

{ \atop (weak_{Δ}^{Δ,y:A} ∘ ρ)[x := y]}(M) ∈ [[B]]Δ, y:A

which implies that Δ, y:A ⊢^{S} { \atop ρ[x := y]}(M) →^{nf} P : B for some P. Hence if P ≡ P′(y) with y ∉ FV(P′) then Δ ⊢^{S} λx:A.M →^{nf} P′ : A → B by (S-η’), and otherwise Δ ⊢^{S} ρ̂(λx:A.M) ≡ ρ̂(λy:A.[y/x]M) →^{nf} λy:A.P : A → B by (S-λ). Let Q be the normal form in either case.

We then need to show that δ̂(λx:A.M)(N) ∈ [[B]]Δ′ for any renaming δ from Δ′ to Δ and any N ∈ [[A]]Δ′. We can show by reasoning similar to the above that (δ ∘ ρ)[x := N] ∈ [[Γ, x:A]]Δ′. This means that { \atop (δ ∘ ρ)[x := N]}(M) ∈ [[B]]Δ′, so Δ′ ⊢^{S} { \atop (δ ∘ ρ)[x := N]}(M) →^{nf} R : B for some R. Furthermore, we know that Δ′ ⊢^{S} δ̂ ∘ ρ(λx:A.M) →^{nf} δ̂(Q) : A → B by Renaming, and also Δ′ ⊢^{S} N →^{nf} S : A for some S by definition of semantic objects, so

Δ′ ⊢^{S} δ̂ ∘ ρ(λx:A.M)(N) ≡ (λz:A.{ \atop δ ∘ ρ[x := z]}(M))(N)
→^{wh} [N/z]({ \atop (δ ∘ ρ)[x := z]}(M)) ≡ { \atop (δ ∘ ρ)[x := N]}(M): B

by (W-β) for any z fresh in Δ′. Hence δ̂ ∘ ρ(λx:A.M)(N) ∈ [[B]]Δ′ by (S2), so ρ̂(λx:A.M) ∈ [[A → B]]Δ by definition.

• (App). By inductive hypothesis we know that ρ̂(M) ∈ [[A → B]]Δ and ρ̂(N) ∈ [[A]]Δ. Hence by definition of [[A → B]]Δ

îd_{Δ}(ρ̂(M))(ρ̂(N)) ≡ ρ̂(M(N)) ∈ [[B]]Δ

Chapter 2. The Simply Typed Lambda Calculus 57

• (Subst). Suppose ρ ∈ [[Γ_{0}, Γ_{1}]]Δ. Then we know that ρ = ρ_{0}ρ_{1} where ρ_{0} ∈ [[Γ_{0}]]Δ and ρ_{1} ∈ [[Γ_{1}]]Δ. Hence by inductive hypothesis ρ̂_{0}(N) ∈ [[C]]Δ, so ρ_{0}[z := ρ̂_{0}(N)]ρ_{1} ∈ [[Γ_{0}, z:C, Γ_{1}]]Δ. Finally, by inductive hypothesis again

{ \atop ρ_{0}[z := ρ̂_{0}(N)]ρ_{1}}(M) ∈ [[A]]Δ, and

{ \atop ρ_{0}[z := ρ̂_{0}(N)]ρ_{1}}(M) ≡ { \atop ρ_{0}[z := ρ̂_{0}ρ_{1}(N)]ρ_{1}}(M) ≡ ρ̂_{0}ρ_{1}([N/z]M)

□

Lemma 2.4.9 If Γ is a context then id_{Γ} ∈ [[Γ]]Γ. Proof By induction on the structure of Γ:

• Γ ≡ (). Immediate.

• Γ ≡ Γ_{0}, x:A. By inductive hypothesis id_{Γ_{0}} ∈ [[Γ_{0}]]Γ_{0}, and weak_{Γ_{0}}^{Γ} ∘ id_{Γ_{0}} ∈

[[Γ_{0}]]Γ by Lemma 2.4.7. Finally

(weak_{Γ_{0}}^{Γ} ∘ id_{Γ_{0}})[x := x] ∈ [[Γ]]Γ by Lemma 2.4.5, (S1) and the definition of the interpretation of contexts.

□

Corollary 2.4.10 If Γ ⊢ M : A then there is a P such that Γ ⊢^{S} M →^{nf} P : A. Proof By Soundness, Lemma 2.4.9 and the definition of [[A]]Δ. □ Lemma 2.4.11 (Soundness for Γ ⊢ M = N : A) If Γ ⊢ M = N : A then there is a P such that Γ ⊢^{S} M →^{nf} P : A and Γ ⊢^{S} N →^{nf} P : A. Proof By induction on derivations that Γ ⊢ M = N : A. We give several interesting cases:

• (Trans). By inductive hypothesis and Uniqueness of Normal Forms.

• (β). By Soundness we know that Γ ⊢^{S} λx:A.M →^{nf} P : A → B, Γ ⊢^{S} N →^{nf} Q : A and Γ ⊢^{S} [N/x]M →^{nf} R : B. Hence Γ ⊢^{S} (λx:A.M)(N) →^{nf} R : B by (W-β) and (S-WH).

• (η). By Soundness we know that Γ ⊢^{S} λx:A.M(x) →^{nf} P : A → B, so Γ ⊢^{S} M →^{nf} P : A → B by Lemma 2.3.26.

• (App-Eq). By inductive hypothesis we know that Γ ⊢^{S} M →^{nf} R : A → B, Γ ⊢^{S} P →^{nf} R : A → B, Γ ⊢^{S} N →^{nf} S : A and Γ ⊢^{S} Q →^{nf} S : A. By Soundness we know that Γ ⊢^{S} M(N) →^{nf} T : B and Γ ⊢^{S} P (Q) →^{nf} U : B. Hence by Adequacy for Reduction we know that M(N) ▷^{∗} R(S) and P (Q) ▷^{∗} R(S), and by Subject Reduction we have Γ ⊢^{S} R(S) →^{nf} T : B and Γ ⊢^{S} R(S) →^{nf} U : B. Hence T ≡ U by Uniqueness of Normal Forms.

□

2.4.5 Consequences of Soundness

We now transfer the metatheoretic study of λ^{S} in Section 2.3 to the simply typed lambda calculus by using Corollary 2.4.10 and Completeness.

Corollary 2.4.12 (Strong Normalization) If Γ ⊢ M : A then M is strongly normalizing.

Corollary 2.4.13 (Subject Reduction) If Γ ⊢ M : A and M ▷ N then Γ ⊢ N : A.

Corollary 2.4.14 (Church–Rosser) If Γ ⊢ M = N : A then there is a P such that M ▷^{∗} P and N ▷^{∗} P.

We could also show the properties of Free Variables, Renaming and Strengthening for the simply typed lambda calculus.

2.5 Discussion and Related Work

As we have seen, we are able to give simpler proofs for important properties of type theory by using the derivations of λ^{S} instead of those of the simply typed lambda calculus. The soundness and completeness results are essential to our study of the metatheory for simply typed lambda calculus, to transfer the results from the typed operational semantics to the semantic presentation. In particular, we emphasize that the Church–Rosser and subject reduction properties follow straightforwardly for λ^{S}, and that the Church–Rosser property does not follow by simple induction on terms for βη-reduction and terms with type labels.

Several ideas have been influential in the development of typed operational semantics. Martin-Löf[53] gives an early proof of Church–Rosser and normalization for a typed notion of reduction: the reduction relation there is defined to have the same rules of inference as the judgemental equality excluding symmetry. Although this is not a formal system, it is one of the few proofs in the literature which proves normalization (our soundness) for a typed reduction, and typed operational semantics can be seen as a restriction of this more general reduction.

In another direction, Mitchell’s notion of type closed predicate for the simply typed lambda calculus [62] is close to a formal system. A type closed predicate is a predicate P on terms which satisfies the following conditions:

(P-Var) \frac{P(M_{1}) ∧ … ∧ P(M_{n})}{P(x(M_{1}, …, M_{n}))} for x of appropriate type

(P-App)  \frac{∀N.P(N) ⊃ P(M(N))}{P(M)}

(P-β)  \frac{P(N) ∧ P(([N/x]M)(N_{1}, …, N_{n}))}{P((λx:A.M)(N, N_{1}, …, N_{n}))}

The conditions Mitchell gives are similar to our rules of inference for the typed operational semantics, but there are several important differences:

• Normal forms are not included in the formulation of type closed predicates. Having the extra information of the normal form of a term is useful in proving properties about reduction. For example, our use of normal forms in the definition of our typed operational semantics led us to a proof of weak Church–Rosser, whereas Mitchell states that there is no obvious type closed predicate to prove this property.

• There is no explicit relationship between the type closed predicates and reduction. Our definition instead makes it clear that we are defining a special reduction relation with type information. This is a benefit when we are studying the reduction behavior of well-typed terms, because the reduction relation we define is related to standard reduction.

• Mitchell’s rule (P-App) is not structural. This seems to be a consequence of the usual proof of soundness, as we have discussed above in Section 2.4.2. Using the rule (P-App) instead of ours both leads to a strange formal system and makes using the predicates more difficult. For example, Church–Rosser is difficult to prove using type closed predicates, because it is not immediate that M is Church–Rosser if M(N) and N are.

• The definition of type closed predicate does not contain information about contexts, which limits the generality of the predicates. For example, there is no type closed predicate which proves strengthening.

• The definition of type closed predicate is informal with respect to applications to sequences of terms, which makes it appear slightly simpler than it is.

The above points suggest that although our definition of typed operational semantics appears more complicated than Mitchell’s type closed predicates, our approach is in fact simpler because it provides structure which is helpful in studying reduction.

The relationship between type closed predicates and typed operational semantics makes clear the view of λ^{S} as an alternative induction principle for welltyped terms in the simply typed lambda calculus: the rules of inference can instead be seen as conditions on predicates. One way of thinking of λ^{S} is as a formal system expressing general properties of predicates which need to be established in order to know that the predicate holds for judgements in the simply typed lambda calculus. The soundness result says that such predicates are a model for the simply typed lambda calculus.

Typed operational semantics can also be seen as presenting a modification of Coquand’s algorithm [15], described as a formal system. He presents a reduction relation to weak head normal form and a bisimilarity relation which compares these weak head normal forms for βη-convertibility. These relations are untyped and therefore need to be annotated with type information.

Our work offers the following technical improvements over the approach in Coquand’s paper:

• Our typed operational semantics is itself a formal system. In addition to its conceptual simplicity, this means that we can prove metatheoretic results by showing the equivalence of formal systems instead of considering an untyped reduction relation.

• Similarly, our derivations define a general class of predicates which hold for typed terms in the simply typed lambda calculus, as we discussed above, and we can establish results such as strong normalization by induction on the derivations of our typed operational semantics. Coquand can prove certain predicates, such as strengthening, but there is no obvious generalization in his presentation.

• We give a direct proof of normalization instead of using a bisimilarity relation for testing conversion. In addition to being a much simpler algorithm, because conversion is tested by reducing two terms to normal form and testing whether they are syntactically identical, this allows a considerable simplification of the soundness proof. Because we exploit the full power of standard reduction to normal form, we only need to consider predicates about well-typedness and not relations for bisimilarity.

The simply typed lambda calculus is a good system for explaining many important points about typed operational semantics, but there is one important aspect of typed operational semantics which is only brought out in the study of systems with dependent types. In these systems, with type equalities that allow a term to have syntactically different but judgementally equal types, proving the subject reduction property can be difficult. The typed operational semantics presentation makes these proofs easier by giving a presentation without an explicit type equality rule coercing a term from one type to another. This will be essential to our treatment of the Logical Framework and the calculus UTT.

UTT

In this chapter we present the calculus UTT. This system is formulated in Martin-Löf’s Logical Framework [63], a formal system which Martin-Löf intended to be used as a framework for defining type theories. The Logical Framework is a weak theory that has functional types and dependency, and we define new type theories by introducing constants and equalities into this theory. These constants represent the terms and rules of inference of the type theory we are representing in the Logical Framework.

The Logical Framework used in UTT differs from Martin-Löf’s by having labels on the framework-level abstractions. Including the labels makes the study of the metatheory for the system more difficult.

3.1 Structure and Intended Use

The type theory UTT incorporates the aspects of type theory that we have discussed in the introduction. We shall give a brief overview of the type theory and some motivations for the constructs included in the type theory.

UTT has an impredicative universe of propositions which is distinct from the collection of all types. This reflects the view that propositions are indeed mathematical objects which can be understood in the type-theoretic framework, but that our logical reasoning should be confined to an independent universe which does not change as we alter the overall type theory to incorporate different applications. Furthermore, we can establish that type-checking is decidable as a consequence of the results later in this thesis, so we shall be able to know whether a proof object is an element of the type of proofs of a particular proposition.

We also have a predicative universe of computational types in UTT. This universe includes inductive types which are important for programming and mathematics, such as natural numbers, product types, function spaces, sum types, and dependent product and sum types. We also include the type of propositions and the type of proofs of each proposition in this universe.

UTT provides an environment which is well-suited to studying the specification and verification of programs. The dependent product and sum types allow us to represent specifications, refinements or implementations of specifications and realizations adequately in the type theory. A specification in type theory is represented as a pair of a type, which contains the possible structures which realize the specification, and a predicate over that type, which specifies the properties that any structure should satisfy. Luo discusses this approach iextensively [46, 47]. Also, the notion of deliverable [57,56] is studied in the context of ECC, a subsystem of UTT.

The structure of UTT may be inappropriate for particular applications in programming or mathematics. For example, it seems unnatural to consider the type of propositions and the types of proofs of propositions to be computational types, although including them in the computational universe is useful in studying specification and verification. The Logical Framework, the independence of the logic and the conceptual openness of the type theory make it possible to consider the type-theoretic formulation best suited to a given application domain.

3.2 The Logical Framework

Martin-Löf’s Logical Framework is intended to be used as a meta-language for introducing new type theories. There are several reasons for using such a framework to present a type theory. First, the Logical Framework allows us to form hypothetical judgements parameterized over types. As Nordström, Petersson, and Smith explain, most text books on logic have few completely formal derivations. For example, the statement “A implies A” involves a meta-level use of the variable A, which need not be a formal entity in the theory we are studying. The Logical Framework allows us to make assumptions that A is a type and to reason about arbitrary types. Secondly, for reasons which we shall discuss in detail later, inductive types can be presented effectively in the Logical Framework. Lastly, implementing type theories using the Logical Framework is easier, because the framework deals with issues such as binders once and for all.

We shall distinguish the collections in the type theory being formulated, the object language, from the collections in the Logical Framework, the meta-language, by referring to the collections in the framework as kinds. Extending our semantic explanation of the judgements in Section 1.1, we say that if A is a kind then we know what the elements of A are and when two elements of A are equal, the equality being a decidable equivalence relation. The notion of kind is more basic than the concept of type, because kinds remain conceptually open: we only need to be able to recognize that an object is an element of the kind. In contrast, as we explained in Section 1.1, if we know that A is a type then we must know what the canonical elements of A are, where these canonical elements are formed according to the introduction rules for the type. Corresponding to our change in terminology in Section 1.1, where we used “type” for his “set,” what we call a “kind” he calls a “type.”

We have the following forms of judgement in the Logical Framework and the corresponding semantic explanations:

• A kind. This means that we know what the elements of the kind A are, and we also know when two elements of A are equal. The equality must be a decidable equivalence relation.

• A = B. This means that A and B are kinds that they have the same elements, and furthermore that the equalities on elements for A and B are the same.

• M: A. This means that M is an element of the kind A.

• M = N: A. This means that M and N are elements of the kind A and that they are equal under the equality for A.

Judgements with hypotheses in the Logical Framework are explained in the same way as judgements with hypotheses in type theory, as we have described in Section 1.1. We therefore introduce an infinite set V of names for the hypotheses, and another judgement form, ⊢Γ, which means that Γ represents a valid sequence of hypotheses. We also parameterize each of the four judgements above by sequences of hypotheses Γ. Notation We write Γ ⊢ J to mean any of the five judgement forms under the sequence of hypotheses Γ.

We use the following conventions for variable names:

• Γ, Δ, Φ, … denote arbitrary sequences of hypotheses,

• A, B, C, … denote arbitrary kinds,

• M, N, P, … denote arbitrary terms, and

• x, y, z, … denote arbitrary variables.

3.2.1 Contexts and Substitution Rules

Because of the explanation of judgements with hypotheses, we can introduce general rules which correspond to our understanding of what it means to know a judgement with hypotheses. For example, the judgement x:A ⊢ B kind was explained to mean that we know

• () ⊢ [M/x]B kind for any element () ⊢ M : A and

• () ⊢ [M/x]B = [N/x]B for any elements () ⊢ M = N : A.

This explanation, generalized to arbitrary finite sequences of hypotheses, justifies the rules (Kind Subst) and (Kind Subst-Eq) below.

We first introduce the syntactic construct for representing sequences of hypotheses.

Definition 3.2.1 (Pre-Context) A sequence x_{1}:A_{1}, …, x_{n}:A_{n} of pairs of variables x_{i} ∈ V and kinds A_{i} is a pre-context. The empty context is denoted by ().

The domain of a pre-context Γ, dom(Γ), is the set of variables {x_{1}, …, x_{n}}.

We have several rules which allow us to judge that a sequence of hypotheses is well-formed. We shall call a pre-context Γ such that ⊢Γ a valid context.

(Emp) \overline{⊢()} (Weak) \frac{Γ ⊢ A kind x ∉ dom(Γ)}{⊢Γ, x:A} (Var) \frac{⊢Γ_{0}, x:A, Γ_{1}}{Γ_{0}, x:A, Γ_{1} ⊢ x : A}

Figure 3–1: Contexts and Assumptions

Corresponding to the above description of the meaning of judgements with hypotheses, we have the following formal rules for substitution given in Figure 3– 2.

3.2.2 The Kind Type

The kind Type represents the kind of all types which can be formed in the type theory being represented in the Logical Framework. In order to know that A is

(Ctxt Subst)  \begin{matrix}⊢Γ_{0}, z:C, Γ_{1} & Γ_{0} ⊢ P : C \\ ⊢ & Γ_{0}, [P/z]Γ_{1} \end{matrix}

(Kind Subst)  \frac{Γ_{0}, z:C, Γ_{1} ⊢ A kind Γ_{0} ⊢ P : C}{Γ_{0}, [P/z]Γ_{1} ⊢ [P/z]A kind}

(Term Subst)  \frac{Γ_{0}, z:C, Γ_{1} ⊢ M : A Γ_{0} ⊢ P : C}{Γ_{0}, [P/z]Γ_{1} ⊢ [P/z]M : [P/z]A}

(Kind Subst-Eq) \frac{Γ_{0}, z:C, Γ_{1} ⊢ A kind Γ_{0} ⊢ P = Q : C}{Γ_{0}, [P/z]Γ_{1} ⊢ [P/z]A = [Q/z]A}

(Term Subst-Eq) \frac{Γ_{0}, z:C, Γ_{1} ⊢ M : A Γ_{0} ⊢ P = Q : C}{Γ_{0}, [P/z]Γ_{1} ⊢ [P/z]M = [Q/z]M : [P/z]A}

(Kind-Eq Subst)  \frac{Γ_{0}, z:C, Γ_{1} ⊢ A = B Γ_{0} ⊢ P : C}{Γ_{0}, [P/z]Γ_{1} ⊢ [P/z]A = [P/z]B}

(Term-Eq Subst) \frac{Γ_{0}, z:C, Γ_{1} ⊢ M = N : B Γ_{0} ⊢ P : C}{Γ_{0}, [P/z]Γ_{1} ⊢ [P/z]M = [P/z]N : [P/z]B}

Figure 3–2: Substitution Rules a type, we shall need to know exactly what we prescribed in Section 1.1: what the canonical elements of A are and when two canonical elements of A are equal. Similarly, two types A and B are equal if they have the same canonical elements and the equalities for A and B are the same.

Introducing a kind of all types does not make our theory inconsistent because kinds themselves are not a part of the object language. Reflecting the conceptual openness of the universe of types, in order to know that Type is a kind we do not need to know what all types in the type theory are, we only need to know how to recognize what a type is and when two types are equal.

There will also be associated with each type A in the object language a kind El(A) of the elements of A. To know that an object is in the kind El(A) we must know that it evaluates to a canonical form which is in A, and to know that two objects are equal objects in El(A) we must know that they evaluate to equal canonical forms in A.

(Type)  \frac{⊢Γ}{Γ ⊢ Type kind}

(El) \frac{Γ ⊢ A : Type}{Γ ⊢ El(A) kind} (El-Eq) \frac{Γ ⊢ A = B : Type}{Γ ⊢ El(A) = El(B)}

Figure 3–3: The Kind Type

Notation In writing kinds we shall often omit the El operator.

3.2.3 Judgemental Equality

The rules in Figure 3–4 stipulate that the judgemental equalities of the Logical Framework for terms and for kinds are equivalence relations.

(KRefl) \frac{Γ ⊢ A kind}{Γ ⊢ A = A}  (KSym) \frac{Γ ⊢ A = B}{Γ ⊢ B = A}

(KTrans)  \frac{Γ ⊢ A = B Γ ⊢ B = C}{Γ ⊢ A = C}

(Refl) \frac{Γ ⊢ M : A}{Γ ⊢ M = M : A} (Sym) \frac{Γ ⊢ M = N : A}{Γ ⊢ N = M : A}

(Trans)  \frac{Γ ⊢ M = N : A Γ ⊢ N = P : A}{Γ ⊢ M = P : A}

Figure 3–4: General Equality Rules

In Figure 3–5 we have the rules that reflect our understanding of the meaning of the judgement Γ ⊢ A = B: that the kinds A and B have the same elements and that the equalities for the two kinds are identical.

(=T) \frac{Γ ⊢ M : A Γ ⊢ A = B}{Γ ⊢ M : B} (=R) \frac{Γ ⊢ M = N : A Γ ⊢ A = B}{Γ ⊢ M = N : B}

Figure 3–5: Equality Typing Rules

3.2.4 Dependent Product Kinds

As we have said, we shall define the object-level type theory through the use of the meta-language of the Logical Framework. The fundamental tool we use in the Logical Framework is the mechanism of a kind of higher-order dependent functions. These functions will correspond to expressions with holes in them in the object language. As we discussed at the beginning of this chapter, the higher-order functions allow us to explain the binding mechanism of the object-level through the binding mechanism of the Logical Framework.

The β and η-equalities for dependent products express two basic operations on expressions with holes. The rule (β) allows us to fill a hole in an expression, which involves using the meta-level substitution. The rule (η) states that two different terms denote the same expression with a hole. The equality on terms induced by the equalities of the Logical Framework is a definitional equality: it merely says that two terms in the Logical Framework denote the same expression, with or without holes. When we describe new types in the framework we shall need to introduce equalities to express the object-level equality on elements of the types.

We have differed from Martin-Löf’s presentation of the terms of the Logical Framework by including type labels in abstractions. This is also the presentation used in the Edinburgh Logical Framework. The constructs (x:A_{1})A_{2} and [x:A_{1}]M_{0} are binders.

Notation We use the convention of writing (A)B for (x:A)B if x does not occur in the free variables of B.

We shall also write f(M_{1}, …, M_{n}) for f(M_{1}) … (M_{n}).

3.3 Inductive Data Types in UTT

So far we have only introduced a calculus for notation, the Logical Framework. An essential feature of programming languages is the ability to define datatypes and to perform recursion over the elements. One datatype which is included in almost all programming languages is the type of numbers, so we shall demonstrate the type-theoretic approach to inductive types by beginning with this example.

3.3.1 An Example: The Natural Numbers

As we have discussed in Section 1.1, the first step in defining a new type in type theory is to show under what circumstances that type is well-formed. Here this is

(Π) \frac{Γ, x:A_{1} ⊢ A_{2} kind}{Γ ⊢ (x:A_{1})A_{2} kind} (Π-Eq) \frac{Γ ⊢ A_{1} = B_{1} Γ, x:A_{1} ⊢ A_{2} = B_{2}}{Γ ⊢ (x:A_{1})A_{2} = (x:B_{1})B_{2}}

(λ)  \frac{Γ, x:A_{1} ⊢ M_{0} : A_{2}}{Γ ⊢ [x:A_{1}]M_{0} : (x:A_{1})A_{2}}

(λ-Eq)  \frac{Γ ⊢ A_{1} = B_{1} Γ, x:A_{1} ⊢ M_{0} = N_{0} : A_{2}}{Γ ⊢ [x:A_{1}]M_{0} = [x:B_{1}]N_{0} : (x:A_{1})A_{2}}

(App)  \frac{Γ ⊢ M_{1} : (x:A_{1})A_{2} Γ ⊢ M_{2} : A_{1}}{Γ ⊢ M_{1}(M_{2}) : [M_{2}/x]A_{2}}

(App-Eq)  \frac{Γ ⊢ M_{1} = N_{1} : (x:A_{1})A_{2} Γ ⊢ M_{2} = N_{2} : A_{1}}{Γ ⊢ M_{1}(M_{2}) = N_{1}(N_{2}) : [M_{2}/x]A_{2}}

(β)  \frac{Γ, x:A_{1} ⊢ M_{0} : A_{2} Γ ⊢ M_{2} : A_{1}}{Γ ⊢ ([x:A_{1}]M_{0})(M_{2}) = [M_{2}/x]M_{0} : [M_{2}/x]A_{2}}

(η)  \frac{Γ ⊢ M : (x:A_{1})A_{2}}{Γ ⊢ [x:A_{1}]M(x) = M : (x:A_{1})A_{2}}

Figure 3–6: Dependent Product Kinds

simple: the natural numbers are a well-formed type in any valid context.

\frac{⊢Γ}{Γ ⊢ N : Type}

From now on, we shall assume that each of the rules introducing a new constant has the premiss that Γ is a valid context, and that its conclusion is that the constant is well-typed in Γ.

We also need to say what canonical objects are elements of the new type. For the natural numbers, 0 is always a natural number, and if n is a natural number then succ(n) is also a natural number. In our presentation in the Logical Framework, succ will be a meta-level function from N to N, instead of a new constant symbol which has a hole in it. In other words, we could instead have said that if n is a natural number then succ[n] is a natural number, where succ[n] is simply a new term, but instead we use the meta-level functional type to express this.

The rules of inference for these canonical elements are what we would expect:

0: N and succ: (N)N

Non-canonical elements of type N will be variables or terms which have not been evaluated to a form where the outermost term constructor is either 0 or succ. For example, ([x:N]x)(0) is not canonical, although it evaluates to the canonical form 0 by β-reduction. We can think of terms which have not been evaluated to a canonical form as programs which have not yet been run.

In order to write programs with the natural numbers, we shall want an induction principle over the elements. This induction principle will be a non-canonical object whose kind will reflect the usual induction principle on natural numbers. The induction principle, because it should be able to prove predicates over natural numbers, will make essential use of the dependency of the Logical Framework.

E_{N} : (C:(N)Type)
(C(0))
((n:N)(C(n))C(succ(n)))
(z:N)C(z)

Because this induction principle allows us to defined dependent functions to any type, rather than just to propositions, we shall call it an elimination constant. We can define the usual recursion for natural numbers using the elimination constant corresponding to induction:

R_{N} =_{df} [C:Type]
[c:C]
[f:(N)(C)C]
E_{N}([n:N]C, c, f)

Finally, we need to introduce equality rules. These rules relate the introduction rules, the canonical elements of the natural numbers, with the elimination constant or induction principle, by showing how a function defined by the elimination constant behaves on the canonical elements. There will be a separate such rule for each canonical element, and these are what we expect:

(E_{N} −0)  \frac{C: (N)Type c: C(0) f: (n:N)(C(n))C(succ(n))}{E_{N}(C, c, f, 0) = a: C(0)}

(E_{N} −succ) \frac{C: (N)Type c: C(0) f: (n:N)(C(n))C(succ(n) n: N}{E_{N}(C, c, f, succ(n)) = f(n, E_{N}(C, c, f, n)): C(succ(n))}

These rules correspond to the usual definition of functions over the natural numbers by primitive recursion. We can write programs or functions on the natural numbers using the elimination constant and derive the expected equalities:

m + n =_{df} R_{N}(N, m, [x, v:N]succ(v), n)
m + 0 = m
m + succ(n) = succ(m + n)

We can furthermore use the elimination constant to show that expected properties hold for +, such as associativity and commutativity.

We shall see when we define the propositional equality that we can derive the Peano postulates using the elimination constant.

3.3.2 Schemas for Inductive Types

We need more than just a few basic types in a programming language. Older languages have certain basic types such as integers and then allow new types to be built up with records. Languages such as SML make it easy to create new types tailored to the programming task at hand. In order to capture this feature in type theory, we need a general way of introducing new inductive types. In type theory, because it is a logical language, we have the further problems that we need to put restrictions on this general mechanism to ensure the consistency of the system with the new types: in other words, we should not be able to write programs which never terminate.

Above, we introduced the natural numbers by giving each new constant explicitly. The induction principle we gave is clearly related to the introduction rules, and we would like to have a general way of generating an induction principle given reasonable introduction rules for a new type. The introduction of kind schemas to the Logical Framework, and the definitions which support this, will allow us to achieve exactly this.

Definition 3.3.1 (Small Kinds) We say that a kind A is a small kind if

• A ≡ El(M) or

• A ≡ (x:A_{1})A_{2}, where A_{1} and A_{2} are small kinds.

The small kinds are kinds in which Type does not occur. The intention is that inductive types will be formulated as a sequence of kinds which represent the kinds of the introduction rules. Because it is inconsistent to have an embedding of the universe of types into itself, we need to ensure that the kinds representing the introduction rules have no occurrences of the kind Type.

Definition 3.3.2 (Schema Families) Let Γ be a valid context and X be a variable.

• We say that a kind Φ is a strictly positive operator in Γ with respect to X, notation Pos_{Γ;X}(Φ), if Γ, X:Type ⊢ Φ kind and

– Φ ≡ X or

– Φ ≡ (x:A)Φ_{0}, where A is a small kind and Pos_{Γ;X}(Φ_{0}).

• We say that a kind Θ is an inductive schema in Γ with respect to X, notation Sch_{Γ;X}(Θ), if – Θ ≡ X,

– Θ ≡ (x:A)Θ_{0}, where A is a small kind and Sch_{Γ;X}(Θ_{0}), or

– Θ ≡ (Φ)Θ_{0}, where Pos_{Γ;X}(Φ) and Sch_{Γ;X}(Θ_{0}).

• We say that a finite sequence of kinds Θ_{1}, …, Θ_{n} is a schema family in Γ with respect to X, notation Sch_{Γ;X}(Θ_{1}, …, Θ_{n}), if Sch_{Γ;X}(Θ_{i}) for 1 ≤ i ≤ n.

Notation

• We write Φ(M) for [M/X]Φ if Pos_{Γ;X}(Φ), and similarly for Θ such that Sch_{Γ;X}(Θ) and Θ_{1}, …, Θ_{n} such that Sch_{X;Γ}(Θ_{1}, …, Θ_{n}).

• If Θ is a schema family in Γ with respect to X then we write Arity_{X}(Θ) for the sequence Φ_{1}, …, Φ_{m} of strictly positive operators in Γ with respect to X in Θ. We also extend this to schema families in the obvious way.

• We use the notation F [x_{1}, …, x_{n}] =_{df} M to introduce definitions with variables x_{1}, …, x_{n}. The notation F [N_{1}, …, N_{n}] then means the term or kind [N_{1}, …, N_{n}/x_{1}, …, x_{n}]M.

Definition 3.3.3

• Assume that Pos_{Γ;X}(Φ), where Φ ≡ (x_{1}:A_{1}) … (x_{n}:A_{n})X, and suppose that Γ ⊢ A : Type, Γ ⊢ C : (A)Type and Γ ⊢ z : Φ(A). Then define

Φ^{∘}[A, C, z] =_{df} (x_{1}:A_{1}) … (x_{n}:A_{n})C(z(x_{1}, …, x_{n}))

• Suppose Sch_{Γ;X}(Θ), where Θ ≡ (x_{1}:M_{1}) … (x_{n}:M_{n})X, let A and C be as above and let Γ ⊢ z : Φ(A). Then define

Θ^{∘}[A, C, z] =_{df} (x_{1}:M_{1}(A)) … (x_{n}:M_{n}(A))
(Φ_{i_{1}}^{∘}[A, C, x_{i_{1}}]) … (Φ_{i_{k}}^{∘}[A, C, x_{i_{k}}])C(z(x_{1}, …, x_{n}))

• Suppose Pos_{Γ;X}(Φ), where Φ ≡ (x_{1}:A_{1}) … (x_{n}:A_{n})X, let A, C and z be as above, and let Γ ⊢ f : (x:A)C(x). Then define

Φ^{♮}[A, C, f, z] =_{df} [x_{1}:A_{1}] … [x_{n}:A_{n}]f(z(x_{1}, …, x_{n}))

We then have the following introduction rules for the constants associated with inductive types, where we again consider these introductions relative to a valid context Γ and Θ̄ a schema family in Γ with respect to X:

M^{X}[Θ̄] : Type
ι_{i}^{X}[Θ̄] : Θ_{i}(M^{X}[Θ̄]) (1 ≤ i ≤ n)
E^{X}[Θ̄] : (C:(M^{X}[Θ̄])Type)
(f_{1}:Θ_{1}^{∘}[M^{X}[Θ̄], C, ι_{1}^{X}[Θ̄]])
…
(f_{n}:Θ_{n}^{∘}[M^{X}[Θ̄], C, ι_{n}^{X}[Θ̄]])
(z:M^{X}[Θ̄])C(z)

We have the associated equality rule:

E^{X}[Θ̄](C, f̄, ι_{i}^{X}[Θ̄](ā))
= f_{i}(ā, Φ_{1}^{♮}[M^{X}[Θ̄], C, E^{X}[Θ̄](C, f̄), a_{1}], …, Φ_{k}^{♮}[M^{X}[Θ̄], C, E^{X}[Θ̄](C, f̄), a_{k}])
: C(ι_{i}^{X}[Θ̄](ā))

for 1 ≤ i ≤ n, where f̄ stands for f_{1}, …, f_{n}, ā for a_{1}, …, a_{m} and Arity_{X}(Θ_{i}) ≡ Φ_{1}, …, Φ_{k}.

The kinds of the constants for the introduction and elimination of inductive types require explicit information about the inductive type involved: we need to provide the full schema. The extra information is needed in order for it to be decidable whether a term has a given kind. These operations are therefore monomorphic, in contrast to the polymorphic application in the Logical Framework, which requires no type information, and the framework abstraction which only has partial type information.

We can define many interesting inductive types using this general schema:

0 =_{df} M^{X}[]
1 =_{df} M^{X}[X]
2 =_{df} M^{X}[X, X]
N =_{df} M^{X}[X, (X)X]
list =_{df} [A:Type]M^{X}[X, (A)(X)X]
→ =_{df} [A, B:Type]M^{X}[((A)B)X]
Π =_{df} [A:Type][B:(A)Type]M^{X}[((x:A)B(x))X]
Σ =_{df} [A:Type][B:(A)Type]M^{X}[(x:A)(B(x))X]
+ =_{df} [A, B:Type]M^{X}[(A)X, (B)X]
W =_{df} [A:Type][B:(A)Type]M^{X}[(x:A)((B(x))X)X]

Finally, we need to have a rule of inference which equates constant expressions which have equal schema families.

(κ-Eq) \frac{Sch_{Γ;X}(Θ̄) Sch_{Γ;X}(Θ̄′) Γ ⊢ κ^{X}[Θ̄] : A Γ ⊢ κ^{X}[Θ̄′] : A Γ, X:Type ⊢ Θ_{i} = Θ′_{i} 1 ≤ i ≤ n}{Γ ⊢ κ^{X}[Θ̄] = κ^{X}[Θ̄′] : A}

Luo [47] calls the Logical Framework with the rule (κ-Eq) and no added constants the Logical Framework with inductive schema.

We give an example of the need for the rule (κ-Eq). Suppose we consider the type of lists over a type A, which we have represented above as M^{X}[X, (A)(X)X]. Furthermore, suppose A′ is some type which is judgementally equal to A, ⊢ A = A′ : Type. We certainly then intend that the type of lists over A is equal to the type of lists over A′, and furthermore that the term constructors for these two types are equal as well. We need the rule (κ-Eq) to show that ⊢ M^{X}[X, (A)(X)X] = M^{X}[X, (A′)(X)X] : Type, and similarly for ι_{0} and ι_{1} and E (and μ if it is in the universe, as we define it below).

3.4 An Impredicative Universe of Propositions

We now introduce the universe of propositions. UTT follows the idea, as we discussed in Section 1.1.4, that the propositions-as-types principle gives an embedding from propositions to types but does not necessarily identify propositions and types. We therefore introduce the universe of propositions as a type and a coercion operator from this universe to types.

The impredicative universe of propositions is introduced by the following constant declarations:

Prop : Type
Prf : (Prop)Type
∀ : (A:Type)((A)Prop)Prop
Λ : (A:Type)
(P:(A)Prop)
((x:A)Prf(P (x)))
Prf(∀(A, P))
E_{∀} : (A:Type)
(P:(A)Prop)
(R:(Prf(∀(A, P)))Prop)
((g:(x:A)Prf(P (x)))Prf(R(Λ(A, P, g))))
(z:Prf(∀(A, P)))Prf(R(z))

with the equality rule

E_{∀}(A, P, R, f, Λ(A, P, g)) = f(g) : Prf(R(Λ(A, P, g)))

with the appropriate types for the variables.

Again, the constants we define here are monomorphic, in that they require full information about the proposition being proved.

As we have discussed earlier, kinds are conceptually open in the sense that we only need to recognize the elements of a kind, rather than needing to know all of the elements of the kind inductively. The introduction of new types into the Logical Framework using the dependent product kind and the kind Type reflects this openness: we are saying that we can recognize these new objects to be elements of their respective kinds.

The universe of propositions is impredicative because the universal quantification is allowed to range over arbitrary types and because we have a coercion from propositions to types: the expression ∀(Prop, [X:Prop]Prf(X)) quantifies over all propositions and is itself a proposition.

We have linked the type theory and the logic intimately by allowing the quantifier to range over all types. This adheres to the view that the type theory should be open and that the logic in the system is universal: if we add new types to the type theory we can form new propositions over these types, but we do not need to alter the ways of forming propositions.

We could have used more restrictive quantifiers if we were interested in using the logic for specific types. For example, instead of the constant ∀ with a domain of all types we could have introduced the constants:

∀_{Prop} : (X:Prop)Prop
∀_{Prf} : (X:Prop)(p:Prf(X))Prop

plus separate introduction and elimination constants for these. This would restrict our logic so that it could only form statements about propositions and proofs of propositions.

We can define the usual application operator using the dependent elimination operator we have introduced:

app(A, P, M, N) =_{df} E_{∀}(A, P, [G:Prf(∀(A, P))]P (N),
[g:(x:A)Prf(P (x))]g(N), M)
: (A:Type)
(P:(A)Prop)
(Prf(∀(A, P)))
(N:A)Prf(P (N))

We can derive the usual equality rule corresponding to β-reduction for propositional redices:

app(A, P, Λ(A, P, g), N) = g(N) : Prf(P (a))

Impredicativity is a very strong principle. It allows us to define many of the logical connectives which are taken as primitive in weaker logics. For example, we can encode the following connectives:

A ⊃ B =_{df} ∀(Prf(A), [x:Prf(A)]Prf(B))
true =_{df} ∀(Prop, [X:Prop]X ⊃ X)
false =_{df} ∀(Prop, [X:Prop]X)
A ∧ B =_{df} ∀(Prop, [X:Prop]A ⊃ B ⊃ X)
A ∨ B =_{df} ∀(Prop, [X:Prop](A ⊃ X) → (B ⊃ X) ⊃ X)
¬A =_{df} A ⊃ false
∃x:A.P [x] =_{df} ∀(Prop, [X:Prop](∀(A, [x:A]P [x] ⊃ X)) ⊃ X)

We can also define equality using an impredicative encoding of the Leibniz principle:

M =_{A} N =_{df} ∀(A → Prop,
[P:A → Prop]
App(A, Prop, P, M) ⊃
App(A, Prop, P, N))

where App is the application operator for the inductive type →, defined in the same way as the above app.

We can justify these encodings of logical connectives using the propositionsas-types embedding and the metatheoretic properties of the system UTT as we develop them in Chapters 4 and 6. We shall also know that in addition to being an equivalence relation and having the substitution property, the Leibniz equality defined also reflects the judgemental equality: two objects are Leibniz equal if and only if they are judgementally equal.

Theorem 3.4.1 (Equality Reflection) () ⊢ M = N : A if and only if there is a term p such that () ⊢ p : Prf(M =_{A} N).

Proof Following the technique of Martin-Löf [51] or Luo [47]. □

A thorough discussion of the internal logic of UTT and the adequacy of the encodings of the logical operators can be found in Luo’s book [47].

We can use recursion on the inductive types to define higher-order predicates for induction principles. Smith [73] shows that ¬(Eq(N, 0, succ(0)), cannot be shown in Martin-Löf type theory with no universes, where Eq is Martin-Löf’s intensional equality, but in the theory with a predicative universe it can be shown. However, it is not the predicativity of the universes which is essential but the existence of any universe: we can use the same style of prove in UTT to show that ¬(0 =_{N} succ(0)) in the impredicative universe. This is done by defining the predicate P: N → Prop which for 0 returns true and for any term of the form succ(n) returns false. Then by definition of Leibniz equality it is clear that if App(A, Prop, P, 0) implies App(A, Prop, P, succ(n)) then there must be a proof of false.

Similarly, to prove that if s(m) =_{N} s(n) then m =_{N} n, we can use the predicate P: N → Prop which for 0 returns any proposition and for succ(x) returns the proposition that m =_{N} x. It is clear by definition of Leibniz equality that if there is a proof of App(A, Prop, P, succ(m)) ⇒ App(A, Prop, P, succ(n)), which is judgementally equal to (m =_{N} m) ⇒ (m =_{N} n), then there is a proof of m =_{N} n.

We can also prove the equalities which correspond to the uniqueness of the constructors in the internal logic using the induction principle which is defined for the inductive types. For example, for the type Σx:A.B as we defined it above, we can show that

pair(π_{1}(A, B, p), π_{2}(A, B, p)) =_{Σx:A.B} p

where pair is the only constructor for the type and π_{1} and π_{2} are the projections defined using the elimination constant.

If we do not have the rule of η-equality for the Logical Framework then some of the uniqueness properties cannot be proved, for example for the Π-type. Luo [47] shows that if this rule is present then the uniqueness properties hold for all inductive types. This is part of the motivation for formulating UTT in the Logical Framework: the original proposal [19] formulated the inductive schema in the predicate universes of a type theory, altering the structure of the theory by having (η) as an equality in the type theory.

3.5 Universes

An important aspect of Martin-Löf’s type theory is the predicative universes. We have already introduced an impredicative universe of propositions, which allows impredicative quantification. The predicative universe contains names of types, and allows us to quantify over types and write functions in the type theory which return types. This is important if we want to use type theory as a language for specification, in order to be able to express abstract data types and specifications.

The system we study in this thesis has only one predicative universe. It is therefore a subsystem of full UTT [47].

The declarations which define the predicative universe are:

U : Type
T : (U)Type
prop : U
prf : (Prop)U

The associated rules of eqaulity are:

(T-prop) \overline{T(prop) = Prop: Type} (T-prf) \frac{P: Prop}{T(prf(P)) = Prf(P): Type}

In order to introduce inductive types in the universe, we need an auxiliary operator which collects the types used in inductive schemas. These operations are defined only on the syntax of schemas.

Definition 3.5.1 (Types_{Γ}(Θ̄)) Let Γ be a pre-context and let A, Φ and Θ be a small kind, a strictly positive operator with respect to X and a schema with respect to X. The sets Types_{Γ}(A), Types_{Γ}(Φ) and Types_{Γ}(Θ) are defined as follows:

Types_{Γ}(A) =_{df} \begin{cases}\{(Γ, A)\} & if A is a type \\ Types_{Γ}(A_{1}) ∪ Types_{Γ,x:A_{1}}(A_{2}) & if A ≡ (x:A_{1})A_{2} \end{cases}

Types_{Γ}(Φ) =_{df} \begin{cases}∅ & if Φ ≡ X \\ Types_{Γ}(A_{1}) ∪ Types_{Γ,x:A_{1}}(Φ_{0}) & if Φ ≡ (x:A_{1})Φ_{0} \end{cases}

Types_{Γ}(Θ) =_{df} \begin{cases}∅ & if Θ ≡ X \\ Types_{Γ}(A_{1}) ∪ Types_{Γ,x:A_{1}}(Θ_{0}) & if Θ ≡ (x:A_{1})Θ_{0} \\ Types_{Γ}(Φ) ∪ Types_{Γ}(Θ_{0}) & if Θ ≡ (Φ)Θ_{0} \end{cases}

For Θ̄ ≡ Θ_{1}, …, Θ_{n},

Types_{Γ}(Θ̄) =_{df} ⋃_{1≤i≤n} Types_{Γ}(Θ_{i})

We now consider the last rules of inference for UTT. Suppose Sch_{Γ;X}(Θ̄), and assume that there is a Θ̄′ such that Sch_{Γ;X}(Θ̄′), Γ, X:Type ⊢ Θ_{i} = Θ′_{i} for 1 ≤ i ≤ n, and for each (Γ′, A) ∈ Types_{Γ}(Θ̄′) there is an a such that T(a) ≡ A. Then we have that μ^{X}[Θ̄] is an element of the universe:

Γ ⊢ μ^{X}[Θ̄] : U and Γ ⊢ T(μ^{X}[Θ̄]) = M^{X}[Θ̄] : Type

This definition is formally different from Luo’s [47], but we can show that it is equivalent. Our definition is easier to reason with when we consider the syntactic properties of the system.

Basic Metatheory for UTT

In this chapter we shall consider the basic metatheory for the type theory UTT. We begin by discussing different aspects of the metatheory for type theories. We follow this by giving several definitions which will be used later in our understanding of the type theory. These include the definition of reduction and an equivalent presentation of UTT which omits some of the rules of inference.

Because of our approach of introducing a typed operational semantics, the focus of the chapter will be on the system UTT^{S}, the typed operational semantics for UTT. Nearly all of the metatheory will be developed for UTT^{S}, and we shall transfer these results to UTT via soundness and completeness results. We shall only need a few auxiliary lemmas about UTT to be able to prove the soundness theorem.

The fundamental result about the type theory in our development, that the typed operational semantics UTT^{S} is a sound interpretation of UTT, requires a complicated proof. We therefore leave this result for Chapter 6.

4.1 Metatheory for Type Theories

This section explains several aspects of the metatheory of type theory which are relevant to our treatment of the system UTT.

4.1.1 Presentations of Type Theory

We can have many different motivations for considering a type theory, and each of these motivations can give rise to a different formal presentation of the type theory. We use soundness and completeness results to show that these different systems really are just different views of the same underlying type theory.

We have described what we called the semantic presentation in Section 1.1. We can give an explanation of the judgements and rules of inference in this system in a way that justifies our belief in the correctness of the system. This presentation includes substitution or cut rules, judgemental equality and a judgement for valid contexts.

Unfortunately, the semantic presentation is very inconvenient to reason about, although it is the system we want to reason in. We have used typed operational semantics as the formal system to reason about, transferring the results about the typed operational semantics to the semantic presentation by soundness and completeness results. The typed operational semantics is a convenient system for metatheoretic study because it has a close correspondence between judgements and derivations.

Our interest in using type theory as a formalism implementable on the computer leads to another presentation of the system. For this purpose we want to use the minimal amount of computation necessary to determine whether a term is well-typed. Huet’s constructive engine [40] is an excellent choice of presentation from this perspective for the Calculus of Constructions, and van Bentham Jutting, McKinna and Pollack [80] explore this problem for Pure Type Systems, a general class of type theories. Furthermore, the user should be able to give the minimal information necessary in the most convenient form, which leads to implicit arguments and type synthesis, universe polymorphism, closure under α-equivalence and other such features.

Because there are many ways of viewing a type theory, it is not clear exactly what we mean when we speak of a particular type theory. There are several syntactic ways in which we can vary the presentation of a type theory while still considering the type theory to be essentially the same:

• A simple way in which we can present a type theory in different ways is to have different judgement forms. For example, the system with both a valid context judgement and a typing judgement for terms can be shown equivalent with the system with a single typing judgement for terms.

• There can be presentations of the theory which are equivalent at the level of judgements but not at the level of derivations. For example, because the cut rule is admissible in many minimal presentations of type theories, adding this rule will not change the derivable judgements but will change the derivations.

• The syntax of terms can vary between presentations while we still might maintain some notion of the equivalence of the systems. One example of this is the presentation of calculi with named variables or with de Bruijn indices, where we introduce a syntax which is less convenient for the use of the theory but is considerably easier to reason about.

A second example is the syntax of application and abstraction. Certainly the representation using polymorphic application and abstraction with a type label for the domain is the intended syntax, because it is most convenient for using type theory. However, as Streicher [75] notes, using a polymorphic application in systems which fail to have the Church–Rosser property introduces significant problems, and it is unlikely that the systems with and without explicit type labels on applications are equivalent in the sense which we intend.

It is not a new idea that different presentations of a theory emphasize different aspects of the theory. However, the study of syntax is fundamental to our understanding of type theory, and small changes to the syntax can significantly alter the behavior of a system. In the remainder of this section we shall discuss some variations in syntax and how these variations affect the metatheory for the type theories.

4.1.2 Reduction and Equality

One fundamental property for a type theory is the Church–Rosser property, which essentially says that equal terms have a common reduct. However, the name “Church–Rosser” has come to represent two different but related theorems in type theory, each associated with a different perspective on the relative importance of the notions of reduction and equality. These differing perspectives affect the presentation of the type theory because of the principle of replacing a type by an equal one: in each system we can say that if a term has a certain type, and another type is equal to that type, then the term has the second type.

The first view, influential in Barendregt’s presentation of Pure Type Systems [8], is that reduction is simply a relation on untyped terms. Conversion is then defined to be the least equivalence relation containing reduction, and there is one rule incorporating the conversion, which works on untyped terms, into the type theory. In this setting the Church–Rosser property is viewed as a property of the untyped reduction, by analogy with the untyped lambda calculus, so we say that if a term has two reducts then those two reducts themselves have a common reduct. This property is also called the “diamond property,” because of the diagrammatic representation of the theorem with reduction depicted as arrows, and the property can be formulated as a property for arbitrary relations rather than only reduction.

Investigations of metatheoretic properties for systems with conversion also require the subject reduction property, which says that if a term is well typed then any reduct of that term has the same type. Indeed, the properties of Church– Rosser and subject reduction will be necessary in the construction of almost any interesting model for systems with conversion. This is because proofs of conversion may involve terms which are not well-typed, because the proofs can be from expansions as well as reductions. In showing the correctness of a model construction, we need to know that the interpretation respects conversion for types, and it is possible that the interpretation may only be defined for well-typed terms and types. The argument for correctness, using the Church–Rosser and subject reduction properties, is as follows: suppose that these two properties hold, and that A and B are convertible types. Then by Church–Rosser we know that there is a common reduct for A and B, and by subject reduction we know that each type in these reduction sequences is well-typed. Thus all we need to show is that the interpretation respects reduction for types.

The other view is that equality between terms and types is central to the type theory, leading to a separate judgement form to express this equality. In presentations with judgemental equality, the rules of inference for equality and well-typedness are defined simultaneously, and a proof of equality will involve only well-typed terms or types between the two equal objects. In this presentation reduction is defined by analogy with the rules of inference which define the equality, and the Church–Rosser property is expressed by saying that if we can judge that two objects are equal then those two objects have a common reduct. Again, in this style of presentation reduction is not used in the actual type theory but is instead an auxiliary notion.

We shall follow the presentation with judgemental equality largely for practical reasons. It seems to be easier to use these systems to construct models for all but the simplest type theories. The important distinction between conversion and judgemental equality is that with judgemental equality we always know that a proof of equality involves only well-typed terms or types between the two equal objects. Because reduction is not a fundamental notion in the presentation of the system, it is not necessary to know any properties of reduction, such as Church– Rosser and subject reduction, in order to construct models. The untyped reduction is only an auxiliary notion which we consider for practical reasons. The main role of the subject reduction property will now be to explain the relationship between the untyped reduction and judgemental equality, and the relationship between systems with conversion and systems with judgemental equality.

As a consequence of our choice of presentation, we shall mean by the Church– Rosser property what we called the Church–Rosser property for systems with judgemental equality, that if two terms are judgementally equal then they have a common reduct. By the diamond property we shall mean that if a term reduces to two terms then those two terms have a common reduct. Each of these properties is of course sensitive to the definition of reduction: for example, it could be the case that a one-step reduction does not have the diamond property but its transitive closure does.

The decision between systems presented with conversion or judgemental equality in general has important consequences for the development of the metatheory of type theories. For β-equality this has been less evident, because we can give syntactic proofs of the diamond property for β-reduction. The proof essentially follows the proof for the untyped lambda calculus, where we consider a parallel one-step reduction which we can show to have the diamond property, and the transitive closure of the one-step reduction is equivalent to the full reduction. The subject reduction property can also be shown relatively straightforwardly for the system with only β-conversion. As a consequence, models can be constructed for these systems without any real difficulty, using the two important syntactic results.

However, the diamond property is not true for untyped βη-reduction on the usual term structure used for type theories, as we have already discussed in Section 2.3.3. This problem is more difficult in the context of type theories with dependent types, because for the same counterexample [x:A]([y:B]M)(x), even if the two labels A and B are judgementally equal it could take an arbitrary number of reduction steps to find a common reduct for them.

The difficulties with βη-equality are important in our understanding of type theory. Although the role of η-equalities is not clear in systems considered as logics, such as the Calculus of Constructions, in the Logical Framework not having (η) as an equality influences the object logic: some propositions which we expect to be true in object logics are unprovable. We discussed this problem briefly in Section 3.3.2.

More generally, the failure of the diamond property for βη-reduction reinforces the belief that judgemental equality is preferable for the semantic presentation of type theories. If we are viewing the type theory as expressing a logical system then we should be more concerned with the well-typedness of terms than with their computational behavior. As we have discussed above, other presentations of the type theory may well use the notion of reduction instead of judgemental equality, for example the presentation which we use for the implementation of the type theory.

From the perspective of the metatheory of type theories, we shall see that using judgemental equality for the system with βη-equality leads to an elegant proof of the soundness of the typed operational semantics for UTT. As we have mentioned, the proof will not rely on the syntactic properties Church–Rosser and subject reduction being established beforehand. This is in contrast to Geuver’s proof of Church–Rosser, subject reduction and strong normalization for the Calculus of Constructions with βη-conversion [30], which involves a complicated dependency between these syntactic results, for different reduction relations.

4.1.3 Syntax for Inductive Types

As we have mentioned in the introduction, there is a long-standing interest in the presentation of inductive types in type theory. We shall give here an outline of some of the more influential presentations and discuss the advantages and disadvantages of the different systems from the perspective of the metatheory.

The computational aspect of inductive types in type theory has been understood for a long time. Gödel’s System T [34] is a type theory with computation over the natural numbers. Martin-Löf’s well-ordering type [50] captures many inductive types in an elegant way. Böhm and Berarducci [11] formulate inductive datatypes using encodings in type theories with impredicativity.

The problem has been to give a formulation which includes not only the computation rules but also an adequate induction principle. An early presentation of inductive types is Martin-Löf’s well-ordering or W -type [50,54]. The idea behind this type is that inductive types are well-ordered sets, and given enough basic types many interesting inductive types can be defined as well-orderings over the basic types. If we also include the internal equality type which reflects judgemental equality then this system is sufficiently powerful to provide a good basis for constructive mathematics, including as it does adequate representations of the important logical connectives, natural numbers, and a wide class of other inductive types.

Unfortunately, type-checking in the extensional theory is undecidable, which means that the theory fails to meet the criterion that we should be able to recognize proofs, where by proofs we mean proof objects rather than derivations. This is also a problem in computer science applications, since we would like the computational equality to be decidable. Another serious problem is that if an empty type and a universe are included then the type theory is no longer strongly normalizing. These problems are discussed in Nördstrom, Petersson and Smith’s book [63].

Goguen and Luo [35] study the W -type in a system with added η-rules or filling-up rules. We can choose to have an extensional equality for particular types by adding these rules, which correspond to uniqueness conditions, only for those types. The filling-up rules are weaker than full extensionality, and therefore they are slightly more flexible than the extensional equality type, However, the essential problems remain for the empty type, and the problems with the filling-up rules seem to be similar to those with the extensional equality type.

Another proposal was to add fixed point operators to the type theory. Early papers [60,24] used the subset type, a significant addition to type theory. Coquand and Paulin-Mohring [19] introduce two different presentations of inductive types. One of these presentations requires the η-rules in order to derive the induction principles and so has the problems we have discussed above. The other is similar to the earlier proposals but avoids the need for the subset type.

UTT uses a mechanism for inductive types similar to the proposal of Coquand and Paulin-Mohring [19], which uses the existing Π-type in the type theory to define a general class of strictly positive schemas. However, one important difference between their system and UTT is that UTT is presented in the Logical Framework. This allows us to use the η-equality for the Π-type in the Logical Framework to gain an adequate induction principle for all of the encoded inductive types. In contrast, Coquand and Paulin-Mohring rely on η-equality for the Π-type of the type theory being defined, which then changes our understanding of the type theory.

Dybjer [25] introduces a similar schematic method of introducing inductive types, based on a scheme introduced by Backhouse [6]. This schema also includes inductive families of types and simultaneous induction.

Coquand [16] formulates a system with inductive types and pattern matching. The pattern matching mechanism is similar to that of functional programming languages such as SML, but it is generalized to dependent types so pattern matching can be done on proofs. This system seems to offer an excellent environment for readable proofs, and the mechanism is implemented on an experimental basis in the ALF system mentioned in the introduction.

4.1.4 Metatheory for Inductive Types

There are several problems to consider in our understanding of the type theory once we have a formulation of the syntax which adequately represents inductive types.

The interaction between inductive types and universes leads to a system which is proof-theoretically very strong. Giving a hierarchical explanation of the type theory, in other words explaining how each type is built from types which are simpler according to some measure, is consequently more difficult. The measures for understanding the hierarchy of types in less powerful systems, for example natural number measures for the Calculus of Constructions or for ECC, no longer apply in systems with inductive types. We construct a complexity measure for types which gives a hierarchical understanding of the type theory in Appendix A.

Syntactically, many representations of inductive types use monomorphic constructors, as we have described in Section 3.3. This will mean that we will have some form of label on both the introduction and elimination constants, and we need to consider whether the reduction relation requires the labels to be syntactically identical or not. This is also a problem in defining the impredicative universe when we formulate the type theory in the Logical Framework. We discuss our solution to this problem in Section 4.7.2.

A further complication is introduced by the more general induction principles associated with inductive types. The Calculus of Constructions as formulated by Coquand and Huet does not have a general induction principle over impredicative quantification: the only elimination principle is the non-dependent application, corresponding to recursion rather than induction. Such induction principles have already been considered in the early proofs of normalization by Martin-Löf[52,53].

4.2 Definitions for the Logical Framework

In Section 3.2 we said that the Logical Framework is an open theory and that we can add new constants to extend the type theory being defined in the framework. In order to study the type theory metatheoretically, however, we need to fix it as a particular theory. In this section we make the relevant definitions to be able to reason about the Logical Framework and the type theory UTT.

In Chapter 3 we referred to objects which are well-typed as terms or kinds, but in studying the metatheory we are also interested in the underlying syntactic objects. We introduce the syntactic objects of the Logical Framework inductively, the terms and kinds, and we shall explicitly mention when we require them to be well-typed.

Definition 4.2.1 (Terms and Kinds) We have several basic constructors for terms and kinds in the Logical Framework:

• Let V be an infinite collection of names. Then there is a variable for each element of V.

• If x ∈ V, A is a kind and M is a term then abstraction, [x:A]M, is a term.

• If M and N are terms then application, M(N), is a term.

Chapter 4. Basic Metatheory for UTT 96 • Type is a kind.

• If M is a term then El(M) is a kind.

• If x ∈ V and A and B are kinds then the Π-kind, (x:A)B, is a kind.

• The constants introduced in Chapter 3, Sections 3.4 and 3.5, are terms.

• If Θ̄ ≡ Θ_{1}, …, Θ_{n} is a sequence of kinds then κ^{X}[Θ̄] is a term, for κ ∈

{M, ι_{i}, E, μ}, where 1 ≤ i ≤ n. Definition 4.2.2 (Syntactic Equivalence) Two terms are syntactically equivalent, M ≡ N, if they are equal up to renaming of bound variables.

We identify terms which are syntactically equivalent. Definition 4.2.3 (Free Variables) The free variables of a term M, FV(M), are defined as usual to be the variables which are not in the scope of a binder. Definition 4.2.4 (Contexts) Let Γ ≡ x_{1}:A_{1}, …, x_{n}:A_{n} be a pre-context.

We define the domain of Γ, notation dom(Γ), as {x_{1}, …, x_{n}}. The free variables of Γ, notation FV(Γ), are defined as

FV(Γ) =_{df} dom(Γ) ∪ ⋃_{1≤i≤n} FV(A_{i})

Γ is a context if the x_{i} are distinct and FV(A_{i}) ⊆ {x_{1}, …, x_{i−1}} for 1 ≤ i ≤ n. We say that x is fresh in Γ if x ∉ dom(Γ).

Definition 4.2.5 (Pre-Schema Families) Let X be a variable.

• We say that a kind Φ is a pre-positive operator with respect to X, notation

PPos_{X}(Φ), if – Φ ≡ X or

– Φ ≡ (x:A)Φ_{0}, where A is a small kind and PPos_{X}(Φ_{0}).

• We say that a kind Θ is a pre-inductive schema with respect to X, notation PSch_{X}(Θ), if

– Θ ≡ X,

– Θ ≡ (x:A)Θ_{0}, where A is a small kind and PSch_{X}(Θ_{0}), or

– Θ ≡ (Φ)Θ_{0}, where PPos_{X}(Φ) and PSch_{X}(Θ_{0}).

• We say that a finite sequence of kinds Θ_{1}, …, Θ_{n} is a pre-schema family with respect to X, notation PSch_{X}(Θ_{1}, …, Θ_{n}), if PSch_{X}(Θ_{i}) for 1 ≤ i ≤ n.

A strictly positive operator Φ in Γ with respect to X is a pre-positive operator P hi with respect to X such that Γ, X:Type ⊢ Φ kind, and similarly for inductive schemas and schema families.

4.3 An Alternative Induction on Terms

We use an alternative induction principle on terms and kinds in order to ensure that we have the correct premisses for constants. The idea is that we want to know the inductive hypothesis for the argument kinds for constants which have functional kinds. Also, for constants which will be types, we need information about the kinds for the constructors for those types: for example, for the type El(Prf(∀(A, P))), whose interpretation will be defined in the definition for ∀, we need to know that the inductive hypothesis is valid for the kind (x:El(A))El(Prf(P (x))), which is an argument kind for the constructor Λ.

Specifically, if P is a predicate on terms and Q is a predicate on kinds, then the following will be several of the clauses for the induction principle:

• if Q holds for Type and P holds for M then Q holds for El(M).

• if Q holds for (Prop)Type then P holds for Prf.

• if Q holds for (A:Type)((A)Prop)Prop and Q holds for (x:A)Prf(P (x)) then P holds for ∀.

• if Q holds for the kind of E^{X}[Θ̄], P holds for M^{X}[Θ̄], P holds for ι_{i}^{X}[Θ̄] and P holds for Φ_{i_{j}}^{♮}[A, C, f, z], where A, C, f and z are variables and i_{j} ranges over the i for the strictly positive operators, then P holds for E^{X}[Θ̄].

Given that these clauses and those for the other constants hold then P holds for all terms and Q holds for all kinds. We can show the soundness of this induction principle simply by using the usual induction principle and the proofs which we are given for the basic constructors. A simple way of verifying that this principle is sound is to notice that the kind for each constant only depends on constants defined before it.

4.4 UTT ^{−}

The rules of inference we have introduced for UTT are not the most convenient to reason about, because the substitution rules which we have included in UTT are admissible in the theory without them. We therefore introduce another calculus, UTT^{−}, whose judgements are the same as UTT but which does not include the substitution rules: specifically, we do not include the rules in the table for substitution rules on page 68. We indicate that the judgement has been derived in UTT^{−} by writing ⊢^{−} instead of ⊢. We shall use UTT^{−} to construct a set-theoretic model of the calculus.

We shall assume for the systems UTT and UTT^{−} that in each of the rules for constants, there is a subderivation of the type of the constant. Furthermore, in the rule (Θ̄-Eq), we shall assume that each Φ^{♮}[A, C, f, z] is well-typed. It is clear that this in no way changes the derivable judgements, because the new rules are derivable from the existing ones, so the equivalence of the systems is trivial.

The relationship between UTT^{−} and UTT in one direction is easy to establish:

Lemma 4.4.1 (Completeness of UTT ^{−} for UTT) If Γ ⊢^{−} J then Γ ⊢ J.

Proof By induction on derivations of UTT^{−}. Each rule of inference in UTT^{−} is also a rule of inference in UTT. □

For the other direction, we shall rely on the soundness of UTT^{S} for UTT and completeness of UTT^{S} for UTT^{−}.

A better approach to organizing our proof might be to prove the soundness and completeness of the categorical model of UTTfirst, which is a more abstract presentation of the calculus. Constructing the set-theoretic model and the normalization proof via this intermediate semantics might be easier than constructing the models directly.

4.5 Metatheory for UTT

We shall need some simple lemmas to construct the normalization proof and the set-theoretic model.

Definition 4.5.1 (Subderivation) For any two derivations J_{1} and J_{2}, J_{1} is a subderivation of J_{2} if J_{1} occurs as a subtree of J_{2}.

Lemma 4.5.2 (Context Validity for UTT) Any derivation of Γ_{0}, Γ_{1} ⊢ J has a subderivation of ⊢Γ_{0}, if Γ_{0}, Γ_{1} ⊢ J is not ⊢Γ_{0}.

Proof By induction on derivations in UTT. □

The notation for the above lemma may be confusing. We note that the notation Γ ⊢ J can represent any of the judgements of UTT, including ⊢Γ.

Lemma 4.5.3 (Contexts for UTT) If Γ ⊢ J then Γ is a context. Furthermore:

• If Γ ⊢ A kind then FV(A) ⊆ dom(Γ).

• If Γ ⊢ M : A then FV(M) ∪ FV(A) ⊆ dom(Γ).

• If Γ ⊢ A = B then FV(A) ∪ FV(B) ⊆ dom(Γ).

• If Γ ⊢ M = N : A then FV(M) ∪ FV(N) ∪ FV(A) ⊆ dom(Γ).

Proof By induction on derivations, using Context Validity for UTT and the fact that ⊢Γ, x:A implies that Γ ⊢ A kind for (Π) and (λ). □

These lemmas also follow for UTT^{−}.

4.6 Environments

Environments are simply assignments of values for a set of variables. We introduce the definition in order to fix notation.

Definition 4.6.1 (Environment) An environment for S and Γ, where S is a set and Γ is a finite set of variables, is a function from Γ to S.

Notation If ρ is an environment for S and Γ, x ∉ Γ and v ∈ S then we write ρ[x := v] for the environment ρ′ such that:

ρ′(y) =_{df} \begin{cases}ρ(y) & if y ≠ x \\ v & if y = x \end{cases}

4.7 Definitions for the Metatheory

In this section we give the basic definitions we shall need for the metatheoretic development of UTT.

4.7.1 Reduction and Normal Forms

We first introduce several notions for terms which will be important in the presentation of UTT^{S}.

Definition 4.7.1 (Compatible Closure) Let R be a relation on terms. Then the compatible closure of R, notation M ▷_{R} N, is the least relation satisfying the following rules:

(R-Inc)  \frac{MRN}{M ▷_{R} N}

(Π-L) \frac{A_{1} ▷_{R} B_{1}}{(x:A_{1})A_{2} ▷_{R} (x:B_{1})A_{2}} (Π-R) \frac{A_{2} ▷_{R} B_{2}}{(x:A_{1})A_{2} ▷_{R} (x:A_{1})B_{2}}

(λ-L) \frac{A_{1} ▷_{R} B_{1}}{[x:A_{1}]M_{0} ▷_{R} [x:B_{1}]M_{0}} (ξ) \frac{M_{0} ▷_{R} N_{0}}{[x:A_{1}]M_{0} ▷_{R} [x:A_{1}]N_{0}}

(App-L) \frac{M_{1} ▷_{R} N_{1}}{M_{1}(M_{2}) ▷_{R} N_{1}(M_{2})} (App-R) \frac{M_{2} ▷_{R} N_{2}}{M_{1}(M_{2}) ▷_{R} M_{1}(N_{2})}

(El)  \frac{M ▷_{R} N}{El(M) ▷_{R} El(N)}

Definition 4.7.2 (Untyped Reduction) We introduce the following one-step reduction relations:

(β)  ([x:A_{1}]M_{0})(M_{2}) β [M_{2}/x]M_{0}
(η) [x:A]M(x) η M x ∉ FV(M)
(E_{∀})  E_{∀}(A, P, R, f, Λ(A′, P′, g)) o f(g)
(E^{X}[Θ̄]) E^{X}[Θ̄](C, f̄, ι_{i}^{X}[Θ̄′](ā)) o f_{i}(ā,
Φ_{i_{1}}^{♮}[M^{X}[Θ̄], C, E^{X}[Θ̄](C, f̄), a_{i_{1}}],
…,
Φ_{i_{k}}^{♮}[M^{X}[Θ̄], C, E^{X}[Θ̄](C, f̄), a_{i_{k}}])
(prop)  T(prop) o Prop
(prf)  T(prf(P)) o Prf(P)
(μ^{X}[Θ̄])  T(μ^{X}[Θ̄]) o M^{X}[Θ̄]

Let untyped reduction, M ▷ N, be the compatible closure of all of the above rules. Let object-level reduction be the relation ▷_{o}.

A term M is a redex if there is an N such that MβηoN.

We do not require labels to be identical in the rules for E_{∀} and E^{X}[Θ̄] in the above reduction: for example, in the rule E_{∀} the terms A and A′ are distinct, although we shall know that if the whole term is well-typed then A and A′ are judgementally equal. From the point of view of implementations this is clearly the preferable definition of reduction, because we do not want to have to consider equivalence of labels. We discuss the two possible choices, either requiring the labels to be identical or allowing them to be different, further in Section 4.7.2.

Definition 4.7.3 We write M ▷^{+} N for the transitive closure of reduction and M ▷^{∗} N for the reflexive, transitive closure of reduction.

Lemma 4.7.4 (Substitution for Reduction) If M_{1} ▷ N_{1} and M_{2} ▷ N_{2} then [M_{2}/x]M_{1} ▷^{∗} [N_{2}/x]N_{1}.

Proof We show that if M_{1} ▷ N_{1} then [M_{2}/x]M_{1} ▷ [M_{2}/x]N_{1} by induction on the proof of M_{1} ▷ N_{1}, and that if M_{2} ▷ N_{2} then [M_{2}/x]M_{1} ▷^{∗} [N_{2}/x]M_{1} by induction on the structure of M_{1}. □

Definition 4.7.5 (Strongly Normalizing) A term is strongly normalizing if all reduction sequences starting from that term terminate.

Definition 4.7.6 (Pre-redex) We say that a term M is a full pre-redex if M is an abstraction or of the forms E_{∀}(A, P, R, f), E^{X}[Θ̄](C, f̄) or T.

If M is a full pre-redex and M is not an abstraction then we say that M is an object-level full pre-redex.

A term which is a full pre-redex or a subterm E_{∀}, E_{∀}(A), E_{∀}(A, P) and so on is a pre-redex.

Definition 4.7.7 (Base Term) We define the notion of base term inductively by the following rules:

• Variables are base terms.

Chapter 4. Basic Metatheory for UTT 103 • If M_{1} is a base term then M_{1}(M_{2}) is a base term.

• If M_{2} is a base term and M_{1} is an object-level full pre-redex then M_{1}(M_{2}) is a base term.

The base terms are terms where a variable is in the position of an introductory term, that is an abstraction or a canonical object in the type theory. Definition 4.7.8 (Weak Head Normal) A term M is weak head normal if it is a base term or a pre-redex. Definition 4.7.9 (Normal Form) A term M or kind A is normal or in normal form if

• M is a variable,

• A ≡ (x:A_{1})A_{2} and A_{1} and A_{2} are normal,

• M ≡ [x:A_{1}]M_{0}, A_{1} is normal and M_{0} is normal and not of the form N(x) with x ∉ FV(N),

• M ≡ M_{1}(M_{2}), M_{1} and M_{2} are normal and M_{1}(M_{2}) is not a redex,

• A ≡ Type,

• A ≡ El(M) and M is normal,

• M is a constant, or

• M ≡ κ^{X}[Θ̄], where Θ_{i} is normal for 1 ≤ i ≤ n. Lemma 4.7.10 If M is normal then M has no reductions. Proof By induction on terms in normal form. □

The following facts about terms are easy to establish:

Lemma 4.7.11

• If M_{1}(M_{2}) is weak head normal and M_{1} and M_{2} are normal then M_{1}(M_{2}) is normal.

• If M is weak head normal and M ▷^{∗} N then N is weak head normal.

Proof Straightforward. □

4.7.2 Labels and Untyped Reduction

In Definition 4.7.2, we defined an untyped reduction relation which allowed the labels of the constants to be different in the rules for E_{∀}-reduction and E^{X}[Θ̄]- reduction. There is another formulation of untyped reduction, which Altenkirch [4] calls “tight” reduction in contrast to the reduction which ignores labels called “loose” reduction, that requires the labels for the introduction and elimination constants to be the same. This is closer to the presentation of equalities in UTT: the rule of tight reduction for E_{∀} is

E_{∀}(A, P, R, f, Λ(A, P, g)) ▷ f(g)

and similarly for E^{X}[Θ̄]. In systems like this with non-left linear reductions, we cannot prove the diamond property simply by induction on possible reductions: we can only prove the weak diamond property, that if a term has two single-step reducts then those two reducts have a common multi-step reduct. For example, suppose that we take the definition of reduction above for E_{∀}, and suppose E_{∀}(A, P, R, f, Λ(A, P, g)) ▷ f(g) and E_{∀}(A, P, R, f, Λ(A, P, g)) ▷ E_{∀}(A, P, R, f, Λ(A′, P, g)). We then need two reduction steps to reach the common reduct f(g),

E_{∀}(A, P, R, f, Λ(A′, P, g)) ▷ E_{∀}(A′, P, R, f, Λ(A′, P, g)) ▷ f(g)

One reason for considering tight reduction is that it is easier to show the property of subject reduction, which says that if Γ ⊢ M : A and M ▷ N then Γ ⊢ N : A, where ⊢ represents judgements for some type theory. For example, Salvesen [70] shows that certain Pure Type Systems with βη-equality have the properties of Church–Rosser and closure using terms with labeled application and a tight reduction, relying on strong normalization. In our formulation we can prove the properties of subject reduction and Church–Rosser for well-typed terms for either notion of reduction by induction on derivations in UTT^{S}. We choose to do the development for loose reduction because it is easier to use practically: we do not need to look at labels at all in untyped reduction.

4.7.3 Pre-Substitutions

Definition 4.7.12 (Pre-Substitution) We define a pre-substitution to be an environment for terms.

Notation

• We write δ̂(M) for the result of simultaneously substituting the values for the variables in the domain of δ:

δ̂(M) =_{df} [δ(x_{1}), …, δ(x_{n})/x_{1}, …, x_{n}]M

• If Δ has all components of Γ then we write weak_{Γ}^{Δ} for the substitution weak_{Γ}^{Δ}(x) = x from Δ to Γ.

• id_{Γ} =_{df} weak_{Γ}^{Γ}.

Lemma 4.7.13

• [N/x]M ≡ { \atop id_{FV(M)−\{x\}}[x := N]}(M).

• { \atop δ ∘ ϕ[x := N]}(M) ≡ { \atop δ ∘ ϕ[x := δ̂(N)]}(M).

• ϕ̂(δ̂(M)) ≡ ϕ̂ ∘ δ(M).

Lemma 4.7.14 Suppose δ is a pre-substitution such that δ(X) ≡ Y. Then:

Chapter 4. Basic Metatheory for UTT 106 • If PPos_{X}(Φ) then PPos_{Y} (δ̂(Φ)), and similarly for PSch_{X}(Θ) and PSch_{X}(Θ̄).

• If PPos_{X}(Φ) then

δ̂(Φ^{∘}[A, C, z]) ≡ (δ̂(Φ))^{∘}[δ̂(A), δ̂(C), δ̂(z)]

and similarly for PSch_{X}(Θ) and PSch_{X}(Θ̄).

• If PPos_{X}(Φ) then

δ̂(Φ^{♮}[A, C, f, z]) ≡ (δ̂(Φ))^{♮}[δ̂(A), δ̂(C), δ̂(f), δ̂(z)]

Proof By induction on the proofs that PPos_{X}(Φ), PSch_{X}(Θ) or PSch_{X}(Θ̄). □

4.8 UTT^{S}

: A Typed Operational Semantics for UTT

We now introduce UTT^{S}, the typed operational semantics for UTT. We have already discussed the motivations behind this idea in Section 1.3 and Chapter 2.

4.8.1 Judgements and Derivations

The judgement forms for UTT^{S} and their intuitive meanings will be: • ⊢^{S}Γ, meaning that Γ is a valid sequence of assumptions,

• Γ ⊢^{S} A →^{nf} B, meaning that the kind A has normal form B which is a valid kind in Γ,

• Γ ⊢^{S} M →^{nf} P : A, meaning that M has normal form P which is a canonical form in the kind A in context Γ, and Chapter 4. Basic Metatheory for UTT 107

• Γ ⊢^{S} M →^{wh} N : A, meaning that M has an outermost reduct which when contracted yields N, and both M and N are elements of kind A in context Γ.

We shall use the following abbreviations:

• Γ ⊢^{S} M : B if Γ ⊢^{S} M →^{nf} P : B for some P,

• Γ ⊢^{S} A kind if Γ ⊢^{S} A →^{nf} B for some B,

• Γ ⊢^{S} M ↓ N [P] : B if Γ ⊢^{S} M →^{nf} P : B and Γ ⊢^{S} N →^{nf} P : B,

• Γ ⊢^{S} A ↓ B [C] if Γ ⊢^{S} A →^{nf} C and Γ ⊢^{S} B →^{nf} C,

• Sch_{Γ;X}^{S}(Θ̄) if ⊢^{S}Γ, PSch_{X}(Θ̄) and Γ, X:Type ⊢^{S} Θ_{i} →^{nf} Θ′_{i} for 1 ≤ i ≤ n and

• Γ ⊢^{S} Θ̄ ↓ Θ̄′ [Θ̄′′] if ⊢^{S}Γ, PSch_{X}(Θ̄), PSch_{X}(Θ̄′) and Γ, X:Type ⊢^{S} Θ_{i} ↓ Θ′_{i} [Θ′′_{i}] for 1 ≤ i ≤ n and

UTT^{S} is defined to be the least relations defined by the rules of inference in Figures 4–1 to 4–4.

(S-Emp) \overline{⊢^{S}()} (S-Weak) \frac{Γ ⊢^{S} A →^{nf} B x ∉ dom(Γ)}{⊢^{S}Γ, x:A}

Figure 4–1: Contexts

4.8.2 Discussion

We have already discussed the motivation for typed operational semantics in the context of the simply typed lambda calculus in Section 2.1.3. The ideas underlying

(S-Var) \frac{Γ_{0}, x:A, Γ_{1} ⊢^{S} A →^{nf} B}{Γ_{0}, x:A, Γ_{1} ⊢^{S} x →^{nf} x : B}  (S-Π) \frac{\begin{matrix}Γ ⊢^{S} A_{1} →^{nf} B_{1} \\ Γ, x:A_{1} ⊢^{S} A_{2} →^{nf} B_{2} \end{matrix}}{Γ ⊢^{S} (x:A_{1})A_{2} →^{nf} (x:B_{1})B_{2}}

(S-λ)  \frac{\begin{matrix}Γ ⊢^{S} A_{1} →^{nf} B_{1} \\ Γ, x:A_{1} ⊢^{S} M_{0} →^{nf} N_{0} : B_{2} \end{matrix}}{Γ ⊢^{S} [x:A_{1}]M_{0} →^{nf} [x:B_{1}]N_{0} : (x:B_{1})B_{2}}  N_{0} ≢ N(x) with x ∉ FV(N)

(S-η)  \frac{Γ ⊢^{S} A_{1} →^{nf} B_{1} Γ, x:A_{1} ⊢^{S} M_{0} →^{nf} N(x) : B_{2} Γ ⊢^{S} N →^{nf} P : (x:B_{1})B_{2}}{Γ ⊢^{S} [x:A_{1}]M_{0} →^{nf} P : (x:B_{1})B_{2}}

(S-App) \frac{Γ ⊢^{S} M_{1} →^{nf} N_{1} : (x:B_{1})B_{2} Γ ⊢^{S} M_{2} →^{nf} N_{2} : B_{1} Γ ⊢^{S} [M_{2}/x]B_{2} →^{nf} C}{Γ ⊢^{S} M_{1}(M_{2}) →^{nf} N_{1}(N_{2}) : C} M_{1}(M_{2}) weak head normal

(S-Type) \frac{⊢^{S}Γ}{Γ ⊢^{S} Type →^{nf} Type}  (S-El) \frac{Γ ⊢^{S} M →^{nf} N : Type}{Γ ⊢^{S} El(M) →^{nf} El(N)}

(S-C)  \frac{⊢^{S}Γ}{Γ ⊢^{S} c →^{nf} c : A}  c a constant of type A

(S-WH)  \frac{Γ ⊢^{S} M →^{wh} N : B Γ ⊢^{S} N →^{nf} P : B}{Γ ⊢^{S} M →^{nf} P : B}

Figure 4–2: Canonical Forms

(S-M)  \frac{Sch_{Γ;X}^{S}(Θ̄)}{Γ ⊢^{S} M^{X}[Θ̄] →^{nf} M^{X}[Θ̄′] : Type}

(S-ι) \frac{Sch_{Γ;X}^{S}(Θ̄)}{Γ ⊢^{S} ι_{i}^{X}[Θ̄] →^{nf} ι_{i}^{X}[Θ̄′] : Θ′_{i}(M^{X}[Θ̄′])} 1 ≤ i ≤ n

(S-E) \frac{Sch_{Γ;X}^{S}(Θ̄)}{Γ ⊢^{S} E^{X}[Θ̄]→^{wh} E^{X}[Θ̄′] : (C:(M^{X}[Θ̄′])Type) (f_{1}:(Θ′_{1})^{∘}[M^{X}[Θ̄′], C, ι_{1}^{X}[Θ̄′]]) … (f_{n}:(Θ′_{n})^{∘}[M^{X}[Θ̄′], C, ι_{n}^{X}[Θ̄′]])(z:M^{X}[Θ̄′])C(z)}

(S-μ) \frac{Γ ⊢^{S} Θ̄ ↓ Θ̄′ [Θ̄′′]}{Γ ⊢^{S} μ^{X}[Θ̄] →^{nf} μ^{X}[Θ̄′′] : Type} (Γ′, A) ∈ Types_{Γ}(Θ̄′) implies A ≡ T(a)

Figure 4–3: Canonical Forms–Schemas

(W-β)  \frac{Γ ⊢^{S} [x:A_{1}]M_{0} : (x:B_{1})B_{2} Γ ⊢^{S} M_{2} : B_{1} Γ ⊢^{S} [M_{2}/x]B_{2} →^{nf} C}{Γ ⊢^{S} ([x:A_{1}]M_{0})(M_{2}) →^{wh} [M_{2}/x]M_{0} : C}

(W-E_{∀})  \frac{Γ ⊢^{S} E_{∀}(A_{1}, P_{1}, R, f) →^{nf} E_{∀}(A_{3}, P_{3}, R′, f′) : (M:Prf(∀(A_{3}, P_{3})))S Γ ⊢^{S} Λ(A_{2}, P_{2}, g) →^{nf} Λ(A_{3}, P_{3}, g′) : Prf(∀(A_{3}, P_{3}, g′)) Γ ⊢^{S} Prf(R(Λ(A_{2}, P_{2}, g))) →^{nf} B}{Γ ⊢^{S} E_{∀}(A_{1}, P_{1}, R, f, Λ(A_{2}, P_{2}, g)) →^{wh} f(g) : B}

(W-E^{X}[Θ̄])  \frac{Γ ⊢^{S} E^{X}[Θ̄_{1}](C, f̄) →^{nf} E^{X}[Θ̄_{3}](C′, f̄′) : (M:M^{X}[Θ̄_{3}])D Γ ⊢^{S} ι_{i}^{X}[Θ̄_{2}](ā) →^{nf} ι_{i}^{X}[Θ̄_{3}](ā′) : M^{X}[Θ̄_{3}] Γ ⊢^{S} C(ι_{i}^{X}[Θ̄_{2}](ā)) →^{nf} B}{Γ ⊢^{S} E^{X}[Θ̄_{1}](C, f̄, ι_{i}^{X}[Θ̄_{2}](ā))→^{wh} f_{i}(ā, Φ_{i_{1}}^{♮}[M^{X}[Θ̄_{3}], C, E^{X}[Θ̄_{3}](C, f̄), a_{i_{1}}], …) : B}

(W-prop)  \frac{Γ ⊢^{S} prop : El(U)}{Γ ⊢^{S} T(prop) →^{wh} Prop : Type}

(W-prf)  \frac{Γ ⊢^{S} prf(P) : El(U)}{Γ ⊢^{S} T(prf(P)) →^{wh} Prf(P) : Type}

(W-μ)  \frac{Γ ⊢^{S} μ^{X}[Θ̄] : El(U)}{Γ ⊢^{S} T(μ^{X}[Θ̄]) →^{wh} M^{X}[Θ̄] : Type}

(W-App) \frac{Γ ⊢^{S} M_{1} →^{wh} N_{1} : (x:A_{1})A_{2} Γ ⊢^{S} M_{2} : A_{1} Γ ⊢^{S} [M_{2}/x]A_{2} →^{nf} B}{Γ ⊢^{S} M_{1}(M_{2}) →^{wh} N_{1}(M_{2}) : B}

(W-Obj) \frac{\begin{matrix}Γ ⊢^{S} M_{1} : (x:B_{1})B_{2} \\ Γ ⊢^{S} M_{2} →^{wh} N_{2} : B_{1} \\ Γ ⊢^{S} [M_{2}/x]B_{2} →^{nf} C \end{matrix}}{Γ ⊢^{S} M_{1}(M_{2}) →^{wh} M_{1}(N_{2}) : C} M_{1} a full object-level pre-redex

Figure 4–4: Weak Head Reduction our presentation of a typed operational semantics for UTT are the same as those for the simply typed lambda calculus.

The system UTT^{S} is not simply a reduction relation with added type information. Each of the rules involving application requires the normal forms of the type labels to be identical, which means that we are implicitly using a rule of type equality. However, this use of the normal forms of types means that we do not need the rules (=-T) and (=-R).

This use of normal forms gives us useful information which is not available in UTT because of the judgemental equality. For example, if we have that Γ ⊢^{S} [x:A_{1}]M_{0} : (x:B_{1})B_{2} then we shall know directly that Γ, x:A_{1} ⊢^{S} M_{0} : B_{2} and Γ ⊢^{S} A_{1} →^{nf} B_{1}. This is crucially different from UTT: there we only know that if Γ ⊢ [x:A_{1}]M_{0} : (x:B_{1})B_{2} then there is an A_{2} such that Γ, x:A_{1} ⊢ M_{0} : A_{2} and Γ ⊢ (x:A_{1})A_{2} = (x:B_{1})B_{2}.

Similar to the typed operational semantics for the simply typed lambda calculus, we have weakened some rules of inference in order to formulate an appropriate principle of induction. Using metatheoretic reasoning, we shall again be able to show the admissibility of the more natural η-reduction rule:

(S-η’) \frac{Γ ⊢^{S} A_{1} →^{nf} B_{1} Γ, x:A_{1} ⊢^{S} M →^{nf} N(x) : B_{2}}{Γ ⊢^{S} [x:A_{1}]M_{0} →^{nf} N : (x:B_{1})B_{2}} x ∉ FV(N)

The rule (S-Var) has also been weakened. The premiss contains an implicit use of weakening, and enough information is already contained in the following rule:

(S-Var’) \frac{⊢^{S}Γ_{0}, x:A, Γ_{1} Γ_{0} ⊢^{S} A →^{nf} B}{Γ_{0}, x:A, Γ_{1} ⊢^{S} x →^{nf} x : B}

We can show the admissibility of this rule as well, after establishing weakening for UTT^{S}.

The kinds in some of the premisses for the weak head reduction relation may be misleading. For example, one of the premisses for the rule (W-E_{∀}) is

Γ ⊢^{S} E_{∀}(A_{1}, P_{1}, R, f) →^{nf} E_{∀}(A_{3}, P_{3}, R′, f′) : (M:Prf(∀(A_{3}, P_{3})))S

The information in the kind here is merely indicative: the full kind information is uniquely determined by the context and the term E_{∀}(A_{1}, P_{1}, R, f). We can use our understanding of the structure of derivations to reconstruct the kinds for the terms A_{1}, P_{1}, R and f.

In the rule (S-κ), we have written A^{X}[Θ̄] to mean the appropriate type as given in the rules for inductive types in Section 3.3.2.

4.9 Metatheory for UTT^{S}

In this section, when we use the phrase “induction on derivations” we shall mean derivations in UTT^{S} unless we state otherwise.

4.9.1 Basic Metatheory

Lemma 4.9.1 (Generation) Any judgement which is derivable in UTT^{S} has a uniquely determined last rule of inference.

Proof By induction on derivations. □

As in Section 2.3.2, we have given a simplified statement of the lemma to avoid rewriting each rule of inference. Some particular consequences of this lemma are:

• If ⊢^{S}Γ, x:A then there is a subderivation of Γ ⊢^{S} A →^{nf} B for some B.

• If Γ ⊢^{S} (x:A_{1})A_{2} →^{nf} (x:B_{1})B_{2} then there are subderivations of Γ ⊢^{S} A_{1} →^{nf} B_{1} and Γ, x:A_{1} ⊢^{S} A_{2} →^{nf} B_{2}.

• If Γ ⊢^{S} M_{1}(M_{2}) →^{nf} P : C and M_{1}(M_{2}) is weak head normal then there are P_{1}, P_{2}, B_{1} and B_{2} such that P ≡ P_{1}(P_{2}), Γ ⊢^{S} M_{1} →^{nf} P_{1} : (x:B_{1})B_{2}, Γ ⊢^{S} M_{2} →^{nf} P_{2} : B_{1} and Γ ⊢^{S} [M_{2}/x]B_{2} →^{nf} C.

• If Γ ⊢^{S} M →^{nf} P : B and M is not weak head normal then there is an N such that Γ ⊢^{S} M →^{wh} N : B and Γ ⊢^{S} N →^{nf} P : B.

Chapter 4. Basic Metatheory for UTT 113

• If Γ ⊢^{S} M_{1}(M_{2}) →^{wh} N : B and M_{1} is not weak head normal then there are N_{1}, P_{2}, B_{1} and B_{2} such that N ≡ N_{1}(M_{2}), where Γ ⊢^{S} M_{1} →^{wh} N_{1} : (x:B_{1})B_{2}, Γ ⊢^{S} M_{2} →^{nf} P_{2} : B_{1} and Γ ⊢^{S} [M_{2}/x]B_{2} →^{nf} B.

Lemma 4.9.2 (Uniqueness of Normal Forms)

• If Γ ⊢^{S} M →^{nf} P : B and Γ ⊢^{S} M →^{nf} Q : C then P ≡ Q and B ≡ C.

• If Γ ⊢^{S} A →^{nf} B and Γ ⊢^{S} A →^{nf} C then B ≡ C. Proof By induction on derivations, using Generation in each case for the second derivation. □ Lemma 4.9.3 (Context Validity) Any derivation of Γ_{0}, Γ_{1} ⊢^{S} J has a subderivation of ⊢^{S}Γ_{0}, if Γ_{0}, Γ_{1} ⊢^{S} J is not ⊢^{S}Γ_{0}. Proof By induction on derivations. □

Because we are using complete induction on derivations, we can use Generation or Context Validity in inductive proofs. We shall know by these lemmas that the inductive hypothesis applies for all subderivations. Corollary 4.9.4 (Subderivation) If Γ_{0}, x:A, Γ_{1} ⊢^{S} J then there is a subderivation of Γ_{0} ⊢^{S} A →^{nf} B for some B. Proof By Context Validity there is a subderivation of ⊢^{S}Γ_{0}, x:A. By Generation there is a subderivation of Γ_{0} ⊢^{S} A →^{nf} B for some B. Lemma 4.9.5 (Completeness for UTT ^{−})

• If ⊢^{S}Γ then ⊢^{−}Γ.

• If Γ ⊢^{S} A →^{nf} B then Γ ⊢^{−} A kind and Γ ⊢^{−} A = B.

• If Γ ⊢^{S} M →^{nf} P : A then Γ ⊢^{−} M : A and Γ ⊢^{−} M = P : A.

• If Γ ⊢^{S} M →^{wh} N : A then Γ ⊢^{−} M : A and Γ ⊢^{−} M = N : A.

Proof By induction on derivations. We give several cases:

• (S-Var). By Context Validity we know that there is a subderivation of ⊢^{S}Γ_{0}, x:A, Γ_{1}, so by inductive hypothesis we know both ⊢^{−}Γ_{0}, x:A, Γ_{1} and Γ_{0}, x:A, Γ_{1} ⊢^{−} A = B. Hence Γ_{0}, x:A, Γ_{1} ⊢^{−} x : B by (Var) and (=-T), and Γ_{0}, x:A, Γ_{1} ⊢^{−} x = x : B by (Refl).

• (S-η). By inductive hypothesis we know that

– Γ ⊢^{−} A_{1} kind and Γ ⊢^{−} A_{1} = B_{1},

– Γ, x:A_{1} ⊢^{−} M_{0} : B_{2} and Γ, x:A_{1} ⊢^{−} M_{0} = N(x) : B_{2}, and

– Γ ⊢^{−} N : (x:B_{1})B_{2} and Γ ⊢^{−} N = P : (x:B_{1})B_{2}.

Clearly Γ ⊢^{−} (x:A_{1})B_{2} = (x:B_{1})B_{2}, so Γ ⊢^{−} [x:A_{1}]M_{0} : (x:B_{1})B_{2}. Also Γ ⊢^{−} [x:A_{1}]M_{0} = [x:B_{1}]N(x) : (x:B_{1})B_{2} by (λ-Eq) and Γ ⊢^{−} N = [x:B_{1}]N(x) : (x:B_{1})B_{2} by (η), so Γ ⊢^{−} [x:A_{1}]M_{0} = P : (x:B_{1})B_{2} by (Sym) and (Trans).

• (W-β). By inductive hypothesis

– Γ ⊢^{−} [x:A_{1}]M_{0} : (x:C_{1})C_{2} and Γ ⊢^{−} [x:A_{1}]M_{0} = P : (x:C_{1})C_{2},

– Γ ⊢^{−} M_{2} : C_{1},

– Γ ⊢^{−} [M_{2}/x]C_{2} = C and

– Γ, x:A_{1} ⊢^{−} M_{0} : C_{2} and Γ ⊢^{−} A_{1} = C_{1} by Generation.

Hence Γ ⊢^{−} M_{2} : A_{1} implies that Γ ⊢^{−} ([x:A_{1}]M_{0})(M_{2}) = [M_{2}/x]M_{0} : [M_{2}/x]C_{2} by (β). Also by (λ) Γ ⊢^{−} [x:A_{1}]M_{0} : (x:A_{1})C_{2}, so by (App) Γ ⊢^{−} ([x:A_{1}]M_{0})(M_{2}) : [M_{2}/x]C_{2}. We then apply the equality Γ ⊢^{−} [M_{2}/x]C_{2} = C twice to get the result.

• (W-μ). We know by Generation that there is a subderivation of ⊢^{S}Γ, that there is a Θ′_{i} such that Γ, X:Type ⊢^{S} Θ_{i} ↓ Θ′_{i} [Θ′′_{i}], and that for all (Γ′, A) ∈ Types_{Γ}(Θ′_{i}) there is an a such that A ≡ T(a) for 1 ≤ i ≤ n. Therefore, Γ ⊢^{−} T(μ^{X}[Θ̄]) = μ^{X}[Θ̄] : Type.

□

Lemma 4.9.6 (Contexts) If Γ ⊢^{S} J then Γ is a context. Furthermore:

• If Γ ⊢^{S} A →^{nf} B then FV(A) ⊆ dom(Γ) and FV(B) ⊆ dom(Γ).

• If Γ ⊢^{S} M →^{nf} P : B then FV(M) ⊆ dom(Γ), FV(P) ⊆ dom(Γ) and FV(B) ⊆ dom(Γ).

• If Γ ⊢^{S} M →^{wh} N : B then FV(M) ⊆ dom(Γ) and FV(B) ⊆ dom(Γ).

Proof By induction on derivations. □

We use the same technique as in Section 2.3.2 to show that we can thin the context in judgements in UTT^{S}.

Definition 4.9.7 (Renaming) A renaming is a substitution δ from Δ to Γ such that for each (x:A) ∈ Γ we have δ(x) ≡ y and (y:δ̂(A)) ∈ Δ.

Lemma 4.9.8 • If δ is a renaming from Δ to Γ and ϕ is a renaming from Φ to Δ then ϕ ∘ δ is a renaming from Φ to Γ.

• If M is weak head normal and δ is a renaming from Δ to Γ then δ̂(M) is weak head normal.

Lemma 4.9.9 (Renaming) If δ is a renaming from Δ to Γ then

• If Γ ⊢^{S} A →^{nf} B then Δ ⊢^{S} δ̂(A) →^{nf} δ̂(B).

• If Γ ⊢^{S} M →^{nf} P : A then Δ ⊢^{S} δ̂(M) →^{nf} δ̂(P) : δ̂(A).

Proof By induction on derivations. We give several illustrative cases:

• (S-Var). Then by inductive hypothesis Δ ⊢^{S} δ̂(A) →^{nf} δ̂(B), and by definition δ(x) is a variable, so Δ ⊢^{S} δ̂(x) →^{nf} δ̂(x) : δ̂(B).

• (S-Π). We know that Δ ⊢^{S} δ̂(A_{1}) →^{nf} δ̂(B_{1}) by inductive hypothesis, so ⊢^{S}Δ, y:δ̂(A_{1}) for y fresh in Δ by (S-Weak). Hence δ[x := y] is a renaming from Δ, y:δ̂(A_{1}) to Γ, x:A_{1}, so by inductive hypothesis again Δ, y:δ̂(A_{1}) ⊢^{S}

{ \atop δ[x := y]}(A_{2}) →^{nf} { \atop δ[x := y]}(B_{2}). Since δ̂((x:A_{1})A_{2}) ≡ (y:δ̂(A_{1})){ \atop δ[x := y]}(A_{2})

and δ̂((x:B_{1})B_{2}) ≡ (y:δ̂(B_{1})){ \atop δ[x := y]}(B_{2}), we have that Δ ⊢^{S} δ̂((x:A_{1})A_{2}) →^{nf} δ̂((x:B_{1})B_{2}).

• (S-κ). These rules follow by inductive hypothesis and Lemma 4.7.14.

□

Lemma 4.9.10 If ⊢^{S}Γ, ⊢^{S}Δ and Δ has all components of Γ then weak_{Γ}^{Δ} is a substitution from Δ to Γ.

Proof By induction on the structure of Γ such that ⊢^{S}Γ, using Generation, Renaming and the inductive hypothesis for the case Γ_{0}, x:A. □

As we mentioned, Renaming has the following corollary:

Corollary 4.9.11 (Thinning) If Γ ⊢^{S} J and Δ is a valid context with all components of Γ then Δ ⊢^{S} J.

Proof By Renaming and Thinning. □

Lemma 4.9.12 (Context Replacement) If Γ_{0} ⊢^{S} A ↓ B [C] and Γ_{0}, x:A, Γ_{1} ⊢^{S} J then Γ_{0}, x:B, Γ_{1} ⊢^{S} J.

Proof By induction on derivations. The interesting cases are (S-Weak) and (S-Var).

• (S-Weak). Suppose Γ_{1} is empty. Then Γ_{0} ⊢^{S} B →^{nf} C implies that ⊢^{S}Γ_{0}, x:B.

Otherwise, by inductive hypothesis Γ_{0}, x:B, Γ_{1} ⊢^{S} D →^{nf} E so ⊢^{S}Γ_{0}, x:B, Γ_{1}, y:D.

• (S-Var). Suppose Γ_{0}, x:A, Γ_{1} ⊢^{S} J is Γ_{0}, x:A, Γ_{1} ⊢^{S} x →^{nf} x : D, where Γ_{0}, x:A, Γ_{1} ⊢^{S} A →^{nf} D. By Context Validity we know that ⊢^{S}Γ_{0}, x:A, Γ_{1}, so by Thinning Γ_{0}, x:A, Γ_{1} ⊢^{S} A →^{nf} C, and by Uniqueness of Normal Forms C ≡ D. By inductive hypothesis and Context Validity we know that ⊢^{S}Γ_{0}, x:B, Γ_{1}. By assumption Γ_{0} ⊢^{S} B →^{nf} C, so again by Thinning Γ_{0}, x:B, Γ_{1} ⊢^{S} B →^{nf} C. Hence Γ_{0}, x:B, Γ_{1} ⊢^{S} x →^{nf} x : C.

Otherwise Γ_{0}, x:B, Γ_{1} ⊢^{S} D →^{nf} E by inductive hypothesis, so Γ_{0}, x:B, Γ_{1} ⊢^{S} y →^{nf} y : D.

□

Strengthening is often the most difficult of the metatheoretic results for a type theory with an equality rule for types. For UTT^{S} this result is straightforward, because type equality is taken care of in the individual rules. Indeed, the kind in each judgement about terms must always be normal, and although we do not explicitly use this fact it ensures that the strengthened variable never occurs in the kind. This is different from the situation in UTT, where the kind could include a redex which has the strengthened variable but where the reduct does not.

Lemma 4.9.13 (Strengthening) Suppose z is a variable such that z ∉ FV(Γ_{1}). Then:

• If ⊢^{S}Γ_{0}, z:C, Γ_{1} then ⊢^{S}Γ_{0}, Γ_{1}.

• If Γ_{0}, z:C, Γ_{1} ⊢^{S} A →^{nf} B and z ∉ FV(A) then Γ_{0}, Γ_{1} ⊢^{S} A →^{nf} B.

• If Γ_{0}, z:C, Γ_{1} ⊢^{S} M →^{nf} N : A and z ∉ FV(M) then Γ_{0}, Γ_{1} ⊢^{S} M →^{nf} N : A.

• If Γ_{0}, z:C, Γ_{1} ⊢^{S} M →^{wh} N : A and z ∉ FV(M) then Γ_{0}, Γ_{1} ⊢^{S} M →^{wh} N : A.

Proof By induction on derivations. We check several cases, with the others being similar or following simply by inductive hypothesis.

• (S-Weak). Suppose z = x. Then z ∉ dom(Γ) by assumption, and ⊢^{S}Γ by Context Validity.

Otherwise, by inductive hypothesis Γ_{0}, Γ_{1} ⊢^{S} A →^{nf} B, and by assumption x ∉ dom(Γ_{0}, z:C, Γ_{1}) ⊇ dom(Γ_{0}, Γ_{1}). Hence ⊢^{S}Γ_{0}, Γ_{1}, x:A.

• (S-Var). We know that Γ ≡ Γ_{0}, z:C, Γ_{1}, that x:A ∈ Γ, that z ∉ FV(Γ_{1}) and z ≠ x. By Contexts we know that z ∉ FV(Γ_{0}) as well, so z ∉ FV(A). Hence by inductive hypothesis Γ_{0}, Γ_{1} ⊢^{S} A →^{nf} B, so Γ_{0}, Γ_{1} ⊢^{S} x →^{nf} x : B.

• (S-App). By inductive hypothesis we know that Γ_{0}, Γ_{1} ⊢^{S} M_{1} →^{nf} N_{1} : (x:A_{1})A_{2} and Γ_{0}, Γ_{1} ⊢^{S} M_{2} →^{nf} N_{2} : A_{1}. By Contexts z ∉ FV([M_{2}/x]A_{2}), so by inductive hypothesis Γ_{0}, Γ_{1} ⊢^{S} [M_{2}/x]A_{2} →^{nf} B. Hence Γ_{0}, Γ_{1} ⊢^{S} M_{1}(M_{2}) →^{nf} N_{1}(N_{2}) : B.

□

4.9.2 Results About Reduction

The calculus UTT^{S} is a synthesis of standard reduction and typing rules from UTT. We are able to use this to considerable advantage in showing results about the relationship between untyped reduction and typing in UTT^{S}.

Lemma 4.9.14 (Adequacy for Untyped Reduction)

• If Γ ⊢^{S} M →^{nf} P : A then P is normal and there is an N such that M ▷_{βo}^{∗} N ▷_{η}^{∗} P.

• If Γ ⊢^{S} A →^{nf} C then C is normal and A ▷_{βo}^{∗} B ▷_{η}^{∗} C.

• If Γ ⊢^{S} M →^{wh} N : A then M ▷_{βo} N.

Proof By induction on derivations. We consider (S-η).

By Contexts x ∉ FV(P). Then by inductive hypothesis A_{1} ▷_{βo}^{∗} B_{1} ▷_{η}^{∗} C_{1} and M_{0} ▷_{βo}^{∗} N_{0} ▷_{η}^{∗} P (x), and C_{1} and P (x) are normal, so [x:A_{1}]M_{0} ▷_{βo}^{∗} [x:B_{1}]N_{0} ▷_{η}^{∗} [x:C_{1}]P (x), and furthermore [x:C_{1}]P (x) ▷_{η} P. Then, since P (x) is normal we know that P is normal, so P ≡ Q by Lemma 4.7.10 and the inductive hypothesis. □

Corollary 4.9.15

• If Γ ⊢^{S} A →^{nf} B and A is normal then A ≡ B.

• If Γ ⊢^{S} M →^{nf} P : A and M is normal then M ≡ P.

Proof By Adequacy for Reduction M ▷^{∗} P. By Lemma 4.7.10 M has no reductions, so M ≡ P. □

Lemma 4.9.16 (Subject Reduction for (η)) If Γ ⊢^{S} [x:A_{1}]M(x) →^{nf} P : (x:C_{1})C_{2} and x ∉ FV(M) then Γ ⊢^{S} M →^{nf} P : (x:C_{1})C_{2}.

Proof By Generation we know that Γ ⊢^{S} A_{1} →^{nf} C_{1}, Γ, x:A_{1} ⊢^{S} M(x) →^{nf} P_{0} : C_{2}, and either P_{0} ≡ P (x), x ∉ FV(P) and Γ ⊢^{S} P →^{nf} P : (x:C_{1})C_{2} (by Adequacy for Reduction and Corollary 4.9.15) or P ≡ [x:C_{1}]P_{0} and P_{0} ≡ P′(x) implies x ∈ FV(P′). By induction on the proof that Γ, x:A_{1} ⊢^{S} M(x) →^{nf} P_{0} : C_{2} we show that Γ ⊢^{S} M →^{nf} P : (x:C_{1})C_{2}:

• (S-App). Then Γ, x:A_{1} ⊢^{S} M →^{nf} P′ : (x:C_{1})C_{2}, Γ, x:A_{1} ⊢^{S} x →^{nf} x : C_{1} and P_{0} ≡ P′(x). Since x ∉ FV(M) we know by Strengthening that Γ ⊢^{S} M →^{nf} P′ : (x:C_{1})C_{2}, so x ∉ FV(P′) implies that P ≡ P′.

• (W-β). Then Γ, x:A_{1} ⊢^{S} [y:B_{1}]N_{0} →^{nf} P′ : (x:C_{1})C_{2}, Γ, x:A_{1} ⊢^{S} x →^{nf} x : C_{1} and Γ, x:A_{1} ⊢^{S} [x/y]N_{0} →^{nf} P_{0} : C_{2}. By Generation we know that Γ, x:A_{1} ⊢^{S} B_{1} →^{nf} C_{1} and by Strengthening x ∉ FV(M) implies that Γ ⊢^{S} B_{1} →^{nf} C_{1}, so by Context Replacement Γ, x:B_{1} ⊢^{S} [x/y]N_{0} →^{nf} P_{0} : C_{2}. Hence Γ ⊢^{S} [x:B_{1}][x/y]N_{0} →^{nf} P : (x:C_{1})C_{2}, by either (S-λ) or (S-η).

• (W-App). By inductive hypothesis, Strengthening and (S-WH).

□

Definition 4.9.17 The predicates S_{Γ}^{C}(A) and S_{Γ}^{P,A}(M) are defined as the least relations such that:

• S_{Γ}^{C}(A) if Γ ⊢^{S} A →^{nf} C and for all B if A ▷ B then S_{Γ}^{C}(B).

• S_{Γ}^{P,A}(M) if

– Γ ⊢^{S} M →^{nf} P : A,

– for all N if M ▷ N then S_{Γ}^{P,A}(N), and

– for all N which are subterms of M there are B and Q such that Γ, Δ ⊢^{S} N →^{nf} B : Q where Δ is the sequence of binders which N occurs under in M.

C_{Γ}^{C}(A) and C_{Γ}^{P,A}(M) will be the same as S_{Γ}^{C}(A) and S_{Γ}^{P,A}(M) except that instead of M ▷ N we use M ▷^{+} N.

This definition is closely related to the definition of strong normalization in Altenkirch’s thesis [4], although we have added type information. The predicate is well-defined because it is strictly positive. We shall also have the following induction principle on this predicate: if S_{Γ}^{C}(A) and P(B) for all B such that A ▷^{∗} B then P(A), then P holds for all terms such that Γ ⊢^{S} A →^{nf} C, and similarly (but including subterms) for Γ ⊢^{S} M →^{nf} P : C.

Lemma 4.9.18 The following properties hold for S_{Γ}^{P,A}(M):

• If S_{Γ}^{P,A}(M) then Γ ⊢^{S} M →^{nf} P : A.

• If S_{Γ}^{P,A}(M) then M is strongly normalizing.

• If S_{Γ}^{P,A}(M) and M ▷^{∗} N then S_{Γ}^{P,A}(N).

Chapter 4. Basic Metatheory for UTT 121 • S_{Γ}^{P,A}(M) if and only if C_{Γ}^{P,A}(M).

• If S_{Γ}^{P,A}(M) and N is a subterm of M then there are Q and B such that S_{Γ}^{Q,B}(N).

• If Γ_{0} ⊢^{S} C ↓ D [E] then – if S_{Γ_{0},x:C,Γ_{1}}^{B}(A) then S_{Γ_{0},x:D,Γ_{1}}^{B}(A), and

– if S_{Γ_{0},x:C,Γ_{1}}^{P,A}(M) then S_{Γ_{0},x:D,Γ_{1}}^{P,A}(M).

• If z is a variable such that z ∉ FV(Γ_{1}) then – if S_{Γ_{0},x:C,Γ_{1}}^{B}(A) and z ∉ FV(A) then S_{Γ_{0},Γ_{1}}^{B}(A), and – if S_{Γ_{0},x:C,Γ_{1}}^{P,A}(M) and z ∉ FV(M) then S_{Γ_{0},Γ_{1}}^{P,A}(M).

Proof By induction on proofs of S_{Γ}^{P,A}(M), using Context Replacement and Strengthening for the last two. □ Lemma 4.9.19 (Reduction)

• If Γ ⊢^{S} A →^{nf} B then S_{Γ}^{B}(A).

• If Γ ⊢^{S} M →^{nf} P : A then S_{Γ}^{P,A}(M).

• If Γ ⊢^{S} M →^{wh} N : A and S_{Γ}^{P,A}(N) then S_{Γ}^{P,A}(M). Proof By induction on derivations. We show two cases:

• (S-λ). We need to show that – Γ ⊢^{S} [x:A_{1}]M_{0} →^{nf} [x:C_{1}]P_{0} : (x:C_{1})C_{2},

– [x:A_{1}]M_{0} ▷ N implies S_{Γ}^{P,(x:C_{1})C_{2}}(N) and

– S_{Γ}^{C_{1}}(A_{1}) and S_{Γ,x:A_{1}}^{P_{0},C_{2}}(M_{0}).

The first follows directly and the last follows by inductive hypothesis.

For the second, by induction on S_{Γ}^{C_{1}}(A_{1}) we know that A_{1} ▷ B_{1} and S_{Γ,x:B_{1}}^{P_{0},C_{2}}(M_{0}) imply that S_{Γ}^{P,(x:C_{1})C_{2}}([x:B_{1}]M_{0}) for all B_{1}. Also, by induction on S_{Γ,x:A_{1}}^{P_{0},C_{2}}(M_{0}) we know that M_{0} ▷ N_{0} implies that S_{Γ,x:A_{1}}^{P_{0},C_{2}}(N_{0}) for all N_{0}. Hence, suppose [x:A_{1}]M_{0} ▷ N. Then:

– A_{1} ▷ B_{1} implies that [x:A_{1}]M_{0} ▷ [x:B_{1}]M_{0}. Then S_{Γ}^{C_{1}}(B_{1}), so Γ ⊢^{S} B_{1} →^{nf} C_{1} by Lemma 4.9.18. Hence S_{Γ,x:B_{1}}^{P_{0},C_{2}}(M_{0}) by the Context Replacement component of Lemma 4.9.18, so by inductive hypothesis S_{Γ}^{P,(x:C_{1})C_{2}}([x:B_{1}]M_{0}).

– M_{0} ▷ N_{0} implies that [x:A_{1}]M_{0} ▷ [x:A_{1}]N_{0}. By inductive hypothesis.

– [x:A_{1}]M(x) ▷ M by (η), where x ∉ FV(M). Since M is a subterm of [x:A_{1}]M(x) we know that S_{Γ,x:A_{1}}^{Q,B}(M) for some Q and B, and by the Strengthening component of Lemma 4.9.18 we know that S_{Γ}^{Q,B}(M). Furthermore by Lemma 4.9.16 we know that Γ ⊢^{S} M →^{nf} P : (x:C_{1})C_{2}, so by Uniqueness of Normal Forms S_{Γ}^{P,(x:C_{1})C_{2}}(M).

• (W-β). The result follows again by induction on the normalization premisses, where if [x:A_{1}]M(x) ▷ M by (η) because M_{0} ≡ M(x) with x ∉ FV(M) then M(M_{2}) ≡ [M_{2}/x]M(x), and S_{Γ}^{P,C}([M_{2}/x]M_{0}) by assumption.

□

The inclusion of the η-equality rule has not significantly altered our treatment of the metatheory for UTT^{S}. The properties we need can be established in a style similar to the standard development [8,44]. Indeed, typed operational semantics seem to be a useful technical contribution to the metatheory for type theories exactly because of this uniformity of development.

Corollary 4.9.20 (Subject Reduction for UTT^{S}) If Γ ⊢^{S} M →^{nf} P : A and M ▷^{∗} N then Γ ⊢^{S} N →^{nf} P : A.

Corollary 4.9.21 (Strong Normalization for UTT^{S}) If Γ ⊢^{S} M →^{nf} P : A then M is strongly normalizing.

Corollary 4.9.22 (Diamond Property for UTT^{S}) If Γ ⊢^{S} M →^{nf} P : A, M ▷^{∗} M_{1} and M ▷^{∗} M_{2} then M_{1} ▷^{∗} P and M_{2} ▷^{∗} P.

4.9.3 Admissible Rules

We shall now show the admissibility of several rules which will be important in showing the soundness of UTT^{S} for UTT:

Proposition 4.9.23 (Admissibility of (S-Var’) ) If ⊢^{S}Γ_{0}, x:A, Γ_{1} and Γ_{0} ⊢^{S} A →^{nf} B then Γ_{0}, x:A, Γ_{1} ⊢^{S} x →^{nf} x : B.

Proof By Thinning Γ_{0}, x:A, Γ_{1} ⊢^{S} A →^{nf} B, so by (S-Var) Γ_{0}, x:A, Γ_{1} ⊢^{S} x →^{nf} x : B. □

Proposition 4.9.24 (Admissibility of (S-η’)) If Γ ⊢^{S} A_{1} →^{nf} B_{1} and Γ, x:A_{1} ⊢^{S} M_{0} →^{nf} N(x) : B_{2}, with x ∉ FV(N), then Γ ⊢^{S} [x:A_{1}]M_{0} →^{nf} N : (x:B_{1})B_{2}.

Proof By Adequacy for Reduction and Reduction we know that Γ, x:A_{1} ⊢^{S} N(x) →^{nf} N(x) : B_{2}. Since N(x) is normal by Normal Forms, the only rule which applies is (S-App), so by Generation there are C_{1} and C_{2} such that Γ, x:A_{1} ⊢^{S} N →^{nf} N : (x:C_{1})C_{2}, Γ, x:A_{1} ⊢^{S} x →^{nf} x : C_{1} and Γ, x:A_{1} ⊢^{S} [x/x]C_{2} →^{nf} B_{2}. By Generation for the variable we know that Γ, x:A_{1} ⊢^{S} A_{1} →^{nf} C_{1}, and by Thinning Γ, x:A_{1} ⊢^{S} A_{1} →^{nf} B_{1}, so by Uniqueness of Normal Forms C_{1} ≡ B_{1}. Furthermore, by Normal Forms C_{2} is normal, so [x/x]C_{2} ≡ B_{2} by Lemma 4.9.15. Finally, by Strengthening Γ ⊢^{S} N →^{nf} N : (x:B_{1})B_{2} and by (S-η) Γ ⊢^{S} [x:A_{1}]M_{0} →^{nf} N : (x:B_{1})B_{2}. □

The admissibility of the rules (S-η’) and (S-Var’) means that we could show the equivalence of a system which has these two rules instead of (S-η) and (S-Var) in UTT^{S}. Similarly, the soundness and completeness results for UTT would allow us to prove equivalence with a system with much stronger rules for weak head reduction. In particular, it seems that we could remove the type reductions in the premisses of many of the rules for weak head reduction.

Similar to the simply typed lambda calculus, we can use Adequacy for Reduction, Subject Reduction and Uniqueness of Normal Forms to show that if two terms have a common reduct and they are both well-typed in UTT^{S} then they have the same normal form. For example, we can show the admissibility of the following rule for application equality:

(S-App-Eq) \frac{Γ ⊢^{S} M_{1} ↓ N_{1} [P_{1}] : (x:A_{1})A_{2} Γ ⊢^{S} M_{2} ↓ N_{2} [P_{2}] : A_{1} Γ ⊢^{S} M_{1}(M_{2}) →^{nf} Q : B Γ ⊢^{S} N_{1}(N_{2}) →^{nf} R : C}{Γ ⊢^{S} M_{1}(M_{2}) ↓ N_{1}(N_{2}) [Q] : B}

4.10 Discussion

We have discussed many of the benefits and ideas of typed operational semantics in Chapter 2 on the simply typed lambda calculus. However, the technique of using a typed operational semantics to study the metatheory of type theory is particularly useful in the study of systems with dependent types. For the systems UTT and UTT^{S}, the derivations of UTT^{S} are easier to manipulate because there is only one derivation of well-typedness for any given context and term: there is no rule of conversion or type equality, which allows the type of a term to be replaced by an equal type. This allows us to have the desirable statement of the Generation lemma that, for example, if Γ ⊢^{S} [x:A_{1}]M_{0} →^{nf} P : (x:B_{1})B_{2} then Γ, x:A ⊢^{S} M_{0} →^{nf} Q : B_{2} for some Q. In the semantic presentation, the type equality rule means that we cannot recover all of the type information from a judgement.

We emphasize again that the Church–Rosser and subject reduction properties follow straightforwardly for UTT^{S}. This is in contrast to several proofs for normalizing type systems [70,30], which use complicated syntactic methods to show Church–Rosser. Coquand’s proof technique [15], which was part of the inspiration for our presentation, is similar to ours but does not develop a formal system to reason in, instead annotating an untyped reduction relation with type information.

Coquand’s proof is for a special variant of Martin-Löf type theory with one universe and a Π-type. This variant does not distinguish syntactically between kinds and elements in the universe, and the Π-type only has application and not the full elimination rule. This means that the problem of matching labels discussed in Section 4.7.2 is not addressed in his paper. UTT is also a more sophisticated type theory because it includes an impredicative universe and a general class of inductive types.

An advantage of Coquand’s proof over ours is that the technique of using a bisimulation may be needed for calculi with more sophisticated equalities between terms and types, although we are able to avoid using it for η-equality. For example, one approach to systems with a reduction which is known not to have the Church–Rosser property could be to define a final equality on terms in normal form, following the semantic explanation of the meaning of a type (see Section 1.1). UTT^{S} could be modified to include such an added equality, as we shall discuss in Section 7.2.

It may also be simpler to use a reduction to weak head normal form rather than reduction to full normal form. Several of the proofs by induction on derivations in UTT^{S} make extensive use of the Generation lemma, and the reductions under the Π-binder in the rules (W-E_{∀}) and (W-E^{X}[Θ̄]) make these proofs even more indirect. This will also affect our soundness proof, because we shall always need to normalize types when it might again be enough to consider the weak head normal form.

We could instead have presented a system which included context reduction to normal form in the judgements: for example, the judgement for context validity would be that Γ →^{nf} Δ. One case of the Generation lemma for this system would be that if Γ, x:A →^{nf} Δ, x:B then there is a subderivation of Γ; A →^{nf} Δ; B, which is better than the lemma we are able to prove because it mentions the particular B in the subderivation. It also seems that a proof of Reduction with reduction in the context is more elegant, because we can give a direct proof instead of appealing to Context Replacement. However, giving such a presentation would mean that we would have to formalize reduction in the context, and the lemmas we prove about Chapter 4. Basic Metatheory for UTT 126 reduction would be correspondingly more difficult. We have therefore chosen to use the simpler system which only allows reduction in the subject.

A Set-Theoretic Model Construction

In this chapter we give a semantics for UTT in classical set theory. This semantics is based on Dybjer’s semantics for Martin-Löf type theory [26]. Basically, types are interpreted by their intuitive set-theoretic counterparts, with the exception of propositions which are only either true or false. Hence functions will be set-theoretic functions, the natural numbers will be the natural numbers, and in general inductive types will be a least fixed-point of the inductive equation for that type.

The set-theoretic model we give in this chapter will be important in the next chapter, where we show the soundness of UTT^{S} for UTT. We will use the model to give an induction principle on types which it seems we cannot justify syntactically.

In calculi with dependent types, such as UTT, terms and kinds are introduced simultaneously, which means that for all but the simplest interpretations the notions associated with the model theory are more complicated. In the case of the notion of environment, we need to know what an environment is before we can define the interpretations for terms and kinds. Once we have the interpretation of kinds, to prove soundness we can restrict our attention to derivable judgements and the environments which satisfy the context of those judgements. This is in contrast to the simply typed lambda calculus, as described by Mitchell [62], where terms and types are separate syntactically so the possible values for types can be introduced before the interpretations for terms, and environments are simply maps from variables to the union of all possible values for types. The interpretation of contexts is given after terms and kinds have been interpreted, and essentially the interpretation of a context Γ is an environment for the domain of Γ such that the value of the environment at each variable in the domain of Γ is in the interpretation of its kind. This is the notion of satisfaction of contexts introduced for example by Mitchell.

Set theory extended by an axiom stating the existence of an inaccessible cardinal gives an interpretation for the set theory without this axiom, by assuming that there is a set larger than any set which can be formed using the usual set forming operations such as union and powerset. Once we add this larger set, all of the original sets can be formed in the same way, and forming sets using just the original axioms always results in a set smaller than the inaccessible cardinal, but we can also form new large sets by applying the set forming operations to the inaccessible cardinal. Similarly, in type theory extended by a universe, the universe can be seen as containing a “smaller” version of the type theory, with all of the type-theoretic operations applying to objects within the universe to form new objects in the universe, and to the universe to form new “larger” types. Our interpretation follows this intuition by using inaccessible cardinals to interpret the universe and the kind Type.

Our approach differs from Dybjer’s in several respects. First, since our type theory is expressed using the Logical Framework and includes an impredicative universe of propositions, we need to provide an interpretation for these constructs. Secondly, we do not consider the generalization of inductive types to inductive families of types. Thirdly, Dybjer interprets the inductive types using Aczel’s rule sets [1], whereas we give an interpretation based on a least fixed-point construction and transfinite induction. These two interpretations are merely different presentations of essentially the same construct.

Lastly, Dybjer gives three possible interpretations for universes in his paper, one of which we have used here. The interpretation we use is to interpret the type-theoretic universe as a set-theoretic universe. Dybjer’s second interpretation interprets the universe as the set inductively generated by the type constructors, similar to the inductive types. These two interpretations are unable to include an interpretation of the elimination rule for the universe. His last interpretation assigns to the universe the small set of names formed by the constructors, and only the lifting operator is required to be large. This corresponds more closely to our type-theoretic understanding of a universe, where the universe is inductively generated by its introduction rules.

Following our discussion in Section 4.4, we do not interpret the type theory UTT but instead the theory UTT^{−}, which does not include rules for substitutions.

5.1 The Interpretation

We assume the existence of three strongly inaccessible cardinals κ_{0}, κ_{1} and κ_{2}, with κ_{0} < κ_{1} < κ_{2}.

We shall assume the usual operations on cardinals [82,42].

We recall from Section 4.6 that an environment for a set S is simply a function from a finite set of variables to S.

We shall call an environment for κ_{2} a set environment.

Let {∗} be a distinguished one-element set.

Let A be a set and B(x) be a family of sets indexed by x ∈ A. We write Πx ∈ A.B(x) for the set of maps from elements x ∈ A to B(x), and Σx ∈ A.B(x) for the set of pairs of elements (x, y) with x ∈ A and y ∈ B(x). We also write λx ∈ A.f(x) for the map from elements x ∈ A to B(x), where f(x) ∈ B(x) for each x ∈ A.

We recall that the cumulative hierarchy for an ordinal α, notation V_{α}, is defined by induction on α:

V_{0} =_{df} ∅
V_{succ(α)} =_{df} P(V_{α})
V_{α} =_{df} ⋃_{β<α} V_{β} (for limit α)

This definition can be found in standard books on set theory [82].

Our proof uses the technique of defining a partial interpretation for terms and showing that this interpretation is total for terms which are well-typed. This technique is introduced by Streicher [75]. The idea is that we can require certain conditions to hold in order for the interpretation to be defined, which we know must be true from the structure of derivations. For example, we require in the definition of the interpretation of application M_{1}(M_{2}) (the most problematic case) that the interpretation of M_{1} must be a set-theoretic function and that the interpretation of M_{2} must be in the domain of M_{1}. When we examine the rule of inference for application in the final soundness proof, these conditions must always hold by inductive hypothesis. Hence the interpretation of application is well defined for well-typed terms.

Definition 5.1.1 (Interpretation) Let ρ be a set environment. We define the interpretation of terms M and kinds A under ρ, [[M]](ρ) and [[A]](ρ), by induction on the structure of M and A, using the induction principle of Section 4.3:

• [[x]](ρ) =_{df} ρ(x) if x ∈ dom(ρ).

• [[(x:A_{1})A_{2}]](ρ) =_{df} Πv ∈ [[A_{1}]](ρ).[[A_{2}]](ρ[x := v])

– if [[A_{1}]](ρ) is defined and

– [[A_{2}]](ρ[x := v]) is defined for any v ∈ [[A_{1}]](ρ) and some x ∉ dom(ρ).

• [[[x:A_{1}]M_{0}]](ρ) =_{df} λv ∈ [[A_{1}]](ρ).[[M_{0}]](ρ[x := v])

– if [[A_{1}]](ρ) is defined and

– [[M_{0}]](ρ[x := v]) is defined for any v ∈ [[A_{1}]](ρ) and some x ∉ dom(ρ).

Chapter 5. A Set-Theoretic Model Construction 131

• [[M_{1}(M_{2})]](ρ) =_{df} [[M_{1}]](ρ)([[M_{2}]](ρ))

– if [[M_{1}]](ρ) and [[M_{2}]](ρ) are defined,

– [[M_{1}]](ρ) is a function and

– [[M_{2}]](ρ) ∈ dom([[M_{1}]](ρ)).

• [[Type]](ρ) =_{df} V_{κ_{1}}.

• [[El(M_{0})]](ρ) =_{df} [[M_{0}]](ρ) if [[M_{0}]](ρ) is defined.

• [[Prop]] =_{df} {∅, {∗}}.

• [[Prf]] =_{df} λv ∈ [[Prop]].v.

• [[∀]] =_{df} λA ∈ [[Type]].λP ∈ A → [[Prop]]. \begin{cases}\{∗\} & if ∀a ∈ A.P (a) = \{∗\} \\ ∅ & otherwise \end{cases}.

• [[Λ]] =_{df} λA ∈ [[Type]].λP ∈ A → [[Prop]].λg ∈ (Πa ∈ A.[[Prf]](P (a))).∗.

•

[[E_{∀}]] =_{df} λA ∈ [[Type]].λP ∈ A → [[Prop]].
λR ∈ [[Prf]]([[∀]](A, P)) → [[Prop]].
λf ∈ (Πg ∈ (Πa ∈ A.[[Prf]](P (a))).[[Prf]](R([[Λ]](A, P, g)))).
λz ∈ [[Prf]]([[∀]](A, P)).
f(λa ∈ A.∗)

• [[U]] =_{df} V_{κ_{0}}.

• [[T]] =_{df} λv ∈ [[U]].v.

• [[prop]] =_{df} {∅, {∗}}.

• [[prf]] =_{df} λv ∈ [[Prop]].v.

Chapter 5. A Set-Theoretic Model Construction 132

Remarks

• We recall that terms which are syntactically equivalent are equal. Therefore, in the above definition for terms with binders, we can always choose a subterm which has a bound variable distinct from the domain of the set environment ρ.

• In the rest of the text we omit writing [[Prf]] and [[T]] since both are the identity.

• For the definitions of [[Λ]] and [[E_{∀}]], the set Πa ∈ A.P (a) is the empty set if P (a) is the empty set for some a ∈ A.

We define several functions which allow us to define the set-theoretic semantics of inductive data types by least fixed-point constructions. Definition 5.1.2 Let κ be a strongly inaccessible cardinal, let ρ be a set environment and suppose PSch_{X}(Θ̄). We define a partial function on sets relative to κ, Θ̄_{ρ}^{#} ∈ V_{κ} → V_{κ}, by induction on PSch_{X}(Θ̄):

• Θ_{1}, …, Θ_{n}_{ρ}^{#}(S) =_{df} Θ_{1}_{ρ}^{#}(S) + ⋯ + Θ_{n}_{ρ}^{#}(S) if Θ_{1}_{ρ}^{#}, …, Θ_{n}_{ρ}^{#} are defined.

• X_{ρ}^{#}(S) =_{df} {∗}.

• (Φ)Θ_{ρ}^{#}(S) =_{df} Φ_{ρ}^{#}(S) × Θ_{ρ}^{#}(S) if Φ_{ρ}^{#} and Θ_{ρ}^{#} are defined.

• (x:A)Θ_{ρ}^{#}(S) =_{df} Σa ∈ [[A]](ρ).Θ_{ρ[x:=a]}^{#}(S)

– if [[A]](ρ) defined,

– [[A]](ρ) ∈ V_{κ} and

– Θ_{ρ[x:=a]}^{#} is defined for any a ∈ [[A]](ρ).

• Φ_{ρ}^{#}(S) =_{df} [[Φ]](ρ[X := S]) if [[Φ]](ρ[X := S]) is defined.

Chapter 5. A Set-Theoretic Model Construction 133 Lemma 5.1.3 Suppose PSch_{X}(Θ), ρ is a set environment, and S is a set. Then we have [[Θ]](ρ[X := S]) ≅ Θ_{ρ}^{#}(S) → S. Proof We give the obvious maps in each direction:

Θ^{→} =_{df} λf ∈ [[Θ]](ρ[X := S]).λ<M̄, ∗>.fM̄
∈ [[Θ]](ρ[X := S]) → Θ_{ρ}^{#}(S) → S
Θ^{←} =_{df} λf ∈ Θ_{ρ}^{#}(S) → S.λM̄.f<M̄, ∗>
∈ (Θ_{ρ}^{#}(S) → S) → [[Θ]](ρ[X := S])

which trivially give an isomorphism. □ Lemma 5.1.4 (Monotonicity of Θ̄_{ρ}^{#}) Suppose ρ is a set environment. Then:

• If PSch_{X}(Θ̄) and Θ̄_{ρ}^{#} is defined then Θ̄_{ρ}^{#} is a monotone function on sets.

• If PSch_{X}(Θ) and Θ_{ρ}^{#} is defined then Θ_{ρ}^{#} is a monotone function on sets.

• If PPos_{X}(Φ) and Φ_{ρ}^{#} is defined then Φ_{ρ}^{#} is a monotone function on sets. Proof By induction on PSch_{X}(Θ̄), using the monotonicity of the set-theoretic operators + and ×, and Σ and Π on the right-hand side. □ Lemma 5.1.5 card(X) = card(A → X) if card(X) ≥ card(2^{card(A)}). Proof By transfinite induction on A [42]. □ Lemma 5.1.6 (Boundedness of Θ̄_{ρ}^{#}) Let ρ be a set environment, suppose PSch_{X}(Θ̄) and assume that Θ̄_{ρ}^{#} is defined relative to κ. Then there is an ordinal α_{0} < κ such that Θ̄_{ρ}^{#}(S) ∈ V_{α_{0}} → V_{α_{0}}. Proof First, we construct the bound α_{0} using only set-theoretic operators on sets smaller than κ, so we are guaranteed that α_{0} < κ because κ is strongly inaccessible.

We construct α_{0} by induction on PSch_{X}(Θ̄):

• Θ_{1}, …, Θ_{n}. Let α_{0} be α_{Θ_{1}} + ⋯ + α_{Θ_{n}}.

• Θ ≡ X. Then we take α_{0} to be 1.

• Θ ≡ (x:A)Θ_{0}. By inductive hypothesis we know that for each a ∈ [[A]](ρ) there exists an α_{a} such that Θ_{0}_{ρ}^{#}(X) ∈ V_{α_{a}} → V_{α_{a}}. Let α_{0} =_{df} β × ⨆_{a∈[[A]](ρ)} α_{a}, where β is the least limit ordinal such that A ∈ V_{β}.

• Θ ≡ (Φ)Θ_{0}. Let α_{0} be α_{Φ} × α_{Θ_{0}}.

• Φ ≡ (x_{1}:A_{1}) … (x_{n}:A_{n})X. Then

[[(x_{1}:A_{1}) … (x_{n}:A_{n})X]](ρ[X := X])
= Πv_{1} ∈ [[A_{1}]](ρ)…. Πv_{n} ∈ [[A_{n}]](ρ).X
≅ (Σv_{1} ∈ [[A_{1}]](ρ)…. [[A_{n}]](ρ[x_{1} := v_{1}] …[x_{n−1} := v_{n−1}])) → X

Let A be the domain of the function space. We can take the least ordinal α_{0} such that A ⊆ V_{α_{0}} and card(A) < card(α_{0}). This is because if f ∈ A → V_{α_{0}} then for each a ∈ A we know that (a, f(a)) ∈ V_{β_{a}} for some β_{a} < α_{0}. Let β =_{df} ⊔_{a∈A}β_{a} which is less than α_{0}. Hence f = {(a, f(a)) | a ∈ A} ⊆ V_{β}, so f ∈ V_{α_{0}}.

□

Definition 5.1.7 Let κ be a strongly inaccessible cardinal, let F ∈ V_{κ} → V_{κ} and let α be an ordinal. We define F^{α} as:

F^{0} =_{df} ∅
F^{succ(α)} =_{df} F (F^{α})
F^{α} =_{df} ∪_{β<α}F^{β} for limit α

Proposition 5.1.8 If F ∈ V_{α} → V_{α} and F is a monotone function on V_{α} then there is an ordinal α_{0} such that F^{α_{0}} is a least fixed-point for F.

Proof Standard [1]. □

Definition 5.1.9 (Interpretation of Inductive Types) Let Θ̄_{ρ}^{#}(S) be defined relative to some κ, and let α_{0} be the ordinal such that (Θ̄_{ρ}^{#})^{α_{0}} is a least fixed-point for Θ̄_{ρ}^{#}. Then we define the interpretation of an inductive type as:

[[M^{X}[Θ̄]]](ρ) =_{df} (Θ̄_{ρ}^{#})^{α_{0}}(∅) if κ ≤ κ_{1}
[[μ^{X}[Θ̄]]](ρ) =_{df} (Θ̄_{ρ}^{#})^{α_{0}}(∅) if κ ≤ κ_{0}

Definition 5.1.10 The interpretation of the introduction rule for an inductive type is given as

[[ι_{i}^{X}[Θ̄]]](ρ) =_{df} Θ_{i}^{←} ∘ introΘ̄_{ρ}^{#} ∘ in_{i}

where introΘ̄_{ρ}^{#} is the map from Θ̄_{ρ}^{#}((Θ̄_{ρ}^{#})^{α_{0}}) to (Θ̄_{ρ}^{#})^{α_{0}}.

Definition 5.1.11 Suppose

C ∈ [[M^{X}[Θ̄]]](ρ) → [[Type]].
f_{1} ∈ [[Θ_{1}^{∘}(M^{X}[Θ̄], C, ι_{1}^{X}[Θ̄])]](ρ[C := C])
…
f_{n} ∈ [[Θ_{n}^{∘}(M^{X}[Θ̄], C, ι_{n}^{X}[Θ̄])]](ρ[C := C])

Let α_{0} be the ordinal which defines the least fixed-point for Θ̄_{ρ}^{#}.

We define R^{α}(M), for M ∈ (Θ̄_{ρ}^{#})^{α}, by transfinite induction on α:

• α = 0. Then R^{α}(M) =_{df} ϵ, the unique function from the empty set ∅.

• α = succ(β). Then

R^{succ(β)}(intro_{i}(N_{1}, …, N_{m})) =_{df} f_{i}(N_{1}, …, N_{m}, Φ_{i_{1}}^{∗}, …)

if

Φ_{i_{j}}^{∗} =_{df} [[Φ_{i_{j}}^{♮}[A, C, f, z]]](ρ[A := [[M^{X}[Θ̄]]](ρ)][C := C][f := R^{β}][z := N_{i_{j}}])
∈ [[Φ_{i_{j}}^{∘}[A, C, z]]](ρ[A := [[M^{X}[Θ̄]]](ρ)][C := C][z := N_{i_{j}}])

for 1 ≤ j ≤ k, where we also assume that both of these interpretations are defined.

• Limit α. Then

R^{α}(M) =_{df} R^{γ}(M)

where γ =_{df} ∩{β | M ∈ (Θ̄_{ρ}^{#})^{β}}, if R^{γ}(M) is defined.

Then

[[E^{X}[Θ̄]]](ρ)(C, f_{1}, …, f_{n}) =_{df} λM ∈ [[M^{X}[Θ̄]]](ρ).R^{α_{0}}(M)

We have used the induction principle defined in Section 4.3 to know that [[Φ_{i_{j}}^{♮}[A, C, f, z]]](ρ′) will already have been defined by inductive hypothesis if it has a value. Since the interpretation is a partial function, it may of course fail to be defined because the conditions required have not been met.

Definition 5.1.12 We define the interpretation of a context Γ by induction on the structure of Γ:

• [[()]] =_{df} {ϵ}.

• [[Γ, x:A]] =_{df} {ρ[x := v] | ρ ∈ [[Γ]] and v ∈ [[A]](ρ)}

– if [[Γ]] is defined and

– [[A]](ρ) is defined for any ρ ∈ [[Γ]].

5.2 Properties of the Interpretation

In this section we establish the basic properties of the interpretation, in preparation for the final proof of soundness. These properties will be proved by the same induction principle which we used to define the interpretation, the alternative induction principle on terms defined in Section 4.3.

Definition 5.2.1

• a and b are Kleene equal, notation a ≃ b, if a is defined if and only if b is defined, and if they are both defined then a = b.

• a is Kleene greater than b, notation a ≻ b, if whenever a is defined then b is defined and a = b.

The following lemma says that although we have defined the interpretation of terms with binders by choosing a particular fresh variable, we can treat this as though we used an arbitrary fresh variable. This will be important in the proof of the substitution lemma.

Lemma 5.2.2 Suppose γ is an environment for variables and ρ is a set environment. Then [[M]](ρ ∘ γ) ≃ [[γ̂(M)]](ρ), where γ̂(M) is for γ as a substitution.

Proof By induction on the structure of M. We only consider the variable and Π cases:

• M ≡ x. Then [[x]](ρ ∘ γ) ≃ ρ(γ(x)) ≃ [[γ(x)]](ρ) ≃ [[γ̂(x)]](ρ).

• A ≡ (x:A_{1})A_{2}. Suppose [[(x:A_{1})A_{2}]](ρ ∘ γ) is defined. Then [[A_{1}]](ρ ∘ γ) is defined and there is an x ∉ dom(γ) such that [[A_{2}]]((ρ ∘ γ)[x := v]) is defined for any v ∈ [[A_{1}]](ρ ∘ γ). By inductive hypothesis we know that [[A_{1}]](ρ ∘ γ) = [[γ̂(A_{1})]](ρ).

Choose some y ∉ dom(ρ), then by inductive hypothesis

[[A_{2}]]((ρ ∘ γ)[x := v]) = [[A_{2}]](ρ[y := v] ∘ γ[x := y])
≻ [[{ \atop γ[x := y]}(A_{2})]](ρ[y := v])

for any v ∈ [[γ̂(A_{1})]](ρ), so

[[(x:A_{1})A_{2}]](ρ ∘ γ) = [[(y:γ̂(A_{1})){ \atop γ[x := y]}(A_{2})]](ρ)
= [[γ̂((x:A_{1})A_{2})]](ρ)

The other direction follows similarly.

□

The above lemma is important in our proof of the substitution lemma. We need it because in performing a substitution [N/x]M, the terms M and N could both have binders for which the interpretation has chosen the same fresh variable. For example, in the substitution [[x:A_{1}]M_{0}/y]([x:A_{1}]y), we need to interpret [x:A_{1}]M_{0} where x is already in the environment, so if the interpretation of [x:A_{1}]M_{0} has chosen x as the fresh variable then there will be a clash. The above lemma says that we can interpret the substituted term by choosing a different variable.

Lemma 5.2.3 Let ρ_{1} and ρ_{2} be two set environments. If for all x ∈ FV(M) we have that ρ_{1}(x) = ρ_{2}(x) then [[M]](ρ_{1}) ≃ [[M]](ρ_{2}).

Proof We only need to show that [[M]](ρ_{1}) ≻ [[M]](ρ_{2}) under the conditions mentioned. This follows by induction on the structure of terms and types, where all cases except binders are straightforward.

We illustrate the case of [x:A_{1}]M_{0}. Suppose [[[x:A_{1}]M_{0}]](ρ_{1}) is defined. Then [[A_{1}]](ρ_{1}) is defined and [[M_{0}]](ρ_{1}[x := v]) is defined for any v ∈ [[A_{1}]](ρ_{1}) and for some x ∉ dom(ρ_{1}). By inductive hypothesis [[A_{1}]](ρ_{1}) = [[A_{1}]](ρ_{2}). Choose y ∉ dom(ρ_{1}) ∪ dom(ρ_{2}). Then by Lemma 5.2.2 and inductive hypothesis

[[M_{0}]](ρ_{1}[x := v]) = [[M_{0}]](ρ_{1}[y := v] ∘ id_{dom(ρ_{1})}[x := y])
≃ [[{ \atop id_{dom(ρ_{1})}[x := y]}(M_{0})]](ρ_{1}[y := v])
= [[{ \atop id_{dom(ρ_{2})}[x := y]}(M_{0})]](ρ_{2}[y := v])
≃ [[M_{0}]](ρ_{2}[y := v] ∘ id_{dom(ρ_{2})}[x := y]) = [[M_{0}]](ρ_{2}[x := v])

for any v ∈ [[A_{1}]](ρ_{2}), so [[[x:A_{1}]M_{0}]](ρ_{2}) is defined and [[[x:A_{1}]M_{0}]](ρ_{1}) = [[[x:A_{1}]M_{0}]](ρ_{2}). □

Lemma 5.2.4 (Substitution) Let ρ = ρ_{0}ρ_{1} be a set environment. Then

[[M]](ρ[z := [[N]](ρ_{0})]) ≻ [[[N/z]M]](ρ)

Proof By induction on the structure of terms and kinds. We show several cases.

• M ≡ x. Then x ≢ z and [[x]](ρ[z := [[N]](ρ_{0})]) defined imply that

[[x]](ρ[z := [[N]](ρ_{0})]) = ρ[z := [[N]](ρ_{0})](x) = ρ(x) = [[x]](ρ)

• M ≡ z. Then [[z]](ρ[z := [[N]](ρ_{0})]) = [[N]](ρ_{0}) ≃ [[N]](ρ) by definition and Lemma 5.2.3.

• A ≡ (x:A_{1})A_{2}. If [[(x:A_{1})A_{2}]](ρ[z := [[N]](ρ_{0})]) is defined then [[A_{1}]](ρ[z := [[N]](ρ_{0})]) is defined and [[A_{2}]](ρ[z := [[N]](ρ_{0})][x := v]) is defined for some x ∉ dom(ρ) and any v ∈ [[A_{1}]](ρ[z := [[N]](ρ_{0})]). By inductive hypothesis we have that [[[N/z]A_{1}]](ρ) is defined and equal to [[A_{1}]](ρ[z := [[N]](ρ_{0})]) and

[[A_{2}]](ρ[z := [[N]](ρ_{0})][x := v]) = [[A_{2}]](ρ[x := v][z := [[N]](ρ_{0})])
= [[[N/z]A_{2}]](ρ[x := v])

for v ∈ [[[N/z]A_{1}]](ρ).

• M ≡ κ^{X}[Θ̄], where κ ∈ {M, ι_{i}, E, μ}. M^{X}[Θ̄], ι_{i}^{X}[Θ̄] and μ^{X}[Θ̄] follow straightforwardly by inductive hypothesis. E^{X}[Θ̄] follows by transfinite induction and the inductive hypothesis.

• M is a constant. Straightforward.

□

5.3 Soundness

Lemma 5.3.1 (Soundness) For any derivable judgement Γ ⊢^{−} J we know that [[Γ]] is defined. Furthermore:

• If Γ ⊢^{−} A kind and ρ ∈ [[Γ]] then [[A]](ρ) is defined.

• If Γ ⊢^{−} M : A and ρ ∈ [[Γ]] then [[A]](ρ) and [[M]](ρ) are defined and [[M]](ρ) ∈ [[A]](ρ).

• If Γ ⊢^{−} A = B and ρ ∈ [[Γ]] then [[A]](ρ) and [[B]](ρ) are defined and [[A]](ρ) = [[B]](ρ).

• If Γ ⊢^{−} M = N : A and ρ ∈ [[Γ]] then [[M]](ρ), [[N]](ρ) and [[A]](ρ) are defined, [[M]](ρ) = [[N]](ρ), [[M]](ρ) ∈ [[A]](ρ) and [[N]](ρ) ∈ [[A]](ρ).

Proof By induction on derivations in UTT^{−}:

• (Emp). Immediate.

• (Weak). By inductive hypothesis [[Γ]] is defined and if ρ ∈ [[Γ]] then [[A]](ρ) is defined, so [[Γ, x:A]] is defined.

• (Var). By inductive hypothesis [[Γ_{0}, x:A, Γ_{1}]] is defined, and by definition ρ ∈ [[Γ_{0}, x:A, Γ_{1}]] implies that there are N and ρ_{0} ∈ [[Γ_{0}]] such that N ∈ [[A]](ρ_{0}). By Contexts (Lemma 4.5.3) we know that each x_{i} ∈ dom(Γ_{0}, x:A, Γ_{1}) is distinct and FV(A) ⊆ dom(Γ_{0}), so ρ(x) = N ∈ [[A]](ρ_{0}) = [[A]](ρ) by Lemma 5.2.3.

• (Π). By inductive hypothesis [[Γ, x:A_{1}]] is defined, so by definition [[Γ]] is defined and [[A_{1}]](ρ) is defined if ρ ∈ [[Γ]]. Therefore, if v ∈ [[A_{1}]](ρ) then ρ[x := v] ∈ [[Γ, x:A_{1}]], so by inductive hypothesis [[A_{2}]](ρ[x := v]) is defined, which means that [[(x:A_{1})A_{2}]](ρ) is defined.

• (λ). By inductive hypothesis and the definition of the interpretation of contexts.

• (App). By inductive hypothesis if ρ ∈ [[Γ]] then [[M_{1}]](ρ) and [[(x:A_{1})A_{2}]](ρ) are defined and [[M_{1}]](ρ) ∈ [[(x:A_{1})A_{2}]](ρ), and also [[M_{2}]](ρ) and [[A_{1}]](ρ) are defined and [[M_{2}]](ρ) ∈ [[A_{1}]](ρ). Therefore

[[M_{1}(M_{2})]](ρ) = [[M_{1}]](ρ)([[M_{2}]](ρ))
∈ [[A_{2}]](ρ[x := [[M_{2}]](ρ)]) = [[[M_{2}/x]A_{2}]](ρ)

by definition and Lemma 5.2.4.

• (Type). Immediate.

• (El). By inductive hypothesis if ρ ∈ [[Γ]] then [[A]](ρ) ∈ [[Type]], so [[El(A)]](ρ) is defined.

• (=T). By inductive hypothesis if ρ ∈ [[Γ]] then [[M]](ρ), [[A]](ρ), and [[B]](ρ) are defined, [[M]](ρ) ∈ [[A]](ρ) and [[A]](ρ) = [[B]](ρ). Hence [[M]](ρ) ∈ [[B]](ρ).

• (=R). Similar to the previous case.

• (KRefl)(KSym)(KTrans)(Refl)(Sym)(Trans). By inductive hypothesis.

• (Π-Eq). By reasoning similar to (Π).

• (λ-Eq). By inductive hypothesis [[Γ, x:A_{1}]] is defined, so by definition [[Γ]] is defined and [[A_{1}]](ρ) is defined if ρ ∈ [[Γ]]. We also know by inductive hypothesis that [[B_{1}]](ρ) is defined and that [[A_{1}]](ρ) = [[B_{1}]](ρ) if ρ ∈ [[Γ]]. Therefore if v ∈ [[A_{1}]](ρ) then ρ[x := v] ∈ [[Γ, x:A_{1}]] and by inductive hypothesis [[M_{0}]](ρ[x := v]) and [[N_{0}]](ρ[x := v]) are defined and equal. Hence by extensionality

λv ∈ [[A_{1}]](ρ).[[M_{0}]](ρ[x := v]) = λv ∈ [[B_{1}]](ρ).[[N_{0}]](ρ[x := v])

and by reasoning similar to (λ) they are both in [[(x:A_{1})A_{2}]](ρ).

• (App-Eq). By reasoning similar to (App).

• (β). By inductive hypothesis [[Γ, x:A_{1}]] is defined, so by definition [[Γ]] is defined and [[A_{1}]](ρ) is defined for ρ ∈ [[Γ]]. Also by inductive hypothesis, ρ ∈ [[Γ]] implies that [[M_{2}]](ρ) is defined and in [[A_{1}]](ρ), so ρ[x := [[M_{2}]](ρ)] ∈ [[Γ, x:A_{1}]]. By a final application of the inductive hypothesis we have that [[M_{0}]](ρ[x := [[M_{2}]](ρ)]) and [[A_{2}]](ρ[x := [[M_{2}]](ρ)]) are defined and

[[M_{0}]](ρ[x := [[M_{2}]](ρ)]) ∈ [[A_{2}]](ρ[x := [[M_{2}]](ρ)])

Chapter 5. A Set-Theoretic Model Construction 142

so by definition of the interpretation and Lemma 5.2.4 we have that

[[([x:A_{1}]M_{0})(M_{2})]](ρ)

= (λv ∈ [[A_{1}]](ρ).[[M_{0}]](ρ[x := v]))([[M_{2}]](ρ))
= [[M_{0}]](ρ)ρ[x := [[M_{2}]](ρ)]
= [[[M_{2}/x]M_{0}]](ρ)

and [[A_{2}]](ρ[x := [[M_{2}]](ρ)]) = [[[M_{2}/x]A_{2}]](ρ).

• (El-Eq). By inductive hypothesis.

• (Prop). Immediate.

• (Prf). If v ∈ {∅, {∗}} then v ∈ V_{κ}.

• (∀). Both possible values are in {∅, {∗}}.

• (Λ). Suppose

ρ ∈ [[Γ]]
A ∈ [[Type]]
P ∈ Πa ∈ A.[[Prop]]
g ∈ Πa ∈ A.P (a)

We show that ∗ ∈ [[∀]](A, P) by case analysis on [[∀]](A, P):

– [[∀]](A, P) = {∗}, where for all a ∈ A we have P (a) = {∗}. Then ∗ ∈ {∗} = [[∀]](A, P).

– [[∀]](A, P) = ∅. Then there is an a ∈ A such that g(a) ∈ P (a) = ∅, which is a contradiction.

• (E_{∀}). Suppose

ρ ∈ [[Γ]]
A ∈ [[Type]]
P ∈ Πa ∈ A.[[Prop]]
R ∈ Πp ∈ [[∀]](A, P).[[Prop]]
f ∈ Πg ∈ (Πa ∈ A.P (a)).R([[Λ]](A, P, g))
z ∈ [[∀]](A, P)

Then by analyzing the possible values of [[∀]](A, P) we show that f(λa ∈ A.∗) ∈ R(z):

– [[∀]](A, P) = {∗}, where for all a ∈ A we have P (a) = {∗}. Then (λa ∈ A.∗) ∈ Πa ∈ A.P (a) and

f(λa ∈ A.∗) ∈ R([[∀]](A, P, λa ∈ A.∗)) = R(z)

where the equality holds because [[Λ]](A, P, λa ∈ A.∗) = ∗ = z.

– [[∀]](A, P) = ∅. Then z ∈ [[∀]](A, P) is a contradiction.

• (Prop-Eq). Again suppose

ρ ∈ [[Γ]]
A ∈ [[Type]]
P ∈ Πa ∈ A.[[Prop]]
R ∈ Πp ∈ [[∀]](A, P).[[Prop]]
f ∈ Πg ∈ (Πa ∈ A.P (a)).R([[Λ]](A, P, g))
g ∈ Πa ∈ A.P (a)

Then

[[E_{∀}]](A, P, R, f, [[Λ]](A, P, g)) = f(g)

follows from g = λa ∈ A.∗, which we show by analyzing the possible values of [[∀]](A, P):

– [[∀]](A, P) = {∗}, where for all a ∈ A we have P (a) = {∗}. Then for each a ∈ A we have g(a) = ∗ ∈ {∗}, so by extensionality g = λa ∈ A.∗.

– [[∀]](A, P) = ∅. Then there is an a ∈ A such that g(a) ∈ P (a) and P (a) = ∅, which is a contradiction.

• (M^{X}[Θ̄]). By inductive hypothesis we know that [[Γ′]] is defined for all (Γ′, A) ∈ Types_{Γ}(Θ̄), and we have that [[A]](ρ) is defined and in [[Type]] for all ρ ∈ [[Γ′]]. Hence [[M^{X}[Θ̄]]](ρ) ∈ [[Type]].

• (ι_{i}^{X}[Θ̄]). We know that intro_{i} ∈ Θ_{i}_{ρ}^{#}([[M^{X}[Θ̄]]](ρ)) → [[M^{X}[Θ̄]]](ρ), so

Θ̄^{→}(intro_{i}) ∈ [[Θ_{i}]](ρ[X := [[M^{X}[Θ̄]]](ρ)]) = [[Θ_{i}[M^{X}[Θ̄]]]](ρ)

by Lemma 5.1.3 and Lemma 5.2.4.

• (E^{X}[Θ̄]). Suppose

ρ ∈ [[Γ]]
C ∈ [[M^{X}[Θ̄]]](ρ) → [[Type]]
f_{1} ∈ [[Θ_{1}^{∘}(M^{X}[Θ̄], C, ι_{1}^{X}[Θ̄])]](ρ[C := C])
…
f_{n} ∈ [[Θ_{n}^{∘}(M^{X}[Θ̄], C, ι_{n}^{X}[Θ̄])]](ρ[C := C])

We show by transfinite induction on α that if M ∈ (Θ̄_{ρ}^{#})^{α} then R^{α}(M) is defined and in C(M):

– α = 0. Trivial.

– α = succ(β). If

M ∈ (Θ̄_{ρ}^{#})^{succ(β)} = Θ̄_{ρ}^{#}((Θ̄_{ρ}^{#})^{β})

then M = intro_{i}(N_{1}, …, N_{n}), where ∗ N_{j} ∈ [[M_{i,j}]](ρ[X := (Θ̄_{ρ}^{#})^{β}][x_{1}, …, x_{j−1} := N_{1}, …, N_{j−1}]),

∗ Θ_{i} ≡ (x_{1}:M_{1}) … (x_{m}:M_{m})X, and

∗ M_{i_{1}}, …, M_{i_{p}} are the strictly positive operators for Θ_{i}. Then for each 1 ≤ j ≤ p, let M_{i_{j}} ≡ (y_{1}:A_{1}) … (y_{q}:A_{q})X. We know that if P_{k} ∈ [[A_{i,j,k}]](ρ[x_{1}, …, y_{1}, …:= N_{1}, …, P_{1}, …]) for 1 ≤ k ≤ q then N_{j}(P_{1}, …, P_{q}) ∈ (Θ̄_{ρ}^{#})^{β}, so by inductive hypothesis

R^{β}(N_{j}(P_{1}, …, P_{q})) ∈ C(N_{j}(P_{1}, …, P_{q}))

Therefore

[[Φ_{i_{j}}^{♮}[A, C, f, z]]](ρ[A := [[M^{X}[Θ̄]]](ρ)][C := C][f := R^{β}][z := N_{i_{j}}])

∈ [[Φ_{i_{j}}^{∘}[A, C, z]]](ρ[A := [[M^{X}[Θ̄]]](ρ)][C := C][z := N_{i_{j}}])

so [[E^{X}[Θ̄]]](ρ) is defined. Finally, we know that

f_{i}(N_{1}, …, N_{n}, [[Φ_{i_{1}}^{♮}[A, C, f, z]]](ρ[A := [[M^{X}[Θ̄]]](ρ)][C := C][f := R^{β}][z := N_{i_{j}}]), …)

∈ [[C(ι_{i}^{X}[Θ̄](x_{1}, …, x_{n}))]](ρ[x_{1}, …, x_{n} := N_{1}, …, N_{n}])
= C(intro_{i}(N_{1}, …, N_{n}))

– Limit α. By inductive hypothesis.

• (Θ̄-Eq). We need to show that

[[Φ_{i_{j}}^{♮}[A, C, f, z]]](ρ[A := [[M^{X}[Θ̄]]](ρ)][C := C][f := R^{β}][z := N_{i_{j}}])

= [[Φ_{i_{j}}^{♮}[A, C, f, z]]](ρ[A := [[M^{X}[Θ̄]]](ρ)][C := C][f := R^{α_{0}}][z := N_{i_{j}}])

for any β such that N_{i_{j}} ∈ [[Φ_{i_{j}}]](ρ[X := (Θ̄_{ρ}^{#})^{β}]). This follows by transfinite induction on α_{0}.

• (κ-Eq). By inductive hypothesis we know that

[[Θ_{i}]](ρ[X := S]) = [[Θ′_{i}]](ρ[X := S])

for any S ∈ [[Type]] and 1 ≤ i ≤ n, so Θ_{i}_{ρ}^{#} = Θ′_{i}_{ρ}^{#}. Hence Θ̄_{ρ}^{#} = Θ̄′_{ρ}^{#}, so the interpretations of the operators on these schemas are equal.

• (U)(T)(prop)(prf). Straightforward.

• (μ^{X}[Θ̄]). Similar to (M^{X}[Θ̄]), using [[U]] in the place of [[Type]]. We know for every (Γ′, A) ∈ Types_{Γ}(Θ̄′) that A ≡ T(a) for some a, so [[a]](ρ′) ∈ V_{κ_{0}} for any ρ′ ∈ [[Γ′]].

□

Soundness

In this chapter we show that UTT^{S} is sound for UTT: that is,

• if Γ ⊢ A kind then there is a B such that Γ ⊢^{S} A →^{nf} B,

• if Γ ⊢ M : A then there are P and B such that Γ ⊢^{S} A →^{nf} B and Γ ⊢^{S} M →^{nf} P : B,

• if Γ ⊢ A = B then there is a C such that Γ ⊢^{S} A ↓ B [C] : and

• if Γ ⊢ M = N : A then there are P and B such that Γ ⊢^{S} A →^{nf} B and Γ ⊢^{S} M ↓ N [P] : B.

As we have mentioned frequently before, the soundness result is crucial to our treatment of the metatheory of UTT. It is through soundness and completeness for UTT^{S} that we transfer the metatheoretic development of UTT^{S} to UTT. Of particular interest is that we use this new system to show strengthening and subject reduction for UTT.

The technique we use to show soundness is closely related to existing proofs of normalization. However, by instead showing soundness for the system UTT^{S}, we are able to make more explicit the exact conditions needed in the proof: the rules of inference of UTT^{S} show that the well-typed terms are exactly those constructed with the canonical constructors of the kinds and a series of weak head expansions. Furthermore, as we mentioned in Section 4.10, the reasoning used to show strong normalization is applicable to other important results about reduction as well, and the rules of inference for UTT^{S} provide a general structure for showing such results.

6.1 Normalization Proofs

We have already discussed normalization proofs in Section 2.4.1. In this section we shall concentrate on proofs of normalization for type theories with dependent types.

We mentioned in Section 2.4.1 that the standard proof of normalization for the simply typed lambda calculus relies on an infinite number of variables of each type. For simple types, where there is no dependency of types upon terms, it is easy to see how to enumerate all of the types. The extension to systems with dependent types has been developed by Pottinger [65] and Luo [44]. These proofs introduce an infinite context with infinitely many variables of each type and shows that any term typable in the original system is typable in this infinite context. However, we shall again use the technique of a Kripke-style model construction which we used in Chapter 2.

A standard technique for showing normalization for simpler type systems interprets types as sets of terms which need not be well-typed. Gallier [28] discusses the proof of normalization for System F using untyped interpretations in detail, following Tait [77] and Mitchell [61]. Altenkirch [4] and Geuvers [30] use a similar technique for the more difficult system of the Calculus of Constructions, which has dependent types.

However, in our proof we are interested in soundness for the formal system UTT^{S} instead of simple normalization, so by definition we need to construct a model with well-typed terms. In our view, the improvements this approach leads to in the study of the metatheory, as developed in Chapter 4, justify the added complexity of a full soundness proof even for simpler systems like the Calculus of Constructions, because our typed operational semantics is so well suited to studying the relationship between reduction and well-typed terms. We have already discussed this in detail in Section 4.9.

There are several proofs of normalization that do not use infinite contexts and interpret types as sets of well-typed terms. Martin-Löf [53] gives an early such proof, which as we mentioned in Section 2.4.1 uses a restricted reduction relation to avoid the need for the general notion of substitution. This proof also uses a typed reduction relation, similar to our typed operational semantics. Coquand [15] uses a Kripke-style model construction to show normalization of a subset of Martin-Löf type theory using sets of well-typed terms.

It seems that we could also construct the model in this chapter for UTT^{S}, which would prove the admissibility of application and substitution for UTT^{S} without reference to UTT. Studying the close relationship between terms and derivations as expressed by Uniqueness of Normal Forms (Lemma 4.9.2) might lead to a better proof method. This topic seems to be an area for further research, and we discuss possible directions briefly in Section 7.2.

Our proof follows standard techniques for proving normalization [52,44,15]. However, we note the following differences:

• We prove the result for UTT, a type theory presented in the Logical Framework which has a predicative universe, a wide class of inductive types, and an impredicative universe of propositions. The impredicativity in particular forces us to use a complicated proof technique.

• Our proof requires strong normalization as a component of the definition of the interpretation of kinds, following Martin-Löf [52] and Koletsos [41]. This means that we need neither Luo’s quasi-normalization result [44] nor strengthening in our proof of normalization.

• We give an explicit set-theoretic construction of the complexity measure which we use in the proof.

• Again, we are proving soundness for the system UTT^{S} instead of normalization. This, in conjunction with the completeness theorem, means that all of the metatheory we have developed for UTT^{S} will transfer to UTT. In particular, we shall have strengthening, subject reduction and Church–Rosser, in addition to strong normalization, as consequences of the soundness theorem.

6.2 An Overview of the Proof

In this section we shall give a general description of the proof of soundness of UTT^{S} for UTT. We intend to give a description of the important points in the proof without going into technical details.

Normalization and soundness proofs in general are done by model constructions. Our first concern in a model construction is the semantic domain of discourse. In Section 6.3 we define the semantic objects for our soundness proof.

Because we are proving soundness for UTT^{S}, the primary component of our semantic objects will be terms with derivations of well-typedness in UTT^{S}. We shall show that, relative to any substitution, all terms which are well-typed in UTT are in the interpretation of their kinds, where the kinds are interpreted as sets of terms which are well-typed in UTT^{S}.

It is well known that combining the strong logical principle of impredicativity with other principles can easily lead to inconsistency. Girard showed that Martin-Löf’s original type theory, with an axiom of Type: Type, was inconsistent, and he later showed that a system with two levels of impredicativity is inconsistent as well [14]. Hence, an important first step in showing the consistency of a type theory is to give a complexity measure on the types of the theory, since the systems mentioned above fail to have such a measure.

As we mentioned in Chapter 5, we use the set-theoretic model to derive a complexity measure. One intuition for the complexity measure is that we need to be able to give a “natural” set-theoretic interpretation for the non-propositional types. The idea is that one component of the interpretation is essentially the set-theoretic interpretation, but where types are sets of terms. This allows us to model substitution for quantification on types. For example, if we want to interpret the impredicative proposition ∀(Prop, [X:Prop]X), which quantifies over propositions, we need to be able to consider arbitrary possible interpretations of propositions. The interpretation of the quantification will be the intersection of the interpretation of all these possible interpretations. We shall need this not only for propositions but for any type in the type theory, although not the kinds of the Logical Framework. However, since the interpretation of the impredicative universe will be one of the first defined, we need to know all of the semantic objects before the interpretation is defined.

This problem motivates the definition of value sets. The value sets are intended to capture the possible set-theoretic behaviors of elements of each type: for propositions A the values are sets of terms of type El(Prf(A)) with special conditions on these sets, for functions the values are functions from values for the domain to values for the range, and so on.

Luo [44] uses what he calls a quasi-normalization result to give such a complexity measure for the type theory ECC. He gives this definition of the measure by considering types in a quasi-normal form, where the type constructors for Π, Σ and universes can all be distinguished. He therefore shows that all types can be reduced to another type of this form before the full normalization result.

We have avoided needing such a result in two ways. First, because we do not use Tait’s specific non-structural technique for proving normalization, as discussed in Section 2.4.2, we can always know that the type of a term is normalizing by inductive hypothesis in the course of the proof. We therefore have a technique that would not require quasi-normalization for ECC but could still use Luo’s simple complexity measure by considering the normal forms. However, our complexity measure is defined by considering the complexity of the set-theoretic interpretation, which does not rely on normal forms in any way. We have needed to use this complexity measure not because of difficulty in obtaining normal forms but because there seems to be no simple measure for types in UTT, even if we restrict ourselves to the types in normal form. We have discussed this problem in Appendix A.

In order to give a Kripke-style interpretation of the type theory, we need semantic values to be closed under transitions, which for us will be context extensions δ from Δ′ to Δ. Because of Renaming (Lemma 4.9.9), we know that terms typed in UTT^{S} are closed under context extensions. To allow the semantic objects, which include values, to be similarly closed, we index the values by context extensions. Therefore our semantic objects at a context Δ will be pairs of a term well-typed in UTT^{S} at context Δ and a family of values, indexed by context extensions δ from Δ′ to Δ. The formal definition of semantic objects and value sets is given in Definition 6.3.1. We also define the obvious notions of monotonicity mon_{δ}(.) (Definition 6.3.3) and application APP_{Δ}(., .) (Definition 6.3.4) on these objects.

Coquand and Gallier’s proof[17], using Kripke-style models, seems to fail because their notion of substitution is not closed under context extensions. There is no way to pass from a substitution from Δ to Γ to a substitution from Δ′ to Γ if δ is a renaming from Δ′ to Δ. As we have seen already in the proof of soundness for the simply typed lambda calculus, this extensibility is an essential property of substitution. We also need the property which we call coherence (Lemma 6.5.2), which states the distributivity of monotonicity and the interpretation. We discuss this more in Section 6.4, and the essential problem with the paper is addressed by Lemma 6.4.5. Ritter [68] has also addressed this problem, using a Kripkelike interpretation to show strong normalization for a version of the Calculus of Constructions presented with categorical combinators.

The equality we intend for semantic objects is that two semantic objects are equal if the term components have the same normal form and the indexed value components are equal at all extensions. In the course of our soundness proof, we shall need to show that the application equality rule (App-Eq) is sound: in particular, we shall need to know that if (M, v_{M}) is a semantic object for (x:A_{1})A_{2} at Δ and (N_{1}, v) and (N_{2}, v) are equal semantic objects for A_{1} at Δ then APP_{Δ}((M, v_{M}), (N_{1}, v)) = APP_{Δ}((M, v_{M}), (N_{2}, v)). For this to be the case, the function in the value v_{M} will need to return values which depend only on the normal form of the term component of the argument. Many proofs of normalization give this requirement as part of the definition of values, but we follow Coquand [13] in giving this instead as a predicate on semantic objects, uniformity (Definition 6.3.6).

Section 6.4 is a short section which introduces the notion of environments for the semantic objects and gives the expected definitions of equality and uniformity for these environments, lifted from equality and uniformity for semantic objects.

We have now defined the semantic objects we shall use throughout the proof. Section 6.5 follows Streicher’s technique [75] by giving a partial interpretation of terms to semantic objects and kinds to sets of semantic objects, relative to an environment of semantic objects, as we have already discussed in Section 5.1. However, in showing that the interpretation is a semantic object if it is defined, we need to show simultaneously the distributivity of monotonicity and the interpretation. We also define the interpretation for contexts as environments whose semantic objects are elements of the interpretations of the constituent kinds (Definition 6.5.3).

Indeed, the similarity of this entire development with Chapter 5 suggests that a better approach might be to give a soundness proof for a more abstract semantics, perhaps to a category-theoretic interpretation of type theory, followed by specific treatments for set theory and UTT^{S}. Altenkirch [4] uses this technique to show strong normalization of the Calculus of Constructions.

After defining the interpretation, Definition 6.5.1, we show that this interpretation function has desirable properties. Specifically, we prove by induction on the structure of terms lemmas for the interpretation about:

• changing the bound variables (Lemma 6.6.2),

• equality of the interpretation under environments which correspond on the free variables (Lemma 6.6.3),

• uniformity of the interpretation (Lemma 6.6.1), for the soundness of the application equality rule (App-Eq), and to allow us to pass from a valuation at Δ to a valuation at Δ′ given a renaming from Δ′ to Δ, and • a substitution property for the interpretation (Lemma 6.6.4), used in the

soundness of the rules (S-App) and (β).

Finally, in Section 6.7 we give the final proof of soundness by induction on derivations in UTT. This result is for any valuation in the interpretation of the context, so we prove that if ⊢Γ then there is such an valuation from Γ to Γ, which gives the exact soundness result we need.

6.3 Semantic Objects

In this section we give the important definitions for semantic objects. These include the value sets, which are one of the components of the semantic objects, the operations of monotonicity and application on semantic objects, and the property of uniformity for semantic objects.

We shall make use of the complexity measures c(A) and k(M) which we define in Appendix A. We summarize the important properties of these complexity measures:

• If Sch_{Γ;X}(Θ̄) and for any (Γ′, A) ∈ Types_{Γ}(Θ̄), where Γ′ ≡ Γ, x_{1}:A_{1}, …, x_{n}:A_{n}, if for all A_{i} we have that Γ, x_{1}:A_{1}, …, x_{i−1}:A_{i−1} ⊢ N_{i} : A_{i}, then

c(Γ ⊢ [N̄/Γ′]A kind) < c(Γ ⊢ El(M^{X}[Θ̄]) kind)

• If Γ ⊢ (x:A_{1})A_{2} kind then c(Γ ⊢ A_{1} kind) < c(Γ ⊢ (x:A_{1})A_{2} kind) and

c(Γ ⊢ [N/x]A_{2} kind) < c(Γ ⊢ (x:A_{1})A_{2} kind)

for any N such that Γ ⊢ N : A_{1}.

•

– c(Γ ⊢ El(Prop) kind) < c(Γ ⊢ El(U) kind).

– c(Γ ⊢ El(Prf(P)) kind) < c(Γ ⊢ El(U) kind) for any P such that Γ ⊢^{∗} P : Prop.

– c(Γ ⊢ El(M^{X}[Θ̄]) kind) < c(Γ ⊢ El(U) kind) if Γ ⊢ μ^{X}[Θ̄] : El(U).

• k(Γ ⊢ N_{j}(P_{1}, …, P_{p}) : M^{X}[Θ̄]) < k(Γ ⊢ ι_{i}^{X}[Θ̄](N_{1}, …, N_{n}) : M^{X}[Θ̄]) for 1 ≤ j ≤ n.

Definition 6.3.1 (Value Sets) We define the semantic objects for Δ and A SO_{Δ}(A), the value sets V (Δ ⊢^{S} M : A), and the saturated sets SAT_{Δ}(A), where we assume that Δ ⊢^{S} A →^{nf} A or Δ ⊢^{S} M →^{nf} M : A, simultaneously. The following definitions are for arbitrary normal A:

• A semantic object for Δ and A is a pair (M, v), where Δ ⊢^{S} M →^{nf} P : A and v is a family of objects v(δ) ∈ V (Δ′ ⊢^{S} P : A), indexed by renamings δ from Δ′ to Δ.

• SO_{Δ}(A) is the set of semantic objects for Δ and A.

• S is a saturated set for Δ and A, notation SAT_{Δ}(A), if S is a set of semantic objects for Δ and A such that the following conditions hold:

(S1) If M is a base term such that Δ ⊢^{S} M →^{nf} P : A then (M, λδ.∗) is

in S, and (S2) if (N, v) is in S and Δ ⊢^{S} M →^{wh} N : A then (M, v) is in S.

• A family v(δ) of sets indexed by renamings δ from Δ′ to Δ is a saturated family of sets for Δ and A if v(δ) is a saturated set for Δ′ and A for each renaming δ from Δ′ to Δ.

The definition of V (Δ ⊢^{S} M : A), where Δ ⊢^{S} M →^{nf} M : A, is given by induction on the complexity of A:

• V (Δ ⊢^{S} M : A) =_{df} {∗} if M is a base term, for any A.

• V (Δ ⊢^{S} Λ(A, P, g) : El(Prf(∀(A, P)))) =_{df} {∗}.

• V (Δ ⊢^{S} ∀(A, P) : El(Prop)) =_{df} SAT_{Δ}(El(Prf(∀(A, P)))).

• V (Δ ⊢^{S} ι_{i}^{X}[Θ̄](N_{1}, …, N_{n}) : El(M^{X}[Θ̄])) =_{df} f_{Δ}(Θ_{i}, N_{1}, …, N_{n}), where f_{Δ}(Θ, N_{1}, …, N_{n}) is defined by induction on the complexity of M^{X}[Θ̄] and Sch_{Δ;X}^{S}(Θ_{i}):

– f_{Δ}(X, ()) =_{df} {∗}.

– f_{Δ}((x:A)Θ_{0}, N_{1}, …, N_{n}) =_{df} V (Δ ⊢^{S} N_{1} : A) × f_{Δ}(Θ′_{0}, N_{2}, …, N_{n}), where Δ ⊢^{S} [N_{1}/x]Θ_{0} →^{nf} Θ′_{0}.

–

f_{Δ}((Φ)Θ_{0}, N_{1}, …, N_{n}) =_{df} V (Δ ⊢^{S} N_{1} : Φ(M^{X}[Θ̄])) ×
f_{Δ}(Θ_{0}, N_{2}, …, N_{n})

• V (Δ ⊢^{S} prop : El(U)) =_{df} SAT_{Δ}(El(Prop)).

• V (Δ ⊢^{S} prf(∀(A, P)) : El(U)) =_{df} SAT_{Δ}(El(Prf(∀(A, P)))).

• V (Δ ⊢^{S} μ^{X}[Θ̄] : El(U)) =_{df} SAT_{Δ}(El(M^{X}[Θ̄])).

• V (Δ ⊢^{S} M : Type) =_{df} SAT_{Δ}(El(M)) if M is not a base term.

• V (Δ ⊢^{S} M : (x:A_{1})A_{2}), if M is not a base term, is the set of f such that:

– dom(f) ∈ SAT_{Δ}(A_{1}) and

– f(N, v_{N}) ∈ V (Δ ⊢^{S} P : B_{2}), where (N, v_{N}) ∈ dom(f), Δ ⊢^{S} M(N) →^{nf} P : B_{2} and Δ ⊢^{S} [N/x]A_{2} →^{nf} B_{2}.

There are several important points about this definition:

• The induction is well defined by Completeness (Lemma 4.9.5) and the complexity measure in Appendix A.

• By Strong Normalization, semantic objects are always strongly normalizing. Also, if Δ ⊢^{S} M →^{nf} P : A then Δ ⊢^{S} P →^{nf} P : A by Adequacy for Reduction and Subject Reduction.

• The cases of the definition are exhaustive by Generation (Lemma 4.9.1) and unique by Uniqueness of Normal Forms (Lemma 4.9.2).

• We shall use the usual symbol for equality on semantic objects to denote the least equivalence relation which includes α-equivalence on the first component.

• In many proofs of normalization for impredicative calculi in the literature [44,17] there is a lemma stating that for any context Δ, term M and kind A there is a canonical value v_{Δ,M,A} ∈ V (Δ ⊢^{S} M : A). However, this lemma is only used for base terms, to allow the context to be extended under binders. In our formulation it is obvious that if Δ ⊢^{S} M →^{nf} P : A and P is a base term then ∗ ∈ {∗} = V (Δ ⊢^{S} P : A).

• The domain of a function in the value set for dependent product kinds (x:A_{1})A_{2} need not be the whole of SO_{Δ}(A_{1}). This is because when we define the interpretation of [x:A_{1}]M_{0}, for example, the domain of the function defined will need to be the interpretation of A_{1}, since the inductive hypothesis will only apply for elements of this set. This is the reason that base terms always have the same value set regardless of their kind, because we do not know the interpretation of A_{1} beforehand but we need to know that base terms are always in saturated sets.

• Because of Uniqueness of Normal Forms, we shall not distinguish between terms M well-typed in context Δ in UTT^{S} and proofs of Δ ⊢^{S} M →^{nf} P : A.

Lemma 6.3.2 For any kind A such that Δ ⊢^{S} A →^{nf} B, we have SO_{Δ}(B) ∈ SAT_{Δ}(B).

Proof Straightforward. □

Definition 6.3.3 (Monotonicity) If (M, v_{M}) is a semantic object for Δ and A and δ is a renaming from Δ′ to Δ then

mon_{δ}(M, v_{M}) =_{df} (δ̂(M), λδ′.v_{M}(δ′ ∘ δ))

By construction we know that mon_{δ}(M, v_{M}) is a semantic object for Δ′ and A.

Definition 6.3.4 (Application) Let (M_{1}, v_{1}) be a semantic object for Δ and (x:A_{1})A_{2} such that Δ ⊢^{S} M_{1} →^{nf} P_{1} : (x:A_{1})A_{2}, and (M_{2}, v_{2}) be a semantic object for Δ and A_{1} such that Δ ⊢^{S} M_{2} →^{nf} P_{2} : A_{1}. We show that there is a B_{2} such that Δ ⊢^{S} [M_{2}/x]A_{2} →^{nf} B_{2} and define

APP_{Δ}((M_{1}, v_{1}), (M_{2}, v_{2})) ∈ SO_{Δ}(B_{2})

the partial function for semantic application:

• If P_{1} is a base term and Δ ⊢^{S} [M_{2}/x]A_{2} →^{nf} B_{2} then

APP_{Δ}((M_{1}, v_{1}), (M_{2}, v_{2})) =_{df} (M_{1}(M_{2}), ∗)

where Δ ⊢^{S} M_{1}(M_{2}) →^{nf} P_{1}(P_{2}) : B_{2} by (S-App).

• If P_{1} is not a base term and mon_{δ}(M_{2}, v_{2}) ∈ dom(v_{1}(δ)) for all renamings δ from Δ′ to Δ then

APP_{Δ}((M_{1}, v_{1}), (M_{2}, v_{2})) =_{df} (M_{1}(M_{2}), λδ.v_{1}(δ)(mon_{δ}(M_{2}, v_{2})))

where Δ ⊢^{S} [M_{2}/x]A_{2} →^{nf} B_{2} and Δ ⊢^{S} M_{1}(M_{2}) →^{nf} P : B_{2} by definition of v_{2}(id_{Δ}) ∈ V (Δ ⊢^{S} M_{1} : (x:A_{1})A_{2}).

Lemma 6.3.5

APP_{Δ′′}(mon_{δ′∘δ}(M, v_{M}), mon_{δ′}(N, v_{N}))
= mon_{δ′}(APP_{Δ′}(mon_{δ}(M, v_{M}), (N, v_{N})))

Proof Straightforward by the definitions of application and monotonicity, using Thinning (Lemma 4.9.11). □

Notation We write (M, v_{M}) ↓ (N, v_{N}) if (M, v_{M}) and (N, v_{N}) are semantic objects for Δ and A, there is a P such that Δ ⊢^{S} M ↓ N [P] : A, and v_{M} = v_{N}.

Chapter 6. Soundness 159 Definition 6.3.6 (Uniform Semantic Objects) Let S be a saturated family of sets for Δ and A. Then S is uniform if (M, v_{M}) ∈ S(δ) implies that (M, v_{M}) is uniform and mon_{δ′}(M, v_{M}) ∈ S(δ′ ∘ δ) for all renamings δ′ from Δ′′ to Δ′.

A semantic object (M, v_{M}) for Δ and A is uniform if:

• M is a base term,

• M ≡ ∀(A, P) and v_{M} is uniform,

• M ≡ Λ(A, P, g),

• M ≡ ι_{i}^{X}[Θ̄](N_{1}, …, N_{n}) and (N_{i}, v_{i}) is uniform for 1 ≤ i ≤ n,

• M ≡ prop and v_{M} is uniform,

• M ≡ prf(∀(A, P)) and v_{M} is uniform,

• M ≡ μ^{X}[Θ̄] and v_{M} is uniform,

• A ≡ Type, M is not a base term and v_{M} is uniform, or

• Δ ⊢^{S} M →^{nf} P : (x:A_{1})A_{2} and (U1) λδ.dom(v_{M}(δ)) is uniform, (U2) if (N, v_{N}) ∈ dom(v(δ)) then APP_{Δ′}(mon_{δ}(M, v_{M}), (N, v_{N})) is uni-

form, and (U3) if (N_{1}, v_{1}) ↓ (N_{2}, v_{2}) then

APP_{Δ′}(mon_{δ}(M, v_{M}), (N_{1}, v_{1})) ↓ APP_{Δ′}(mon_{δ}(M, v_{M}), (N_{2}, v_{2}))

We have adopted Coquand’s technique [13] of separating this condition from the definition of the value sets. This allows us to simplify the definition of value sets and to prove that the interpretation is uniform (Lemma 6.6.1) separate from proving that the interpretation is well-defined (Lemma 6.5.2).

The definition of uniformity is not as basic as it could be. We could instead have separated it into a property of monotonicity and a property about semantic objects for (x:A_{1})A_{2} being effectively functions on equivalence classes of terms quotiented by having a common normal form (property (U3)).

Definition 6.3.7 (Uniform Semantic Objects) The set of uniform semantic objects for Δ and A, notation USO_{Δ}(A), is the set of semantic objects for Δ and A which are uniform.

Lemma 6.3.8 We list several simple properties of uniform semantic objects:

• USO_{Δ}(A) is uniform and in SAT_{Δ}(A).

• If (M, v_{M}) is a uniform semantic object then mon_{δ}(M, v_{M}) is also a uniform semantic object, for any renaming δ from Δ′ to Δ.

6.4 Valuations

We recall from Section 4.9 that a pre-substitution is an environment for terms.

Definition 6.4.1 (Substitution) A substitution ϕ from Δ to Γ, where Γ ≡ x_{1}:A_{1}, …, x_{m}:A_{m} and ⊢^{S}Δ, is a pre-substitution over Γ such that

Δ ⊢^{S} ϕ̂(A_{i}) →^{nf} B_{i} and Δ ⊢^{S} ϕ(x_{i}) →^{nf} P : B_{i} for 1 ≤ i ≤ m.

A pre-valuation is an environment for semantic objects at some context Δ.

Definition 6.4.2 (Valuation) A valuation from Δ to Γ is a pre-valuation such that the term component is a substitution from Δ to Γ.

Definition 6.4.3 (Confluent Valuations) Let ρ_{1} and ρ_{2} be valuations from Δ to Γ. Then if there is a P such that Δ ⊢^{S} ϕ_{1}(x) ↓ ϕ_{2}(x) [P] : ϕ̂_{1}(A) and val_{1}(x) = val_{2}(x) for all (x:A) ∈ Γ, we say that ρ_{1} and ρ_{2} are confluent valuations for Γ at Δ.

Definition 6.4.4 (Uniform Valuation) A valuation ρ from Δ to Γ is uniform if ρ(x) is uniform for all (x:A) ∈ Γ.

Lemma 6.4.5 If ρ is a valuation from Δ to Γ and δ is a renaming from Δ′ to Δ then mon_{δ}(ρ) is a valuation from Δ′ to Γ.

Proof By Thinning and the definitions of monotonicity and valuation. □

6.5 The Interpretation

We give a partial interpretation function from terms to semantic objects and from kinds to sets of semantic objects. For a further discussion of the technique for partial interpretations of terms to define models for type theory we refer the reader to Section 5.1.

As we mentioned in Section 6.2, the value of the interpretation function for a term relative to a valuation from Δ to Γ is a semantic object for Δ, which is a pair of a term well-typed in UTT^{S} in context Δ and a family of values indexed by renamings from Δ′ to Δ. However, we are somewhat informal in our treatment of the interpretation with respect to terms which are well-typed in UTT^{S}. In the definition of the interpretation we only give the term rather than a derivation of its well-typedness, but we justify this by Lemma 6.5.2, which shows that the term is indeed well-typed in UTT^{S} and that the interpretation of a term is a semantic object.

Definition 6.5.1 (Interpretation) We define the interpretation of terms [[M]]ρΔ and of kinds [[A]]ρΔ by induction on the structure of M and A.

[[M]]ρΔ is always a pair (ϕ̂(M), V [[M]]ρΔ), with V [[M]]ρΔ a family of values indexed by δ from Δ′ to Δ, defined as below:

• V [[x]]ρΔ =_{df} val(x) if x ∈ dom(ρ).

• [[(x:A_{1})A_{2}]]ρΔ is defined if for some x ∉ dom(ρ)

Chapter 6. Soundness 162 – Δ ⊢^{S} ϕ̂(A_{1}) →^{nf} B_{1},

– Δ, y:ϕ̂(A_{1}) ⊢^{S} { \atop ϕ[x := y]}(A_{2}) →^{nf} B_{2} for any y fresh in Δ

– [[A_{1}]]ρΔ is defined, uniform and a saturated family of sets for Δ and B_{1}, and

– for any renaming δ from Δ′ to Δ and any (M_{2}, v_{2}) ∈ [[A_{1}]]ρΔ(δ) ∗ Δ′ ⊢^{S} [M_{2}/x]B_{2} →^{nf} B′_{2} and

∗ [[A_{2}]]mon_{δ}(ρ)[x := (M_{2}, v_{2})]Δ′ is defined and a saturated family of

sets for Δ′ and B′_{2}, where Δ′ ⊢^{S} { \atop ϕ[x := M_{2}]}(A_{2}) →^{nf} B′_{2}. [[(x:A_{1})A_{2}]]ρΔ(δ) is the set of (M_{1}, v_{1}) such that

– (M_{1}, v_{1}) is a uniform semantic object for Δ′ and (x:B_{1})B_{2} and

– for all renamings δ′ from Δ′ to Δ:

∗ if M_{1} is not a base term then dom(v_{1}(δ′)) = [[A_{1}]]mon_{δ′∘δ}(ρ)Δ′′(id_{Δ′′}) and

∗ for all (M_{2}, v_{2}) ∈ [[A_{1}]]mon_{δ′∘δ}(ρ)Δ′′(id_{Δ′′}),

APP_{Δ′′}(mon_{δ′}(M_{1}, v_{1}), (M_{2}, v_{2}))
∈ [[A_{2}]]mon_{δ′∘δ}(ρ)[x := (M_{2}, v_{2})]Δ′′(id_{Δ′′})

• [[[x:A_{1}]M_{0}]]ρΔ is defined if for some x ∉ dom(ρ) – Δ ⊢^{S} ϕ̂(A_{1}) →^{nf} B_{1},

– Δ, y:ϕ̂(A_{1}) ⊢^{S} { \atop ϕ[x := y]}(M_{0}) →^{nf} [y/x]P_{0} : B_{2} for any y fresh in Δ,

– [[A_{1}]]ρΔ is defined, uniform and a saturated family of sets for Δ and B_{1} and

– [[M_{0}]]mon_{δ}(ρ)[x := (M_{2}, v_{2})]Δ′ is defined and in SO_{Δ′}(B′_{2}), for any renaming δ from Δ′ to Δ and any (M_{2}, v_{2}) ∈ [[A_{1}]]ρΔ(δ), where Δ′ ⊢^{S} [M_{2}/x]B_{2} →^{nf} B′_{2}.

V [[[x:A_{1}]M_{0}]]ρΔ(δ) =_{df} ∗ if P_{0} ≡ P (x), where x ∉ FV(P) and P is a base term.

Chapter 6. Soundness 163

Otherwise,

V [[[x:A_{1}]M_{0}]]ρΔ(δ) =_{df} λ(M_{2}, v_{2})
∈ [[A_{1}]]mon_{δ}(ρ)Δ′(id_{Δ′}).V [[M_{0}]]mon_{δ}(ρ)[x := (M_{2}, v_{2})]Δ′(id_{Δ′})

• [[M_{1}(M_{2})]]ρΔ is defined if:

– [[M_{1}]]ρΔ is defined and in USO_{Δ}((x:B_{1})B_{2}), where Δ ⊢^{S} ϕ̂(M_{1}) →^{nf} P_{1} : (x:B_{1})B_{2},

– [[M_{2}]]ρΔ is defined and in USO_{Δ}(B_{1}),

– if P_{1} is a base term then Δ ⊢^{S} [ϕ̂(M_{2})/x]A_{2} →^{nf} B′_{2} and

– if P_{1} is not a base term then [[M_{2}]]ρΔ ∈ dom(V [[M_{1}]]ρΔ(id_{Δ})). [[M_{1}(M_{2})]]ρΔ =_{df} APP_{Δ}([[M_{1}]]ρΔ, [[M_{2}]]ρΔ)

• [[Type]]ρΔ(δ) =_{df} USO_{Δ′}(Type).

• [[El(M_{0})]]ρΔ is defined if [[M_{0}]]mon_{δ}(ρ)Δ′ is defined and in USO_{Δ′}(Type) for

any renaming δ from Δ′ to Δ, where Δ ⊢^{S} ϕ̂(M_{0}) →^{nf} P_{0} : Type.

[[El(M_{0})]]ρΔ(δ) =_{df} \begin{cases}V [[M_{0}]]mon_{δ}(ρ)Δ′(id_{Δ′}) & P_{0} not a base term \\ USO_{Δ′}(El(P_{0})) & P_{0} a base term \end{cases}

• V [[Prop]]ρΔ(δ) =_{df} USO_{Δ′}(El(Prop)).

• V [[Prf]]ρΔ(δ) =_{df} λ(P, v_{P}) ∈ [[El(Prop)]]mon_{δ}(ρ)Δ′(id_{Δ′}).v_{P}.

• V [[∀]]ρΔ(δ) is the function which given – (A, v_{A}) ∈ [[Type]]mon_{δ}(ρ)Δ′(id_{Δ′}) and

– (P, v_{P}) ∈ [[(El(A))El(Prop)]]mon_{δ}(ρ)[A := (A, v_{A})]Δ′(id_{Δ′}) gives the saturated set S such that if (g, v_{g}) ∈ [[(x:El(A))El(Prf(P (x)))]]mon_{δ}(ρ)[A := (A, v_{A})][P := (P, v_{P})]Δ′(id_{Δ′}) where Δ′ ⊢^{S} A ↓ A′ [A′′] : Type and Δ′ ⊢^{S} P ↓ P′ [P′′] : (El(A′′))El(Prop), then (Λ(A′, P′, g), λδ.∗) ∈ S.

• V [[Λ]]ρΔ(δ) is the function which given arguments in the appropriate domains returns ∗.

• V [[E_{∀}]]ρΔ(δ) is the function which given arguments in the appropriate domains returns ∗.

• [[M^{X}[Θ̄]]]ρΔ is defined if Δ, Y:Type ⊢^{S} { \atop ϕ[X := Y]}(Θ_{i}) →^{nf} Θ′_{i} for some X ∉ dom(ρ) and any Y fresh in Δ, and [[Θ_{i}]]ρ′Δ′ is defined for any valuation ρ′ from Δ′ to Γ, X:Type.

V [[M^{X}[Θ̄]]]ρΔ(δ) is defined by transfinite induction on the ordinal α_{0} to be the least saturated set S such that if

– (M_{j}, v_{j}) ∈ [[M_{j}]]mon_{δ}(ρ)[X := S][x_{1} := (M_{1}, v_{1})] … Δ′(id_{Δ′}) and

– Δ′, Y:Type ⊢^{S} { \atop ϕ[X := Y]}(Θ_{j}) ↓ Θ′_{j} [Θ′′_{j}] for any Y fresh in Δ′

for 1 ≤ j ≤ n then

(ι_{i}^{X}[Θ̄′](N_{1}, …, N_{n}), λδ′.<v_{1}(δ′), …, v_{n}(δ′)>) ∈ S

• [[ι_{i}^{X}[Θ̄]]]ρΔ is defined if Δ, Y:Type ⊢^{S} { \atop ϕ[X := Y]}(Θ_{i}) →^{nf} Θ′_{i} for some X ∉ dom(ρ) and for any Y fresh in Δ, and [[Θ_{i}]]ρ′Δ′ is defined for any valuation ρ′ from Δ′ to Γ, X:Type.

V [[ι_{i}^{X}[Θ̄]]]ρΔ(δ) =_{df} λ(M_{1}, v_{1}) ∈ [[M_{1}]]mon_{δ}(ρ[X := [[M^{X}[Θ̄]]]ρΔ])Δ′(id_{Δ′}). … λ(M_{n}, v_{n}) ∈ [[M_{n}]]mon_{δ}(ρ[X := [[M^{X}[Θ̄]]]ρΔ])[x_{1} := (M_{1}, v_{1})] … Δ′(id_{Δ′}).

<v_{1}(id_{Δ′}), …, v_{n}(id_{Δ′})>

• [[E^{X}[Θ̄]]]ρΔ is defined if Δ, Y:Type ⊢^{S} { \atop ϕ[X := Y]}(Θ_{i}) →^{nf} Θ′_{i}, for some X ∉ dom(ρ) and for any Y fresh in Δ, and [[Θ_{i}]]ρ′Δ′ is defined for any valuation ρ′ from Δ′ to Γ, X:Type.

Assume

(C, v_{C}) ∈ [[(X)Type]]mon_{δ}(ρ)[X := [[M^{X}[Θ̄]]]mon_{δ}(ρ)Δ′]Δ′(id_{Δ′}).
(f_{1}, v_{f_{1}}) ∈ [[Θ_{1}^{∘}[A, C, z]]]ρ′_{1}Δ′(id_{Δ′})
…
(f_{n}, v_{f_{n}}) ∈ [[Θ_{n}^{∘}[A, C, z]]]ρ′_{n}Δ′(id_{Δ′})

where

ρ′_{i} =_{df} mon_{δ}(ρ)[A := [[M^{X}[Θ̄]]]mon_{δ}(ρ)Δ′][C := (C, v_{C})][z := [[ι_{i}^{X}[Θ̄]]]mon_{δ}(ρ)Δ′]

for 1 ≤ i ≤ n. Then V [[E^{X}[Θ̄]]]ρΔ(δ)((C, v_{C}), (f_{1}, v_{f_{1}}), …, (f_{n}, v_{f_{n}})) =_{df} R^{α} is the partial function defined by transfinite induction on the complexity of M^{X}[Θ̄]:

– α = 0. Then

R^{0} =_{df} λ(M, v_{M}) ∈ [[El(M^{X}[Θ̄])]]mon_{δ}(ρ)Δ′(id_{Δ′}).
∗  if M is a base term
R^{0}(N, v_{M}) if Δ′ ⊢^{S} M →^{wh} N : El(M^{X}[Θ̄])

– α = succ(β). Let (M, v_{M}) ∈ [[El(M^{X}[Θ̄])]]mon_{δ}(ρ)Δ′(id_{Δ′}). Then ∗ R^{succ(β)}(M, v_{M}) =_{df} ∗ if M is a base term,

∗ R^{succ(β)}(M, v_{M}) =_{df} R^{succ(β)}(N, v_{M}) if Δ′ ⊢^{S} M →^{wh} N : El(M^{X}[Θ̄]) and R^{succ(β)}(N, v_{M}) is defined, and

∗ let Φ_{i_{1}}, …, Φ_{i_{j}} be the strictly positive operators in Θ and define Φ_{i_{k}}^{∗} to be the interpretation of Φ_{i_{k}}^{♮}[A, C, f, z] under the valuation ρ[A := [[M^{X}[Θ̄]]]ρΔ][C := (C, v_{C})][f := R^{β}][z := (N_{i_{k}}, v_{i_{k}})], for 1 ≤ k ≤ j. Then

R^{succ(β)}(M, v_{M}) =_{df} v_{f_{i}}(N_{1}, …, N_{n}, Φ_{i_{1}}^{∗}, …, Φ_{i_{j}}^{∗})

if M ≡ ι_{i}^{X}[Θ̄′](N_{1}, …, N_{n}) and

Φ_{i_{k}}^{∗}

∈ [[Φ^{∘}[A, C, z]]]ρ[A := [[M^{X}[Θ̄]]]ρΔ][C := (C, v_{C})][z := (N_{i_{k}}, v_{i_{k}})]Δ

for 1 ≤ k ≤ j.

– Limit α. Then R^{α}(M, v_{M}) =_{df} R^{β}(M, v_{M}), where β =_{df} ⋂{γ ∈ α | M ∈ [[M^{X}[Θ̄]]]ρΔ^{γ}(δ)}.

• V [[U]]ρΔ(δ) is the saturated set S such that if

– (M, v_{M}) is a uniform semantic object for Δ′ and El(U) and

– M ≡ prop, M ≡ prf(P) or M ≡ μ^{X}[Θ̄]

then (M, v_{M}) ∈ S.

• V [[prop]]ρΔ(δ) =_{df} USO_{Δ′}(El(Prop)).

• V [[prf]]ρΔ(δ) =_{df} λ(P, v_{P}) ∈ [[El(Prop)]]mon_{δ}(ρ)Δ′(id_{Δ′}).v_{P} (id_{Δ′}).

• [[μ^{X}[Θ̄]]]ρΔ is defined if there are Θ̄′ such that for each (Γ′, A) ∈ Types_{Γ}(Θ̄′) there is an a such that A ≡ T (a), Δ, Y:Type ⊢^{S} { \atop ϕ[X := Y]}(Θ_{i}) ↓ Θ′_{i} [Θ′′_{i}] for 1 ≤ i ≤ n, and [[Θ_{i}]]ρ′Δ′ is defined for any valuation ρ′ from Δ′ to Γ, X:Type.

In this case V [[μ^{X}[Θ̄]]]ρΔ is the same family of sets defined for V [[M^{X}[Θ̄]]]ρΔ.

• V [[T]]ρΔ(δ) =_{df} λ(M, v_{M}) ∈ [[El(U)]]mon_{δ}(ρ)Δ′(id_{Δ′}).v_{M}(id_{Δ′}).

We rely more heavily in this chapter on the alternative induction principle for terms introduced in Section 4.3 than we did in Chapter 5. This is because in the set-theoretic model we always know that Πv ∈ A.B(x) is defined if A and B(x) are defined, whereas in the interpretation here the interpretation of Π is sometimes undefined.

We have chosen our definition of the interpretation of U for convenience. The definition is simple because the computation rule for the universe is simple, only changing the outermost constructor prop, prf or μ^{X}[Θ̄] to its type-level equivalent Prop, Prf or M^{X}[Θ̄]. We could instead define the value of the interpretation to be USO_{Δ′}(El(U)), which would require us to reason in UTT^{S} to show that T is well-defined. If we had an elimination rule for the universe then we would need to define the interpretation by induction on the complexity of types in the universe, similar to the interpretation of inductive types.

Lemma 6.5.2 (Well-Definedness of the Interpretation) Suppose ρ is a valuation from Δ to Γ. Then:

Well-Definedness

• If [[M]]ρΔ is defined then there is a B such that [[M]]ρΔ ∈ SO_{Δ}(B).

• If [[A]]ρΔ is defined then Δ ⊢^{S} A →^{nf} B and [[A]]ρΔ ∈ SAT_{Δ}(B).

Coherence If δ is a renaming from Δ′ to Δ and then

• if [[A]]ρΔ is defined then mon_{δ}([[A]]ρΔ) = [[A]]mon_{δ}(ρ)Δ′.
• if [[M]]ρΔ is defined then mon_{δ}([[M]]ρΔ) = [[M]]mon_{δ}(ρ)Δ′.

Proof By simultaneous induction on the structure of M and A.

For Coherence, the terms are identical because

{ \atop δ ∘ ϕ}(M) ≡ δ̂(ϕ̂(M))

The second component of the interpretation is always a family of values indexed by a renaming δ from Δ′ to Δ, and the interpretation of each subterm is used relative to δ. Hence we only need

mon_{δ′∘δ}(ρ) = mon_{δ′}(mon_{δ}(ρ))

which is trivial.

Well-Definedness is as follows:

• M ≡ x. By definition Δ ⊢^{S} ϕ̂(A) →^{nf} B and ρ(x) is a semantic object for Δ and B.

• A ≡ (x:A_{1})A_{2}. Suppose the conditions we require for [[(x:A_{1})A_{2}]]ρΔ to be defined are met. This means that Δ ⊢^{S} ϕ̂(A_{1}) →^{nf} B_{1} and Δ, y:ϕ̂(A_{1}) ⊢^{S}

{ \atop ϕ[x := y]}(A_{2}) →^{nf} B_{2}, so Δ ⊢^{S} ϕ̂((x:A_{1})A_{2}) →^{nf} (y:B_{1})B_{2} by (S-Π).

To show [[(x:A_{1})A_{2}]]ρΔ defined, we need to show that the application used in the definition is well-defined. Suppose δ is a renaming from Δ′ to Δ and (M_{1}, v_{1}) is a uniform semantic object for Δ′ and (y:B_{1})B_{2}, where Δ′ ⊢^{S} M_{1} →^{nf} P_{1} : (y:B_{1})B_{2}. If P_{1} is a base term then by assumption Δ′′ ⊢^{S} [M_{2}/y]B_{2} →^{nf} B′_{2} for any (M_{2}, v_{2}) ∈ [[A_{1}]]ρΔ(δ′ ∘ δ). If P_{1} is not a base term then dom(v_{1}(δ′′)) = [[A_{1}]]ρΔ(δ′′ ∘ (δ′ ∘ δ)) for any renaming δ′′ from Δ′′′ to Δ′′, and if (M_{2}, v_{2}) ∈ [[A_{1}]]ρΔ(δ′ ∘ δ) then by the definition of uniformity mon_{δ′′}(M_{2}, v_{2}) ∈ [[A_{1}]]ρΔ(δ′′ ∘ (δ′ ∘ δ)).

To show [[(x:A_{1})A_{2}]]ρΔ(δ) ∈ SAT_{Δ}((x:B_{1})B_{2}) we need to show properties (S1) and (S2) for [[(x:A_{1})A_{2}]]ρΔ(δ):

(S1) Suppose M_{1} is a base term such that Δ′ ⊢^{S} M_{1} →^{nf} P_{1} : δ̂((x:B_{1})B_{2}) and δ′ is a renaming from Δ′′ to Δ′. Then if (M_{2}, v_{2}) ∈ [[A_{1}]]ρΔ(δ′ ∘ δ) then Δ′′ ⊢^{S} M_{2} →^{nf} P_{2} : B_{1}, so M_{1}(M_{2}) is a base term such that Δ′′ ⊢^{S} M_{1}(M_{2}) →^{nf} P_{1}(P_{2}) : { \atop ϕ[x := M_{2}]}(A_{2}) by Renaming and (S-App). Hence by inductive hypothesis and (S1) we know that

APP_{Δ′′}(mon_{δ′}(M_{1}, ∗), (M_{2}, v_{2}))
∈ [[A_{2}]]mon_{δ′∘δ}(ρ)[x := (M_{2}, v_{2})]Δ′′(id_{Δ′′})

(S2) Suppose – Δ′ ⊢^{S} M_{1} →^{wh} N_{1} : (x:B_{1})B_{2},

– (N_{1}, v_{1}) ∈ [[(x:A_{1})A_{2}]]ρΔ(δ) and

– δ′ is a renaming from Δ′′ to Δ′.

Then if (M_{2}, v_{2}) ∈ [[A_{1}]]mon_{δ′∘δ}(ρ)Δ′′(id_{Δ′′}) then Δ′′ ⊢^{S} M_{2} →^{nf} P_{2} : B_{1} and Δ′′ ⊢^{S} [M_{2}/x]B_{2} →^{nf} B′_{2}, and

APP_{Δ′′}(mon_{δ′}(N_{1}, v_{1}), (M_{2}, v_{2}))
∈ [[A_{2}]]mon_{δ′∘δ}(ρ)[x := (M_{2}, v_{2})]Δ′′(id_{Δ′′})

by definition of [[(x:A_{1})A_{2}]]ρΔ. Hence Δ′′ ⊢^{S} M_{1}(M_{2}) →^{wh} N_{1}(M_{2}) : B′_{2} by Renaming and (S-App-WH), so by inductive hypothesis and (S2) for [[A_{2}]]mon_{δ′∘δ}(ρ)[x := (M_{2}, v_{2})]Δ′′(id_{Δ′′}) we know that

APP_{Δ′′}(mon_{δ′}(M_{1}, v_{1}), (M_{2}, v_{2}))
∈ [[A_{2}]]mon_{δ′∘δ}(ρ)[x := (M_{2}, v_{2})]Δ′′(id_{Δ′′})

• M ≡ [x:A_{1}]M_{0}. If [[[x:A_{1}]M_{0}]]ρΔ is defined then Δ ⊢^{S} ϕ̂(A_{1}) →^{nf} B_{1} and

Δ, y:ϕ̂(A_{1}) ⊢^{S} { \atop ϕ[x := y]}(M_{0}) →^{nf} P_{0} : B_{2}. If P_{0} ≡ P (y) with y ∉ FV(P)

then Δ ⊢^{S} ϕ̂([x:A_{1}]M_{0}) →^{nf} P : (x:B_{1})B_{2} by (S-η’), and otherwise Δ ⊢^{S} ϕ̂([x:A_{1}]M_{0}) →^{nf} [y:B_{1}]P_{0} : (y:B_{1})B_{2} by (S-λ). Let P be the normal form in either case. P need not be an abstraction or a base term because of the possibility of an η-reduction.

Suppose P is a base term. Then ∗ ∈ {∗} = V (Δ′ ⊢^{S} P : (x:B_{1})B_{2}) for any renaming δ from Δ′ to Δ.

Otherwise, suppose δ is a renaming from Δ′ to Δ and (M_{2}, v_{2}) ∈ [[A_{1}]]ρΔ(δ). We need to show that V [[[x:A_{1}]M_{0}]]ρΔ(δ) ∈ V (Δ′ ⊢^{S} P : (y:B_{1})B_{2}):

– dom(V [[[x:A_{1}]M_{0}]]ρΔ(δ)) = [[A_{1}]]ρΔ(δ) ∈ SAT_{Δ′}(B_{1}) by inductive hypothesis (Coherence) and assumption.

– We know that Δ′ ⊢^{S} [M_{2}/x]B_{2} →^{nf} B′_{2} and

[[M_{0}]]mon_{δ}(ρ)[x := (M_{2}, v_{2})]Δ′ ∈ SO_{Δ′}(B′_{2})

so Δ′ ⊢^{S} { \atop ϕ[x := M_{2}]}(M_{0}) →^{nf} P′ : B′_{2} and

V [[M_{0}]]mon_{δ}(ρ)[x := (M_{2}, v_{2})]Δ′(id_{Δ′}) ∈ V (Δ′ ⊢^{S} P′ : B′_{2})

We also have Δ′ ⊢^{S} ϕ̂([x:A_{1}]M_{0})(M_{2}) →^{nf} P′ : B′_{2} by Renaming, (S-β) and (S-WH), and Δ′ ⊢^{S} [M_{2}/x]B_{2} →^{nf} B′_{2} by assumption.

• M ≡ M_{1}(M_{2}). Suppose [[M_{1}(M_{2})]]ρΔ is defined. Then we have exactly the conditions required for APP_{Δ}([[M_{1}]]ρΔ, [[M_{2}]]ρΔ) to be defined, in particular because [[M_{1}]]ρΔ is uniform.

• A ≡ Type. By (S-Type) and Lemma 6.3.2.

• A ≡ El(M_{0}). By definition [[M_{0}]]ρΔ ∈ USO_{Δ}(Type) and Δ ⊢^{S} M_{0} →^{nf} P_{0} : Type, so Δ ⊢^{S} El(M_{0}) →^{nf} El(P_{0}) by (S-El). If P_{0} is not a base term then V [[M_{0}]]mon_{δ}(ρ)Δ′(id_{Δ′}) ∈ V (Δ′ ⊢^{S} P_{0} : Type) = SAT_{Δ′}(El(P_{0})) by inductive hypothesis (Coherence), and if P_{0} is a base term then USO_{Δ′}(El(P_{0})) ∈ SAT_{Δ′}(El(P_{0})) by Lemma 6.3.8.

• M ≡ Prop. We know that Δ ⊢^{S} Prop →^{nf} Prop : El(U) by (S-C).

Suppose δ is a renaming from Δ′ to Δ. Then by Lemma 6.3.8

V [[Prop]]ρΔ(δ) = USO_{Δ′}(El(Prop))
∈ SAT_{Δ′}(El(Prop)) = V (Δ′ ⊢^{S} Prop : Type)

• M ≡ Prf. We know that Δ ⊢^{S} Prf →^{nf} Prf : (El(Prop))Type by (S-C).

Suppose δ is a renaming from Δ′ to Δ. Then:

– dom(V [[Prf]]ρΔ(δ)) = [[El(Prop)]]mon_{δ}(ρ)Δ′(id_{Δ′}) ∈ SAT_{Δ′}(El(Prop)) by inductive hypothesis, Well-Definedness and Coherence.

– Suppose (P, v_{P}) ∈ [[El(Prop)]]mon_{δ}(ρ)Δ′(id_{Δ′}). Then Δ′ ⊢^{S} P →^{nf} P′ : El(Prop) implies that Δ′ ⊢^{S} Prf(P) →^{nf} Prf(P′) : Type. If P′ is a base term then

v_{P} (id_{Δ′}) ∈ V (Δ′ ⊢^{S} P′ : El(Prop)) = {∗} = V (Δ′ ⊢^{S} Prf(P′) : Type)

and if P′ is not a base term then

v_{P} (id_{Δ′}) ∈ V (Δ′ ⊢^{S} P′ : El(Prop))
= SAT_{Δ′}(El(Prf(P′))) = V (Δ′ ⊢^{S} Prf(P′) : Type)

• M ≡ ∀. We know that Δ ⊢^{S} ∀ →^{nf} ∀ : ((El(A))El(Prop))El(Prop) by (S-C), so suppose δ is a renaming from Δ′ to Δ. We need to show that

V [[∀]]ρΔ(δ) ∈ V (Δ′ ⊢^{S} ∀ : (A:Type)((El(A))El(Prop))El(Prop))

The domains are saturated sets by inductive hypothesis, and also Δ′ ⊢^{S} (El(A))El(Prop) →^{nf} B. Hence, suppose

(A, v_{A}) ∈ [[Type]]mon_{δ}(ρ)Δ′(id_{Δ′})
(P, v_{P}) ∈ [[(El(A))El(Prop)]]mon_{δ}(ρ)[A := (A, v_{A})]Δ′(id_{Δ′})

We know that Δ′ ⊢^{S} A →^{nf} A′ : Type. Then B ≡ (El(A′))El(Prop) by Generation and Uniqueness of Normal Forms, so Δ′ ⊢^{S} P →^{nf} P′ :

(El(A′))El(Prop). Hence Δ′ ⊢^{S} ∀(A, P) →^{nf} ∀(A′, P′) : Type follows by (S-App).

Finally, we need

V [[∀]]ρΔ(δ)((A, v_{A}), (P, v_{P})) ∈ V (Δ′ ⊢^{S} ∀(A′, P′) : El(Prop))
= SAT_{Δ′}(El(Prf(∀(A′, P′))))

but this follows by construction.

• M ≡ Λ. We know that Λ is normalizing, so we need to show that if δ is a renaming from Δ′ to Δ then V [[Λ]]ρΔ(δ) is in its value set.

We again know by inductive hypothesis that each of the domains is a saturated set. Furthermore, if

(A, v_{A}) ∈ [[Type]]mon_{δ}(ρ)Δ′(id_{Δ′})
(P, v_{P}) ∈ [[(El(A))El(Prop)]]mon_{δ}(ρ)[A := (A, v_{A})]Δ′(id_{Δ′})
(g, v_{g}) ∈ [[(x:El(A))El(Prf(P (x)))]]mon_{δ}(ρ)[A := (A, v_{A})][P := (P, v_{P})]Δ′(id_{Δ′})

then Δ′ ⊢^{S} A →^{nf} A′ : Type, Δ′ ⊢^{S} P →^{nf} P′ : (El(A′))El(Prop) and Δ′ ⊢^{S} g →^{nf} g′ : (x:El(A′))El(Prf(P′(x))) by Generation and Uniqueness of Normal Forms. Hence Δ′ ⊢^{S} Λ(A, P, g) →^{nf} Λ(A′, P′, g′) : El(Prf(∀(A′, P′))).

Finally,

V [[Λ]]ρΔ(δ)((A, v_{A}), (P, v_{P}), (g, v_{g})) = ∗
∈ {∗} = V (Δ′ ⊢^{S} Λ(A′, P′, g′) : El(Prf(∀(A′, P′))))

• M ≡ E_{∀}. We know that the domains are saturated sets by inductive hypothesis.

Suppose δ is a renaming from Δ′ to Δ and

(A, v_{A}) ∈ [[Type]]mon_{δ}(ρ)Δ′(id_{Δ′})
(P, v_{P}) ∈ [[(El(A))El(Prop)]]mon_{δ}(ρ)[A := (A, v_{A})]Δ′(id_{Δ′})

and that (R, v_{R}), (f, v_{f}) and (M, v_{M}) are in the interpretations of the appropriate kinds. By definition of uniform semantic object and the interpretation of Π, we know that Δ′ ⊢^{S} R(M) →^{nf} B : El(Prop) and that (M, v_{M}) ↓ (N, v_{M}) implies Δ′ ⊢^{S} R(M) ↓ R(N) [B] : El(Prop). Also, Δ′ ⊢^{S} E_{∀}(A, P, R, f) →^{nf} E_{∀}(A′′, P′′, R′, f′) : (M:El(Prf(∀(A′′, P′′))))El(B_{M}). We show that Δ′ ⊢^{S} E_{∀}(A, P, R, f, M) →^{nf} Q : B by induction on the construction of [[El(Prf(∀(A, P)))]]mon_{δ}(ρ)[A := (A, v_{A})][P := (P, v_{P})]Δ′(id_{Δ′}), from which it follows that

(E_{∀}(A, P, R, f, M), λδ′.∗) ∈ SO_{Δ′}(B)

– M is a base term such that Δ′ ⊢^{S} M →^{nf} Q : El(Prf(∀(A′, P′))). Then E_{∀}(A, P, R, f, M) is a base term and E_{∀}(A, P, R, f) is an objectlevel pre-redex, so Δ′ ⊢^{S} E_{∀}(A, P, R, f, M) →^{nf} E_{∀}(A′′, P′′, R′, f, Q) : El(Prf(B)) by (S-base).

– Δ′ ⊢^{S} M →^{wh} N : El(Prf(∀(A′, P′))) and (N, v_{N}) ∈ [[El(Prf(∀(A, P)))]]mon_{δ}(ρ)[A := (A, v_{A})][P := (P, v_{P})]Δ′(id_{Δ′}) By inductive hypothesis Δ′ ⊢^{S} E_{∀}(A, P, R, f, N) →^{nf} Q : El(Prf(B)), and Δ′ ⊢^{S} E_{∀}(A, P, R, f, M) →^{wh} E_{∀}(A, P, R, f, N) : El(Prf(B)) by (S-base). Hence Δ′ ⊢^{S} E_{∀}(A, P, R, f, M) →^{nf} Q : El(Prf(B)) by (S-WH).

– M ≡ Λ(A′, P′, g), where Δ′ ⊢^{S} A ↓ A′ [A′′] : Type, Δ′ ⊢^{S} P ↓ P′ [P′′] : (El(A′′))El(Prop) and (g, v_{g}) ∈ [[(x:El(A))El(Prf(P (x)))]]mon_{δ}(ρ)[A := (A, v_{A})][P := (P, v_{P})]Δ′ Since this last set is saturated by inductive hypothesis, we know that Δ′ ⊢^{S} g →^{nf} g′ : (x:El(A′′))El(Prf(P′_{x})), where Δ′ ⊢^{S} P′(x) →^{nf} P′_{x} : El(Prop), so Δ′ ⊢^{S} Λ(A, P, g) ↓ Λ(A′, P′, g) [Λ(A′′, P′′, g′)] : El(Prf(∀(A′′, P′′))). Then

APP_{Δ′}((f, v_{f}), (g, v_{g}))

∈ [[El(Prf(R(Λ(A, P, g))))]]ρ′Δ′(id_{Δ′})

where ρ′ is mon_{δ}(ρ) extended by A, P, R, f and g, and the set is saturated by inductive hypothesis and the definition of the interpretation. Hence Δ′ ⊢^{S} f(g) →^{nf} Q : El(Prf(B)), and

Δ′ ⊢^{S} E_{∀}(A, P, R, f, Λ(A′, P′, g)) →^{wh} f(g) : El(Prf(B))

implies that Δ′ ⊢^{S} E_{∀}(A, P, R, f, Λ(A′, P′, g)) →^{nf} Q : El(Prf(B)) by (S-WH).

• M ≡ M^{X}[Θ̄]. If [[M^{X}[Θ̄]]]ρΔ is defined then Δ, Y:Type ⊢^{S} { \atop ϕ[X := Y]}(Θ_{j}) →^{nf} Θ′_{j} for 1 ≤ j ≤ n, so Δ ⊢^{S} ϕ̂(M^{X}[Θ̄]) →^{nf} M^{Y} [Θ̄′] : Type by (S-κ).

Furthermore, the set defined is a saturated set at each renaming δ from Δ′ to Δ by construction.

• M ≡ ι_{i}^{X}[Θ̄]. If [[ι_{i}^{X}[Θ̄]]]ρΔ is defined then Δ, Y:Type ⊢^{S} { \atop ϕ[X := Y]}(Θ_{j}) →^{nf} Θ′_{j} for 1 ≤ j ≤ n, so Δ ⊢^{S} ϕ̂(ι_{i}^{X}[Θ̄]) →^{nf} ι_{i}^{Y} [Θ̄′] : Θ′_{i}(M^{Y} [Θ̄′]) by (S-κ).

Suppose δ is a renaming from Δ′ to Δ and

(M_{j}, v_{j}) ∈ [[M_{j}]]mon_{δ}(ρ[X := [[M^{X}[Θ̄]]]ρΔ])[x_{1} := (M_{1}, v_{1})] … Δ′(id_{Δ′})

for 1 ≤ j ≤ m, which means that Δ′ ⊢^{S} N_{j} →^{nf} N′_{j} : B with Δ′ ⊢^{S}

{ \atop ϕ[X := ϕ̂(M^{X}[Θ̄])][x_{1} := N_{1}] …[x_{j−1} := N_{j−1}]}(M_{j}) →^{nf} B.

Each of the domains is a saturated set by inductive hypothesis, so we only need to show that Δ′ ⊢^{S} ι_{i}^{X}[Θ̄](N_{1}, …, N_{n}) →^{nf} P : El(M^{X}[Θ̄′]) and

V [[ι_{i}^{X}[Θ̄]]]ρΔ(δ)((M_{1}, v_{1}), …, (M_{n}, v_{n})) ∈ V (Δ′ ⊢^{S} P : El(M^{X}[Θ̄′]))

The first of these follows by (S-App), since ι_{i}^{X}[Θ̄](N_{1}, …, N_{j}) is always weak head normal. The second follows by construction.

• M ≡ E^{X}[Θ̄]. If [[ι_{i}^{X}[Θ̄]]]ρΔ is defined then Δ, Y:Type ⊢^{S} { \atop ϕ[X := Y]}(Θ_{j}) →^{nf} Θ′_{j} for 1 ≤ j ≤ n, so Δ ⊢^{S} ϕ̂(E^{X}[Θ̄]) →^{nf} E^{X}[Θ̄′] : A^{X}[Θ̄′] by (S-κ).

Suppose δ is a renaming from Δ′ to Δ and (C, v_{C}), (f_{i}, v_{f_{i}}) and (M, v_{M}) are in the interpretations of the appropriate kinds, where (C, v_{C}) is uniform.

We already know that E^{X}[Θ̄](C, f_{1}, …, f_{n}) is well-typed in UTT^{S} of the appropriate type, that Δ′ ⊢^{S} C(M) →^{nf} B : El(Prop) and that if (M, v_{M}) ↓ (N, v_{M}) then Δ′ ⊢^{S} C(M) ↓ C(N) [B] : El(Prop).

We show by transfinite induction on α that R^{α}(M, v_{M}) ∈ SO_{Δ′}(B) for all (M, v_{M}) ∈ [[M^{X}[Θ̄]]]ρΔ^{α}(δ):

– α = 0. Then (M, v_{M}) ∈ [[M^{X}[Θ̄]]]ρΔ^{0}(δ) implies that M is a base term or a weak head expansion. These cases are similar to the proof for E_{∀}.

– α = succ(β). By induction on the construction of [[M^{X}[Θ̄]]]ρΔ^{succ(β)}(δ). The cases for base terms and weak head expansions are again straightforward, so we only demonstrate the proof for the constructor case. We know that

(M_{j}, v_{j}) ∈ [[M_{j}]]mon_{δ}(ρ)[X := [[M^{X}[Θ̄]]]ρΔ^{β}][x_{1} := (M_{1}, v_{1})] … Δ′(id_{Δ′})

and Δ′, Y:Type ⊢^{S} { \atop ϕ[X := Y]}(Θ_{j}) ↓ Θ′_{j} [Θ′′_{j}] for any Y fresh in Δ′. Let Φ_{i_{k}}^{∗} be the interpretation of Φ_{i_{k}}^{♮}[A, C, f, z] under the valuation mon_{δ}(ρ[A := [[M^{X}[Θ̄]]]ρΔ])[C := (C, v_{C})][f := R^{β}][z := (N_{i_{k}}, v_{i_{k}})]. By assumption we know that

Φ_{i_{k}}^{∗}
∈ [[Φ_{i_{k}}^{∘}[A, C, z]]]mon_{δ}(ρ[A := [[M^{X}[Θ̄]]]ρΔ])[C := (C, v_{C})][z := (N_{i_{k}}, v_{i_{k}})]Δ′(id_{Δ′})

for 1 ≤ k ≤ j. Hence by definition

APP_{Δ}((f_{i}, v_{f_{i}}), (N_{1}, v_{1}), …, (N_{n}, v_{n}), Φ_{i_{1}}^{∗}, …, Φ_{i_{j}}^{∗})
∈ [[C(ι_{i}^{X}[Θ̄](x_{1}, …, x_{n}))]]ρ[x_{1} := (N_{1}, v_{1})] …[x_{n} := (N_{n}, v_{n})]Δ′(id_{Δ′})

so Δ′ ⊢^{S} f_{i}(N_{1}, …, N_{n}, ϕ̂(Φ^{♮}[M^{X}[Θ̄], C, E^{X}[Θ̄](C, f_{1}, …, f_{n}), N_{i_{1}}]), …) →^{nf} P : B.

– Limit α. This follows by inductive hypothesis.

• M ≡ U. We know that Δ ⊢^{S} U →^{nf} U : Type by (S-C).

Suppose δ is a renaming from Δ′ to Δ. Then V [[U]]ρΔ(δ) ∈ SAT_{Δ′}(El(U)) = V (Δ′ ⊢^{S} U : Type) by construction.

• M ≡ prop. Similar to Prop.

• M ≡ prf. Similar to Prf.

• M ≡ μ^{X}[Θ̄]. We know that Δ ⊢^{S} ϕ̂(μ^{X}[Θ̄]) →^{nf} μ^{X}[Θ̄′′] : U by (S-μ), where the conditions for the interpretation being well-defined are sufficient for the application of the rule.

The second component is similar to M^{X}[Θ̄].

• M ≡ T. We know that Δ ⊢^{S} T →^{nf} T : (El(U))Type by (S-C).

We need to show that V [[T]]ρΔ(δ) ∈ V (Δ′ ⊢^{S} T : (El(U))Type) if δ is a renaming from Δ′ to Δ, where the domain is a saturated set by inductive hypothesis. This means we need to show that if (N, v_{N}) ∈ dom(V [[T]]ρΔ(δ)) then V [[T]]ρΔ(δ)(N, v_{N}) ∈ V (Δ′ ⊢^{S} Q : Type), where Δ′ ⊢^{S} T(N) →^{nf} Q : Type. We show this by induction on the construction of [[U]]mon_{δ}(ρ)Δ′(id_{Δ′}):

– N is a base term such that Δ′ ⊢^{S} N →^{nf} P : El(U). Then T(N) is a base term as well, so Δ′ ⊢^{S} T(N) →^{nf} T(P) : Type and

V (Δ′ ⊢^{S} P : El(U)) = {∗} = V (Δ′ ⊢^{S} T(P) : Type)

– Δ′ ⊢^{S} M →^{wh} N : El(U) and (N, v_{N}) ∈ [[U]]mon_{δ}(ρ)Δ′(id_{Δ′}). By inductive hypothesis there is a Q such that Δ′ ⊢^{S} T(N) →^{nf} Q : Type and V [[T]]ρΔ(δ)(N, v_{N}) ∈ V (Δ′ ⊢^{S} Q : Type). Then Δ′ ⊢^{S} T(M) →^{nf} Q : Type by (S-base) and (S-WH), and

V [[T]]ρΔ(δ)(M, v_{N}) = v_{N} = V [[T]]ρΔ(δ)(N, v_{N})

– N ≡ prop. Then Δ′ ⊢^{S} T(prop) →^{nf} Prop : Type and

V (Δ′ ⊢^{S} prop : El(U)) = SAT_{Δ′}(El(Prop)) = V (Δ′ ⊢^{S} Prop : Type)

– N ≡ prf(P). We know by Generation that Δ′ ⊢^{S} prf(P) →^{nf} prf(P′) : El(U) implies that Δ′ ⊢^{S} P →^{nf} P′ : El(Prop), so Δ′ ⊢^{S} Prf(P) →^{nf} Prf(P′) : Type and Δ′ ⊢^{S} T(prf(P)) →^{wh} Prf(P) : Type imply Δ′ ⊢^{S} T(prf(P)) →^{nf} Prf(P′) : Type by (S-WH). If P′ is a base term then

V (Δ′ ⊢^{S} prf(P′) : El(U)) = {∗} = V (Δ′ ⊢^{S} Prf(P′) : Type)

and if P′ is not a base term then

V (Δ′ ⊢^{S} prf(P′) : El(U)) = SAT_{Δ′}(El(Prf(P′)))
= V (Δ′ ⊢^{S} Prf(P′) : Type)

– N ≡ μ^{X}[Θ̄]. We know by Generation that Δ′ ⊢^{S} μ^{X}[Θ̄] →^{nf} μ^{X}[Θ̄′] : El(U) implies that Δ′, X:Type ⊢^{S} Θ_{i} →^{nf} Θ′_{i} for 1 ≤ i ≤ n, so Δ′ ⊢^{S} M^{X}[Θ̄] →^{nf} M^{X}[Θ̄′] : Type and Δ′ ⊢^{S} T(μ^{X}[Θ̄]) →^{wh} M^{X}[Θ̄] : U imply Δ′ ⊢^{S} T(μ^{X}[Θ̄]) →^{nf} M^{X}[Θ̄′] : Type by (S-WH). Furthermore

V (Δ′ ⊢^{S} μ^{X}[Θ̄′] : El(U)) = SAT_{Δ′}(El(M^{X}[Θ̄′]))
= V (Δ′ ⊢^{S} M^{X}[Θ̄′] : Type)

Definition 6.5.3 (Interpretation of Contexts) The interpretation of a context Γ, [[Γ]]Δ, is a set of valuations from Δ to Γ defined by induction on the structure of Γ:

• [[()]]Δ =_{df} {ϵ}.

• [[Γ, x:A]]Δ =_{df} {ρ[x := (M, v_{M})] | ρ ∈ [[Γ]]Δ and (M, v_{M}) ∈ [[A]]ρΔ(id_{Δ})}

– if [[Γ]]Δ is defined and

– [[A]]ρΔ is defined for any ρ ∈ [[Γ]]Δ.

6.6 Properties of the Interpretation

Lemma 6.6.1 (Uniformity) If ρ is a uniform valuation from Δ to Γ and [[M]]ρΔ is defined then [[M]]ρΔ is a uniform semantic object, and if ρ_{1} and ρ_{2} are confluent uniform valuations then [[M]]ρ_{1}Δ ↓ [[M]]ρ_{2}Δ.

Proof First, if ρ_{1} and ρ_{2} are confluent uniform valuations then by definition Δ ⊢^{S} ϕ_{1}(x) ↓ ϕ_{2}(x) [P_{x}] : B_{x} for every x ∈ dom(Γ), so by Adequacy for Reduction ϕ_{1}(x) ▷^{∗} P_{x} and ϕ_{2}(x) ▷^{∗} P_{x}. Let ϕ′(x) =_{df} P_{x} for every x ∈ dom(Γ). Then ϕ̂_{1}(M) ▷^{∗} ϕ̂′(M) and ϕ̂_{2}(M) ▷^{∗} ϕ̂′(M), so by Subject Reduction and Uniqueness of Normal Forms Δ ⊢^{S} ϕ̂_{1}(M) ↓ ϕ̂_{2}(M) [P] : B. Hence for the second condition we only need to show that V [[M]]ρ_{1}Δ = V [[M]]ρ_{2}Δ if ρ_{1} and ρ_{2} are confluent uniform valuations.

We prove the lemma by induction on the structure of M. Many of the cases are straightforward.

• M ≡ x. By definition.

• A ≡ (x:A_{1})A_{2}. By definition if (M, v_{M}) ∈ [[(x:A_{1})A_{2}]]ρΔ then (M, v_{M}) is uniform.

Suppose δ is a renaming from Δ′ to Δ, δ′ is a renaming from Δ′′ to Δ′ and (M, v_{M}) ∈ [[(x:A_{1})A_{2}]]ρΔ(δ). We need to show that mon_{δ′}(M, v_{M}) ∈ [[(x:A_{1})A_{2}]]ρΔ(δ′ ∘ δ). This follows trivially because if δ′′ is a renaming from Δ′′′ to Δ′′ then δ′ ∘ δ is a renaming from Δ′′′ to Δ′. Hence [[(x:A_{1})A_{2}]]ρΔ is uniform.

If ρ_{1} and ρ_{2} are confluent uniform valuations then by inductive hypothesis we know that the interpretations of A_{1} and A_{2} are equal for any confluent uniform valuations ρ′_{1} and ρ′_{2}. Since these sets determine the construction of the interpretation of (x:A_{1})A_{2}, we know that the interpretations of [[(x:A_{1})A_{2}]]ρ_{1}Δ and [[(x:A_{1})A_{2}]]ρ_{2}Δ must be equal.

• M ≡ [x:A_{1}]M_{0}. We first need to show that [[[x:A_{1}]M_{0}]]ρΔ is uniform.

(U1) By Coherence and inductive hypothesis [[A_{1}]]mon_{δ}(ρ)Δ′(id_{Δ′}) = [[A_{1}]]ρΔ(δ) is uniform.

(U2) Suppose (M_{2}, v_{2}) ∈ [[A_{1}]]mon_{δ}(ρ)Δ′(id_{Δ′}). By inductive hypothesis

[[M_{0}]]mon_{δ}(ρ)[x := (M_{2}, v_{2})]Δ′
= ([N/x]M_{0}, λδ′.V [[M_{0}]]mon_{δ}(ρ)[x_{2} := (N_{2}, v_{2})](δ′))

is uniform, and therefore so is APP_{Δ′}(mon_{δ}([[[x:A_{1}]M_{0}]]ρΔ), (M_{2}, v_{2})).

(U3) Suppose (M_{1}, v_{1}) ↓ (M_{2}, v_{2}), where both are in [[A_{1}]]mon_{δ′∘δ}(ρ)Δ′′. Then by inductive hypothesis

V [[M_{0}]]mon_{δ′∘δ}(ρ)[x := (M_{1}, v_{1})]Δ′′
= V [[M_{0}]]mon_{δ′∘δ}(ρ)[x := (M_{2}, v_{2})]Δ′′

so

λδ′.V [[[x:A_{1}]M_{0}]]mon_{δ}(ρ)Δ′(δ′)(M_{1}, v_{1})
= λδ′.V [[[x:A_{1}]M_{0}]]mon_{δ}(ρ)Δ′(δ′)(M_{2}, v_{2})

If ρ_{1} and ρ_{2} are confluent uniform valuations then mon_{δ}(ρ_{1})[x := (M_{2}, v_{2})] and mon_{δ}(ρ_{2})[x := (M_{2}, v_{2})] are confluent uniform valuations for any (M_{2}, v_{2}) ∈ [[A_{1}]]mon_{δ}(ρ_{1})Δ′ = [[A_{1}]]mon_{δ}(ρ_{2})Δ′. Hence

λδ′.V [[M_{0}]]mon_{δ}(ρ_{1})[x := (M_{2}, v_{2})]Δ′(δ′)
= λδ′.V [[M_{0}]]mon_{δ}(ρ_{2})[x := (M_{2}, v_{2})]Δ′(δ′)

• M ≡ M_{1}(M_{2}). By inductive hypothesis and the definition of uniformity.

• A ≡ Type. By definition of USO_{Δ′}(Type).

• A ≡ El(M). By inductive hypothesis.

• M ≡ ∀. The domains are again clearly uniform by inductive hypothesis. Furthermore, if

(A, v_{A}) ∈ [[Type]]mon_{δ}(ρ)Δ′
(P, v_{P}) ∈ [[(El(A))El(Prop)]]mon_{δ}(ρ)[A := (A, v_{A})]Δ′

then the set defined for V [[∀]]ρΔ(δ)((A, v_{A}), (P, v_{P})) includes all (Λ(A′, P′, g), λδ′.∗) such that Δ′ ⊢^{S} A ↓ A′ [A′′] : Type and Δ′ ⊢^{S} P ↓ P′ [P′′] : (El(A′′))El(Prop). Hence it is clear by Uniqueness of Normal Forms that if (A_{1}, v_{A_{1}}) ↓ (A_{2}, v_{A_{2}}) and (P_{1}, v_{P_{1}}) ↓ (P_{2}, v_{P_{2}}) then

V [[∀]]ρΔ(δ)((A_{1}, v_{A_{1}}), (P_{1}, v_{P_{1}})) = V [[∀]]ρΔ(δ)((A_{2}, v_{A_{2}}), (P_{2}, v_{P_{2}}))

We therefore only need to show that V [[∀]]ρΔ(δ)((A, v_{A}), (P, v_{P})) is uniform by induction on the construction of V [[∀]]ρΔ(δ)((A, v_{A}), (P, v_{P})).

– M is a base term such that Δ′ ⊢^{S} M →^{nf} N : El(Prf(∀(A′′, P′′))). Then any renaming of M is a base term as well.

– Δ′ ⊢^{S} M →^{wh} N : El(Prf(∀(A, P))) and (N, v_{N}) ∈ V [[∀]]ρΔ(δ)((A, v_{A}), (P, v_{P})). By inductive hypothesis.

– g ∈ [[(x:El(A))El(Prf(P (x)))]]mon_{δ}(ρ)[A := (A, v_{A})][P := (P, v_{P})]Δ′ implies that (Λ(A′, P′, g), ∗) ∈ V [[∀]]ρΔ(δ)((A, v_{A}), (P, v_{P})), where Δ′ ⊢^{S} A ↓ A′ [A′′] : Type and Δ′ ⊢^{S} P ↓ P′ [P′′] : (El(A′′))El(Prop). Then [[(x:El(A))El(Prf(P (x)))]]mon_{δ}(ρ)[A := (A, v_{A})][P := (P, v_{P})]Δ′ is uniform by inductive hypothesis.

The following two lemmas about the behavior of the interpretation with respect to free variables and substitution are similar to the lemmas in the construction of the set-theoretic model for UTT, Lemma 5.2.2 and Lemma 5.2.3.

Lemma 6.6.2 If ρ is a valuation from Δ to Γ and γ is an environment for variables then [[M]](ρ ∘ γ)Δ ≃ [[γ̂(M)]]ρΔ.

Proof By induction on the structure of terms, following the proof of Lemma 5.2.2. □ Lemma 6.6.3 Let ρ_{1} and ρ_{2} be two valuations from Δ to Γ. If for all x ∈ FV(M) we have that ρ_{1}(x) = ρ_{2}(x) then V [[M]]ρ_{1}Δ ≃ V [[M]]ρ_{2}Δ.

Proof By induction on the structure of terms and types, following Lemma 5.2.3. In particular we again use Lemma 6.6.2 for terms with binders. □

Lemma 6.6.4 (Substitution) If

• ρ = ρ_{0}ρ_{1} is a valuation from Δ to Γ_{0}, [N/z]Γ_{1}

• ρ[z := [[N]]ρ_{0}Δ] is a valuation from Δ to Γ_{0}, z:C, Γ_{1}, and

• [[N]]ρ_{0}Δ is a semantic object for Δ and C, where Δ ⊢^{S} ϕ̂(C) →^{nf} D,

then [[M]]ρ[z := [[N]]ρ_{0}Δ]Δ ≻ [[[N/z]M]]ρΔ.

Proof By induction on the structure of M. We give several cases:

• M ≡ x, where x ≠ z. Then [[x]]ρ[z := [[N]]ρ_{0}Δ]Δ = ρ[z := [[N]]ρ_{0}Δ](x) = ρ(x) = [[x]]ρΔ = [[[N/z]x]]ρΔ.

• M ≡ z. Then [[z]]ρ[z := [[N]]ρ_{0}Δ]Δ = [[N]]ρ_{0}Δ = [[N]]ρΔ = [[[N/z]z]]ρΔ by Lemma 6.6.3.

• A ≡ (x:A_{1})A_{2}. Suppose [[(x:A_{1})A_{2}]]ρ[z := [[N]]ρ_{0}Δ]Δ is defined for some x such that x ∉ dom(Γ_{0}, z:C, Γ_{1}). Then by definition

– Δ ⊢^{S} { \atop ϕ[z := ϕ̂(N)]}(A_{1}) →^{nf} B_{1},

– Δ, y:{ \atop ϕ[z := ϕ̂(N)]}(A_{1}) ⊢^{S} { \atop ϕ[z := ϕ̂(N)][x := y]}(A_{2}) →^{nf} B_{2} for y fresh

in Δ,

– [[A_{1}]]mon_{δ}(ρ[z := [[N]]ρ_{0}Δ])Δ′ is defined and

– [[A_{2}]]mon_{δ}(ρ[z := [[N]]ρ_{0}Δ])[x := (M_{2}, v_{2})]Δ′ is defined for any (M_{2}, v_{2}) ∈ [[A_{1}]]mon_{δ}(ρ[z := [[N]]ρ_{0}Δ])Δ′.

Chapter 6. Soundness 181

Clearly { \atop ϕ[z := ϕ̂(N)]}(A_{1}) ≡ ϕ̂([N/z]A_{1}) and

{ \atop ϕ[z := ϕ̂(N)][x := y]}(A_{2}) ≡ { \atop ϕ[x := y]}([y/x]A_{2})

Furthermore,

[[A_{1}]]mon_{δ}(ρ[z := [[N]]ρ_{0}Δ])Δ′
= [[A_{1}]]mon_{δ}(ρ)[z := mon_{δ}([[N]]ρΔ)]Δ′
= [[A_{1}]]mon_{δ}(ρ)[z := [[N]]mon_{δ}(ρ)Δ′]Δ′
= [[[N/z]A_{1}]]mon_{δ}(ρ)Δ′

by Coherence and inductive hypothesis, and similarly

[[A_{2}]]mon_{δ}(ρ[z := [[N]]ρ_{0}Δ])[x := (M_{2}, v_{2})]Δ′

= [[[N/z]A_{2}]]mon_{δ}(ρ)[x := (M_{2}, v_{2})]Δ′

for any (M_{2}, v_{2}) ∈ [[[N/z]A_{1}]]mon_{δ}(ρ)Δ′. Hence [[[N/z](x:A_{1})A_{2}]]ρΔ is defined and equal to [[(x:A_{1})A_{2}]]ρ[z := [[N]]ρ_{0}Δ]Δ.

• M is a constant. Straightforward, using the inductive hypothesis where appropriate.

• M ≡ κ^{X}[Θ̄]. These are all straightforward by inductive hypothesis and the

fact that { \atop ϕ[z := ϕ̂(N)]}(Θ_{i}) ≡ ϕ̂([N/z]Θ_{i}).

Lemma 6.6.5 Let ρ ∈ [[Γ]]Δ. Then:

• ρ is uniform, and

• if δ is a renaming from Δ′ to Δ then mon_{δ}(ρ) ∈ [[Γ]]Δ′. Proof By induction on the structure of Γ:

• Γ ≡ (). Immediate.

• Γ ≡ Γ_{0}, x:A. We know that ρ = ρ_{0}[x := (M, v_{M})], where ρ_{0} ∈ [[Γ_{0}]]Δ and (M, v_{M}) ∈ [[A]]ρ_{0}Δ(id_{Δ}). By inductive hypothesis ρ_{0} is uniform and mon_{δ}(ρ_{0}) ∈ [[Γ_{0}]]Δ′. Hence [[A]]ρ_{0}Δ is uniform by Uniformity, so by Coherence

mon_{δ}(M, v_{M}) ∈ [[A]]ρ_{0}Δ(δ) = [[A]]mon_{δ}(ρ_{0})Δ′(id_{Δ′})
□

Lemma 6.6.6 (Substitution for Contexts) Suppose Γ_{0} ⊢ P : C, ρ_{0} ∈ [[Γ_{0}]]Δ and [[P]]ρ_{0}Δ is defined and in [[C]]ρ_{0}Δ. Then

• if [[Γ_{0}, z:C, Γ_{1}]]Δ is defined then [[Γ_{0}, [P/z]Γ_{1}]]Δ is defined, and

• if ρ_{0}ρ_{1} ∈ [[Γ_{0}, [P/z]Γ_{1}]]Δ then ρ_{0}[z := [[P]]ρ_{0}Δ]ρ_{1} ∈ [[Γ_{0}, z:C, Γ_{1}]]Δ.

Proof By induction on the structure of Γ_{1}:

• Γ_{1} ≡ (). Clearly [[Γ_{0}]]Δ is defined and if ρ_{0} ∈ [[Γ_{0}]]Δ then ρ_{0}[z := [[P]]ρ_{0}Δ] ∈ [[Γ_{0}, z:C]]Δ.

• Γ_{1} ≡ Γ′_{1}, x:A. Suppose [[Γ_{0}, z:C, Γ′_{1}, x:A]]Δ is defined. Then [[Γ_{0}, z:C, Γ′_{1}]]Δ is defined and if ρ_{0}[z := (M, v_{M})]ρ′_{1} ∈ [[Γ_{0}, z:C, Γ′_{1}]]Δ then [[A]]ρ_{0}[z := (M, v_{M})]ρ′_{1}Δ is defined. By inductive hypothesis [[Γ_{0}, [P/z]Γ′_{1}]]Δ is defined.

Suppose ρ_{0}ρ′_{1} ∈ [[Γ_{0}, [P/z]Γ′_{1}]]Δ. Then ρ_{0}[z := [[P]]ρ_{0}Δ]ρ′_{1} ∈ [[Γ_{0}, z:C, Γ′_{1}]]Δ by inductive hypothesis, and

[[A]]ρ_{0}[z := [[P]]ρ_{0}Δ]ρ′_{1}Δ = [[[P/z]A]]ρ_{0}ρ′_{1}Δ

by Substitution. Hence [[Γ_{0}, [P/z]Γ′_{1}, x:[P/z]A]]Δ is defined and if

ρ_{0}ρ′_{1}[x := (M, v_{M})] ∈ [[Γ_{0}, [P/z]Γ′_{1}, x:[P/z]A]]Δ

then

ρ_{0}[z := [[P]]ρ_{0}Δ]ρ′_{1}[x := (M, v_{M})] ∈ [[Γ_{0}, z:C, Γ′_{1}, x:A]]Δ

6.7 Soundness

We use the following lemma to show that the interpretations of constants are in the interpretations of their kinds. Lemma 6.7.1 Suppose ρ ∈ [[Γ]]Δ and

• [[(x_{1}:A_{1}) … (x_{n}:A_{n})A]]ρΔ is a saturated set for Δ and (x_{1}:B_{1}) … (x_{n}:B_{n})B,

• (M, v_{M}) is a uniform semantic object for Δ and (x_{1}:B_{1}) … (x_{n}:B_{n})B and • for all renamings δ from Δ′ to Δ and

(N_{1}, v_{1}) ∈ [[A_{1}]]mon_{δ}(ρ)Δ′(id_{Δ′})
…
(N_{n}, v_{n}) ∈ [[A_{n}]]mon_{δ}(ρ)[x_{1} := (N_{1}, v_{1})] …[x_{n−1} := (N_{n−1}, v_{n−1})]Δ′(id_{Δ′})

we know that

(M(N_{1}, …, N_{n}), λδ′.v_{M}(δ′ ∘ δ)(mon_{δ′}(N_{1}, v_{1}), …, mon_{δ′}(N_{n}, v_{n})))

∈ [[A]]mon_{δ}(ρ)[x_{1} := (N_{1}, v_{1})] …[x_{n} := (N_{n}, v_{n})]Δ′(id_{Δ′})

Then (M, v_{M}) ∈ [[(x_{1}:A_{1}) … (x_{n}:A_{n})A]]ρΔ(id_{Δ}). Proof By induction on n:

• n = 0. Immediate.

• n = m + 1. We know that (M, v_{M}) is a uniform semantic object. Suppose δ is a renaming from Δ′ to Δ and (M_{1}, v_{1}) ∈ [[A_{1}]]mon_{δ}(ρ)Δ′(id_{Δ′}). Then APP_{Δ′}(mon_{δ}(M, v_{M}), (N_{1}, v_{1})) is a uniform semantic object for Δ′ and (x_{2}:B_{2}) … (x_{m+1}:B_{m+1})B by definition of uniform semantic object. Furthermore mon_{δ}(ρ)[x_{1} := (N_{1}, v_{1})] ∈ [[Γ, x_{1}:A_{1}]]Δ′ by Lemma 6.6.5 and definition.

We also know that if δ′ is a renaming from Δ′′ to Δ′ then mon_{δ′}(N_{1}, v_{1}) ∈ [[A_{1}]]mon_{δ′∘δ}(ρ)Δ′′(id_{Δ′′}) by Uniformity and Coherence, so for all

(N_{2}, v_{2}) ∈ [[A_{2}]]mon_{δ′∘δ}(ρ)Δ′′(id_{Δ′′})
…
(N_{m+1}, v_{m+1}) ∈ [[A_{m+1}]]mon_{δ′∘δ}(ρ)[x_{2} := (N_{2}, v_{2})] … Δ′′(id_{Δ′′})

we know that

(M(N_{1}, …, N_{m+1}),
λδ′′.v_{M}(δ′′ ∘ (δ′ ∘ δ))(mon_{δ′′∘δ′}(N_{1}, v_{1}), mon_{δ′′}(N_{2}, v_{2}), …))
∈ [[A]]mon_{δ}(mon_{δ}(ρ)[x_{1} := (N_{1}, v_{1})]) …[x_{n} := (N_{n}, v_{n})]Δ′(id_{Δ′})

Hence

APP_{Δ′}((M, v_{M}), (N_{1}, v_{1}))
∈ [[(x_{2}:A_{2}) … (x_{m+1}:A_{m+1})A]]mon_{δ}(ρ)[x_{1} := (N_{1}, v_{1})]Δ′(id_{Δ′})

by inductive hypothesis, so by definition

(M, v_{M}) ∈ [[(x_{1}:A_{1}) … (x_{n}:A_{n})A]]ρΔ(id_{Δ})
□

Theorem 6.7.2 (Soundness) If any judgement Γ ⊢ J holds then [[Γ]]Δ is defined. Furthermore:

• If Γ ⊢ A kind and ρ ∈ [[Γ]]Δ then [[A]]ρΔ is defined.

• If Γ ⊢ M : A and ρ ∈ [[Γ]]Δ then [[M]]ρΔ and [[A]]ρΔ are defined and [[M]]ρΔ ∈ [[A]]ρΔ(id_{Δ}).

• If Γ ⊢ A = B and ρ ∈ [[Γ]]Δ then [[A]]ρΔ and [[B]]ρΔ are defined and [[A]]ρΔ ↓ [[B]]ρΔ.

• If Γ ⊢ M = N : A and ρ ∈ [[Γ]]Δ then [[M]]ρΔ, [[N]]ρΔ and [[A]]ρΔ are defined, [[M]]ρΔ ∈ [[A]]ρΔ(id_{Δ}) and [[M]]ρΔ ↓ [[N]]ρΔ.

Proof We prove this by induction on derivations in UTT.

• (Emp). Immediate.

• (Weak). By inductive hypothesis we know that [[Γ]]Δ is defined, and [[A]]ρΔ is defined for all ρ ∈ [[Γ]]Δ. Hence [[Γ, x:A]]Δ is defined.

• (Var). By inductive hypothesis [[Γ]]Δ is defined. Hence Γ ≡ Γ_{0}, x:A, Γ_{1} implies that ρ = ρ_{0}[x := (M, v_{M})]ρ_{1} for some (M, v_{M}) ∈ [[A]]ρ_{0}Δ, where [[A]]ρ_{0}Δ is defined, Δ ⊢^{S} ϕ̂_{0}(A) →^{nf} B and [[A]]ρ_{0}Δ ∈ SAT_{Δ}(B) by inductive hypothesis, the definition of the interpretation of contexts and Well-Definedness. By Contexts (Lemma 4.5.3) we know that each x_{i} ∈ dom(Γ_{0}, x:A, Γ_{1}) is distinct and that FV(A) ⊆ dom(Γ_{0}), so ρ(y) = ρ_{0}(y) for all y ∈ FV(A). Hence ρ(x) = (M, v_{M}) ∈ [[A]]ρ_{0}Δ = [[A]]ρΔ by Lemma 6.6.3.

• (Π). By inductive hypothesis [[Γ, x:A_{1}]]Δ′′ is defined and [[A_{2}]]ρ′′Δ′′ is defined for any ρ′′ ∈ [[Γ, x:A_{1}]]Δ′′. If [[Γ, x:A_{1}]]Δ′′ is defined then by definition [[Γ]]Δ′′ is defined and [[A_{1}]]ρ′Δ′′ is defined for any ρ′ ∈ [[Γ]]Δ′′.

Suppose ρ is a valuation from Δ to Γ. Then Δ ⊢^{S} ϕ̂(A_{1}) →^{nf} B_{1} and [[A_{1}]]ρΔ ∈ SAT_{Δ}(B_{1}) by Well-Definedness, so ⊢^{S}Δ, y:ϕ̂(A_{1}) for any y fresh in Δ, and weak_{Δ}^{Δ,y:_{ϕ}(A_{1})} is a renaming from Δ, y:ϕ̂(A_{1}) to Δ. We know by (S1) that

(y, ∗) ∈ [[A_{1}]]ρΔ(weak_{Δ}^{Δ,y:_{ϕ}(A_{1})})

and mon_{weak{Δ,y:_{ϕ}(A_{1}) \atop Δ}}(ρ) ∈ [[Γ]]Δ, y:ϕ̂(A_{1}) by Lemma 6.6.5, so

mon_{weak{Δ,y:_{ϕ}(A_{1}) \atop Δ}}(ρ)[x := (y, ∗)] ∈ [[Γ, x:A_{1}]]Δ, y:ϕ̂(A_{1})

Hence Δ, y:ϕ̂(A_{1}) ⊢^{S} { \atop ϕ[x := y]}(A_{2}) →^{nf} B_{2}.

Now suppose δ is a renaming from Δ′ to Δ. By Lemma 6.6.5 we know that mon_{δ}(ρ) ∈ [[Γ]]Δ′, so [[A_{1}]]mon_{δ}(ρ)Δ′ is defined, uniform and a saturated family of sets for Δ′ and B_{1}. Also, if (M_{2}, v_{2}) ∈ [[A_{1}]]mon_{δ}(ρ)Δ′ then mon_{δ}(ρ)[x := (M_{2}, v_{2})] ∈ [[Γ, x:A_{1}]]Δ′. Hence [[A_{2}]]mon_{δ}(ρ)[x := (M_{2}, v_{2})]Δ′ is defined and a saturated family of sets for Δ′ and B′_{2} by inductive hypothesis and Well-Definedness, where Δ′ ⊢^{S} { \atop ϕ[x := M_{2}]}(A_{2}) →^{nf} B′_{2}. Finally, we know that { \atop ϕ[x := M_{2}]}(A_{2}) ▷^{∗} [M_{2}/y]B_{2} by Lemma 4.7.13, so Δ′ ⊢^{S} [M_{2}/y]B_{2} →^{nf} B′_{2} by Subject Reduction.

• (λ). By similar reasoning as for (Π) we know that [[A_{1}]]mon_{δ}(ρ)Δ′ is defined, uniform and a saturated family of sets for Δ′ and B_{1} for any renaming δ from

Δ′ to Δ, Δ ⊢^{S} ϕ̂(A_{1}) →^{nf} B_{1} and Δ, y:ϕ̂(A_{1}) ⊢^{S} { \atop ϕ[x := y]}(M_{0}) →^{nf} P_{0} : B_{2}.

Suppose δ is a renaming from Δ′ to Δ. Then if (M_{2}, v_{2}) ∈ [[A_{1}]]mon_{δ}(ρ)Δ′(id_{Δ′}) then we again can show that mon_{δ}(ρ)[x := (M_{2}, v_{2})] ∈ [[Γ, x:A_{1}]]Δ′, so by inductive hypothesis [[M_{0}]]mon_{δ}(ρ)[x := (M_{2}, v_{2})]Δ′ is defined and in [[A_{2}]]mon_{δ}(ρ)[x := (M_{2}, v_{2})]Δ′(id_{Δ′}), and Δ′ ⊢^{S} { \atop ϕ[x := M_{2}]}(A_{2}) →^{nf} B′_{2}. This again implies that Δ′ ⊢^{S} [M_{2}/x]B_{2} →^{nf} B′_{2}, so [[[x:A_{1}]M_{0}]]ρΔ is defined.

Finally,

({ \atop ϕ[x := M_{2}]}(M_{0}), V [[M_{0}]]mon_{δ}(ρ)[x := (M_{2}, v_{2})]Δ′)

= [[M_{0}]]mon_{δ}(ρ)[x := (M_{2}, v_{2})]Δ′
∈ [[A_{2}]]mon_{δ}(ρ)[x := (M_{2}, v_{2})]Δ′(id_{Δ′})

If P_{0} is not a base term then

V [[M_{0}]]mon_{δ}(ρ)[x := (M_{2}, v_{2})]Δ′
= λδ′.V [[M_{0}]]mon_{δ}(ρ)[x := (M_{2}, v_{2})]Δ′(δ′)
= λδ′.V [[M_{0}]]mon_{δ′}(mon_{δ}(ρ)[x := (M_{2}, v_{2})])Δ′′(id_{Δ′′})
= λδ′.V [[M_{0}]]mon_{δ′∘δ}(ρ)[x := mon_{δ′}(M_{2}, v_{2})]Δ′′(id_{Δ′′})
= λδ′.(λ(M_{2}, v_{2}) ∈ [[A_{1}]]mon_{δ′∘δ}(ρ)Δ′′(id_{Δ′′}).
V [[M_{0}]]mon_{δ′∘δ}(ρ)[x := (M_{2}, v_{2})]Δ′′(id_{Δ′′}))(mon_{δ′}(M_{2}, v_{2}))
= λδ′.V [[[x:A_{1}]M_{0}]]mon_{δ′∘δ}(ρ)Δ′′(id_{Δ′′})(mon_{δ′}(M_{2}, v_{2}))
= λδ′.V [[[x:A_{1}]M_{0}]]ρΔ(δ′ ∘ δ)(mon_{δ′}(M_{2}, v_{2}))

so by (S2) we know that

Δ′ ⊢^{S} ϕ̂([x:A_{1}]M_{0})(M_{2}) →^{wh} { \atop ϕ[x := M_{2}]}(M_{0}) : B′_{2}

implies that

APP_{Δ′}(mon_{δ}([[[x:A_{1}]M_{0}]]ρΔ), (M_{2}, v_{2}))
= (ϕ̂([x:A_{1}]M_{0})(M_{2}), λδ′.V [[[x:A_{1}]M_{0}]]mon_{δ}(ρ)Δ′(δ′ ∘ δ)(mon_{δ′}(M_{2}, v_{2})))
∈ [[A_{2}]]mon_{δ}(ρ)[x := (M_{2}, v_{2})]Δ′(id_{Δ′})

If P_{0} is a base term then the last steps apply as well.

• (App). By inductive hypothesis and Well-Definedness we know that

– [[M_{1}]]ρΔ ∈ [[(x:A_{1})A_{2}]]ρΔ(id_{Δ}), Δ ⊢^{S} ϕ̂((x:A_{1})A_{2}) →^{nf} (x:B_{1})B_{2} and [[(x:A_{1})A_{2}]]ρΔ is a saturated family of sets for Δ and (x:B_{1})B_{2}, so Δ ⊢^{S} ϕ̂(M_{1}) →^{nf} P_{1} : (x:B_{1})B_{2} and if P_{1} is not a base term then dom(V [[M_{1}]]ρΔ) = [[A_{1}]]ρΔ, and

– [[M_{2}]]ρΔ ∈ [[A_{1}]]ρΔ(id_{Δ}), Δ ⊢^{S} ϕ̂(A_{1}) →^{nf} B_{1}, and [[A_{1}]]ρΔ is a saturated family of sets for Δ and B_{1}.

If [[(x:A_{1})A_{2}]]ρΔ is defined then we know that Δ ⊢^{S} ϕ̂([M_{2}/x]A_{2}) →^{nf} B′_{2}, since [[M_{2}]]ρΔ ∈ [[A_{1}]]ρΔ(id_{Δ′}). Hence [[M_{1}(M_{2})]]ρΔ is defined, and by definition of [[(x:A_{1})A_{2}]]ρΔ and Lemma 6.6.4

[[M_{1}(M_{2})]]ρΔ ∈ [[A_{2}]]ρ[x := [[M_{2}]]ρΔ]Δ(id_{Δ}) = [[[M_{2}/x]A_{2}]]ρΔ(id_{Δ})

• (Type). Immediate.

• (El). By inductive hypothesis [[A]]ρΔ is defined and in [[Type]]ρΔ(id_{Δ}) = USO_{Δ}(Type). Hence [[El(A)]]ρΔ is defined by Uniformity.

• (=T). By inductive hypothesis we know that [[M]]ρΔ and [[A]]ρΔ are defined, [[M]]ρΔ ∈ [[A]]ρΔ(id_{Δ}) and [[A]]ρΔ ↓ [[B]]ρΔ. The result follows trivially.

• (=R). By inductive hypothesis we know that [[M]]ρΔ, [[N]]ρΔ and [[A]]ρΔ are defined, [[M]]ρΔ = [[N]]ρΔ ∈ [[A]]ρΔ(id_{Δ}) and [[A]]ρΔ ↓ [[B]]ρΔ. The result follows trivially.

• (KRefl)(Refl)(KSym)(Sym). By inductive hypothesis.

Chapter 6. Soundness 188 • (KTrans)(Trans). By inductive hypothesis and Uniqueness of Normal Forms.

• (Π-Eq). By inductive hypothesis, where

Δ ⊢^{S} ϕ̂((x:A_{1})A_{2}) ↓ ϕ̂((x:B_{1})B_{2}) [(x:C_{1})C_{2}]

follows by reasoning similar to (Π).

• (λ-Eq). By inductive hypothesis, where

Δ ⊢^{S} ϕ̂([x:A_{1}]M_{0}) ↓ ϕ̂([x:B_{1}]N_{0}) [P] : (x:C_{1})C_{2}

follows by reasoning similar to (λ).

• (App-Eq). By inductive hypothesis we know that if ρ ∈ [[Γ]]Δ then

[[M_{1}]]ρΔ ↓ [[N_{1}]]ρΔ ∈ [[(x:A_{1})A_{2}]]ρΔ
[[M_{2}]]ρΔ ↓ [[N_{2}]]ρΔ ∈ [[A_{1}]]ρΔ
[[M_{1}(M_{2})]]ρΔ ∈ [[[M_{2}/x]A_{2}]]ρΔ
[[N_{1}(N_{2})]]ρΔ ∈ [[[N_{2}/x]A_{2}]]ρΔ

Hence Δ ⊢^{S} ϕ̂(M_{1}) ↓ ϕ̂(N_{1}) [P_{1}] : (x:B_{1})B_{2}, Δ ⊢^{S} ϕ̂(M_{2}) ↓ ϕ̂(N_{2}) [P_{2}] : B_{1}, Δ ⊢^{S} ϕ̂(M_{1}(M_{2})) →^{nf} Q : B and Δ ⊢^{S} ϕ̂(N_{1}(N_{2})) →^{nf} R : C. This means that ϕ̂(M_{1}(M_{2})) ▷^{∗} P_{1}(P_{2}) and ϕ̂(N_{1}(N_{2})) ▷^{∗} P_{1}(P_{2}), so Δ ⊢^{S} P_{1}(P_{2}) →^{nf} Q : B and Δ ⊢^{S} P_{1}(P_{2}) →^{nf} R : C by Subject Reduction. Hence Q ≡ R and B ≡ C by Uniqueness of Normal Forms. Furthermore, if P_{1} is not a base term then

V [[M_{1}]]ρΔ(id_{Δ})([[M_{2}]]ρΔ) = V [[M_{1}]]ρΔ(id_{Δ})([[N_{2}]]ρΔ)
= V [[N_{1}]]ρΔ(id_{Δ})([[N_{2}]]ρΔ)

by inductive hypothesis and the definition of value sets.

• (β). We know that [[([x:A_{1}]M_{0})(M_{2})]]ρΔ ∈ [[A_{2}]]ρ[x := [[M_{2}]]ρΔ]Δ Chapter 6. Soundness 189

and

[[M_{0}]]ρ[x := [[M_{2}]]ρΔ]Δ = (ϕ̂([M_{2}/x]M_{0}), V [[M_{0}]]ρ[x := [[M_{2}]]ρΔ]Δ)
∈ [[A_{2}]]ρ[x := [[M_{2}]]ρΔ]Δ

where [[A_{2}]]ρ[x := [[M_{2}]]ρΔ]Δ = [[[M_{2}/x]A_{2}]]ρΔ by Substitution. We then know that

V [[[M_{2}/x]M_{0}]]ρΔ = V [[M_{0}]]ρ[x := [[M_{2}]]ρΔ]Δ = V [[([x:A_{1}]M_{0})(M_{2})]]ρΔ and

Δ ⊢^{S} ϕ̂(([x:A_{1}]M_{0})(M_{2})) ↓ ϕ̂([M_{2}/x]M_{0}) [P] : B′_{2}

where Δ ⊢^{S} ϕ̂([M_{2}/x]A_{2}) →^{nf} B′_{2}, by reasoning similar to that for (λ).

• (η). We know that – [[M]]ρΔ ∈ [[(x:A_{1})A_{2}]]ρΔ,

– Δ ⊢^{S} ϕ̂((x:A_{1})A_{2}) →^{nf} (x:B_{1})B_{2},

– [[(x:A_{1})A_{2}]]ρΔ ∈ SAT_{Δ}((x:B_{1})B_{2}) and

– FV(M) ⊆ dom(Γ) by Contexts for UTT. Then:

V [[M]]ρΔ
= λδ.V [[M]]ρΔ(δ)
= λδ.V [[M]]mon_{δ}(ρ)Δ′(id_{Δ′})
= λδ.λ(M_{2}, v_{2}) ∈ [[A_{1}]]mon_{δ}(ρ)Δ′(id_{Δ′}).V [[M]]mon_{δ}(ρ)Δ′(id_{Δ′})(M_{2}, v_{2})
= λδ.λ(M_{2}, v_{2}) ∈ [[A_{1}]]mon_{δ}(ρ)Δ′(id_{Δ′}).
V [[M]]mon_{δ}(ρ)[x := (M_{2}, v_{2})]Δ′(id_{Δ′})(M_{2}, v_{2})
= λδ.λ(M_{2}, v_{2}) ∈ [[A_{1}]]mon_{δ}(ρ)Δ′(id_{Δ′}).
(λδ′.V [[M]]mon_{δ}(ρ)[x := (M_{2}, v_{2})]Δ′(δ′)(mon_{δ′}(M_{2}, v_{2})))(id_{Δ′})
= V [[[x:A_{1}]M(x)]]ρΔ

and by Lemma 4.9.16 we know that Δ ⊢^{S} ϕ̂([x:A_{1}]M(x)) →^{nf} P : (x:B_{1})B_{2} implies that Δ ⊢^{S} ϕ̂(M) →^{nf} P : (x:B_{1})B_{2}, so the result follows by Uniqueness of Normal Forms.

• (El-Eq). Straightforward by inductive hypothesis and (S-El).

• (Ctxt Subst). By inductive hypothesis [[Γ_{0}, z:C, Γ_{1}]]Δ is defined, [[Γ_{0}]]Δ is defined and if ρ_{0} ∈ [[Γ_{0}]]Δ then [[P]]ρ_{0}Δ and [[C]]ρ_{0}Δ are defined and [[P]]ρ_{0}Δ ∈ [[C]]ρ_{0}Δ. Hence [[Γ_{0}, [P/z]Γ_{1}]]Δ is defined by Lemma 6.6.6.

• (Kind Subst). By inductive hypothesis

– [[Γ_{0}, z:C, Γ_{1}]]Δ is defined,

– if ρ ∈ [[Γ_{0}, z:C, Γ_{1}]]Δ then [[A]]ρΔ is defined and

– if ρ_{0} ∈ [[Γ_{0}]]Δ then [[P]]ρ_{0}Δ and [[C]]ρ_{0}Δ are defined and [[P]]ρ_{0}Δ ∈ [[C]]ρ_{0}Δ.

Hence [[Γ_{0}, [P/z]Γ_{1}]]Δ is defined by Lemma 6.6.6, and if ρ_{0}ρ_{1} ∈ [[Γ_{0}, [P/z]Γ_{1}]]Δ then ρ_{0}[z := [[P]]ρ_{0}Δ]ρ_{1} ∈ [[Γ_{0}, z:C, Γ_{1}]]Δ. Therefore [[A]]ρ_{0}[z := [[P]]ρ_{0}Δ]ρ_{1}Δ = [[[P/z]A]]ρ_{0}ρ_{1}Δ.

• (Term Subst)(Kind-Eq Subst)(Term-Eq Subst). Similar to (Kind Subst).

• (Kind Subst-Eq). By inductive hypothesis [[Γ_{0}, z:C, Γ_{1}]]Δ is defined, if ρ ∈ [[Γ_{0}, z:C, Γ_{1}]]Δ then [[A]]ρΔ is defined and if ρ_{0} ∈ [[Γ_{0}]]Δ then [[P]]ρ_{0}Δ, [[Q]]ρ_{0}Δ and [[C]]ρ_{0}Δ are defined and [[P]]ρ_{0}Δ ↓ [[Q]]ρ_{0}Δ ∈ [[C]]ρ_{0}Δ.

Hence [[Γ_{0}, [P/z]Γ_{1}]]Δ is defined by Lemma 6.6.6, and if ρ_{0}ρ_{1} ∈ [[Γ_{0}, [P/z]Γ_{1}]]Δ then ρ_{0}[z := [[P]]ρ_{0}Δ]ρ_{1} ∈ [[Γ_{0}, z:C, Γ_{1}]]Δ. Furthermore, ρ_{0}[z := [[P]]ρ_{0}Δ]ρ_{1} ↓ ρ_{0}[z := [[Q]]ρ_{0}Δ]ρ_{1}, so

[[A]]ρ_{0}[z := [[P]]ρ_{0}Δ]ρ_{1}Δ ↓ [[A]]ρ_{0}[z := [[Q]]ρ_{0}Δ]ρ_{1}Δ

by Uniformity and

[[[P/z]A]]ρ_{0}ρ_{1}Δ ↓ [[[Q/z]A]]ρ_{0}ρ_{1}Δ

by Substitution.

• (Term Subst-Eq). Similar to (Kind Subst-Eq).

• (Prop). By Well-Definedness and Uniformity

[[Prop]]ρΔ ∈ USO_{Δ}(Type) = [[Type]]ρΔ

• (Prf). [[Prf]]ρΔ is a uniform semantic object by Well-Definedness and Uniformity. Suppose δ is a renaming from Δ′ to Δ and (P, v_{P}) ∈ USO_{Δ′}(El(Prop)) = [[El(Prop)]]mon_{δ}(ρ)Δ′(id_{Δ′}). Then

APP_{Δ′}(mon_{δ}([[Prf]]ρΔ), (P, v_{P}))
= APP_{Δ′}([[Prf]]mon_{δ}(ρ)Δ′, (P, v_{P}))
∈ USO_{Δ′}(Type) = [[Type]]mon_{δ}(ρ)Δ′

by Coherence and the definition of the interpretation, so

[[Prf]]ρΔ ∈ [[(El(Prop))Type]]ρΔ(id_{Δ})

by the definition of [[(El(Prop))Type]]ρΔ(id_{Δ}).

• (∀). [[∀]]ρΔ is a uniform semantic object by Well-Definedness and Uniformity. Also, [[(A:Type)((El(A))El(Prop))El(Prop)]]ρΔ is defined by inductive hypothesis. Suppose δ is a renaming from Δ′ to Δ and

(A, v_{A}) ∈ [[Type]]mon_{δ}(ρ)Δ′
(P, v_{P}) ∈ [[(El(A))El(Prop)]]mon_{δ}(ρ)[A := (A, v_{A})]Δ′

Then we know that

Δ′(Δ′(mon_{δ}([[∀]]ρΔ))(A, v_{A}))(P, v_{P})
∈ USO_{Δ′}(El(Prop))
= [[El(Prop)]]mon_{δ}(ρ)Δ′(id_{Δ′})

so [[∀]]ρΔ ∈ [[(A:Type)((El(A))El(Prop))El(Prop)]]ρΔ(id_{Δ′})

by Lemma 6.7.1.

• (Λ). [[Λ]]ρΔ is a uniform semantic object by Well-Definedness and Uniformity.

Suppose δ is a renaming from Δ′ to Δ and

(A, v_{A}) ∈ [[Type]]mon_{δ}(ρ)Δ′(id_{Δ′})
(P, v_{P}) ∈ [[(El(A))El(Prop)]]mon_{δ}(ρ)[A := (A, v_{A})]Δ′(id_{Δ′})
(g, v_{g}) ∈ [[(x:El(A))El(Prf(P (x)))]]mon_{δ}(ρ)[A := (A, v_{A})][P := (P, v_{P})]Δ′(id_{Δ′})

which means that Δ′ ⊢^{S} A ↓ A [A′] : Type and Δ′ ⊢^{S} P ↓ P [P′] : (El(A′))El(Prop). By definition of [[∀]]ρΔ, [[Prf]]ρΔ and [[El]]ρΔ we know that

(Λ(A, P, g), λδ′.∗)
∈ V [[∀]]ρΔ(δ)((A, v_{A}), (P, v_{P}))
= V [[∀(A, P)]]mon_{δ}(ρ)[A := (A, v_{A})][P := (P, v_{P})]Δ′(id_{Δ′})
= [[El(Prf(∀(A, P)))]]mon_{δ}(ρ)[A := (A, v_{A})][P := (P, v_{P})]Δ′(id_{Δ′})

so [[Λ]]ρΔ is in the interpretation of its kind by Lemma 6.7.1.

• (E_{∀}). [[E_{∀}]]ρΔ is a uniform semantic object by Well-Definedness and Uniformity.

Suppose δ is a renaming from Δ′ to Δ and

(A, v_{A}) ∈ [[Type]]mon_{δ}(ρ)Δ′(id_{Δ′})
(P, v_{P}) ∈ [[(El(A))El(Prop)]]mon_{δ}(ρ)[A := (A, v_{A})]Δ′(id_{Δ′})

and that (R, v_{R}), (f, v_{f}) and (M, v_{M}) are in the interpretations of the appropriate kinds.

First, since

(R, v_{R}) ∈ [[(El(Prf(∀(A, P))))El(Prop)]]mon_{δ}(ρ)[A := (A, v_{A})][P := (P, v_{P})]Δ′(id_{Δ′})

we know that

APP_{Δ′}((R, v_{R}), (M, v_{M})) ∈ [[El(Prop)]]mon_{δ}(ρ)Δ′(id_{Δ′}) = USO_{Δ′}(El(Prop)) so v_{R}(id_{Δ′})(M, v_{M}) ∈ SAT_{Δ′}(El(Prf(S))), where Δ′ ⊢^{S} R(M) →^{nf} S : El(Prop). Similar to Well-Definedness, we again know that if (M, v_{M}) ↓ (N, v_{N}) then Δ′ ⊢^{S} R(M) ↓ R(N) [S] : El(Prop).

We show that

(E_{∀}(A, P, R, f, M), λδ′.∗)
∈ [[El(Prf(R(M)))]]mon_{δ}(ρ)[R := (R, v_{R})][M := (M, v_{M})]Δ′(id_{Δ′})
= v_{R}(id_{Δ′})(M, v_{M})

by induction on the construction of

[[El(Prf(∀(A, P)))]]mon_{δ}(ρ)[A := (A, v_{A})][P := (P, v_{P})]Δ′(id_{Δ′})

from which by Lemma 6.7.1 it follows that [[E_{∀}]]ρΔ is in the interpretation of its kind:

– M is a base term such that Δ′ ⊢^{S} M →^{nf} Q : El(Prf(∀(A′, P′))). Then E_{∀}(A, P, R, f, M) is a base term, so (E_{∀}(A, P, R, f, M), λδ′.∗) ∈ v_{R}(id_{Δ′})(M, v_{M}) by (S1).

– Δ′ ⊢^{S} M →^{wh} N : El(Prf(∀(A′, P′))) and

(N, v_{N}) ∈ [[El(Prf(∀(A, P)))]]mon_{δ}(ρ)[A := (A, v_{A})][P := (P, v_{P})]Δ′

By inductive hypothesis E_{∀}(A, P, R, f, N) ∈ v_{R}(id_{Δ′})(N, v_{N}), and Δ′ ⊢^{S} E_{∀}(A, P, R, f, M) →^{wh} E_{∀}(A, P, R, f, N) : El(Prf(S)), by (S-base). Hence (E_{∀}(A, P, R, f, M), λδ′.∗) ∈ v_{R}(id_{Δ′})(N, v_{N}) by (S2). Finally, since Δ′ ⊢^{S} M ↓ N [Q] : El(Prf(∀(A′, P′))) and v_{M} = λδ′.∗ = v_{N}, we know that v_{R}(id_{Δ′})(N, v_{N}) = v_{R}(id_{Δ′})(M, v_{N}) by definition of uniformity.

– M ≡ Λ(A′, P′, g), where Δ′ ⊢^{S} A ↓ A′ [A′′] : Type, Δ′ ⊢^{S} P ↓ P′ [P′′] : (El(A′′))El(Prop) and

(g, v_{g}) ∈ [[(x:El(A))El(Prf(P (x)))]]mon_{δ}(ρ)[A := (A, v_{A})][P := (P, v_{P})]Δ′(id_{Δ′})

Then

APP_{Δ′}((f, v_{f}), (g, v_{g}))
∈ [[El(Prf(R(Λ(A, P, g))))]]ρ′Δ′(id_{Δ′})
= v_{R}(id_{Δ′})(Λ(A, P, g), λδ′.∗)

where ρ′ is mon_{δ}(ρ) extended by A, P, R, f and g, and

Δ′ ⊢^{S} E_{∀}(A, P, R, f, Λ(A′, P′, g)) →^{wh} f(g) : El(Prf(S))

so

(E_{∀}(A, P, R, f, Λ(A′, P′, g)), λδ′.∗) ∈ v_{R}(id_{Δ′})(Λ(A, P, g), λδ′.∗)

Since [[(x:El(A))El(Prf(P (x)))]]mon_{δ}(ρ)[A := (A, v_{A})][P := (P, v_{P})]Δ′ is a family of saturated sets by inductive hypothesis, we know that Δ′ ⊢^{S} g →^{nf} g′ : (x:El(A′))El(Prf(P′(x))), so

Δ′ ⊢^{S} Λ(A, P, g) ↓ Λ(A′, P′, g) [Λ(A′′, P′′, g′)] : El(Prf(∀(A′, P′)))

by (S-App). Hence

v_{R}(id_{Δ′})(Λ(A, P, g), λδ′.∗) = v_{R}(id_{Δ′})(Λ(A′, P′, g), λδ′.∗)

by definition of uniformity.

• (Prop-Eq). Clearly

Δ ⊢^{S} ϕ̂(E_{∀}(A, P, R, f, Λ(A, P, g))) ↓ ϕ̂(f(g)) [N] : El(Prf(S))

where Δ ⊢^{S} R(Λ(A, P, g)) →^{nf} S : El(Prop). Also, ∗ is the unique value for proofs.

• (M^{X}[Θ̄]). By inductive hypothesis Δ, Y:Type ⊢^{S} { \atop ϕ[X := Y]}(Θ_{j}) →^{nf} Θ′_{j}, using the same construction as for (Π) and (λ), so [[M^{X}[Θ̄]]]ρΔ is defined.

By Well-Definedness and Uniformity

[[M^{X}[Θ̄]]]ρΔ ∈ USO_{Δ}(Type) = [[Type]]ρΔ(id_{Δ})

• (ι_{i}^{X}[Θ̄]). By inductive hypothesis Δ, Y:Type ⊢^{S} { \atop ϕ[X := Y]}(Θ_{j}) →^{nf} Θ′_{j}, so [[ι_{i}^{X}[Θ̄]]]ρΔ is defined.

Next, suppose δ is a renaming from Δ′ to Δ and

(N_{1}, v_{1}) ∈ [[El(M_{1})]]mon_{δ}(ρ[X := [[M^{X}[Θ̄]]]ρΔ])Δ′(id_{Δ′}).
…
(N_{n}, v_{n}) ∈ [[El(M_{n})]]mon_{δ}(ρ[X := [[M^{X}[Θ̄]]]ρΔ])[x_{1} := (N_{1}, v_{1})] … Δ′(id_{Δ′})

By construction we have

(ι_{i}^{X}[Θ̄](N_{1}, …, N_{n}), λδ′.<v_{1}(δ′), …, v_{n}(δ′)>) ∈ [[M^{X}[Θ̄]]]mon_{δ}(ρ)Δ′

so by Lemma 6.7.1 we know that [[ι_{i}^{X}[Θ̄]]]ρΔ is in the interpretation of its kind.

• (E^{X}[Θ̄]). By inductive hypothesis Δ, Y:Type ⊢^{S} { \atop ϕ[X := Y]}(Θ_{j}) →^{nf} Θ′_{j}.

We show by transfinite induction on the complexity of M^{X}[Θ̄] that R^{α}(M) is defined and R^{α}(M, v_{M}) ∈ v_{C}(M, v_{M}) for (M, v_{M}) ∈ [[M^{X}[Θ̄]]]ρΔ^{α}, and furthermore that

[[Φ^{♮}[M^{X}[Θ̄], C, f, z]]]mon_{δ}(ρ)[C := (C, v_{C})][f := R^{α}][z := (M, v_{M})]Δ′

∈ [[Φ^{∘}[M^{X}[Θ̄], C, z]]]ρ[A := [[M^{X}[Θ̄]]]ρΔ][C := (C, v_{C})][z := (M, v_{M})]Δ′

This proof is similar to that in Lemma 5.3.1. Then by Lemma 6.7.1 we know that [[E^{X}[Θ̄]]]ρΔ is in the interpretation of its kind.

• (Θ̄-Eq). We need to show that

[[Φ^{♮}[M^{X}[Θ̄], C, f, z]]]mon_{δ}(ρ)[C := (C, v_{C})][f := R^{β}][z := (N_{i_{k}}, v_{i_{k}})]Δ′

= [[Φ^{♮}[M^{X}[Θ̄], C, f, z]]]mon_{δ}(ρ)[C := (C, v_{C})][f := R^{α_{0}}][z := (N_{i_{k}}, v_{i_{k}})]Δ′

for β < α_{0}, which follows by transfinite induction on α_{0}.

• (κ-Eq). We know that Δ, Y:Type ⊢^{S} { \atop ϕ[X := Y]}(Θ_{i}) ↓ { \atop ϕ[X := Y]}(Θ′_{i}) [Θ′′_{i}] for 1 ≤ i ≤ n, so Δ ⊢^{S} ϕ̂(κ^{X}[Θ̄]) ↓ ϕ̂(κ^{X}[Θ̄′]) [κ^{X}[Θ̄′′]] : A^{X}[Θ̄′′]. Furthermore, we know for any ρ_{i,j} from Δ to Γ, X:Type, x_{1}:M_{i,1}, …, x_{j−1}:M_{i,j−1} that

[[M_{i,j}]]ρ_{i,j}Δ = [[M′_{i,j}]]ρ_{i,j}Δ

For M^{X}[Θ̄] and μ^{X}[Θ̄], we know that Δ, Y:Type ⊢^{S} { \atop ϕ[X := Y]}(Θ_{i}) ↓ Θ′′_{i} [Θ′′′_{i}] if and only if Δ, Y:Type ⊢^{S} { \atop ϕ[X := Y]}(Θ′_{i}) ↓ Θ′′_{i} [Θ′′′_{i}], so the interpretations are equal.

For E^{X}[Θ̄], we have the added premisses that

[[Θ_{i}^{∘}[A, C, z]]]ρ′Δ′ = [[(Θ′_{i})^{∘}[A, C, z]]]ρ′Δ′

and

[[Θ_{i}^{♮}[A, C, f, z]]]ρ′Δ′ = [[(Θ′_{i})^{♮}[A, C, f, z]]]ρ′Δ′

for any valuation ρ′ from Δ′ to Γ, A:Type, C:(A)Type, f:(x:A)C(x), z:Θ(A), so the interpretations [[E^{X}[Θ̄]]]ρΔ and [[E^{X}[Θ̄′]]]ρΔ are equal.

• (U). By Well-Definedness and Uniformity

[[U]]ρΔ ∈ USO_{Δ}(Type) = [[Type]]ρΔ(id_{Δ})

• (prop). By definition of [[U]]ρΔ.

• (prf). [[prf]]ρΔ is a uniform semantic object by Well-Definedness and Uniformity.

Suppose δ is a renaming from Δ′ to Δ and

(P, v_{P}) ∈ [[El(Prop)]]mon_{δ}(ρ)Δ′(id_{Δ′}) = USO_{Δ′}(El(Prop))

Then by definition of value sets, uniformity and [[El(U)]]mon_{δ}(ρ)Δ′

APP_{Δ′}(mon_{δ}([[prf]]ρΔ), (P, v_{P})) = (prf(P), v_{P}) ∈ [[El(U)]]mon_{δ}(ρ)Δ′(id_{Δ′})

so the result follows by Lemma 6.7.1.

• (μ^{X}[Θ̄]). By inductive hypothesis Δ, Y:Type ⊢^{S} { \atop ϕ[X := Y]}(Θ_{j}) ↓ { \atop ϕ[X := Y]}(Θ′_{j}) [Θ′′_{j}], where for all (Γ′, A) ∈ Types_{Γ}(Θ′_{j}) there is an a such that T(a) ≡ A. This implies that for all (Γ′, A) ∈ Types_{Δ}({ \atop ϕ[X := Y]}(Θ′_{j})) there is an a such that T(a) ≡ A. Hence [[μ^{X}[Θ̄]]]ρΔ is defined.

• (T). We know that [[T]]ρΔ is a uniform semantic object by Well-Definedness and Uniformity.

Suppose δ is a renaming from Δ′ to Δ and (S, v_{S}) ∈ [[El(U)]]mon_{δ}(ρ)Δ′(id_{Δ′}). Then by definition of value sets and uniformity

APP_{Δ′}(mon_{δ}([[T]]ρΔ), (S, v_{S})) ∈ USO_{Δ′}(Type) = [[Type]]mon_{δ}(ρ)Δ′(id_{Δ′})

so the result follows by Lemma 6.7.1.

• (T-prop)(T-prf)(T-μ^{X}[Θ̄]). These follow by construction of the interpretation.

□

Lemma 6.7.3 If ⊢Γ then λx.(x, λδ.∗) ∈ [[Γ]]Γ.

Proof By induction on the structure of Γ:

• Γ ≡ (). Immediate.

• Γ ≡ Γ_{0}, x:A. By Context Validity (Lemma 4.5.2) and inductive hypothesis we know that λx.(x, λδ.∗) ∈ [[Γ_{0}]]Γ_{0}. Hence Γ_{0} ⊢ A kind trivially, so by Soundness [[A]]λx.(x, λδ.∗)Γ_{0} is defined, which means that there is a B such that Γ_{0} ⊢^{S} A →^{nf} B and [[A]]λx.(x, λδ.∗)Γ_{0} ∈ SAT_{Γ_{0}}(B). We then know that weak_{Γ_{0}}^{Γ} is a renaming and

mon_{weak}_{Γ_{0}}^{Γ}(λx.(x, λδ.∗)) ∈ [[Γ_{0}]]Γ

by Lemma 6.6.5. Finally, (x, λδ.∗) ∈ [[A]]mon_{weak}_{Γ_{0}}^{Γ}(λx.(x, λδ.∗))Γ by Soundness and (S1), so the result follows.

□

Corollary 6.7.4

• If Γ ⊢ A kind then there is a B such that Γ ⊢^{S} A →^{nf} B.

• If Γ ⊢ M : A then there are B, P such that Γ ⊢^{S} A →^{nf} B and Γ ⊢^{S} M →^{nf} P : B.

• If Γ ⊢ A = B then there is a C such that Γ ⊢^{S} A ↓ B [C].

• If Γ ⊢ M = N : A then there are B, P such that Γ ⊢^{S} A →^{nf} B and Γ ⊢^{S} M ↓ N [P] : B.

Proof We consider the case of Γ ⊢ A kind. By Lemma 6.7.3 there is a valuation from Γ to Γ, so by Soundness we know that [[A]]ρΔ is defined. By Well-Definedness there is a B such that Γ ⊢^{S} A →^{nf} B.

6.8 Consequences of Soundness

Several important results for UTT follow from soundness and completeness for UTT^{S} and the metatheory developed in Chapter 4.

Corollary 6.8.1 (Unicity of Types) If Γ ⊢ M : A and Γ ⊢ M : B then Γ ⊢ A = B.

Proof By Soundness, Uniqueness of Normal Forms and Completeness. □

Corollary 6.8.2 (Uniqueness of Product Formation) If Γ ⊢ (x:A_{1})A_{2} = (x:B_{1})B_{2} then Γ ⊢ A_{1} = B_{1} and Γ, x:A_{1} ⊢ A_{2} = B_{2}.

Proof By Soundness, Generation, Context Replacement and Completeness. □

Corollary 6.8.3 (Kind Correctness) If Γ ⊢ M : A then Γ ⊢ A kind.

Corollary 6.8.4 (Strong Normalization) If Γ ⊢ M : A then M is strongly normalizing.

Corollary 6.8.5 (Subject Reduction) If Γ ⊢ M : A and M ▷^{∗} N then Γ ⊢ N : A.

Corollary 6.8.6 (Church–Rosser) If Γ ⊢ M = N : A then there is a P such that M ▷^{∗} P and N ▷^{∗} P.

We can also use the above results to show the decidability of type-checking and the equality reflection theorem (Theorem 3.4.1), using standard techniques [51,47].

Conclusions and Further Work

7.1 Conclusions

We have introduced a new class of formal systems, typed operational semantics, which present type theory from a computational perspective. In doing so, we have arrived at a strategy for studying computation in type theory opposite to the frequently adopted approach of removing type information from the proof of normalization. We have demonstrated that a specific such system gives a new treatment of fundamental results which have been difficult to establish for systems with dependent types, including strong normalization, Church–Rosser and subject reduction. In our opinion, the benefits of our approach in the study of the basic metatheory justify the added complexity in the proof of soundness. Furthermore, the specific typed operational semantics that we study itself gives a precise, coherent description of the relationship between typing and reduction.

We have studied the idea of typed operational semantics in the context of two type theories. The basic similarity of the treatment of these two theories suggests that our approach may provide a uniform treatment of the metatheory for normalizing type theories.

We have developed a basic metatheoretic understanding of a sophisticated type theory with the Logical Framework, impredicativity, inductive types and a predicative universe. We hope that the theoretical understanding of inductive types as presented in this thesis and elsewhere will provide a foundation for a more practical investigation of the strength of type theory as a specification and programming language.

7.2 Further Work

In the semantic explanation of judgements, two terms are equal in a type if their canonical forms are equal relative to a decidable notion of equality for that type. Coquand’s algorithm for testing conversion [15] uses a bisimilarity relation to compare terms which are η-convertible, and the normalization proof uses a logical relation to show that equal terms are bisimilar. Although we have demonstrated in this thesis that the additional machinery of bisimilarity is not necessary for η-equality, there seem to be situations where an equality other than syntactic identity of normal forms may be essential.

One class of such systems is typed calculi with added equalities or reductions representing uniqueness conditions which are known not to have the Church– Rosser property. A well-known system with this problem is the simply typed lambda calculus with product types and a unit type. Goguen and Luo [35] present another system whose metatheoretic properties could be better understood using the technique of bisimilarity and logical relations, with sums, products, the unit type and Martin-Löf’s W -type. This system has many of the inductive types which are interesting in practice presented without the added complexity of the kind schema of UTT.

There may also be some inductive types over which we would like a coarser notion of equality. An example of such a type is the type of multisets, which could be represented as lists with the added equality that

cons(a, cons(b, l)) = cons(b, (cons(a, l))

It is clear that notions of equality up to associativity and commutativity cannot be modeled simply by reduction, and we need an equivalence on the canonical forms.

The notion of βη-long normal form seems to be preferable when we use the Logical Framework as a framework for defining logics. It would be interesting to see whether the system UTT^{S} can be changed to incorporate such long normal forms.

Explicit definitions, or let-expressions, are a useful tool for introducing abbreviations in ML-like languages which can also be added to type theories. Severi and Poll [71] show that many Pure Type Systems which are strong normalization under β-reduction are also strong normalization if we include definitions, in particular Calculus of Constructions. However, this proof uses considerable metatheoretic power because it relies on ECC being strongly normalizing. It seems that our system UTT^{S} can be extended to handle explicit definitions and give normalization proofs for systems with explicit definitions directly.

We have not proved the equivalence of the presentation of UTT with judgemental equality and the presentation with conversion. It is easy to show that any judgement which holds in the system with judgemental equality holds in the system with conversion. To show the other direction we need to know Church–Rosser for well-typed terms in the system with conversion, which Coquand [15] overlooks. A solution to this is to follow Salvesen’s technique [70] and consider the presentations of these two systems with a type label on application corresponding to the domain of the application: that is, application is of the form App(A_{1}, M_{1}, M_{2}), and the rule of inference for application is

(App) \frac{Γ ⊢ M_{1} : (x:A_{1})A_{2} Γ ⊢ M_{2} : A_{1}}{Γ ⊢ App(A_{1}, M_{1}, M_{2}) : [M_{2}/x]A_{2}}

The reduction rule is similar to our equalities for constants in UTT, requiring the labels to be syntactically equivalent for β or η-reduction to take place:

(β) App(A_{1}, [x:A_{1}]M_{0}, M_{2}) ▷ [M_{2}/x]M_{0}
(η)  [x:A_{1}]App(A_{1}, M, x) ▷ M  if x ∉ FV(M)

Because this system has the weak confluence property, if terms are normalizing then they are also confluent by Newman’s lemma, as proved for example by Barendregt [7]. Using this technique to prove equivalence will only be possible in systems where all well-typed terms are normalizing, but the representation of the system UTT^{S} is already dependent on strong normalization.

The treatment of variables in this thesis does not seem satisfactory, and in particular identifying terms which are equivalent up to change of bound variables seems unacceptable. We believe that the correct syntax-directed presentation of a system should use some representation for bound variables which is unique, such as de Bruijn indices [21] or Stoughton’s α-normal forms [74], while the canonical presentation should use variables with names and full α-equality as a rule of inference. In fact we believe that for studying the metatheory the system should be presented as explicitly as possible, which should include rules of equality for weakening and substitution.

We have needed to use a complicated definition of the interpretation function in our proof of soundness. The reason for this is that we want to interpret judgements rather than derivations, since there may be several derivations of the same judgement. However, systems which are syntax-directed, such as UTT^{S}, do not have this problem, since there is a unique derivation associated with any judgement. It would be interesting to investigate model construction for syntax-directed systems to see whether this is easier than the technique of using a partial interpretation. This may require having a more explicit term structure which reflects the structure of derivations more accurately: for example, using explicit substitutions [55, 78]. In any case, it is not clear that UTT^{S} is the right syntax-directed system, and Huet’s constructive engine [40] or some other system may be better suited to constructing interpretations.

Appendix A

A Complexity Measure for UTT ^{−}

In this section we justify the induction principle over the types of UTT^{−} by giving a complexity measure. This principle plays an important role in our proof of normalization, because it allows us to define the range of the interpretation we give in the proof in Chapter 6. This is in contrast to the set-theoretic interpretation, for example, where the range of the interpretation of Γ ⊢^{−} M : A is just the universe of sets.

Luo’s thesis [44] defines a measure on the types of ECC which is considerably simpler than ours. This is because he is able to show the important substitution property by analysis of the syntax, that

Γ_{0}, x:A, Γ_{1} ⊢^{−} B kind and Γ_{0} ⊢^{−} N : A imply c([N/x]B) ≤ c(B)

This property seems to be false for any simple complexity measure for the types of UTT^{−}, in light of examples such as the type

Γ ⊢^{−} [succ(y)/x]T(E_{N}([x:N]type_{0}, N, [v:type_{0}]N → v, x))
= N → T(E_{N}([x:N]type_{0}, N, [v:type_{0}]N → v, y))

Here the first type and the domain of the second type are equivalent except for the change of a variable name, and a simple measure based on the structure of types would have to assign the same value to those two types and hence a higher value for the second type.

Appendix A. A Complexity Measure for UTT^{−} 205

Our solution to this interaction between inductive types and universes is to use a variant of the set-theoretic model to provide a complexity measure. The intuition is that in this model, the rank of the interpretations of the constituent types of an inductive type are necessarily smaller than that of the type. However, this is only true in the absence of empty types: for example, the rank of the set of ordered pairs with one element in the empty set is equal to the rank of the empty set. We therefore consider an interpretation where propositions are always non-empty, and we restrict the syntax of inductive types to exclude the empty types.

A better solution would have been to define the interpretation of universes inductively, similar to our definition of inductive types. This would allow us to define a measure on types which simply follows the inductive definition of the universe. Another alternative would have been to use the positive inductive definitions introduced by Allen [3].

A.1 Set-Theoretic Preliminaries

Definition A.1.1 The rank of a set S, rank(S), is the unique operation satisfying the recursive equation rank(S) = {rank(T)|T ∈ S}.

Lemma A.1.2 The following properties hold for the rank function:

• If A and B are sets then max{rank(A), rank(B)} ≤ rank(A + B).

• If A and B are non-empty sets then max{rank(A), rank(B)} < rank(A×B).

• If A is a non-empty set and B is a family of non-empty sets over A then max({rank(A)} ∪ {rank(B(a))|a ∈ A}) < rank(F a ∈ A.B(a)), for F ∈ {Σ, Π}.

Proof Straightforward. □

A.2 An Alternative Interpretation of Proposi-

tions

The proof-irrelevant semantics we gave in chapter 5 interprets false propositions as the empty set. Although this is an intuitive interpretation for the calculus, for the purpose of defining a complexity measure we wish to avoid giving an empty interpretation to any type. Hence we now give a simple alternative semantics in which there is only one proposition, with a unique proof. This is simply an inconsistent interpretation of propositions.

Definition A.2.1 We define the following constants:

[[Prop]] =_{df} {0}
[[Prf]] =_{df} λv ∈ [[Prop]].{0}
[[∀]] =_{df} λA ∈ [[Type]].λP ∈ A → [[Prop]].0
[[Λ]] =_{df} λA ∈ [[Type]].λP ∈ A → [[Prop]].λf ∈ (Πa ∈ A.[[Prf]](P (a))).∅
[[E_{∀}]] =_{df} λA ∈ [[Type]].λP ∈ A → [[Prop]].λR ∈ [[∀]](A, P) → [[Prop]].
λf ∈ (Πg ∈ (Πa ∈ A.[[Prf]](P (a))).[[Prf]](R([[Λ]](A, P, g)))).
λz ∈ [[Prf]]([[∀]](A, P)).∅

Lemma A.2.2 If ⊢^{−}Γ, [[Γ]] is defined, ρ ∈ [[Γ]] and Γ ⊢^{−} M : A then [[M]](ρ) ∈ [[A]](ρ).

Proof Straightforward by induction on derivations. □

A.3 UTT ^{∗}

We introduce the calculus UTT^{∗}, which corresponds to the sublanguage of UTT^{−} with no empty types.

Definition A.3.1 (Non-Empty Kind Schema) Let Γ be a valid context. We say that Θ̄ is a non-empty Γ-schema, notation Sch_{Γ;X}^{∗}(Θ̄), if there is a Θ_{i} whose arity is 0.

Recall that the arity of a schema is the sequence of strictly positive operators which occur in the schema. The condition of being a non-empty kind schema says that there must be a constructor for the type which is not recursively defined. This non-recursive constructor gives a base element for the type.

Definition A.3.2 (UTT ^{∗}) The calculus UTT^{∗} is the calculus UTT^{−} with all occurrences of Sch_{Γ;X}^{−}(Θ̄) replaced by Sch_{Γ;X}^{∗}(Θ̄). We use the symbol ⊢^{∗} for the judgements of UTT^{∗}.

There is an obvious map from derivations in UTT^{∗} to derivations in UTT^{−}. It is clear that the set-theoretic interpretation lifts directly to this calculus.

Lemma A.3.3 Under the semantics introduced in section A.2, the following properties hold for UTT^{∗}:

• For any valid context Γ there exists a ρ ∈ [[Γ]].

• For any valid kind Γ ⊢^{∗} A kind and any ρ ∈ [[Γ]], [[A]](ρ) is non-empty.

Proof By induction on derivations.

The only rule which could introduce empty interpretations is (M^{X}[Θ̄]), but because there must be some Θ_{i} whose arity is 0 it is clear that Θ̄_{ρ}^{#}(S) is strictly larger than S for any set S. □

We can also show the converse, that any well-typed term in UTT whose interpretation involves no empty types is also a well-typed term in UTT^{∗}. However, although this fact gives us an understanding of the relationship between UTT and UTT^{∗}, it plays no role in our development of the syntax, so we omit the details.

Lemma A.3.4 Suppose Sch_{Γ;X}^{∗}(Θ̄). If S is a non-empty set then for all (Γ, Γ′; A) ∈ Types_{Γ}(Θ̄), for all (ρ, ρ′) ∈ [[Γ, Γ′]], rank([[A]](ρ, ρ′)) < rank(Θ̄_{ρ}^{#}(S)).

Proof By induction on Sch_{Γ;X}^{∗}(Θ̄), where for Sch_{Γ,Γ′;X}^{∗}(Θ) and Pos_{Γ,Γ′;X}^{∗}(Φ) we also show that Θ_{ρ,ρ′}^{#}(S) and Φ_{ρ,ρ′}^{#}(S) are non-empty:

• Sch_{Γ,Γ′;X}^{∗}(Θ_{1}, …, Θ_{n}). By inductive hypothesis and Lemma A.1.2.

• Sch_{Γ,Γ′;X}^{∗}(X). Immediate.

• Sch_{Γ,Γ′;X}^{∗}((Φ)Θ_{0}). By inductive hypothesis and Lemmas A.3.3 and A.1.2.

• Sch_{Γ,Γ′;X}^{∗}((x:A)Θ_{0}). Suppose (ρ, ρ′) ∈ [[Γ, Γ′]]. First,

(Γ, Γ′; A) ∈ Types_{Γ,Γ′}((x:A)Θ_{0})

and by Lemma A.1.2 we know that

rank([[A]](ρ, ρ′)) < rank(Σa ∈ [[A]](ρ, ρ′).Θ_{0}_{ρ,ρ′,a}^{#}(S))
= rank((x:A)Θ_{0}_{ρ,ρ′}^{#}(S))

where [[A]](ρ, ρ′) is non-empty by Lemma A.3.3 and Θ_{0}_{ρ,ρ′,a}^{#}(S) is non-empty by inductive hypothesis.

Furthermore, by inductive hypothesis we know that for any (Γ, Γ′, x:A, Γ′′; B) ∈ Types_{Γ,Γ′,x:A}(Θ_{0}) and any (ρ, ρ′, a, ρ′′) ∈ [[Γ, Γ′, x:A, Γ′′]],

rank([[B]](ρ, ρ′, a, ρ′′)) < rank(Θ_{0}_{ρ,ρ′,a}^{#}(S))
< rank(Σa ∈ [[A]](ρ, ρ′).Θ_{0}_{ρ,ρ′,a}^{#}(S))
= rank((x:A)Θ_{0}_{ρ,ρ′}^{#}(S))

• Pos_{Γ,Γ′;X}^{∗}((x:A)Φ_{0}). Similar to the previous case.

Appendix A. A Complexity Measure for UTT^{−} 209

• Pos_{Γ,Γ′;X}^{∗}(X). Immediate.

□

Definition A.3.5 We define the complexity of derivable judgements Γ ⊢^{∗} A kind, c(Γ ⊢^{∗} A kind), as

c(Γ ⊢^{∗} A kind) =_{df} μi.(∀ρ ∈ [[Γ]].rank([[A]](ρ)) ≤ i)

Lemma A.3.6 If Γ ⊢^{∗} A = B then c(Γ ⊢^{∗} A kind) = c(Γ ⊢^{∗} B kind). Proof By Theorem 5.3.1, for any ρ ∈ [[Γ]], if Γ ⊢^{∗} A = B then [[A]](ρ) = [[B]](ρ). □ Lemma A.3.7 If Γ ⊢^{∗} A kind, ⊢^{∗}Δ, and Γ ⊆ Δ, then c(Γ ⊢^{∗} A kind) = c(Δ ⊢^{∗} A kind). Proof By 5.2.3. □ Lemma A.3.8 Suppose Γ, x:A ⊢^{∗} B kind and Γ ⊢^{∗} N : A. Then

c(Γ ⊢^{∗} [N/x]B kind) ≤ c(Γ, x:A ⊢^{∗} B kind)

Proof For any ρ ∈ [[Γ]],

rank([[[N/x]B]](ρ)) = rank([[B]](ρ[x := [[N]](ρ)]))

by Lemma 5.2.4, from which the result follows directly. □ Lemma A.3.9

• If Sch_{Γ;X}^{∗}(Θ̄) and for any (Γ′, A) ∈ Types_{Γ}(Θ̄), where Γ′ ≡ Γ, x_{1}:A_{1}, …, x_{n}:A_{n},

if for all A_{i} we have that Γ, x_{1}:A_{1}, …, x_{i−1}:A_{i−1} ⊢^{∗} N_{i} : A_{i}, then

c(Γ ⊢^{∗} [N̄/Γ′]A kind) < c(Γ ⊢^{∗} El(M^{X}[Θ̄]) kind)

• If Γ ⊢^{∗} (x:A_{1})A_{2} kind then c(Γ ⊢^{∗} A_{1} kind) < c(Γ ⊢^{∗} (x:A_{1})A_{2} kind) and

c(Γ ⊢^{∗} [N/x]A_{2} kind) < c(Γ ⊢^{∗} (x:A_{1})A_{2} kind)

for any N such that Γ ⊢^{∗} N : A_{1}.

•

– c(Γ ⊢^{∗} El(Prop) kind) < c(Γ ⊢^{∗} El(U) kind).

– c(Γ ⊢^{∗} El(Prf(P)) kind) < c(Γ ⊢^{∗} El(U) kind) for any P such that Γ ⊢^{∗}

P : Prop.

– c(Γ ⊢^{∗} El(M^{X}[Θ̄]) kind) < c(Γ ⊢^{∗} El(U) kind) if Γ ⊢^{∗} μ^{X}[Θ̄] : El(U).

Proof The first statement follows from lemmas A.3.8 and A.3.4.

The second statement follows from lemmas A.3.8, A.3.3, and A.1.2 and the definition of [[(x:A_{1})A_{2}]](ρ).

The last statement follows by definition of the interpretation of [[U]](ρ). □

Definition A.3.10 (Inductive Complexity) Let the complexity for M such that Γ ⊢^{−} M : M^{X}[Θ̄] be defined as

k(Γ ⊢^{∗} M : M^{X}[Θ̄]) =_{df} μα.∀ρ.[[M]](ρ) ∈ (Θ̄_{ρ}^{#})^{α}

Lemma A.3.11 k(Γ ⊢^{∗} N_{j}(P_{1}, …, P_{p}) : M^{X}[Θ̄]) < k(Γ ⊢^{∗} ι_{i}^{X}[Θ̄](N_{1}, …, N_{n}) : M^{X}[Θ̄]) for any P_{1}, …, P_{p} of appropriate type and 1 ≤ j ≤ n.

Proof Let ρ be a valuation such that [[N_{j}(P_{1}, …, P_{p})]](ρ) ∈ (Θ̄_{ρ}^{#})^{α} but not for any β < α. It is clear by definition of ι_{i}^{X}[Θ̄] that k(Γ ⊢^{∗} ι_{i}^{X}[Θ̄](N_{1}, …, N_{n}) : )M^{X}[Θ̄] is larger than α. □

We recall that this definition of the complexity measure is for a subsystem of UTT without empty types. This subsystem includes all of the types we defined using the schemas in Section 3.3.2 except the empty type and the W -type. Modifying the proof to include these types would involve either defining the interpretation of the universe inductively or showing that there is a reduction-preserving map from UTT to the subsystem UTT^{∗}. For the latter technique, we can simply map a schema family to that schema family extended by the schema X.

Bibliography

[1] Peter Aczel. An introduction to inductive definitions. In J. Barwise, editor, Handbook of mathematical logic. North-Holland, Amsterdam, 1977.

[2] Peter Aczel. Frege structures and the notions of proposition, truth and set. In The Kleene symposium. North-Holland, Amsterdam, 1980.

[3] Stuart Allen. A non–type–theoretic definition of Martin-Löf’s types. In Proceedings of the Symposium on Logic in Computer Science, Ithaca, New York, June 1987.

[4] Thorsten Altenkirch. Constructions, Inductive Types and Strong Normalization. PhD thesis, University of Edinburgh, 1993.

[5] L. Augustsson, Th. Coquand, and B. Nordström. A short description of another logical framework. In G. Huet and G. Plotkin, editors, Preliminary Proceedings of Logical Frameworks, 1990.

[6] R. Backhouse. On the meaning and construction of the rules in Martin-Löf’s theory of types. In A. Avron et al, editor, Workshop on General Logic. LFCS Report Series, ECS-LFCS-88-52, Dept. of Computer Science, University of Edinburgh, 1988.

[7] Henk Barendregt. The Lambda Calculus: its Syntax and Semantics. North Holland, revised edition, 1984.

[8] Henk Barendregt. Lambda calculi with types. In Samson Abramsky, D. M. Gabbai, and T. S. E. Maibaum, editors, Handbook of Logic in Computer Science, volume 2. Oxford University Press, 1991.

[9] S. Berardi. Type Dependence and Constructive Mathematics. PhD thesis, Universita di Torino, Italy, 1990.

[10] E. Bishop. Foundations of Constructive Analysis. McGraw-Hill, 1967.

[11] C. Böhm and A. Berarducci. Automatic synthesis of typed λ-programs on term algebras. Theoretical Computer Science, 39, 1985.

[12] Robert L. Constable, et al. Implementing Mathematics with the NuPRL Proof Development System. Prentice–Hall, Englewood Cliffs, NJ, 1986.

[13] Catarina Coquand. From semantics to rules: A machine assisted analysis, 1993. To appear as Chalmers Technical Report.

[14] Thierry Coquand. An analysis of Girard’s paradox. In Proc. of the Symposium on Logic in Computer Science, pages 227–236, Boston, June 1986.

[15] Thierry Coquand. An algorithm for testing conversion in type theory. In Gérard Huet and Gordon Plotkin, editors, Logical Frameworks. Cambridge University Press, 1991.

[16] Thierry Coquand. Pattern matching with dependent types. In Workshop on Logical Frameworks, 1992. Preliminary Proceedings.

[17] Thierry Coquand and Jean Gallier. A proof of strong normalization for the theory of constructions using a Kripke-like interpretation. In Workshop on Logical Frameworks–Preliminary Proceedings, 1990.

[18] Thierry Coquand and Gerard Huet. The calculus of constructions. Information and Computation, 76:95 – 120, 1988.

[19] Thierry Coquand and Christine Paulin-Mohring. Inductively defined types. Lecture Notes In Computer Science, 417, 1990.

[20] Haskell Curry and Robert Feys. Combinatory Logic, volume 1. North Holland, 1958.

[21] N.G. de Bruijn. Lambda calculus notation with nameless dummies: a tool for automatic formula manipulation with application to the church-rosser theorem. Indag. Mathematics 34, 1972.

[22] N.G. de Bruijn. A survey of the project AUTOMATH. In J. Hindley and J. Seldin, editors, To H. B. Curry: Essays on Combinatory Logic, Lambda Calculus and Formalism. Academic Press, 1980.

[23] G. Dowek et al. The Coq Proof Assistent: User’s Guide (version 5.6). INRIA-Rocquencourt and CNRS-ENS Lyon, 1991.

[24] Peter Dybjer. Inductively defined sets in Martin-Löf’s set theory. In Arnon Avron et.al., editor, Workshop on General Logic. Dept. of Computer Science, University of Edinburgh, 1988.

[25] Peter Dybjer. An inversion principle for Martin-Löf’s type theory. In Peter Dybjer et al, editor, Workshop on Programming Logic. Programming Methodology Group, Report 54, 1989.

[26] Peter Dybjer. Inductive sets and families in Martin-Löf’s type theory and their set-theoretic semantics. In Gérard Huet and Gordon Plotkin, editors, Logical Frameworks. Cambridge University Press, 1991.

[27] Yuxi Fu. Topics in type theory. Technical report, Dept. of Computer Science, University of Manchester, 1992.

[28] Jean Gallier. On Girard’s “Candidats de Reducibilité”. In Piergiogio Oddifreddi, editor, Logic and Computer Science. Academic Press, 1990.

[29] G. Gentzen. Untersuchungen über das logische schliessen. Mathematische Zeitschrifte, 39, 1935.

[30] Herman Geuvers. Logics and Type Systems. PhD thesis, Katholieke Universiteit Nijmegen, September 1993.

[31] Herman Geuvers and Mark-Jan Nederhof. A modular proof of strong normalization for the Calculus of Constructions. Journal of Functional Programming, 1(2):155–189, April 1991.

[32] Jean-Yves Girard. Interprétation fonctionelle et élimination des coupures de l’arithmétique d’ordre supérieur. PhD thesis, Université Paris VII, 1972.

[33] Jean-Yves Girard, Yves Lafont, and Paul Taylor. Proofs and Types. Cambridge University Press, 1989.

[34] Kurt Gödel. Über eine bisher noch nicht benutze erweitrung des finiten standpunktes. Dialectica, 12, 1958.

[35] Healfdene Goguen and Zhaohui Luo. Inductive data types: Well-ordering types revisited. In G. Huet and G. Plotkin, editors, Logical Environments. Cambridge University Press, 1993.

[36] Robert Harper, Furio Honsell, and Gordon Plotkin. A framework for defining logics. Proc. 2nd Ann. Symp. on Logic in Computer Science, 1987.

[37] Robert Harper, David MacQueen, and Robin Milner. Standard ML. Technical Report ECS–LFCS–86–2, Laboratory for Foundations of Computer Science, March 1986.

[38] Robert Harper and Robert Pollack. Type checking with universes. Theoretical Computer Science, 89, 1991.

[39] William Howard. The formulae-as-types notion of construction. In J. Hindley and J. Seldin, editors, To H. B. Curry: Essays on Combinatory Logic. Academic Press, 1980.

[40] Gérard Huet. The constructive engine. In R. Narasimhan, editor, A Perspective in Theoretical Computer Science. World Scientific Publishing, 1989. Commemorative Volume for Gift Siromoney.

[41] G. Koletsos. Church–Rosser theorem for typed functional systems. Journal of Symbolic Logic, 50(3):782–790, 1985.

[42] A. Levy. Basic Set Theory. Springer–Verlag, 1979.

[43] Clas Löfwall and Gunnar Sjödin. Strong normalisability in Martin-Löf’s type theory. Technical Report R91:09, SICS, 1991.

[44] Zhaohui Luo. An Extended Calculus of Constructions. PhD thesis, University of Edinburgh, November 1990.

[45] Zhaohui Luo. A problem of adequacy: conservativity of calculus of constructions over higher-order logic. Technical Report ECS-LFCS-90-121, University of Edinburgh, 1990.

[46] Zhaohui Luo. Program specification and data refinement in type theory. Mathematical Structures in Computer Science, 3(3), 1993.

[47] Zhaohui Luo. Computation and Reasoning. Oxford University Press, 1994.

[48] Zhaohui Luo and Robert Pollack. LEGO Proof Development System: User’s Manual. LFCS Report ECS-LFCS-92-211, University of Edinburgh, 1992.

[49] David MacQueen. Using dependent types to express modular structure. In Proceedings of the 13th ACM Symposium on the Principles of Programming Languages, 1986.

[50] P. Martin-Löf. Constructive mathematics and computer programming. In L.J. Cohen et.al, editor, Logic, Methodology and Philosophy of Science VI, Amsterdam, 1982. North-Holland.

[51] Per Martin-Löf. A theory of types. Unpublished manuscript, 1971.

[52] Per Martin-Löf. An intuitionistic theory of types, 1972. Unpublished manuscript.

[53] Per Martin-Löf. An intuitionistic theory of types: Predicative part. In H. Rose and J. C. Shepherdson, editors, Logic Colloqium 1973, pages 73 – 118, 1975.

[54] Per Martin-Löf. Intuitionistic Type Theory. Bibliopolis, 1984.

[55] Per Martin-Löf. Substitution calculus. Handwritten notes, 1992.

[56] J. McKinna. Deliverables: a categorical approach to program development in type theory. PhD thesis, University of Edinburgh, 1992.

[57] J. McKinna and R. Burstall. Deliverables: a categorical approach to program development in type theory. Proc of Mathematical Foundations of Computer Science, LNCS 711, 1993.

[58] James McKinna and Robert Pollack. Pure type systems formalized. In M.Bezem and J.F.Groote, editors, Proceedings of the International Conference on Typed Lambda Calculi and Applications, TLCA’93, pages 289–305. Springer–Verlag, LNCS 664, March 1993.

[59] N. Mendler. Recursive types and type constraints in second-order lambda calculus. In Proceedings of POPL, 1987.

[60] N. Mendler. Recursive Definition in Type Theory. PhD thesis, Cornell University, 1988.

[61] J.C. Mitchell. A type-inference approach to reduction properties and semantics of polymorphic expressions. In ACM Conference on LISP and Functional Programming, pages 308–319, August 1986.

[62] John Mitchell. Type systems for programming languages. In J. van Leeuwen, editor, Handbook of Theoretical Computer Science. North Holland, 1990.

[63] Bengt Nordström, Kent Petersson, and Jan Smith. Programming in Martin-Löf’s Type Theory: An Introduction. Oxford University Press, 1990.

[64] Christian-Emil Ore. The Extended Calculus of Constructions (ECC) with inductive datatypes. Information and Computation, 1990.

[65] G. Pottinger. Strong normalization for the terms of the theory of constructions. Technical Report TR 11-7, Odyssey Research Associates, Inc., 1987.

[66] Dag Prawitz. Natural Deduction: A Proof-Theoretical Study. Almqvist and Wiksell, 1965.

[67] John C. Reynolds. Towards a theory of type structure. In Colloq. sur la Programmation, volume 19 of Lecture Notes in Computer Science, pages 408– 423. Springer–Verlag, 1974.

[68] Eike Ritter. Categorical Abstract Machine for Higher-Order Typed Lambda Calculus. PhD thesis, University of Cambridge, September 1992.

[69] Anne Salvesen. Typeteori - en studie. Cand. scient. thesis, University of Oslo, 1984.

[70] Anne Salvesen. The Church-Rosser property for pure type systems with βηreduction, November 1991. unpublished manuscript.

[71] Paula Severi and Erik Poll. Pure type systems with definitions, September 1993.

[72] Jan Smith. An interpretation of Martin-Löf’s type theory in a type-free theory of propositions. Journal of Symbolic Logic, 49(3), 1984.

[73] Jan Smith. The independence of Peano’s fourth axiom from Martin-Löf’s type theory without universes. Journal of Symbolic Logic, 53(3), 1988.

[74] Allen Stoughton. Substitution revisited. Theoretical Computer Science, 59:317–325, 1988.

[75] Thomas Streicher. Semantics of Type Theory: Correctness, Completeness and Independence Results. Birkhäuser, 1991.

[76] W. W. Tait. Intensional interpretation of functionals of finite type I. Journal of Symbolic Logic, 32, 1967.

[77] W. W. Tait. A realizability interpretation of the theory of species. In R. Parikh, editor, Logic Colloquium, Lecture Notes in Mathematics, 453, pages 240–251, 1975.

[78] A. Tasistro. Formulation of Martin-Löf’s theory of types with explicit substitutions. Licentiate thesis, 1993.

[79] L. S. van Bentham Jutting. Checking Landau’s “Grundlagen” in the AUTO-MATH system. PhD thesis, Technische Hogeschool Eindhoven, 1977.

[80] L. van Benthem Jutting, James McKinna, and Robert Pollack. Typechecking in pure type systems. submitted for publication, 1993.

[81] D. van Dalen. The Language Theory of Automath. PhD thesis, Technical University of Eindhoven, 1980.

[82] D. van Dalen, H.C. Doets, and H. de Swart. Sets: Naive, Axiomatic and Applied. International Series in Pure and Applied Mathematics. Pergammon Press, 1978.

[83] Benjamin Werner. A normalization proof for an impredicative type system with large elimination over integers. In Workshop on Logical Frameworks– Preliminary Proceedings, pages 341–357, 1992.

Index

Π-kind, 96

abstraction, 21, 95 admissible, 23 application, 22, 95

base term, 29, 102 body, 21

canonical, 3 canonical objects, 72 Church–Rosser property, 89 compatible closure, 34, 100 complexity measure, 148, 202 composition, 36 confluent valuations, 158 context, 22, 96 conversion, 89 cumulative hierarchy, 128

definitional equality, 71 diamond property, 35 domain, 67, 96

elimination constant, 73 environment, 100 extensional theory, 93

free variables, 96 fresh, 96 full pre-redex, 102

impredicative, 80 induction principle, 73 inductive types, 74, 92

judgemental equality, 22, 90 judgements, 3

kinds, 65

Kleene equal, 135

Kleene greater than, 136

Logical Framework, 65

meta-language, 65

non-canonical object, 73 non-empty Γ-schema, 205 normal, 35, 103

object language, 65

object-level full pre-redex, 102 object-level reduction, 101

pre-context, 22, 67 pre-redex, 29, 102 pre-substitution, 36, 105 predicative universe, 84 propositions, 79 propositions as types, 6 quasi-normalization, 149

rank, 203 redex, 34, 101 reduction, 89 renaming, 37, 114

saturated family of sets, 153 saturated set, 54, 153 semantic object, 52, 153 semantic presentation, 4, 87 set environment, 128 small kind, 75 strongly normalizing, 35, 102 subderivation, 99 subject reduction property, 89 substitution, 36, 158 syntactically equivalent, 96 syntax directed, 27

type, 69 type closed predicate, 59 typed operational semantics, 12, 87

uniform, 157, 159 uniform semantic objects, 158 untyped reduction, 34, 101

valid context, 67 valuation, 158 value sets, 153 variable, 95

weak head normal, 30, 103