Extensional concepts in intensional type theory

Martin Hofmann

Doctor of Philosophy University of Edinburgh

Abstract

Theories of dependent types have been proposed as a foundation of constructive mathematics and as a framework in which to construct certified programs. In these applications an important role is played by identity types which internalise equality and therefore are essential for accommodating proofs and programs in the same formal system.

This thesis attempts to reconcile the two different ways that type theories deal with identity types. In extensional type theory the propositional equality induced by the identity types is identified with definitional equality, i.e. conversion. This renders type-checking and well-formedness of propositions undecidable and leads to non-termination in the presence of universes. In intensional type theory propositional equality is coarser than definitional equality, the latter being confined to definitional expansion and normalisation. Then type-checking and well-formedness are decidable, and this variant is therefore adopted by most implementations.

However, the identity type in intensional type theory is not powerful enough for formalisation of mathematics and program development. Notably, it does not identify pointwise equal functions (functional extensionality) and provides no means of redefining equality on a type as a given relation, i.e. quotient types. We call such capabilities extensional concepts. Other extensional concepts of interest are uniqueness of proofs and more specifically of equality proofs, subset types, and propositional extensionality—the identification of equivalent propositions. In this work we investigate to what extent these extensional concepts may be added to intensional type theory without sacrificing decidability and existence of canonical forms. The method we use is the translation of identity types into equivalence relations defined by induction on the type structure. In this way type theory with extensional concepts can be understood as a high-level language for working with equivalence relations instead of equality. Such translations of type theory into itself turn out to be best described using categorical models of type theory.

We thus begin with a thorough treatment of categorical models with particular emphasis on the interpretation of type-theoretic syntax in such models. We then show how pairs of types and predicates can be organised into a model of type theory in which subset types are available and in which any two proofs of a proposition are equal. This model has applications in the areas of program extraction from proofs and modules for functional programs. For us its main purpose is to clarify the idea of syntactic translations via categorical model constructions.

The main result of the thesis consists of the construction of two models in which functional extensionality and quotient types are available. In the first one types are modelled by types together with proposition-valued partial equivalence relations. This model is rather simple and in addition provides subset types and propositional extensionality. However, it does not furnish proper dependent types such as vectors or matrices. We try to overcome this disadvantage by using another model based on families of type-valued equivalence relations which is however much more complicated and validates certain conversion rules only up to propositional equality.

We illustrate the use of these models by several small examples taken from both formalised mathematics and program development.

We also establish various syntactic properties of propositional equality including a proof of the undecidability of typing in extensional type theory and a correspondence between derivations in extensional type theory and terms in intensional type theory with extensional concepts added. Furthermore we settle affirmatively the hitherto open question of the independence of unicity of equality proofs in intensional type theory which implies that the addition of pattern matching to intensional type theory does not yield a conservative extension.

Acknowledgements

This thesis would not have appeared without the generous help and support of many people to whom I wish to express my deep thanks here.

The first person to thank here is my supervisor Don Sannella. He has taught me a lot on research in general and in particular on writing in our weekly meetings. He created a wonderful environment which allowed me to focus on my research only without being occupied by financial or administrative problems. His detailed comments on an earlier draft of this thesis resulted in important improvements. My second supervisor, Gordon Plotkin, has provided valuable guidance in discussions and in particular has suggested and made possible a visit to Gothenburg during which the idea for this thesis work arose. Terry Stroup, my former supervisor from Erlangen, brought me to Edinburgh and looked after me during my first year of studies. I am grateful to Rod Burstall and Andy Pitts for agreeing to be examiners of this thesis. Rod Burstall was a “step supervisor”, as he once put it, during the whole period of this research and helped me a lot both personally and scientifically.

My friend and colleague Thorsten Altenkirch provided invaluable input to my research and moral support in many (sometimes lively) discussions. He carefully proof-read an earlier draft and suggested major improvements. I also owe him thanks for introducing me to Bath Street Housing Coop, the place where I spent my first two years in Edinburgh. My thanks go to the Coop members too, for making me feel at home in Scotland.

Thomas Streicher helped me in many conversations, made important suggestions, and was a wonderful host during several visits of mine to Munich.

The LFCS provided an excellent environment for scientific work. The courses, the visitors, the computing facilities, and the administration took away most of the difficulties other young researchers have to cope with.

Thanks for stimulating conversations and suggestions on the subject of this thesis go to David Aspinall, Adriana Compagnoni, Thierry Coquand, Wolfgang Degen, Peter Dybjer, Bart Jacobs, Per Martin-Löf, Zhaohui Luo, James Mc-Kinna, Uwe Nestmann, Benjamin Pierce, Alex Simpson, Martin Steffen, Makoto Takeyama, and the members of the Edinburgh Lego Club.

Prof. Ulrich Herzog and his colleagues have provided a desk and a computer and before all a very friendly atmosphere during two periods which I spent in Erlangen.

I wish to acknowledge financial support by Edinburgh University, the DAAD, and the European Union HCM programme, contract number ERBCHBICT930420.

My very special thanks go to my wife Annette for her love and patience during our geographical separation.

Declaration

This thesis was composed by myself, and the work reported herein is my own, unless explicitly declared otherwise. Large parts of the material in Chapter 5 have already been published in [45] (Sect. 5.1), [47] (Sect. 5.2; together with Th. Streicher), [44] (Sect. 5.3).

Table of Contents

1. Introduction 1 1.1 Definitional and propositional equality . . . . . . . . . . . . . . . . 2 1.2 Extensional concepts . . . . . . . . . . . . . . . . . . . . . . . . . . 6 1.3 Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

1.3.1 The use of categorical models . . . . . . . . . . . . . . . . . 8 1.3.2 Syntactic models . . . . . . . . . . . . . . . . . . . . . . . . 9

1.4 Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

1.4.1 Application to machine-assisted theorem proving . . . . . . 12 1.5 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2. Syntax and semantics of dependent types 17

2.1 Syntax for a core calculus . . . . . . . . . . . . . . . . . . . . . . . 17 2.1.1 Raw syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 2.1.2 Judgements . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 2.1.3 Notation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 2.1.4 Derived rules and meta-theoretic properties . . . . . . . . . 24

2.2 High-level syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 2.2.1 Telescopes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 2.2.2 Elements of telescopes and context morphisms . . . . . . . . 26 Table of Contents vii

2.2.3 Definitions and substitution . . . . . . . . . . . . . . . . . . 27 2.3 Further type formers . . . . . . . . . . . . . . . . . . . . . . . . . . 29

2.3.1 Unit type . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 2.3.2 Σ-types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 2.3.3 Function and cartesian product types . . . . . . . . . . . . . 30 2.3.4 The Calculus of Constructions . . . . . . . . . . . . . . . . . 30 2.3.5 Universes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 2.3.6 Quotient types . . . . . . . . . . . . . . . . . . . . . . . . . 33

2.4 Abstract semantics of type theory . . . . . . . . . . . . . . . . . . . 33 2.4.1 Syntactic categories with attributes . . . . . . . . . . . . . . 34 2.4.2 Type constructors . . . . . . . . . . . . . . . . . . . . . . . . 46

2.5 Interpreting the syntax . . . . . . . . . . . . . . . . . . . . . . . . . 62 2.5.1 Partial interpretation . . . . . . . . . . . . . . . . . . . . . . 63 2.5.2 Soundness of the interpretation . . . . . . . . . . . . . . . . 64

2.6 Discussion and related work . . . . . . . . . . . . . . . . . . . . . . 74

3. Syntactic properties of propositional equality 77

3.1 Intensional type theory . . . . . . . . . . . . . . . . . . . . . . . . . 78 3.1.1 Substitution . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 3.1.2 Uniqueness of identity . . . . . . . . . . . . . . . . . . . . . 80 3.1.3 Functional extensionality . . . . . . . . . . . . . . . . . . . . 83

3.2 Extensional type theory . . . . . . . . . . . . . . . . . . . . . . . . 86 3.2.1 Comparison with Troelstra’s presentation . . . . . . . . . . . 87 3.2.2 Undecidability of extensional type theory . . . . . . . . . . . 87 3.2.3 Interpreting extensional type theory in intensional type theory 89 Table of Contents viii

3.2.4 An extension of TT_{I} for which the interpretation in TT_{E} is

surjective . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 3.2.5 Conservativity of TT_{E} over TT_{I} . . . . . . . . . . . . . . . . 96 3.2.6 Discussion and extensions . . . . . . . . . . . . . . . . . . . 109 3.2.7 Conservativity of quotient types and functional extensionality118

3.3 Related work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

4. Proof irrelevance and subset types 123 4.1 The refinement approach . . . . . . . . . . . . . . . . . . . . . . . . 124 4.2 The deliverables approach . . . . . . . . . . . . . . . . . . . . . . . 126 4.3 The deliverables model . . . . . . . . . . . . . . . . . . . . . . . . . 127

4.3.1 Contexts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 4.3.2 Families of specifications . . . . . . . . . . . . . . . . . . . . 129 4.3.3 Sections of specifications (deliverables) . . . . . . . . . . . . 130

4.4 Model checking with Lego . . . . . . . . . . . . . . . . . . . . . . . 131 4.4.1 Records in Lego . . . . . . . . . . . . . . . . . . . . . . . . . 131 4.4.2 Deliverables in Lego . . . . . . . . . . . . . . . . . . . . . . 132

4.5 Type formers in the model D . . . . . . . . . . . . . . . . . . . . . 135 4.5.1 Dependent products . . . . . . . . . . . . . . . . . . . . . . 135 4.5.2 Dependent sums . . . . . . . . . . . . . . . . . . . . . . . . 136 4.5.3 Natural numbers . . . . . . . . . . . . . . . . . . . . . . . . 138 4.5.4 The type of propositions . . . . . . . . . . . . . . . . . . . . 139 4.5.5 Proof irrelevance . . . . . . . . . . . . . . . . . . . . . . . . 142 4.5.6 Universes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

4.6 Subset types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 Table of Contents ix

4.6.1 Subset types without impredicativity . . . . . . . . . . . . . 147 4.6.2 A non-standard rule for subset types . . . . . . . . . . . . . 147

4.7 Reinterpretation of the equality judgement . . . . . . . . . . . . . . 154 4.8 Related work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156

5. Extensionality and quotient types 158

5.1 The setoid model . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 5.1.1 Contexts of setoids . . . . . . . . . . . . . . . . . . . . . . . 160 5.1.2 Implementing the setoid model S_{0} in Lego . . . . . . . . . . 163 5.1.3 Type formers in the setoid model . . . . . . . . . . . . . . . 164 5.1.4 Propositions . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 5.1.5 Quotient types . . . . . . . . . . . . . . . . . . . . . . . . . 172 5.1.6 Interpretation of quotient types in S_{0} . . . . . . . . . . . . . 174 5.1.7 A choice operator for quotient types . . . . . . . . . . . . . 178 5.1.8 Type dependency and universes . . . . . . . . . . . . . . . . 183

5.2 The groupoid model . . . . . . . . . . . . . . . . . . . . . . . . . . 186 5.2.1 Groupoids . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 5.2.2 Interpretation of type formers . . . . . . . . . . . . . . . . . 196 5.2.3 Uniqueness of identity . . . . . . . . . . . . . . . . . . . . . 203 5.2.4 Propositional equality as isomorphism . . . . . . . . . . . . 203

5.3 A dependent setoid model . . . . . . . . . . . . . . . . . . . . . . . 206 5.3.1 Families of setoids . . . . . . . . . . . . . . . . . . . . . . . 208 5.3.2 Dependent product . . . . . . . . . . . . . . . . . . . . . . . 212 5.3.3 The identity type . . . . . . . . . . . . . . . . . . . . . . . . 214 5.3.4 Inductive types . . . . . . . . . . . . . . . . . . . . . . . . . 217 Table of Contents x

5.3.5 Quotient types . . . . . . . . . . . . . . . . . . . . . . . . . 220 5.4 Discussion and related work . . . . . . . . . . . . . . . . . . . . . . 222

6. Applications 226

6.1 Tarski’s fixpoint theorem . . . . . . . . . . . . . . . . . . . . . . . . 227

6.1.1 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232 6.2 Streams in type theory . . . . . . . . . . . . . . . . . . . . . . . . . 232 6.3 Category theory in type theory . . . . . . . . . . . . . . . . . . . . 237

6.3.1 Categories in S_{0} . . . . . . . . . . . . . . . . . . . . . . . . . 239 6.3.2 Categories in S_{1} . . . . . . . . . . . . . . . . . . . . . . . . . 241 6.3.3 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243

6.4 Encoding of the coproduct type . . . . . . . . . . . . . . . . . . . . 244

6.4.1 Development in the setoid models . . . . . . . . . . . . . . . 245 6.5 Some basic constructions with quotient types . . . . . . . . . . . . . 247

6.5.1 Canonical factorisation of a function . . . . . . . . . . . . . 248 6.5.2 Some categorical properties of S_{0} . . . . . . . . . . . . . . . 249 6.5.3 Subsets and quotients . . . . . . . . . . . . . . . . . . . . . 250 6.5.4 Saturated subsets . . . . . . . . . . . . . . . . . . . . . . . . 252 6.5.5 Iterated quotients . . . . . . . . . . . . . . . . . . . . . . . . 253 6.5.6 Quotients and products . . . . . . . . . . . . . . . . . . . . . 253 6.5.7 Quotients and function spaces . . . . . . . . . . . . . . . . . 254

6.6 Σ is co-continuous—intensionally . . . . . . . . . . . . . . . . . . . 255 6.6.1 Parametrised limits of ω-chains . . . . . . . . . . . . . . . . 256 6.6.2 Development in TT_{E} . . . . . . . . . . . . . . . . . . . . . . 257 6.6.3 Development in TT_{I} . . . . . . . . . . . . . . . . . . . . . . 258 Table of Contents xi 7. Conclusions and further work 260 A. Lego context approximating S_{0} 262

A.1 Extensionality axioms . . . . . . . . . . . . . . . . . . . . . . . . . 262 A.2 Quotient types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263 A.3 Further axioms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263

B. Syntax 264 C. A glossary of type theories 272 D. Index of symbols 274

Chapter 1

Introduction

Theories of dependent types have been proposed as a foundation of constructive mathematics [72,19] and as a framework in which to construct certified programs [64,19,109] and to extract programs from proofs [27,87]. Using implementations of such type theories, substantial pieces of constructive mathematics have been formalised and medium scale program developments and verifications have been carried out.

One key feature of dependent type theories making them so apt for these applications is that to a certain extent they allow the internalisation of metatheorems; they can “speak about themselves”. For instance, it is possible to use such a type theory as a programming language and at the same time for reasoning about these programs. Then, the proof that e.g. a program meets its specification is an element of a certain type and the fact that this is so can be checked automatically.

To a great extent this is made possible through the internalisation of equality by propositional equality and more generally through the interplay between propositional equality and (intensional) definitional equality.

The main subject of this thesis is to study this interplay and in particular extensions to propositional equality which maintain the desirable properties of the definitional equality.

1.1 Definitional and propositional equality

In extensional type theory and axiomatic set theory the constant zero function and the function defined by

f(n) = \{ \begin{matrix}0,  if there is no counterexample to Fer- mat’s conjecture of size less than n \\ 1,  otherwise \end{matrix}

are (probably) equal, whereas intensionally they are quite distinct, because their definitions are entirely different. On the other hand, even in an intensional setting there may be a proof that the extensions of the two functions agree. In the presence of such a proof it should be the case that whenever some definable property holds for the constant zero function then it also holds for f.^{1}

However, certain equalities do not require a proof. For instance, in the above example the function f equals the function which searches for a counterexample to Fermat’s conjecture. Similarly, we have

if true then e else e′ = e  (1.1)

just by appealing to the definition of the if-then-else construct. One therefore speaks in the former case of a propositional equality whereas in the latter we have an example of a definitional equality. The precise borderline between propositional and definitional equality is fluid, but it appears to be commonly agreed that two objects are definitionally equal if after certain computation steps they evaluate to identical results.^{2} Traditionally, definitional equality is therefore meant to be induced by a strongly normalising confluent rewriting system; in an extended sense we might simply require definitional equality to be decidable and furthermore that the decision procedure be induced by some notion of terminating computation on terms. Indeed, we shall consider notions of definitional equality defined indirectly via interpretation in some syntactically constructed model.

1A simpler example of propositionally equal yet intensionally different functions is given by the identity on the natural numbers and the function λx: N.Suc^{x}(0) sending x to the x-fold iteration of the successor function on zero. The example with Fermat’s conjecture is however more convincing since one could imagine an intensional theory in which the former two functions become identified by some “η-rule” for natural numbers, whereas in no reasonable intensional or algorithmic setting would one identify two functions the propositional equality of which is equivalent to Fermat’s conjecture.

It is important that definitional equality is pervasive so if M and N are definitionally equal then P (M) is definitionally equal to P (N) whatever P is. In particular the proposition stating that M is propositionally equal to N is definitionally equal to the proposition that M is propositionally equal to itself. Since the latter proposition is always true, definitional equality always entails propositional equality, but certainly not vice versa.

This distinction between “obvious” identities which do not require a proof and “meaningful” identities which need to be verified is the key difference between intensional and extensional theories. In an extensional theory every identity needs a proof, whereas in an intensional theory a notion of computation or definitional expansion is built in.

An illustrative example of definitional equality arises in category theory. For conceptual reasons one often does not want to have an equality on objects. Nonetheless, such an equality is needed to state when a composition f ∘ g is defined, namely when the domain of f and the codomain of g agree. A careful analysis of common practice shows that the word “agree” here refers in most cases to definitional equality of objects. For example if G(X) = A × X one would be allowed to compose a morphism with codomain G(X) with a projection, but no category theorist would write “let’s prove that the domain and codomain of the following two morphisms are equal”.

2Luo [67] confines definitional equality to actual definitional expansion and considers 1.1 as an instance of “computational equality”. However, since computational and definitional equality behave identically syntactically this distinction is merely a philosophical one. On the other hand, Martin-Löf [71] explains the use of the term “definitional” for equalities like 1.1 on the grounds that the “non-canonical” term former if-then-else is defined by 1.1 and a corresponding clause for false.

A formal framework in which both propositional and definitional equality are present is Martin-Löf’s intensional type theory [85]. Definitional equality is expressed by the equality judgement Γ ⊢ M = N : σ meaning that M and N are definitionally equal terms of type σ in context (type assignment) Γ. There is also a notion of definitional equality on types: Γ ⊢ σ = τ. Propositional equality of terms M and N is expressed by the judgement Γ ⊢ P : Id_{σ}(M, N) meaning that P is a proof that M and N are propositionally equal terms of type σ in context Γ. Here “Id” is Martin-Löf’s identity type which is defined as an inductive family with the single constructor Refl(M) : Id_{σ}(M, M).

In the presence of a type of propositions “Prop” one can also define propositional equality by Leibniz’s principle. According to this principle a proof that M is propositionally equal to N is a proof that whenever a property P : σ → Prop holds for M then it holds for N.

These formulations demonstrate an important aspect of propositional equality in intensional type theory—the fact that it internalises proofs of equality. Propositional equality is identified with the type of its proofs and it is decidable whether a term belongs to this type or not. In contrast, in set theory one may define an “identity type” by

Id_{σ}^{set}(M, N) = \{ \begin{matrix}\{⋆\} if M = N \\ ∅ otherwise \end{matrix}

Then Id_{σ}^{set}(M, N) is nonempty iff M and N are equal, but membership in Id_{σ}^{set}(M, N) is not in general decidable, so ⋆ cannot be considered a proof that M equals N.

A similar situation occurs in extensional Martin-Löf type theory [72,31] where propositional and definitional equality are forcefully identified by the equality reflection rule

\frac{Γ ⊢ P : Id_{σ}(M, N)}{Γ ⊢ M = N : σ} Id-DefEq

This rule makes definitional equality extensional^{3} and thus undecidable (Sect. 3.2.2). Moreover, type checking becomes undecidable because Refl(M) : Id_{σ}(M, N) holds iff M and N are definitionally equal. Also, the term Refl(M) can no longer be considered a proof that M and N are equal as is the case in of the above “identity type” in set theory. For these and other reasons (see Sect. 3.2.6.2) interest in extensional type theory seems to have recently decreased. We shall however explain in Chapter 3 that the equality reflection rule can be seen as a shortcut for longer derivations in intensional type theory.

Unfortunately, the abovementioned formalisations of propositional equality (identity type and Leibniz equality) suffer from serious limitations when they are used at types which are not inductive. For example, if P : Πx: σ.Id_{τ}(f x, g x) is a proof that f and g are point-wise propositionally equal then there is in general no way of constructing an element of Id_{σ→τ}(f, g) although in the presence of P the functions f and g are clearly propositionally equal in the abstract sense. This has led to the common misunderstanding that the identity type was intensional. This is not so because if M(x) and N(x) are expressions containing a free variable of type σ then in certain cases an element of Id_{τ}(M(x), N(x)) may be constructed by induction on x even if M(x) and N(x) are not definitionally (i.e. intensionally) equal.^{4}

Summing up, we can say that definitional equality is intensional—it identifies objects which become identical upon definitional expansion and/or computation; and that (idealised) propositional equality is extensional, but that it is not adequately captured by the identity type or Leibniz equality. This thesis is an attempt at overcoming this mismatch.

3Strictly speaking, definitional equality does not become extensional here, but the equality judgement no longer expresses definitional equality. To avoid the introduction of a third notion of equality, judgemental equality, we shall by a slight abuse of language identify definitional equality with the relation expressed by the equality judgement.

4Luo [67] therefore calls the identity type “weakly intensional”. A way of justifying the predicate “intensional” for the identity type consists of decreeing that intensional equality on open terms refers to definitional equality of all closed instances.

1.2 Extensional concepts

We use the term “extensional concept” to refer to a desirable feature of propositional equality which is not present in its traditional formulation. In this thesis several such extensional concepts are of interest, notably the following:

i. Functional extensionality: Two functions which are point-wise propositionally equal are propositionally equal.

ii. Uniqueness of identity: Any two proofs of a propositional equality are propositionally equal.

iii. Proof-irrelevance: Any two proofs of a proposition are propositionally equal.

iv. Subset types: The presence of a type former which permits the formation of a type of elements of a given type that satisfy a certain predicate.

v. Propositional extensionality: Two propositions which imply each other are propositionally equal.

vi. Quotient types: The presence of a type former which permits arbitrary definition of propositional equality on some underlying type.

These extensional concepts are not independent of each other. In particular iii implies iv and vi implies i (see Sect. 3.2.7) Also, v implies iii if one assumes a distinguished proposition with exactly one proof. The concepts iii, v, iv only make sense if there is a difference between propositions and arbitrary types. In this thesis this difference is expressed by the assumption of a type of propositions Prop and a type Prf(P) for each P : Prop. The propositions are then the types of the form Prf(P) and the elements of these types are proofs. If for conceptual reasons one does not want to have a type of all propositions one can also introduce a new judgement Γ ⊢ σ Prop to mean that the type P is a proposition. We only hint at this alternative in Remarks 4.6.1 & 5.1.11.

The concept of uniqueness of identity is of course a special case of proofirrelevance, so it only makes sense in the absence of the latter, for example in a theory with propositions and types identified.

In extensional type theory, these extensional concepts are either present or can be added easily, see e.g. [31]. Here we take on the more difficult task of adding them to intensional type theory. Apart from the advantages of intensional type theory in general this has the desirable effect that we can add a choice principle for quotient types 5.1.7 which would be unsound in any extensional theory.

Extensional concepts could simply be added axiomatically and justified semantically, say by a set-theoretic interpretation. For example, in order to achieve functional extensionality we could simply assume a family of constants

Ext_{σ,τ} : Πf, g: σ → τ.(Πx: σ.Id_{τ}(f x, g x)) → Id_{σ→τ}(f, g)

However, in this case an important property, called N-canonicity (Def. 2.1.9), of definitional equality will be violated, namely that every closed term of the natural numbers is definitionally equal to a numeral.^{5} The reason is that a term containing an instance of Ext cannot be definitionally equal to a numeral because there are no rules governing the behaviour of Ext w.r.t. definitional equality. This work can—to some extent—be seen as a quest for extensions of definitional equality so as to include rules for these constants.

An exception to this is uniqueness of identity. As noticed by Streicher [101] it can indeed by added axiomatically and the axiom can be endowed with a reduction rule so that no non-canonical elements arise. For us the concept is of relevance because it is needed to establish equivalence of extensional and intensional type theory with extensional concepts added (3.2.5).

5The use of the natural numbers is arbitrary here. One can easily show that a noncanonical element in some other type induces one in the type of natural numbers.

1.3 Method

The main tool we use in order to achieve the goals set out above consists of defining interpretations of the type theory with extensional concepts inside pure type theory. For example, in order to achieve functional extensionality and quotient types, one interprets every type as a type together with an (internal) equivalence relation and propositional equality at a particular type as this equivalence relation. Since this approach is inspired by Bishop’s definition of a set by its members and its equality [9] we call this translation the setoid interpretation. Similarly, for subset types and proof-irrelevance we use a translation of types into types with unary predicates and of terms into terms plus proofs that these predicates are respected. Following Burstall and McKinna [13] we call this translation the deliverables interpretation.

Given such an interpretation we can consider two objects definitionally equal if they receive definitionally equal interpretations and in this way ensure N-canonicity.

1.3.1 The use of categorical models

It turns out that due to type dependency the verification that a certain translation indeed validates all the rules of type theory is quite difficult. It has therefore proven useful to insert the intermediate step of abstract categorical models. One then defines a sound interpretation function from the syntax to the abstract model once and for all and the task of proving that a certain translation is sound can then be reduced to the task of verifying that one has an instance of the abstract model.

This may be compared to the situation in the simply typed lambda calculus. Instead of directly giving an interpretation of typed lambda terms in some mathematical structure one can alternatively show that this structure forms a cartesian closed category and then appeal to the general interpretation function mapping lambda terms to morphisms in an arbitrary cartesian closed category [49]. In our situation the role of cartesian closed categories is played by syntactic categories with attributes—an equational presentation of Cartmell’s notion of categories with attributes [15,89]. Such an equational presentation has the advantage that the property of being a model can be checked using term rewriting (normalisation). In this way we have encoded all the syntactic models within the Lego proof checker [68] and advantageously used its normalisation features to verify them.

1.3.2 Syntactic models

So the task of interpreting type theory with extensional concepts can be rephrased as that of exhibiting a categorical model in which the desired extensional concepts are valid. The aims set out in Sect. 1.3 above place certain restrictions on such models.

Firstly, in order that (semantically defined) definitional equality be decidable, equality in the model must be decidable, which presupposes that the semantic objects come with some effective description.

Second, the model must have the property that the type of natural numbers consists of numerals only so that we obtain the desired property that even in the presence of an extensional concept every closed term of the natural numbers is definitionally equal to a numeral (N-canonicity).

Now any model satisfying these two requirements would meet the specification set out so far. However, in addition to this we want that the model explains the extensional concepts in terms of more basic ideas. “More basic” in this context means in terms of type theory without extensional concepts added. We thus seek a syntactic model the objects of which are syntactical and the equality of which is induced by the definitional equality of the underlying type theory.

The interpretation in the model then not only induces a coarser notion of definitional equality, but actually computes syntactic expressions which no longer contain the extensional concepts. Extensional concepts may therefore be seen as abbreviations or “macros” for longer derivations in the theory without them.

In particular, working in the syntactic model for functional extensionality and quotients can be viewed as using a high-level language for working with equivalence relations instead of equality and functions together with proofs that they respect these relations instead of mere functions. Similarly, the syntactic model for subset types and proof irrelevance can be understood as a high-level language for working with “deliverables” in the sense of [13], i.e. functions together with proofs that they respect certain predicates.

We also encounter a model which cannot be called syntactic—the groupoid model. It is similar in spirit to the syntactic models we give and serves similar purposes. The groupoid model can be seen as a refinement of the setoid interpretation in which proofs are constrained by equations. For example the proof that a function respects equality must respect symmetry. This allows for a more finegrained definition of (semantic) propositional equality on the identity type itself which both shows the underivability of uniqueness of equality proofs and permits a view of propositional equality of types as isomorphism.

It turns out that the syntactic models for the various extensional concepts discriminate between the features present in the type theory under consideration. For instance, the simplest model for quotient types does not support universes and other more involved forms of type dependency like the definition of a family of types indexed over Booleans by case distinction. It is possible to extend this model to cover universes, but then the extensional concepts are only available for types in the universe and not for the universe itself. Definition of types by cases is still not possible. On the other hand, in a more complicated model in which these type dependencies are available, certain expected definitional equalities only hold propositionally, for example certain instances of the computation rules associated to elimination of natural numbers. Some of these limitations have a natural explanation in terms of the intended meaning of the particular extensional concept in question; others, like the lack of certain definitional equalities, are rather arbitrary but nevertheless seem unavoidable.

Of course here the question arises whether the method of syntactic models is not too restrictive. Certainly, any approach to extensional concepts would (modulo some coding) be induced by a model which meets the first two requirements on a syntactic model, viz. semantic equality would have to be decidable and the interpretation of the natural numbers would have to consist of numerals only. Given that from the model one also expects some insight about the nature of the extensional concepts, not much choice is left. We cannot exclude the existence of such non-syntactic models, but have not encountered any in the course of the research reported here.

1.4 Applications

The applications of extensional concepts are numerous. Functional extensionality is required when one wants to reason about higher-order functions and also when coding coinductive types and greatest fixpoints using function types [60]. Quotient types are of pivotal use in formalisations of proofs in constructive algebra, since the most elementary algebraic constructions involve quotients. Quotient types also provide bisimulation principles to reason about infinite types. This may facilitate semantics-based verification of concurrent programs. Subset types can be used for modular specification. Here the additional computational principle that a function on a subset type should embody an algorithm defined on the whole type is important (Sect. 4.6.2). Proof irrelevance and propositional extensionality are of more theoretical interest. For example, propositional extensionality implies that quotient types are effective, i.e. that if two equivalence classes are equal in a quotient type then their representatives are related (Sect. 5.1.6.4). We work out several of these applications in some detail in Chapter 6.

Most of the applications also go through if the extensional concepts are merely assumed axiomatically without supporting them by a syntactic model. Indeed, we establish a conservativity property (Thm. 3.2.5) of which this fact is a general consequence. The benefit of the syntactic models in applications is three-fold. First, they show that using (partial) equivalence relations (called “book-equalities” in the Automath tradition [25]) is essentially equivalent to using propositional equality with extensional concepts added. Even if one does insist on “book-equalities”, the syntactic models may guide their use, which is particularly important in the presence of type dependency. Second, they allow to gauge the differences in expressiveness between various approaches to “book-equalities”, e.g. equivalence relations vs. partial equivalence relations, Prop-valued vs. type-valued relations, et cetera. Finally, two of the syntactic models we look at give rise to a complete separation between proofs and computations. Definitional equality in the model only compares the computational parts, so that the decision procedure for equality and type checking becomes more efficient.

1.4.1 Application to machine-assisted theorem proving

Theorem proving in type theories with or without extensional concepts is in principle possible by writing down derivations according to the rules. For realistic applications these rules are, however, unmanagable and one either has to move to informal notation or use machine support. For ordinary type theory without extensional concepts such machine support exists in the form of proof assistants like Lego [68]. There are in principle two possibilities as to how a proof assistant can be extended so as to provide extensional concepts.

As said above, most of the applications go through with axiomatically added extensional concepts. The Lego system allows for the addition of axioms or constants and even for the addition of certain definitional equalities as rewrite rules. In Appendix A we give Lego code which approximates in this sense one of the syntactic models for extensionality and quotient types (a setoid interpretation). The main disadvantage of this simple-minded approach is that terms of the natural numbers may contain instances of these axioms and thus not reduce to a canonical form. We also encounter certain non-standard operations on subset types and quotient types which cannot be cast into the form of Lego constants.

A deeper application of the work described here consists of a changing the implementation of the proof assistant itself so that it would compute interpretations in a syntactic model of all types and terms occurring during a proof session and use these interpretations to decide definitional equality and thus type checking. This would restore the ability of internal computation on terms and would also support the non-standard operations. Additionally, the interpretations could be made accessible to the user for subsequent processing. For instance, in the case of the syntactic model for proof-irrelevance the computational part of the interpretation can be seen as a program corresponding to the computational content of a proof.

Unfortunately, such a change to a proof assistant involves substantial practical effort and thus falls beyond the scope of this thesis.

1.5 Overview

Chapter 2 recapitulates the syntax of dependent type theory including universes and impredicative quantification. We use a judgement-oriented presentation without a logical framework. In order to compensate for the lack of a logical framework we develop a high-level syntax for substitutions and free variables. In the second part of Chapter 2 we introduce our notion of categorical model for dependent type theory, so-called syntactic categories with attributes, and we describe the interpretation of syntax therein. The definition of the interpretation function and the soundness proof closely follows [100].

The third chapter is mainly devoted to a comparison between intensional type theory with extensional concepts added and extensional type theory. The main result is that the latter is conservative over the former. Together with the undecidability of extensional type theory we consider this result the main theoretical justification for the use of intensional type theory with extensional concepts added. We also describe some basic constructions with the identity type that are required later, such as the definition of Martin-Löf’s elimination rule in terms of a Leibniz principle.

Chapter 4 contains the first syntactic model construction, a “deliverables interpretation” of the Calculus of Constructions, which models types as types together with a predicate. The model supports subset types and proof-irrelevance, and it interprets a non-standard rule for subset types which under certain conditions allows one to lift a function defined on a subset to a function on the whole set. The interpretation establishes a correspondence between two methodologies for program development in type theory, the deliverables approach and the refinement approach. We also sketch an application of the interpretation to typing of higher-order modules.

Our main purpose in presenting the deliverables interpretation is, however, to introduce the methodology of describing translations of type theory into itself using categorical models, and to indicate how the verification of such a categorical model can be mechanised using Lego.

Chapter 5 forms the kernel of this thesis. It contains three model constructions centred around extensionality and quotient types. Section 5.1 describes an interpretation under which types are modelled as types together with a Prop-valued partial equivalence relation (“setoids”). The interpretation is rather simple because type dependency is only allowed at the level of the relations, not for the types themselves. In this model functional and propositional extensionality, subset types, and quotient types can be interpreted. For the quotient types a choice operator may be defined which under certain conditions allows a representative to be recovered from an equivalence class. The model does not contain any properly dependent types such as matrices and universes. To alleviate this we look at an extension with universes obtained by amalgamating the setoid model with the deliverables interpretation. In this way a universe is supported, but extensional concepts become restricted to types inside the universe.

Sect. 5.3 describes an attempt to overcome the lack of type dependency in the previous model. We try to answer the question of what the right definition of a family of setoids indexed over a setoid might be, under the hypothesis that the underlying types of such a family should depend on the underlying type of the indexing setoid. The criterion for the value of such a definition is of course that the families must form a syntactic category with attributes and support as many type formers as possible as well as functional extensionality. The answer turns out to be rather unsatisfactory; the model is quite complicated and the verification even of the type of natural numbers is extremely complicated.

In Sect. 5.2 the—in our opinion—most natural solution to the above question of dependent setoids is described: the groupoid interpretation of type theory. It is, however, not a syntactic model, but can only be defined in extensional type theory or set theory. We show how the groupoid interpretation answers the question of independence of uniqueness of identity and how it permits one to interpret propositional equality on a universe as isomorphism. It also motivates the setup of the dependent setoid model in Sect. 5.3, which is why we describe it first.

Chapter 6 is devoted to applications of the extensional concepts and of the conservativity of extensional type theory over intensional type theory with extensional concepts added. Many of these applications have been actually formally developed within the Lego proof checker.

Sect. 6.1 studies a formalisation of Tarski’s generalised fixpoint theorem using subset types. The main lemma—a property of posets—is instantiated in the course of the proof with various sub-posets of a given one, whence the need for subset types. Our development is based on an earlier formalisation by Pollack, which can be viewed as the result of translating our development to intensional type theory using the interpretation in the deliverables model.

Sect. 6.2 studies an important application of functional extensionality—an encoding of infinite lists (“streams”) as functions. We derive a coinduction principle for these streams and define a fixpoint combinator the verification of which makes heavy use of coinduction.

In Sect. 6.3 we describe a simple-minded encoding of category theory in type theory with extensional concepts (propositional equality is used to compare both objects and morphisms). We investigate how this encoding gets translated under the various interpretations in terms of setoids. The resulting encodings in pure intensional type theory resemble encodings proposed independently by other authors.

Sect. 6.4 serves a similar purpose. We show how an encoding of disjoint-union types in extensional type theory due to Troelstra gets translated under the setoid interpretations. In particular we show in some detail how functional extensionality gets eliminated.

Sect. 6.5 is devoted to an examination of our syntax for quotient types by redoing certain constructions with quotient sets collected by Bourbaki [10] in order to become independent of their encoding as sets of equivalence classes. All but one construction go through; we explain why this one (isomorphism between the two definitions of the image of a function as a subset and as a quotient) must fail under a constructive understanding of quotienting as a redefinition of (propositional) equality.

Finally, Sect. 6.6 gives an application of the conservativity of extensional type theory over intensional type theory. We give an extensional type-theoretic variant of a theorem due to Mendler which involves indexed families of sets. Our formalisation is such that the conservativity theorem implies the existence of a proof of this theorem in intensional type theory with functional extensionality and uniqueness of identity. However, we were not able to come up explicitly with such a proof. This “application” suggests that in certain situations extensional type theory might be useful as a high-level language for type theory with extensional concepts.

Each of the four theoretical chapters ends with a section discussing possible extensions and related work. General conclusions and some directions for future research are summarised in Chapter 7.

The appendix contains a summary of the type-theoretic rules used throughout the thesis, a glossary of type theories appearing in the thesis, and an index of symbols. We also include a translation into Lego syntax of some of the rules for extensional concepts.

Syntax and semantics of dependent types

In this chapter we fix a particular syntax for a dependently typed calculus and define an abstract notion of model as well as a general interpretation function mapping syntactical objects to entities in a model. This interpretation function is shown to be sound with respect to the syntax.

2.1 Syntax for a core calculus

We start by giving a syntactic description of intensional Martin-Löf type theory with Π-types, natural numbers, and the identity type [71]. On top of this we can add further inductive types, Σ-types, universes, impredicative quantification and so forth, in order to accommodate richer systems like the Calculus of Constructions [19] or Lego/ECC [65,67]. The syntax we give does not make use of a “logical framework” as e.g. in [85] or [101]. We could, however, view the core calculus as a framework and make all further definitions of types inside some universe. So we do not really commit ourselves to a particular style of presentation.

2.1.1 Raw syntax

The raw syntax is formed out of three categories: pre-contexts, pre-types, and pre-terms. These are defined by the grammar in Fig. 2–1.

Γ  ::= ⋄  empty context
| Γ, x: σ  context extension
σ, τ  ::= N  natural numbers
| Πx: σ.τ  dependent product
| Id_{σ}(M, N)  identity type
M, N, O, P ::= x  variable
| 0  N introduction (zero)
| Suc(M)  N introduction (successor)
| R_{σ}^{N}(M, N, O)  N elimination (induction)
| λx: σ.M^{τ}  typed abstraction
| App_{σ,τ}(M, N)  typed application
| Refl_{σ}(M)  identity introduction
| J_{σ,τ}(M, N, O, P)  identity elimination

Figure 2–1: Syntax of pre-constructions

A few remarks concerning this presentation are in order. First, note that we include type information in application and abstraction. This makes the definition of the interpretation function for models easier, and it appears somewhat arbitrary to leave the type information out in this particular place. Indeed much more type information could be inferred automatically and for an actual implementation one would set up some sort of front end which would generate as much type information as possible so that the syntax we give here would only appear as an intermediate language. Cf. also Streicher [100] where situations are indicated in which the typing information in an application can not be inferred. To increase readability we shall, however, often suppress type information informally and in particular we abbreviate App_{σ,τ}(M, N) by (M N) and λx: σ.M^{τ} by λx: σ.M or even λx.M where appropriate. See Coquand’s survey article [16, Sect. 2.3] for a deeper discussion of such abus de langage.

Second, we are a bit sloppy about variable binding in our presentation. For example, as will emerge from the typing rules, the type σ in of R_{σ}^{N} contains a free variable of type N which becomes bound in R_{σ}^{N}. To be consistent with the usual notation we make this binding explicit in the case of Π-types, but otherwise not, since it would lead to overly clumsy terms.

We identify all constructions up to renaming of both free and bound variables and ensure by a suitable renaming policy that no unwanted variable captures occur. This could be made more precise by using de Bruijn indices instead of named variables, but the price to pay is that syntactic weakening would no longer be the identity and thus notation would become less readable.

The union of pre-terms, -types, and -contexts is called the set of pre-construc-tions. The prefix “pre” indicates that these need not “typecheck” in any sense. The actual terms, types, and contexts (constructions) are those which occur inside the typing judgements to be defined in the next section. To avoid repetition we use the synonyms “element”, “function”, “operation” for “terms”, where the latter two are mostly used for terms with distinguished free variables. We also sometimes say “set” instead of “type”.

2.1.2 Judgements

There are six kinds of judgements.

Γ ⊢  Γ is a well-formed context of variable declarations
Γ ⊢ σ  σ is a type in context Γ
Γ ⊢ M : σ  M is a term of type σ in context Γ
⊢ Γ = Δ  The contexts Γ and Δ are equal
Γ ⊢ σ = τ  The types σ and τ both in context Γ are equal
Γ ⊢ M = N : σ  The terms M and N of type σ are equal

The last three kinds of judgements state definitional equality of contexts, types, and terms. The valid judgements are defined inductively by the following clauses.

2.1.2.1 Context rules

Valid contexts are generated from the empty context by successive extensions.

\overline{⋄ ⊢} Empty  \frac{Γ ⊢ σ}{Γ, x : σ ⊢} Compr

It follows from our conventions on variable names that in rule Compr the variable x does not occur in Γ.

2.1.2.2 Type formation rules

For each of the type formers N, Id, Π there is a formation rule stating the conditions under which a pre-type having that type former as outermost constructor is well-formed. In particular the type formation rule for Π specifies its binding behaviour.

\frac{Γ, x : σ ⊢ τ}{Γ ⊢ Πx : σ.τ} Π-Form \frac{\begin{matrix}Γ ⊢ M : σ \\ Γ ⊢ N : σ \end{matrix}}{Γ ⊢ Id_{σ}(M, N)} Id-Form \frac{Γ ⊢}{Γ ⊢ N} N-Form

2.1.2.3 Term formation rules

First, there are two “structural rules” which define the typing of variables and type conversion along type equalities.

\frac{Γ, x: σ, Δ ⊢}{Γ, x: σ, Δ ⊢ x : σ} Var  \frac{\begin{matrix}Γ ⊢ σ = τ \\ Γ ⊢ M : σ \end{matrix}}{Γ ⊢ M : τ} Conv

The following rules each correspond to a constructor on pre-terms and define its well-formedness and typing. In particular they define the binding behaviour of the term formers λ, R_{σ}^{N}, and J_{σ,τ}. The rules can be grouped in pairs according to whether a certain type appears in the conclusion (introduction) or in a premise (elimination) of the rule. The rules corresponding to the Π-type are

\frac{Γ , x : σ ⊢ M : τ}{Γ ⊢ λx: σ.M^{τ} : Πx: σ.τ} Π-Intro \frac{Γ ⊢ M : Πx: σ.τ  Γ ⊢ N : σ}{Γ ⊢ App_{σ,τ}(M, N) : τ[x := N]} Π-Elim

The introduction rules for the natural numbers define the constructors 0 and Suc whereas the elimination rule defines mathematical induction.

\frac{Γ ⊢}{Γ ⊢ 0 : N} N-Intro-0  \frac{Γ ⊢ M : N}{Γ ⊢ Suc(M) : N} N-Intro-Suc

\frac{Γ , x: N ⊢ σ Γ ⊢ M_{z} : σ[x := 0] Γ , x: N , p: σ ⊢ M_{s} : σ[x := Suc(x)] Γ ⊢ N : N}{Γ ⊢ R_{σ}^{N}(M_{z}, M_{s}, N) : σ[x := N]} N-Elim

Notice here that the free variables x in σ as well as x and p in M_{s} are bound by R^{N}. We could have chosen a notation like

R_{x:N.σ}^{N}(M_{z}, x: N.p: σ.M_{s}, N)

to emphasise this. Instead we define later in Sect. 2.2 a high-level syntax for terms and types with free variables.

Finally, for the identity type Id_{σ}(M, N) the introduction rule corresponds to reflexivity, whereas the elimination rule is a generalised Leibniz principle which we study in more detail in Chapter 3.

\frac{Γ ⊢ M : σ}{Γ ⊢ Refl_{σ}(M) : Id_{σ}(M, M)} Id-Intro

\frac{Γ , x: σ, y: σ , p: Id_{σ}(x, y) ⊢ τ Γ , x: σ ⊢ M : τ[x := x][y := x][p := Refl_{σ}(x)] Γ ⊢ N_{1} : σ Γ ⊢ N_{2} : σ Γ ⊢ P : Id_{σ}(N_{1}, N_{2})}{Γ ⊢ J_{σ,τ}(M, N_{1}, N_{2}, P) : τ[x := N_{1}][y := N_{2}][p := P]} Id-Elim-J

2.1.2.4 Definitional equality

Definitional equality of types Γ ⊢ σ = τ, terms Γ ⊢ M = N : σ, and contexts Γ = Δ is defined as the least congruence with respect to all type and term formers closed under “definitional expansion”. This means that definitional equality is reflexive, symmetric, and transitive:

\frac{Γ ⊢ σ}{Γ ⊢ σ = σ} T-Refl \frac{Γ ⊢ σ = τ}{Γ ⊢ τ = σ} T-Sym \frac{Γ ⊢ σ = τ  Γ ⊢ τ = ρ}{Γ ⊢ σ = ρ} T-Trans

with analogous rules for definitional equality on contexts and terms. Furthermore there are congruence rules for every type and term former; for example the congruence rule for the successor and for the Π-type are:

\frac{Γ ⊢ M = M′ : N}{Γ ⊢ Suc(M) = Suc(M′) : N} C-Suc \frac{Γ ⊢ σ = σ′ Γ, x: σ ⊢ τ = τ′}{Γ ⊢ Πx: σ.τ = Πx: σ′.τ′} C-Π

Notice also the congruence rule for context extension.

\frac{⊢ Γ = Δ Γ ⊢ σ = τ}{⊢ Γ, x: σ = Δ, y: τ} C-Compr

Special attention is drawn to the congruence rule for abstraction (“ξ-rule”) because it is left out in some presentations of type theory. See [71] and Sect. 3.2.1.

\frac{Γ ⊢ Πx: σ.τ = Πx: σ′.τ′ Γ, x: σ ⊢ M = M′ : τ}{Γ ⊢ λx: σ.M^{τ} = λx: σ′.M′^{τ′} : Πx: σ.τ} C-Abstr

Finally, closure under definitional expansion is formalised by the following rules which are all understood under the premise that the respective left and right hand sides both have the indicated types.

\overline{Γ ⊢ App_{σ,τ}(λx: σ.M^{τ}, N) = M[x := N] : τ[x := N]} Π-Beta
\overline{Γ ⊢ R_{σ}^{N}(M_{z}, M_{s}, 0) = M_{z} : σ[x := 0]} Nat-Comp-Zero

Γ ⊢ R_{σ}^{N}(M_{z}, M_{s}, Suc(N)) = M_{s}[x := N][p := R_{σ}^{N}(M_{z}, M_{s}, N)] : σ[x := Suc(N)] Nat-Comp-Suc

Γ ⊢ J_{σ,τ}(M, N, N, Refl_{σ}(N)) =
M[x := N] : τ[x := N][y := N][p := Refl_{σ}(N)]

Id-Comp

Notice that, unlike propositional equality given by Id the definitional equality is not annotated by any justification or proof whatsoever. Thus, Γ ⊢ M = M′ : σ states that M and M′ are definitionally equal terms of type σ whereas Γ ⊢ P : Id_{σ}(M, M′) states that P is a proof that M and M′ are propositionally equal terms of type σ in context Γ. Also a definitional equality can never appear as an assumption in a context, whereas propositional equality obviously can. This stands in contrast to the system presented in [34] in the framework of so-called labelled deductive systems.

2.1.3 Notation

The empty context is usually left out in judgements; so we write ⊢ N instead of ⋄ ⊢ N. We sometimes write Γ ⊢ J for an indeterminate judgement where J may be of the form Γ, Γ = Δ, σ, σ = τ, M : σ, M = N : σ. In the running text the ambient context Γ and the derivation symbol ⊢ are often left out and informal equality reasoning may be used to justify equality judgements thereby implicitly using reflexivity, symmetry, transitivity, and the congruence rules.

We shall in the sequel sometimes use an abbreviated notation for inference rules whereby we omit the context Γ carried along previously. So a rule \frac{Δ⊢J}{Θ⊢J′} is understood as \frac{Γ,Δ⊢J}{Γ,Θ⊢J′}. This abbreviated notation appears also in [6] and [105]. We also use this abbreviated notation in the running text, so phrases like “let M : σ be … ” are understood in arbitrary context Γ. If Γ ⊢ σ then we sometimes write Γ ⊢ σ true to mean that there exists M with Γ ⊢ M : σ.

The implicit typing premises to equality rules mentioned above (Sect. 2.1.2.4) are also required in all subsequent equality rules. So an equality rule of the form

\frac{P}{Γ ⊢ M = N : σ}

is understood as

\frac{P, Γ ⊢ M : σ, Γ ⊢ N : σ}{Γ ⊢ M = N : σ}

We use the symbol ≡ for syntactic identity including α-conversion. So λx: N.x ≡ λy: N.y, but (λx: N.x) 0 ≢ 0.

The set of set-theoretic natural numbers is denoted ω. If n ∈ ω we sometimes write n also for the corresponding numeral in N, for example we write abbreviate Suc(Suc(Suc(0))) by 3.

2.1.4 Derived rules and meta-theoretic properties

The meta-theory of systems like the above has been the subject of extensive study [2,100,105,19,67,38]. For our development we need the following meta-theoretic properties whose proofs are standard and may be found e.g. in [67].

Proposition 2.1.1 (Weakening) Let Γ, Δ ⊢ and Γ ⊢ σ. If the judgement Γ, Δ ⊢ J is derivable then so is Γ, x: σ, Δ ⊢ J.

Proposition 2.1.2 (Substitution) Let Γ, x: σ, Δ ⊢ and Γ ⊢ M : σ. If the judgement Γ, x: σ, Δ ⊢ J is derivable then so is Γ, Δ[x := M] ⊢ J[x := M]

Proposition 2.1.3 If ⊢ Γ = Δ then Γ ⊢. If Γ ⊢ σ = τ then Γ ⊢ σ. If Γ ⊢ M = N : σ then Γ ⊢ M : σ.

Proposition 2.1.4 (Strong normalisation) The rewrite system obtained by directing the non-logical equality rules (Π-Beta, Id-Comp, Nat-Comp-Zero, Nat-Comp-Suc) from left to right is strongly normalising. This induces a decision procedure for definitional equality.

Proposition 2.1.5 (Decidability) It is decidable whether a judgement Γ ⊢ J is derivable.

Remark 2.1.6 The strong normalisation property implies in particular that every term in the empty context is definitionally equal to a canonical one, i.e. a term having Refl, 0, Suc, or λ as outermost term former.

Proposition 2.1.7 (Unicity of typing) If Γ ⊢ M : σ and Γ ⊢ M : τ then Γ ⊢ σ = τ.

Proposition 2.1.8 (Unicity of type formation) If Γ ⊢ Πx: σ.τ = Πx: σ′.τ′ then Γ ⊢ σ = σ′ and Γ, x: σ ⊢ τ = τ′. If Γ ⊢ Id_{σ}(M, N) = Id′_{σ}(M′, N′) then Γ ⊢ σ = σ′ and Γ ⊢ M = M′ : σ and Γ ⊢ N = N′ : σ.

These meta-properties continue to hold mutatis mutandis for the various extensions to the core type theory we are going to make.

2.1.4.1 N-canonicity

We are now in the position to make precise what we mean by the property that in the empty context terms of the natural numbers are canonical which we hinted at in the Introduction.

Definition 2.1.9 (N-canonicity) A type theory with natural numbers is N-ca-nonical if whenever ⋄ ⊢ M : N then ⋄ ⊢ M = \underbrace{Suc(… Suc(0) …)}_{n times} for some n ∈ ω.

It follows from Prop. 2.1.5 and Remark 2.1.6 above that the core type theory described so far is N-canonical. We remark that if Γ ⊢ M : N is a non-canonical element of the natural numbers and Γ ⊢ L : σ is any term of type σ then Γ ⊢ R_{σ}^{N}(L, [x: N, y: σ]L, M) : σ is a non-canonical element of type σ so that the role of N in the definition of N-canonicity is arbitrary.

2.2 High-level syntax

In the syntactic model constructions we are interested in we need to define various operations on contexts and will require the notion of relative contexts or “telescopes” [26]. We thus introduce some high-level syntax and derived rules and judgements in order to deal with these. We also introduce some abbreviational machinery to deal with definitions and substitutions.

2.2.1 Telescopes

If Γ and Δ = x_{1}: τ_{1}, …, x_{n}: τ_{n} are pre-contexts then we write Γ ⊢ Δ as an abbreviation for the n judgements Γ ⊢ τ_{1}, Γ, x_{1}: τ_{1} ⊢ τ_{2} up to Γ, x_{1}: τ_{1}, …, x_{n−1}: τ_{n−1} ⊢ τ_{n}. In this case we say that Δ is a context relative to or a telescope w.r.t. Γ. It can be shown by induction that Γ ⊢ Δ iff Γ, Δ ⊢ where according to our convention the variables in Δ have been suitably renamed. The type equality judgements are extended accordingly to telescopes. I.e. we write Γ ⊢ Δ = Δ′ if Δ and Δ′ have the same length and definitionally equal components.

2.2.2 Elements of telescopes and context morphisms

Assume Γ ⊢ Δ with Δ = x_{1} : τ_{1}, …, x_{n} : τ_{n}. If f = (M_{1}, …, M_{n}) is an n-tuple of pre-terms then we write Γ ⊢ f : Δ as an abbreviation for the n judgements Γ ⊢ M_{1} : τ_{1}, Γ ⊢ M_{2} : τ_{2}[x_{1} := M_{1}], up to Γ ⊢ M_{n} : τ_{n}[x_{1} := M_{1}] … [x_{n−1} := M_{n−1}]. We then call f an element of the telescope Δ. In the special case where Δ is independent of Γ, i.e. we have Γ ⊢ and Δ ⊢, we call f a substitution or a context morphism from Γ to Δ. In this situation we write Γ ⊢ f ⇒ Δ. Definitional equality is extended canonically to elements of telescopes, that is we write Γ ⊢ f = f′ : Δ if f and f′ have the same length and definitionally equal components.

Syntactic substitution generalises to elements of telescopes. If Γ ⊢ f : Δ and Γ, Δ ⊢ σ then we write σ[(x_{1}, …, x_{n}) := f] for the parallel substitution of all Δvariables x_{1} through x_{n} in σ by their companions in the n-tuple f. We then have Γ ⊢ σ[(x_{1}, …, x_{n}) := f]. If the variables are clear from the (linguistic) context we also write σ[f]. An analogous notation applies to substitution inside terms and telescopes.

The context morphisms include the identity from Γ to Γ which consists of the tuple of variables in Γ, and they are closed under composition, i.e. if f is a context morphism from Γ to Δ and g is a context morphism from Δ to Θ then the parallel substitution of f into g gives a context morphism from Γ to Θ denoted g ∘ f. In this way the contexts form a category, i.e. composition is associative and the identity is neutral.

We remark that the property of unicity of typing (Prop. 2.1.7) which holds for terms does not extend to elements of telescopes. For example the pair (0, Refl_{N}(0)) can be viewed as a substitution from ⋄ to x : N, p : Id_{N}(x, x) or to x : N, p : Id_{N}(0, 0). Therefore, elements of telescopes ought to be annotated with typing information which we shall, however, usually omit.

Since we are going to describe constructions involving abstractly given contexts and telescopes we need a means of introducing variables for them. If Γ is a precontext of length n and if γ = (γ_{1}, … γ_{n}) is an n-tuple of variables then γ : Γ denotes Γ with its variables renamed to γ_{1}… γ_{n}. This allows us for example to write γ : Γ ⊢ γ : Γ.

2.2.3 Definitions and substitution

Assume Γ, Δ ⊢ σ for some type expression σ. By the declaration

τ[δ : Δ] := σ

the meta-variable τ becomes an abbreviation for the expression σ. This notation emphasises that the variables from Δ are free in τ. For example we may define

eqzero[n : N] := Id_{N}(n, 0)

and in ambient context maxint : N

eqmax[n : N] := Id_{N}(n, maxint)

Explicit variable names in a substitution may now be omitted, for example the expression eqzero[5] denotes Id_{N}(5, 0) and eqmax[5] denotes Id_{N}(5, maxint). We also use square brackets as a form of first-order abstraction. I.e. we may write

[δ : Δ]σ

to emphasise the Δ-variables in σ. The above declaration can thus equivalently be written as

τ := [δ : Δ]σ

Whenever τ or [δ : Δ]σ appears inside some term then by suitable renaming it is ensured that none of the Δ-variables are captured.

Analogous conventions apply to terms, telescopes, and elements. The main application of first-order abstraction is the instantiation of binding operators like R^{N}. For example the following is a (somewhat contrived) proof that every natural number is equal to itself

n : N ⊢
R_{[n:N]Id_{N}(n,n)}^{N}(  by ind. on n
Refl_{N}(0) ,  base case
[n : N, p : Id_{N}(n, n)]Refl_{N}(Suc(n)) ,  ind. case
n) : Id_{N}(n, n)  conclusion

Observe the scoping of variable names here. The n in the subscript to R^{N} is different from the one declared in the global context.

It is the hope of the author that with these conventions a reasonable compromise between readability and formal correctness has been found.

2.3 Further type formers

In this section we introduce the syntax of a few further type formers such as Σ-types and universes. We also describe how Coquand-Huet’s Calculus of Constructions fits into our syntactic framework. It is understood that whenever a rule introduces new type or term formers then the raw syntax is suitably extended to account for these, and definitional equality is extended accordingly.

2.3.1 Unit type

We start with a unit type, which is sometimes handy for technical reasons. It introduces a type 1 with single canonical element ⋆. The unit type comes with an induction principle stating that ⋆ is the only inhabitant of 1 up to propositional equality. We shall later (Sect. 4.5.4) consider an extensional unit types which contains a single element ⋆ up to definitional equality.

\overline{⊢ 1} Unit-Form  \overline{⋆ : 1} Unit-Intro
\frac{x: 1 ⊢ σ[x] ⊢ M : σ[⋆] ⊢ N : 1}{⊢ R_{σ}^{1}(M, N) : σ[N]} Unit-Elim
\overline{⊢ R_{σ}^{1}(M, ⋆) = M : σ[⋆]} Unit-Comp

2.3.2 Σ-types

Σ-types serve to internalise telescopes. They are given by the following rules.

\frac{⊢ σ x: σ ⊢ τ[x]}{⊢ Σx: σ.τ[x]} Σ-Form \frac{⊢ M : σ  ⊢ N : τ[M]}{⊢ pair_{σ,τ}(M, N) : Σx: σ.τ[x]} Σ-Intro

\frac{\begin{matrix}p : Σx: σ.τ[x] ⊢ ρ[p] \\ x: σ, y: τ[x] ⊢ M[x, y] : ρ[pair_{σ,τ}(x, y)] \end{matrix}  ⊢ P : Σx: σ.τ[x]}{⊢ R_{σ,τ,ρ}^{Σ}(M, P) : ρ[P]} Σ-Elim
R_{σ,τ,ρ}^{Σ}(M, pair_{σ,τ}(N, O)) = M[N, O] : ρ[pair_{σ,τ}(N, O)]

Σ-Comp In case type information can be inferred from the context we abbreviate the pairing operator pair_{σ,τ}(M, N) by (M, N). By suitable instantiation of R^{Σ} we can define projections .1 and .2 which provide a left inverse to the pairing operator viewed as the context morphism x: σ, y: τ ⊢ pair_{σ,τ}(x, y) ⇒ Σx: σ.τ:

\begin{matrix}M.1 := R_{σ,τ,σ}^{Σ}([x: σ, y: τ]x , M) : σ \\ M.2 := R_{σ,τ,[p:Σx:σ.τ]τ[p.1]}^{Σ}([x: σ, y: τ]y , M) : τ[M.1] \end{matrix}

Now from Σ-Comp we get pair(M, N).1 = M and pair(M, N).2 = N. But pairing is not surjective which is why Σ-types only approximate the summation obtained from telescopes. However, using R^{Σ} we can find a term of the type

p: Σx: σ.τ ⊢ Id_{Σx:σ.τ}(p, ⟨p.1, p.2⟩)

namely R^{Σ}(p , [x: σ, y: τ]Refl_{Σx:σ.τ}(pair(x, y))). Thus “surjective pairing holds propositionally”.

2.3.3 Function and cartesian product types

Function spaces and cartesian products are special cases of dependent product and sum. Writing σ → τ := Πx: σ.τ and σ ×τ := Σx: σ.τ we have ⊢ σ → τ and ⊢ σ ×τ provided ⊢ σ and ⊢ τ and we obtain corresponding introduction and elimination rules.

Although Σ-types and unit type are not absolutely crucial we consider them from now on as part of the core type theory which we henceforth refer to by TT. The type theory TT is a sub-system of Martin-Löf’s intensional type theory [85].

2.3.4 The Calculus of Constructions

Coquand-Huet’s [19] Calculus of Constructions is a dependently typed calculus with products (Π-types) only and a universe Prop that is closed under impredicative quantification. The latter is described by the following rules.

\overline{⊢ Prop} Prop-Form \frac{⊢ S : Prop}{⊢ Prf(S)} Proof-Form
\frac{x: σ ⊢ S[x] : Prop}{⊢ ∀x: σ.S[x] : Prop} Prop-Intro
\overline{⊢ Prf(∀x: σ.S[x]) = Πx: σ.Prf(S[x])} Prop-Eq

The terms of Prop are called “propositions”. If M : Prop is a proposition then Prf(M) is the type of its proofs. A type of the form Prf(M) for some M : Prop is also called a proposition. The term “propositions” for these terms (and types) can be misleading because in some applications of the Calculus of Constructions the universe Prop is used to represent both datatypes and propositions [87]. In the present work this will not be done.

The operator ∀ together with the equation Prop-Eq gives that the product over a family of propositions (indexed over σ) is a proposition again. In Coquand and Huet’s original presentation, terms of type Prop and their corresponding Prf-types were syntactically identified. The presentation used here is due to Streicher [100]. The Calculus of Constructions has types in the empty context, for example the type of falsehood ⊢ Πs: Prop.Prf(s).

We use logical connectives ⇒, ∧, ∨, tt, ff, ¬ for their encodings in the Calculus of Constructions. If P, Q : Prop then their implication P ⇒ Q is defined as the proposition ∀x: Prf(P).Q, their conjunction is defined as the proposition ∀c: Prop.(P ⇒ Q ⇒ c) ⇒ c, and their disjunction P ∨Q is given by ∀c: Prop.(P ⇒ c) ⇒ (Q ⇒ c) ⇒ c. The true proposition tt is defined as ∀c: Prop.c ⇒ c. The false proposition ff is defined as ∀c: Prop.Prf(c). The negation ¬P of proposition P is defined as P ⇒ ff. If x: σ ⊢ P : Prop then we define the existential quantification of P as ∃x: σ.P := ∀c: Prop.(∀x: σ.P ⇒ c) ⇒ c. For M, N: σ we define Leibniz equality M =^{L} N as

∀P: σ → Prop.(P M) ⇒ (P N)

It is well-known that the proof rules for these connectives in higher-order intuitionistic logic are derivable [19]. Extending the notation from Sect. 2.1.3 we write Γ ⊢ P true for Γ ⊢ P : Prop to mean that there exists P with Γ ⊢ P : Prf(P).

The syntactic properties stated in Sect. 2.1.4 including decidability of equality continue to hold for the Calculus of Constructions, see e.g. [3].

2.3.5 Universes

A universe is a type U containing names or codes for types. This is achieved by an operator El which for each term M : U gives a type El(M). A universe can be closed under various type formers in which case there are functions similar to ∀ which perform the type formation on the level of codes. As an example we give the rules for a universe closed under Π and containing the natural numbers.

\overline{⊢ U} U-Form \frac{⊢ M : U}{⊢ El(M)} El-Form

\frac{⊢ S : U x : El(S) ⊢ T : U}{⊢ Π̂(S, T) : U} U-Intro-Π
El(Π̂(S, T)) = Πx: El(S).El(T)

U-Eq-Π

\overline{⊢ N̂ : U} U-Intro-N \overline{⊢ El(N̂) = N} U-Eq-N

We do not consider “universe-induction” [85, p. 101ff.]. Universes can be used to represent modules [41] and also increase the strength of the type theory. For example in the presence of a universe containing an empty type 0 (which we haven’t defined) it becomes possible to find an inhabitant of the type ⊢ Πp : Id_{N}(0, Suc(0)).0 which corresponds to Peano’s fourth axiom [97]. For a type theory without universes it may therefore be appropriate to introduce this as an axiom by the following rule:

\frac{Γ ⊢ M : Id_{N}(0, Suc(0)) Γ ⊢ σ}{Γ ⊢ Peano_{σ}(M) : σ} Peano-4

This rule does not introduce non-canonical elements in the empty context, because with Γ = ⋄ the premises to Peano-4 cannot be met. In [107] it is shown how a term Peano_{σ}(M) can be defined by induction on the form of σ in the core type theory without empty types and universes. Cf.. also Sect. 6.4.

2.3.6 Quotient types

Quotient types permit the redefinition of the propositional equality on a type. According to the particular notion of propositional equality chosen we obtain different formulations of quotient types. In this thesis we study quotient types with respect to Leibniz equality (Sect. 5.1), the identity type (Sects. 3.2.6.1, 5.3), and (marginally) also w.r.t. extensional ‘definitional’ equality (Sect. 3.2.6.1). We defer the syntactic rules to these sections. Here we only remark that intensional formulations of quotient types must invariably introduce non-canonical elements of identity types which establish propositional equality of equivalence classes of related elements, and therefore the statement made in Remark 2.1.6 is no longer true in the presence of quotient types unless definitional equality is redefined using a syntactic model like the ones presented in Chapter 5.

2.4 Abstract semantics of type theory

As described in the Introduction we require a precise definition of what a model for a dependently typed calculus should be and also a generic interpretation function mapping syntactic objects to objects in the model. Many notions of model have been proposed in the literature; for a comprehensive treatment see e.g. [56]. We use a derivative of categories with attributes as introduced by Cartmell [15] and later used by Pitts [89] (dubbed type categories there) and Moggi [84]. This notion seems to offer the right level of generality for our purposes, and nevertheless does not introduce any unnecessary formal padding.

As opposed to the “display-map” approach [103] or “contextual categories” [15,99], in categories with attributes a distinction is made between “families” (the denotations of types) and their corresponding context extensions. In particular, the map which assigns the corresponding context extension to a family need not be injective. This extra generality will be required in almost all the model constructions we shall study.

The original definition of categories with attributes involves conditional equations, since certain diagrams are required to be pullbacks. This is a disadvantage if one wants to construct models internally in some type theory and check the model equations using normalisation. We thus describe a notion of model without conditional equations inspired by Curien’s categorical combinators [21,22,23]. This means that in addition to abstract contexts and families we introduce a third sort of abstract sections which are in one-one correspondence to sections (right inverses) to projections. Their separate introduction allows to quantify over them without using conditional equations. Ehrhard [30] and Ritter [92] achieves the same goal by introducing arbitrary morphisms between families as a new sort. For our purposes this appears overly general and the price to pay is that a formal unit type must be introduced and that the equational theory becomes more complicated.

Since a guideline in our description of the semantics of dependent types is to stay as close to the syntax as possible without losing the advantages which abstract semantics offers, we have chosen the name syntactic categories with attributes for the notion of model to be described here.

2.4.1 Syntactic categories with attributes

Definition 2.4.1 A syntactic category with attributes is given by the following data:

i. A category C with terminal object ⊤. The objects of C are called contexts (A, B^{1}, Γ, Δ, …), the morphisms (f, g, h, …) are called context morphisms. The unique morphism from the terminal object to Γ is denoted !_{Γ}. ii. A functor Fam : C^{op} → Sets. If f ∈ C(Γ, Δ) is a context morphism

1Read “Alpha”, “Beta”.

and σ ∈ Fam(Δ) then Fam(f)(σ) ∈ Fam(Γ) is abbreviated by σ{f}. The elements of Fam(Γ) are called types or families (σ, τ, ρ,…) in context Γ.

iii. If σ is a family in context Γ then there is a context Γ · σ called the comprehension of σ, and a context morphism p(σ) ∈ C(Γ · σ, Γ) called the display map or the projection of σ. Moreover, if in addition f ∈ C(B, Γ) then q(f, σ) ∈ C(B · σ{f}, Γ · σ) and

[figure: B · σ{f}; q(f, σ); Γ · σ; B; p(σ{f}); f; Γ; p(σ)]

commutes.^{2} The assignment q(−, −) is functorial in the sense that q(id_{Γ}, σ) = id_{Γ·σ} and for g ∈ C(A, B) also q(f ∘ g, σ) = q(f, σ) ∘ q(g, σ{f}). Note that these equations “typecheck” by virtue of the functoriality of Fam.

iv. For each σ ∈ Fam(Γ) there is a set Sect(σ) of sections or terms (M, N, …).

v. If M ∈ Sect(σ) for σ ∈ Fam(Γ) then \overline{M} ∈ C(Γ, Γ · σ) and

p(σ) ∘ \overline{M} = id_{Γ}  (Sect-Char)

or diagrammatically

Γ  \overline{\overline{M}  ^{}}Γ · σ
[figure: id_{Γ}; p(σ)]

Γ vi. If σ ∈ Fam(Δ) and f ∈ C(Γ, Δ · σ) then Hd(f) ∈ Sect(σ{p(σ) ∘ f}) and

2Henceforth all diagrams are supposed to commute unless stated otherwise. The diagrams have been typeset using Paul Taylor’s versatile macro package.

q(p(σ) ∘ f, σ) ∘ \overline{Hd(f)} = f  (Mor-Inv)

or diagrammatically

Γ · σ\{p(σ) ∘ f\} \overline{q(p(σ) ∘ f, σ)^{}}Δ · σ
[figure: f]
[figure: Γ; \overline{Hd(f)}; p(σ) ∘ f; Δ; p(σ)]

Moreover, if f : Γ → Δ and M ∈ Sect(σ{f}) then

M = Hd(q(f, σ) ∘ \overline{M})  (Sect-Inv)

which at the level of contexts becomes

Γ · σ\{f\}  \overline{q(f, σ)  ^{}}Δ · σ
[figure: q(f, σ) ∘ \overline{M}]
[figure: Γ; \overline{M} = \overline{Hd(q(f, σ) ∘ \overline{M})}; f; Δ; p(σ)]

This definition is rather condensed and may need some explanation. C being a category means that there is an associative composition (∘) for context morphisms which has a left- and right-neutral element, the identity id_{Γ}. Fam being a functor from C^{op} to the category Sets of sets and functions means that for each context Γ there is a set Fam(Γ) of possible interpretations of types over Γ and if f : B → Γ then Fam(f) is a function from Fam(Γ) to Fam(B) written −{f} and satisfying σ{id_{Γ}} = σ and σ{f ∘ g} = σ{f}{g} for σ ∈ Fam(Γ) and g : A → B.

The projection p(σ) associates to each family σ ∈ Fam(Γ) a forgetful context morphism Γ · σ → Γ. Its codomain Γ · σ corresponds to the extension of context Γ by type σ. Substitution along the morphism p(σ) corresponds to weakening.

The morphism q(f, σ) : Γ · σ{f} → Δ · σ can be seen as a “weakening” of f. On the Δ-part of Δ · σ{f} it behaves like f (this expressed by the commutative square for q) and on the σ{f}-part it does nothing (this is indirectly expressed by the equation Mor-Inv.

The mapping M ↦ \overline{M} associates a context morphism to a section M from Γ to Γ · σ which is the identity everywhere but on the last component. This is expressed by the equation Sect-Char. The equation Mor-Inv is a kind of surjective pairing property for context morphisms. It expresses that (and how) f : Γ → Δ · σ can be recovered from its two components Hd(f) and p(σ) ∘ f.

The (at first sight strange) “typing” of Hd may be explained as follows: A context morphism f : Γ → Δ · σ should be thought of as containing two components: A context morphism from Γ to Δ (obtainable as p(σ) ∘ f) and a section of σ submitted to substitution along this first component of f, i.e. an element of Sect(σ{p(σ) ∘ f}). This is Hd(f).

We continue by giving a few examples of syntactic categories with attributes which should clarify the definition further. In particular, the term model provides some more intuition and should be carefully gone through by the reader unfamiliar with categorical models of type theory.

Example 2.4.2 (Term model) Consider a calculus of dependent types T like the core calculus TT described in Section 2.1. We construct a syntactic category with attributes, which will later turn out to be the initial one. The underlying category of contexts C has as objects the well-formed contexts of T and as morphisms context morphisms as defined in Sect. 2.2.2 modulo definitional equality. This is easily seen to be a category in which the empty context is a terminal object. For a context Γ the set Fam(Γ) is the set of well-formed types in this context, i.e. the set of valid judgements Γ ⊢ σ. Context extension is inherited from the syntax, so Γ · (Γ ⊢ σ) = Γ, x: σ and the display map p(Γ ⊢ σ) is the context morphism consisting of the variables in Γ. Substitution is syntactic substitution, i.e. if (M_{1}, …, M_{n}) : B → Γ = (x_{1} : σ_{1}, …, x_{n} : σ_{n}) then (Γ ⊢ σ){(M_{1}, …, M_{n})} = B ⊢ σ[x_{1} := M_{1}] … [x_{n} := M_{n}]. The “weakened” context morphism q((M_{1}, …, M_{n}), σ) : B, x: σ[x_{1} := M_{1}] … [x_{n} := M_{n}] ⟶ Γ, x: σ between the respective comprehensions then becomes (M_{1}, …, M_{n}, x) where x : σ[x_{1} := M_{1}] … [x_{n} := M_{n}] is the last variable of the comprehension of the substituted type. If Γ ⊢ σ is a family then Sect(Γ ⊢ σ) is the set of terms Γ ⊢ M : σ again modulo definitional equality. To such a section we associate the context morphism \overline{x_{1} : σ_{1}, …, x_{n} : σ_{n} ⊢ M : σ} = (x_{1}, …, x_{n}, M). Finally if f = (M_{1}, …, M_{n}) is a context morphism we put Hd(f) := M_{n}. The verification that this forms a syntactic category with attributes is straightforward. The term model of the Calculus of Constructions has been thoroughly studied by Streicher [100]; in particular a completeness result for abstract categorical semantics w.r.t. syntax is proved there.

The next example is taken from [55] with minor adjustments.

Example 2.4.3 (Families over sets) Let F be a small category with terminal object. We form a syntactic category with attributes over the category Sets of sets and functions as follows: If Γ is a set then Fam(Γ) is the set of all functions from Γ to Ob(F). If σ ∈ Fam(Γ) then Γ · σ is the disjoint union {(γ, s) | γ ∈ Γ and s ∈ F(1, σ(γ))}. The map p(σ) is the first projection. If furthermore f : B → Γ then σ{f} is the composition σ ∘ f and q(f, σ) sends (b, s) where b ∈ B and s ∈ F(1, σ(f(b))) to (f(b), s). Finally Sect(σ) is the cartesian product ∏_{γ∈Γ} F(1, σ(γ)). We leave the remaining definitions and the verifications to the reader.

In this example families carry an intensional structure, namely the morphisms in F which are not global sections and thus are not reflected into the underlying category.

Example 2.4.4 (Set-theoretic model) An important special case of the previous example arises when F is chosen to be the full subcategory of Sets consisting of small sets, i.e. with cardinality smaller than some inaccessible cardinal (see Sect. 5.2.2.6). We then obtain the familiar set-theoretic model [65,16]. of type theory, which may e.g. be used to demonstrate equational consistency, i.e. the fact that the type ⊢ Id_{N}(0, Suc(0)) is not inhabited.

Example 2.4.5 (Families of ω-sets) An ω-set is a pair X = (|X|, ⊩_{X}) where |X| is a set and ⊩_{X} is a surjective relation between |X| and the set ω of natural numbers. If n ⊩_{X} x for some n ∈ ω and x ∈ |X| then we say that n realises x or that n is a realiser for x. Surjectivity means that every element of |X| has a realiser. A morphism between two ω-sets X and Y is a function f from |X| to |Y | for which there exists a natural number n (viewed as a code for a partial recursive function) such that for all x ∈ |X| and realisers m ⊩_{X} x, the computation {n}(m) terminates and is a realiser for f(x). (We write {n}(m) for the application of the partial recursive function coded by n to input m.) We say that f is tracked by n. The ω-sets with these morphisms form a category with terminal object given by the singleton set {⋆} equipped with the trivial realisability relation, i.e. every natural number realises ⋆ and the unique morphism is realised by any code for a total recursive function.

We construct a syntactic category with attributes over the category of ω-sets as follows: A family over an ω-set Γ is an assignment of a (small) ω-set to each element of |Γ|. If σ = (σ_{γ})_{γ∈|Γ|} is such a family then its comprehension Γ · σ is defined by |Γ·σ| := {(γ, s) | γ ∈ |Γ| and s ∈ |σ_{γ}|} and n ⊩_{Γ·σ} (γ, s) iff {p_{1}}(n) ⊩_{Γ} γ and {p_{2}}(n) ⊩_{σ_{γ}} s where p_{1} and p_{2} are codes for the components of some recursive bijection between ω and ω×ω. The display map p(σ) is the first projection tracked by p_{1}. If σ is such a family above Γ and f is a morphism from B to Γ tracked by n ∈ ω then we define the substitution σ{f} simply by composition, viz. as the family (σ_{f(β)})_{β∈|B|}. The morphism q(f, σ) sends (β, s) to (f(β), s) and is tracked by the pairing of n and a code for the identity. If σ is as before then a section is an element M of the cartesian product ∏_{γ∈|Γ|} |σ_{γ}| together with a realiser, i.e. some natural number n such that whenever m ⊩_{Γ} γ then {n}(m) ⊩_{σ_{γ}} M_{γ}. We leave the definition of the remaining components to the reader.

Remark 2.4.6 One might try to define a syntactic category with attributes over Sets, say, by defining Fam(Γ) as the set of all functions with codomain Γ and if σ : Σ ^{}Γ is such a function and furthermore f : B → Γ then to define substitution as the pullback

[figure: {(b, s) ∈ B × Σ | f(b) = σ(s)}; Σ; B; f; Γ; σ]

This does not work because then for example σ{id_{Γ}} is only isomorphic, but not equal to σ. Also the composition law is not strictly satisfied. In [46] we describe a canonical construction which turns a structure like the above into a syntactic category with attributes.

Some remarks on notation. We usually refer to a syntactic category with attributes by the name of its category of contexts. If C is any category then a syntactic category with attributes having C as underlying category of contexts will be called a syntactic category with attributes over C. Whenever we use one of the operator symbols which were part of the definition of a syntactic category with attributes it should be clear from the context to which syntactic category with attributes we are referring.

Although the formulation of the above definition might suggest something different, a syntactic category with attributes is meant to be a structure, i.e. the various components referred to by the operator symbols are explicitly given and not merely required to exist. The same applies to further definitions in this style.

We begin our investigation of syntactic categories with attributes with a characterisation of the sections as special context morphisms.

Proposition 2.4.7 Let σ ∈ Fam(Γ). The assignment M ↦ \overline{M} is a bijection between Sect(σ) and {f : Γ → Γ · σ | p(σ) ∘ f = id_{Γ}}.

Proof. One direction is part of the definition of a model. Conversely, if f : Γ → Γ · σ has the specified property then Hd(f) is a section of σ{id_{Γ}} = σ. It is immediate from the definition that these two maps are inverse to each other. □

So up to bijective correspondence the set Sect(σ) is the set of sections of the corresponding display map. By making these sections part of the structure we can quantify over sections without having to introduce conditional equations.

Our next step consists of establishing a correspondence to the usual notions of model which make use of pullbacks.

Proposition 2.4.8 Every diagram of the form

[figure: B · σ{f}; q(f, S); Γ · σ; B; p(σ{f}); f; Γ; p(σ)]

is a pullback.

Proof. Let u : A → B and v : A → Γ · σ be context morphisms such that f ∘ u = p(σ) ∘ v. The unique mediating morphism from A to B · σ{f} is given by q(u, σ\{f\}) ∘ \overline{Hd(v)}. Indeed

p(σ\{f\}) ∘ q(u, σ\{f\}) ∘ \overline{Hd(v)} =
u ∘ p(σ\{u ∘ f\}) ∘ \overline{Hd(v)} =  since Hd(v) ∈ Sect(σ\{u ∘ f\})
u
[figure: A · σ{f ∘ u}; q(u, σ{f}); B · σ{f}; q(f, σ); Γ · σ]

[figure: A; \overline{Hd(v)}; p(σ\{f ∘ u\}); u; B; p(σ\{f\}); f; Γ; σ]

Similarly we have

q(f, σ) ∘ q(u, σ\{f\}) ∘ \overline{Hd(v)}
= q(f ∘ u, σ) ∘ \overline{Hd(v)}
= v  by Mor-Inv

Chapter 2. Syntax and semantics of dependent types 42 For uniqueness let w : A → B·σ{f} be such that q(f, σ) ∘ w = v and p(σ{f}) ∘ w = u. Then

Hd(w)
= Hd(q(fu, σ) ∘ \overline{Hd(w)})  by Sect-Inv
= Hd(q(f, σ) ∘ q(u, σ\{f\}) ∘ \overline{Hd(w)})
= Hd(q(f, σ) ∘ w)  by Mor-Inv
= Hd(v)  by assumption

and thus

w =
q(u, σ\{f\}) ∘ \overline{Hd(w)} =
q(u, σ\{f\}) ∘ \overline{Hd(v)}

as required. □ This property has the consequence that if f : B → Γ · σ then Hd(f) is the unique section M ∈ Sect(σ\{f\}) with q(p(σ) ∘ f, σ) ∘ \overline{M} = f. This implies the following identities. Lemma 2.4.9 Let A, B, Γ be contexts and σ ∈ Fam(Γ).

i. Hd(q(f, σ) ∘ g) = Hd(g) for f : B → Γ and g : A → B · σ{f}.

ii. Hd(\overline{Hd(f)} ∘ g) = Hd(f ∘ g) for f : B → Γ · σ and g : A → B. We can furthermore use the pullback property in order to characterise syntactic categories with attributes. Proposition 2.4.10 Let C be a category with terminal object and equipped with the following data:

– A functor Fam : C^{op} → Sets with morphism part written −{−} as in Def. 2.4.1.

– For each σ ∈ Fam(Γ) a C-morphism with codomain Γ denoted Γ · σ ^{p(σ)}^{}Γ.

– For f ∈ C(B, Γ) and σ ∈ Fam(Γ) a pullback square

[figure: B · σ{f}; q(f, σ); Γ · σ; B; p(σ{f}); f; Γ; p(σ)]

– For each σ ∈ Fam(Γ) a set Sect(σ) and a bijection

\overline{−} : Sect(σ) ^{}\{f ∈ C(Γ, Γ · σ) | p(σ) ∘ f = id_{Γ}\}

Then there is a unique way of completing this structure to a syntactic category with attributes.

Proof. It only remains to define the Hd(−) operation and to check the equations and uniqueness of the particular choice made. Let f : B → Γ · σ. The unique mediating morphism in

B

[figure: f; id_{B}]
B · σ\{f\} \overline{q(p(σ) ∘ f, σ)^{}}Γ · σ

[figure: B; p(σ{f}); p(σ) ∘ f] Γ^{p(σ)^{}}

is a section of σ{p(σ) ∘ f}. We let Hd(f) be the corresponding section of σ{p(σ) ∘ f}. Uniqueness of this choice follows from the universality of the pullback and the equations are routine calculation. □

Remark 2.4.11 A special case of Prop 2.4.10 arises when the bijection \overline{−} is an identity, i.e. if Sect(σ) equals the set of right inverses to p(σ). Such a structure is called “category with attributes” by Cartmell and Moggi [15,84] and a “type category” by Pitts [89]. This notion in turn is equivalent to Jacobs’ notion of full split comprehension category [56], a notion of model based on fibrations.

2.4.1.1 Substitution on sections

Assume f : B → Γ, σ ∈ Fam(Γ), and M ∈ Sect(σ). We construct a section M{f} ∈ Sect(σ{f}) as

M\{f\} = Hd(\overline{M} ∘ f)

This reflects the intuition that substitution in terms is composition rather than induced by abstract universal properties. If in particular the morphism f happens to be a display map, i.e. of the form p(τ) for some τ ∈ Fam(Γ), then the “substitution” M{p(τ)} is the weakening of M. Alternatively we can identify the morphism \overline{M\{f\}} as the unique mediating morphism in the diagram

B

[figure: \overline{M} ∘ f; id_{B}]
B · σ{f} q(f, σ) ^{}Γ · σ

[figure: B; p(σ{f}); f] Γ^{p(σ)^{}}

whereby we get that if q(f, σ) ∘ \overline{N} = \overline{M} ∘ f for some N ∈ Sect(σ\{f\}) then N = M{f}.

2.4.1.2 Notation for weakening

If σ, τ ∈ Fam(Γ), M ∈ Sect(σ), and f : B → Γ we introduce the following abbreviated notations for weakening.

\begin{aligned}σ^{+} & := & σ\{p(τ)\} \\ M^{+} & := & M\{p(τ)\}(= Hd(\overline{M} ∘ p(τ))) \\ f^{+} & := & q(f, σ) \end{aligned}

This notation being ambiguous (e.g. f^{+} can mean both q(f, σ) and q(f, τ)) we use it only if the meaning is clear from the context. In the term model we have (Γ ⊢ σ)^{+} = Γ, x: τ ⊢ σ and (Γ ⊢ M : σ)^{+} = Γ, x: τ ⊢ M : σ.

2.4.1.3 Handling of variables.

If σ ∈ Fam(Γ) then Hd(id_{Γ·σ}) is a section of σ{p(σ)}. In the term model it corresponds to the term Γ, x : σ ⊢ x : σ where the second instance of σ is actually weakened. We abbreviate this section by v_{σ}. The thus defined “semantic variables” are stable under substitution in the following sense.

Lemma 2.4.12 If f : B → Γ and σ ∈ Fam(Γ) then

v_{σ}{q(f, σ)} = v_{σ{f}}

We can also establish that the substitution of a section into a variable results in that section; this corresponds to the syntactic triviality x[x := M] = M.

Lemma 2.4.13 If σ ∈ Fam(Γ) and M ∈ Sect(σ) then

v_{σ}\{\overline{M}\} = M

Proof. Routine calculation. □

We could have introduced v_{σ} as a primitive together with an operator Cons which turns a context morphism f : B → Γ and a section M ∈ Sect(σ{f}) into a context morphism Cons(M, f) : B → Γ · σ. The morphism q(f, σ) then becomes definable as Cons(v_{σ{f}}, f ∘ p(σ{f})). We leave it as an exercise to work out the details of this alternative description.^{3}

3In the meantime this “exercise” has been (independently) worked out by P. Dybjer and it turns out that the resulting notion of model without conditional equations is much more natural and intuitive than ours. If this thesis would be written again, certainly this notion would be used instead.

The variables other than the last one are obtained as successive weakenings of v_{σ}. For example if σ ∈ Fam(Γ) and τ ∈ Fam(Γ · σ) then v_{τ} ∈ Sect(τ^{+}) and v_{σ}^{+} ∈ Sect(σ^{+}^{+}).

2.4.2 Type constructors

We now turn to the description of the semantic companions to the type formers described in Sect. 2.1. These semantic operators will be defined in such a way that the term model always provides an instance. This precludes their definition by universal properties as is usually done in the literature (e.g. [100,56]). Instead we must ask for stability under substitution of all type and term formers not only the constructors. This sometimes leads to more complicated formulations, but it is the only way to identify as models the various syntactic constructions to be defined later.

2.4.2.1 Dependent Products

Definition 2.4.14 Assume a syntactic category with attributes C. We say that C is equipped with dependent products if the following hold.

– For every context Γ and families σ ∈ Fam(Γ), τ ∈ Fam(Γ · σ) there is a distinguished family Π(σ, τ) ∈ Fam(Γ).

– If M ∈ Sect(τ) then there is a distinguished section λ_{σ,τ}(M) ∈ Sect(Π(σ, τ)).

– If M ∈ Sect(Π(σ, τ)) and N ∈ Sect(σ) then there is a distinguished section App_{σ , τ}(M, N) ∈ Sect(τ\{\overline{N}\}).

– If f : B → Γ then

Π(σ, τ){f} = Π(σ{f}, τ{q(f, σ)})

and for M ∈ Sect(Π(σ, τ)), N ∈ Sect(σ)

App_{σ , τ}(M, N){f} = App_{σ{f} , τ{q(f,σ)}}(M{f}, N{f})

and for M ∈ Sect(τ)

λ_{σ,τ}(M){f} = λ_{σ{f},τ{q(f,σ)}}(M{q(f, σ)})

– If M ∈ Sect(τ) and N ∈ Sect(σ) then App_{σ , τ}(λ_{σ,τ}(M), N) = M\{\overline{N}\}.

This definition of dependent products almost verbally follows the syntactic definition of Π-types. The requirements on compatibility of reindexing with the dependent product constructor corresponds to the syntactic definition of substitution as distributive over type- and term constructors.

Remark 2.4.15 We could require an “η-rule” too, i.e. for M ∈ Sect(Π(σ, τ))

λ_{σ,τ}(App_{σ{p(σ)} , τ{q(p(σ),σ)}}(M^{+}, v_{σ})) = M

Then the compatibility condition on λ_{σ,τ}(−) could be dropped and in fact Π would enjoy a universal property. However then the term model would not have dependent products unless an η-rule were present in the syntax.

Proposition 2.4.16 The term model from Example 2.4.2 is equipped with dependent products if the underlying syntax has Π-types.

Proof. If σ ∈ Fam(Γ) and τ ∈ Fam(Γ · σ) then Γ is a valid context and Γ ⊢ σ and Γ, x : σ ⊢ τ by definition of the term model. We then put Π(σ, τ) := Πx : σ.τ ∈ Fam(Γ). If f : B → Γ is a (syntactic) context morphism then clearly

(Πx : σ.τ)[f] = Πx : σ[f].τ[(f, x)]

by definition of syntactic substitution. Next if M ∈ Sect(τ) then Γ, x : σ ⊢ M : τ so we put λ_{σ,τ}(M) := λx: σ.M ∈ Sect(Π(σ, τ)). Conversely, if M ∈ Sect(Π(σ, τ)) and N ∈ Sect(σ) then Γ ⊢ M : Πx : σ.τ and Γ ⊢ N : σ so we put App_{σ , τ}(M, N) := (M N). Again by definition of syntactic substitution these choices meet the coherence requirements and moreover by Pi-Beta the defining equation is also satisfied. We also see that the “η-rule” mentioned in the above remark corresponds to λx : σ.M x = M which does not necessarily hold. □

We now give another characterisation of dependent products which is sometimes easier to check.

Proposition 2.4.17 A syntactic category with attributes has dependent products iff for each family σ ∈ Fam(Γ) and τ ∈ Fam(Γ · σ) there is a distinguished family Π(σ, τ) ∈ Fam(Γ) and a morphism

ev_{σ,τ} : Γ · σ · Π(σ, τ){p(σ)} → Γ · σ · τ

with p(τ) ∘ ev_{σ,τ} = p(Π(σ, τ){p(σ)}) in such a way that for every section M ∈ Sect(τ) there exists a distinguished section λ_{σ,τ}(M) ∈ Sect(Π(σ, τ)) such that ev_{σ,τ} ∘ \overline{λ_{σ,τ}(M)\{p(σ)\}} = \overline{M}, and moreover the following three coherence conditions are satisfied for any morphism f : B → Γ:

– Π(σ, τ){f} = Π(σ{f}, τ{q(f, σ)}

–

.  \overline{q(q(f, σ), Π(σ, τ)\{p(σ)\})^{}}.

[figure: .; ^{ev^{σ{f},τ{q(f,σ)}}}; q(q(f, σ), τ); .; ^{ev^{σ,τ}}]

– λ_{σ,τ}(M){f} = λ_{σ{f},τ{q(f,σ)}}(M{q(f, σ)})

Proof. We give the proof for the term model. The general case is an exercise in categorical notation. In the situation γ : Γ ⊢ σ and γ : Γ, x : σ ⊢ τ we define the context morphism ev_{σ,τ} as

γ: Γ, s: σ, f: Πx: σ.τ ⊢ (γ, s, f s) : γ: Γ, s: σ, t: τ

Conversely if we are given a context morphism ev_{σ,τ} with the above source and target and satisfying the commutativity requirement then we must have

ev_{σ,τ} = [γ: Γ, s: σ, f: Πx: σ.τ](γ, s, A[s, f])

for some term

γ: Γ, s: σ, f: Πx: σ.τ ⊢ A[s, f] : τ

We then define for Γ ⊢ M : Πx: σ.τ and Γ ⊢ N : σ

(M N) := A[N, M]

The verifications are straightforward. □

From the example of the dependent product it should have become clear how in principle every syntactic type or term former can be translated into its semantic equivalent. For every type forming rule one introduces an operator on families and for every term forming rule an operator on sections where in each case suitable instances of weakening have to be inserted. Then for every equation one introduces an equation between the corresponding semantic entities and finally one imposes equations which ensure the compatibility of all semantic operators with substitution.

In most cases, however, this approach leads to very clumsy formulations of the semantic type formers. Indeed, it is often possible to replace a term operator by a single context morphism (or sometimes by a single section) and a type operator by a single family. An example for the former is provided by the alternative characterisation of dependent products in Prop. 2.4.17 where we have replaced the application operator by the evaluation morphisms. An example for the latter arises from the identity type we define in Sect. 2.4.2.4 below.

We often follow this strategy in the definition of further semantic type formers without explicitly stating and proving correspondences like Prop. 2.4.17 above.

In most cases we relate our definition to stronger ones which make use of universal properties and thus are more elegant, but are usually not met by syntactic models like the term model.

2.4.2.2 Unit types

The semantic definition corresponding to the unit type defined in Sect. 2.3.1 is as follows:

Definition 2.4.18 A syntactic category with attributes is equipped with unit types, if for every context Γ there is a distinguished family 1_{Γ} ∈ Fam(Γ) and a distinguished section ⋆_{Γ} ∈ Sect(1_{Γ}) such that for every σ ∈ Fam(Γ · 1_{Γ}) and M ∈ Sect(σ\{\overline{⋆_{Γ}}\}) there is a distinguished section R_{σ}^{1_{Γ}}(M) ∈ Sect(σ) with

R_{σ}^{1_{Γ}}(M)\{\overline{⋆_{Γ}}\} = M

in such a way that the following coherence equations are satisfied for every morphism f : B → Γ, and M ∈ Sect(σ{⋆_{Γ}}):

– 1_{Γ}{f} = 1_{B}

– ⋆_{Γ}{f} = ⋆_{B}

– (R_{σ}^{1_{Γ}}(M)){f^{+}} = R_{σ{f^{+}}}^{1_{B}}(M{f^{+}})

In view of the first coherence condition one might require only 1_{⊤} and obtain the other units by substitution along the unique morphism into the terminal object. The operator R^{1_{Γ}} would, however, still have to be required for arbitrary contexts.

The correspondence to the syntax is as follows: If σ ∈ Fam(Γ · 1_{Γ}) and M ∈ Sect(σ\{\overline{⋆_{Γ}}\}) and N ∈ Sect(1_{Γ}), then R^{1}(M, N) := R_{σ}^{1_{Γ}}(M)\{\overline{N}\} ∈ Sect(σ\{\overline{N}\}).

In many models unit types exist by virtue of the following proposition.

Proposition 2.4.19 A syntactic category with attributes C can be equipped with unit types if there exists a family 1 ∈ Fam(⊤) such that p(1) is an isomorphism.

Proof. We put 1_{Γ} := 1{!_{Γ}}. Since

Γ · 1_{Γ} \overline{!_{Γ}^{+}^{}}⊤ · 1

[figure: Γ; p(1_{Γ}); !_{Γ}; ⊤; p(1)]

is a pullback, p(1_{Γ}) is an isomorphism, too. Let φ be its inverse. We put ⋆_{Γ} := Hd(φ) and for σ ∈ Fam(Γ · 1_{Γ}) and M ∈ Sect(σ{φ}) we put R_{σ}^{1_{Γ}}(M) := M{p(1_{Γ})} ∈ Sect(σ{p(1_{Γ}) ∘ φ}) = Sect(σ). Stability under substitution follows since all the operators are given by substitutions themselves. □

2.4.2.3 Natural numbers Definition 2.4.20 A syntactic category with attributes C is equipped with natural numbers if for every context Γ there are the following data:

– a distinguished family N_{Γ} ∈ Fam(Γ),

– a distinguished section 0_{Γ} ∈ Sect(N_{Γ}) and a distinguished morphism Suc_{Γ} : Γ · N_{Γ} → Γ · N_{Γ} with p(N_{Γ}) ∘ Suc_{Γ} = p(N_{Γ}),

– for every σ ∈ Fam(Γ·N_{Γ}), M_{z} ∈ Sect(σ\{\overline{0}\}), and M_{s} ∈ Sect(σ\{Suc_{Γ} ∘ p(σ)\}) a distinguished section R^{N_{Γ}}(M_{z}, M_{s}) ∈ Sect(σ) with R^{N_{Γ}}(M_{z}, M_{s})\{\overline{0_{Γ}}\} = M_{z} and R^{N_{Γ}}(M_{z}, M_{s})\{Suc_{Γ}\} = M_{s}\{\overline{R^{N_{Γ}}(M_{z}, M_{s})}\}

in such a way that all these data are stable under substitution, i.e. for f : B → Γ, σ ∈ Fam(Γ · N_{Γ}), M_{z} ∈ Sect(σ\{\overline{0}\}), M_{s} ∈ Sect(σ\{Suc_{Γ} ∘ p(σ)\}), we have:

– N_{Γ}{f} = N_{B}

– 0_{Γ}{f} = 0_{B}

– f^{+} ∘ Suc_{B} = Suc_{Γ} ∘ f^{+}

– R_{σ}^{N_{Γ}}(M_{z}, M_{s}){f^{+}} = R_{σ}^{N_{B}}(M_{z}{f}, M_{s}{f^{+}}) By straightforward calculation we obtain:

Proposition 2.4.21 The term model described in 2.4.2 is equipped with natural numbers given by

N_{Γ}  := Γ ⊢ N
0_{Γ}  := Γ ⊢ 0 : N
Suc_{Γ}[γ: Γ, n: N] := (γ, Suc(n)) : Γ, n: N
R_{σ}^{N_{Γ}}(M_{z}, M_{s}) := Γ, x: N ⊢ R^{N}(M_{z}, M_{s}, x) : σ

Again, we relate our notion of natural numbers to a stronger one often offered in the literature, e.g. [78].

Definition 2.4.22 Let B be a cartesian category (with terminal object and products). A parametrised natural numbers object in B is a diagram 1 ^{0}^{}N ^{Suc}^{}N such that for any diagram G ^{z}^{}S ^{s}^{}S there exists a unique morphism R(z, s) : G × N → S such that

[figure: G; z; S; s; S]
[figure: ⟨id_{G}, 0⟩]
[figure: G × N; R(z, s); id_{G} × Suc; G × N; R(z, s)]

Proposition 2.4.23 Let C be a syntactic category with attributes. If there exists a family N ∈ Fam(⊤) such that ⊤ · N is the object part of a parametrised natural numbers object in C then C can be equipped with natural numbers in the sense of Def. 2.4.20.

Proof. We define

N_{Γ} := N{!_{Γ}}
0_{Γ} := Hd(0){!_{Γ}}

Next we notice that Γ · N_{Γ} is isomorphic to the cartesian product Γ × ⊤ · N by virtue of Prop. 2.4.8. Without loss of generality we can identify Γ · N_{Γ} with this product. We then put Suc_{Γ} := id_{Γ} × Suc. We also have that p(N_{Γ}) is a product projection and \overline{0_{Γ}} = ⟨id_{Γ}, 0⟩.

Next we note that for σ ∈ Fam(Γ · N_{Γ}), sections of σ{Suc_{Γ}}{p(σ)} (this is the “type” of M_{s}) are in bijective correspondence to the set of endomorphisms h of Γ · N_{Γ} · σ with p(σ) ∘ h = Suc_{Γ} ∘ p(σ). On the other hand elements of Sect(σ\{\overline{0_{Γ}}\}) (the “type” of M_{z}) are in bijective correspondence to morphisms g : Γ → Γ · N_{Γ} ·σ with p(σ) ∘ g = ⟨id_{Γ}, 0⟩.

Now given such g and h arising from appropriate sections M_{z} and M_{s} then R(g, h) : Γ·N_{Γ} → Γ · N_{Γ}·σ and p(σ) ∘ R(g, h) = id_{Γ·N_{Γ}} by the uniqueness property of the natural numbers object. So R(g, h) induces a section of σ which is the desired R_{σ}^{N_{Γ}}(M_{z}, M_{s}). The commutativity of the diagram defining R(g, h) gives the required equation for R_{σ}^{N_{Γ}}. The coherence laws for N_{Γ}, 0_{Γ}, and Suc_{Γ} follow from their definition by substitution (pullback) and the coherence of R_{σ}^{N_{Γ}} is again a consequence of the uniqueness property. □

One may compare this to the proof of mathematical induction for natural numbers objects in a topos, see e.g. [40].

2.4.2.4 Identity types

For the definition of the identity type we first observe that for σ ∈ Fam(Γ) the morphism

\overline{v_{σ}} : Γ · σ → Γ · σ · σ^{+}

is the “diagonal” which in the term model is given by

γ: Γ, x: σ ⊢ (γ, x, x) : Γ, x: σ, y: σ

It has the property

p(σ^{+}) ∘ \overline{v_{σ}} = p(σ)^{+} ∘ \overline{v_{σ}} = id_{Γ·σ}

where p(σ^{+}) and p(σ)^{+} are the two projections Γ · σ · σ^{+} → Γ · σ.

Definition 2.4.24 A syntactic category with attributes C is equipped with identity types if for every context Γ and σ ∈ Fam(Γ) there is

– a distinguished family Id(σ) ∈ Fam(Γ · σ · σ^{+}), – a distinguished morphism Refl_{σ} : Γ · σ → Γ · σ · σ^{+} · Id_{σ} with p(Id_{σ}) ∘ Refl_{σ} =

\overline{v_{σ}},

– for every family ρ ∈ Fam(Γ · σ · σ^{+} · Id_{σ}) and M ∈ Sect(ρ{Refl_{σ}}) a distinguished section J_{σ,ρ}(M) ∈ Sect(ρ) with J_{σ,ρ}(M){Refl_{σ}} = M

in such a way that all these data are stable under substitution, i.e. for f : B → Γ, σ, ρ as above, and M ∈ Sect(ρ{Refl_{σ}}) we have:

– Id(σ){f^{+}^{+}} = Id(σ{f})

– Refl_{σ} ∘ f^{+} = f^{+}^{+}^{+} ∘ Refl_{σ{f}}

– J_{σ,ρ}(M){f^{+}^{+}^{+}} = J_{σ{f},ρ{f^{+}^{+}^{+}}}(M{f^{+}})

Again in many “semantic” models we can give a simpler definition as follows:

Proposition 2.4.25 A syntactic category with attributes can be equipped with identity types if for every σ ∈ Fam(Γ) there is a distinguished family Id(σ) ∈ Fam(Γ · σ · σ^{+}) stable under substitution such that

Γ · σ · σ^{+} · Id(σ) \overline{p(Id(σ))_{}}Γ · σ · σ^{+}

[figure: Γ · σ · σ^{+}; p(Id(σ)); p(σ^{+}); Γ · σ; p(σ)^{+}]

(commutes and) is a pullback.

Proof. The universal property of the pullback applied to Γ · σ · σ^{+} ^{}^{\overline{v_{σ}}} Γ · σ ^{\overline{v_{σ}}}^{}Γ · σ · σ^{+} gives the morphism Refl_{σ} : Γ · σ → Γ · σ · σ^{+} · Id(σ) with p(Id(σ)) ∘ Refl_{σ} = \overline{v_{σ}} as required. Now Refl_{σ} is actually an isomorphism because Γ · σ · σ^{+} ^{}^{\overline{v_{σ}}} Γ · σ ^{\overline{v_{σ}}}^{}Γ · σ · σ^{+} is also the pullback of the two projections p(σ)^{+}, p(σ^{+}) : Γ · σ · σ^{+} → Γ · σ. For the inverse of Refl_{σ} we may for example take p(σ^{+}) ∘ p(Id(σ)). So substituting along this inverse defines the desired function J_{σ,ρ} : Sect(ρ{Refl_{σ}}) → Sect(ρ). All the data except Id(σ) are defined by universal properties and thus are stable under substitution. □

2.4.2.5 Σ-types

Definition 2.4.26 A syntactic category with attributes C is equipped with Σtypes if for every context Γ and families σ ∈ Fam(Γ), τ ∈ Fam(Γ · σ) there is:

– a distinguished family Σ(σ, τ) ∈ Fam(Γ),

– a distinguished morphism pair_{σ,τ} : Γ · σ · τ → Γ · Σ(σ, τ) with

p(Σ(σ, τ)) ∘ pair_{σ,τ} = p(σ) ∘ p(τ)

– for each family ρ ∈ Fam(Γ·Σ(σ, τ)) and M ∈ Sect(ρ{pair_{σ,τ}}) a distinguished section R_{σ,τ}^{Σ}(M) : Sect(ρ) with R_{σ,τ}^{Σ}(M){pair_{σ,τ}} = M

in such a way that all these data are stable under substitution, i.e. for every situation f : B → Γ, σ ∈ Fam(Γ), τ ∈ Fam(Γ · σ), ρ ∈ Fam(Γ · Σ(σ, τ)), M ∈ Fam(ρ{pair_{σ,τ}}) we have:

– Σ(σ, τ){f} = Σ(σ{f}, τ{f^{+}})

– f^{+} ∘ pair_{σ,τ} = pair_{σ{f},τ{f^{+}}} ∘ f^{+}^{+}

– R_{σ,τ}^{Σ}(M){f^{+}} = R_{σ{f},τ{f^{+}}}^{Σ}(M{f^{+}^{+}})

The term model is equipped with Σ-types with the obvious choice. A more specialised but simpler definition of Σ-types is the following:

Proposition 2.4.27 A syntactic category with attributes can be equipped with Σ-types if for every σ ∈ Fam(Γ) and τ ∈ Fam(Γ · σ) there is a distinguished family Σ(σ, τ) ∈ Fam(Γ) and an isomorphism pair_{σ,τ} : Γ · σ · τ → Γ · Σ(σ, τ) with p(Σ(σ, τ)) ∘ pair_{σ,τ} = p(σ) ∘ p(τ) both stable under substitution in the sense of Def. 2.4.26.

Proof. The elimination operation R^{Σ_{σ,τ}} is defined by substitution along the inverse of pair_{σ,τ}. □

The Σ-types obtained by virtue of the above proposition are called extensional for they have the property that any P ∈ Sect(Σ(σ, τ)) is of the form Hd(pair_{σ,τ} ∘ \overline{P.1}^{+} ∘ \overline{P.2}) for uniquely determined sections P.1 ∈ Fam(σ) and P.2 ∈ Fam(τ\{\overline{P.1}\}).

2.4.2.6 Universes

In this section we define a general semantic framework which allows us to interpret various kinds of universes including the universe Prop in the Calculus of Constructions. We first present a very concise definition of semantic universes which, however, turns out to be too restrictive for many applications. Therefore we define a looser notion and give a canonical construction which allows to pass from one to the other. The Calculus of Constructions will play the role of a “running example”. We give the explicit constructions for this particular case and appeal to the mathematical understanding of the reader for the generalisation to other instances of universes.

Throughout this section we assume a fixed syntactic category with attributes C equipped with dependent products.

Definition 2.4.28 A full submodel of C consists of a subset Fam′(Γ) of Fam(Γ) for each context Γ such that whenever f : B → Γ and σ ∈ Fam′(Γ) then σ{f} ∈ Fam′(B). In other words a full submodel is a subfunctor of Fam : C^{op} → Sets.

Definition 2.4.29 A full submodel Fam′ is closed under some type former if whenever all family arguments to the type former are in Fam′ then so is the newly formed family.

For example Fam′ is closed under dependent products if for σ ∈ Fam′(Γ) and τ ∈ Fam′(Γ · σ) the product Π(σ, τ) is in Fam′(Γ) (instead of just in Fam(Γ)). In case the type former takes no arguments, i.e. it is a constant like N, then closure means that this constant is in Fam′.

Definition 2.4.30 A full submodel Fam′ is closed under impredicative quantification if whenever σ ∈ Fam(Γ) and τ ∈ Fam′(Γ · σ) then Π(σ, τ) ∈ Fam′(Γ).

So impredicative quantification means that the product of a family in Fam′ over an arbitrary family is in Fam′ again.

Definition 2.4.31 A pair (U, El) is a generic family for a full submodel Fam′ if U ∈ Fam(⊤) and El ∈ Fam′(⊤ · U) and for every family σ ∈ Fam′(Γ) there exists a unique morphism s : Γ → ⊤ · U such that σ = El{s}.

Example 2.4.32 If U ∈ Fam(⊤) and El ∈ Fam(⊤ · U) are any two families with the property that whenever El{s} = El{s′} for some s, s′ : Γ → ⊤ · U then the assignment Fam′(Γ) := {σ ∈ Fam(Γ) | ∃s : Γ → ⊤ · U . σ = El{s}} defines a full submodel of C with generic family (U, El).

In fact by definition every full submodel with generic family is of the form given in Ex. 2.4.32. The reason for introducing the notion of full submodel is that it allows to state closure properties in a shorter way as becomes clear in the next definition.

Definition 2.4.33 The syntactic category with attributes C is a model of the Calculus of Constructions if it has a full submodel closed under impredicative quantification with a distinguished generic family, denoted (Prop, Prf).

Proposition 2.4.34 Let C be a model of the Calculus of Constructions. Then for any context Γ, family σ ∈ Fam(Γ) and s : Γ·σ → ⊤·Prop there is a distinguished morphism ∀_{σ}(s) : Γ → ⊤ · Prop with

Prf{∀_{σ}(s)} = Π(σ, Prf{s})

Moreover, these morphisms are stable under substitution, that is for every f : B → Γ and σ, s as above we have

∀_{σ}(s) ∘ f = ∀_{σ{f}}(s ∘ f^{+})

Proof. If s : Γ · σ → ⊤ · Prop then τ := Prf{s} lies in the full submodel. Since the latter is closed under impredicative quantification the product Π(σ, τ) does too. We thus define ∀_{σ}(s) as the unique morphism with Prf{∀_{σ}(s)} = Π(σ, τ). For stability under substitution we observe that substituting either side into Prf gives rise to the same family. So the equation follows by the definition of generic family. □

Proposition 2.4.35 The term model of the Calculus of Constructions is a model for same.

Proof. The generic family is given by the pair (⊢ Prop , x: Prop ⊢ Prf(x)). We must show that this is indeed a generic family, i.e. that Γ ⊢ Prf(M) = Prf(N) implies Γ ⊢ M = N. We prove this by induction along derivations together with the statement that Γ ⊢ Prf(M) = Πx: σ.Prf(N) implies Γ ⊢ M = ∀x: σ.N. So assume Γ ⊢ Prf(M) = Prf(N). If this is an instance of reflexivity then Γ ⊢ M = N by reflexivity, too. If it is an instance of the congruence rule for Prf we must have Γ ⊢ M = N as a premise. In all other cases we can find τ such that Γ ⊢ Prf(M) = τ and Γ ⊢ τ = Prf(N) such that both these judgements have shorter derivations than Γ ⊢ Prf(M) = Prf(N) and moreover the last instance in the proof of Γ ⊢ Prf(M) = τ is neither reflexivity, nor transitivity, and if it is symmetry then the derivation of its premise does not end with either of these three. In the first case either τ is Prf(M′) and Γ ⊢ M = M′ or M is ∀x: σ.M′ and τ is Πx: σ.Prf(M′); in either case the result follows from the inductive hypothesis. All the other cases are similar.

We thus have shown that the types of the form Prf(M) form a full submodel with generic family. They are closed under impredicative quantification by virtue of the ∀-operator. □

2.4.2.7 Other universes.

In order to define semantic counterparts to other sorts of universes we proceed in a similar way. We ask for a full submodel with a generic family closed under the desired type-forming operations. For example in order to interpret the particular universe used in Sect. 2.3.5 we ask for closure under dependent products and natural numbers. We can now define operators similar to ∀_{σ}(s) witnessing the closure on the level of morphisms. Again using uniqueness we can show that these operators are stable under substitution. Finally, by suitably extending the argument in the proof of Prop. 2.4.35 we can show that the term model provides an instance.

The set-theoretic model admits a cumulative hierarchy of universes all closed under all the standard type formers using inaccessible cardinals. This is worked out e.g. in [65]. The ω-set model admits such a chain of universes all inside the impredicative universe of partial equivalence relations hinted at in Example 2.4.37 below even without using inaccessible cardinals. This is worked out in [1] and [6].

2.4.2.8 Loose models for universes

Unfortunately the definitions above are too restrictive to account for many natural models like the set-theoretic model and the ω-set model. For example if in the set-theoretic model we put Prop := {tt, ff} and Prf(tt) = {⋆} and Prf(ff) = ∅ then the induced full submodel, i.e. those families {σ_{γ}}_{γ∈Γ} with σ_{γ} ∈ {{⋆}, ∅}, are not closed under impredicative quantification because if σ_{γ} = {⋆} for all γ ∈ Γ then the product over the family is a singleton, but not the chosen singleton {⋆}. We present a laxer notion of model for the Calculus of Constructions of which the set-theoretic model forms an instance (see Example 2.4.37) together with a canonical construction which turns such a model into an actual model in the sense of the definitions given above. The notion as well as the construction generalise to other universes in a straightforward way.

Definition 2.4.36 A syntactic category with attributes C equipped with dependent products is a loose model for the Calculus of Constructions if the following are given:

– distinguished families Prop ∈ Fam(⊤) and Prf ∈ Fam(⊤ · Prop),

– for each σ ∈ Fam(Γ) and s : Γ · σ → ⊤ · Prop a distinguished morphism ∀_{σ}(s) : Γ → ⊤ · Prop and a distinguished morphism ev_{σ,s} : Γ · σ · Prf{∀_{σ}(s) ∘ p(σ)} → Γ · σ · Prf{s} with p(Prf{s}) ∘ ev_{σ,s} = p(Prf{∀_{σ}(s) ∘ p(σ)}),

– for each section M ∈ Sect(Prf{s}) a distinguished section λ_{σ,s}(M) ∈ Sect(Prf{∀_{σ}(s)}) with

ev_{σ,s} ∘ \overline{λ_{σ,s}(M)\{p(σ)\}} = \overline{M}

in such a way that all these data are stable under substitution, that is for f : B → Γ, σ ∈ Fam(Γ), s : Γ · σ → ⊤ · Prop, M ∈ Sect(Prf{s}) we have:

– ∀_{σ}(s) ∘ f = ∀_{σ{f}}(s ∘ f^{+})

– ev_{σ,s} ∘ f^{+}^{+} = f^{+}^{+} ∘ ev_{σ{f},s ∘ f^{+}}

– λ_{σ,s}(M){f} = λ_{σ{f},s ∘ f^{+}}(M{f^{+}})

Notation. To simplify notation we shall in the sequel denote by “Prop” the family in Fam(⊤), its substitutions Prop{!_{Γ}} ∈ Fam(Γ), and its comprehension ⊤ · Prop.

Example 2.4.37 The set-theoretic model can be turned into a loose model of the Calculus of Constructions as follows: We define Prop and Prf as in the erroneous attempt above, i.e. Prop = {tt, ff} and Prf(tt) = {⋆} and Prf(ff) = ∅, and for s : Γ · σ → Prop we define ∀_{σ}(s)(γ) := tt if s(γ, x) = tt for all x ∈ σ_{γ} and ff otherwise. Then we can define ev_{σ,s} as the function sending (x, ⋆) to (x, ⋆) in the former case and as the empty function otherwise. The other components are defined accordingly and the verifications are straightforward.

This loose model is trivial in the sense that for any two M, N ∈ Sect(Prf{s}) for some s : Γ → Prop we must have M = N. It is known that the ω-set model can be turned into a nontrivial loose model by letting Prop be the set of partial equivalence relations on ω endowed with the trivial realisability structure [100,2, 55].

Proposition 2.4.38 There exists a canonical construction which for a given loose model C for the Calculus of Constructions produces a model in the sense of Def. 2.4.33 over the same category of contexts. Moreover the new model supports whatever type former the original one did.

Proof. The families of the new model are defined as the disjoint union

Fam_{new}(Γ) := Fam(Γ) .∪ C(Γ, Prop)

If f : B → Γ then substitution on families in the left summand is inherited from the original model whereas on the right summand it is given by composition.

For σ ∈ Fam_{new}(Γ) let σ̂ be σ if σ is already in Fam(Γ) and Prf{σ} if σ is a morphism from Γ to Prop. All the other components of the new model except Π are inherited from the original model by pre-composition with “ ˆ−”.

If σ ∈ Fam_{new}(Γ) and τ ∈ Fam(Γ · σ) then we define the product Π(σ, τ) in the new model as Π(σ̂, τ). On the other hand, if τ is a morphism from Γ · σ to Prop then the product Π(σ, τ) in the new model is defined as the morphism ∀σ̂(τ) : Γ → Prop. For evaluation and abstraction we use either the operations from the original model or the ones which are part of the definition of a loose model. Both satisfy the required equations and are stable under substitution.

The families in the right summand, viz. the morphisms into Prop, thus form a full submodel closed under impredicative quantification. It has the generic family (Prop, id_{Prop}). Indeed if s : Γ → Prop ∈ Fam_{new}(Γ) then there is a unique morphism — namely s itself — such that s arises by substitution from the generic family. □

The above proposition is a bit vague as stated, because for example the promised construction might produce the same (trivial) result for every loose model. Had we defined a notion of morphism between models we could identify the construction as an equivalence.

In case the loose model we start with has the property that the families of the form Prf{f} form a full submodel with generic object, i.e. the functions Prf{−} are injective, then we can choose Fam_{new} to be Fam and define Π(σ, τ) by case distinction according to whether τ = Prf{t} for some (then unique) t or not. A special case of this procedure appears in [100] for the particular case of the ω-set model and in [2] for a particular class of models.

2.5 Interpreting the syntax

In this section we define a semantic function which maps well-formed terms, types, and contexts of the dependently typed calculus defined in Sect. 2.1 to entities in a syntactic category with attributes which supports the type formers and other features present in the syntax. We proceed by first defining a partial interpretation function on pre-constructions which is then proven total on well-formed constructions by induction on derivations. This method, which circumvents the necessity to prove independence of the interpretation of a particular derivation, is due to Streicher [100]. Our treatment here differs from loc.cit. in that our notion of model is more general, in particular we do not require extensional Π-types, and that in loc.cit. only the particular example of the Calculus of Constructions is considered.

Chapter 2. Syntax and semantics of dependent types 63

2.5.1 Partial interpretation

Assume a syntactic category with attributes C equipped with dependent products, natural numbers, and identity types. An a priori partial interpretation function [[−]] is defined which maps:

– pre-contexts to objects of C

– pairs Γ | σ, where Γ is a pre-context and σ is a pre-type, to families in Fam([[Γ]])

– pairs Γ | M, where Γ is a pre-context and M is a pre-term to sections in

Sect(σ) for some σ ∈ Fam(Γ). We show below in Thm. 2.5.6 that this semantic function is defined on all contexts, types, and terms.

The semantic clauses are the following, where in order to reduce the number of cases we adopt the convention that an expression containing an undefined subexpression is itself undefined. We also adopt the convention that expressions which do not “typecheck”, like Γ · σ if σ ∉ Fam(Γ), are undefined.

– [[⋄]] = ⊤

– [[Γ, x: σ]] = [[Γ]] · [[Γ | σ]]

– [[Γ | Πx: σ.τ]] = Π([[Γ | σ]] , [[Γ, x: σ | τ]])

– [[Γ | N]] = N_{[[Γ]]}

– [[Γ | Id_{σ}(M, N)]] = Id_{[[Γ|σ]]}\{\overline{[[Γ | M]]^{+}}\}\{\overline{[[Γ | N]]}\}

– [[Γ | x]] = v_{[[Γ′|σ]]} \underbrace{^{+...+}}_{n times} if Γ = Γ′, x: σ, Γ′′ where Γ′′ has length n and x does not occur in Γ′, Γ′′. Undefined otherwise.

– [[Γ | App_{σ ,[x:σ]τ}(M, N)]] = App_{[[Γ|σ]] ,[[Γ,x:σ|τ]]}([[Γ | M]], [[Γ | N]])

– [[Γ | λx: σ.M^{τ}]] = λ_{[[Γ|σ]],[[Γ,x:σ|τ]]}([[Γ, x: σ | M]])

– [[Γ | 0]] = 0_{[[Γ]]}

– [[Γ | Suc(M)]] = Hd(Suc_{[[Γ]]} ∘ \overline{[[Γ | M]]})

– [[Γ | R^{N}(M_{z}, M_{s}, N)]] = R^{N_{[[Γ]]}}([[Γ | M_{z}]], [[Γ, x: N, p: σ | M_{s}]])\{\overline{[[Γ | N]]}\}

– [[Γ | Refl_{σ}(M)]] = Refl_{[[Γ|σ]]}\{\overline{[[Γ | M]]}\}

– [[Γ | J_{σ,[x,y:σ,p:Id_{σ}(x,y)]τ}(M, N_{1}, N_{2}, P)]] = J_{[[Γ|σ]] , [[Γ,x,y:σ,p:Id_{σ}(x,y) | τ]]}([[Γ, x: σ | M]])\{\overline{[[Γ | N_{1}]]}^{+}^{+}\}\{\overline{[[Γ | N_{2}]]}^{+}\}\{\overline{[[Γ | P]]}\}

The n-fold weakening in the clause for variables is understood along the semantics of the n types in Γ′′ in their respective contexts. Notice that the semantic combinators like R^{N} and J take sections as arguments, whereas substitution (−{−}) takes morphisms as arguments, so that when arguments are supplied via substitution, like the three last arguments to J we must use \overline{−} to transform sections into morphisms.

2.5.2 Soundness of the interpretation

Before we state and prove a soundness theorem for this interpretation we establish correspondences between syntactic and semantic substitution and weakening. In order to state these we need to define a semantic equivalent of telescopes.

Definition 2.5.1 Let C be a model and Γ ∈ Ob(C). A (semantic) telescope over Γ is a list of families (σ_{1}, …, σ_{n}) with σ_{1} ∈ Fam(Γ), σ_{2} ∈ Fam(Γ · σ_{1}), …, σ_{n} ∈ Fam(Γ · σ_{1} · . . . · σ_{n−1}). The set of semantic telescopes is denoted by Tel(Γ). The empty telescope over Γ is written ()_{Γ}. The operations of comprehension and substitution are extended to telescopes by the following recursive definition.

– Γ · ()_{Γ} = Γ

– p(()_{Γ}) = id_{Γ} Chapter 2. Syntax and semantics of dependent types 65

– ()_{Γ}{f} = ()_{B} for f : B → Γ.

– q(f, ()_{Γ}) = f

– Γ · (Δ, σ) = Γ · Δ · σ where (Δ, σ) is the telescope Δ extended by family σ.

– p((Δ, σ)) = p(Δ) ∘ p(σ)

– (Δ, σ){f} = (Δ{f}, σ{q(f, Δ)})

– q(f, (Δ, σ)) = q(q(f, Δ), σ) By a straightforward induction on the length of telescopes we now obtain Proposition 2.5.2 The telescopes together with the operations defined above satisfy the premises of Prop 2.4.10 and thus define a syntactic category with attributes where Sect(Δ) = “the set of sections of p(Δ)”.

The partial interpretation function can be extended to telescopes by defining for pre-contexts Γ and Δ = x_{1}: τ_{1}, …, x_{n}: τ_{n}

[[Γ | Δ]] := ([[Γ | τ_{1}]], [[Γ, x_{1}: τ_{1} | τ_{2}]], …, [[Γ, x_{1}: τ_{1}, …, x_{n−1}: τ_{n−1} | τ_{n}]]) Clearly, if [[Γ | Δ]] is defined then so is [[Γ]] and the former is a semantic telescope over the latter. Moreover, the following two properties of the extension are obvious from the definitions of p(−) and q(−, −) on telescopes:

p([[Γ | Δ, Θ]]) = p([[Γ | Δ]]) ∘ p([[Γ, Δ | Θ]])

q(f, [[Γ | Δ, Θ]]) = q(q(f, [[Γ | Δ]]), [[Γ, Δ | Θ]])

Lemma 2.5.3 (Weakening) Let Γ, Δ be pre-contexts, σ, τ pre-types, M a preterm and x a fresh variable. The following equations hold if either side is defined:

[[Γ, x: σ, Δ]] = [[Γ, x: σ]] · [[Γ | Δ]]{p([[Γ | σ]])}

[[Γ, x: σ, Δ | τ]] = [[Γ, Δ | τ]]{q(p([[Γ | σ]]), [[Γ | Δ]])}
[[Γ, x: σ, Δ | M]] = [[Γ, Δ | M]]{q(p([[Γ | σ]]), [[Γ | Δ]])}

Proof. An instance of this lemma is one of the left hand sides of the above equations. The weight of such an instance is the number of symbols required to write it down including variables and punctuation symbols. Thus for example the weight of [[Γ, x: σ, Δ, y: τ]] is greater than the weight of [[Γ, x: σ | τ]] because y is not contained in the latter. We also need the notion of length of a pre-context Δ denoted |Δ| which is the number of variable declarations it contains. We proceed by induction on the weight and give a representative selection of the many cases required.

First consider the case where Δ = ⋄. If either side of the instance is defined then p([[Γ | σ]]) must be defined, too. Now [[Γ, x: σ, Δ]] = [[Γ, x: σ]] = [[Γ, x: σ]] · [[Γ | Δ]]{p([[Γ | σ]])} because [[Γ | Δ]] = ()_{[[Γ]]} by definition.

If Δ = Δ′, y: τ then

[[Γ, x: σ, Δ]]

= [[Γ, x: σ, Δ′]] · [[Γ, x: σ, Δ′ | τ]]  by definition
= [[Γ, x: σ]] · [[Γ | Δ′]]{p([[Γ | σ]])} · [[Γ, Δ′ | τ]]{q(p([[Γ | σ]]), [[Γ | Δ′]])} by IH
= [[Γ, x: σ]] · ( [[Γ | Δ′]]{p([[Γ | σ]])} , [[Γ, Δ′ | τ]]{q(p([[Γ | σ]]), [[Γ | Δ′]])})
= [[Γ, x: σ]] · [[Γ | Δ]]{p([[Γ | σ]])}

The last two steps follow from the definition of substitution and comprehension on semantic telescopes. We have used the inductive hypothesis (IH) on the instances [[Γ, x: σ, Δ′ | τ]] and [[Γ, x: σ, Δ′]] which both have smaller weight.

Next we consider the instance [[Γ, x: σ, Δ | N]]. We have

[[Γ, x: σ, Δ | N]]

= N_{[[Γ,x:σ,Δ]]}
= N_{[[Γ,x:σ]]·[[Γ|Δ]]{p([[Γ|σ]])}}  by IH
= N_{[[Γ,Δ]]}{q(p([[Γ | σ]]), [[Γ | Δ]])}
= [[Γ, Δ | N]]{q(p([[Γ | σ]]), [[Γ | Δ]])}

For the penultimate step we have used that q(p([[Γ | σ]]), [[Γ | Δ]]) is a morphism from [[Γ, x: σ]] · [[Γ | Δ]]{p([[Γ | σ]])} to [[Γ]] · [[Γ | Δ]] = [[Γ, Δ]] and the fact that N_{Γ}{f} = N_{B} for any morphism f : B → Γ.

Now we consider the instance [[Γ, x: σ, Δ | Πy: τ.ρ]]. We have

[[Γ, x: σ, Δ | Πy: τ.ρ]]

= Π( [[Γ, x: σ, Δ | τ]] , [[Γ, x: σ, Δ, y: τ | ρ]] )

=

Π( [[Γ, Δ | τ]]{q(p([[Γ | σ]]), [[Γ | Δ]])},
[[Γ, Δ, y: τ | ρ]]{q(p([[Γ | σ]]), [[Γ | Δ, y: τ]])})

=

Π( [[Γ, Δ | τ]]{q(p([[Γ | σ]]), [[Γ | Δ]])},
[[Γ, Δ, y: τ | ρ]]{q(q(p([[Γ | σ]]), [[Γ | Δ]]), [[Γ, Δ | y: τ]])})
= Π([[Γ, Δ | τ]], [[Γ, Δ, y: τ | ρ]]){q(p([[Γ | σ]]), [[Γ | Δ]])}
= [[Γ, Δ | Πy: τ.ρ]]{q(p([[Γ | σ]]), [[Γ | Δ]])}

In the second step we have used the IH on the instances [[Γ, Δ | τ]] and [[Γ, Δ, y : τ | ρ]] both of which have smaller weight than the original instance. We see here the need for the rather involved structure of the inductive argument. The third step uses the definition of the q(−, −) operation on semantic telescopes and the fourth step is a consequence of the stability of Π under substitution.

The instance [[Γ, x: σ, Δ | Id_{τ}(M, N)]] is similar. We expand the definition and use the IH on the instances [[Γ, x: σ, Δ | τ]], [[Γ, x: σ, Δ | M]], and [[Γ, x: σ, Δ | N]] all of which have smaller weight.

Let us now consider the instance [[Γ, x: σ, Δ | y]] where y is a variable. We observe that using our notation for telescopes and functoriality of substitution we can rewrite the iterated weakening in the semantic clause for variables as follows:

[[Γ′, y: τ, Γ′′ | y]] = v_{[[Γ′|τ]]}{p([[Γ′, y: τ | Γ′′]])}

where y does not occur in Γ′, Γ′′. Suppose now that [[Γ, x: σ, Δ | y]] is defined. Then either Γ = Γ′, y: τ, Γ′′ for some type τ and y does not occur in Γ′, Γ′′, Δ or Δ = Δ′, y: τ, Δ′′ and y does not not occur in Γ, Δ′, Δ′′. In the former case we calculate as follows:

[[Γ′, y: τ, Γ′′, x: σ, Δ | y]]
= v_{[[Γ′|τ]]}{p([[Γ′, y: τ | Γ′′, x: σ, Δ]])}
= v_{[[Γ′|τ]]}{p([[Γ′, y: τ | Γ′′]]) ∘ p([[Γ | σ]]) ∘ p([[Γ, x: σ | Δ]])}
= …

Now we notice that

[[Γ, x: σ | Δ]] = [[Γ | Δ]]{p([[Γ | σ]])}

by induction on |Δ| and the IH. This in turn implies that

p([[Γ | σ]]) ∘ p([[Γ, x: σ | Δ]]) = p([[Γ | Δ]]) ∘ q(p([[Γ | σ]]), [[Γ | Δ]])

because semantic telescopes form a syntactic category with attributes. We can thus continue the calculation as follows:

…

= v_{[[Γ′|τ]]}{p([[Γ′, y: τ | Γ′′]]) ∘ p([[Γ | Δ]]) ∘ q(p([[Γ | σ]]), [[Γ | Δ]])}
= v_{[[Γ′|τ]]}{p([[Γ, y: τ | Γ′′, Δ]]) ∘ q(p([[Γ | σ]]), [[Γ | Δ]])}
= [[Γ′, y: τ, Γ′′, Δ | y]]{q(p([[Γ | σ]]), [[Γ | Δ]])}

On the other hand if Δ = Δ′, y: τ, Δ′′ and y does not occur in Γ, Δ′, Δ′′ then

[[Γ, x: σ, Δ′, y: τ, Δ′′ | y]] =

= v_{[[Γ,x:σ,Δ′|τ]]}{p([[Γ, x: σ, Δ′, y: τ | Δ′′]])}
= v_{[[Γ,Δ′|τ]]{q(p([[Γ|σ]]),[[Γ|Δ′]])}}{p([[Γ, x: σ, Δ′, y: τ | Δ′′]])}  by IH
= v_{[[Γ,Δ′|τ]]}{q(p([[Γ | σ]]), [[Γ | Δ′, y: τ]])}{p([[Γ, x: σ, Δ′, y: τ | Δ′′]])}
= …

by Lemma 2.4.1.3 and the definition of q(−, −) on telescopes. Now again by induction on |Δ′′| and the IH we conclude that

[[Γ, x: σ, Δ′, y: τ | Δ′′]] = [[Γ, Δ′, y: τ | Δ′′]]{q(p([[Γ | σ]]), [[Γ | Δ′, y: τ]])}

and thus

q(p([[Γ | σ]]), [[Γ | Δ′, y: τ]]) ∘ p([[Γ, x: σ, Δ′, y: τ | Δ′′]]) =
p([[Γ, Δ′, y: τ | Δ′′]]) ∘ q(p([[Γ | σ]]), [[Γ | Δ′, y: τ, Δ′′]])

using the commutativity of the square corresponding to the substitution [[Γ, Δ′, y: τ | Δ′′]]{q(p([[Γ | σ]]), [[Γ | Δ′, y: τ]])} and the observation on nested q(−, −)-morphisms on telescopes made above. Now we can finish the calculation as follows

…

= v_{[[Γ,Δ′|τ]]}{p([[Γ, Δ′, y: τ | Δ′′]])}{q(p([[Γ | σ]]), [[Γ | Δ]])}
= [[Γ, Δ | y]]{q(p([[Γ | σ]]), [[Γ | Δ]])}

If the right hand side of the equation for variables is defined then we perform the same case distinction as to whether y occurs in Γ or Δ. Since all the steps in the above calculation are valid if either side is defined this implies that the left hand side is defined, too.

The instances of the form [[Γ, x: σ, Δ | M]] are similar to the instances of the form [[Γ, x: σΔ | τ]]. If M is a constant then we follow the proof for N, and if the outermost constructor of M is a binder then we argue as in the case of Π. □

Lemma 2.5.4 (Substitution) Let Γ, Δ be pre-contexts, σ, τ pre-types, M, N preterms and x a fresh variable. We denote the substitution of M for x in some preconstruction C by C[M]. The expression \overline{[[Γ | M]]} is abbreviated by m. If [[Γ | σ]] and [[Γ | M]] are both defined and the latter is a section of the former then the following equations hold if either side is defined:

[[Γ, Δ[M]]] = [[Γ]] · [[Γ, x: σ | Δ]]\{\overline{[[Γ | M]]}\}
[[Γ, Δ[M] | τ[M]]] = [[Γ, x: σ, Δ | τ]]\{q(\overline{[[Γ | M]]}, [[Γ, x: σ | Δ]])\}
[[Γ, Δ[M] | N[M]]] = [[Γ, x: σ, Δ | N]]\{q(\overline{[[Γ | M]]}, [[Γ, x: σ | Δ]])\}

Proof. Again we proceed by simultaneous induction on the weights of the three instances. We abbreviate the morphism \overline{[[Γ | M]]} by m. It now plays the role of the “weakening morphism” p([[Γ | σ]]) in Lemma 2.5.3. There are only two cases the proof of which differs from the one of their companion in Lemma 2.5.3. The first one is the instance [[Γ, ⋄[M]]]. This equals [[Γ]] · [[Γ, x: σ | ⋄]]{m} iff [[Γ | M]] is defined and is a section of [[Γ | σ]] because otherwise the substitution would not typecheck and would thus be undefined. This is actually the only place where this assumption is needed; it is propagated to the other cases through the inductive process.

The second case is the instance where N is the variable x, i.e.

[[Γ, Δ[M] | M]] = [[Γ, x: σ, Δ | x]]{q(m, [[Γ, x: σ | Δ]])}

Notice here that x[M] = M. By the inductive hypothesis and by induction on |Δ| we may assume that

[[Γ | Δ[M]]] = [[Γ, x: σ | Δ]]{m}

and thus

m ∘ p([[Γ | Δ[M]]]) = p([[Γ, x: σ | Δ]]) ∘ q(m, [[Γ, x: σ | Δ]])

by the commutativity of the square corresponding to the substitution [[Γ, x: σ | Δ]]{m}. Now we calculate as follows:

[[Γ, Δ[M] | M]]
= [[Γ | M]]{p([[Γ | Δ[M]]])}  by |Δ|-fold application of Lemma 2.5.3
= v_{[[Γ|σ]]}{m ∘ p([[Γ | Δ[M]]])}  by Lemma 2.4.13
= v_{[[Γ|σ]]}{p([[Γ, x: σ | Δ]]) ∘ q(m, [[Γ, x: σ | Δ]])}  as argued above
= [[Γ, x: σ, Δ | x]]{q(m, [[Γ, x: σ | Δ]])}  by the clause for variables

The proofs of all the other cases almost literally follow the proof of Lemma 2.5.3 and are thus left out. □

Substitution for arbitrary context morphisms We can extend the interpretation function to (syntactic) context morphisms (together with their domain and codomain) as follows: If Γ, Δ are pre-contexts, f a tuple of pre-terms and M a pre-term then

– [[Γ | () | ⋄]] =!_{[[Γ]]}

– [[Γ | (f, M) | Δ, x: σ]] = q([[Δ | σ]], [[Γ | fΔ]]) ∘ \overline{[[Γ | M]]}

where as before we adopt the convention that expressions which do not typecheck are undefined. We now have the following general substitution property.

Lemma 2.5.5 (General substitution) Let B, Γ, Δ be pre-contexts and f a |Γ|- tuple of pre-terms, M a pre-term, and σ a pre-type. We denote the simultaneous substitution of the Δ-variables by f in some pre-construction C by C[f]. If [[B | f | Γ]] is a morphism from [[B]] to [[Γ]] then the following equations hold if either side is defined:

[[B, Δ[f]]] = [[B]] · [[Γ | Δ]]{[[B | f | Γ]]}
[[B, Δ[f] | σ[f]]] = [[Γ, Δ | σ]]{q([[B | f | Γ]], Γ | Δ)}
[[B, Δ[f] | M[f]]] = [[Γ, Δ | M]]{q([[B | f | Γ]], Γ | Δ)}

Proof. The proof is by induction on the length of f. If f = () and thus Γ = ⋄ then the first equation is satisfied by definition of substitution on semantic telescopes. The second equation becomes

[[B, Δ | σ]] = [[Δ | σ]]{q([[B | () | ⋄]], [[⋄ | Δ]])}

From a |B|-fold application of Lemma 2.5.3 we get

[[B, Δ | σ]] = [[Δ | σ]]{q(p(⋄ | B), [[⋄ | Δ]])}

where we have used compositionality of q(−, −) and the definition of p(−) on telescopes. But now p(⋄ | B) as a morphism from [[B]] to ⊤ must equal !_{[[⊤]]} by the unicity property of the terminal object. The third equation is analogous.

Now consider the case where f = (f′, N) and Γ = Γ′, y: τ. If [[B | f | Γ]] is defined and is a morphism from B to Γ then [[B | N]] must be defined and be a section of [[Γ | τ]]{[[B | f′ | Γ]]} which by the IH is equal to [[B | τ[f′]]]. Now for the first equation we calculate as follows:

[[B, Δ[(f′, N)]]]
= [[B, Δ[f′][y := N]]]  by definition of parallel substitution
= [[B]] · [[B, y: τ[f′] | Δ[f′]]]\{\overline{[[B | N]]}\}  by Lemma 2.5.4
= [[B]] · [[Γ′, y: τ | Δ]]\{q([[B | f′ | Γ′]], [[Γ′ | τ]])\}\{\overline{[[B | N]]}\} by ind. on |Δ| and IH
= [[B]] · [[Γ | Δ]]{[[B | (f′, N) | Γ′, y: τ]]}

by compositionality of −{−} and the definition of the interpretation of nonempty context morphisms.

The other cases are similar. □

We remark that the inductive argument above does not go through if we restrict ourselves to Δ = ⋄ and thus q([[B | f | Γ]], [[Γ | Δ]]) = [[B | f | Γ]].

We have tried to prove the general substitution lemma directly by induction on the weight of the instances. Then all the inductive cases are very much the same as, if not easier than in the weakening case (Lemma 2.5.3), but the case where M is a variable becomes extremely complicated and seems to require weakening and substitution for terms in the first place.

We can now establish a correspondence between syntax and semantics.

Theorem 2.5.6 The interpretation function enjoys the following soundness properties

– If Γ ⊢ then [[Γ]] is an object of C.

– If Γ ⊢ σ then [[Γ | σ]] is an element of Fam([[Γ]]).

– If Γ ⊢ M : σ then [[Γ | M]] is an element of Sect([[Γ | σ]]).

– If Γ ⊢ and Δ ⊢ and Γ ⊢ f : Δ then [[Γ | f | Δ]] ∈ C([[Γ]], [[Δ]]).

– If ⊢ Γ = Δ then [[Γ]] = [[Δ]].

– If Γ ⊢ σ = τ then [[Γ | σ]] = [[Γ | τ]].

– If Γ ⊢ M = N : σ then [[Γ | M]] = [[Γ | N]].

Proof. The proof is by induction on derivations. Again we only treat selected cases to give the general idea. The cases for context and type formation rules are fairly simple applications of the IH. Assume for example that Γ ⊢ Πx : σ.τ[x] has been derived from Γ ⊢ σ and Γ, x: σ ⊢ τ[x] using Π-Form. Then we may assume that S := [[Γ | σ]] ∈ Fam([[Γ]]) and T := [[Γ, x: σ | τ]] ∈ Fam([[Γ, x: σ]]). Now [[Γ, x: σ]] = [[Γ]] · S by the semantic clause for context extension. So Π(S, T) is defined and equals [[Γ | Πx: σ.τ]] by the clause for Π-types.

More interesting are rules involving syntactic substitution. Assume for example that Γ ⊢ App_{σ ,[x:σ]τ}(M, N) : τ[N] has been derived from Γ ⊢ M : Πx: σ.τ[x] and Γ ⊢ N : σ using Π-Elim. Then by induction we may assume that [[Γ | M]] ∈ Fam([[Γ | Πx: σ.τ[x]]]) and [[Γ | N]] ∈ Fam([[Γ | σ]]). By expanding some definitions and using the IH we get from this that [[Γ | App_{σ ,[x:σ]τ}(M, N)]] is defined and is a section of the family [[Γ, x: σ | τ[x]]]{[[Γ | N]]}. We now use Lemma 2.5.4 to conclude that this family equals [[Γ | τ[N]]] as required. □

We finish our presentation of categorical semantics of dependent type theory with a trivial completeness theorem for syntactic categories with attributes.

Theorem 2.5.7 Let Γ, Δ be pre-contexts, σ, τ be pre-types, and M, N be preterms.

– If [[Γ]] is defined in all interpretations then Γ ⊢.

– If [[Γ | σ]] is defined in all interpretations then Γ ⊢ σ.

– If [[Γ | M]] is defined in all interpretations then Γ ⊢ M : σ for some (unique) σ.

– If [[Γ]] = [[Δ]] in all interpretations then ⊢ Γ = Δ.

– If [[Γ | σ]] = [[Γ | τ]] in all interpretations then Γ ⊢ σ = τ.

– If [[Γ | M]] = [[Γ | N]] in all interpretations then Γ ⊢ M = N : σ for some unique σ.

Proof. Using the term model from Ex. 2.4.2 and induction on the definition of the interpretation function. □

Remark 2.5.8 One can define morphisms between syntactic categories with attributes in the obvious way as functions on contexts, morphisms, families, and sections preserving all the structure up to equality. In this way syntactic categories with attributes supporting a given set of type formers form a category in which the respective term model is initial.

2.6 Discussion and related work

Our formulation of the syntax differs from the more modern one in [85] in that it is not based on a logical framework. In the latter approach one first defines a type theory with Π-types (written (x: σ)τ) and one universe (called Set) the way we have done and then one introduces all further constructs as constants of the appropriate type, e.g. for Σ-types one would have a constant Σ : (S: Set)(T: (s: El(S))Set)Set. In this way many of the rules can be simplified and less meta-notation (like substitution) is needed. The reason why we have not used this notation was that the categorical semantics then becomes more complicated. In retrospect we think that it might have been better to pay this price in exchange for a neater and more up-to-date syntax.

Another basic characteristic of our presentation of the syntax is the handling of substitution as a defined operation on the raw syntax. Recently, there has been an interest in treating substitution as part of the syntax and giving reduction (or equality rules) for it ([22,23] and unpublished notes by Per Martin-Löf). We have not used this presentation simply because it does not yet seem to be sufficiently settled, see for instance [76].

The categorical semantics of dependent type theory has attracted quite some interest, see [15,55,86,30,52] for instance, but mostly from an abstract categorical point of view. If we can claim any originality for the material in this chapter then it is for having tried to de-mystify the categorical semantics and to relate it as closely to the syntax as possible. Let us summarise the most important approaches to categorical semantics in the literature. The subject started with Cartmell’s pioneering work [15] who invented the notions of contextual categories and categories with attributes. Categories with attributes have been described in Remark 2.4.11; in contextual categories the “families” are replaced by an additional tree structure on the category of contexts. This latter notion underlies Streicher’s work [99,100] on categorical semantics of the Calculus of Constructions, where the interpretation of the syntax is defined formally and the method of partially interpreting pre-constructions appears for the first time.

In these two notions of model, equality of families and compatibility of the type formers with substitution up to equality is crucial (this in known as the “split case”). In other approaches to categorical semantics this has been weakened to canonical isomorphism (the non-split case), e.g. in locally cartesian closed categories [96], models based on fibrations [30,55], and display map categories [52,103]. The interpretation of the syntax in such structures is not obvious at all, however, a fact which has astonishingly been neglected by many authors. An exception is Ehrhard [30] who restricts to the split case and then uses Streicher’s method to interpret the syntax of the Calculus of Constructions in his fibrational models. The problem of interpreting the syntax in non-split categorical structures has only recently been taken up by Curien using an intermediate syntax with explicit substitutions [23] and by the author using a categorical construction that turns a non-split structure into a split one [46]. In both approaches problems (in particular the treatment of universes) remain, so that one can conclude that at the current state-of-the-art the non-split models do not properly correspond to the syntax.

Another generalisation offered by models based on fibrations is that morphisms between families are primitive rather than defined through context comprehension as special context morphisms. This has the advantage that context comprehension satisfies a universal property w.r.t. these morphisms [30] and therefore—if it exists—it is unique up to isomorphism. Morphisms between families also permit a more natural characterisation of Π- and Σ-types as certain adjoint functors. Again, this characterises them up to isomorphism so that the presence of these type formers becomes a property rather than additional structure. However, this only works for models of extensional type theory.

It has already been said that most of the material in this chapter is not original. However, since no homogeneous treatment covering both syntax and semantics of dependent type theory exists in the literature, let alone a textbook (this may be remedied by the forthcoming [89]), we considered it necessary to give a rather detailed account. As novelties, albeit implicit in existing literature, we consider the equational presentation of categories with attributes, the emphasis on stability under substitution rather than universal properties in the formulation of the semantic type formers, e.g. the identity type, the construction achieving equality between the semantics of Prf(∀x: σ.S) and Πx: σ.Prf(S) in Prop. 2.4.38, and the explicit use of telescopes in the correctness proof for the interpretation function.

Syntactic properties of propositional equality

The main focus of this Chapter are the proofs of two important properties of extensional type theory, i.e. type theory with propositional and definitional equality identified. The first property is undecidability of this theory; in view of the information loss in the equality reflection rule an obvious thing, which is nevertheless not completely trivial to prove (Sect. 3.2.2). The second property is the conservativity of extensional type theory over intensional type theory with extensional concepts (Sect. 3.2.5). These two properties constitute the major justification for the use of intensional type theory with extensional concepts.

On the way we develop some notions and concepts which will be required later such as the formulation of propositional equality using uniqueness of identity and a Leibniz property (Sect. 3.2.3.1) and the syntactic formulation of extensional concepts relevant in Martin-Löf type theory without a universe of propositions (Sects 3.1.2, 3.1.3, 3.2.6.1). An impatient reader may skip the other parts of this chapter without affecting the understandability of the rest of the thesis.

3.1 Intensional type theory

Intensional type theory is the one described in Sect. 2.1. Here we present some derived combinators and operations for the inductive identity type Id_{σ} defined there (Sect. 3.1.1). Next we look at the extensional concepts of uniqueness of identity (Sect. 3.1.2) and functional extensionality (Sect.3.1.3) and establish some syntactic properties of these.

3.1.1 Substitution

From the elimination operator J we can define an operator which allows to replace propositionally equal objects in a dependent type. Let x: σ ⊢ τ[x] and M, M′ : σ and P : Id_{σ}(M, M′) and N : τ[M]. We then define

Subst_{σ,τ}(M, M′, P, N) :=
J_{σ,[x,y:σ][p:Id_{σ}(x,y)]τ[x]→τ[y]}([x: σ]λh: τ[x].h , M , M′ , P) N : τ[M′]

By the equality rule Id-Comp we have

Subst_{σ,τ}(M, M, Refl_{σ}(M), N) = N : τ[M]  (3.1)

Intuitively, Subst allows to “replace” M by the propositionally equal M′ in the type τ[M] of N. As opposed to extensional type theory every application of propositional equality must be recorded in the terms, we cannot simply write N : τ[M′], but Subst_{σ,τ}(M, M′, P, N) : τ[M′] as indicated.

Since the first two arguments to Subst can be inferred from the third one we often suppress these and write Subst_{σ,τ}(P, N). Also, as usual, type annotations may be left out. The same convention applies to other combinators and definitional extensions which we introduce later on.

It is slightly unpleasant that the function type has to be used in order to derive a principle as basic as substitution. This may be avoided by replacing J by another elimination operator J′ governed by the typing rule

\frac{Γ , x, y : σ , p : Id_{σ}(x, y) ⊢ τ[x, y, p] Γ ⊢ N_{1} : σ Γ ⊢ N_{2} : σ Γ ⊢ M : τ[N_{1}, N_{1}, Refl_{σ}(N_{1})] Γ ⊢ P : Id_{σ}(N_{1}, N_{2})}{Γ ⊢ J′_{σ,τ}(M, N_{1}, N_{2}, P) : τ[N_{1}, N_{2}, P]} Id-Elim-J′

and an equality rule analogous to Id-Comp. So instead of having to “prove” τ[x, x, Refl_{σ}(x)] for all x : σ (the second premise to Id-Elim-J we only need it for x := N_{1}. This elimination operator is definable from J using function types and gives Subst directly without using them. However, since J is more established, we shall stick to it.

It is worth pointing out that identity elimination (J) allows us to “reason” about terms involving instances of Subst (an example for such a term occurs in Ex. 6.6). Intuitively using J one can “replace” the proof P in an instance of Subst by an instance of reflexivity and then use the definitional equality Eqn. 3.1 above to get rid of Subst . A more systematic approach to this is provided by the conservativity result in Sect. 3.2.5 and is exemplified again in Ex. 6.6.

3.1.1.1 Symmetry and transitivity

Let M, N : σ and P : Id_{σ}(M, N). We define

Sym_{σ}(M, N, P) := Subst_{σ,[x:σ]Id_{σ}(x,M)}(M, N, P, Refl_{σ}(M)) : Id_{σ}(N, M) If in addition we have Q : Id_{σ}(N, O) we define

Trans_{σ}(M, N, O, P, Q) := Subst_{σ,[x:σ]Id(M,x)}(N, O, Q, P) : Id_{σ}(M, O) The typing annotations and the inferable arguments may again be elided.

3.1.1.2 Compatibility with function application

Assume U : σ → τ and M, N : σ and P : Id_{σ}(M, N). An element of type Id_{τ}(U M, U N) is constructed as follows:

Resp (U, P) := Subst_{σ,[x:σ]Id_{τ} (U M,x)}(P, Refl_{τ}(U M))

More generally, if ⊢ Πx: σ.τ[x] and M, N, P are as before then we can find an element of Id_{τ[N]}(Subst_{σ,τ}(P, U M) , U N).

3.1.2 Uniqueness of identity

The conversion functions from τ[M] to τ[M′], if P : Id(M, M′), obtained from Subst depend on the proof supplied. That is, if Γ ⊢ P, Q : Id_{σ}(M, N) and Γ ⊢ L : τ[M] then in general the type

Γ ⊢ Id_{τ[N]}(Subst_{σ,τ}(P, L) , Subst_{σ,τ}(Q, L))

is not inhabited. We shall prove this later in Section 5.2. It is, however, certainly desirable that the above type is inhabited^{1}, or that equivalently the type

Γ ⊢ Id_{Id_{σ}(M,N)}(P, Q)

is inhabited. We use the term uniqueness of identity to refer to either type being inhabited for every such P, Q, M, N.

Various authors have proposed the addition of axioms to type theory so as to achieve uniqueness of identity [101,17,37]. Now as pointed out in [101] it is sufficient to have uniqueness of identity in the case where one of the two proofs is a canonical one by reflexivity. The general case follows using J, see below. So we introduce a family of constants

\frac{Γ ⊢ σ Γ ⊢ M : σ Γ ⊢ P : Id_{σ}(M, M)}{Γ ⊢ IdUni_{σ}(M, P) : Id_{Id_{σ}(M,M)}(P, Refl(M))} Id-Uni-I

and (in addition to the obvious congruence rules) an equality rule

\frac{Γ ⊢ σ Γ ⊢ M : σ}{Γ ⊢ IdUni_{σ}(M, Refl(M)) = Refl(Refl(M)) : Id_{σ}(M, M)} Id-Uni-Comp

1Inhabited, at any rate, if the identity typed is to approximate extensional equality.

For an application of a type theory without uniqueness of identity see Sect. 5.2.4.

In this way an instance of IdUni can be eliminated if its arguments are canonical, so that, provided Id-Uni-Comp does not destroy strong normalisation, a type theory extended by Id-Uni-I and Id-Uni-Comp is N-canonical in the sense of Def. 2.1.9. We have not found a formal proof in the literature that Id-Uni-Comp is indeed strongly normalising, but it seems probable that any of the usual proofs of normalisation should carry over.

Where appropriate we omit the type annotation and the first argument to IdUni .

For the sake of completeness we give now a proof of the general case of uniqueness of identity using IdUni . If Γ ⊢ σ then consider the type

τ[x, y: σ , p: Id_{σ}(x, y)] := Πq: Id_{σ}(x, y).Id_{Id_{σ}(x,y)}(p, q)

Now if Γ ⊢ M, N : σ and Γ ⊢ P, Q : Id_{σ}(M, N) then we have

Γ ⊢ J_{σ,τ}([x: σ]λq: Id_{σ}(x, x).IdUni_{σ}(x, p) , M , N , P) Q : Id_{Id_{σ}(M,N)}(P, Q)

3.1.2.1 Uniqueness of identity for definable types.

In the presence of a universe one can show that various instances of IdUni are definable. In addition to the unit type we need an empty type 0 containing no canonical elements and an elimination operator R_{σ}^{0}, where Γ ⊢ R_{σ}^{0}(M) : σ if Γ ⊢ M : 0. Moreover, we need a universe (U, El) in the sense of 2.3.5 containing codes ˆ1 and ˆ0 for the unit type and the empty type. We say that uniqueness of identity is definable at type σ if for each M : σ and P : Id_{σ}(M, M) the type Id_{Id_{σ}(M,M)}(P, Refl_{σ}(M)) is inhabited without using IdUni .

Proposition 3.1.1 In TT extended with an empty type 0 and a universe (U, El), containing 0 and 1, uniqueness of identity is definable at 0, 1, N. If uniqueness of identity is definable at σ then it is definable at Id_{σ}(M, N) for Γ ⊢ M, N : σ. If Γ, x: σ ⊢ τ and uniqueness of identity is definable at σ and at τ, then it is definable at Σx: σ.τ.

Proof. For the empty type 0 the result is trivial, since in the presence of a term M : 0 any type is inhabited by R^{0}. For 1 we first construct a general proof x, y: 1 ⊢ P_{0}[x, y] : Id_{1}(x, y) using R^{1} satisfying P_{0}[x, x] = Refl(x) and then show using J and R^{1} that whenever Γ ⊢ P : Id_{1}(M, N) then Γ ⊢, Id_{Id_{1}(M,N)}(P, P_{0}[M, N]). Uniqueness of identity at 1 is a trivial consequence from this. We argue similarly for the case of identity types themselves. If uniqueness of identity is definable at Γ ⊢ σ and Γ ⊢ M, N : σ then as shown above we have a general proof

Γ , p, q: Id_{σ}(M, N) ⊢ P_{0}[p, q] : Id_{Id_{σ}(M,N)}(p, q)

We deduce uniqueness of identity at Id_{σ}(M, N) as in the case of 1 using J.

For N we define a term x, y: N ⊢ EqNat[x, y] : U by induction (R^{N}) in such a way that ⊢ EqNat[0, 0] = ˆ1 : U, x: N ⊢ EqNat(0, Suc(x)) = EqNat(Suc(x), 0) = ˆ0 : U, and x, y: N ⊢ EqNat(Suc(x), Suc(y)) = EqNat(x, y). Now we construct terms

x, y: N , p: Id_{N}(x, y) ⊢ Φ[p] : El(EqNat[x, y])

and

x, y: N , p: El(EqNat[x, y]) ⊢ Ψ[p] : Id_{N}(x, y)

The function Φ is defined using identity elimination, whereas Ψ involves induction (R^{N}). Now using identity elimination (J) we can show that

x, y: N , p: Id_{N}(x, y) ⊢ Id_{Id_{N}(x,y)}(Ψ(Φ(p)), p)

is inhabited. So uniqueness of identity at N follows from unicity of proofs of El(EqNat[x, x]), which can be established by induction.

For Σ-types consider the type

EqSigma[u, v: Σx: σ.τ[x]] := Σp: Id_{σ}(u.1, v.1).Id_{τ[y]}(Subst_{σ,τ}(p, u.2) , v.2)

As in the case of N we can construct an “isomorphism” between Id_{Σx:σ.τ}(M, N) and EqSigma[M, N] and deduce uniqueness of identity from uniqueness of proofs of EqSigma which in turn follows from uniqueness of identity at σ and τ.

□

The methods of the above proof appear to carry over to other inductive types and type formers and under a certain assumption also to Π-types, see below. Uniqueness of identity is, however, not definable at universes, as emerges from the proof of its independence in Sect. 5.2.

3.1.2.2 The relationship with pattern-matching

It is worth highlighting the trivial observation that uniqueness of identity is definable at all types using the device of pattern-matching for dependent types introduced by Coquand in [17]. We do not here give the full definition of this mechanism, but only remark that it allows to define a function on an inductive type, such as the identity type, by specifying its value at the canonical elements. In this way we may define a term

Γ, p: Id_{σ}(M, M) ⊢ IdUni_{σ}(M, P) : Id_{Id_{σ}(M,M)}(M, Refl_{σ}(M))

by the single pattern

IdUni_{σ}(M, Refl_{σ}(M)) = Refl_{Id_{σ}(M,M)}(Refl_{σ}(M))

since Refl_{σ}(M) is the only canonical element of Id_{σ}(M, M). Of course, this reduction to canonical elements is also the intention behind the elimination rules R^{N}, J, …, but there the patterns are given in a parametrised way. This subtle difference is made more explicit in the proof of independence of uniqueness of identity in 5.2.

3.1.3 Functional extensionality

Suppose that Γ ⊢ U, V : Πx: σ.τ and Γ, x: σ ⊢ P : Id_{τ}(U x , V x). It is in general not possible to derive from these hypotheses that Γ ⊢ Id_{Πx:σ.τ}(U, V) is inhabited, that is—in the terminology of the Introduction—intensional type theory does not support functional extensionality. In [101] a formal semantic proof of this is given. Intuitively one may argue that if functional extensionality were available then in the case Γ = ⋄ we could deduce Id_{Πx:σ.τ}(U, V) true (from the existence of P above), but by strong normalisation (see Remark 2.1.6) an identity type in the empty context can only be inhabited by a canonical element Refl(−), so U and V must be definitionally equal, i.e. intensionally equal, which does not follow from the existence of the proof P which may have been obtained using induction. This is an unfortunate problem with the identity type which makes its instances at higher types essentially unusable. To achieve functional extensionality we may add a family of constants Ext_{σ,τ}(U, V, P) obeying the rule

\frac{\begin{matrix}Γ ⊢ U, V : Πx: σ.τ \\ Γ, x: σ ⊢ P : Id_{τ}(U x, V x) \end{matrix}}{Γ ⊢ Ext_{σ,τ}(U, V, P) : Id_{Πx:σ.τ}(U, V)} Ext-Form

The type annotations and the first two arguments to Ext may be omitted.

The introduction of these constants is essentially the solution proposed by Turner in [108]. Clearly, the addition of these constants Ext is consistent as may be seen from the set-theoretic or the ω-set model (Examples 2.4.4 and 2.4.5). Its serious drawback, immediately pointed out by Martin-Löf in a subsequent discussion also in [108], is that this introduces non-canonical elements in each type, since we have not specified how the eliminator J should behave when applied to a proof having Ext as outermost constructor. For example, consider the (constant) family f : N → N ⊢ N. Now if x: N ⊢ P [x] : Id_{τ}(U x, V x) for two functions U, V : N → N then Subst_{N→N,[x:N→N]N}(Ext(P), 0) is an element of N in the empty context which does not reduce to canonical form. We address this problem later in Chapter 5 where we give syntactic models in which functional extensionality holds and which induce a decidable definitional equality on the syntax under which terms like the above are indeed definitionally equal to an element in canonical form. One may try to achieve the same thing by adding reduction rules for Ext under which the above term would for example reduce to 0. Yet no satisfactory set of such rules has been found to date. Notice, however, that we can show that the term in question is propositionally equal to 0 because using J we can “replace” Ext(P) by an instance of Refl.

In loc.cit. Turner proposes to add the (definitional) equation

Γ ⊢ Ext_{σ,τ}([x: σ]Refl_{τ}(U)) = Refl_{Πx:σ.τ}(λx: σ.U) : Id_{Πx:σ.τ}(λx: σ.U, λx: σ.U) (3.2)

i.e. if we use Ext only to establish equality of definitionally equal terms then we may use Refl straightaway. The equation is ‘incomplete’ (i.e. does not solve the problem with non-canonical elements) because for example even in its presence the above term is not equal to 0 or any other canonical natural number. We remark that the propositional version of Turner’s equation is an instance of IdUni , but does not seem to follow from J alone. Interestingly, using Turner’s equation we can define uniqueness of identity at Π-types as well.

Proposition 3.1.2 Consider an extension of TT containing a family of term formers Ext_{σ,τ} satisfying Turner’s equation (3.2) above. If uniqueness of identity is definable at Γ, x: σ ⊢ τ then it is definable at Γ ⊢ Πx: σ.τ.

Proof. Consider the type EqPi[u, v : Πx: σ.τ] := Πx: σ.Id_{τ}(u x, v x). We define

Φ[u, v: Πx: σ.τ , p: Id_{Πx:σ.τ}(u, v)] := λx: σ.Resp ([u : Πx: σ.τ]u x , p) : EqPi[u, v]

and

Ψ[u, v: Πx: σ.τ , p: EqPi[u, v]] := Ext_{σ,τ}([x: σ]p x) : Id_{Πx:σ.τ}(u, v)

From uniqueness of identity at τ and Ext it follows that any two elements of EqPi are propositionally equal. On the other hand an element p : Id_{Πx:σ.τ}(u, v) is propositionally equal to Ψ[u, v, Φ[u, v, p]] using first J and then Turner’s equation. (Notice that Resp (f, Refl(x)) = f x by Id-Comp.) We conclude using Resp for Ψ. □

Note that this proof still goes through if Eqn. 3.2 only holds propositionally, e.g. by IdUni .

In the remainder of this chapter we shall leave aside the issue of non-canonical elements and study the logical implications of functional extensionality together with uniqueness of identity. We shall see that in a certain sense these two allow to recover the strength of extensional type theory in an intensional setting.

3.2 Extensional type theory

As described in the Introduction, in extensional type theory the definitional equality is identified with propositional equality and thereby becomes extensional. This is achieved by adding the following two rules [85, p. 65]:

\frac{\begin{matrix}Γ ⊢ σ Γ ⊢ M : σ Γ ⊢ N : σ \\ Γ ⊢ P : Id_{σ}(M, N) \end{matrix}}{Γ ⊢ M = N : σ} Id-Defeq

\frac{\begin{matrix}Γ ⊢ σ Γ ⊢ M : σ Γ ⊢ N : σ \\ Γ ⊢ P : Id_{σ}(M, N) \end{matrix}}{Γ ⊢ P = Refl_{σ}(M) : Id_{σ}(M, N)} Id-Uni

The first rule (Id-DefEq) is the equality reflection rule discussed in the Introduction. Notice that this rule is needed to make the other one (Id-Uni) “typecheck”. For technical reasons we also assume an η-rule for Π-types:

\frac{Γ ⊢ M : Πx: σ.τ}{Γ ⊢ M = λx: σ.M x : Πx: σ.τ} Π-Eta

In [85] it is pointed out that in the presence of rules Id-DefEq and Id-Uni, identity elimination becomes definable by putting

J_{σ,τ}(M, N_{1}, N_{2}, P) := M[x := N_{1}]

The operators IdUni and Ext are also definable, see Prop. 3.2.2; in fact they are just instances of reflexivity! Therefore, extensional type theory does not need explicit elimination operators for identity. For these reasons, extensional type theory is intuitively quite appealing. It also is very close to set theory and extensional concepts like quotient types are easily added (see [31] and Sect. 3.2.6.1). Moreover, it avoids the unusual coexistence of two different notions of equality. The rest of this Chapter is devoted to refute these apparent advantages of extensional type theory and to argue in favour of intensional type theory with extensional concepts. The two main arguments we put forward are the undecidability of extensional type theory (Sect. 3.2.2) and the conservativity of extensional type theory over intensional type theory (Sect. 3.2.5) which shows that nothing is lost by using intensional type theory.

3.2.1 Comparison with Troelstra’s presentation

In order to prevent possible confusion let us remark that in Troelstra and van Dalen’s book [107, Sect. 4–5], the predicates “intensional” and “extensional” are used in a different way. Their intensional theory ML_{0}^{i} is a version of our extensional type theory, that is it has rule Id-DefEq, but with type equality confined to basically syntactic identity. So no definitional conversion is permitted inside a type and thus the introduction rule for the identity type must be extended to permit one to conclude Γ ⊢ Refl(M) : Id_{σ}(M, M′) from Γ ⊢ M = M′ : σ. Moreover, ML_{0}^{i} neither contains a congruence rule for abstraction (“ξ-rule”) nor an η-rule for Π-types. On the other hand, their extensional type theory ML_{0} agrees mostly with extensional type theory in our sense (and in the sense of [85]). Intensional type theory in our sense (and in the sense of [85]) is only mentioned briefly as a note [loc.cit., p. 633].

3.2.2 Undecidability of extensional type theory

The equality reflection principle Id-DefEq is problematic since upon its application the proof P for the propositional equality is lost. Therefore, a syntax-directed decision procedure for definitional equality in extensional type theory would have to “guess” this proof P. Our aim in this section is to prove that this is not possible by showing that definitional equality in extensional type theory is undecidable. Before doing this we describe how this entails undecidability of all other kinds of judgements. Assume Γ ⊢ M : σ and Γ ⊢ N : σ. Now Γ ⊢ Refl_{σ}(M) : Id_{σ}(M, N) iff Γ ⊢ M = N : σ so typechecking is equivalent to deciding definitional equality. Furthermore, we have Γ ⊢ Id_{σ}(M, M) iff Γ ⊢ M : σ so typehood is equivalent to typechecking. The same goes for the remaining three kinds of judgements: type equality, context equality, and well-formedness of contexts.

Let us now turn to the undecidability of definitional equality. Although the rule Id-DefEq represents an information loss, undecidability is not entirely obvious because it is not clear how many propositional equalities are actually provable. In particular, there does not seem to be an obvious reduction to the halting problem, but one must use the tool of recursively inseparable sets [24]. In order to avoid the introduction of too much machinery we shall, however, avoid explicit mention of this notion. We also avoid explicit formalisation of proofs and algorithms in Martin-Löf type theory and appeal to a variant of Church’s thesis and the mathematical intuition of the reader.

If n ∈ ω is a natural number let n̂ stand for the numeral Suc^{n}(0) in type theory. We have ⊢ n̂ : N. A k-ary function f on the natural numbers is called numeral-wise representable if there exists a term ⊢ f̂: N → N → … → N such that for every k-tuple of natural numbers (x_{1}, …, x_{k}) we have ⊢ f̂ x̂_{1} … x̂_{k} = { \atop f(x_{1}, …, x_{k})} : N. It is well-known and actually obvious from the form of the recursor R^{N} that every primitive recursive function is numeral-wise representable. Compare this to the interpretation of Heyting arithmetic in type theory [107, Theorem 4.9].

Fix some Gödel numbering of Turing machines (TMs) in order to allow for self-application of Turing machines and consider the following function:

f(e, t) := \{ \begin{matrix}1, if TM e applied to itself halts after less than t steps with result 0 \\ 0, otherwise \end{matrix}

Since the number of steps required to evaluate f(e, t) is linear in e and t, this function is primitive recursive. Let ⊢ f̂ : N → N → N be its numeral-wise representation.

Now suppose e is such that e applied to itself halts after some number of steps with a result other than 0. Then f(e, −) is constantly 0 and this fact is actually provable in type theory, i.e. in this case the following type is inhabited by induction (R^{N}) and finite case distinction (also R^{N}):

t : N ⊢ Id_{N}(f̂ ê t , 0)

Using Id-DefEq this implies that

t : N ⊢ f̂ ê t = 0 : N

holds.

On the other hand, if TM e applied to itself halts with result 0 then

t : N ⊢ f̂ ê t = 0 : N

does not hold because this would contradict the definition of f.

Notice that in case e applied to itself does not halt, the above equation may or may not hold according to whether nontermination is provable in type theory.

Now if definitional equality in extensional type theory were decidable we could construct a Turing machine which when applied to some number e returns 0 if

t : N ⊢ f̂ ê t = 0 : N

and returns 1 otherwise. Let e_{0} be the Gödel number of this machine and consider the application of e_{0} to itself. By definition of e_{0} this computation terminates. We arrive at a contradiction whatever the result is.

Summing up, we obtain:

Theorem 3.2.1 In extensional type theory definitional equality, typechecking and typehood are equivalent and undecidable.

The same argument shows that inhabitation of identity types in nonempty contexts is undecidable in intensional type theory.

We remark that the undecidability of extensional type theory is part of the “folklore” in the field, but to the best of our knowledge has never been explicitly proved in the literature.

3.2.3 Interpreting extensional type theory in intensional type theory

In view of the above undecidability results, implementations of extensional type theory like e.g. Nuprl [31] deal with derivations rather than terms and judgements. The question arises whether derivations in extensional type theory can be translated into terms in intensional type theory with functional extensionality and uniqueness of identity. For example, we may want to know whether if x: N ⊢ U, V : N in intensional type theory and x: N ⊢ U = V : N in extensional type theory then the type x: N ⊢ Id_{N}(U, V) is inhabited in intensional type theory. This is indeed the case and follows from a much more general correspondence between intensional and extensional type theory which we prove below.

3.2.3.1 The type theories TT_{I} and TT_{E}

Streicher has observed in [101] that in the presence of uniqueness of identity the elimination operator J can be defined in terms of its particular instance Subst defined above (Sect. 3.1.1). Indeed, if Γ, x: σ ⊢ H : τ[x, x, Refl(x)] and Γ ⊢ P : Id_{σ}(M, N) then we form the type

ρ[x: σ] := Πp: Id_{σ}(M, x).τ[M, x, p]

Now we observe that Γ ⊢ ρ[M] is inhabited by

L[γ] := λp: Id(M, M).Subst (Sym (IdUni (P)) , H[M])

Therefore, Subst_{σ,ρ}(P, L) P is an inhabitant of Γ ⊢ τ[M, N, P] as required.

This suggests to take Subst instead of J as a primitive if one has uniqueness of identity. For the remainder of this Chapter, by “intensional type theory” or TT_{I} we mean the theory TT from above together with the constants IdUni and Ext, and with the elimination operator J with its associated rules replaced by a newly introduced term former Subst governed by the following two rules:

\frac{\begin{matrix}Γ, x: σ ⊢ τ[x] \\ Γ ⊢ M_{1}, M_{2} : σ \\ Γ ⊢ P : Id_{σ}(M_{1}, M_{2}) \\ Γ ⊢ N : τ[M_{1}] \end{matrix}}{Γ ⊢ Subst_{σ,τ}(M_{1}, M_{2}, P, N) : τ[M_{2}]} Leibniz
Γ ⊢ Subst_{σ,τ}(M, M, Refl_{σ}(M), N) = N : τ[M]

Leibniz-Comp The type annotations and the first two arguments to Subst may be omitted. If so stated in the running text, TT_{I} may be augmented by further type formers and rules. Thus, the term formers associated to propositional equality in TT_{I} are: Refl, Subst , IdUni , and Ext.

By “extensional type theory” or TT_{E} we mean the core type theory TT with the identity elimination rules (the rules Id-Elim-J and Id-Comp J) replaced by Id-DefEq and Id-Uni, and with Π-Eta added. In order to distinguish the intensional from the extensional type theory we write ⊢_{I} and ⊢_{E} for the two respective judgement relations. Recall from Sect. 2.1.3 that (for ⊢∈ {⊢_{I}, ⊢_{E}}) we write Γ ⊢ σ true if there exists M with Γ ⊢ M : σ and that ≡ denotes syntactic identity modulo renaming of variables.

It was mentioned before that the operators of TT_{I} are definable in TT_{E}. More formally, we can define a “stripping map” | − | by

– |Subst_{σ,τ}(M_{1}, M_{2}, P, N)| := |N|

– |IdUni_{σ}(M, P)| := Refl_{Id_{|σ|}(|M|,|M|)}(Refl_{|σ|}(|M|))

– |Ext_{σ,τ}(U, V, P)| := Refl_{Πx:|σ|.|τ|}(|U|)

– homomorphically extended to all other terms, types, contexts. and judgements

This mapping enjoys the following trivial soundness property.

Proposition 3.2.2 If Γ ⊢_{I} J then |Γ| ⊢_{E} |J| for all contexts Γ and judgements J.

Proof. By induction on derivations in TT_{I} or equivalently by showing that the term model of TT_{E} forms a model of TT_{I} with the settings prescribed by the definition of |−|. The only interesting case is the interpretation of Ext. If Γ, x: σ ⊢_{E} P: Id_{τ}(U x, V x) then by Id-DefEq we have Γ, x: σ ⊢_{E} U x = V x : Πx: σ.τ. So by the congruence rule for abstraction we get Γ ⊢_{E} λx: σ.U x = λx: σ.V x : Πx: σ.τ and hence using Π-Eta and transitivity Γ ⊢_{E} U = V : Πx: σ.τ and finally Γ ⊢_{E} Refl(U) : Id(U, V) as required. Without Π-Eta we could obtain functional extensionality only for abstractions but not for arbitrary terms of Π-type. □

In order to compare the strengths of extensional and intensional type theory we are now interested in possible converses of this proposition. In particular:

Inv  Γ ⊢_{E} J implies Γ′ ⊢_{I} J′ for
some Γ′, J′ with |Γ′| ≡ Γ and |J′| ≡ J.
Cons-Ty  |Γ| ⊢_{E} |σ| true implies Γ ⊢_{I} σ true .
Cons-Id |Γ| ⊢_{E} |M| = |N| : |σ| implies Γ ⊢_{I} Id_{σ}(M, N) true.

Clearly, Cons-Ty implies Cons-Id. The first property Inv which in contrast to the other two speaks about arbitrary judgements in TT_{E}, is not true. A counterexample is the judgement

x: N ⊢_{E} x = Suc^{x}(0) : N

where Suc^{x}(0) := R_{N}^{N}(0, [x, y: N]Suc(y), x) is the x-th iteration of the successor function on start value 0. If we decorate both sides of this equation with instances of Subst we get more complicated terms, but certainly no true equation in TT_{I}. The reason is that (apart from congruence) the only way that a Subst -expression can be definitionally equal to something else is by use of Leibniz-Comp, but then the outermost Subst disappears and no equation has been added which wasn’t there before. However, we certainly have

x: N ⊢_{I} Id_{N}(x, Suc^{x}(0)) true

since the required inhabitant of the identity type may be constructed by induction. Together with Id-DefEq this gives a proof of the above judgement in TT_{E} and corroborates Cons-Id.

Our aim is to prove Cons-Ty, and thus Cons-Id and to define a mild extension of TT_{I} under which Inv becomes true.

3.2.4 An extension of TT_{I} for which the interpretation in TT_{E} is surjective

The above counterexample would no longer go through if there were a term whose stripping equals x and which nevertheless is definitionally equal to Suc^{x}(0) in TT_{I}. To cure the problem with Inv we may simply add such a construct. More precisely, we introduce a new term former ℜ_{σ}(M, N, P) described by the following two rules:

\frac{Γ ⊢_{I} M, N : σ Γ ⊢_{I} P : Id_{σ}(M, N)}{Γ ⊢_{I} ℜ_{σ}(M, N, P) : σ} ℜ-Form
\frac{Γ ⊢_{I} ℜ_{σ}(M, N, P) : σ}{Γ ⊢_{I} ℜ_{σ}(M, N, P) = N : σ} ℜ-Eq

Let us write TT_{ℜ} for TT_{I} extended with ℜ and ⊢_{ℜ} for the corresponding judgement relation. In view of ℜ-Eq, ℜ is a simple definitional extension comparable with the addition of an explicit function symbol for multiplication which is definitionally equal to its primitive recursive coding using R^{N}. The power of ℜ stems from its interpretation in TT_{E}. Namely, we decree that:

|ℜ_{σ}(M, N, P)| := |M|

Now Prop. 3.2.2 continues to hold:

Proposition 3.2.3 If Γ ⊢_{ℜ} J then |Γ| ⊢_{E} |J| for all contexts Γ and judgements J.

Proof. As before by induction on derivations; the only interesting case is the rule ℜ-Eq. If Γ ⊢_{ℜ} ℜ_{σ}(M, N, P) : σ then we must have Γ ⊢_{ℜ} M, N : σ and Γ ⊢_{ℜ} P : Id_{σ}(M, N). So we may inductively assume that |Γ| ⊢_{E} |P | : Id_{|σ|}(|M|, |N|) and thus |Γ| ⊢_{E} |M| = |N| : |σ| by Id-DefEq. But this is the stripping of the conclusion of rule ℜ-Eq. □

The interesting aspect of TT_{ℜ} is that the interpretation |−| of it in TT_{E} is actually surjective, which means that Inv holds.

Theorem 3.2.4 Whenever Γ ⊢_{E} J then there exist Γ′ and J′ in the language of TT_{ℜ} such that Γ′ ⊢_{ℜ} J′ and |Γ′| ≡ Γ and |J′| ≡ J.

Proof. By induction on derivations in TT_{E}. The interesting cases are Id-DefEq, Id-Uni, and Π-Eta. In the other cases we just follow the derivation in TT_{E}. For Id-DefEq assume Γ ⊢_{E} P : Id_{σ}(M, N) and (inductively) Γ′ ⊢_{ℜ} P′ : Id_{σ′}(M′, N′) where |C′| ≡ C for C ∈ {Γ, σ, P, M, N}. Now the conclusion of Id-DefEq is Γ ⊢_{E} M = N : σ. Putting M′′ := ℜ_{σ′}(M′, N′, P′) we have Γ′ ⊢_{ℜ} M′′ = N′ : σ′ but on the other hand |M′′| ≡ |M′| ≡ M.

The rule Id-Uni has the same premises so we keep the variables introduced so far. The conclusion of the rule is Γ ⊢_{E} P = Refl_{σ}(M) : Id_{σ}(M, N). Therefore, we must find a term P′′ with stripping equal to P and which itself is definitionally equal (in TT_{I}) to Refl(M′). Using ℜ we can relax this to propositional equality. This suggests to define

P′′ := Subst_{σ,[x:σ′]Id(M′,x)}(N′, M′, Sym (P′), P′)

We have Γ′ ⊢_{ℜ} P′′ : Id_{σ}(M, M) and Γ′ ⊢_{ℜ} IdUni (P′′) : Id(P′′, Refl(M)). Moreover, |P′′| ≡ |P′| ≡ P. Therefore with

P′′′ := ℜ_{Id_{σ′}(M′,M′)}(P′′, Refl(M′), IdUni (P′′))

we have Γ′ ⊢_{ℜ} P′′′ = Refl_{σ}(M′) : Id_{σ′}(M′, M′) and the stripping of this judgement is the conclusion of rule Id-Uni.

Finally, for Π-Eta we use a particular instance of Ext. □

The particular instance of IdUni used in this proof can be defined using J as well. So if we had used J instead of Subst we could have avoided the use of uniqueness of identity. Then, however |P′′| would not be identical to P but only β-reduce to P. One could circumvent this using J′ (defined above in Sect. 3.1.1) as primitive. The only use of functional extensionality was in order to mimic the rule Π-Eta. If one were not interested in this rule, one could get surjectivity of | − | with ℜ alone and no extensional concepts at all. In particular, in TT_{ℜ} we can derive a propositional counterpart of the λ-congruence rule (ξ-rule) as follows: Suppose that Γ, x: σ ⊢_{ℜ} U, V : τ and Γ, x: σ ⊢_{ℜ} P : Id_{τ}(U, V). Then we have

Γ ⊢_{ℜ} Refl_{Πx:σ.τ}(λx: σ.V) : Id_{Πx:σ.τ}(λx: ℜ_{τ}(U, V, P) , λx: σ.V)  (3.3)

This shows quite well how ℜ works. In a certain sense, the above judgement is a triviality because it is an instance of reflexivity. But if one does not identify definitionally equal terms and instead reads an expression ℜ_{σ}(M, N, P) as something like “means M but is written N for reasons of intensionality and this is justified by virtue of P ” then the above judgement really corresponds to the conclusion of a propositional ξ-rule. One can do even more and—using extensional concepts and instances of Resp —move all the instances of ℜ to the root of a term, with the stripping unchanged, which may be used to obtain a variant of property Cons-Id as follows: If Γ ⊢_{E} M = N : σ we can find Γ′, σ′ and ℜ-free terms M_{1}, M_{2}, N_{1}, N_{2}, and proofs P_{1}, P_{2} such that

Γ′ ⊢_{ℜ} ℜ_{σ′}(M_{1}, M_{2}, P_{1}) = ℜ_{σ′}(N_{1}, N_{2}, P_{2}) : σ′

where |Γ′| ≡ Γ, |σ′| ≡ σ, |M_{1}| ≡ M, and |N_{1}| ≡ N. From the definition of ℜ we then get

Γ′ ⊢_{ℜ} Trans (P_{1}, Sym (P_{2})) : Id_{σ′}(M_{1}, M_{2})

which we can see as the conclusion of Cons-Id in case Γ′ and σ′ are sufficiently simple so that they equal their stripping. Also the type annotations of M_{1}, M_{2} must not contain any instances of ℜ or Subst which may be difficult to guarantee. We will not pursue this line of thought any further and prove Cons-Ty and Cons-Id by other methods below. However, we want to advocate the use of ℜ as a possible addition to intensional type theory even in the absence of extensional concepts. This requires a slightly unusual approach to theorem proving in type theory because in the course of trying to prove a goal it may become necessary to alter it by interspersing instances of ℜ. E.g. we can’t prove that λx: σ.U and λx: σ.V from above are definitionally equal or (without functional extensionality) that they are propositionally equal, but by altering the goal using ℜ this becomes possible as we have just seen in the derivation of Judgement 3.3.

3.2.5 Conservativity of TT_{E} over TT_{I}

Our aim is now to prove property Cons-Ty of which Cons-Id is a consequence. In fact we shall establish the following mild generalisation of Cons-Ty.

Theorem 3.2.5 If Γ ⊢_{I} σ and |Γ| ⊢_{E} P : |σ| for some P then there exists P′ such that Γ ⊢_{I} P′ : σ. Moreover, |Γ| ⊢_{E} |P′| = P : |σ|.

Before embarking on the proof of this Theorem we remark that it does not follow from Inv, i.e. in the presence of ℜ, because if Γ ⊢_{ℜ} σ and |Γ| ⊢_{E} |σ| true then we have Γ′ ⊢_{ℜ} σ′ true for some Γ′ and σ′ with |Γ′| ≡ |Γ| and |σ′| ≡ |σ|, but there is no reason why Γ ⊢_{ℜ} σ true should hold, too. It would, however, be true if types (and contexts) with identical stripping could be shown to be isomorphic. On the other hand, this fact (at least for types) is a consequence of Cons-Ty because if |σ| ≡ |σ′| then the stripping of

\begin{matrix}Σf: σ → σ′.Σf^{−1}: σ′ → σ. \\ Id(λx: σ.f^{−1}(f x), λx: σ.x) × Id(λx: σ′.f(f^{−1} x), λx: σ′.x) \end{matrix}

is inhabited in TT_{E} by taking the identity on σ for f and f^{−1}, and Cons-Ty then gives an isomorphism between σ and σ′ in TT_{I}.

These isomorphisms are indeed the key to proving the conservativity theorem, but it turns out that the use of ℜ can be avoided.

The idea for the proof is to show that the term model of TT_{I} quotiented by propositional equality forms a model of TT_{E}. Quotienting a model of type theory is, however, not an easy thing to do because as soon as one identifies two morphisms f, g : Γ → Δ one also has to identify families over Γ which come from the same family over Δ through substitution along f and g. This identification of families also forces identification of certain contexts and therefore of new morphisms which were incomparable before. We do not know whether there exists a general theory of quotients of syntactic categories with attributes and more generally of fibrations and generalised algebraic theories, but we believe that such a theory would have to be fairly complicated. Fortunately, in the particular case at hand we have a good definition for when two types or contexts are to be identified, so that we can get away without looking at the most general case.

Our strategy consists of first extending propositional equality to contexts so that we can say when two context morphisms are to be identified. Next, by structural induction we construct possibly undefined isomorphisms (up to propositional equality) between types and between contexts in such a way that the isomorphism between two types (and between two contexts) is defined iff their strippings are equal in TT_{E}. The key idea of the proof is that this semantic property of types and contexts can be defined by structural induction,

We identify two types or contexts if the corresponding isomorphism is defined, and show that this gives a model of TT_{E}. We then show that stripping lifts to an operation on the induced equivalence classes and defines a structure-preserving map between this model and the term model of TT_{E}. Its composition with the interpretation of TT_{E} in the quotient model must therefore be the identity. This, together with the fact that equality in the quotient model is isomorphism, gives the desired result.

3.2.5.1 Propositional equality of context morphisms

Let Γ be a context in TT_{I}. By induction on the length of Γ we define a type ⊢_{I} \overline{Γ} in the empty context and substitutions x: \overline{Γ} ⊢_{I} out_{Γ} ⇒ Γ and Γ ⊢_{I} in_{Γ} ⇒ x: \overline{Γ} as follows:

\overline{⋄}  := 1
in_{⋄}  := ⋆
out_{⋄}  := ()
\overline{Γ, x: σ}  := Σg: \overline{Γ}.σ[out_{Γ}[g]]
in_{Γ,x:σ}[γ: Γ, x: σ] := pair_{\overline{Γ},σ[out_{Γ}]}(in_{Γ}[γ], x)
out_{Γ,x:σ}[z: \overline{Γ, x: σ}] := (out_{Γ}[z.1] , z.2)

From the equation Σ-Comp we get the definitional equality

γ: Γ ⊢_{I} out_{Γ}[in_{Γ}[γ]] = γ : Γ  (3.4)

This equation is needed for the definitions above to typecheck, so strictly speaking we have to establish it along with the inductive definition above.

The converse only holds propositionally: If ⊢_{I} M : \overline{Γ} then by induction on the length of Γ and using R^{Σ} we can construct a term srj_{Γ}(M) such that

⊢_{I} srj_{Γ}(M) : Id\overline{Γ}(in_{Γ}[out_{Γ}[M]] , M)

This reflection of contexts into types allows us to compare substitutions up to propositional equality. If Γ ⊢_{I} f, g ⇒ Δ then we can form

Γ ⊢_{I} Id\overline{Δ}(in_{Δ} ∘ f, in_{Δ} ∘ g) (⋆)

and if Δ ⊢_{I} σ, Γ ⊢_{I} P : Id\overline{Δ}(in_{Δ} ∘ f, in_{Δ} ∘ g), and Γ ⊢_{I} M: σ[f] then since Γ ⊢_{I} σ[f] = σ[out_{Δ}][in_{Δ} ∘ f] we have

Γ ⊢_{I} Subst_{\overline{Δ},σ[out_{Δ}]}(in_{Δ} ∘ f, in_{Δ} ∘ g, P, M) : σ[g]

So the above type (⋆) behaves like an identity type at contexts. We thus introduce the abbreviations

Id_{Δ}(f, g) := Id\overline{Δ}(in_{Δ} ∘ f, in_{Δ} ∘ g)

and

Subst_{Δ,σ}(f, g, P, M) := Subst_{\overline{Δ},σ[out_{Δ}]}(in_{Δ} ∘ f, in_{Δ} ∘ g, P, M)

for these types and terms. We also write

Refl_{Δ}(f) := Refl\overline{Δ}(in_{Δ} ∘ f)

and

IdUni_{Δ}(f, P) := IdUni \overline{Δ}(in_{Δ} ∘ f, P)

As usual, we allow the omission of arguments which can be inferred or are clear from the context.

From Leibniz-Comp and IdUni-Comp we obtain the definitional equalities

Γ ⊢_{I} Subst_{Δ,σ}(Refl(f), M) = M : σ[f]
Γ ⊢_{I} IdUni_{Δ}(f, Refl(f)) = Refl(Refl(f)) : Id_{Δ}(f, f)

Remark 3.2.6 This definition of propositional equality of context morphisms can still be carried out when Σ-Comp is a replaced by a propositional equality (as is the case in the type theory S_{1} to be introduced in Sect. 5.3), but then one must construct a witness for the propositional counterpart of Eqn. 3.4 along with the definition of in_{Γ} and out_{Γ}. This is possible, but messy to write down.

3.2.5.2 Propositional isomorphisms

A pair of syntactic context morphisms Γ ⊢_{I} f ⇒ Δ and Δ ⊢_{I} f′ ⇒ Γ is called a propositional isomorphism between Γ and Δ if γ: Γ ⊢_{I} Id_{Γ}(f^{−1}[f[γ]] , γ) true and δ: Δ ⊢_{I} Id_{Δ}(f[f^{−1}[δ]] , δ) true. In this situation we write (f, f^{−1}) : Γ ≅ Δ. If Γ ⊢_{I} σ and Γ ⊢_{I} τ then a pair of terms Γ, x: σ ⊢_{I} f[x] : τ and Γ, x: τ ⊢_{I} f^{−1}[x] : σ is called a propositional isomorphism between σ and τ if Γ, x: σ ⊢_{I} Id_{σ}(f^{−1}[f[x]] ,

x) true and Γ , y: τ ⊢_{I} Id_{τ}(f[f^{−1}[y]] , y) true. We write Γ ⊢_{I} (f, f^{−1}) : σ ≅ τ to indicate this.

We shall now partially define symbols co_{Γ,Δ} and ty_{Γ,Δ,σ,τ} by structural induction on pre-terms and pre-contexts in such a way that if these symbols are defined they constitute propositional isomorphisms in the following way

(co_{Γ,Δ}, co_{Γ,Δ}^{−1}) : Γ ≅ Δ

and

Γ ⊢_{I} (ty_{Γ,Δ,σ,τ}, ty_{Γ,Δ,σ,τ}^{−1}) : σ ≅ τ[co_{Γ,Δ}]

The inductive clauses for these symbols are as follows’:

co_{⋄,⋄}  = co_{⋄,⋄}^{−1} = ()
co_{Γ,x:σ,Δ,y:τ}[γ: Γ, x: σ] = (co_{Γ,Δ}[γ], ty_{Γ,Δ,σ,τ}[γ, x])
co_{Γ,x:σ,Δ,y:τ}^{−1}[δ: Δ, y: τ] = (co_{Γ,Δ}^{−1}[δ], ty_{Γ,Δ,σ,τ}^{−1}[co_{Γ,Δ}^{−1}, Subst_{Δ,τ}(P, y)])

where δ: Δ ⊢_{I} P : Id(δ, co_{Γ,Δ}[co_{Γ,Δ}^{−1}[δ]]) is obtained from the assumption that (co_{Γ,Δ}, co_{Γ,Δ}^{−1}) : Γ ≅ Δ. The context morphisms co and co^{−1} are undefined in all other cases. In particular co_{Γ,Δ} is undefined if Γ and Δ have different length.

The propositional isomorphisms ty_{Γ,Δ,σ,τ} can only be defined if σ and τ share the same outermost type former. We have a clause for each of these.

ty_{Γ,Δ,N,N}[γ, x] = \{ \begin{matrix}x, if co_{Γ,Δ} is defined \\ undefined otherwise \end{matrix}
ty_{Γ,Δ,N,N}^{−1} = ty_{Γ,Δ,N,N}

For the definition of ty_{Γ,Δ,Πx:σ_{1}.σ_{2},Πy:τ_{1}.τ_{2}} assume γ: Γ, f: Πx: σ_{1}.σ_{2} and y: τ_{1}[co_{Γ,Δ}[γ]]. We put U := ty_{Γ,Δ,σ_{1},τ_{1}}^{−1}[γ, y] : σ_{1}[γ] and V := f v : σ_{2}[γ, U]. Now

W := ty_{(Γ,x:σ_{1}),(Δ,y:τ_{1}),σ_{2},τ_{2}}[(γ, U), V] : τ_{2}[co_{Γ,Δ}[γ] , ty_{Γ,Δ,σ_{1},τ_{1}}[γ, U]]

by expanding the definition of co_{(Γ,x:σ_{1}),(Δ,y:τ_{1})}. Finally,

Subst (P, W) : τ_{2}[co_{Γ,Δ}[γ] , y]

where

γ: Γ , y: τ_{1}[co_{Γ,Δ}] ⊢_{I} P : Id_{Γ,y:τ_{1}[co_{Γ,Δ}]}(
(co_{Γ,Δ}[γ] , ty_{Γ,Δ,σ_{1},τ_{1}}[γ, ty_{Γ,Δ,σ_{1},τ_{1}}^{−1}[γ, y]]) ,
(co_{Γ,Δ}[γ] , y))

is obtained from reflexivity and the assumption Γ ⊢_{I} (ty_{Γ,Δ,σ_{1},τ_{1}}, ty_{Γ,Δ,σ_{1},τ_{1}}^{−1}) : σ_{1} ≅ τ_{1}[co_{Γ,Δ}] and thus

ty_{Γ,Δ,Πx:σ_{1}.σ_{2},Πy:τ_{1}.τ_{2}}[γ, f] := λy: τ_{1}[co_{Γ,Δ}[γ].Subst (P, W) : (Πy: τ_{1}.τ_{2})[co_{Γ,Δ}[γ]]

The inverse ty_{Γ,Δ,Πx:σ_{1}.σ_{2},Πy:τ_{1}.τ_{2}}^{−1} is defined in the same way, interchanging the roles of ty and ty^{−1}. The proofs that a propositional isomorphism has been constructed are obtained using Ext.

For ty_{Γ,Δ,Σx:σ_{1}.σ_{2},Σy:τ_{1}.τ_{2}} we assume γ: Γ and f: Σx: σ_{1}.σ_{2}. Now

U := ty_{Γ,Δ,σ_{1},τ_{1}}[γ, f.1] : τ_{1}[co_{Γ,Δ}[γ]]

and

V := ty_{(Γ,x:σ_{1}),(Δ,y:τ_{1}),σ_{2},τ_{2}}[(γ, f.1), f.2] : τ_{2}[co_{Γ,Δ}[γ], U]

We thus define

ty_{Γ,Δ,Σx:σ_{1}.σ_{2},Σy:τ_{1}.τ_{2}}[γ, f] := (U, V) : (Σy: τ_{1}.τ_{2})[co_{Γ,Δ}[γ]]

The inverse is again obtained by interchanging ty and ty^{−1}. For the proof of the isomorphism property one uses that surjective pairing holds propositionally (see Sect. 2.3.2).

For ty_{Γ,Δ,Id_{σ}(M_{1},M_{2}),Id_{τ} (N_{1},N_{2})} we check whether there exist P, Q with

γ: Γ ⊢_{I} P : Id_{τ[co_{Γ,Δ}[γ]]}(ty_{Γ,Δ,σ,τ}[γ, M_{1}], N_{1}[co_{Γ,Δ}[γ]])
γ: Γ ⊢_{I} P_{2} : Id_{τ[co_{Γ,Δ}[γ]]}(ty_{Γ,Δ,σ,τ}[γ, M_{2}], N_{2}[co_{Γ,Δ}[γ]])

If not, then ty_{Γ,Δ,Id_{σ}(M_{1},M_{2}),Id_{τ} (N_{1},N_{2})} is undefined. If yes, then for p: Id_{σ}(M_{1}, M_{2}) we define

ty_{Γ,Δ,Id_{σ}(M_{1},M_{2}),Id_{τ} (N_{1},N_{2})}[γ, p: Id_{σ}(M_{1}, M_{2})] :=
Trans (Sym (P_{1}), Trans (Resp (λx: σ.ty_{Γ,Δ,σ,τ}[γ, x] , p) , P_{2}))
: (Id_{τ}(N_{1} , N_{2})[co_{Γ,Δ}[γ]]

The inverse is defined analogously; the proof of the isomorphism property is an instance of IdUni .

Notice that this definition depends in various places on choices of particular proofs of propositional equalities. Some of the choices, e.g. in the definition of co_{Γ,x:σ,Δ,y:τ}^{−1}, could be avoided by carrying through explicit witnesses for the various isomorphism properties. Others, like the one in the clause for the identity type, are more difficult to eliminate.

These propositional isomorphisms enjoy various properties all of which follow by straightforward structural induction. First (for convenience) we restate the isomorphism properties.

Lemma 3.2.7 Let Γ ⊢_{I} σ and Δ ⊢_{I} τ.

i. If co_{Γ,Δ} is defined so is co_{Γ,Δ}^{−1} and the two constitute a propositional isomorphism between Γ and Δ.

ii. If ty_{Γ,Δ,σ,τ} is defined so are co_{Γ,Δ} and ty_{Γ,Δ,σ,τ}^{−1} and Γ ⊢_{I} (ty_{Γ,Δ,σ,τ}, ty_{Γ,Δ,σ,τ}^{−1}) : σ ≅ τ[co_{Γ,Δ}].

Chapter 3. Syntactic properties of propositional equality 102 Next we state that definedness of the propositional isomorphisms induces an equivalence relation on contexts and on types. Lemma 3.2.8 i. If ⊢_{I} Γ then co_{Γ,Γ} is defined and γ: Γ ⊢_{I} Id_{Γ}(γ, co_{Γ,Γ}[γ]) true.

ii. If Γ ⊢_{I} σ then ty_{Γ,Γ,σ,σ} is defined and Γ, x: σ ⊢_{I} Id_{σ}(x, ty_{Γ,Γ,σ,σ}[x]) true. iii. If co_{Γ,Δ} is defined then so is co_{Δ,Γ}. iv. If ty_{Γ,Δ,σ,τ} is defined then so is ty_{Δ,Γ,τ,σ}. v. If co_{Γ,Δ} and co_{Δ,Θ} are both defined then so is co_{Γ,Θ} and

γ: Γ ⊢_{I} Id_{Θ}(co_{Δ,Θ}[co_{Γ,Δ}[γ]] , co_{Γ,Θ}[γ]) true

vi. If ty_{Γ,Δ,ρ,σ} and ty_{Δ,Θ,σ,τ} are both defined then so is

ty_{Γ,Θ,ρ,τ} and

γ: Γ, x: ρ ⊢_{I} Id_{τ[co_{Γ,Θ}]}(
Subst_{Θ,τ}(P, ty_{Δ,Θ,σ,τ}[co_{Γ,Δ}[γ], ty_{Γ,Δ,ρ,σ}[γ, x]]) ,
ty_{Γ,Θ,ρ,τ}[γ, x]) true

for every

γ: Γ ⊢_{I} P : Id_{Θ}(co_{Δ,Θ}[co_{Γ,Δ}[γ]] , co_{Γ,Θ}[γ]) true

We also need that the propositional isomorphisms are stable under definitional equality and under syntactic substitution. Lemma 3.2.9 i. If ⊢_{I} Γ = Γ′ and ⊢_{I} Δ = Δ′ then if co_{Γ,Δ} is defined so is

co_{Γ′,Δ′} and

γ: Γ ⊢_{I} Id_{Δ}(co_{Γ,Δ}[γ], co_{Γ′,Δ′}) true

ii. If ⊢_{I} Γ = Γ′ and ⊢_{I} Δ = Δ′ and Γ ⊢_{I} σ = σ′ and Δ ⊢_{I} τ = τ′ then if ty_{Γ,Δ,σ,τ}

is defined so is ty_{Γ′,Δ′,σ′,τ′} and

γ: Γ, x: σ ⊢_{I} Id_{τ}(Subst_{Δ,τ}(P, ty_{Γ,Δ,σ,τ}[γ, x]) , ty_{Γ′,Δ′,σ′,τ′}[γ, x]) true for every γ: Γ ⊢_{I} P : Id_{Δ}(co_{Γ,Δ}, co_{Γ′,Δ′}).

Lemma 3.2.10 Suppose that ty_{Γ,Δ,σ,τ} is defined and that Γ′ ⊢_{I} f ⇒ Γ and Δ′ ⊢_{I} g ⇒ Δ are syntactic context morphisms satisfying

Γ′ ⊢_{I} Id_{Δ}(co_{Γ,Δ} ∘ f , g ∘ co_{Γ′,Δ′}) true

so in particular co_{Γ′,Δ′} defined, then ty_{Γ′,Δ′,σ[f],τ[g]} is defined and

γ′: Γ′, x: σ[f] ⊢_{I} Id_{τ[g ∘ co_{Γ′,Δ′}]}(ty_{Γ′,Δ′,σ[f],τ[g]}[γ′, x] , ty_{Γ,Δ,σ,τ}[f[γ′], x]) true

The relationship to extensional type theory is described by the following lemma.

Lemma 3.2.11 i. If co_{Γ,Δ} is defined then ⊢_{E} |Γ| = |Δ| and γ: |Γ| ⊢_{E} γ = |co_{Γ,Δ}|[γ] : |Γ|.

ii. If ty_{Γ,Δ,σ,τ} is defined then |Γ| ⊢_{E} |σ| = |τ| and

γ: |Γ|, x: |σ| ⊢_{E} x = |ty_{Γ,Δ,σ,τ}|[γ, x] : |σ|

3.2.5.3 A model for TT_{E}

We come to the construction of a model for TT_{E} by quotienting the term model of TT_{I}. We write ∼ for an equivalence relation determined by the (linguistic) context and [−] for equivalence classes.

Definition 3.2.12 The category C has as objects equivalence classes of contexts ⊢_{I} Γ where Γ and Δ are considered equivalent if co_{Γ,Δ} is defined (this forms an equivalence relation by Lemma 3.2.8). A morphism between [Γ] and [Δ] is an equivalence class of triples (A, B, f) where A ∈ [Γ], B ∈ [Δ], and A ⊢_{I} f ⇒ B. Two such triples (A, B, f) and (A′, B′, f′) are equivalent if co_{A,A′} and co_{B,B′} are defined and

α: A ⊢_{I} Id_{B′}(co_{B,B′}[f[α]] , f′[co_{A,A′}[α]]) true

Again, it follows from Lemma 3.2.8 together with properties of Id that this defines an equivalence relation. The identity morphism on [Γ] is given by [(Γ, Γ, γ: Γ ⊢_{I} γ ⇒ Γ)]. The composition of [(B′, Ξ, g)] : [Δ] → [Θ] and [(A, B, f)] : [Γ] → [Δ] is given by [(A, Ξ, α: A ⊢_{I} g[co_{B,B′}[f[α]]] : Ξ)]. Observe that co_{B,B′} is defined by Lemma 3.2.8.

Proposition 3.2.13 C is a category with terminal object [⋄].

Proof. First we check that homsets, identities, and composition are well-defined, i.e. independent of the choice of representatives. For the homsets this is obvious, the case of identities is an instance of reflexivity. For composition we consider the diagram

[figure: A; f; B; co; B′; g; Ξ]

[figure: A_{1}; co; f_{1}; B_{1}; co; co; B′_{1}; co; g_{1}; Ξ_{1}; co]

If the two outer squares commute up to propositional equality, i.e. if (A, B, f) ∼ (A_{1}, B_{1}, f_{1}) and (B′, Ξ, g) ∼ (B′_{1}, Ξ_{1}, g_{1}), then the whole rectangle commutes up to propositional equality because the inner square does by Lemma 3.2.8. It is obvious that identities are neutral. For associativity of composition assume A ⊢_{I} f ⇒ B, B′ ⊢_{I} g ⇒ Ξ, Ξ′ ⊢_{I} h ⇒ Θ. A common representative for both ways of composing the triple is given by

α: A ⊢_{I} h[co_{Ξ,Ξ′}[g[co_{B,B′}[f[α]]]]] : Θ

Finally, the obviously unique morphism from [Γ] to [⋄] is given by [(Γ, ⋄, ())]. □

Definition 3.2.14 (The model Q) A syntactic category with attributes Q over the category C is defined as follows: Let [Γ] ∈ Ob(C). A family over [Γ] is an equivalence class of pairs (Δ, σ) with Δ ⊢_{I} σ, where two such pairs (Δ, σ) and (Δ′, σ′) are considered equivalent if ty_{Δ,Δ′,σ,σ′} is defined. The set of families is denoted Fam([Γ]).

If [(Δ, σ)] ∈ Fam([Γ]) then the morphism p([(Δ, σ)]) : [Γ] · [Δ, σ] → [Γ] is represented by

[((Δ, x: σ) , Γ , δ: Δ, x: σ ⊢_{I} co_{Δ,Γ}[δ : Γ])]

If [(A, B, f)] : [Θ] → [Γ] then the substitution [(Δ, σ)]{[(A, B, f)]} is represented by (A , (α: A ⊢_{I} σ[co_{B,Δ}[f[α]]])). The morphism q([(A, B, f)], [(Δ, σ)]) is represented by

((A, x: σ[co_{B,Δ} ∘ f]) , (Δ, x: σ) ,
α: A, x: σ[co_{B,Δ} ∘ f] ⊢_{I} (co_{B,Δ} ∘ f, x) : (Δ, x: σ))

A section of [(Δ, σ)] is an equivalence class of triples (Θ, τ, M) with (Θ, τ) ∼ (Δ, σ) and Θ ⊢_{I} M : τ, where two such triples (Θ, τ, M) and (Θ′, τ′, M′) are equivalent if

ϑ: Θ ⊢_{I} Id_{τ′}(ty_{Θ,Θ′,τ,τ′}[ϑ, M] , M′[co_{Θ,Θ′}[ϑ]]) true

If [(Θ, τ, M)] is a section of Sect([(Δ, σ)]) then a morphism \overline{[(Θ, τ, M)]} : [Γ] → [Γ] · [(Δ, σ)] is represented by

\begin{matrix}(Θ , (Θ, x: τ) , \\ ϑ: Θ ⊢_{I} (ϑ, M) : (Θ, x: τ)) \end{matrix}

Conversely, if [(A, B, f)] : [Γ] → [Γ] · [(Δ, σ)] then we must have B ≡ B′, x: ρ since equivalent contexts have equal lengths. Thus f ≡ (f′, M) for B ⊢_{I} M : ρ[f′]. We put Hd([(A, B, f)]) := [(B, σ[f′], M)].

Proposition 3.2.15 Q is a syntactic category with attributes.

Proof. Routine verification. As an example we check that substitution in families is well-defined and commutes with composition. Suppose that g = [(B′, Ξ, g)] : [Δ] → [Θ] and σ = [(Ω, σ)] ∈ Fam([Θ]). We have

σ{g} = [(B′, σ[co_{Ξ,Ω} ∘ g])]

Now let (Ω′, σ′) ∼ (Ω, σ) be another representative for σ. We must show that

(B′, σ[co_{Ξ,Ω} ∘ g]) ∼ (B′, σ′[co_{Ξ,Ω′} ∘ g])

By definition this is equivalent to ty_{B′,B′,σ[co_{Ξ,Ω} ∘ f],σ′[co_{Ξ,Ω′} ∘ f]} being defined. By Lemma 3.2.10 this holds if ty_{Ω,Ω′,σ,σ′} is defined and

β′: B′ ⊢_{I} Id_{Ω′}(co_{Ω,Ω′} ∘ co_{Ξ,Ω} ∘ g , co_{Ω′,Ξ} ∘ g ∘ co_{B′,B′}) true

The former follows from the assumption (Ω′, σ′) ∼ (Ω, σ); the latter follows by equality reasoning from Lemma 3.2.8.

Now suppose that (B′′, Ξ′, g′) ∼ (B′, Ξ, g) is another representative for g. We must show that ty_{B′,B′′,σ[co_{Ξ,Ω} ∘ g],σ[co_{Ξ′,Ω} ∘ g′]} is defined. Using Lemmas 3.2.8 and 3.2.10 this boils down to

B′ ⊢_{I} Id_{Ω}(co_{Ω,Ω} ∘ co_{Ξ,Ω} ∘ g , co_{Ξ′,Ω} ∘ g′ ∘ coB′, B′′) true

Using the fact that Id respects composition and using Lemma 3.2.8 this follows from

B′ ⊢_{I} Id_{Ξ′}(co_{Ξ,Ξ′} ∘ g , g′ ∘ coB′, B′′) true

which is the definition of (B′′, Ξ′, g′) ∼ (B′, Ξ, g).

For compatibility with composition assume in addition that f = [(A, B, f)] : [Γ] → [Δ] and σ = [(Ω, σ)] ∈ Fam([Θ]). We have g ∘ f = [(A, Ξ, g ∘ co_{B,B′} ∘ f)] and thus

σ{g ∘ f} = [(A, σ[co_{Ξ,Ω} ∘ g ∘ co_{B,B′} ∘ f])]

which equals σ{g}{f} as required. □

Proposition 3.2.16 The stripping map | − | from TT_{I} to TT_{E} lifts to a structure preserving map from Q to the term model of TT_{E} (constructed according to Ex. 2.4.2) defined by |[Γ]| = |Γ|, |[(Γ, σ)]| = |σ|, and |[(Γ, σ, M)]| = |M|

Proof. Immediate from Lemma 3.2.11 (for contexts and types) and rule DefEq and the definition of stripping (for context morphisms and terms). □

Proposition 3.2.17 The model Q supports Π-types, Σ-types, natural numbers, and extensional identity types, and these are preserved by | − |.

Proof. Let σ = [(Γ, σ)] ∈ Fam(Γ) and τ = [(Γ′, x: σ′) , τ] ∈ Fam(Γ · σ). We represent Π(σ, τ) ∈ Fam(Γ) by

γ: Γ ⊢_{I} Πx: σ.τ[co_{Γ,Γ′}[γ], ty_{Γ,Γ′,σ,σ′}[γ, x]]

It follows from the definition of ty for Π-types that this is well-defined.

If M = [((Γ′′, x: σ′′) , τ′ , M)] ∈ Sect(τ) we represent its abstraction λ_{σ,τ} (M) ∈ Sect(Π(σ, τ)) by

γ′′: Γ′′ ⊢_{I} λx: σ′′.M : Πx: σ′′.τ′

This is indeed a section of Π(σ, τ) because ty_{Γ,Γ′′,Πx:σ.τ[co_{Γ,Γ′}],ty_{Γ,Γ′,σ,σ′},Πx:σ′′.τ′} is defined by assumption and the definition of ty for Π-types. For well-definedness we use again the definition of ty for Π-types.

Now let M = [(Γ′′, Πx: σ′′.τ′, M)] ∈ Sect(Π(σ, τ)) (observe that the type of M must be a dependent product) and N = [(Γ′′′, σ′′′, N)] ∈ Sect(σ). The application App_{σ_{,}τ} (M, N) ∈ Sect(τ \{\overline{N}\}) is represented by

γ′′′: Γ′′′ ⊢_{I} M ty_{Γ′′′,Γ′′,σ′′′,σ′′}[γ′′′, N] : τ′[ty_{Γ′′′,Γ′′,σ′′′,σ′′}[γ′′′, N]]

Now the required equations are readily checked, and since the Π-type and its associated term formers are modelled by their syntactic companions interspersed with canonical isomorphisms, it follows that stripping preserves the dependent product structure because the canonical isomorphisms are mapped to identities by Lemma 3.2.11.

For the identity type assume σ = [(Γ, σ)] ∈ Fam(Γ) and M = [(Γ′, σ′, M)] ∈ Sect(σ) and N = [(Γ′′, σ′′, M)] ∈ Sect(σ). We represent the identity type Idσ(M, N) ∈ Fam(Γ) by

γ′: Γ′ ⊢_{I} Id_{σ′′}(ty_{Γ′,Γ′′,σ′,σ′′}[γ′, M] , N[co_{Γ′,Γ′′}])

Now if this family has a section then M = N by definition of equality on sections and any two sections of this family are equal by IdUni and the definition of equality on sections.

We follow the same pattern for Σ-types and natural numbers. □

Proof of Theorem 3.2.5. Consider the following informal diagram of interpretations

Q

[figure: [[−]]; [−]; [[−]]; | − |]
TT_{I}  \overline{| − |  ^{}}TT_{E}

Here TT_{I} and TT_{E} denote the term models associated to the type theories TT_{I} and TT_{E}. The informal map [[−]] : TT_{I} → Q denotes the interpretation of TT_{I} in Q which being a model for TT_{E} also is a model for TT_{I}. The mapping | − | : Q → TT_{E} is the lifting of | − | : TT_{I} → TT_{E} given by Prop. 3.2.16. Finally, [−] : TT_{I} → Q is the canonical mapping associating equivalence classes, which is structure preserving by definition of Q.

These maps preserve all the type and term formers up to semantic equality; thus, by induction on derivations or more elegantly by an initiality argument^{2} we find that any two paths in this diagram with common source and target and starting from either TT_{I} or TT_{E} are equal. In more elementary terms this gives in particular the following identities:

i. If Γ ⊢_{I} then [Γ] = [[|Γ|]] in Q.

ii. If Γ ⊢_{I} σ then [(Γ, σ)] = [[|Γ| | |σ|]] in Q.

iii. If Γ ⊢_{I} M : σ then [(Γ, σ, M)] = [[|Γ| | |M|]] in Q.

iv. If Γ ⊢_{E} then ⊢_{E} |[[Γ]]| = Γ.

v. If Γ ⊢_{E} σ then Γ ⊢_{E} |[[Γ | σ]]| = σ.

2We cannot properly formulate initiality of TT_{I} and TT_{E} since we have not defined morphisms of models. See however Remark 2.5.8

vi. If Γ ⊢_{E} M : σ then Γ ⊢_{E} |[[Γ | M]]| = M : σ.

Now suppose that Γ ⊢_{I} σ and |Γ| ⊢_{E} M : |σ|. The interpretation yields

[[|Γ| | M]] ∈ Sect([[|Γ| | |σ|]])

Thus Sect([(Γ, σ)]) ≠ ∅ by Eqn. ii. By definition of Q this means that there exist Γ′, σ′, M′ with Γ′ ⊢_{I} P′ : σ′ and co_{Γ,Γ′} and ty_{Γ,Γ′,σ,σ′} are defined. Therefore we have

γ: Γ ⊢_{I} ty_{Γ,Γ′,σ,σ′}^{−1}[γ, M′[co_{Γ,Γ′}[γ]]] : σ

and therefore Γ ⊢_{I} σ true. Call this term M′′, i.e. Γ ⊢ M′′ : σ. By definition of Q we have (Γ, σ, M′′) ∈ [[|Γ| | M]] and thus |Γ| ⊢_{E} |M′′| = M : |σ| by Eqn. vi. □

3.2.6 Discussion and extensions

The relative complexity and clumsiness of the present proof is regrettable and it is our hope that in the near future a shorter and more elegant proof will be found. Notice, however, that the described method is fairly robust w.r.t. extensions of the type theory. For it to be extensible to a new type former it is enough that this type former admits an action on propositional isomorphisms. To demonstrate this we consider the addition of quotient types and of a universe closed under Π-types and natural numbers below.

A possible point of criticism is the non-constructive nature of the proof. Not only has the axiom of choice been used in the definition of the canonical isomorphisms co and ty; more seriously the interpretation of TT_{E} in Q associates equivalence classes to contexts, types, and terms. In order to get an inhabitant of type σ in the proof above we must arbitrarily choose a representative of the corresponding class. So the present proof does not directly give rise to an algorithm which effectively computes an inhabitant of σ in TT_{I} from a derivation of |σ| true in TT_{E}. Such algorithm trivially exists by Markov’s principle: we simply try out all possible terms and derivations and from the non-constructive proof of existence we know that this search always succeeds. But of course one would like a more efficient algorithm which makes use of the derivation in TT_{E}. It is, however, not clear whether the described argument gives rise to such an algorithm. An idea would be to carry out the construction of Q in a setoid model similar to the ones described in Chapter 5, where quotients come with a canonical choice of representatives. In the present framework of a set-theoretic presentation of syntactic categories with attributes this is, however, not possible.

Definitional equality has played a minor role in the present proof and it appears that the whole development goes through if TT_{I} was replaced by a type theory without definitional equality at all and rules like β replaced by corresponding constants of identity types in the style of IdUni. The construction of the model Q would remain unchanged since propositionally equal objects are identified in Q.

3.2.6.1 Quotient types

The Nuprl version [31] of TT_{E} contains a quotient type former governed by the following rules.

\frac{Γ ⊢ σ Γ , x, x′: σ ⊢ ρ[x, x′]}{Γ ⊢ σ/ρ} Q-E-Form \frac{Γ ⊢ M: σ Γ ⊢ σ/ρ}{Γ ⊢ [M]_{ρ}: σ/ρ} Q-E-Intro

\frac{Γ ⊢ M, N : σ Γ ⊢ H : ρ[M, N]}{Γ ⊢ [M]_{ρ} = [N]_{ρ} : σ/ρ} Q-E-Eq

\frac{\begin{matrix}Γ, x: σ/ρ ⊢ τ[x] Γ, x: σ ⊢ M[x] : τ[[x]_{ρ}] \\ Γ , x, x′: σ , p: ρ[x, x′] ⊢ M[x] = M[x′] : τ[[x′]_{ρ}] \\ Γ ⊢ N : σ/ρ \end{matrix}}{Γ ⊢ plug_{ρ} N in M : τ[N]} Q-E-Elim
\overline{Γ ⊢ plug_{ρ} [N]_{ρ} in M = M[N] : τ[[N]_{ρ}]} Q-E-Comp

Here ρ is viewed as a binary relation on σ and the idea is that σ/ρ is the type of equivalence classes of the least equivalence relation on σ containing ρ. The operator [−]_{ρ} associates an equivalence class to an element of σ. The rule Q-E-Eq states that equivalence classes of ρ-related elements are equal in σ/ρ. Notice that this rule introduces an information loss in a way similar to Id-DefEq—upon its application the proof H is lost. The lifting operator “plug_{ρ} − in −” permits one to define functions on the quotient type as usual in mathematical practice by defining it on representatives and proving independence of the particular representative chosen. Notice that Q-E-Eq is required for Q-E-Elim to make sense. Finally, the rule Q-E-Comp states intuitively that the underlying algorithm of a lifted function is the function itself.

A version of quotient types for TT_{I} has to replace the conclusion of Q-E-Eq by a propositional equality and include instances of Subst in order to make rule Q-E-Elim typecheck. Formally, we extend TT_{I} by the following rules for intensional quotient types.

\frac{Γ ⊢ σ Γ , x, x′: σ ⊢ ρ[x, x′]}{Γ ⊢ σ/ρ} Q-I-Form \frac{Γ ⊢ M: σ Γ ⊢ σ/ρ}{Γ ⊢ [M]_{ρ}: σ/ρ} Q-I-Intro

\frac{Γ ⊢ M, N : σ Γ ⊢ H : ρ[M, N]}{Γ ⊢ Qax_{ρ}(H) : Id_{σ/ρ}([M]_{ρ}, [N]_{ρ})} Q-I-Ax

\frac{Γ, x: σ/ρ ⊢ τ[x] Γ, x: σ ⊢ M[x] : τ[[x]_{ρ}] Γ , x, x′: σ , p: ρ[x, x′] ⊢ H : Id_{τ[[x′]_{ρ}]}(Subst_{σ/ρ,τ}(Qax_{ρ}(p), M[x]) , M[x′]) Γ ⊢ N : σ/ρ}{Γ ⊢ plug_{ρ} N in M using H : τ[N]} Q-I-Elim
Γ ⊢ plug_{ρ} [N]_{ρ} in M using H = M[N] : τ[[N]_{ρ}]

Q-I-Comp

Let TT_{EQ}, TT_{IQ} refer to the respective extensions of TT_{E} and TT_{I} with quotient types and let ⊢_{EQ}, ⊢_{IQ} denote the corresponding judgement relations.

We notice that, like Ext, the term former Qax introduces non-canonical elements in the identity type and thus in all types. In Chapter 5 we study models^{3} which induce further equations for Qax so that these non-canonical elements disappear, but for now TT_{IQ} is any extension of TT_{I} supporting the rules for quotient types. So in particular this may be one of the type theories to be studied in Chapter 5 or it may be a simple addition of the rules for quotient types to TT_{I} where we ignore the problem with non-canonical elements.

3In the first of these models (Sect. 5.1) Q-I-Form is restricted to relations ρ of the form Prf(R) for some Γ , x, x′: σ ⊢ R : Prop, and Q-I-Elim is split into a non-dependent elimination rule and an induction axiom.

Let us now study the relationship between TT_{IQ} and TT_{EQ}. The interpretation | − | of TT_{I} in TT_{E} extends to quotient types by setting |Qax_{ρ}(H)| := Refl_{|σ|/|ρ|}(|[M]_{R}|) where Γ ⊢_{I} H : ρ[M, N], and homomorphically extending to the other type and term formers. E.g. |σ/ρ| := |σ|/|ρ|. Now again Prop. 3.2.2 continues to hold, i.e. if Γ ⊢_{IQ} J then |Γ| ⊢_{EQ} |J|. Moreover, if TT_{ℜQ} and ⊢_{ℜQ} denote the extension of TT_{IQ} by ℜ as in Sect. 3.2.4, we obtain an analogue of Thm. 3.2.4, i.e. if Γ ⊢_{EQ} J then Γ′ ⊢_{ℜQ} J′ for some Γ′, J′ with |Γ′| ≡ Γ and |J′| ≡ J. Here the only new nontrivial case arises from rule Q-E-Eq. In order to mimic this in TT_{ℜQ} we have to use Q-I-Ax and an instance of ℜ.

More interestingly, TT_{EQ} is again conservative over TT_{IQ} with respect to type inhabitation.

Theorem 3.2.18 If Γ ⊢_{IQ} σ and |Γ| ⊢_{EQ} P : |σ| for some P then there exists P′ such that Γ ⊢_{IQ} P′ : σ.

Proof. The proof follows the same pattern as the proof of Thm. 3.2.5. First, we extend the definition of the ty-isomorphisms as follows: Assume Γ ⊢_{IQ} σ/ρ and Δ ⊢_{IQ} τ/φ. In this context we put U[x: σ] := ty_{Γ,Δ,σ,τ}[γ, x] : τ[co_{Γ,Δ}[γ]]. Now, in the context γ: Γ , x, x′: σ, p: ρ[x, x′] we put

V := ty_{Γ,x,x′:σ,Δ,y,y′:τ,ρ,φ}[γ, x, x′ , p] : φ[co_{Γ,Δ}[γ] , ty_{Γ,Δ,σ,τ}[γ, x] , ty_{Γ,Δ,σ,τ}[γ, x′]]

and therefore we have

γ: Γ, x, x′: σ , p: ρ[x, x′] ⊢_{IQ} V : φ[co_{Γ,Δ}[γ] , U[x] , U[x′]]

and hence

γ: Γ, x, x′: σ , p: ρ[x, x′] ⊢_{IQ} Qax_{φ}(V)[co_{Γ,Δ}[γ]] : Id([U[x]]_{φ} , [U[x′]]_{φ})

Therefore we may use rule Q-I-Elim and conclude

γ: Γ, q: σ/ρ ⊢_{IQ} plug_{ρ} q in [U]_{φ} using V : (τ/φ)[co_{Γ,Δ}]

If all the participating isomorphisms were defined we make this term the value of ty_{Γ,Δ,σ/ρ,τ/φ}. The inverse is defined analogously.

Next we must show that Lemmas 3.2.7–3.2.11 carry over to this extension. The proofs are difficult to write down, but are essentially straightforward. As an example we show Part ii of Lemma 3.2.8. In the situation Γ ⊢_{IQ} σ/ρ we must establish

γ: Γ, q: σ/ρ ⊢_{IQ} Id(q, ty_{Γ,Γ,σ/ρ,σ/ρ}[γ, q]) true

After expanding the definitions and simplifying by using the Lemma inductively for σ and ρ, this boils down to the following property which may be compared to the (η)-rule for quotients in simple type theory [54].

Lemma 3.2.19 If Γ ⊢_{IQ} σ/ρ then

Γ, q: σ/ρ ⊢_{IQ}

Id_{σ/ρ}(plug_{ρ} q in [x: σ][x]_{ρ} using [x, x′: σ, p: ρ[x, x′]]Qax_{ρ}(p) , q) true

holds. In other words the lifting of the projection [ −]_{φ} equals the identity.

Proof of Lemma. Let

τ[γ: Γ, q: σ/ρ] :=

Id_{σ/ρ}(plug_{ρ} q in [x: σ][x]_{ρ} using [x, x′: σ, p: ρ[x, x′]]Qax_{ρ}(p) , q)

By rule Q-I-Comp we have

γ: Γ , x: σ ⊢_{IQ} Refl_{σ/ρ}([x]_{ρ}) : τ[[x]_{ρ}]

Moreover, since τ is an identity type, we have

γ: Γ , x, x′: σ , p: ρ[x, x′] ⊢_{IQ}

H : Id_{τ[x′]}(Subst_{σ/ρ,τ}(Qax_{ρ}(p), Refl_{σ/ρ}([x]_{ρ})) , Refl_{σ/ρ}([x′]_{ρ}))

for H := IdUni_{τ[x′]}(Subst_{σ/ρ,τ}(Qax_{ρ}(p), Refl_{σ/ρ}([x]_{ρ}))). (In fact, this identity may also be proved using J alone.) Therefore, we may conclude

γ: Γ, q: σ/ρ ⊢_{IQ} plug_{ρ} q in [x: σ]Refl_{σ/ρ}([x]_{ρ}) using H : τ[q]

as required. □

Having defined the canonical isomorphisms co and ty for TT_{IQ} we construct a model Q from TT_{IQ} in exactly the same way as in the proof of Thm. 3.2.5. In order to get an interpretation of TT_{EQ} in this model we must show that it supports the rules for quotient types from TT_{EQ}. Suppose that σ ∈ Fam(Γ) and ρ = [(Γ, x: σ, x′: σ′ , ρ)] ∈ Fam(Γ · σ · σ^{+}). Recall that this means Γ, x: σ, x′: σ′ ⊢_{IQ} ρ and that ty_{Γ,Γ,σ,σ′} is defined and that both (Γ, σ) and (Γ, σ′) are representatives for σ. We define the interpretation of the quotient type as the following family over Γ:

σ/ρ := [(Γ , σ/ρ′)]

where

ρ′ = [γ: Γ, x, x′: σ]ρ[x, ty_{Γ,Γ,σ,σ′}[γ, x′]]

If M = [(Γ′, σ′′, M)] ∈ Sect(σ) then we put

[M]ρ := [(Γ , σ/ρ′ , [γ: Γ][ty_{Γ,Γ′,σ,σ′′}^{−1}[γ, M[co_{Γ,Γ′}[γ]]]]_{ρ})]

which is a section of σ/ρ. If M, N ∈ Sect(σ) and H ∈ Sect(ρ{M^{+}}{N}) then by suitably composing with the ty-isomorphisms and using Q-I-Ax and the definition of equality for sections we obtain that [M]ρ = [N]ρ, i.e. rule Q-E-Eq is validated. We continue similarly for the remaining term formers and rules and then proceed as in the proof of Thm. 3.2.5. □

3.2.6.2 Universes

We consider an extension of both TT_{I} and TT_{E} by the rules for a universe closed under Π-types and natural numbers from Sect. 2.3.5. It is known that extending TT_{E} by universes allows non-normalising terms to be typed. For example, in the context Γ ≡ d: U , p: Id_{U}(d, Π̂(d, [x: d]d) we can derive the type equality

Γ ⊢_{E} D = D → D

for D := El(d) using rules Id-DefEq and U-Eq-Π and therefore we have the judgement

Γ ⊢_{E} (λx: D.x x) (λx: D.x x) : D

In TT_{I} we can only construct a propositional isomorphism between D and D → D using instances of Subst_{U,[x:U]El(x)}. This allows one to construct a term M such that |M| is non-normalising, but where M itself does not contain any redexes at all because the instances of Subst contain the variable p which prevents reduction.

Our aim is to show that the development in the previous sections goes through for this extension. Certainly, Thm. 3.2.4 characterising the extension of TT_{I} by the ℜ-operator continues to hold because we make the same extension to TT_{I} and TT_{E}. More importantly, Thm 3.2.5 establishing the conservativity of TT_{E} over TT_{I} as far as inhabitation of types is concerned, carries over as well.

Theorem 3.2.20 The extension of TT_{E} by a universe closed under Π and natural numbers is conservative over TT_{I} with the same extension in the sense of Thm. 3.2.5.

Proof. As in the case of quotient types we have to extend the definition of the ty-isomorphisms so as to account for the newly introduced types U and El(M). A certain complication arises from the fact that it is no longer the case that if Γ ⊢_{I} σ = τ then σ and τ share the same outermost type former because of the “non-logical” type equalities U-Eq-Π and U-Eq-N. We may introduce an additional clause for ty to account for this equality, but then in order to retain transitivity (Lemma 3.2.8) we must close up under composition of ty from the left and from the right. Then, however, ty is no longer uniquely defined and one would have to establish coherence up to propositional equality. To account for arbitrary non-logical type equalities this seems indeed to be the only possible way; in the particular case of a universe we can get away by treating types of the form El(M) separately.

We say that Γ ⊢_{I} σ is a small type if Γ ⊢_{I} σ = El(M) for some Γ ⊢_{I} M : U. Notice that in this case we must have either Γ ⊢_{I} σ = N or σ ≡ Πx_{1}: τ_{1}. · · · Πx_{k}: τ_{k}.El(N) for some k ≥ 0 and Γ, x_{1}: τ_{1}, ⋯ x_{k}: τ_{k} ⊢_{I} N : U and small τ_{1},…, τ_{k}. Now we introduce the following two clauses to deal with U and small types:

ty_{Γ,Δ,U,U}[γ: Γ, x: U] = \{ \begin{matrix}x, if co_{Γ,Δ} is defined \\ undefined otherwise \end{matrix}

and

ty_{Γ,Δ,σ,τ}[γ: Γ, x: σ] = Subst_{[x:U]El(x)}(P, x)

if there exist M, N, P with Γ ⊢_{I} σ = El(M) and Δ ⊢_{I} τ = El(N), i.e. σ and τ are small, and Γ ⊢_{I} P : Id_{U}(M, N[co_{Γ,Δ}]), and undefined otherwise. In the former case M, N, P are chosen arbitrarily. The inverses are defined analogously.

The clause for N in Sect. 3.2.5.2 is removed and the clause for Π-types in Sect. 3.2.5.2 is restricted to those cases which are not yet dealt with by the above clause for small types, i.e. ty_{Γ,Δ,Πx:σ_{1}.σ_{2},Πy:τ_{1}.τ_{2}} is defined by the clause given there only if Πx: σ_{1}.σ_{2} and Πx: τ_{1}.τ_{2} are not small.

Now it is easy to show that the auxiliary properties of these canonical isomorphisms continue to hold. Notice that if ty_{Γ,Δ,σ,τ} is defined and σ is small so is τ.

It remains to show that the model Q constructed from the extended syntax as in Def. 3.2.14 still supports Π-types, natural numbers, and a universe.

The type of natural numbers is given by N := [(Γ, N)]. We have [(Γ, N, 0)] ∈ Sect(N). If M = [(Δ, σ, M)] ∈ Sect(N) then we must have Δ ⊢_{I} σ = El(S) and Δ ⊢_{I} P : Id(S, N̂) for some P. Now we define

Suc(M) := [(Δ, N, Suc(Subst (P, M)))]

In a similar way we define R^{N} using pre-composition with instances of Subst_{U,El} where necessary.

For the Π-type we only need to consider the case Π(σ, τ) where both σ and τ are small since in all other cases we may proceed as in the proof of Prop. 3.2.17 above. So assume σ = [Γ, El(S)] and w.l.o.g. τ = [Γ, x: El(S) , El(T [x])]. We define Π(σ, τ) as [(Γ, El(Π̂(S, T)))]. That this is well-defined and also the definition of the associated combinators follow from the following Lemma which states that the ty-isomorphisms for Π-types remain essentially unchanged by the alteration for small types.

Lemma 3.2.21 Suppose that Γ ⊢_{I} S : U and Δ ⊢_{I} T : U and Γ, x: El(S) ⊢_{I} M : U and Δ, x: El(T) ⊢_{I} N : U and Γ ⊢_{I} P : Id(S, T [co_{Γ,Δ}]) and Γ, x: El(S) ⊢_{I} Q : Id(M, N[Subst (P, x)]), i.e. ty_{Γ,x:El(S),Δ,x:El(T),El(M),El(N)} is defined. Then

γ: Γ , u: Πx: El(S).El(M) ⊢_{I} Id(
ty′_{Γ,Δ,Πx:El(S).El(M),Πx:El(T).El(N)}[γ, x] ,
λx: τ[co_{Γ,Δ}].Subst_{U,El}(Q, u ty_{Γ,Δ,El(S),El(T)}^{−1}[γ, x])) true

where ty′ is the propositional isomorphism given by the (now overridden) clause of Sect. 3.2.5.2.

Proof of Lemma. Using Ext and elementary equality reasoning. □

We may now replace instances of ty at small Π-types by ty′ and proceed as in the proof of Prop. 3.2.17.

The universe and its externalisation are defined as the equivalence classes of U and El, respectively. The code N̂ in context [Γ] is given by [Γ, U, N̂]. Similarly, we define the code of Π as the lifting to equivalence classes of the syntactic term former Π̂. That this is well-defined is readily checked using Resp and Ext.

We conclude as in the Proof of Thm. 3.2.5. □

Remark 3.2.22 We believe that this result extends to an impredicative universe as defined in Sect. 2.3.4, but we have not been able to prove this because it is not clear how the ∀-operator lifts to equivalence classes. That is, if ty_{Γ,Δ,σ,τ} is defined and Γ, x: τ ⊢_{I} M : Prop then it is not obvious why one should have

Γ ⊢_{I} Id_{Prop}(∀x: σ.M[ty_{Γ,Δ,σ,τ}] , ∀x: τ.M) true

although this can probably be shown by induction on the structure of σ.

We also remark that the existence of a term M in TT_{I} such that |M| is nonnormalising, is now an immediate consequence of the conservativity theorem 3.2.5 extended to universes.

In Chapters 4 and 5 we also consider Prop-valued Leibniz equality as an implementation of propositional equality. In general, Leibniz equality is much weaker than the identity type in TT_{I} because substitution (Subst ) is possible only for “propositional” families of the form x: σ ⊢ Prf(P). Thus, the results reported in this chapter do not apply to Leibniz equality. However, the type theory S_{0} we consider in Chapter 5 has the unusual property that its Leibniz equality behaves like the identity type so that the results do carry over. In the deliverables model of Chapter 4 we could define an identity type which would coexist with Leibniz equality, but it would not be Prop-valued.

3.2.7 Conservativity of quotient types and functional extensionality

We have now studied in much detail the question of conservativity of TT_{E} over TT_{I}. Another important question is the conservativity of TT_{I} over pure type theory without extensional concepts added. Let TT_{p} denote the type theory without Ext but with IdUni , and let ⊢_{p} denote the corresponding judgement relation. Certainly, we cannot in general have that Γ ⊢_{p} σ and Γ ⊢_{I} σ true implies Γ ⊢ σ true because the type of Ext is valid in TT_{p}. However, we believe that the following holds.

Conjecture 3.2.23 If Γ ⊢_{p} σ and neither Γ nor σ contains instances of the Πtype then Γ ⊢_{I} σ true implies Γ ⊢_{p} σ true.

A possible proof of this would use one of the models to be presented in Chapter 5 and show that a Π-free type is (propositionally) isomorphic to its denotation in the model. We shall try to answer this question in future work. In [32, Sect. 4.4.2] such a conservativity result is proved for first-order predicate logic over simple type theory using a similar method, but the situation is much simpler there because one only has to consider bi-implication instead of isomorphism.

As shown in [101], uniqueness of identity is not conservative over type theory without it in any reasonable sense, because for example we have

x: σ , u, v: τ[x] ⊢_{I} Id_{Σx:σ.τ[x]}(pair(x, u), pair(x, v)) → Id_{τ[x]}(u, v) true

but this does not hold in the pure type theory with J alone. Probably one has conservativity for types not containing the identity type, but this is logically uninteresting.

Surprisingly, quotient types are not conservative over TT_{p} because in their presence a weak form of functional extensionality is derivable. Suppose that ⊢_{p} F, G : Πx: σ.τ and ⊢_{p} H : Πx: σ.Id_{τ}(F x, G x). We claim that

⊢_{IQ} Id_{Πx:σ.τ}(λx: σ.F x, λx: σ.G x) true

using quotient types, but of course without using functional extensionality. To get the conclusion of functional extensionality from this (in the sense of Sect. 3.1.3) an η-rule for Π-types would be required.

Define

ExtEq[u, v: Πx: σ.τ] := Πx: σ.Id_{τ}(u x, v x)

and consider the quotient type (Πx: σ.τ)/ExtEq. Now we have

x: σ, u: Πx: σ.τ ⊢ (u x) : τ[x]

and

x: σ , u, v: Πx: σ.τ , p: ExtEq[u, v] ⊢ p x : Id_{τ[x]}(u x, v x)

Thus we can “lift” application to the quotient type and get

x: σ, q: (Πx: σ.τ)/ExtEq ⊢_{IQ} plug_{ExtEq} q in [u: Πx: σ.τ]u x using [u, v: Πx: σ.τ , p: ExtEq[u, v]]p x : τ[x] and by abstracting from x: σ we obtain

q: (Πx: σ.τ)/ExtEq ⊢_{IQ}
λx: σ.plug_{ExtEq} q in [u: Πx: σ.τ]u x
using [u, v: Πx: σ.τ , p: ExtEq[u, v]]p x
: Πx: σ.τ

Call this function Extract, i.e.

q: (Πx: σ.τ)/ExtEq ⊢_{IQ} Extract[q] : Πx: σ.τ

Notice that by rule Q-I-Comp we have

f: Πx: σ.τ ⊢_{IQ} Extract[[f]_{ExtEq}] = λx: σ.f x : Πx: σ.τ

We have

Qax_{ExtEq}(H) : Id_{(Πx:σ.τ)/ExtEq}([F]_{ExtEq}, [G]_{ExtEq})

and therefore Id_{Πx:σ.τ}(λx: σ.F x, λx: σ.G x) true by Resp.

We do not know whether quotient types are conservative over extensional type theory (TT_{E}).

3.3 Related work

Astonishingly, the meta-theory of propositional equality, in particular in the context of intensional type theory, has attracted very little attention in the literature. In the standard reference [85] the intensional (TT_{I}) and the extensional (TT_{E}) versions of type theory are introduced and compared by way of example.

Streicher [101] was the first to see the need for uniqueness of identity as an additional principle for propositional equality in intensional type theory. He also realised that the complicated elimination rule J may be replaced by the Leibniz principle Subst and uniqueness of identity, if one is interested in the latter. In loc.cit. an η-rule for the identity type is introduced and it is shown that it entails equality reflection, i.e. the rule Id-DefEq. The η-rule is as follows: If x, y: σ , p: Id_{σ}(x, y) ⊢ M[x, y, p] : τ[x, y, p] then

x, y: σ , p: Id_{σ}(x, y) ⊢ J([x: σ]M[x, x, Refl(x)] , x, y , p) = M : τ[x, y, p]

Streicher’s work has been taken up in [37] and syntactic consequences of uniqueness of identity in the context of Pure Type Systems are studied.

Luo [65,67] studies a few meta-properties of propositional equality in the context of the Extended Calculus of Constructions. He discusses the so-called equality reflection principle which states that propositional and definitional equality agree in the empty context. This principle (not to be confused with the equality reflection rule Id-DefEq) is (in the absence of extensional concepts) an immediate consequence of normalisation. Luo also considers formulations of the Calculus of Constructions which have an identity type inside Prop and nevertheless allow elimination (Subst , J) over arbitrary families, not only propositional ones. He observes that these identity types and the definable Leibniz equality imply each other. However, as shown by Streicher in [101] this bi-implication only forms a retraction and not a propositional isomorphism between the two incarnations of propositional equality and so in particular it is not possible to define a J-like elimination rule (or equivalently uniqueness of identity) for Leibniz equality in this case.

Recently, Gabbay and de Queiroz [34] have looked at propositional equality in the context of labelled deductive systems. In their setting not only propositional equality but also definitional equality is witnessed by a proof term (“label”), written as a subscript to =, which in this case records instances of reflexivity, symmetry, transitivity, and of the congruence rules. They have the following introduction rule for identity types (given here in our notation):

\frac{Γ ⊢ M =_{s} N : σ}{Γ ⊢ Refl_{σ}(M, N, s) : Id_{σ}(M, N)}

and the elimination rule

\frac{Γ ⊢ τ  Γ , M =_{t} N: σ ⊢ L : τ  Γ ⊢ P : Id_{σ}(M, N)}{Γ ⊢ TEST(P, L) : τ}

where t is a variable that becomes bound in the TEST-expression. They claim that this elimination rule for propositional equality is simpler than Id-Elim-J, but they do not compare to the formulation with Subst and IdUni . It is difficult to give a satisfactory comparison between their system and TT_{I}, say, because the framework is very different; for example the hypothetical use of definitional equalities in the elimination rule is not possible in TT_{I} and in fact we consider it the raison d’être of propositional equality that it may be assumed hypothetically. We conjecture that one may give a translation between Gabbay and de Queiroz’ calculus and TT_{I} by mapping both annotated definitional equality and propositional equality to the identity type, but since their calculus is not given in a fully formal way it is hard to give more detail. As an application they give a proof of a constructive variant of Leisenring’s formula ∃x.∀y.P (x) ⇒ P (y), that is they show that the type (in our notation)

σ → Σx: σ.Πy: σ.Id_{σ}(x, y) → τ[x] → τ[y]

is inhabited. Obviously, an inhabitant may be constructed using Subst as well.

Extensional quotient types like the ones considered in Sect. 3.2.6.1 have been theoretically investigated by Mendler [79] who finds that they correspond to categorical coequalisers. See also the section on related work in Chapter 5.

The problem with the failure of strong normalisation in the presence of extensional identity types and universes (Sect. 3.2.6.2) has also been noticed in [41] where it is concluded that for this reason identity types cannot be used to describe sharing constraints in SML functors [80] and that sharing by parametrisation [12, 11] ought to be used instead. We believe that [41] was written in ignorance of the intensional identity type and that the latter provides a reasonable alternative to sharing by parametrisation. We leave this to further research.

Proof irrelevance and subset types

Our aim in this chapter is to present a syntactic model for the extensional concepts of proof-irrelevance and subset types. The model we give not only provides these concepts, but also relates two approaches to program development in Martin-Löf type theory [85] or the Extended Calculus of Constructions (ECC) [65]. Under the first one specifications and types are freely mixed using Σ-types. This methodology underlies a project for development of correct software at the University of Ulm [109]. It is also the most natural approach and is probably employed by most users of type systems like the ones under consideration.

In the second approach types and specifications are kept completely distinct. This way of using type theory has been studied systematically in McKinna’s thesis [75,13]. We consider both approaches in detail. For definiteness we work in the Calculus of Constructions extended with Σ-types and natural numbers which enables us to use the defined logical connectives and Leibniz equality (=^{L}). Much of the development to follow can also be carried out in Martin-Löf type theory replacing Leibniz equality by the identity type and the logical connectives by product, sum, etc..

4.1 The refinement approach

Let us start with an example. A type of even numbers can be formed as

Even := Σn: N.∃m: N.n =^{L} 2m

An element of type Even is thus a natural number together with a proof that it is even. More generally, a function with result type Even can be viewed as an N-valued function together with a proof that it only takes on even values. Such a function can thus be viewed as a “verified program”. For lack of a better name we call this methodology the refinement approach^{1}. There are basically two problems with this approach. First, the projection from a refined type such as Even to its underlying type of elements (here N) is in general not injective^{2}, for two elements of type Even may have the same underlying number, but two different proofs of evenness. More seriously, a function out of a refined type even into a base type like N may depend on the proof component. For example if f : Even → Even then f decomposes into

f_{1} : Πn: N.Prf(∃m: N.n =^{L} 2m) → N

and

f_{2} : Prf(∀n: N.∀p: ∃m: N.n =^{L} 2m.∃m′: N.(f_{1} n p) =^{L} 2m′)

So even in order to compute the underlying natural number of (f x) for some x : Even, both components of x are required. Even if by strong normalisation we know that (f x).1 eventually converts to a natural number, this computation may in principle require evaluation of the proof part of the argument, x.2. Hence one cannot honestly claim that f is a verified program; it is at most a computation which bears some extensional resemblance to an intended algorithm.

1In the terminology of Hayashi [43] Even is a refinement of N.

2If we formulate this example using the identity type instead of Leibniz equality and Σ instead of ∃, then we could prove using Prop. 3.1.1 and R^{Σ} that the projection is injective. However, for a predicate like [n: N]∃m, m′: N.n =^{L} m × m′ stating that n is composite this is not possible.

The situation is not quite as serious as it might appear, since one can show that computations of type N (and other basic inductive types) cannot really depend on proofs.

Proposition 4.1.1 Let ⋄ ⊢ P : Prop be a proposition in the empty context and p : Prf(P) ⊢ M : N be a term of type N containing a variable of type Prf(P). Then M is definitionally equal to a numeral, i.e. p : Prf(P) ⊢ M = Suc^{n}(0) for some n ∈ ω.

Proof. We give the proof for the Calculus of Constructions with natural numbers, but without Σ-types, i.e. the only type formers are N, Prop, Prf, Π. The extension with Σ-types and other inductive types is similar. We reason by induction on the length of the normal form of M. If M = 0 or M = Suc(M′) the result follows directly or from the IH. If M = R_{[x:N]N}^{N}(M_{z}, M_{s}, N) then by induction N is a numeral, thus M was not in normal form for it admits a reduction using Nat-Comp-Zero or Nat-Comp-Suc. Now assume that the normal form of M is of the form (M_{1} M_{2} … M_{n}) where M_{1} is not an application. If M_{1} is a variable then by assumption it would have to be p : Prf(P). But then for M to typecheck we would have to have

Prf(P) = Πx_{2}: σ_{2}…. Πx_{n}: σ_{n}.N

for suitable types σ_{2} … σ_{n}. But this is possible only if N = Prf(N̂) for some N̂ : Prop which is not the case.

On the other hand if

M_{1} = R_{[x:N]Πx_{2}:σ_{2}....Πx_{n}:σ_{n}.N}^{N}(M_{z}, M_{s}, N)

then again by induction we can assume that N is a numeral whereby M was not in normal form. This exhausts all possible cases for a normal form of M. □

We observe that the proof depended upon the fact that N is not a proposition and that M does not contain any free variables other than than p : Prf(P). Indeed, it is not necessarily the case that an open term of type N containing p is definitionally equal to a term not containing p. For example

M[p: Prf(P), x: N] :=
R_{[y:N]Prf(P)→N}^{N}(λf: Prf(P).0, λy: N.λf: Prf(P) → N.f , x) p

is in normal form. Now clearly every instance M[p, N] for some numeral N converts to 0, but M itself does not convert to 0. The reason is that the application to p cannot be moved inside the recursion operator.

Of course, using induction (R^{N}) we find p: Prf(P), x: N ⊢ Id_{N}(M[p, x] , 0) true.

4.2 The deliverables approach

In [75] and [13] another approach to program development is advocated under which a specification is a type σ together with a predicate P : σ → Prop and a function between two specifications (σ, P) and (σ′, P′) is a function f_{1} : σ → σ′ together with a “proof” f_{2} : Πa: σ.(P a) → P′ (f_{1} a). Such a pair (f_{1}, f_{2}) is called a deliverable for it corresponds to a program together with its verification. Thus a deliverable contains an actual algorithm (f_{1}) which does not depend on proof components; by forgetting the second component of a deliverable one gets rid of all computationally irrelevant information. In [75] various examples of program development in this framework have successfully been carried out.

What we consider a serious disadvantage of the deliverables approach is that the user has to do a lot of bookkeeping. He or she has to keep track of which proof corresponds to which program, probably by means of a suitable choice of identifiers. Also a lot of work has to be done twice. For example if two deliverables are composed one has to compose the function and proof parts separately. This problem was realised in loc.cit. too, and as a remedy it is shown there that specifications and deliverables form a semi-cartesian closed category whereby one may use categorical combinators like composition, abstraction, and application to obtain new deliverables from already constructed ones.

Our aim in this chapter is to extend this result substantially by showing how deliverables can be organised into a full-blown model of the Calculus of Constructions where specifications interpret types and deliverables interpret terms. Moreover, we shall see that in this model the underlying type of the specification interpreting a Σ-type Σx: σ.P x for some Prop-valued predicate P is the same as the underlying type of the specification interpreting σ. Thus type refinement using Σ-types over Prop-valued predicates only changes the predicate component, but leaves the underlying type unchanged. This means that we can basically use the refinement approach as an internal language for deliverables thereby unifying the advantages of the two approaches described above. Furthermore, we shall see that in the deliverables model the following type is inhabited

Γ ⊢ Πp, q : Prf(P).p =^{L} q

for any proposition Γ ⊢ P : Prop. Thus in the model the projection from a refined type to its underlying “algorithmic” type is provably injective.

4.3 The deliverables model

In this section we construct a syntactic category with attributes whose contexts and families are (modulo some syntactic clutter) pairs of types and Prop-valued predicates, whereas morphisms and thus terms are pairs consisting of an ordinary term of the underlying type and a proof that the predicates are respected. In this model we shall identify a family Prop which has as underlying type the type Prop and the trivial predicate [x: Prop]tt (recall that tt stands for the true proposition ∀P: Prop.Prf(P) → Prf(P)). If P : Prop and P′ is some proof that this trivial predicate is satisfied for P, i.e. P′ : Prf(tt), then we define a specification Prf(P, P′) with underlying type 1_{E} (extensional unit type) and predicate λx: 1_{E}.P. We shall see that with this choice we obtain a (loose) model of the Calculus of Constructions which meets the requirements set out in the previous section. Let us now describe the model in detail. We use the generic notations C, Fam, etc. to denote the entities in the deliverables model.

4.3.1 Contexts

Let Γ be a (syntactic) context. A propositional telescope over Γ is a telescope Δ w.r.t. Γ, i.e. Γ ⊢ Δ, such that all the types in Δ are of the form Prf(M) for some term M. In particular, the empty telescope is propositional.

A context of specifications is a pair (Γ, Δ) such that Γ is a valid (syntactic) context and Δ is a propositional telescope over Γ. For example the pair (⋄, ⋄) forms a context of specifications which is denoted ⊤. Another example is (x: N, y: N , p :

Prf(x + y =^{L} 5), q : Prf(x − y =^{L} 1)).

If (Γ, Δ) and (Γ′, Δ′) are contexts of specifications then a morphism (a deliverable) from the former to the latter is a pair (f, g) where f is a (syntactic) context morphism from Γ to Γ′, i.e. γ: Γ ⊢ f[γ] : Γ′, and g is an element of the telescope Δ′[f] over Γ, Δ, i.e.

γ: Γ, δ: Δ ⊢ g[γ, δ] : Δ′[f[γ]]

For example the pair (3, 2) forms the first component of a morphism from the empty context of specifications ⊤ to the example with natural numbers considered above. The second component would contain two instances of reflexivity.

It is obvious that the morphisms of contexts of specifications contain identities and are closed under component-wise composition so that they form a category. It is also clear that this category C has a terminal object, viz. ⊤ = (⋄, ⋄).

Notation. If Γ ∈ C is a context of specifications we denote by Γ_{set} its underlying type and by Γ_{pred} its second component, the propositional telescope over Γ_{set}. If f : Γ → Δ is a morphism of contexts of specifications we denote by f_{fun} its first component, the syntactic context morphism from Γ_{set} to Δ_{set}; we denote by f_{resp} the second component, the element Γ_{set}, Γ_{pred} ⊢ f_{resp} : Δ_{pred}[f_{fun}].

Equality of contexts of specifications and their morphisms is component-wise definitional equality.

4.3.2 Families of specifications

Let Γ be a context of specifications. A family of specifications over Γ is a pair (σ_{set}, σ_{pred}) where

Γ_{set} ⊢ σ_{set}

and

Γ_{set}, x : σ_{set} ⊢ σ_{pred} : Prop

for instance, if Γ_{set} = N and Γ_{pred}[n: N] = Even[n] then σ_{set}[m: Γ_{set}] = N and σ_{pred}[m: Γ_{set}, n: N] = (m =^{L} n) is a family of specifications.

The set of these families is denoted Fam(Γ). Equality of families of specifications is again point-wise definitional equality. If σ ∈ Fam(Γ) then we define the comprehension Γ · σ by

(Γ · σ)_{set} := Γ_{set}, x: σ_{set}
(Γ · σ)_{pred}[γ: Γ_{set}, x: σ_{set}] := Γ_{resp}[γ], p: Prf(σ_{pred}[γ, x])

The projection p(σ) is given by

p(σ)_{fun}[γ: Γ_{set}, x: σ_{set}] := γ
p(σ)_{resp}[γ: Γ_{set}, x: σ_{set} , p: Γ_{pred}[γ], q: Prf(σ_{pred}[γ, x])] := p

If f : B → Γ and σ ∈ Fam(Γ) we define the substitution of f in σ by

σ{f}_{set}[β: B_{set}] := σ_{set}[f_{fun}[β]]
σ{f}_{pred}[β: B_{set}, x: σ_{set}[f_{fun}[β]]] := σ_{pred}[f_{fun}[β], x]

We also define the morphism q(f, σ) by

q(f, σ)_{fun}[β: B_{set}, x: σ_{set}[f_{fun}[β]]] := (f[β], x)

q(f, σ)_{resp}[β: B_{set}, x: σ_{set}[f_{fun}[β]], p: B_{pred}[β], q: Prf(σ_{pred}[f_{fun}[β], x])] := (f_{resp}[p], q)

So the first components of all the definitions made follow exactly the term model (Ex. 2.4.2), whereas in the second component we carry through the proofs that the predicates are respected.

4.3.3 Sections of specifications (deliverables)

Let σ ∈ Fam(Γ). A section of σ is a pair (M_{fun}, M_{resp}) where

γ: Γ_{set} ⊢ M_{fun}[γ] : σ_{set}[γ]
γ: Γ_{set}, p: Γ_{pred}[γ] ⊢ M_{resp}[p] : Prf(σ_{pred}[M_{fun}[γ]])

A section M gives rise to a context morphism \overline{M} from Γ to Γ · σ by decreeing

\overline{M}_{fun}[γ: Γ_{set}] := (γ, M_{fun}[γ])
\overline{M}_{resp}[γ: Γ_{set}, p: Γ_{pred}[γ]] := (p, M_{resp}[γ, p])

As in the term model, composition with the projection p(σ) yields the identity.

If ((f, M) , (p, Q)) : Γ → Δ · σ is a morphism of contexts of specifications then from the definition of such morphisms we obtain that

(f, p) : Γ → Δ  γ: Γ_{set} ⊢ M : σ_{set}[f[γ]]
γ: Γ_{set}, r: Γ_{pred}[γ] ⊢ Q : Prf(σ_{pred}[f[γ], M[γ]])

and thus Hd((f, M) , (p, Q)) := (M, Q) is a section of σ{(f, p)}. By straightforward equality reasoning we now obtain:

Proposition 4.3.1 Contexts of specifications together with families of specifications and their sections form a syntactic category with attributes.

We call this model the deliverables model, or D for short. Proving properties about syntactic models like the above proposition is often elementary, but requires some bookkeeping effort due to the relatively complex syntax. It is therefore ideally suited for machine-supported reasoning. In the following we describe how the Lego system can be used for mechanised proof of such properties.

4.4 Model checking with Lego

Our definition of syntactic categories with attributes contains no conditional equations. This makes it particularly easy to verify the correctness of an instance of this definition by means of an implementation of type theory, e.g. Lego [68]. The idea is to code the structure using higher universes as a metalanguage. One problem is that Lego (or any other implementation of type theory) does not support contexts and telescopes, which means that we have to encode these using Σ-types. These encodings, however, are slightly weaker than actual telescopes for they do not have surjective pairing up to conversion. Therefore in order to check certain equations we have to perform certain η-expansions, i.e. replace x by (x.1, x.2). Since surjective pairing holds on the level of contexts, any equation which holds in Lego modulo such expansions does hold in the actual model. Also in Lego we encode meta-level pairs, like the ones occurring in the definition of contexts of specifications, as internal Σ-types. Again, η expansions may become necessary. These issues will become clear by way of example. In order to reduce redundancy we adopt a record notation for Lego which unfortunately is not (yet) implemented.^{3} For the syntax and the pragmatics of Lego we refer the reader to [68].

4.4.1 Records in Lego

The declaration

[R = <<l_{1}:S_{1},…,l_{n}:S_{n}>>]

expands to the following sequence of declarations.

[R = <l_{1}:S_{1}><l_{2}:S_{2}>…<l_{n−1}:S_{n−1}>S_{n}]  Σ-type

3In the meantime this situation has changed and records, albeit with a different syntax, are available in Lego.

[r:R] [l_{1} = r.1 : S_{1} ]  1st projection

[l_{2} = r.2.1 : S_{2} ]
...

[l_{n−1} = r \underbrace{.2.2. . . . .2}_{n − 2 times} .1]

[l_{n} = r \underbrace{.2.2. . . . .2}_{n − 1 times}]  nth projection

Discharge r;

[MkR[l_{1}:S_{1}]…[l_{n}:S_{n}] = (l_{1},…,l_{n}:R)]  tupling

So if [r:R] we can access its components by applying the defined projection functions, e.g. (l_{2} r) is the second component. Using Lego’s postfix notation for function application this expression may also be written as r.l_{2} which is more suggestive of the intended record semantics. The function MkR allows one to collect n items of the appropriate types to form an object of type R. The β-rule for the Σ-type (Σ-Comp) gives the equations

(MkR x_{1}...x_{n}).l_{i} == x_{i}

We now come to the actual implementation of the deliverables model in Lego.

4.4.2 Deliverables in Lego

The contexts of specifications are defined as elements of the following record type.

[CON = <<set:Type(0), pred:set->Prop>>]

So in Lego a context of specifications is just a type and a Prop-valued predicate on it. As we see below we then use the internal Σ-type instead of context extension for comprehension. The morphisms are defined analogously:

[MOR[G,D:CON] = <<fun:G.set->D.set,
                  resp:{g|G.set}(G.pred g)->(D.pred (fun g))>>]

The empty context must be defined using a unit type and a true proposition, i.e. we have

[Emp = MkCON unit ([x:unit]tt)]

where unit:Type(0) is an inductive type with sole constructor star:unit and tt is the proposition {X:Prop}X->X— the higher-order encoding of truth. We have a (not necessarily unique) morphism into Emp from any other context.

[bang[G:CON] = MkMOR G Emp ([ :G.set]star)
                     ([g:G.set][ :G.pred g][X:Prop][x:X]x)]

Thus in order to prove that the category of contexts of specifications has a terminal object the Lego encoding is of no use; we must look at its definition in terms of contexts and telescopes. We can, however, prove in Lego that morphisms admit an associative composition and identities.

[Id[G:CON] = MkMOR ([g:G.set]g) ([g:G.set][p:G.pred g]p)]
[Comp[G,D,T|CON][f:MOR D T][g:MOR G D] =
                MkMOR ([x:G.set]f.fun(g.fun x))
                      ([x:G.set][p:G.pred x]f.resp (g.resp p))]
Goal {G,D,T,X:CON}{f:MOR G D}{g:MOR D T}{h:MOR T X}
     Q (Comp (Comp h g) f) (Comp h (Comp g f));
Intros G D T X f g h;
Refine Q refl;
(*** QED ***)

We have formulated associativity in terms of propositional equality (Q). However, since we were able to prove it using reflexivity alone, we know that the two terms in question have identical normal forms and thus are definitionally equal as required. Alternatively, we can use Lego to calculate these normal forms and compare them by hand, but the use of propositional equality appears more economical. We see that Lego is used here only as a proof assistant. The full proof that deliverables form a syntactic category with attributes is done by hand.

The remaining definitions are as follows:

Chapter 4. Proof irrelevance and subset types 134

[FAM[G:CON] = <<set:G.set->Type(0), pred:{g|G.set}(set g)->Prop>>]
[SECT[G|CON][S:FAM G] =
     <<fun:{g:G.set}S.set g,
       resp:{g|G.set}(G.pred g) -> (S.pred (fun g))>>]

For simplicity we use the same name for the first components of contexts and of families. In the actual Lego implementation we have to choose a different name each time.

Context comprehension is defined using Σ-types and conjunction.

[Dot[G:CON][S:FAM G] =
    MkCON (<g:G.set>S.set g)
          ([x:<g:G.set>S.set g](G.pred x.1) /\ (S.pred x.2)]
[p[G|CON][S:FAM G] = MkMOR (Dot G S) G
                           ([x:(Dot G S).set]x.1)
                           ([x|(Dot G S).set][p:(Dot G S).pred x]fst p)
[Subst[G,D|CON][S:FAM D][f:MOR G D] =
               MkFAM G ([g:G.set]S.set
                     (f.fun g))
                     ([g|G.set][s:S.set (f.fun g)]S.pred s)]
[q[G,D|CON][f:MOR G D][S:FAM D] =
           MkMOR (Dot G (Subst S f)) (Dot D S)
                 ([x:(Dot G (Subst S f)).set](f.fun x.1,x.2)
                 ([x|(Dot G (Subst S f)).set]
                          [p:(Dot G (Subst f)).pred x]
                          (pair (f.resp (fst p)) (snd p)))]

We use conjunction in Lego (/\) to concatenate parts of a propositional telescope. Now we can use Lego to check for example coherence of substitution where in the case of the identity law we must make an η-expansion.

Goal {G|CON}{S:FAM G}Q (Subst S (Id G)) (MkFAM S.set S.pred);
Intros G S;Refine Q refl;
(*** QED ***)

Goal {B,G,D|CON}{f:MOR B G}{g:MOR G D}{S:FAM D}
     Q (Subst S (Comp g f)) (Subst (Subst S g) f);
intros;Refine Q refl;
(*** QED ***)

Since the η-expansion we made is an identity in the true deliverables model we can conclude that the equations we are able to prove in Lego do indeed hold in the actual model. But for example due to the deficiencies of the unit type as a surrogate for the empty context we cannot expect completeness.

4.5 Type formers in the model D

We have now set out the structure of the model, it remains to define various type constructors. In fact it seems that the deliverables model can be endowed with whatever features the original type theory has; we shall, however limit ourselves to Π- and Σ-types, the natural numbers, a universe, and of course the proof-irrelevant type of propositions.

4.5.1 Dependent products

Let Γ be a context of specifications and σ ∈ Fam(Γ) and τ ∈ Fam(Γ · σ). Their dependent product Π(σ, τ) ∈ Fam(Γ) is defined by

Π(σ, τ)_{set}[γ : Γ_{set}] = Πs: σ_{set}[γ].τ_{set}[γ, s]

Π(σ, τ)_{pred}[γ : Γ_{set}, f : Π(σ, τ)_{set}] = ∀s : σ_{set}[γ].σ_{pred}[γ, s] ⇒ τ_{pred}[γ, s, (f s)]

So the set-component of the dependent product is just the syntactic product over the set-components of σ and τ, and the associated predicate expresses that a function in this Π-type sends arguments meeting σ_{pred} to values meeting τ_{pred}.

The associated combinators are almost forced. If M ∈ Sect(τ) then λ_{σ,τ}(M) ∈ Sect(Π(σ, τ)) is defined by

λ_{σ,τ}(M)_{fun}[γ : Γ_{set}] = λs: σ_{set}[γ].M_{fun}[γ, s]

λ_{σ,τ}(M)_{resp}[γ : Γ_{set}, p: Γ_{pred}[γ]] = λs: σ_{set}[γ].λq: Prf(σ_{pred}[γ, s])M_{resp}[γ, s, p, q]

Similarly we define application for M ∈ Sect(Π(σ, τ)) and N ∈ Sect(σ).

App_{σ , τ}(M, N)_{fun}[γ: Γ_{set}] = M_{fun}[γ] N_{fun}[γ]
App_{σ , τ}(M, N)_{resp}[γ: Γ_{set}, p: Γ_{pred}[γ]] = M_{resp}[γ, p] (N_{fun}[γ]) (N_{resp}[γ, p])

Proposition 4.5.1 The above assignments determine dependent products in the deliverables model.

Proof. All the equations follow by simply rewriting the definitions. For compatibility with substitution one uses the fact that syntactic substitution commutes by definition with all type and term formers. The equations can also be checked automatically using Lego. □

4.5.2 Dependent sums

Let Γ be a context of specifications and σ ∈ Fam(Γ) and τ ∈ Fam(Γ · σ). Their dependent sum Σ(σ, τ) ∈ Fam(Γ) is defined by

Σ(σ, τ)_{set}[γ : Γ_{set}] = Σs: σ_{set}[γ].τ_{set}[γ, s]
Σ(σ, τ)_{pred}[γ : Γ_{set}, f : Σ(σ, τ)_{set}] =
R_{σ_{set},τ_{set},[f:Σx:σ_{set}.τ_{set}]Prop}^{Σ}
([x : σ_{set}, y : τ_{set}[x]]σ_{pred}[x] ∧ τ_{pred}[x, y] , f)

That is, Σ(σ, τ)_{pred} holds for a canonical element (x, y) if σ_{pred} holds for x and τ_{pred} holds for y and it is extended to arbitrary elements of Σ(σ, τ)_{set} using the Σ-elimination operator R^{Σ}. Alternatively, one could define Σ(σ, τ)_{pred} using a higher-order encoding or the defined projections.

Next we define the pairing morphism pair : Γ · σ · τ → Γ · Σ(σ, τ). Its first component is defined by

pair_{fun}[γ, s, t] = (γ, ⟨s, t⟩)

The second component is a bit more difficult. We start from the context

γ: Γ_{set}, s: σ_{set}, t: τ_{set}, p: Prf(Γ_{pred}[γ]), q: Prf(σ_{pred}[s]), r: Prf(τ_{pred}[s, t]) In this context we must find an element M of S := Prf(Σ(σ, τ)_{pred})[⟨s, t⟩]. We then put

pair[γ, s, t, p, q, r] = (p, M)

For the construction of M we observe that by virtue of the computation rule Σ-Comp, S equals Prf(σ_{pred}[s] ∧ τ_{pred}[s, t]). We thus put M := ∧-Intro(s, t) where ∧-Intro is the pairing combinator associated to ∧.

For Σ-elimination assume ρ ∈ Fam(Γ · Σ(σ, τ)) and M ∈ Sect(ρ{pair}). We must construct a section R^{Σ}(M) of ρ. The first component is just as in the term model:

R^{Σ}(M)_{fun}[γ: Γ_{set}, x: Σ(σ, τ)_{set}[γ]] = R_{σ_{set},τ_{set},ρ_{set}}^{Σ}(M_{fun}, x)

For the second component we use Σ-elimination as well. We must find an inhabitant of the type

Prf(ρ_{pred}[R_{σ_{set},τ_{set},ρ_{set}}^{Σ}(M_{fun}, x)])

in the context

γ: Γ_{set}, x: Σ(σ, τ)_{set}, p: Γ_{pred}[γ], q: Prf(Σ(σ, τ)_{pred}[x])

Using “cut” this may be reduced to finding an inhabitant of

ρ′[x] := Prf(Σ(σ, τ)_{pred}[x] ⇒ ρ_{pred}[R_{σ_{set},τ_{set},ρ_{set}}^{Σ}(M_{fun}, x)])

in context γ: Γ_{set}, x: Σ(σ, τ)_{set}, p: Γ_{pred}[γ]. Using R^{Σ} we can reduce this task to finding an inhabitant of ρ′[⟨s, t⟩] in context γ: Γ_{set}, x: Σ(σ, τ)_{set}, p: Γ_{pred}[γ], s: σ_{set}[γ], t : τ_{set}[s]. But using Σ-Comp, ρ′[⟨s, t⟩] is equal to

Prf(σ_{pred}[s] ∧ σ_{pred}[t] ⇒ ρ_{pred}[M_{fun}[s, t]])

This latter type is inhabited by K := λh : Prf(σ_{pred}[s] ∧ σ_{pred}[t]).M_{resp}[s, t, fst(h), snd(h)] where fst and snd are the projections associated with ∧. So putting things together we get

R^{Σ}(M)_{resp}[γ, x, p, q] = (R_{σ_{set},τ_{set},ρ′}^{Σ}(K, x)) p

Proposition 4.5.2 The above data endow D with Σ-types.

Proof. The pairing morphism satisfies

p(σ) ∘ p(τ) = p(Σ(σ, τ)) ∘ pair

since the Γ-components are simply copied in both parts of pair. Stability of all components under substitutions follows again directly from the split property of syntactic substitution. It remains to check equation Σ-Comp. In the −_{fun} component it is identical to its syntactic companion, for the −_{resp}-component we calculate as follows: If γ: Γ_{set}, s: σ_{set}, t: τ_{set}, p: Γ_{pred}[γ], q: Prf(σ_{pred}[s]), r: Prf(τ_{pred}[t]) then

(R^{Σ}(M){pair})_{resp}[γ, s, t, p, q, r]
= K ∧-Intro(q, r)  by Σ-Comp
= M_{resp}[s, t, fst(∧-Intro(q, r)), snd(∧-Intro(q, r))]  by Π-Beta
= M_{resp}[s, t, q, r]

□

Using this technique we can show that the deliverables model admits other inductive type constructors. We content ourselves by describing natural numbers in D.

4.5.3 Natural numbers

If Γ ∈ C we define (N_{Γ})_{set}[γ] = N and (N_{Γ})_{pred}[γ, n] = tt. The morphisms 0 and Suc are readily constructed from their syntactic companions. We have (0_{Γ})_{fun}[γ] = 0 and (Suc_{Γ})_{fun}[γ, n] = Suc(n). The −_{resp}-components are constants returning the canonical proof of tt. For N-elimination let ρ ∈ Fam(Γ · N_{Γ}) and M_{z} ∈ Sect(σ\{\overline{0}\}), and M_{s} ∈ Sect(σ\{Suc_{Γ} ∘ p(σ)\}). We must construct a section R^{N_{Γ}}(M_{z}, M_{s}) of ρ. The −_{fun} component is again the same as in the term model, R^{N_{Γ}}(M_{z}, M_{s})_{fun}[γ, n] = R^{N}((M_{z})_{fun}, (M_{s})_{fun}, n). For the −_{resp}-part we must “show” that ρ_{pred} “holds” for this term. By analogy to the case of Σ-types we use R^{N}. This time there is no need for strengthening the inductive hypothesis since the predicate on N is trivial.

Proposition 4.5.3 (N-canonicity) If M ∈ Sect(N_{⊤}) then M is canonical, i.e. M = Suc^{n}(0) for some (set-theoretic) natural number n.

Proof. We have ⊢ M_{fun} : N so by Remark 2.1.6 we have ⊢ M_{fun} = Suc^{n}(0 : N) for some n ∈ ω. Moreover, we have ⊢ M_{resp} : Prf(tt), but by strong normalisation for the Calculus of Constructions there is only one element of Prf(tt) in the empty context, so M = Suc^{n}(0) as required. □

4.5.4 The type of propositions

Now we come to the main feature of the deliverables model — the proof-irrelevant type of propositions. We show that the model is a loose model of the Calculus of Constructions in the sense of Def. 2.4.36. For the moment we assume that the underlying type theory supports an extensional unit type obeying the rules

\frac{Γ ⊢}{Γ ⊢ 1_{E}} Unit-Form  \frac{Γ ⊢}{Γ ⊢ ⋆ : 1_{E}} Unit-Intro

\frac{Γ ⊢ M : 1_{E}}{Γ ⊢ M = ⋆ : 1_{E}} Unit-Eq

We shall see below how this assumption can be eliminated.

Now we define the family Prop ∈ Fam(⊤) by

Prop_{set} = Prop

Prop_{pred}[P: Prop] = tt

The generic family of proof types Prf ∈ Fam(⊤ · Prop) is defined by

Prf_{set}[P: Prop] = 1_{E}
Prf_{pred}[P: Prop, x: 1_{E}] = P

So the proof type associated to a proposition P is always the unit type, but the predicate associated to P is P itself.

Therefore, a section of Prop is already determined by its −_{fun} component; a section of Prf{s} is already determined by its −_{resp}-component.

We come to the definition of universal quantification. Let σ ∈ Fam(Γ) and s : Γ · σ → Prop. Recall that Prop here denotes ⊤ · Prop. We define the morphism ∀_{σ}(s) : Γ → Prop by

∀_{σ}(s)_{fun}[γ: Γ_{set}] = ∀x: σ_{set}.σ_{pred}[x] ⇒ s[γ, x]

For the −_{resp}-part we take some constant function returning a proof of tt.

If M ∈ Sect(Prf{s}), i.e.

γ: Γ_{set}, x: σ_{set} ⊢ M_{fun} : 1_{E}

γ: Γ_{set}, x: σ_{set}, p: Γ_{pred}[γ], q: Prf(σ_{pred}[x]) ⊢ M_{resp}[p, q] : Prf(s[γ, x])

then we define λ_{σ,s}(M) ∈ Sect(Prf{∀_{σ}(s)}) by λ_{σ,s}(M)_{fun}[γ: Γ_{set}] = ⋆ : 1_{E}

λ_{σ,s}(M)_{resp}[γ: Γ_{set}, p: Γ_{pred}[γ]] = λx: σ_{set}.λq: σ_{pred}[x].M_{resp}[p, q] :
Prf(∀x: σ_{set}.σ_{pred}[x] ⇒ s[γ, x])

The evaluation morphism ev_{σ,s} : Γ · σ·Prf{∀_{σ}(s) ∘ p(σ)} → Γ · σ·Prf{s} is defined by

(ev_{σ,s})_{fun}[γ, x, p] = (γ , ⋆)
(ev_{σ,s})_{resp}[
γ: Γ_{set}, x: σ_{set}, f: 1_{E}
p: Γ_{pred}[γ], r: Prf(σ_{pred}[x]), q: Prf(∀y: σ_{set}.σ_{pred}[y] ⇒ s[γ, y])] =
(p , q x r)

Proposition 4.5.4 The above data endow D with the structure of a loose model for the Calculus of Constructions.

Proof. For the β-equation let M ∈ Sect(Prf{s}). We want to show that

ev_{σ,s} ∘ \overline{λ_{σ,s}(M)\{p(σ)\}} = \overline{M}

The −_{fun}-part is an equation of type 1_{E} and therefore holds by Unit-Eq. The −_{resp}-part follows immediately from the definitions and Π-Beta and Prop-Eq. The other laws including the substitutivity laws are also immediate consequences of the definitions. □

We can now establish logical consistency of the deliverables model in the sense that there exists a morphism ff : ⊤ → Prop such that Prf{ff} has no sections.

Proposition 4.5.5 (Consistency) The family Prf{ff} with

ff := ∀_{Prop}(id_{Prop}) : ⊤ → Prop

has no sections.

Proof. We have Prf{ff}_{set} = 1_{E} and Prf{ff}_{pred}[x] = ∀p: Prop.tt ⇒ p. A section of Prf{ff} thus consists of an element of 1_{E} (necessarily ⋆) and a term of type

⋄ ⊢ Prf(∀p: Prop.tt ⇒ p)

but no such term exists by consistency of the syntax. □

4.5.4.1 Eliminating extensional unit types

One may object against the use of extensional unit types as they are not part of the original syntax and because their behaviour in terms of rewriting and in particular normalisation is dubious. For instance they lead to non-confluence in the presence of η-reductions for functions and require a typed notion of reduction (for otherwise every term could be reduced to ⋆). Although we believe that their addition does not cause any substantial problems (and indeed this has been done in the formulation of the Calculus of Constructions used in [30]) we prefer to show two ways in which their use can be eliminated.

First, we observe that the only use of the extensional unit type was to ascribe a −_{set}-component to the families of the form Prf{s}. So a possible solution consists of not giving these families a −_{set}-component at all. We then have to refine the notion of families so as to allow for that. More precisely, we define

Fam(Γ) := Fam_{type}(Γ) ∪^{.} Fam_{prop}(Γ)

where Fam_{type}(Γ) is the set of families of specifications over Γ as defined in Sect. 4.3.2 and Fam_{prop}(Γ) is defined as the set of propositions in context Γ_{set}, i.e. the set of terms P with Γ_{set} ⊢ P : Prop. These are called propositional families over Γ. Now we must show that even with this extended notion of families we still have a syntactic category with attributes supporting all the structure we are interested in. The proof of this is absolutely straightforward and tedious. An element of Fam_{prop}(Γ) behaves like an ordinary family of specifications having the extensional unit type as −_{set}-component. All reference to it is omitted. So for example if P ∈ Fam_{prop}(Γ), i.e. Γ_{set} ⊢ P : Prop then the comprehension Γ · P is defined by (Γ · P)_{set} = Γ_{set} and (Γ · P)_{pred}[γ] = γ: Γ_{pred}[γ], q: Prf(P). Also if τ is a propositional family over Γ · σ then the product Π(σ, τ) is a propositional family over Γ.

A more systematic way of eliminating extensional unit types consists of exhibiting an interpretation of type theory with them in type theory without them. This can be done by constructing a syntactic category with attributes whose base category is the same as that of the term model—the category of contexts and context morphisms—and where a family over Γ is either a type in context Γ or a formal constant 1_{E}. The relevant operations may then be extended to this constant in the obvious way, for instance we define Γ · 1_{E} := Γ and p(1_{E}) := id_{Γ}.

4.5.5 Proof irrelevance

In the deliverables model any two proofs of a proposition are indistinguishable because proof types have 1_{E} as −_{set}-component and observations only take the −_{set}-component into account. To make this statement precise we first need to define a semantic analogue to Leibniz equality.

Definition 4.5.6 Fix a loose model of the Calculus of Constructions and let σ ∈ Fam(Γ) and M, N ∈ Sect(σ). Leibniz equality of M and N, written L Eq(M, N), is the proposition over Γ defined by

∀_{σ→Prop}(∀_{Prf\{\overline{PM}\}}(\overline{PN^{+}})) : Γ → Prop

where we have used the following abbreviations

σ → Prop = Π(σ, Prop{!_{Γ·σ}})  ∈  Fam(Γ)
PM  = App_{σ^{+} ,(σ→Prop)^{+}}(v_{σ→Prop}, M^{+}) ∈ Sect(Prop{!_{Γ·σ→Prop}})
PN  = App_{σ^{+} ,(σ→Prop)^{+}}(v_{σ→Prop}, N^{+}) ∈ Sect(Prop{!_{Γ·σ→Prop}})

Syntactically, the thus defined Leibniz equality corresponds to the usual

Γ ⊢ ∀P: σ → Prop.(P M) ⇒ (P N) : Prop

(To be precise, this gets interpreted as Hd(L Eq([[M]], [[N]])).) By mimicking the usual syntactic manipulations in the semantics we can show that Prf{L Eq(M, M)} is always inhabited, and that if Prf{L Eq(M, N)} is inhabited, then whenever Prf\{\overline{App_{σ , Prop}(P, M)}\} is inhabited for some P ∈ Sect(σ → Prop) then so is Prf\{\overline{App_{σ , Prop}(P, N)}\}.

Let us now examine what Leibniz equality means in the deliverables model. If σ ∈ Fam(Γ) and M, N ∈ Sect(σ) in this model then we have

L Eq(M, N)_{fun}[γ] = ∀P: σ_{set}[γ] → Prop.(P (M_{fun}[γ])) ⇒ (P (N_{fun}[γ]))

whereas L Eq(M, N)_{resp} is some uninteresting proof of tt—the −_{pred}-component of Prop. So L Eq(M, N) simply states actual Leibniz equality of the −_{fun}- components of M and N. Given the definition of Prf in the model we see that Sect(Prf{L Eq(M, N)}) is nonempty iff M_{fun} and N_{fun} are Leibniz equal in context Γ_{set}, Γ_{pred}. We thus obtain the following proposition expressing proofirrelevance in the deliverables model.

Proposition 4.5.7 Let Γ ∈ C be a context of specifications and A : Γ → Prop and M, N ∈ Sect(Prf\{A\}). Then the set Sect(Prf\{\overline{L Eq(M, N)}\}) is nonempty.

Proof. Since the −_{set}-component of the family Prf{A} is 1_{E}, both M_{fun} and N_{fun} must equal ⋆. So by the above considerations the section Pr Ir with Pr Ir_{fun} = ⋆ and Pr Ir_{resp}[γ: Γ_{set}, p: Γ_{pred}[γ]] = λP: 1_{E} → Propλx: Prf(P ⋆).x defines the desired section. □

However, we do not have M = N because the second components (which are not observed by propositional equality) may differ. We can also obtain a model if we identify morphisms and sections with equal first component. In the more general setting of partial equivalence relations instead of predicates this will be done in the next chapter. Here we prefer not to identify propositionally equal terms because this would thwart the application to modules described in Sect. 4.6.2.2 below. There is no fundamental reason for this choice, though.

Corollary 4.5.8 The deliverables model permits the interpretation of a type theory extending the Calculus of Constructions by the rule

\frac{Γ ⊢ A : Prop  Γ ⊢ M, N : Prf(A)}{Γ ⊢ Pr Ir(A, M, N) : Prf(M =^{L} N)} Pr-Ir

Proof. We interpret Pr Ir by the section defined in the proof above. It remains to show that the choice of this section is stable under substitution, but this follows immediately from its uniform syntactic definition. □

4.5.6 Universes

If the underlying type theory has universes so has the deliverables model. In particular since the underlying type theory has an impredicative universe (Prop) we can define such a universe in D which astonishingly is different from Prop. We therefore call it Set and write El instead of Prf. We define

Set_{set} = ΣX: Prop.X → Prop
Set_{pred}[x: Set_{set}] = tt
El_{set}[X: Set_{set}] = X.1
El_{pred}[X: Set_{set}, x: X.1] = X.2 x

It is now possible to define a ∀-operator for this universe. Moreover, the universe Set will be closed under the subset types defined below. Since we do not make further use of Set, we do not give the details here. Notice that since the −_{set}- component of an El-type is not 1_{E}, proof-irrelevance does not hold for Set. In this sense D allows us to use the impredicative universe Prop both for proofirrelevant logic and for impredicative quantification. One may compare this to the two impredicative universes Spec and Prop in Paulin-Mohring’s thesis work [88].

4.6 Subset types

Given Pr-Ir we can encode subset comprehension using Σ-types, more precisely if Γ ⊢ σ and ⊢ P : σ → Prop then the type ⊢ Σx: σ.Prf(P x) can be seen as the subset of σ containing those elements for which P holds. The first projection ⊢ π : Σx: σ.Prf(P x) → σ where π = λu : Σx: σ.Prf(P x).(u.1) is now provably injective in the sense that the proposition

u, v: Σx: σ.Prf(P x) ⊢ (π u) =^{L} (π v) ⇒ u =^{L} v

is provable using Σ-elimination (R^{Σ}) and Pr-Ir. Let us now look at how this particular Σ-type gets interpreted in the deliverables model. If σ ∈ Fam(Γ) and P : Γ · σ → Prop then we have

Σ(σ, Prf{P })_{set}[γ: Γ_{set}] = Σx: σ_{set}.1_{E}
Σ(σ, Prf{P })_{pred}[γ: Γ_{set}, u: Σ(σ, Prf{P })_{set}[γ]] =
R_{...}^{Σ}([x: σ_{set}, y: 1_{E}]σ_{pred}[x] ∧ P [γ, x] , u)

That is, the −_{set}-component of the Σ-type is almost the −_{set}-component of σ and the −_{pred}-component is the conjunction of σ_{pred} and P. It makes sense to replace “is almost” by “is” and to define the following subset type former inside D.

Definition 4.6.1 Let σ ∈ Fam(Γ) and P : Γ · σ → Prop. The subset type {σ | P } ∈ Fam(Γ) is defined by

{σ | P }_{set}[γ: Γ_{set}] = σ_{set}[γ]
{σ | P }_{pred}[γ: Γ_{set}, x: σ_{set}[γ]] = σ_{pred}[γ, x] ∧ P_{fun}[γ, x]

Now if M ∈ Sect(σ) and H ∈ Prf\{P ∘ \overline{M}\} then we define a section (M)_{H} of \{σ | P \} by

((M)_{H})_{fun} = M_{fun}
((M)_{H})_{resp} = pair(M_{resp}, P_{resp})

where here pair is the (defined) introduction operator corresponding to ∧. Conversely, if M ∈ Sect({σ | P }) then we have a section wit(M) of σ (“witness”) given by wit(M)_{fun} = M_{fun} and wit(M)_{resp} = fst(M_{resp}). Every section of the form wit(M) “satisfies” P in the sense that there is a section cor(M) of Prf\{P ∘ \overline{M}\} (“correctness”) given by cor(M)_{fun} = ⋆ and cor(M)_{resp} = snd(M_{resp}) where fst and snd are the projections corresponding to ∧.

Proposition 4.6.2 The deliverables model permits the interpretation of a type theory extending the Calculus of Constructions by a subset type governed by the following rules:

\frac{⊢ σ  x: σ ⊢ P : Prop}{⊢ \{x: σ | P \}} \{\}-Form
\frac{⊢ M : σ  ⊢ H : Prf(P [M])}{⊢ (M)_{H} : \{x: σ | P \}} \{\}-Intro
\frac{⊢ M : \{x: σ | P \}}{⊢ wit(M) : σ} \{\}-Wit
\frac{⊢ M : \{x: σ | P \}}{⊢ cor(M) : Prf(P [wit(M)])} \{\}-Cor
⊢ wit((M)_{H}) = M : σ ⊢ cor((M)_{H}) = H : Prf(P [M])

{}-Beta

Proof. The subset type and its associated combinators are interpreted by the semantic operations defined above. {}-Beta and stability under substitution are immediate from the definition. □

The above proposition could also be “proved” in a purely syntactical way by interpreting {x: σ | P } as Σx: σ.Prf(P). The point is that the more economical encoding above also interprets them.

An extended example for the use of subset types will be given in Sect. 6.1.

4.6.1 Subset types without impredicativity

The above development of subset types and proof irrelevance does not hinge on impredicative propositions; one could carry out the same development in the core type theory TT and would then obtain a model for a type theory with two different sorts: types and propositions. So instead of Γ ⊢ σ we would have to write Γ ⊢ σ type and we would also have a judgement Γ ⊢ σ prop. These “propositions” would support the same type formers as the “types” and moreover we would have an inclusion rule

\frac{Γ ⊢ σ prop}{Γ ⊢ σ type}

Semantically, the “propositions” would be interpreted as families with extensional unit type in the −_{set}-component. In the absence of Leibniz equality we would then define a propositional equality using the identity type from the syntax. The propositions then would be at most single-valued w.r.t. this equality. The resulting model is then quite close to the subset interpretation of Martin-Löf type theory.

4.6.2 A non-standard rule for subset types

In Section 4.5.4.1 we sketched a refinement of the deliverables model in which families could have no −_{set}-component, which then was meant to be 1_{E}. We will now consider a refinement under which there are families without −_{pred}-component, which is understood to be tt. This will allow us to derive a “non-standard” rule for subset types in Prop. 4.6.6 below which shows that every function on a subset type is in fact defined on the whole of the underlying −_{set}-component. So we define a new model with

Fam(Γ) := Fam_{type}(Γ) ∪^{.} Fam_{nprop}(Γ)

where Fam_{type}(Γ) is the set of families of specifications as defined before, whereas Fam_{nprop}(Γ) is the set of (syntactic) types in context Γ_{set}. The elements of this set are called non-propositional families of specifications over Γ. If σ ∈ Fam_{nprop}(Γ) then we define (Γ · σ)_{set} as Γ_{set}, x: σ and (Γ · σ)_{pred} = Γ_{pred}. Substitution in nonpropositional families is simply syntactic substitution. A section of σ is a term Γ_{set} ⊢ M : σ. The corresponding morphism \overline{M} is given by \overline{M}_{fun}[γ] = (γ, M) and \overline{M}_{resp}[γ, p] = p which makes sense since the comprehension of σ does not add anything to the −_{pred}-component. We call the resulting structure the deliverables model with non-propositional families.

Proposition 4.6.3 The deliverables model with non-propositional families is a loose model of the Calculus of Constructions and supports natural numbers and Σ-types. Moreover, Prop and N are non-propositional, and Π(σ, τ) is non-propo-sitional iff τ is, and Σ(σ, τ) is non-propositional iff both σ and τ are.

Proof. The model equations for non-propositional families are readily checked by straightforward expansion of the definitions. N and Prop are defined as their syntactic companions viewed as non-propositional families. If τ ∈ Fam_{nprop}(Γ · σ) then Π(σ, τ) ∈ Fam_{nprop}(Γ) is defined as γ: Γ_{set} ⊢ Πx: σ_{set}[γ].τ_{set}[γ, x]. If σ ∈ Fam_{nprop}(Γ) and τ ∈ Fam(Γ · σ) we define the dependent product by

Π(σ, τ)_{set}[γ: Γ_{set}] := Πx: σ_{set}.τ_{set}[x]
Π(σ, τ)_{pred}[γ: Γ_{set}, f: Π(σ, τ)_{set}[γ]] := ∀x: σ_{set}.τ_{pred}[γ, x, f x]

The dependent sum of two non-propositional families is defined as in the syntax; the dependent sum of an ordinary family and a non-propositional one is defined as in Sect. 4.5.2 where all references to the (non-existing) −_{pred}-part of the nonpropositional family are dropped. The other components and the verifications are straightforward. □

Next we define a syntactical counterpart to non-propositional families which will serve to define the desired rule for subset types.

Definition 4.6.4 Consider the Calculus of Constructions with natural numbers, Σ-types, and subset types. The set of non-propositional pre-types is defined by the following clauses.

– N and Prop are non-propositional.

– If σ and τ are non-propositional then so are Σ(σ, τ) and Π(ρ, τ) for any pre-type ρ.

We write Γ ⊢ σ Nprop if Γ ⊢ σ and σ is a non-propositional pre-type. In this situation σ is called a non-propositional type.

Proposition 4.6.5 The notion of non-propositional types is stable under equality and substitution, more precisely if Γ ⊢ σ = τ and Γ ⊢ σ Nprop then also Γ ⊢ τ Nprop and B ⊢ σ[f] Nprop for every syntactic substitution B ⊢ f ⇒ Γ.

Proof. The only type equality rule which is not a congruence rule is Prop-Eq. Therefore, if Γ ⊢ σ = τ then either both σ and τ have the same outermost type former or both types contain an instance of Prf in which case Γ ⊢ σ Nprop does not hold. We then use induction. The same argument applies to substitution.

□

Proposition 4.6.6 The following rules can be interpreted in the deliverables model with non-propositional families.

\frac{x: σ ⊢ τ[x] Nprop x: σ ⊢ P [x] : Prop p: \{x: σ | P [x]\} ⊢ M[p]: τ[wit(p)] ⊢ N: σ}{⊢ extend_{σ,P,τ}(M, N) : τ[M]} \{\}-Elim-Nonprop

\frac{⊢ H : Prf(P [M])}{⊢ extend_{σ,P,τ}(M, N) = M[(N)_{H}] : τ[N]} \{\}-Elim-Nonprop-Comp

Proof. By induction along the definition of the interpretation function we show that if Γ ⊢ σ Nprop then [[Γ | σ]] ∈ Fam_{nprop}([[Γ]]). It remains to interpret the two rules on the semantic level. Thus let σ ∈ Fam(Γ), τ ∈ Fam_{nprop}(Γ), and P : Γ·σ → Prop. Let w : Γ · \{σ | P \} → Γ · σ be the morphism q(p(\{σ | P \}), σ) ∘ \overline{wit(v_{\{σ | P \}})}. We have w_{fun}[γ, s] = (γ, s) and w_{resp}[γ, p, q] = (p, fst(q)). Now let M ∈ Sect(τ{w}) and N ∈ Sect(σ). We must construct a section extend_{σ,P,τ}(M, N) of τ\{\overline{M}\}. We define it by

extend_{σ,P,τ}(M, N)[γ: Γ_{set}] = M_{fun}[γ, N_{fun}[γ]]

Notice that no −_{resp}-component is required because τ is non-propositional. The equation {}-Elim-Nonprop-Comp now holds by definition. □

The non-standard rule allows one to extend a function p: {x: σ | P [x]} ⊢ M[p] : τ[wit(p)] defined on a subset type to the whole of σ, hence the name of the operator symbol.

In the ordinary deliverables model we could still interpret {}-Elim-Nonprop by showing that non-propositional types get interpreted as families with a −_{pred}- component which is universally valid (equivalent to tt). One would then use this proof to interpret the −_{resp}-component of extend. But first, some care would have to be taken in order to retain stability under substitution, and second the equation {}-Elim-Nonprop-Comp would only hold up to Leibniz equality, because the −_{resp}-components of the two sections might disagree.

The “computation” rule {}-Elim-Nonprop-Comp is suspicious from a rewriting point of view, for if we direct it from left to right we would have to “guess” a proof H : Prf(P [M]). If on the other hand we choose to direct it from right to left there is no way of eliminating instances of extend. Such rules do however make sense as a clarification of the semantically determined definitional equality induced by a syntactic model (here D) discussed in the Introduction. Below in Sect. 4.7 we make that more precise.

4.6.2.1 Internal program extraction

The rule {}-Elim-Nonprop may be used to perform an internal version of program extraction. For example if we have defined a function f : Even → Even where Even is {x: N | ∃m: N.n =^{L} 2m}, then we obtain a function f̂ from N to N by

f̂ = λn: N.extend([x: Even]wit(f x), n)

which is valid since N is non-propositional. Now using {}-Elim-Nonprop-Comp we obtain

x: Even ⊢ f̂ wit(x) = wit(f x) : N

which states that f̂ is the “underlying algorithm” of f.

In a similar vein, the non-standard rule for subset types admits the following generalisation of Prop. 4.1.1 above.

Proposition 4.6.7 Consider a type theory with subset types and the extendoperator. Let Γ ⊢ P : Prop and Γ, p: Prf(P) ⊢ M : σ for some non-propositional type σ, e.g. N. Then there exists a term Γ ⊢ N : σ with Γ, p: Prf(P) ⊢ M = N : σ.

Proof. Consider the type {n: N | P } (where n does not occur in P). We have

Γ , x: {n: N | P } ⊢ M[p := cor(x)] : σ

Therefore, by {}-Elim-Nonprop

Γ ⊢ extend_{σ,P,σ}([x: {n: N | P }]M[p := cor(x)], 0) : σ

Let N be this term. By rule {}-Elim-Nonprop-Comp we get

Γ, p: Prf(P) ⊢ M = N : σ

as required. □

We remark that the non-propositional families and the families of the form Prf{s} are independent in the sense of [84]. In our terminology this means, that for s : Γ → Prop the non-propositional families over Γ are in 1-1 correspondence to the non-propositional families over Γ · Prf{s} and that for non-propositional σ ∈ Fam_{nprop}(Γ) the weakening map

−{p(Prf{s})} : Sect(σ) → Sect(σ{p(Prf{s})})

is a bijection. The non-standard operator extend can be seen as an internalisation or a syntactic version of Moggi’s concept of independence. From equation {}-Elim-Nonprop-Comp we can only deduce that the above mapping is surjective. To deduce bijectivity in a purely syntactic way we could introduce an η-like equation: extend([u: {x: σ | P }M[wit(u)], N) = M[N] if x: σ ⊢ M[x] : σ. This is a case in point for the type theory with semantically defined definitional equality described in Sect. 4.7.

In the set-theoretic model (Ex. 2.4.4), where subset types can be interpreted as ordinary subsets, one can interpret extend as extend_{σ,P,τ}(M, N) = M(N) if P (N) holds and c_{τ} otherwise where c_{τ} ∈ τ is a “default element” defined by induction on the definition of “non-propositional”. However, this understanding is not constructive, whereas the interpretation in D is.

4.6.2.2 Application to modules

We can also use subset types and the deliverables model for modules and higherorder functors, where it is important that the typing component of a functor does not depend upon its implementation component. Although the account of modules we end up with is essentially the same as the one given by Moggi and others in [84,42] we found it interesting to exhibit the relationship with subset types and deliverables and to rephrase their constructions in terms of syntactic models.

For what follows we need a type theory in which Prop (the name “Set” would be more appropriate) contains the natural numbers and other datatypes of interest. This means that there is a constant Γ ⊢ N̂ : Prop with Prf(N̂) = N. In the deliverables model we can then also define such a constant by putting N̂_{fun}[γ] = N̂ and N̂_{resp} returns a proof of tt. Now in the model Prf(N̂) is not N because any family of the form Prf{s} has −_{set}-part 1_{E}, but we can interpret the following rules, where we abbreviate Prf{N̂} by N.

\frac{Γ ⊢}{Γ ⊢ 0 : N} N-Intro-0  \frac{Γ ⊢ M : N}{Γ ⊢ Suc(M) : N} N-Intro-Suc

\frac{Γ , x: N ⊢ S : Prop Γ ⊢ M_{z} : Prf(S[x := 0]) Γ , x : N , p : Prf(S) ⊢ M_{s} : Prf(S[x := Suc(x)]) Γ ⊢ N : N}{Γ ⊢ R_{S}^{N}(M_{z}, M_{s}, N) : Prf(S[x := N])} N-Elim

Now we may view Prop as the universe of datatypes, and types like Prop → Prop as “kinds”. We may then use the subset type to give signatures. For example a signature for sets with a binary operation would be^{4}

BIN = {X: Prop | X ⇒ X ⇒ X}

The signature for “monads” as used in functional programming [83,110] would be

MON = {T: Prop → Prop | (∀X: Prop.X ⇒ (T X)) ∧ (∀X, Y: Prop.(X ⇒ (T Y)) ⇒ (T X) ⇒ (T Y))}

If S : BIN then wit(S) : Prop and cor(S) : Prf(S) → Prf(S) → Prf(S), so an element of type BIN consists of a datatype and a binary operation on it. For example we have (N̂)_{λx.λy.x+y} : BIN. We may therefore call elements of a signature “structures matching the signature”. If S is a structure then we call wit(S) its type component and cor(S) its implementation component.

4Recall that for X, Y: Prop we have Prf(X ⇒ Y) = Prf(X) → Prf(Y) and that Prf(X ∧ Y) together with pair, fst, and snd is a binary product without surjective pairing.

Now we still have that any two “proofs” (elements) of a “proposition” (datatype) are “Leibniz-equal”, for example the type

⊢ Prf(∀P : Prf(N) → Prop.(Prf(P 0)) → Prf(P (Suc(0))))

is inhabited in the model (by Pr-Ir). But the reason for this is that in the model a datatype (a “proposition”) can never depend upon values of a datatype and so every P the quantification ranges over must be constant. Thus by working in D it is possible to typecheck signatures at compile time without performing any computations on datatypes. Using the deliverables model with non-propositional families this can be internalised in the following sense. If F : BIN → BIN is a “functor” mapping structures matching BIN to themselves, then just as in Sect. 4.6.2.1 we can define f̂: Prop → Prop where f̂ X is the “type component” of f applied to a structure matching BIN with type component X.

It should be pointed out that now that we have used up the two components of a specification for types and implementation respectively, there is no possibility of including logical information anymore. This could be done in a similar model where a family has three components: type, implementation, and proof. This might form the basis of a type-theoretic semantics for a modular specification languages like Extended ML [94] in which programs and specifications can coexist. The internal language of such a model, i.e. the type theory interpretable by it should resemble one of the higher-order type theories considered in [53].

4.7 Reinterpretation of the equality judgement

We have now described a syntactic model of type theory in which subset types and proof-irrelevance can be interpreted. We have argued that type theory extended with these additional constructs can be understood as a macro language for working under the deliverables approach described in Sect. 4.2 above. Upon application of the semantic interpretation function to derivations in the extended type theory one obtains a corresponding derivation under the deliverables approach as explained by the semantic interpretation of the various type and term formers.

Rather than actually computing the deliverables interpretation of some derivation one may also look at the new equality judgements induced by this interpretation. We therefore propose a new type theory in which all the equality rules are replaced by rules making reference to semantic equality.

Definition 4.7.1 Let [[…]] denote the semantic function associated to D and take x = y : X to mean that x, y, and X are defined, and x, y are equal elements of the set X. The type theory D is defined by the following clauses.

– The pre-constructions of D are the same as those of ordinary type theory extended with Pr Ir and the operators associated to subset types.

– The typing rules are the same as those of ordinary type theory.

– There are only the following three equality rules:

\frac{[[Γ | M]] = [[Γ | N]] ∈ Sect([[Γ | σ]])}{Γ ⊢ M = N : σ} Eq-Term
\frac{[[Γ | σ]] = [[Γ | τ]] ∈ Fam([[Γ]])}{Γ ⊢ σ = τ} Eq-Type
\frac{[[Γ]] = [[Δ]] ∈ Ob(C)}{⊢ Γ = Δ} Eq-Cont

Since the interpretation function is recursive and equality in the deliverables model is decidable by decidability of equality in the Calculus of Constructions, we find that the new type theory defined above also has decidable typing and equality judgements. In this way we can make sense out of equality rules like {}-Elim-Nonprop-Comp which now appear as special cases of Eq-Term.

This semantic definition of equality also applies to the two syntactic models for extensionality and quotient types we study in the next chapter.

4.8 Related work

A subset type former very similar to ours has also been introduced by Martin-Löf and justified by a very similar model construction—the subset interpretation of type theory (described in [85]). The main difference is that our model accounts for the full Calculus of Construction, i.e. higher-order logic, and more subtly that Martin-Löf identifies morphisms with equal first components and families with equal first and equivalent second components. This last identification makes semantic equality undecidable. A difference in presentation is that Martin-Löf’s subset interpretation is not described in terms of categorical semantics. In this simple case this is only a matter of taste; however, for the more involved setoid models we look at in the next chapter, we found the use of the abstract semantics unavoidable.

Subset types in an extensional context without unicity of typing (in the sense of Prop. 2.1.7) have been studied by Salvesen and Smith [93]. They consider a subset introduction rule which allows one to conclude M : {x: σ | P [x]} provided M : σ and P [M] true. They do not have a rule which gives P [M] from M : {x: σ | P [x]}, but only allow to conclude C true if x: σ, p: Prf(P [x]) ⊢ C true and x does not occur in C. They ask the question under what conditions on P this does allow P [M] to be derived and find that this is the case for stable formulae, i.e. those for which ((P ⇒ ff) ⇒ ff) ⇒ P true. This work does not really compare to ours because in an intensional setting the questions answered in loc.cit. either make no sense or have a trivial answer.

The idea that types endowed with predicates can be organised into a model of type theory also appears in [13]. There, however, only semi-cartesian closure is shown, thus it follows that “deliverables” form a model of the simply typed lambda calculus. In loc.cit. also “relativised specifications” and “second order deliverables” are considered. A relativised specification relative to a specification ⊢ σ and x: σ ⊢ P [x] : Prop consists of a type τ and a relation x: σ, y: τ ⊢ R[x, y] : Prop. If (τ, R) and (τ′, R′) are two relativised specifications over (σ, P) then a secondorder deliverable from (τ, R) to (τ′, R′) consists of a function x: σ ⊢ f[x] : τ → τ′ and a proof x: σ, p: Prf(P [x]) ⊢ F : Prf(∀y: τ.R[x, y] ⇒ R′[x, f[x] y]). In our model a relativised specification is a special case of a family in Fam(⊤ · (σ, P)) (where in general τ may depend upon σ). A second order deliverable then appears as a morphism from p((τ, R)) to p((τ′, R′)) in the slice category over ⊤ · (σ, P). It is easily seen that the relativised specifications form a full submodel of D. The setoid model S_{0} presented in the next chapter has indeed the property that the type component of families does not depend on the context.

Many of the ideas underlying the model D are also present in the thesis work of C. Paulin-Mohring [88]. She describes a type theory with two impredicative universes Spec and Prop which is then interpreted in an amalgamation of pure Calculus of Constructions and system F_{ω}. It is explained in great detail how the F_{ω} component of the interpretation (it corresponds to our −_{fun}- and −_{set}- components) can be seen as a program extracted from a constructive proof. An analogy is drawn to the notion of realisability in proof theory and various extensions are proposed such as an interpretation of well-founded recursion using a fixpoint combinator on the F_{ω} level. Also a subset type is introduced, albeit without the non-standard rule from Sect. 4.6.2. The main differences to our construction are that categorical models are not used and that the “−_{set}-, −_{fun}-components” in Paulin-Mohring’s model do not contain type dependency, very much like our model S_{0} to be introduced in the next chapter.

Summing up, we can say that the constructions leading to the deliverables model were all known, but that some new facets have been presented such as the organisation using categorical models and the non-standard rule for subset types. As was said before, our main purpose in presenting the deliverables model is to exemplify the use of categorical models for syntactic translations.

Extensionality and quotient types

In this chapter we study models for quotient types and the related concepts of functional and propositional extensionality. The general method is to construct models in which types are interpreted as types together with partial equivalence relations. Propositional equality at some type is then the associated partial equivalence relation.

As we discuss below in Sect. 5.4 this idea has been considered by several authors with various aims. What is new here is that the concept of types with partial equivalence relations (“setoids”) is studied in the context of intensional dependent type theory, which makes it necessary to define setoids depending on setoids. In the sequel we shall essentially give three different answers to this question. The first and simplest one (Sect. 5.1) only provides a restricted notion of type dependency because in the model dependency arises only at the level of the relations, not at the level of the types themselves. The second one (Sect. 5.2)—the groupoid model— supports all the type and term-formers we know of and should be considered the “correct” answer, but unfortunately it is not definable in intensional type theory. However, it answers the question of independence of the uniqueness of identity and provides valuable insights into the nature of propositional equality. The third one (Sect. 5.3), finally, is an attempt to overcome the syntactic problems with the groupoid model and the limitations of the first setoid model. It provides slightly more type dependency, but—as we shall see—has other disadvantages, so that the definitive answer to the question of dependent setoids remains open.

We encounter two operations the soundness of which relies on the difference between extensional propositional equality and intensional definitional equality: a choice operator for quotient types (Sect. 5.1.7) and an axiom identifying propositional equality on a universe with the type of isomorphisms (Sect. 5.2.4).

5.1 The setoid model

We consider an extension of the Calculus of Constructions by dependent sums, natural numbers, and possibly some datatypes. No further universes are required. Our aim is to construct a model in which quotient types w.r.t. Leibniz equality can be interpreted and in which the extensional concepts of proof irrelevance, functional extensionality, and propositional extensionality are available. In view of the analysis in Sect. 1.2 we then also have proof-irrelevance which we shall, however, derive directly. The model we construct has the remarkable property that Leibniz equality behaves like the identity type in the sense that a substitution operator for dependent types in the sense of Sect. 3.2.3.1 may be defined for it. If one looks closer at the model this is not so astonishing because the only source for type dependency in this model is the dependency of proof types on propositions, w.r.t. which Leibniz equality is substitutive by definition.

In the model types will be interpreted as types together with Prop-valued partial equivalence relations. Type dependency is modelled only at the level of the relations, i.e. a family indexed over some type σ is a type τ (not depending on σ) and for each x: σ a partial equivalence relation on τ compatible with the relation on σ. By analogy to Bishop’s definition of sets as assemblies together with an equality relation [9] we call the pairs of types and partial equivalence relations setoids.

We use the name target type theory to refer to the version of the Calculus of Constructions the model is built upon, and source type theory to refer to the internal language of the model which contains all the type and term formers from the target type theory together with the desired extensional concepts and the “strong” Leibniz equality. Definitional equality in the source type theory is defined semantically via interpretation in the model according to Sect. 4.7. The model we construct is called the setoid model S_{0}. Its components are called contexts, families, morphisms, etc. of setoids. The source type theory itself will also be called S_{0}.

Large parts of this section have been published as [45]. The extension to universes (Sect. 5.1.8) and the discussion of choice principles and Church’s thesis (Sect. 5.1.4.2 and 5.1.4.3) appear here for the first time.

5.1.1 Contexts of setoids

A context of setoids is a pair Γ = (Γ_{set}, Γ_{rel}) where Γ_{set} is a (syntactic) context (i.e. Γ_{set} ⊢) and Γ_{rel} is a proposition in context γ: Γ_{set}, γ′: Γ_{set}, i.e. γ: Γ_{set}, γ′: Γ_{set} ⊢ Γ_{rel}[γ, γ′] : Prop, in such a way that

γ, γ′: Γ_{set} , Prf(Γ_{rel}[γ, γ′]) ⊢ Γ_{rel}[γ′, γ] true  Sym
γ, γ′, γ′′: Γ_{set} , Prf(Γ_{rel}[γ, γ′]) , Prf(Γ_{rel}[γ′, γ′′]) ⊢ Γ_{rel}[γ, γ′′] true  Trans

Here we just write Prf(Γ_{rel}[γ, γ′]) in a context instead of p : Prf(Γ_{rel}[γ, γ′]) for some variable p since this variable does not appear in the conclusion of the judgement. We shall adopt this abbreviation in the sequel as well. The axioms Sym and Trans thus express that Γ_{rel} is a partial equivalence relation on Γ_{set}. Two contexts of setoids Γ, Δ are equal if their components are definitionally equal, i.e. if ⊢ Γ_{set} = Δ_{set} and γ, γ′: Γ_{set} ⊢ Γ_{rel}[γ, γ′] = Δ_{rel}[γ, γ′] : Prop. The implicit witnesses for Sym and Trans are not compared. It is important that the relation is not assumed reflexive for otherwise we could not interpret propositions, see Sect. 5.1.4.

Examples. The empty context of setoids is given by ⊤ = (⋄, tt) where Sym and Trans are validated by the canonical proof of tt. Another example is the context Int given by Int_{set} = p: N × N and

Int_{rel}[p, p′: Int_{set}] := p.1 + p′.2 =^{L} p.2 + p′.1

where in order to establish symmetry and transitivity we use some elementary lemmas about addition on natural numbers.

5.1.1.1 Morphisms

Let Γ, Δ be contexts of setoids. A morphism from Γ to Δ is a (syntactic) context morphism f from Γ_{set} to Δ_{set} with

γ, γ′: Γ_{set} , Prf(Γ_{rel}[γ, γ′]) ⊢ Δ_{rel}[f[γ], f[γ′]] true  Resp

In this situation we write f : Γ → Δ as usual. Equality of morphisms is definitional equality in the target type theory. Clearly, the composition of two morphisms is a morphism again and the identity is a morphism. Moreover, the unique context morphism into ⊤ trivially satisfies Resp so that we have

Proposition 5.1.1 The contexts of setoids and their morphisms form a category C with terminal object.

Notice that we do not identify “provably equal” morphisms, i.e. f and g with γ: Γ_{set}, Prf(Γ_{rel}[γ, γ]) ⊢ Δ_{rel}[f[γ], g[γ]] true. Doing so would render the semantic equality undecidable and therefore the source type theory would be undecidable. The difference between actual semantic equality and provable equality is also important for the choice operator we consider in Sect. 5.1.7 which would be unsound if the two were identified.

5.1.1.2 Families of setoids

Let Γ be a context of setoids. A family of setoids indexed over Γ is a pair σ = (σ_{set}, σ_{rel}) where σ_{set} is a type in the empty context (⋄ ⊢ σ_{set}) and

γ: Γ_{set} , s, s′: σ_{set} ⊢ σ_{rel}[γ, s, s′] : Prop

is a family of relations on σ_{set} indexed by Γ_{set} such that

γ: Γ_{set} , s, s′: σ_{set} , Sym

Prf(Γ_{rel}[γ, γ]) , Prf(σ_{rel}[γ, s, s′]) ⊢ σ_{rel}[γ, s′, s] true γ: Γ_{set} , s, s′, s′′: σ_{set} , Trans

Prf(Γ_{rel}[γ, γ]) , Prf(σ_{rel}[γ, s, s′]) , Prf(σ_{rel}[γ, s′, s′′]) ⊢ σ_{rel}[γ, s, s′′] true γ, γ′: Γ_{set} , s, s′: σ_{set} , Comp

Prf(Γ_{rel}[γ, γ′]) , Prf(σ_{rel}[γ, s, s′]) ⊢ σ_{rel}[γ′, s, s′] true

Two families are equal if their two components −_{set} and −_{rel} are definitionally equal.

Thus, a family of setoids consists of a Γ_{set}-indexed family of partial equivalence relations on one and the same type σ_{set} with the property expressed by Comp (“compatibility”) that the relations over related elements in Γ_{set} are equivalent (by virtue of symmetry of Γ_{rel}). It is important that symmetry and transitivity are relativised to “existing” γ: Γ_{set}, i.e. those with Γ_{rel}[γ, γ], since otherwise most of the type formers including quotient types would not go through. Also intuitively this restriction makes sense since σ_{set} and σ_{rel} are meant to be undefined or unconstrained outside the “existing” part of Γ. An example of a family is again given by Int_{set} = N × N and Int_{rel}[γ, p, p′] = p.1 + p′. =^{L} p.2 + p′.1. Here the family σ_{rel} does not actually depend on Γ_{set}. Examples where there is such a dependency will arise later in Section 5.1.4 when we interpret an impredicative universe of propositions. The set of families of setoids over Γ is denoted by Fam(Γ).

5.1.1.3 Substitution and comprehension

Let B, Γ be contexts of setoids, f : B → Γ and σ ∈ Fam(Γ). A family σ{f} ∈ Fam(B) is defined by σ{f}_{set} = σ_{set} and

σ{f}_{rel}[β: B_{set} , s, s′: σ{f}_{set}] = σ_{rel}[f[β], s, s′]

The comprehension of σ is defined by (Γ · σ)_{set} = Γ_{set}, s: σ_{set} and

(Γ · σ)_{rel}[(γ, s) , (γ′, s′)] = Γ_{rel}[γ, γ′] ∧ σ_{rel}[γ, s, s′]

The morphism p(σ) : Γ·σ → Γ is defined by p(σ)[γ, s] = γ; the relation is preserved by virtue of ∧-elimination. Finally, the morphism q(f, σ) : B · σ{f} → Γ · σ is given by q(f, σ)[β, s] = (f[β], s). This preserves the relation since f does. It is also readily checked that the relevant square formed out of f, p, and q commutes (and in fact is a pullback).

5.1.1.4 Sections

Let Γ be a context of setoids and σ ∈ Fam(Γ). A section of σ is a term Γ_{set} ⊢ M: σ_{set} which respects the relations, that is

γ, γ′: Γ_{set} , Prf(Γ_{rel}[γ, γ′]) ⊢ σ_{rel}[γ, M[γ], M[γ′]] true Resp

Equality of these sections is again definitional equality in the target type theory. If M is a section then its associated context morphism is defined by \overline{M}[γ] = (γ, M[γ]) which is a morphism by virtue of Resp. Conversely, if (f, M) : B → Γ · σ is a morphism then Hd((f, M)) := M is a section of σ{f}. To see Resp let β, β′: B_{set} and p: B_{rel}[β, β′]. We must show that in this context σ_{rel}[f[β], M[β], M[β′]] true. But this is merely the last component of condition Resp for (f, M) : B → Γ · σ by definition of (Γ · σ_{rel}). Summing up, we have the following:

Proposition 5.1.2 Contexts, families, and sections of setoids form a syntactic category with attributes—the setoid model S_{0}.

The dependent type theory with extensional concepts modelled by this syntactic category with attributes in the sense of Sect. 4.7 will also be called S_{0}.

5.1.2 Implementing the setoid model S_{0} in Lego

If we want to use Lego to check the equations of S_{0} we must deal with of the extensional nature of the judgements of the form Γ ⊢ P true. We have used an approach whereby semantic objects are rendered as pairs consisting of the actual part which figures in the model and a proof that the required judgements hold. For example, we define

[Con = <<set:Type(0), rel:set->set->Prop>>]
[CON[G:Con] =
    ({g,g'|G.set}(G.rel g g')->(G.rel g' g)) /\
    ({g,g',g''|G.set}(G.rel g g')->(G.rel g' g'')->(G.rel g g''))]

Now a context is an element G of Con and a proof of (CON G), but these proofs are ignored when two contexts are compared. For each semantic operation we have a part which works on the first components and a part which establishes preservation of these properties. For instance, composition has two components:

Comp:{A,B,G|Con}(Mor B G)->(Mor A B)->(Mor A G)
COMP:{A,B,G|Con}{g|Mor B G}{f|Mor A B}
                (CON A)->(CON B)->(CON G)->
                (MOR g)->(MOR f)->(MOR (Comp g f))

Thus in a sense we work in the deliverables model. We cannot use the internal language of the deliverables model directly, since it only offers propositional equality of proofs, but we must compare the semantic objects using definitional equality.

5.1.3 Type formers in the setoid model

Let σ ∈ Fam(Γ) and τ ∈ Fam(Γ · σ). The dependent product Π(σ, τ) is defined by

Π(σ, τ)_{set} = σ_{set} → τ_{set}
Π(σ, τ)_{rel}[γ: Γ_{set} , u, v: Π(σ, τ)_{set}] =
∀s, s′: σ_{set}.σ_{rel}[γ, s, s′] ⇒ τ_{rel}[(γ, s) , u s , v s′]

If M ∈ Sect(τ) then we define

λ_{σ,τ}(M)[γ: Γ_{set}] = λs: σ_{set}.M[γ, s]

and conversely, if M ∈ Sect(Π(σ, τ)) and N ∈ Sect(σ) we define

App_{σ , τ}(M, N)[γ: Γ_{set}] = (M[γ] N[γ])

Now by straightforward calculation we obtain:

Proposition 5.1.3 These data endow the model S_{0} with dependent products in the sense of Def. 2.4.14.

In very much the same way we can interpret Σ-types, natural numbers, and various inductive types present in the target type theory. Since the interpretation of these is almost forced we leave it out here. In particular we have (N_{Γ})_{set} = N and (N_{Γ})_{rel}[γ, x, x′] = (x =^{L} x′). This allows us to establish in exactly the same way as in the proof of Prop. 4.5.3 that in the empty context the natural numbers contain canonical elements only, in spite of the extensional concepts (N-canonicity).

5.1.4 Propositions

Our next goal is to identify a type of propositions (and proofs) which allows us to “externalise” the relations associated to each type and to interpret quotient types and extensionality. We use the semantic framework of Def. 2.4.36 (loose model of Constructions). Again, we denote by “Prop” both the family in Fam(⊤), and its comprehension ⊤ · Prop.

To simplify the exposition we assume as in Chapter 4 that the target type theory supports an extensional unit type, i.e. there is a type Γ ⊢ 1_{E} in every context, and a term Γ ⊢ ⋆ : 1_{E} together with the equation Γ ⊢ M = ⋆ : 1_{E} for every Γ ⊢ M : 1_{E}. We shall use the extensional unit type as the underlying type of propositional types. It is possible to get rid of the extensional unit type in the same way as in Section 4.5.4.1, by defining families of setoids as being either of the form defined in Section 5.1.1.2, or to consist simply of a proposition in context Γ_{set} compatible with Γ_{rel} (in which case it is silently understood that the −_{set}-component is the extensional unit type). Comprehension, substitution, and the type formers have then to be defined by case distinction.

Now we are ready to define the required ingredients to interpret propositions. The underlying type of Prop ∈ Fam(⊤) in S_{0} is just the syntactic type of propositions.

Prop_{set} = Prop

In order to identify equivalent propositions we define the relation as bi-implication.

Prop_{rel}[p, q: Prop] = (p ⇔ q)

This is clearly symmetric and transitive and so a family over ⊤ has been defined. Note that Comp degenerates to a tautology in the case of families over ⊤.

The family Prf ∈ Fam(⊤ · Prop) is given by

Prf_{set}[p: Prop] = 1_{E}
Prf_{rel}[p: Prop , x, x′: 1_{E}] = p

where 1_{E} is the extensional unit type. The relation on Prf is trivially symmetric and transitive; for Comp we use the relation on Prop. More precisely, if Prop_{rel}[p, q] and Prf_{rel}[p, x, y], i.e. p, then also q, thus Prf_{rel}[q, x, y].

Next we define universal quantification. If σ ∈ Fam(Γ) and S : Γ · σ → Prop then we put

∀_{σ}(S)[γ: Γ_{set}] = ∀x: σ_{set}.σ_{rel}[γ, x, x] ⇒ S[γ, x]

For property Resp assume γ, γ′: Γ_{set} and Γ_{rel}[γ, γ′]. We must show that ∀_{σ}(S)[γ] ⇔ ∀_{σ}(S)[γ′]. So assume ∀_{σ}(S)[γ] and x: σ_{set} with σ_{rel}[γ′, x, x]. Using Sym and Comp we get σ_{rel}[γ, x, x], hence S[γ, x] by assumption. Property Resp for S using Γ_{rel}[γ, γ′] and σ_{rel}[γ, x, x] gives S[γ, x] ⇔ S[γ′, x] and thus S[γ′, x] as required. The other direction is symmetric. We see that the relativisation to “existing” x: σ_{set} is necessary to prove Resp.

For the abstraction let M ∈ Sect(Prf{S}). We define

λ_{σ,S}(M)[γ: Γ_{set}] = ⋆

To see that this is indeed a section of Prf{∀_{σ}(S)} assume γ, γ′: Γ_{set} and Γ_{rel}[γ, γ′]. We must show that

Prf{∀_{σ}(S)}_{rel}[γ, λ_{σ,S}(M)[γ] , λ_{σ,S}(M)[γ′]]

which equals ∀x: σ_{set}.σ_{rel}[γ, x, x] ⇒ S[γ, x] by definition of Prf_{rel} and ∀. Now assuming x: σ_{set} and σ_{rel}[γ, x, x] we have that (Γ·σ)_{rel}[(γ, x) , (γ′, x)], hence S[γ, x] by Resp for M.

Finally, the evaluation morphism is given by

ev_{σ,S}[γ: Γ_{set} , x: σ_{set} , u: 1_{E}] = (γ, x, ⋆)

We must show that this defines a morphism from Γ · σ ·Prf{∀_{σ}(S) ∘ p(σ)} to Γ · σ · Prf{S}. Assume γ, γ′: Γ_{set}, x, x′: σ_{set} with Γ_{rel}[γ, γ′] and σ_{rel}[γ, x, x′]; furthermore assume ∀x: σ_{set}.σ_{rel}[γ, x, x] ⇒ S[γ, x] (meaning that the two variables of unit type corresponding to Prf{∀_{σ}(S) ∘ p(σ)} are “related” according to the definition of Prf_{rel}). We must show that S[γ, x]. But this follows since by Sym and Trans for Γ we have Γ_{rel}[γ, γ] and thus σ_{rel}[γ, x, x] by Sym and Trans for σ.

The equations relating evaluation and abstraction follow straightforwardly from the properties of the extensional unit type. Also the stability under substitution of all components follows readily by expanding the definitions.

Proposition 5.1.4 The model S_{0} is a loose model of the Calculus of Constructions.

5.1.4.1 Proof irrelevance and extensionality

Next we explore which additional propositions are provable in S_{0}. First, we have a non-provability result:

Proposition 5.1.5 (Consistency) The family

ff := Prf{∀_{Prop}(id_{Prop})} ∈ Fam(⊤)

has no sections.

Proof. We have ff_{set} = 1_{E} and ff_{rel}[x, y: 1_{E}] = ∀p: Prop.Prop_{rel}[p, p] ⇒ p. A section of ff consists of an element of 1_{E} (necessarily ⋆) such that ∀p: Prop.(p ⇔ p) ⇒ p (expanding Prop_{rel}). But this is not possible by consistency of the syntax.

□

Next we look at Leibniz equality in the model. If σ ∈ Fam(Γ) and M, N ∈ Sect(σ) then let L Eq(M, N) : Γ → Prop be the denotation of Leibniz equality as given in Def. 4.5.6. By unfolding its definition we find that in S_{0}

L Eq(M, N)[γ: Γ_{set}] =

∀P: σ_{set} → Prop.
(∀x, x′: σ.σ_{rel}[γ, x, x′] ⇒ ((P x) ⇔ (P x′))) ⇒
∀y: 1_{E}.(P M[γ]) ⇒ (P N[γ])

So (modulo the trivial quantification over 1_{E}) M and N are Leibniz equal in the model if they are indistinguishable by observations which respect the relation on σ.

Lemma 5.1.6 Let σ ∈ Fam(Γ) and M, N ∈ Sect(σ). The family Prf{L Eq(M, N)} over Γ has a section iff

γ: Γ_{set} , Prf(Γ_{rel}[γ, γ]) ⊢ σ_{rel}[γ, M[γ], N[γ]] true

Proof. Assume a section of Prf{L Eq(M, N)}. By definition this means that if Γ_{rel}[γ, γ′] for some γ, γ′: Γ_{set} then M[γ] and N[γ] (not N[γ′]!) are indistinguishable by observations respecting σ_{rel}. Now

λx: σ_{set}.σ_{rel}[γ, M[γ], x]

is such an observation as can be seen using Sym and Trans for σ and Γ_{rel}[γ, γ] by virtue of Γ_{rel}[γ, γ′] and Sym, Trans for Γ. Therefore, we can deduce σ_{rel}[γ, M[γ], N[γ]] provided we can show σ_{rel}[γ, M[γ], M[γ]], but this follows from Resp for M. Conversely, if σ[γ, M[γ], N[γ]] and P : σ → Prop respects σ_{rel} then obviously (P M[γ]) ⇒ (P N[γ]) by definition of “respects”. □

Thus Leibniz equality “externalises” the relation associated to each family.

Proposition 5.1.7 The following rules providing proof irrelevance as well as functional and propositional extensionality can be interpreted in S_{0}.

\frac{Γ ⊢ A : Prop  Γ ⊢ M, N : Prf(A)}{Γ ⊢ M = N : Prf(A)} Pr-Ir

\frac{Γ ⊢ P : Prop  Γ ⊢ Q : Prop  Γ ⊢ H : Prf(P ⇔ Q)}{Γ ⊢ Bi Imp(P, Q, H) : Prf(P =^{L} Q)} Bi-Imp

\frac{\begin{matrix}Γ ⊢ U, V : Πx: σ.τ \\ Γ, x: σ ⊢ H : Prf(U x =^{L} V x) \end{matrix}}{Γ ⊢ Ext(H) : Prf(U =^{L} V)} Ext

Proof. We identify syntactic objects with their denotations in S_{0}. Rule Pr-Ir is immediate because both M and N equal ⋆. For rule Bi-Imp assume P, Q ∈ Sect(Prop{!_{Γ}}). The assumption H gives rise to a proof of P [γ] ⇔ Q[γ] for every γ : Γ_{set} with Γ_{rel}[γ, γ]. But by Lemma 5.1.6 this implies that there exists a section of Prf{L Eq(P, Q)}. The proof for Ext is similar. □

Now we present a somewhat unexpected feature of Leibniz equality, namely that it behaves like Martin-Löf’s identity type in the sense that a Leibniz principle for dependent types can be interpreted from which the definability of Martin-Löf’s elimination rule [85] follows using Pr-Ir and the encoding of J in terms of Subst and IdUni given in Sect. 3.2.3.1.

Proposition 5.1.8 For each σ ∈ Fam(Γ) and τ ∈ Fam(Γ·σ) and M, N ∈ Sect(σ) and P ∈ L Eq(M, N) and U ∈ Sect(τ\{\overline{M}\}) there exists a well-determined section Subst_{σ,τ}(P, U) ∈ Sect(τ\{\overline{N}\}) in such a way that Subst_{σ,τ}(Refl(M), U) = U where Refl(M) is the canonical section of Prf{L Eq(M, M)} corresponding to reflexivity. Moreover, this operator Subst is stable under substitution in all its arguments.

Proof. We define Subst_{σ,τ}(P, U) simply as U. That this is a section of τ\{\overline{N}\} follows from Lemma 5.1.6 applied to P and rule Comp for the family τ. The other properties are trivially satisfied. □

Obviously, this means that we can interpret rules Leibniz and Leibniz-Comp from Sect. 3.2.3.1 with Id_{σ}(M, N) replaced by Prf(M =^{L} N). As long as we do not use induction over definable families the semantic formulation of closure properties as in Prop. 5.1.8 above and the more syntactic one in Prop. 5.1.7 are equivalent and it is a mainly a matter of presentation which one is being used.

Prop. 5.1.8 is important because it states that S_{0} has the same strength as TT_{I} and thus is conservative over extensional type theory (TT_{E}) by Thm. 3.2.5.

5.1.4.2 Axiom of choice

We may start with a target type theory in which the “internal axiom of choice” [5], i.e. the following schema of propositions

\frac{Γ ⊢ σ Γ ⊢ τ}{Γ ⊢ (∀x: σ.∃y: τ.R[x, y]) → (∃f: σ → τ.∀x: σ.R[x, f x]) true} IAC

holds.^{1} Then in the source type theory this axiom is nevertheless not in general valid because in its translation the witness f is required to respect the equivalence relations present on σ and τ which cannot be guaranteed for the witness produced by IAC in the target type theory. In fact one can show by mimicking Diaconescu’s argument (see [59, II.7]) that IAC together with Ext and Bi-Imp implies the principle of the excluded middle, ∀p: Prop.p ∨ (p ⇒ ff); if this holds in the source type theory then it must hold in the target type theory. This in turn is not necessarily the case even if IAC is present in the target type theory. The fact that the axiom of choice may fail because a choice function fails to preserve extensional equality is well-known and is e.g. discussed in [106,36]. See also the example with real numbers in Sect. 5.1.7.1 below.

We conjecture, however, that in the particular case where the type σ in IAC is N (“countable choice”) or any other type with Leibniz equality as the relation we can actually interpret IAC in the source type theory provided we have it for the target type theory. The reason is that this relation is always preserved. See also Remark 5.1.11 below. The same goes for the principle of dependent choice, see e.g. [32, Sect. 4.4.3]:

∀x: σ.∃y: σ.R[x, y] → ∀x: σ.∃f: N → σ.(f 0 =^{L} x) ∧ (∀n: N.R[f n, f(Suc(n))])

where again the choice function has domain N. The internal axiom of choice must not be confused with the following “proof-relevant” version of the axiom of choice, which is obviously inhabited:

1IAC is not valid in the Calculus of Constructions, but it does hold in its set-theoretic interpretation of it.

Πx: σ.Σy: τ.Prf(P [x, y]) → Σf: σ → τ.Πx: σ.Prf(P [x, y])

The difference is that elements of a Σ-type are distinct if they have different witnesses, whereas all proofs of an existential statement are identified.

5.1.4.3 Church’s thesis

Another principle which gets lost when passing from the target type theory to the source type theory is Church’s thesis in the following formulation:

CT = ∃F: (N → N) → N.∀f: N → N.computes[F f, f]

where

computes[e: N, f: N → N] = ∀n: N.∃z: N.(f n =^{L} U[z]) ∧ T[e, n, z]

and T is Kleene’s T-predicate and U is the output extraction function. Informally, computes[e, f] expresses that e is (code for a) program which computes f, and CT states that there exists a functional which to every function f: N → N associates a program for it.

If CT holds in the target type theory^{2} then it need not hold in the source type theory, because there is no reason why the witness F should preserve pointwise equality of functions. Even worse, in the source type theory one can actually prove ¬CT by mimicking the proof in [106] that CT together with the axiom of choice and functional extensionality is inconsistent in HA_{ω}. Intuitively, the reason is that in the presence of functional extensionality F must yield equal results when applied to extensionally equal functions, so one can check whether a function is e.g. constantly zero by examining whether F applied to it equals F (λx: N.0).^{3}

2We do not know whether there exists a model of the Calculus of Constructions in which CT is valid, but this seems rather likely since CT is consistent in higher-order intuitionistic arithmetic (HA_{ω}) using a realisability model, which interprets types as subsets of ω rather than partial equivalence relations.[32,104]

Let us point out that the following weaker formulation of CT

CT′ = ∀f: N → N.∃e: N.computes[e, f]

does hold in the source type theory if it holds in the target type theory because it gets translated into basically the same formula. In the presence of IAC this weaker version implies CT, so that S_{0} together with CT′ provides a type theory in which the internal axiom of choice is inconsistent (provided CT′ is consistent in the target type theory.).

We also believe that CT′ can be consistently added to TT_{I} or TT_{E} if we translate the existential quantification using the squash type former to be introduced in Sect. 5.3.5, rather than into a Σ-type.

5.1.5 Quotient types

We now turn to the interpretation of quotient types in the model. Their syntax is given by the following rules:

\frac{Γ ⊢ σ Γ , s, s′: σ ⊢ R[s, s′] : Prop}{Γ ⊢ σ/R} Q-Form  \frac{Γ ⊢ M: σ}{Γ ⊢ [M]_{R}: σ/R} Q-Intro

\frac{Γ ⊢ τ Γ , s: σ ⊢ M[s] : τ  Γ ⊢ N : σ/R Γ , s, s′: σ , p: Prf(R[s, s′]) ⊢ H : Prf(M[s] =^{L} M[s′])}{Γ ⊢ plug_{R} N in M using H : τ} Q-Elim

Γ ⊢ plug_{R} [N]_{R} in M using H = M[N] : τ

Q-Comp

3Per Martin-Löf has told the author that this phenomenon was one of the reasons for him to reject equality reflection (Id-DefEq), which gives functional extensionality and thus makes (a TT_{E}-version of) CT inconsistent.

\frac{Γ ⊢ M, N : σ Γ ⊢ H : Prf(R[M, N])}{Γ ⊢ Qax_{R}(H) : Prf([M]_{R} =^{L} [N]_{R})} Q-Ax

\frac{Γ , x: σ/R ⊢ P [x] : Prop Γ , s: σ ⊢ H : Prf(P [[s]_{R}]) Γ ⊢ M : σ/R}{Γ ⊢ Qind_{R}(H, M) : Prf(P [M])} Q-Ind

This syntax is a formalisation of usual mathematical practice. Rule Q-Form allows the formation of a type σ/R from a type σ and a relation R. We do not require R to be an equivalence relation. Using Q-Intro one constructs elements (“classes”) of σ/R from “representatives”. The rule Q-Elim allows one to construct functions on the quotient type by definition on representatives. The axiom Q-Ax states that classes of related elements are equal; the axiom Q-Ind states that σ/R consists of “classes” only.

For example, we may define a type of integers as Int := N × N/R_{Int} where R_{Int}[u, v: N × N] = (u.1 + v.2 =^{L} u.2 + v.1). The elimination rule now allows us to define functions like addition on the integers and the induction principle together with the equations permits us to derive properties of these functions from their implementations. In examples we assume that various such functions such as +, | − |, and − (negation) have been defined.

5.1.5.1 Comparison to quotient types in TT_{I}

Notice that Q-Ind resembles a special case of the dependent elimination rule Q-I-Elim from Section 3.2.6.1; the additional proviso in Q-I-Elim stating that H preserves R is trivially satisfied in this special situation because of proof irrelevance.

Using Prop. 5.1.8 and the fact that the quotienting relation never appears in the conclusion of a rule we can simulate the rules for quotients given in Sect. 3.2.6.1 in the following way. If s, s′: σ ⊢ ρ[s, s′] we put R[s, s′] := ∃p: ρ[s, s′].tt and σ/ρ := σ/R. We also put [ − ]_{ρ} = [ − ]_{R}. Obviously we have R[s, s′] true if ρ[s, s′] true and conversely, if R[s, s′] true and p: ρ[s, s′] ⊢ P [s, s′] true for some s, s′: σ ⊢ P [s, s′] : Prop then P [s, s′] true by ∃-elimination. Therefore, the rules Q-I-Form, Q-I-Intro, Q-I-Ax are validated. For Q-I-Elim assume x: σ/R ⊢ τ[x] and x: σ ⊢ M[x] : τ[[x]_{R}] such that

x, x′: σ , p: ρ[x, x′] ⊢ H : Prf(Subst_{σ/ρ,τ}(Qax_{ρ}(p), M[x]) =^{L} M[x′])

We put τ′ = Σx: σ/R.τ[x] and

M′[s: σ] = pair([s]_{R}, M[s]) : τ′

Now if R[s, s′] then we can find H : M′[s] =^{L} M′[s′] using R^{Σ}, ∃-elimination, and equality reasoning. Therefore the premises to rule Q-Elim are satisfied. Let N : σ/R and put U = plug_{R} N in M′ using H : τ′. The second projection U.2 has type τ[U.1] rather than τ[N] as we would need it in order to simulate Q-I-Elim. But using Q-Ind (over N) we can construct P : Prf((plug_{R} N in M′ using H).1 =^{L} N), and thus have Subst_{σ/R,τ}(P, U.2) : τ[N] as required. The computation rule Q-I-Comp follows from Q-Comp and the semantic interpretation of Subst as the identity.

5.1.6 Interpretation of quotient types in S_{0}

Let σ ∈ Fam(Γ) and R : Γ · σ · σ^{+} → Prop be a “relation” over σ. Viewed internally R is a term of type γ: Γ_{set} , x, x′: σ_{set} ⊢ Prop such that

γ: Γ_{set} , x, y: σ_{set} , γ′: Γ_{set} , x′, y′: σ_{set} ,
Prf(Γ_{rel}[γ, γ′] ∧ σ_{rel}[γ, x, x′] ∧ σ_{rel}[γ, y, y′]) ⊢
R[x, y] ⇔ R[x′, y′] true

We say that R “respects” σ_{rel}. Our aim is to define a new family σ/R on which the relation is given by R. The underlying type remains unchanged by quotienting.

(σ/R)_{set}[γ] = σ_{set}[γ]

Now since R is not guaranteed to be symmetric and transitive, we have to take the symmetric and transitive closure of R, moreover we must ensure compatibility with σ_{rel} — the relation already present on σ. It turns out that the right choice for (σ/R)_{rel} is the following higher-order encoding of symmetric, transitive closure.

(σ/R)_{rel}[γ: Γ_{set} , s, s′: σ_{set}] =

∀R′: σ_{set} → σ_{set} → Prop.

(∀x, x′: σ_{set}.(R′ x x′) ⇒ (R′ x′ x))  (σ)
⇒ (∀x, x′, x′′: σ_{set}.(R′ x x′) ⇒ (R′ x′ x′′) ⇒ (R′ x x′′))  (τ)
⇒ (∀x, x′: σ_{set}.σ_{rel}[γ, x, x′] ⇒ (R′ x x′))  (ρ)
⇒ (∀x, x′: σ_{set}.R[γ, x, x′] ⇒ σ_{rel}[γ, x, x] ⇒ σ_{rel}[γ, x′, x′] ⇒ (R′ x x′)) (κ)
⇒ (R′ s s′)

In other words, (σ/R)_{rel}[γ, −, −] is the least partial equivalence relation on σ_{set} which contains σ_{rel}[γ, −, −] and R[γ, −, −] restricted to the domain of σ_{rel}[γ, −, −]. We shall call such a relation suitable, so (σ/R)_{rel} is the least suitable relation.

5.1.6.1 Equivalence classes

Assume M ∈ Sect(σ). We want to construct a section [M]_{R} of σ/R. We put

[M]_{R}[γ] = M[γ]

so [M]_{R} behaves just like M. We must prove Resp for [M]_{R}. Let γ, γ′: Γ_{set} and Γ_{rel}[γ, γ′]. Moreover, let R′: σ_{set} → σ_{set} → Prop be a suitable relation. We must show that R′[M[γ], M[γ′]]. But since M is a section we have σ_{rel}[γ, M[γ], M[γ′]] so we are done since suitable relations contain σ_{rel}[γ, −, −].

For Q-Ax assume M, N ∈ Sect(σ) and H ∈ Sect(Prf\{R ∘ \overline{N^{+}} ∘ \overline{M}\}), i.e.

γ, γ′: Γ_{set} , Prf(Γ_{rel}[γ, γ′]) ⊢ R[γ, M[γ], N[γ]] true

We want to show that Sect(Prf{L Eq([M]_{R}, [N]_{R})}) is non-empty. By Lemma 5.1.6 and the definition of [ −]_{R} it suffices to show that

γ: Γ_{set} , Prf(Γ_{rel}[γ, γ]) ⊢ σ/R_{rel}[γ, M[γ], N[γ]] true

In this context we can show σ_{rel}[γ, M[γ], M[γ]] and σ_{rel}[γ, N[γ], N[γ]] using Resp. Thus for every suitable relation R′: σ_{set} → σ_{set} → Prop we have (R′ M[γ] N[γ]) by (κ) which gives the desired result.

5.1.6.2 Lifting

Now we want to define functions on the quotient family σ/R, from functions on σ which respect R. More precisely, suppose we are given τ ∈ Fam(Γ) and M ∈ Sect(τ{p(σ)}) and

H ∈ Sect(Prf{L Eq( M{p(σ^{+}) ∘ p(Prf{R})},

M{q(p(σ), σ) ∘ p(Prf{R})}
)})

(The two sections inside L Eq are instances of M applied to one of the σ-variables in Γ · σ · σ^{+} · Prf{R}. Thus informally H states that M maps R-related elements to Leibniz-equal elements.) Finally assume N ∈ Sect(σ/R). We want to construct a section plug_{R} N in M using H of τ from this. We define

(plug_{R} N in M using H)[γ: Γ_{set}] = M[γ , N[γ]]

Let γ, γ′: Γ_{set} and Γ_{rel}[γ, γ′]. Since N ∈ Sect(σ/R) we have (σ/R)_{rel}[γ, N[γ], N[γ′]]. Now consider the particular relation

R′ = λx, x′: σ_{set}.
σ_{rel}[γ, x, x]∧
σ_{rel}[γ, x′, x′]∧
τ_{rel}[γ, M[γ, x], M[γ′, x′]]

Now the result follows provided we can show that R′ is suitable. This requires a somewhat lengthy calculation in which H is used to establish that R′ extends R.

5.1.6.3 Induction

Finally, we interpret the induction principle Qind. Assume P : Γ · σ/R → Prop and let an element of Sect(Prf\{P ∘ q(p(σ), σ/R) ∘ \overline{[v_{σ}]_{R^{+}}}\}) be given. In other words assume

γ, γ′: Γ_{set} , Prf(Γ_{rel}[γ, γ′]) , s, s′: σ_{set} , Prf(σ_{rel}[γ, s, s′]) ⊢ P [s] true

Now, if M ∈ Sect(σ/R) then we want to find a section of Prf\{P ∘ \overline{M}\}, i.e. we must show

γ, γ′: Γ_{set} , Prf(Γ_{rel}[γ, γ′]) ⊢ P [M[γ]] true

In this context we find σ/R_{rel}[γ, M[γ], M[γ]] using Sym and Trans and Resp. Now putting s = s′ = M[γ] the result follows if we can show (the stronger condition) σ_{rel}[γ, M[γ], M[γ]]. But this follows by using the suitable relation

R′ := λx, x′: σ_{set}.σ_{rel}[γ, x, x] ∧ σ_{rel}[γ, x′, x′]

Proposition 5.1.9 The setoid model S_{0} allows the interpretation of quotient types.

5.1.6.4 Effectiveness of quotient types

Here we want to address the question as to whether the converse to Q-Ax is also true, i.e. whether we can conclude R[M, N] from [M]_{R} =^{L} [N]_{R}. In general, this cannot be the case because together with Q-Ax this implies that R is an equivalence relation. Quotient types are called effective [54,82] if this condition is already sufficient. It turns out that in S_{0} all quotient types are effective and that this is a purely syntactic consequence of the rules for quotient types and rule Bi-Imp.

Proposition 5.1.10 Fix a type theory with quotient types and Bi-Imp. Let Γ ⊢ σ and Γ , x, y: σ ⊢ R[x, y] : Prop be an equivalence relation, i.e. in context Γ we have

∀x: σ.R[x, x] true  (reflexivity)
∀x, y: σ.R[x, y] ⇒ R[y, x] true  (symmetry)
∀x, y, z: σ.R[x, y] ⇒ R[y, z] ⇒ R[x, z] true (transitivity)

Then for each Γ ⊢ U, V: σ with [U]_{R} =^{L} [V]_{R} we have R[U, V].

Proof. Consider the term M[y: σ] = R[U, y] : Prop. We have

Γ , y, y′: σ , R[y, y′] ⊢ M[y] =^{L} M[y′] true

by symmetry and transitivity and Bi-Imp. Let H denote the proof of this. Now put

M′[z: σ/R] = plug_{R} z in M using H : Prop

By Q-Comp M′[[U]_{R}] equals R[U, U] and M′[[V]_{R}] equals R[U, V]. The former is true by reflexivity of R and both are Leibniz equal by assumption on U and V. Therefore R[U, V] is true as well. □

Remark 5.1.11 (Quotient types without impredicativity) Remark 4.6.1 on the role of impredicativity for subset types applies mutatis mutandis also to S_{0}. We have used the impredicative Calculus of Constructions as a target type theory (and as the basis of the source type theory) mainly for convenience because it offers encodings of the logical connectives and equality so that their existence does not have to be verified in the model. Also effectiveness of quotients can then be derived in the source type theory. However, if for certain reasons one wants to stay within a predicative framework such as Martin-Löf type theory one can still interpret a type theory with a sort rather than a type of propositions. One reason why one might want to do this is that Martin-Löf type theory as a target type theory satisfies the internal axiom of choice so that one could hope to interpret the principles of countable choice and dependent choice in the source type theory as indicated in Sect. 5.1.4.2 above. The details are left to future research.

5.1.7 A choice operator for quotient types

Our next goal consists of finding a way of getting hold of a representative for a given element of a quotient type. The idea is that since in the model an element M of a quotient type is nothing but an element of the underlying type, albeit with a weaker Resp requirement, it should under certain circumstances be possible to view M as an element of this underlying type. In other words we seek to interpret a rule of the form

\frac{Γ ⊢ M : σ/R  “certain proviso”}{Γ ⊢ choice(M) : σ} Q-Choice

and the following two equality rules.

\frac{Γ ⊢ choice([M]_{R}) : σ  Γ ⊢ M : σ}{Γ ⊢ choice([M]_{R}) = M : σ} Q-Choice-Comp
\frac{Γ ⊢ M : σ/R  Γ ⊢ choice(M) : σ}{Γ ⊢ [choice(M)]_{R} = M : σ/R} Q-Choice-Ax

There is no error in rule Q-Choice-Comp; we explain in Sect. 5.1.7.1 how it can be consistent with Q-Ax. Semantically, we want to interpret the choice operator as the identity, i.e. if M ∈ Sect(σ/R) then we want to put choice(M)[γ: Γ_{set}] = M[γ]. Now from M ∈ Sect(σ/R) we can deduce that if Γ_{rel}[γ, γ′] for some γ, γ′: Γ_{set} then σ/R_{rel}[γ, M[γ], M[γ′]]. But in order to conclude choice(M) = M ∈ Sect(σ) we need to have (the stronger) σ_{rel}[γ, M[γ], M[γ′]]. One situation in which we can deduce the latter from the former occurs when from Γ_{rel}[γ, γ′] we can conclude that M[γ] and M[γ′] are actually Leibniz equal, because then we can reason like in Sect. 5.1.6.3 above. Now this situation in turn occurs for example when Γ_{rel}[γ, γ′] entails that γ and γ′ are Leibniz equal themselves. This motivates the following definition.

Definition 5.1.12 The set of non-quotiented types is defined by the following clauses.

– N (and other inductive types) and Πx_{1}: σ_{1} … Πx_{n}: σ_{n}.Prf(M) for n ≥ 0 are non-quotiented.

– If σ and τ are non-quotiented, so is Σx: σ.τ.

A (syntactic) context Γ is non-quotiented if it is made up out of non-quotiented types only.

Notice that if ⊢ Γ = Δ and Γ is non-quotiented then so is Δ.

Proposition 5.1.13 Let Γ be a non-quotiented syntactic context and let (Γ_{set}, Γ_{rel}) be its interpretation in the setoid model. We have

γ, γ′: Γ_{set} , Γ_{rel}[γ, γ′] ⊢ γ.i =^{L} γ′.i true

Proof. Easy induction on the definition of “non-quotiented”. □

Now we could semantically justify the application of choice in non-quotiented contexts, i.e. the above “certain proviso” would be that Γ is non-quotiented. With such a rule we would, however lose the syntactic weakening and substitution properties which are implicit in e.g. the typing rule for application. For example if ⊢ M : σ/R we can infer ⊢ choice(M) : σ because the empty context is nonquotiented, but we would not have x: σ/R ⊢ choice(M) : σ although x does not occur in M. Therefore, we close the rule up under arbitrary substitution and weakening and thus arrive at the following definitive rule for choice:

Γ ⊢ M : σ/R There exists a non-quotiented context Δ and a type τ and a term N with Δ ⊢ N : τ and a syntactic context morphism Γ ⊢ f ⇒ Δ such that M ≡ N[f] and σ/R ≡ τ[f]. Γ ⊢ choice(M) : σ

Q-Choice

Recall that ≡ means syntactic identity and not just definitional equality so that the side condition is decidable since the possible substitutions f are bounded by the size of M. The condition is e.g. satisfied for z: Int ⊢ −|z| : Int with Δ = n: N and f[z: Int] = |z|, but it does not hold for z: Int ⊢ z + z : Int

Proposition 5.1.14 The above rules Q-Choice, Q-Choice-Comp, Q-Choi-ce-Ax can be soundly interpreted in the setoid model.

Proof. We interpret choice(M) like M. Suppose that Γ ⊢ choice(M) : σ by Q-Choice then M ≡ N[f] for some (syntactic) substitution f : Γ ⇒ Δ. We identify these syntactic objects with their interpretations. If Γ_{rel}[γ, γ′] then f[γ] and f[γ′] are actually Leibniz equal by Prop. 5.1.13 using the assumption that Δ is non-quotiented. So M[γ] and M[γ′] are Leibniz equal and thus related in σ_{rel} by the same argument as the one used in Sect. 5.1.6.3. Thus we can assert M ∈ Sect(σ). Since both choice and [−]_{R} are interpreted as the identity, the rules Q-Choice-Comp and Q-Choice-Ax are validated. □

5.1.7.1 Discussion

The choice operator is quite unusual and seems paradoxical at first so that a few examples explaining its use are in order. Let −1 := [(0, 1)]_{R_{Int}} and −1′ := [(2, 3)]_{R_{Int}} where 1, 2, 3 are abbreviations for the corresponding numerals of type N and R_{Int} is as defined in Sect. 5.1.5. Now since 0 + 3 =^{L} 1 + 2 we have R_{Int}[(0, 1) , (2, 3)], and thus −1 =^{L} −1′. On the other hand, choice(−1) = (0, 1) and choice(−1′) = (2, 3). It seems as if we could conclude (0, 1) =^{L} (2, 3) which would be a contradiction. Now −1 =^{L} −1′ means

∀P: Int → Prop.(P − 1) ⇒ (P − 1′)

In order to get a contradiction from this, we would have to instantiate with P = λz: Int.choice(−1) =^{L} choice(z). But this expression is not well-typed since z: Int ⊢ choice(z) (the context z: Int contains a quotient type) is not. Thus, in some sense the choice operator does not respect Leibniz equality. As with any term former it does of course respect definitional equality, so in an extensional setting where the two equalities are identified choice would be unsound.

The main usage of the choice operator is that it permits to recover the underlying implementation of a function between quotients internally. For example, if we have defined some function F : Int → Int in non-quotiented context Γ (so in particular F may not just be a variable) then we may form Γ, u: N × N ⊢ F [u]_{R_{Int}} : Int, apply choice and abstract from u to obtain F′ := λu: N × N.choice(F [u]_{R_{Int}}) : (N × N) → (N × N) Now using Q-Choice-Ax we obtain Γ , u: N × N ⊢ F [u]_{R_{Int}} = [F′ u]_{R_{Int}} : Int and moreover—since R_{Int} is an equivalence relation— Γ ⊢ ∀u, v: N × N.R_{Int}[u, v] ⇒ R_{Int}[F′ u, F′ v] using the above and Prop. 5.1.10.

Yet another application of choice arises from the use of quotient types to model “non-constructive” types like the real numbers. Assume that we have defined a type of real numbers Real as a quotient of a suitable subset type RealRep of N → N (thought of as of decimal or continued fraction expansions), the quotienting relation being that the difference is a fundamental sequence defined in the usual ε-δ style. Now since different real numbers can be arbitrarily close together, there can be no non-constant function from the quotient type Real to a ground type like N and, more generally, all functions from Real to Real must be continuous. This has been brought forward as a serious argument against the use of quotienting in a constructive setting, since if one has defined a real number one cannot even put one’s hands on its first digit! Using the choice operator one can at least solve this last problem. Assume that we have defined a real number R in the empty context, say e or π. We may then form ⊢ choice(R) : N → N and from this extract desired intensional information like the first digit or other things. However, it is still not possible to write a non-constant function from the reals to N. Notice that this lack is not particular to the setoid model, but directly inherited from the target type theory which does not provide functions from N → N to N which respect the “book”-equality for real numbers. Similarly, in the setoid model we have no non-constant function from Prop to N because this is so in the target type theory.

The constructive real numbers furnish another illustrative example due to Troelstra [104] for the failure of the axiom of choice because choice functions need not preserve equality. Consider the function f[x] = x^{3} − 3x. Although f is surjective it has no continuous right inverse. In S_{0} surjectivity, that is ∀a: Real.∃x: Real.f[x] =^{L} a, follows using Qind from ∀â: RealRep.∃x: Real.f[x] =^{L} [â]_{R_{Real}} where Real = RepReal/R_{Real}. This in turn is readily established by case distinction on â. But since this case distinction does not preserve equality of real numbers we cannot lift this operation to a function on the real numbers themselves.

5.1.8 Type dependency and universes

As announced earlier, the model S_{0} does not provide any type dependency other than the one induced by propositions. In particular we have neither universes nor “large eliminations” [2]. Formally, this can be seen as follows. Assume that the target type theory contains an empty type 0 and an operator ?_{σ} such that ?_{σ}(M) : σ if M : 0. Then in the setoid model S_{0} we also have this empty type. Now if we had a universe containing the natural numbers and the empty type then we could define a family of types n: N ⊢ σ[n] such that σ[0] = 0 and σ[Suc(n)] = N. Now remember that the −_{set}-component is left unchanged upon substitution. So in view of the first equation (σ[0] = 0) there would have to be a function ?_{τ} : σ_{set} → τ for every type τ which contradicts the second equation if τ = 0.

A major application of such families of types is that they allow to derive Peano’s fourth axiom [85,97]. On the level of propositions we are still able to interpret this axiom, that is we have 0 =^{L} Suc(0) ⇒ ff, provided this holds in the target type theory. The difference is that Prf(ff) is weaker than the empty type because in the presence of an element of Prf(ff) every proposition is true, but not every type is inhabited.

Universes are also used for modularisation and structuring. E.g. using a universe it is possible to define a type of monoids or groups and to identify the construction of the free group over a monoid as a function. If we want to use universes in this way then we are not interested in quotienting the universe itself or types derived from it like U → U. So it should be enough to allow quotienting for small types, i.e. those of the form El(M) for some M : U. Moreover, there does not seem to be a need to define a function from a quotient type into a universe, unless this function arises by weakening or substitution.

We have investigated an extension to the setoid model which admits a universe restricted in the sense that quotient types and inductive types and elimination of them is only allowed within the universe. This will concern us now.

In this model, types (in the empty context for now) are triples σ = (σ_{type}, σ_{set}, σ_{rel}) where σ_{type} is a type, σ_{set} is a family of types indexed by σ_{type} and finally σ_{rel} is a partial equivalence relation on each σ_{set}[s] for s: σ_{type}. It is not possible to compare x: σ_{set}[s] and x′: σ_{set}[s′] unless s, s′: σ_{type} are definitionally equal. Now the universe has −_{type} component U, whereas types of the form El(M) have trivial −_{type} component 1. Quotienting will then only be possible for such “small” types. Similarly, the families in elimination rules like the one for the natural numbers or the one for quotient types will only range over small types. So in particular we cannot define the above family σ over N, because this would require primitive recursion with result type U. Let us now study the model in more detail.

Contexts are defined as triples Γ = (Γ_{type}, Γ_{set}, Γ_{rel}) where Γ_{type} is a syntactic context. Γ_{set} is a syntactic telescope over Γ_{type}. The third component Γ_{rel} is a proposition

g: Γ_{type} , γ, γ′: Γ_{set}[g] ⊢ Γ_{rel}[g, γ, γ′] : Prop

such that Γ_{rel} defines a partial equivalence relation, i.e. we have

g: Γ_{type} , γ, γ′: Γ_{set}[g] ,

Prf(Γ_{rel}[g, γ, γ′]) ⊢ Γ_{rel}[g, γ′, γ] true  Sym

g: Γ_{type} , γ, γ′, γ′′: Γ_{set}[g] ,

Prf(Γ_{rel}[g, γ, γ′]) , Prf(Γ_{rel}[g, γ′, γ′′]) ⊢ Γ_{rel}[g, γ, γ′′] true  Trans

As usual, equality between such contexts is given by definitional equality of all three components. So a context can be seen as a context of deliverables equipped with a partial equivalence relation on each fibre.

A morphism between two contexts Γ, Δ is a pair f = (f_{type}, f_{set}) such that

g: Γ_{type} ⊢ f_{type}[g] : Δ_{type}
g: Γ_{type} , γ: Γ_{set}[g] ⊢ f_{set}[g, γ] : Δ_{set}[f_{type}[g]]

and moreover

g: Γ_{type} , γ, γ′: Γ_{set}[g] ,

Prf(Γ_{rel}[g, γ, γ′]) ⊢ Δ_{rel}[f_{type}[g], f_{set}[g, γ], f_{set}[g, γ′]] true  Resp

A family over context Γ is now given by a triple σ = (σ_{type}, σ_{set}, σ_{rel}) where g: Γ_{type} ⊢ σ_{type}[g]

g: Γ_{type}, s: σ_{type}[g] ⊢ σ_{set}[g, s]
g: Γ_{type} , s: σ_{type}[g] , γ: Γ_{set}[g] , x, x′: σ_{set}[g, s] ⊢ σ_{rel}[g, γ, s, x, x′] : Prop

in such a way that σ_{rel} is symmetric and transitive and compatible with Γ_{rel}, i.e.

g: Γ_{type} , s: σ_{type}[g] , γ: Γ_{set}[g] , x, x′: σ_{set}[g, s] , Sym

Prf(Γ_{rel}[g, γ, γ]) , Prf(σ_{rel}[g, γ, s, x, x′]) ⊢ σ_{rel}[g, γ, s, x′, x] true
g: Γ_{type} , s: σ_{type}[g] , γ: Γ_{set}[g] , x, x′, x′′: σ_{set}[g, s] , Trans
Prf(Γ_{rel}[g, γ, γ]) , Prf(σ_{rel}[g, γ, s, x, x′]) , Prf(σ_{rel}[g, γ, s, x′, x′′])
⊢ σ_{rel}[g, γ, s, x, x′′] true
g: Γ_{type} , s: σ_{type}[g] , γ, γ′: Γ_{set}[g] , x, x′: σ_{set}[g, s] , Comp
Prf(Γ_{rel}[g, γ, γ′]) , Prf(σ_{rel}[g, γ, s, x, x′]) ⊢ σ_{rel}[g, γ′, s, x, x′] true

We notice that since σ_{set} does not depend on Γ_{set} the last axiom Comp can be formulated in the same simple way as before for ordinary setoids. Indeed, in this setup dependency and quotienting are entirely separated. Again, we have the relativisation of symmetry and transitivity to “existing” elements of Γ_{set}.

The remaining structure is forced by the construction, so we leave it to the reader.

More interesting is the definition of the universe in the empty context. We shall require the target type theory to support a universe (U, El). In particular, this universe may be (Prop, Prf) in which case we obtain an impredicative universe in the model different from the semantic universe of propositions which exists too. The universe is defined by

U_{type} = U

U_{set}[X: U] = El(X) → El(X) → Prop
U_{rel}[X: U][R, R′: El(X) → El(X) → Prop] =
(∀x, x′: El(X).(R x x′) ⇒ (R x′ x)∧
(∀x, x′, x′′: El(X).(R x x′) ⇒ (R x′ x′′) ⇒ (R x x′′))∧
(∀x, x′: El(X).(R x x′) ⇔ (R′ x x′))

This means that a morphism f from Γ to ⊤ · U assigns to g: Γ_{type} an element f_{type}[g] : U and to γ: Γ_{set}[g] a relation El(f_{type}[g]) → El(f_{type}[g]) → Prop in such a way that if Γ_{rel}[g, γ, γ] then this relation is symmetric and transitive and moreover if Γ_{rel}[g, γ, γ′] then the relations associated to γ and γ′ are equivalent. In other words such a morphism induces a family over Γ. This family is formally obtained by substituting f into the generic family El ∈ Fam(⊤ · U) defined by

El_{type}[X: U] = 1
El_{set}[X: U, u: 1] = El(X)
El_{rel}[X: U , u: 1 , R: X → X → Prop , x, x′: El(X)] = R x x′

It is easy to check that this indeed defines a family, because symmetry and transitivity are relativised to those R: X → X → Prop for which U_{rel}[X, R, R] holds.

The universe thus obtained is closed under all type formers the original universe from the underlying type theory is closed under and in addition it is closed under quotient types. We leave the details to future work.

5.2 The groupoid model

We have seen in the last section that the setoid model S_{0} is of rather limited use when one wants to interpret genuine type dependency other than the one arising from proofs depending on propositions. For instance, we were unable to define a family of types over the natural numbers by primitive recursion. The reason was that the set-part of a family did not depend on the set-part of its context, only the relations were made dependent. In order to overcome these limitations an obvious change is to make the −_{set}-parts dependent, too. So a setoid depending on a context of setoids Γ would consist of a type in context Γ_{set}, i.e. Γ_{set} ⊢ σ_{set} and an equivalence relation on each of the σ[γ], i.e. Γ_{set} , x, x′: σ_{set} ⊢ σ_{rel} together with terms refl, sym, trans having the appropriate types. Now in order to define context extension one needs a relation on the context Γ, x: σ_{set}. This means that there must be a way of comparing elements in σ_{set}[γ] and σ_{set}[γ′] if γ and γ′ are related. A natural way of achieving this consists of assuming functions mediating between the two, i.e. a term

γ, γ′: Γ_{set} , p: Γ_{rel}[γ, γ′] , x: σ_{set}[γ] ⊢ σ_{reindex}[p, x] : σ_{set}[γ′]

One would then expect that σ_{reindex} sends related elements to related elements and so forth. It is because the proof p of Γ_{rel}[γ, γ′] is used computationally in σ_{reindex} that all the relations have to be proper dependent types and not just families of propositions. Another way, which we pursue in Section 5.3, consists of defining the relations σ_{rel} between elements in different fibres σ_{set}[γ] and σ_{set}[γ′]. The component σ_{reindex} is, however, still needed.

Now it turns out that in order to obtain a model of type theory along these lines one needs to impose certain equational constraints on these proofs of relatedness and also on the witnesses refl, sym, trans which cannot be guaranteed in a purely syntactic model. The construction can, however, be carried through in an extensional set-theoretic framework and is of interest for the following three reasons.

First, the model shows that from the identity elimination rule J alone it is not possible to prove that any two elements of an identity type are propositionally equal, that is it provides the proof promised in Sect. 3.1.2 that the additional elimination rule IdUni introduced there is indeed necessary.

Second, the model gives a semantic view on the dichotomy between definitional and propositional equality. Definitional equality is the ambient set-theoretic equality in the model, whereas propositional equality gets interpreted as generalised isomorphism. This establishes in particular the soundness of a rule which defines propositional equality between elements of a universe as isomorphism.

Thirdly, we consider the model as the “correct” definition of dependent setoids as opposed to the somewhat ad hoc formulation in Sect. 5.3 below. This latter construction is motivated and clarified by the interpretation we shall give now.

Since in the model types are interpreted as groupoids, that is small categories with isomorphisms only, we call the model the groupoid interpretation of type theory. Much of the material presented here has been published in a joint paper with Streicher [47]. A similar model has independently been studied by Lamarche [58] without, however, noticing the implications on propositional equality. In [47] the model was described in rather abstract terms using the notion of fibration of groupoids. Here we give an elementary description avoiding categorical language as much as possible. We use informal Martin-Löf type theory to denote sets and families of sets as well as elements. In particular we write Πx∈ X.S(x) for the cartesian product of a family of sets S indexed over a set X, and we use Σx∈ X.S(x) for the disjoint union of all sets in an X-indexed family S. We denote pairing by (x, y) and projections by x.1 and x.2. Also we use λx∈ A. … and M N for set-theoretic functional abstraction and application, respectively.

In the following we define groupoids and families of groupoids and show how they give rise to a syntactic category with attributes which interprets the standard type formers including universes and the intensional identity type, but which nevertheless violates uniqueness of identity. Functional extensionality will be available, though.

5.2.1 Groupoids

Definition 5.2.1 A groupoid is a small category in which all morphisms are isomorphisms.

In elementary terms a groupoid X consists of a set X_{set} and a “proof-relevant” relation on it, i.e. for each x, y ∈ X_{set} a set X_{rel}(x, y) which is provably an equivalence relation. This means that there are functions

refl ∈ Πx∈ X_{set}.X_{rel}(x, x)
sym ∈ Πx, y∈ X_{set}.X_{rel}(x, y) → X_{rel}(y, x)
trans ∈ Πx, y, z∈ X_{set}.X_{rel}(y, z) × X_{rel}(x, y) → X_{rel}(x, z)

Notice the order of arguments to trans which differs from the one used for transitivity of Id or of setoids in Sect. 5.1. We have adopted the applicative order here to be in line with usual practice in category theory.

Moreover, these functions must satisfy the following equations.

trans(p, trans(q, r)) = trans(trans(p, q), r) trans(p, refl) = p = trans(refl, p) trans(p, sym(p)) = refl trans(sym(p), p) = refl

where we have omitted the X-arguments. If X is a groupoid we refer to its components by X_{set}, X_{rel}, X_{refl}, X_{sym}, X_{trans}. If the groupoid we are referring to is clear from the context we use the following abbreviations

ι := X_{refl}(x)
pq := X_{trans}(p, q)
p^{−1} := X_{sym}(p)

We also sometimes leave out the −_{set} and −_{rel} subscripts.

Examples. For each set X we have the discrete groupoid ∇(X) defined by ∇(X)_{set} = X and ∇(X)_{rel}(x, y) = {⋆} if x = y and ∅ otherwise.

If X is a set and G is a group we define a groupoid G ⊗ X by (G ⊗ X)_{set} = X and (G ⊗ X)_{rel}(x, y) = G if x = y and ∅ otherwise. Here refl, sym, and trans are defined in the obvious way using the group structure.

Every topological space X gives rise to a groupoid with underlying set being the set of points |X | of X and with the set of morphisms between points x and y being the set of paths from x to y quotiented by homotopy, i.e. two paths are identified if there exists a continuous mapping sending one to the other. For example the groupoid thus associated to the surface of a ball is the discrete one element groupoid ∇(|X |) and the groupoid associated to the surface of a torus is the groupoid Z ⊗ |X |.

Every type Γ ⊢ σ in intensional type theory TT (without extensional concepts) gives rise to a groupoid G(σ) in the following way. The underlying set G(σ)_{set} is the set of terms Γ ⊢ M : σ and the set of morphisms G(σ)_{rel}(M, N) between terms Γ ⊢ M, N : σ is the set of proofs Γ ⊢ P : Id_{σ}(M, N) quotiented by propositional equality, i.e. Γ ⊢ P : Id(M, N) and Γ ⊢ Q : Id(M, N) are identified if Γ ⊢ Id(P, Q) is inhabited. Identity, composition, and inverses are given by Refl_{σ}, Trans_{σ}, and Sym_{σ} which are readily seen to lift to the quotient using Resp . The proof of the groupoid equations is a nice application of the elimination rule Id − Elim − J.

Remark 5.2.2 The definition of groupoids also makes perfect sense in intensional type theory replacing “set” by “type” or “context”. The problem is that not many groupoids exist if we ask the defining equations to hold in terms of definitional equality. Indeed we see below why this definition would not be closed under most type formers, notably function space and Π-type.

Definition 5.2.3 Let X and Y be groupoids. A morphism of groupoids from X to Y is a functor from X to Y when viewed as categories.

In elementary terms such a morphism f consists of a function f_{fun} : X_{set} → Y_{set} and a “proof” that f_{fun} respects the relations, i.e. a function

f_{resp} : Πx, y∈ X_{set}.X_{rel}(x, y) → Y_{rel}(f_{fun}(x), f_{fun}(y))

Moreover, this proof must respect refl and trans, i.e.

f_{resp}(ι) = ι

resp(pq) = resp(p)resp(q)

From this it follows that sym is also preserved. We omit the −_{fun} and −_{resp} subscripts if no confusion can arise.

Example. If Γ ⊢ σ, τ are types in intensional type theory and Γ, x: σ ⊢ F [x] : τ is a “function” from σ to τ then F induces a morphism of groupoids G(F) from G(σ) to G(τ) by G(F)_{fun}(M) := F [M] and G(F)_{resp}(P) = Resp_{σ,τ}(F, P). Again, the required equations are readily verified using Id-Elim-J.

Proposition 5.2.4 Groupoids with morphisms of groupoids form a cartesian closed category.

Proof. Composition and identities are their set-theoretic companions taken for the element and resp-part separately. The terminal object 1 is the discrete oneelement groupoid denoted ∇({⋆}); the cartesian product is the product category. We give the explicit construction of the exponential X ⇒ Y of two groupoids X and Y.

(X ⇒ Y)_{set} = “the set of morphisms from X to Y ”

(X ⇒ Y)_{rel}(f, g) = “the set of natural transformations from f to g”

Thus an element of (X ⇒ Y)_{rel}(f, g) is a function

μ ∈ Πx∈ X_{set}.Y_{rel}(f(x), g(x))

such that for each p ∈ X_{rel}(x, y) the equation

μ(x)g(p) = f(p)μ(y)

holds. The groupoid structure is given by

ι(x) = ι
pq(x) = p(x)q(x)
p^{−1}(x) = (p(x))^{−1}

If f is a groupoid morphism from Z × X to Y its abstraction λ(f) is a groupoid morphism from Z to X ⇒ Y. If z ∈ Z_{set} then λ(f)(z) is the functor which sends x ∈ X_{set} to f(z, x) and p ∈ X_{rel}(x, x′) to f(ι, p). Now if q ∈ Z_{rel}(z, z′) then λ(f)(q) is a natural transformation from λ(f)(z) to λ(f)(z′). Its component at x ∈ X_{set} is f(q, ι). The naturality condition amounts to checking that f(q, ι)f(ι, p) = f(ι, p)f(q, ι) which follows since f preserves transitivity (composition) in X × Y. It remains to verify the functor laws for λ(f). We have

λ(f)(ι)(x) = f(ι, ι) = ι
λ(f)(pq)(x) = f(pq, ι) = f((p, ι)(q, ι)) = f(p, ι)f(q, ι)

We leave it to the reader to define the evaluation morphism and to check the β and η equations. □

The exponential of groupoids cannot be defined syntactically in intensional type theory, because there is no way to restrict the type-theoretic function space in such a way that only those functions are included which preserve reflexivity and transitivity up to definitional equality. An encoding in extensional type theory should, however, be possible.

The assignment ∇(−) of groupoids to sets extends to a functor between these categories and as such has a left adjoint Δ which sends a groupoid G to the quotient set G_{set}/∼ where g ∼ g′ ⇔ G_{rel}(g, g′) ≠ ∅.

Definition 5.2.5 Let Γ be a groupoid. A family of groupoids indexed over Γ is a functor from Γ viewed as a category to the category of groupoids. The set^{4} of families over a groupoid Γ is denoted Fam(Γ).

In elementary terms a family of groupoids over Γ consists of a groupoid σ(γ) for each element γ ∈ Γ_{set}. Moreover, these groupoids must be compatible with each other, i.e. there is a reindexing function

σ_{reindex} ∈ Πγ, γ′∈ Γ_{set}.Γ_{rel}(γ, γ′) → σ(γ)_{set} → σ(γ′)_{set}

and a “proof” that this operation respects the relations, i.e. a function

σ_{resp} ∈ Πγ, γ′∈ Γ_{set}.Πp∈ Γ_{rel}(γ, γ′).Πu, v∈ σ(γ)_{set}.
σ(γ)_{rel}(u, v) → σ(γ′)_{rel}(σ_{reindex}(p, u), σ_{reindex}(p, v))

So far we have the notion of dependent setoid sketched in the introduction to this section. But now again we impose further equational constraints. Both σ_{reindex} and σ_{resp} must respect the groupoid structure, i.e.

σ_{reindex}(ι, u) = u
σ_{reindex}(pq, u) = σ_{reindex}(p, σ_{reindex}(q, u))
σ_{resp}(ι, p) = p

4This is meant to be a “naive” set. In order to avoid size problems one might require the groupoids taken on by the functor to be small w.r.t. some universe.

σ_{resp}(pq, r) = σ_{resp}(p, σ_{resp}(q, r))
σ_{resp}(p, ι) = ι
σ_{resp}(p, qr) = σ_{resp}(p, q)σ_{resp}(p, r)

If σ is a family of groupoids indexed over Γ we refer to its components by σ_{set}, σ_{rel}, σ_{refl}, σ_{sym}, σ_{trans}. We thus allow both σ_{rel}(γ , s, s′) and σ(γ)_{rel}(s, s′) to denote relatedness of s and s′ in the fibre over γ ∈ Γ_{set}. If the family under consideration is clear from the context, we abbreviate σ_{reindex}(p, u) by p · u and also σ_{resp}(p, q) by p · q in accordance with the convention to use the same name for object and morphism part of a functor (For p ∈ Γ_{rel}(γ, γ′) the pair (σ_{reindex}(p, −), σ_{resp}(p, −)) is a functor from σ(γ) to σ(γ′).).

Examples. Every family of sets {S_{x}}_{x∈X} induces a family of (discrete) groupoids indexed over ∇(X) in the obvious way. Moreover if X and Y are groupoids we define the constant family Const(X, Y) over X by

Const(X, Y)_{set}(x) = Y_{set}  independent of x ∈ X_{set}
Const(X, Y)_{rel}(x, y, y′) = Y_{rel}(y, y′)
Const(X, Y)_{reindex}(p, y) = y
Const(X, Y)_{resp}(p, q) = q

We also note that families of groupoids over the terminal groupoid 1 are in 1-1 correspondence to (non-dependent) groupoids.

A family of types Γ, x: σ ⊢ τ[x] in TT almost gives rise to a family of groupoids over G(σ). Indeed, if Γ ⊢ M : σ is an element of G(σ)_{set} then we obtain a groupoid G(τ)(M) := G(τ[M]). Moreover, if Γ ⊢ P : Id_{σ}(M, M′) then Subst_{σ,τ}(P, −) induces a morphism of groupoids from G(τ[M]) to G(τ[N]). However, we do not have Subst (Trans (P, Q), M) = Subst (Q, Subst (P, M)) as required by the second law for σ_{resp}, but only the corresponding propositional equality. Also the Subst -functions do not lift to functions defined on G(σ)_{rel}. Nevertheless it is an instructive exercise to verify the equations for families of groupoids in this case up to propositional equality.

More examples arise from the interpretation of the type constructors which we are going to describe.

5.2.1.1 Comprehension and Substitution

Let Γ be a groupoid and σ ∈ Fam(Γ). We define the comprehension of σ denoted Γ · σ as the following groupoid:

(Γ · σ)_{set} = Σγ∈ Γ_{set}.σ_{set}(γ)
(Γ · σ)_{rel}((γ, u) , (γ′, v)) = Σp∈ Γ_{rel}(γ, γ′).σ_{rel}(γ′ , p · u, v)
(Γ · σ)_{refl}((γ, u)) = (Γ_{refl}(γ), σ_{refl}(γ, u))
(p, q)^{−1} = (p^{−1}, q^{−1})
(p, q)(p′, q′) = (pp′, q(p · q′))

Notice that in order for these definitions to typecheck the equations imposed on families are required. For example, for (Γ_{refl}(γ), σ_{refl}(γ, u)) ∈ (Γ · σ)_{rel}((γ, u) , (γ, u)) it is required that σ_{refl}(γ, u)∈ σ_{rel}(γ , Γ_{refl} · u, u) and this follows from Γ_{refl} · u = u.

It remains to check that Γ·σ is indeed a groupoid. We only verify associativity of transitivity.

((p, q)(p′, q′))(p′′, q′′) = (pp′, q(p · q′))(p′′, q′′) =
(pp′p′′, q(p · q′)(pp′ · q′′) = (pp′p′′, q(p · (q′(p′ · q′′)))) =
(p, q)(p′p′′, q′(p′ · q′′)) = (p, q)((p′, q′)(p′′, q′′))

The canonical projection p(σ) is the first projection from (Γ · σ)_{set} to Γ_{set} which is obviously a morphism of groupoids. The reader familiar with category theory will have noticed that this defininition of comprehension is a special case of the so-called “Grothendieck construction”.

Now let Γ, Δ be groupoids, σ ∈ Fam(Δ) and f : Γ → Δ. The composition σ ∘ f is a family of groupoids over Γ which defines the substitution σ{f}. In more explicit terms we have

σ{f}_{set}(γ∈ Γ_{set}) = σ_{set}(f_{fun}(γ))

σ{f}_{rel}(γ∈ Γ_{set} , u, v∈ σ{f}_{set}(γ)) =
σ_{rel}(f_{fun}(γ), u, v)
σ{f}_{reindex}(γ, γ′∈ Γ_{set}, p∈ Γ_{rel}(γ, γ′) , u∈ σ{f}_{set}(γ)) =
f(p) · u∈ σ{f}_{set}(y)

The other components are defined accordingly. It is immediate from the definition that this substitution operation satisfies the split property σ{f ∘ g} = σ{f}{g} and σ{id_{Δ}} = σ.

Finally, we have the morphism q(f, σ) from Γ · σ{f} to Δ · σ whose function part sends (γ, u) to (f_{fun}(γ), u), and it is readily seen that the following diagram is a pullback in the category of groupoids:

[figure: Γ · σ{f}; q(f, σ); Δ · σ; Γ; p(σ{f}); f; Δ; p(σ)]

This shows that groupoids and families of groupoids form a category with attributes in the sense of Remark 2.4.11. For technical reasons it is, however, appropriate to separate sections from their associated context morphisms as follows.

Sections. Let σ ∈ Fam(Γ). A section of σ is a pair M = (M_{el}, M_{resp}) where M_{el} ∈ Πγ∈ Γ_{set}.σ_{set}(γ) and M_{resp} ∈ Πγ, γ′∈ Γ_{set}.Πp∈ Γ_{rel}(γ, γ′).σ_{rel}(γ′ , p · M_{el}(γ), M_{el}(γ′)) in such a way that the following two equations hold for γ, γ′, γ′′ ∈ Γ_{set} and q ∈ Γ_{rel}(γ, γ′) and q ∈ Γ_{rel}(γ′, γ′′):

M_{resp}(_{refl}(γ)) = _{refl}(M_{el}(γ)) ∈ σ_{rel}(γ, M_{el}(γ), M_{el}(γ))
M_{resp}(pq) = M_{resp}(p)(p · M_{resp}(q)) ∈ σ_{rel}(γ′′, (pq) · M_{el}(γ), M_{el}(γ′′))

If M ∈ Sect(σ) we define the associated context morphism \overline{M} : Γ → Γ · σ by \overline{M}_{fun}(γ) := (γ, M_{el}(γ)) and \overline{M}_{resp}(p) := (p, M_{resp}(p)). This obviously defines a 1-1 correspondence between the set of sections and the set of right inverses to p(σ). We can now conclude:

Proposition 5.2.6 Groupoids and families of groupoids form a syntactic category with attributes.

5.2.2 Interpretation of type formers

We now investigate the closure properties of this model w.r.t. various type formers. It turns out that the groupoid model supports almost all the set-theoretic type formers, so in particular those studied in the monograph [85]. Here we restrict ourselves to the interpretation of sum and product types, the identity type, natural numbers, and a universe.

5.2.2.1 Interpretation of the dependent sum

Let σ be a family over Γ and τ a family over Γ · σ. We want to construct a family over Γ which interprets the Σ-type Σs : σ.τ(s). It is a dependent version of the comprehension groupoid from Section 5.2.1.1. It is defined by

Σ(σ, τ)_{set}(γ∈ Γ_{set}) = Σs∈ σ_{set}(γ).τ_{set}(γ, s)
Σ(σ, τ)_{rel}(γ∈ Γ_{set} , u, v∈ Σ(σ, τ)_{set}(γ)) =
Σp∈ σ_{rel}(γ, u.1, v.1).τ_{rel}((γ, v.1) , (ι, p) · u.2, v.2)
Σ(σ, τ)_{refl}(γ∈ Γ_{set}, u∈ Σ(σ, τ)_{set}(γ)) = (ι, ι)
(p, q)^{−1} = (p^{−1}, q^{−1})
(p, q)(p′, q′) = (pp′, q(p · q′))
p · (s, t) = (p · s, (p, ι) · t) Reindexing on elements.
p · (q, r) = (p · q, (p, ι) · r) Reindexing on morphisms.

The verifications are essentially the same as in Sect. 5.2.1.1 and are left to the reader.

Projections and pairing If M is a section of Σ(σ, τ) then taking the first/second projection in the el- and the resp-part separately yields two sections, one of σ denoted M.1 and one of τ\{\overline{M.1}\} denoted M.2. On the other hand, component-wise pairing turns sections N_{1} of σ and N_{2} of τ\{\overline{N_{1}}\} into a section (N_{1}, N_{2}) of Σ(σ, τ). These operations are inverse to each other, i.e. (N_{1}, N_{2}).1 = N_{1}, (N_{1}, N_{2}).2 = N_{2} and (M.1, M.2) = M. Compatibility with substitution is straightforward.

The groupoid model thus admits extensional Σ-types in the sense of Prop. 2.4.27.

5.2.2.2 Dependent product of groupoids

Let σ, τ, Γ be as before. For each γ ∈ Γ_{set} let τ(γ) denote the family of groupoids over the groupoid (σ_{set}(γ), σ_{rel}(γ)) defined by

τ(γ)_{set}(s∈ σ_{set}(γ)) = τ_{set}((γ, s))
τ(γ)_{rel}(s∈ σ_{set}(γ)) = τ_{rel}((γ, s))

In fact τ(γ) is just a special instance of substitution along the morphism from the one point groupoid to Γ determined by γ ∈ Γ_{set}. Using this notation we define the dependent product of τ along σ as a family over Γ by

Π(σ, τ)_{set}(γ∈ Γ) = “The set of sections of τ(γ)”

Π(σ, τ)_{rel}(γ∈ Γ , M, N∈ Π(σ, τ)_{set}(γ)) =

“The set of natural transformations from M to N”

Natural transformations are defined in the same way as for the exponential of non-dependent groupoids. Also the fibre-wise groupoid structure is like in this example. A bit trickier is the definition of reindexing. For p ∈ Γ_{rel}(γ, γ′) and M ∈ Π(σ, τ)_{set}(γ) we put

(p · M)_{el}(s∈ σ_{set}(γ′)) = (p, ι) · M(p^{−1} · s)

Here M(p^{−1} · s) is an element of τ_{set}(γ, p^{−1} · s). Now since p · (p^{−1}s) = s the pair (p, ι) lies in (Γ · σ)_{rel}((γ, p^{−1} · s), (γ′, s)). So the definition makes sense. The morphism part is similar:

(p · M)_{resp}(q∈ σ_{rel}(γ′, s, s′)) = (p, ι) · M(p^{−1} · q)

Finally we must define the resp part of reindexing. So let μ be a natural transformation from M to M′ in Π(σ, τ)_{set}(γ). We must define a natural transformation from p · M to p · M′. Its component at s ∈ σ_{set}(γ′) is

(p, ι) · μ(p^{−1} · s)

which is an element of τ_{rel}((γ′, s) , (p · M)(s), (p · M′)(s)). The verifications are tedious but straightforward.

Abstraction and application. We want to show that the groupoid model admits products in the sense of Prop. 2.4.17; so we have to define abstraction and the evaluation morphism. In the above situation let M be a section of τ. Its abstraction λ_{σ,τ}(M) is a section of Π(σ, τ). Its element part at γ ∈ Γ_{set} is the section of τ(γ) sending s ∈ σ_{set}(γ) to M_{el}(γ, s) and q ∈ σ_{rel}(γ, s, s′) to M_{resp}(ι, q). Its resp-part sends p ∈ Γ_{rel}(γ, γ′) to a natural transformation from p · λ_{σ,τ}(M)(γ) to λ_{σ,τ}(M)(γ′). Its component at s ∈ σ_{set}(γ′) is M(p, ι) which is an element of

τ_{rel}((γ′, s) , (p · λ_{σ,τ}(M)(γ))(s), M(γ′, s))

The evaluation morphism

ev_{σ,τ} : Γ · σ · Π(σ, τ){p(σ)} → Γ · σ · τ

sends (γ, s, M) : (Γ · σ·Π(σ, τ){p(σ)})_{set} to (γ, M_{el} s) and acts similarly on morphisms. The verifications are left to the reader.

5.2.2.3 The identity groupoid

Now we come to the most important part of the model construction. Due to the particular properties of groupoids and families of groupoids it becomes possible to define an identity type which is different from the categorical equaliser, and hence is truly intensional. We use the semantic framework of Def. 2.4.24.

Let σ be a family of groupoids over Γ. We form the groupoid Γ · σ · σ^{+} which corresponds to the context γ: Γ , s, s′: σ(γ). Over this groupoid we define the family Id(σ) by

Id(σ)((γ, s, s′)) = ∇(σ_{rel}(γ, s, s′))

Thus a proof that s, s′ ∈ σ_{set}(γ) are propositionally equal is an element of σ_{rel}(γ, s, s′). Two such proofs are related only if they are actually equal. Thus propositional and definitional equality on identity types coincide in the groupoid model. Coming back to the example of topological spaces and homotopy we would thus consider two points of a topological space as “propositionally equal” if there exists a path linking the two, and two such paths are propositionally equal if they can be continuously transformed into one another.

It remains to define the reindexing functions for Id(σ). If (p, q, r) ∈ (Γ · σ · σ^{+})_{rel}((γ, s, s′) , (γ_{1}, s_{1}, s′_{1})) and h ∈ Id(σ)_{set}(x, s, s′) = σ_{rel}(γ , s, s′) then

(p, q, r) · h := r(p · h)q^{−1} ∈ σ_{rel}(γ′, s_{1}, s′_{1}) = Id(σ)_{set}(γ′, s_{1}, s′_{1})

Notice that by the definition of Γ · σ · σ^{+} we have p ∈ Γ_{rel}(γ, γ_{1}), q ∈ σ_{rel}(p · s, s_{1}) and r ∈ σ_{rel}(p · s′, s′_{1}). Moreover since h ∈ σ_{rel}(s, s′) by definition of families we have p · h ∈ σ_{rel}(p · s, p · s′). So the above definition of reindexing in Id(σ) is “well typed”.

We check the transitivity law:

(p, q, r)(p′, q′, r′) · h = (pp′, q(p · q′), r(p · r′)) · h =

r(p · r′)(pp′ · h)(q(p · q′)^{−1} = r(p · r′)(pp′ · h)(p · q′^{−1})q^{−1} =
r(p · (r′(p′ · h)q′^{−1}))q^{−1} = (p, q, r) · ((p′, q′, r′) · h)

Now if ⋆ ∈ Id(σ)_{rel}((γ, s, s′) , h, h′)—in other words if h and h′ are equal—then clearly (p, q, r) · h = (p, q, r) · h′, so we put

(p, q, r) · ⋆ = ⋆

For this definition to work all the coherence equations imposed on families of groupoids are indeed required.

Identity introduction. Recall that \overline{v_{σ}} : Γ · σ → Γ · σ · σ^{+} is the diagonal morphism from Γ·σ to Γ · σ·σ^{+} defined on elements by (\overline{v_{σ}})_{fun}(γ, s) = (γ, s, s). We must construct a morphism Refl_{σ} : Γ·σ → Γ · σ · σ^{+}·Id(σ) with p(Id_{σ}) ∘ Refl_{σ} = \overline{v_{σ}}. It is defined by

(Refl_{σ})_{fun}(γ, s) := (γ, s, s, σ_{refl}(s))
(Refl_{σ})_{resp}(p, q) := (p, q, q, ⋆)

This definition implicitly uses the equation

(p, q, q) · refl (σ)(γ, s) = q(p · ι)q^{−1} = qq^{−1} = ι

deduced from the laws for families of groupoids.

Identity elimination. Let τ be a family over the family Γ · σ · σ^{+} · Id(σ) and let M be a section of τ{Refl_{σ}}. We construct a section J_{σ,τ}(M) of τ by

J_{σ,τ}(M)_{el}((γ, s, s′, q)∈ (Γ · σ · σ^{+} · Id(σ))_{set}) := (ι, ι, q, ⋆) · M(γ, s)

This works since (γ, s, s, σ_{refl}(s)) and (γ, s, s′, q) are related in Γ · σ · σ^{+} · Id(σ) by (ι, ι, q, ⋆) because (ι, ι, q) · ι = qιι = q.

It remains to define J_{σ,τ}(M)_{resp}. Let

(p, r, r′, ⋆) ∈ (Γ · σ · σ^{+} · Id(σ))_{rel}((γ, s, s′, q), (γ_{1}, s_{1}, s′_{1}, q_{1}))

or equivalently p ∈ Γ_{rel}(γ, γ′), r ∈ σ_{rel}(γ_{1}, p · s, s_{1}), r′ ∈ σ_{rel}(γ_{1}, p · s′, s′_{1}), and q_{1} = r′(p · q)r^{−1}. We must exhibit an element of

τ_{rel}((γ_{1}, s_{1}, s′_{1}, q_{1}) , (p, r, r′, ⋆) · (ι, ι, q, ⋆) · M(γ, s) , (ι, ι, q_{1}, ⋆) · M(γ_{1}, s_{1}))

Now

M(p, r) relates (p, r, r, ⋆) · M(γ, s) and M(γ_{1}, s_{1})

since M is a section. So we have

(ι, ι, r′(p · q)r^{−1}, ⋆) · M(p, r) relates (p, r, r′(p · q), ⋆) · M(γ, s)
and (ι, ι, r′(p · q)r^{−1}, ⋆) · M(γ_{1}, s_{1})

by “multiplying” by (ι, ι, r′(p · q)r^{−1}, ⋆) which is the desired proof since

(p, r, r′, ⋆)(ι, ι, q, ⋆) = (p, r, r′(p · q), ⋆)

by definition of transitivity in Γ · σ · σ^{+} and q_{1} = r′(p · q)r^{−1} by assumption.

Proposition 5.2.7 The groupoid model supports intensional identity types.

5.2.2.4 Functional extensionality

It is immediate from the definitions of the dependent product and the identity type that the latter supports functional extensionality, i.e. that Ext constants as defined in Sect. 3.1.3 can be defined, and that Turner’s equation (Eqn 3.2 in Sect. 3.1.3) holds. This is important, because we do not have uniqueness of identity in the groupoid model as shown below in Thm. 5.2.8.

5.2.2.5 The base types

The types 0, 1, N may be interpreted by the discrete groupoids ∇(∅), ∇({⋆}), ∇(N). These are initial, terminal, and natural numbers objects, resp., in the category of groupoids from which it follows that the introduction and elimination rules can be interpreted. One may of course construct them explicitly as well. It is also possible to define a groupoid of lists even over a non-discrete groupoid, but we have not checked whether arbitrary parametrised inductive definitions can be carried out in the groupoid model. Certainly, arbitrary inductive definitions as provided by Coquand’s pattern matching [17] cannot be interpreted, for then uniqueness of identity would hold in the groupoid model contradicting Theorem 5.2.8 below. We leave it as an open problem to determine whether the groupoid model supports all “orthodox” inductive definitions, i.e. those which only provide Martin-Löf’s canonical elimination rules as formalised by Dybjer [28].

5.2.2.6 Interpretation of universes

To interpret the universe we mimic the construction described in [65] of a model for the Extended Calculus of Constructions. Let κ be some inaccessible cardinal. This means that κ is regular (closed under union) and whenever a cardinal μ is strictly smaller than κ then so is 2^{μ} [62]. Let U be the set of all groupoids lying inside the level V_{κ} of the cumulative hierarchy. We interpret the universe by the discrete groupoid ∇(U). Since U is a model of ZFC it is closed under all constructions on groupoids we described, so all the universe rules can be interpreted. Using a chain of inaccessible cardinals we can also interpret universes containing each other. If we are interested in a universe closed under impredicative quantification containing only 0 and 1 we may use the discrete groupoid ∇({∅, {⋆}}) with El(X) = X.

Inside the set-theoretic groupoid model we considered so far there does not exist a non-trivial impredicative universe. However, groupoids can be defined in any locally cartesian closed category, for example the category of ω-Sets [100]. Here we can take U to be the set of those ω-Set groupoids for which both the set of objects and each homset are “modest sets”, see loc.cit. We conjecture that in this way we get a non-degenerate (i.e. without proof-irrelevance) model of the Calculus of Constructions.

We have not looked in detail at universes admitting universe induction. However, since the category of sets is a full subcategory of the category of groupoids (via ∇), every set-theoretic construction of such a universe should carry over to the groupoid case, see for example [28].

5.2.2.7 Quotient types

The groupoid model admits the interpretation of intensional quotient types as defined in Sect. 3.2.6.1, at least in the case where the quotienting relation ρ is internally an equivalence relation. If σ ∈ Fam(Γ) and ρ ∈ Fam(Γ · σ · σ^{+}) is such that there exist sections of the appropriate families witnessing reflexivity, symmetry, and transitivity, then we can define a groupoid σ/ρ by (σ/ρ)_{set} = σ_{set} and (σ/ρ)_{rel}(γ, s, s′) = Δ(ρ(γ, s, s′)) where Δ is the left adjoint to ∇ defined after the proof of Prop. 5.2.4. The rules for quotient types can be interpreted in this way, but due to the absence of uniqueness of identity we would like to have further rules which constrain the equality proof obtained by Qax (see rule Q-I-Ax). A special case of this problem will be considered below in Sect. 5.2.4. The formulation of a general quotient type former in the groupoid model of which this example would be an instance is left for future research.

5.2.3 Uniqueness of identity

We are now ready to give the promised proof that uniqueness of identity is not in general definable.

Theorem 5.2.8 Uniqueness of identity is not uniformly definable at all types, in particular it is not definable at the type ⊢ Σx: U.El(x).

Proof. If uniqueness of identity is definable at some type Γ ⊢ σ then by the soundness theorem 2.5.6 and the fact that all groupoids Id(σ)(γ, s, s′) are discrete, every groupoid [[Γ | σ]](γ) for γ ∈ [[Γ]] must be a pre-order, i.e. every set ([[Γ | σ]](γ))_{rel}(x, x′) has at most one element. But the interpretation of Σx: U.El(x) does not have this property since in particular it has the element (Z_{2} ⊗ {⋆}, ⋆) which has two different endomorphisms. □

We remark that in view of Propositions 3.1.1 and 3.1.2 the interpretations of all types definable from N using Π, Σ, Id must be pre-orders, in fact they are discrete, which may also be seen directly from the definition of these type formers in the groupoid model.

Since uniqueness of identity can be defined using pattern-matching (Sect. 3.1.2.2) we obtain the following important corollary:

Corollary 5.2.9 Pattern-matching is a non-conservative extension of Martin-Löf type theory.

5.2.4 Propositional equality as isomorphism

The lack of uniqueness of identity in the syntax has been considered as a drawback, which can be cured by the introduction of the IdUni constants. There may, however, be circumstances under which the existence of more than one proof of identity is actually useful. One such is provided by the following extension to TT with one universe (U, El) which may be soundly interpreted in the groupoid model. For reasons of exposition we assume functional extensionality and an explicit constant Subst as in TT_{I} although it is definable from J. Let

Iso[x, y: U] := Σf: El(x) → El(y).Σf′ : El(y) → El(x).
Id_{El(x)→El(x)}(f′ ∘ f, id) × Id_{El(y)→El(y)}(f ∘ f′, id)

be the type of propositional isomorphisms between El(x) and El(y). If F : Iso[X, Y] let F also stand for the first component F.1 : El(X) → El(Y) and let F^{−1} stand for the second component F.2.1 : El(Y) → El(X). Now consider the following new introduction rule for propositional equality on the universe:

\frac{Γ ⊢ X, Y : U Γ ⊢ F : Iso[X, Y]}{Γ ⊢ UnivId(X, Y, F) : Id_{U}(X, Y)} Univ-Id

Moreover, we introduce a definitional equality describing the reaction of Subst to UnivId:

\frac{Γ ⊢ F : Iso[X, Y] Γ ⊢ M : El(X)}{Γ ⊢ Subst_{U,El}(X, Y, UnivId(F), M) = F M : El(Y)} Univ-Id-Eq

So if we use Subst to rewrite an element M of El(X) as an element of El(Y) then this equals the result of applying the isomorphism F to M. Clearly, this violates uniqueness of identity: this rule makes the operator UnivId injective so that if any two proofs of a propositional equality were identified then also any two isomorphisms between types in the universe would be identified, which is a contradiction as soon as the universe contains a code for a nontrivial type such as N. Astonishingly however, the above extension is sound in pure TT.

Theorem 5.2.10 The above extension of TT can be soundly interpreted in the groupoid model.

Proof. Let U be the groupoid with underlying set U_{set} the set of all small sets (i.e. with cardinality smaller than some inaccessible cardinal) and with U_{rel}(x, y) the set of bijections between x and y. The identity bijection provides reflexivity; symmetry and transitivity are given by taking inverses and composition, respectively. We define a family of groupoids El ∈ Fam(U) by El(x) = ∇(x) and if p : x ≅ y is a bijection between x and y, i.e. p ∈ U_{rel}(x, y) and e ∈ El_{set}(x) = x, then we put p · x := p(x). The El_{resp}-component is trivial since both El(x) and El(y) are discrete. It is readily verified that this defines a family of groupoids. Now we claim that this provides a model for the above extension to TT. Clearly we interpret the universe as U and the El-operator as El. Now if X, Y ∈ U_{set} then the interpretation of Iso is the set of bijections from x to y because El(X) and El(Y) are discrete and thus propositional equality and semantic identity coincide. By definition any such bijection is an element of U_{rel}(X, Y) and thus we interpret UnivId as the identity. Finally, it may be seen from the interpretation of J and the definition of Subst that the latter is interpreted exactly by −_{reindex} so that the equation Univ-Id-Eq is validated. □

The rule Univ-Id-Eq may be replaced by the simpler definitional equality

Γ ⊢ UnivId(X, X, id[X]) = Refl_{U}(X) : Id_{U}(X, X)

Univ-Id-Eq’

where id[X] : Iso[X, X] is the identity function viewed as an isomorphism between X and X. From Univ-Id-Eq’ one obtains the propositional version of Univ-Id-Eq using J in the obvious way.

We do not know whether this extension has many applications as such, but one might imagine more general extensions which allow to define quotient types with proof-relevant equality relation of which the above universe would just be a special case. For example, one could then quotient a slice category by isomorphism and in this way obtain a pullback operation which is “split” up to Id. If one succeeds in formulating the interpretation theory for dependent types inside type theory and with propositional equality rather than set-theoretic extensional equality, one could in this way address the problem of interpreting type theory in non-split structures [23,46]. This ties in with the abovementioned work of Lamarche [58] which attempts to base mathematics on isomorphism rather than equality using a groupoid interpretation without, however, noticing the relationship with propositional equality.

5.3 A dependent setoid model

Our aim in this section is to give a version of truly dependent setoids which can be presented as a syntactic model within TT. As we shall see, the model we end up with has other drawbacks, so that it cannot really be considered superior to S_{0}. The model, which we call S_{1}, is similar in spirit to the groupoid model, but certain compromises have to be made since as we have seen the groupoid model is not definable in intensional type theory.

We have argued that the reason for this is that the preservation of symmetry and transitivity by context morphisms cannot be guaranteed as soon as one has dependent products or function spaces. A natural attempt would be to drop these requirements and to see how far one gets. Then, however, symmetry and transitivity for contexts may not be used in the definition of any type former, for then stability under substitution would fail. To see why, consider a (contrived) type former in the groupoid model which sends σ ∈ Fam(Γ) to B(σ) ∈ Fam(Γ) (for all Γ) given by

B(σ)_{♢} = σ_{♢} for ♢ ∈ {set, rel, refl, sym, trans}.

B(σ)_{reindex}(p, s) = σ_{reindex}(Γ_{sym}(Γ_{sym}(p)), s)

Now, if f : B → Γ and σ ∈ Fam(Γ) then we have B(σ){f} = B(σ{f}), i.e. stability under substitution of B, if and only if f_{resp} preserves B_{sym}.

Now, if no type (and term) former may use symmetry and transitivity for contexts, we can just as well omit them from the definition of contexts. It turns out that the use of reflexivity in certain term formers is unavoidable, notably in the interpretation of Subst —the elimination operator for the identity type. Fortunately, using a trick we can ensure the preservation of reflexivity by all context morphisms as we see below in Sect. 5.3.1.2.

However, we cannot ensure that reflexivity is preserved by reindexing, i.e. that for all families σ ∈ Fam(Γ) and s : σ_{set}(γ) we have

σ_{reindex}(Γ_{refl}(γ), s) = s The lack of this preservation property entails that certain definitional equalities, notably Σ-Comp and Nat-Comp-Suc, only hold up to (semantical) propositional equality in the model S_{1} so that we can only interpret a weakened type theory where these equations are replaced by propositional axioms in the style of Id-Uni-I or Ext-Form. This is not a principal problem because the model S_{1} supports uniqueness of identity and functional extensionality so that by Thm. 3.2.5 and the remark at the end of Sect. 3.2.6 it has the same expressive power as TT_{I}, namely the one of extensional type theory TT_{E}.

Let us now describe the details. The target type theory, i.e. the type theory in which the syntactic model is formulated, is TT, the core type theory with dependent sums and products, identity types, and natural numbers.

Parts of the material have been previously published as [44]. The definition of squash types in Sect. 5.3.5 is new and the material on universes (Sect. 5.3.5.1) has been thoroughly revised and rewritten.

Definition 5.3.1 A context of setoids is a triple Γ = (Γ_{set}, Γ_{rel}, Γ_{refl}) where Γ_{set} is a (syntactic) context and Γ_{rel} is a (syntactic) context relative to (Γ_{set}, Γ_{set}), i.e.

γ : Γ_{set} , γ′ : Γ_{set} ⊢ Γ_{rel}[γ, γ′]

and Γ_{refl} is a tuple of terms establishing reflexivity of Γ_{rel}, i.e.

γ : Γ_{set} ⊢ Γ_{refl}[γ] : Γ_{rel}[γ, γ]

Two contexts of setoids are equal if their three components are definitionally equal.

So a context of setoids is a reflexive graph if we view Γ_{set} as the set of nodes and Γ_{rel}[γ, γ′] as the set of edges from γ to γ′.

Definition 5.3.2 Let Γ and Δ be contexts of setoids. A morphism from Γ to Δ is a pair f = (f_{fun}, f_{resp}) where

γ : Γ_{set} ⊢ f_{fun}[γ] : Δ_{set}

and

γ, γ′ : Γ_{set} , p : Γ_{rel}[γ, γ′] ⊢ f_{resp}[p] : Δ_{rel}[f_{fun}[γ], f_{fun}[γ′]]

such that reflexivity is preserved up to definitional equality, i.e.

γ : Γ ⊢ f_{resp}[Γ_{refl}[γ]] = Δ_{refl}[f_{fun}[γ]] : Δ_{rel}[f_{fun}[γ], f_{fun}[γ]]

holds. Two morphisms between contexts of setoids are equal if their two components are definitionally equal.

Proposition 5.3.3 The contexts of setoids together with their morphisms form a category C with terminal object.

Proof. Clearly, morphisms are closed under component-wise composition and contain the identity. A terminal object ⊤ is given by ⊤_{set} = ⊤_{rel} = ⋄ and ⊤_{refl} = ().

□

5.3.1 Families of setoids

Now we come to the most important ingredient—the definition of dependency in the model. We first introduce a useful abbreviation. If Γ is a context of setoids and γ_{1}, …, γ_{n} : Γ_{set} then

Γ_{conn}[γ_{1}, …, γ_{n}]

denotes the context consisting of all types Γ_{rel}[γ_{i}, γ_{j}] for i, j = 1 … n, i ≠ j, i.e. the γ_{i} are connected by Γ_{rel}. So for example if γ, γ′ : Γ_{set} then

Γ_{conn}[γ, γ′] = (Γ_{rel}[γ, γ′] , Γ_{rel}[γ′, γ])

Definition 5.3.4 Let Γ be a context of setoids. A family of setoids above Γ is a 6-tuple σ = (σ_{set}, σ_{rel}, σ_{reindex}, σ_{sym}, σ_{trans}, σ_{ax}) where

– σ_{set} is a type depending on Γ_{set}

γ : Γ_{set} ⊢ σ_{set}[γ]

– σ_{rel} is a dependent relation on σ_{set}

γ, γ′ : Γ_{set} , s : σ_{set}[γ] , s′ : σ_{set}[γ′] ⊢ σ_{rel}[s, s′]

– σ_{reindex} is the reindexing function which allows to substitute connected ele-

ments of Γ_{set} in σ_{set}

γ, γ′ : Γ_{set} , p : Γ_{conn}[γ, γ′] , s : σ_{set}[γ] , s̄: σ_{rel}[s, s] ⊢
σ_{reindex}[p, s, s̄] : σ_{set}[γ′]

such that σ_{rel} is symmetric and transitive and such that σ_{reindex}[p, s, s̄] is always σ_{rel}-related to s. More precisely we require terms

γ, γ′ : Γ_{set} ,

p : Γ_{conn}[γ, γ′] ,
s : σ_{set}[γ] , s′ : σ[γ′] ,
q : σ_{rel}[s, s′]  ⊢ σ_{sym}[p, q] : σ_{rel}[s′, s]
γ, γ′, γ′′ : Γ_{set} ,
p : Γ_{conn}[γ, γ′, γ′′] ,
s : σ_{set}[γ] , s′ : σ_{set}[γ′] , s′′ : σ_{set}[γ′′] ,
q : σ_{rel}[s, s′] , q′ : σ_{rel}[s′, s′′]  ⊢ σ_{trans}[p, q, q′] : σ_{rel}[s, s′′]
γ, γ′ : Γ_{set} ,
p : Γ_{conn}[γ, γ′] ,
s : σ_{set}[γ] , s̄: σ_{rel}[s, s] ⊢ σ_{ax}[p, s, s̄] : σ_{rel}[s, σ_{reindex}[p, s, s̄]]

Two families are equal if all their six components are definitionally equal. We denote the set of families of setoids over context Γ by Fam(Γ).

Since Γ_{rel} is not assumed to be symmetric we must make Γ_{conn}[γ, γ′] a premise to σ_{reindex} rather than merely Γ_{rel}[γ, γ′]. Otherwise, we could not define type formers like the dependent product. The reflexivity assumption s̄ : σ_{rel}[s, s] in σ_{ax} is needed, for otherwise from σ_{ax} one could conclude that any two elements of σ_{set}[γ] are σ_{rel}-related. The function σ_{reindex} could also be defined without this assumption.

5.3.1.1 Comprehension and substitution

Let σ be a family of setoids indexed over Γ. Its comprehension Γ · σ is the context of setoids defined by

(Γ · σ)_{set}  := γ: Γ_{set} , s: σ_{set}[γ] , s̄: σ_{rel}[s, s]
(Γ · σ)_{rel}[(γ, s, p), (γ′, s′, p′)] :=  p: Γ_{rel}[γ, γ′] , q: σ_{rel}[s, s′])
(Γ · σ)_{refl}[γ, s, s̄] := (Γ_{refl}[γ], s̄)

Thus a typical context of setoids Γ of length 2 takes the form

Γ_{set}  = s_{1} : (σ_{1})_{set}, s̄_{1} : (σ_{1})_{rel}[s_{1}, s_{1}],

s_{2} : (σ_{2})_{set}[s_{1}, s̄_{1}], s̄_{2} : (σ_{2})_{rel}[s_{1}, s̄_{1} , s_{2}, s_{2}]

Γ_{rel}[s_{1}, s̄_{1}, s_{2}, s̄_{2} , s′_{1}, s̄′_{1}, s′_{2}, s̄′_{2}] = p_{1} : (σ_{1})_{rel}[s_{1}, s′_{1}] ,
p_{2} : (σ_{2})_{rel}[s_{1}, s̄_{1}, s′_{1}, s̄′_{1}, s_{2}, s′_{2}]
Γ_{refl}[s_{1}, s̄_{1}, s_{2}, s̄_{2}]  = (s̄_{1}, s̄_{2})

The morphism p(σ) : Γ · σ → Γ is defined by by

p(σ)_{fun}[γ, s, s̄] := γ
p(σ)_{resp}[p, q] := p

It follows immediately from the definition of (Γ · σ)_{refl} that this is indeed a morphism.

Let σ be a family of setoids indexed over Δ and f be a morphism from Γ to Δ. We obtain a family of setoids over Γ denoted σ{f} by pre-composing with f, i.e. by putting

σ{f}_{set}[γ : Γ_{set}] := σ_{set}[f_{fun}[γ]]
σ{f}_{rel}[s : σ_{set}[f_{fun}[γ]] , s′ : σ_{set}[f_{fun}[γ′]]] := σ_{rel}[s, s′]
σ{f}_{reindex}[p : Γ_{conn}[γ, γ′] , s : σ_{set}[f_{fun}[γ]] , s̄: σ_{rel}[s, s]] :=
σ_{reindex}[f_{resp}[p], s, s̄]

Here by a slight abuse of notation we have applied f_{resp} to p : Γ_{conn}[γ, γ′]. This is understood component-wise. The other components of σ{f} are defined similarly by pre-composition. We omit the obvious definition of the q-morphisms.

5.3.1.2 Sections

Definition 5.3.5 If σ is a family over a context of setoids Γ then a section of σ is a pair M = (M_{el}, M_{resp}) where

γ : Γ_{set} ⊢ M_{el}[γ] : σ_{set}[γ]

and

γ, γ′ : Γ_{set} , p : Γ_{rel}[γ, γ′] ⊢ M_{resp}[p] : σ_{rel}[M_{el}[γ], M_{el}[γ′]]

We denote the set of sections of σ by Sect(σ). Two sections are equal if both components are definitionally equal.

Every section induces a context morphism from its context to the comprehension of its type. More precisely, if M ∈ Sect(σ) then we define \overline{M} : Γ → Γ · σ by

\overline{M}_{fun}[γ] := (γ, M_{el}[γ], M_{resp}[Γ_{refl}[γ]])
\overline{M}_{resp}[p] := (p, M_{resp}[p])

We check that reflexivity is preserved:

\overline{M}_{resp}[Γ_{refl}[γ]] =

(Γ_{refl}[γ] , M_{resp}[Γ_{refl}[γ]]) =
Γ · σ_{refl}[γ, M_{el}[γ], M_{resp}[Γ_{refl}[γ]]] =
Γ · σ_{refl}[\overline{M}_{fun}[γ]]

So although no equational constraints are placed on sections they nevertheless induce proper morphisms. This is the “trick” used to obtain preservation of reflexivity. We have p(σ) ∘ \overline{M} = id_{Γ} as required.

Conversely, if f : Γ → Δ·σ then we construct a section Hd(f) ∈ Sect(σ{p(σ) ∘ f}) as follows. The −_{el}-part of p(σ) ∘ f sends γ : Γ_{set} to δ := f_{fun}[γ].1.1.2 : Δ_{set}. Now f_{fun}[γ].1.2 is an element of σ_{set}[δ]. So we put

Hd(f)_{el}[γ] := f_{fun}[γ].1.2

The −_{resp}-component is defined analogously. We have f = q(f, σ) ∘ \overline{Hd(f)} and M = Hd(\overline{M}) so sections and right-inverses to canonical projections are in 1-1 correspondence. Summing up we obtain Proposition 5.3.6 Setoids and families of setoids form a syntactic category with attributes—the setoid model S_{1}.

A frequently asked question is whether one could not identify families as soon as they have definitionally equal −_{set}- and −_{rel}-components, but arbitrary −_{sym}-, −_{trans}-, −_{reindex}-, and −_{ax}-components. As we shall see, these components enter directly the definition of the Subst -operator (and the derived operators Sym and Trans witnessing symmetry and transitivity of the identity type). A fortiori we would then have to identify equivalent morphisms, and to make substitution respect this identification, we would also have to identify certain families. This could only be achieved using a construction like that in the proof of Thm 3.2.5. The resulting structure would probably be a model of extensional type theory, but not a syntactic model in the sense of Sect. 1.3.2 for functional extensionality.

We now pass to the modelling of type formers, notably the identity type and a Π-type satisfying functional extensionality. We also look at natural numbers and Σ-types where we see that certain conversion rules are only satisfied up to propositional equality.

5.3.2 Dependent product

Let Γ be a context of setoids, σ be a family over Γ and τ be a family over Γ · σ. We define a family Π(σ, τ) ∈ Fam(Γ) as follows. Its type component is given by

Π(σ, τ)_{set}[γ : Γ_{set}] := Πs : σ_{set}[γ].Πs̄: σ_{rel}[s, s].τ_{set}[γ, s, s̄]

The relation is defined by

Π(σ, τ)_{rel}[U : Π(σ, τ)_{set}[γ] , V : Π(σ, τ)_{set}[γ′]] :=
Πs : σ_{set}[γ]Πs̄: σ_{rel}[s, s]Πs′ : σ_{set}[γ′]Πs̄′ : σ_{rel}[s′, s′].
σ_{rel}[s, s′] → τ_{rel}[U s s̄, V s′ s̄′]

From the other components the definition of which is basically forced we single out transitivity because it displays a perhaps unexpected need for the use of reindexing.

We assume the following variables:

γ, γ′, γ′′ : Γ_{set} , f: Π(σ, τ)_{set}[γ], f′: Π(σ, τ)_{set}[γ′], f′′: Π(σ, τ)_{set}[γ′′] ,
p: Γ_{conn}[γ, γ′, γ′′] , q_{1}: Π(σ, τ)_{rel}[f, f′] , q_{2}: Π(σ, τ)_{rel}[f′, f′′]

We must show that Π(σ, τ)_{rel}[f, f′′]. To that end assume

s_{1}: σ_{set}[γ], s̄_{1}: σ_{rel}[s_{1}, s_{1}] , s_{2}: σ_{set}[γ′′], s̄_{2}: σ_{rel}[s_{2}, s_{2}] , h: σ_{rel}[s_{1}, s_{2}]

We have to construct an element of τ_{rel}[f s_{1} s̄_{1} , f′′ s_{2} s̄_{2}]. We would like to use τ_{trans} and q_{1}, q_{2} for this, but in order to do so we need an element of σ_{set}[γ′] which is related to both s_{1} and s_{2}. Using σ_{reindex} it is possible to obtain such element from either s_{1} or s_{2} using the hypothesis p: Γ_{conn}[γ, γ′, γ′′], for instance σ_{reindex}[Q, s_{1}, s̄_{1}] where Q : Γ_{conn}[γ, γ′] is a part of p. The rest is obvious. This shows that with a more general definition of transitivity that does not include the restriction to connected elements of the context it would not have been possible to define the Π-type.

Next we define introduction and elimination for the dependent product following Def. 2.4.14. That is, if M ∈ Sect(τ) we construct λ_{σ,τ}(M) ∈ Sect(Π(σ, τ)) and conversely if M ∈ Sect(Π(σ, τ)) and N ∈ Sect(σ) we construct App_{σ , τ}(M, N) ∈ Sect(τ\{\overline{N}\}). The element parts are

λ_{σ,τ}(M)_{el}[γ : Γ_{set}] := λs : σ_{set}[γ].λs̄: σ_{rel}[s, s].M_{el}[γ, s, s̄]

and

App_{σ , τ}(M, N)_{el}[γ : Γ_{set}] := M_{el}[γ] N_{el}[γ] N_{resp}[Γ_{refl}[γ]]

The relational parts are defined similarly. Also the governing equations are readily checked. Stability under substitution may be verified by careful inspection by hand or (better) using the Lego proof checker. The fact that morphisms preserve reflexivity is crucial for this property to hold.

Proposition 5.3.7 The setoid model S_{1} supports dependent products.

5.3.3 The identity type

We are now ready to define the interpretation of the identity type in the model S_{1}. The basic idea is to interpret propositional equality on a type as the associated relation endowed with a trivial relation (namely any two elements are related) so that we can interpret uniqueness of identity. In view of Sect. 3.2.3.1 this allows us to replace J by (the simpler combinator) Subst . Moreover, we can interpret functional extensionality in the sense of Sect. 3.1.3. Ext will satisfy certain definitional equations which in particular ensure that all elements of type N in the empty context are equal to canonical values. However, the definitional equality Leibniz-Comp is only validated up to propositional equality, that is we can interpret a constant of the corresponding identity type. In [44] we sketch the definition of a more complicated identity type in S_{1} with “strict” Leibniz-Comp, but since—as announced above—other computational equations only hold propositionally and there is no fix for those, we do not give this construction here.

Suppose we are given a context of setoids Γ and a family of setoids σ over Γ. We first form the context consisting of Γ and two copies of σ. In our notation this is Γ · σ · σ^{+}. The identity setoid, denoted Id(σ), is a family over this context. We define it by

Id(σ)_{set}[(γ, s_{1}, s̄_{1}, s_{2}, s̄_{2}) : (Γ · σ · σ^{+})_{set}] := σ_{rel}[s_{1}, s_{2}]

and

Id(σ)_{rel}[x, x′: (Γ · σ · σ^{+})_{set} , p: Id(σ)_{set}[x] , q: Id(σ)_{set}[x′]] = 1

i.e. any two elements of Id(σ)_{set} are related. Clearly this is symmetric and transitive. To define the rewriter Id(σ)_{reindex} we make use of transitivity and symmetry of σ_{rel}. We see that although the relations on contexts are not assumed to be symmetric and transitive, we do need these properties for the relations on families.

5.3.3.1 Reflexivity

The distinguished morphism Refl_{σ} : Γ·σ → Γ · σ · σ^{+}·Id(σ) interpreting reflexivity is given by

(Refl_{σ})_{fun}[(γ, s, s̄) : (Γ · σ)_{set}] = (γ, s, s̄, s, s̄, s̄) : (Γ · σ · σ^{+} · Id(σ))_{set}

The −_{resp} component is trivial since any two elements of the identity setoid are related (by ⋆). It is also clear from the definition that Refl_{σ} satisfies the required equations, i.e. is stable under substitution and equals the diagonal when composed with p(Id(σ)).

5.3.3.2 Identity elimination

Let σ ∈ Fam(Γ) and M, N ∈ Sect(σ). We introduce the abbreviation Id(M, N) for the family Id(σ)\{\overline{N^{+}}\}\{\overline{M}\} ∈ Fam(Γ). Id(M, N) corresponds to the setoid of proofs that M and N are equal. We also write Refl(M) for the section

Hd(Refl_{σ} ∘ \overline{M}) ∈ Sect(Id(M, M))

Now assume σ ∈ Fam(Γ), τ ∈ Fam(Γ·σ), M_{1}, M_{2} ∈ Sect(σ), P ∈ Sect(Id(M_{1}, M_{2})), and N ∈ Sect(τ\{\overline{M_{1}}\}) corresponding to the premises of rule Leibniz. We want to define a section Subst (P, N) of τ\{\overline{N_{2}}\} using τ_{reindex}. We put

Subst (P, N)_{el}[γ] = τ_{reindex}[(Γ_{refl}[γ], P_{el}[γ]) , (Γ_{refl}[γ], σ_{sym}[Γ_{refl}[γ], Γ_{refl}[γ], P_{el}[γ]]), N_{el}[γ] , N_{resp}[Γ_{refl}[γ]]]

The first two arguments to τ_{reindex} constitute a proof that (γ, (M_{1})_{el}[γ]) and (γ, (M_{2})_{el}[γ]) are connected in Γ · σ. Notice that reflexivity of Γ is required here as well as symmetry of the relation on families. In particular, the use of reflexivity (as a proof that the two first components of the two elements of Γ · σ are related) is crucial.

The next two arguments to τ_{reindex} are the element N_{el}[γ] : τ_{set}[γ, (M_{1})_{el}[γ]] and a proof that it is related to itself. We hence obtain an element of τ_{set}[γ, (M_{2})_{el}[γ]] as required.

The −_{resp}-part of Subst is defined similarly using τ_{ax}.

As announced above this eliminator does not satisfy the rule Leibniz-Comp. The reason for this is that τ_{reindex} applied to a proof by reflexivity is not necessarily the identity function. However, by virtue of τ_{ax} the propositional companion to Leibniz-Comp is inhabited in the model.

5.3.3.3 Extensional concepts

If P ∈ Sect(Id(M, M)) then—since the relation on Id(σ) is trivial—there is a canonical section of Id(Refl(M), P) sending γ ∈ Γ_{set} to ⋆. Thus we conclude

Proposition 5.3.8 The model S_{1} supports the concept of uniqueness of identity.

Next assume that τ ∈ Fam(Γ · σ), that U, V ∈ Sect(Π(σ, τ)), and that

P ∈ Sect(Id(App_{σ^{+} , τ^{+}}(U^{+}, v_{σ}) , App_{σ^{+} , τ^{+}}(V^{+}, v_{σ})))

i.e. corresponding to the premises to rule Ext-Form (Sect. 3.1.3). We want to define a canonical section Ext_{σ,τ}(U, V, P) of Id(U, V) from this. The element part of P is basically (modulo some currying of Σ-types) a term of type

γ : Γ_{set} , s : σ_{set}[γ] , s̄: σ_{rel}[s, s] ⊢ σ_{rel}[U_{el}[γ, s, s̄] , V_{el}[γ, s, s̄]]

The element part of the section we are looking for amounts to an inhabitant of

γ : Γ_{set} , s : σ_{set}[γ] , s̄: σ_{rel}[s, s] , s′ : σ_{set}[γ] , s̄′ : σ_{rel}[s, s] ⊢
σ_{rel}[U_{el}[g, s, s̄] , V_{el}[g, s′, s̄′]]

We obtain that by using either U_{resp} or V_{resp} and transitivity of σ_{rel}. The −_{resp} part is again trivial.

Proposition 5.3.9 The model S_{1} supports the concept of functional extensionality.

We discuss quotient types below in Sect. 5.3.5.

5.3.4 Inductive types

Simple inductive types like the unit type, the Booleans, and the natural numbers may be defined by taking the identity type from the target type theory as the relation. Unfortunately, in the case of the natural numbers we obtain the computation rule Nat-Comp-Suc (see Sect. 2.1.2.4) only up to propositional equality because of the reflexivity assumptions in contexts.

We show the construction of the natural numbers in S_{1} following Def. 2.4.20. Let Γ be a context of setoids.

N_{set}[γ: Γ_{set}] := N
N_{rel}[γ, γ′: Γ_{set} , n, n′: N] := Id_{N}(n, n′)

where Id_{N} is the identity type from the target type theory. This is obviously symmetric and transitive. The reindexing function N_{reindex} is simply the identity.

The section 0_{Γ} ∈ Sect(N_{Γ}) and the morphisms Suc_{Γ} : Γ · N_{Γ} → Γ · N_{Γ} are defined using the derived combinator Resp defined in Sect. 3.1.1.2. For example we have

(Suc_{Γ})_{fun}[γ: Γ_{set}, n: N] := (γ, Suc(n), Resp ([n: N]Suc(n), Γ_{refl}[γ]))
(Suc_{Γ})_{resp}[(γ, n), (γ′, n′): (Γ · N_{Γ})_{set} , (p, q): (Γ · N_{Γ})_{rel}[(γ, n), (γ′, n′)]] :=
(p, Resp ([n: N]Suc(n), q)) : (Γ · σ)_{rel}[(γ, Suc(n)), (γ′, Suc(n′))]

For the elimination rule R^{N} assume some family σ ∈ Fam(Γ · N_{Γ}) and sections M_{z} ∈ Sect(σ\{\overline{0}\}) and M_{s} ∈ Sect(σ\{Suc_{Γ} ∘ p(σ)\}). We must construct a section R^{N_{Γ}}(M_{z}, M_{s}) ∈ Sect(σ) from this. Assuming γ: Γ_{set}, n: N and n̄: Id_{N}(n, n) we have to find an element R_{σ}^{N}(M_{z}, M_{s})_{el}[γ, n, n̄] of σ_{set}[γ, n, n̄]. Notice the dependency of σ_{set} on the proof that n is equal to itself. As we have seen this dependency is in general unavoidable, because σ may contain term formers like Subst which make use of −_{refl} which is in turn defined using the reflexivity assumptions like n̄ added during context comprehension ((Γ · N)_{set} is Γ_{set}, n: N, n̄: Id_{N}(n, n)).

We wish to define the desired element using R^{N}, but in order to do so we must slightly strengthen the inductive hypothesis, because M_{s} expects elements of σ_{set} which are related to themselves. So we use

(R_{[n:N]Πn̄:Id_{N}(n,n).Σs:σ_{set}[γ,n,n̄].σ_{rel}[s,s]}^{N}(?_{z},?_{s}, n) n̄).1

where the question marks are readily filled using M_{z} and M_{s}. In the case of ?_{s}, i.e. the inductive step, we assume n: N and hyp : Πn̄: Id_{N}(n, n).Σs: σ_{set}[γ, n, n̄].σ_{rel}[s, s] and \overline{sn} : Id_{N}(Suc(n), Suc(n)). We then have to construct an element of

Σs: σ_{set}[γ, Suc(n), \overline{sn}].σ_{rel}[s, s]

There are various possibilities for obtaining this element. The easiest is probably to instantiate hyp with Refl_{N}(n) and to apply (M_{s})_{el}. This gives an element of

σ_{set}[γ, Suc(n), Resp (Suc, Refl_{N})] = σ_{set}[γ, Suc(n), Refl_{N}(Suc(n))]

from which we obtain an element of σ_{set}[γ, Suc(n), \overline{sn}]. The second component, i.e. a proof that this element is related to itself, is obtained using (M_{s})_{resp} and the required first component using instances of Subst and IdUni (which is definable at N).

We omit the nontrivial but essentially forced −_{resp}-part for R_{σ}^{N}(M_{z}, M_{s}).

Now the equation Nat-Comp-Zero follows immediately from its syntactic companion. The other equation Nat-Comp-Suc does not even hold for the −_{el}- parts, because in the right-hand side, according to the definition of substitution for sections, the (omitted) −_{resp}-part of R^{N_{Γ}}(M_{z}, M_{s}) applied to reflexivity appears, whereas the left-hand side does not contain this term. Of course, using induction the two can be proved propositionally equal in the target type theory and are thus propositionally equal in the source type theory so that a propositional counterpart of Nat-Comp-Suc can be interpreted. It seems that in many special cases Nat-Comp-Suc does indeed hold, for instance if σ does not depend on N.

We are now able to establish the two important meta-properties of S_{1}: Ncanonicity and consistency:

Proposition 5.3.10 If M ∈ Sect(N_{⊤}) then M = Suc^{x}(0) for some x ∈ ω.

Proof. By definition of S_{1} and in particular the interpretation of the natural numbers we must have (in the target type theory) ⋄ ⊢ M_{el} : N and ⋄ ⊢ M_{resp} : Id_{N}(M_{el}, M_{el}). By Remark 2.1.6 we have ⋄ ⊢ M_{el} = Suc^{x}(0) for some x ∈ ω and ⋄ ⊢ M_{resp} = Refl_{N}(M_{el}) : Id_{N}(M_{el}, M_{el}). Hence M = Suc^{x}(0) in S_{1}. □

Proposition 5.3.11 The family Id_{N}(0, Suc(0)) over ⊤ has no sections.

Proof. If M ∈ Sect(Id_{N}(0, Suc(0))) then in the target type theory we have ⋄ ⊢ M_{el} : Id_{N}(0, Suc(0)) which is a contradiction. □

5.3.4.1 Σ-types

Our definition of contexts and context morphisms is based on an equational constraint (preservation of reflexivity). So we cannot expect that they can easily be internalised in S_{1} by some sort of Σ-type. The obvious guess for a Σ-type in the setoid model has (for Γ, σ, τ as in the definition of the Π-type) as underlying set

Σ(σ, τ)_{set}(γ : Γ_{set}) = Σs : σ_{set}(γ).Σs̄: σ_{rel}(s, s).τ_{set}(γ, s, s̄)

and as relation

Σ(S, T)_{rel}((s, s̄, t), (s′, s̄′, t′)) = σ_{rel}(s, s′) × τ_{rel}(t, t′)

We can now define pairing and the first projection and more generally interpret the weak Σ-elimination rule [81]. In order to define a second projection or equivalently the dependent Σ-elimination rule we must use τ_{reindex} and thus we cannot get the equation

(M, N).2 = N

but only interpret the corresponding propositional identity.

5.3.5 Quotient types

We believe that intensional quotient types obeying the syntax given in Sect. 3.2.6.1 are definable in S_{1}, but checking all the necessary proof obligations turned out to be too complicated even with machine support. Particular instances of quotient types—especially in the empty context—can, however, easily be seen to exist in S_{1}. Examples are types of integers and rationals. We therefore propose to add the required quotients as primitive when working in S_{1} until a formal verification of the quotient type former in S_{1} can be given.

As an example of how this works, we define a squash type former, which can be seen as a quotient by the everywhere true relation.

Proposition 5.3.12 The setoid model S_{1} supports a squash type former defined by the following rules.

\frac{Γ ⊢ σ}{Γ ⊢ □σ} □-Form  \frac{Γ ⊢ M : σ}{Γ ⊢ □M : □σ} □-Intro

\frac{Γ ⊢ M, N : □σ}{Γ ⊢ □ ax(M, N) : Id_{□σ}(M, N)} □-Ax

\frac{\begin{matrix}Γ ⊢ σ, τ  Γ, x: σ ⊢ M[x] : τ  Γ ⊢ N : □σ \\ Γ , x, x′: σ ⊢ H : Id_{τ}(M[x], M[x′]) \end{matrix}}{Γ ⊢ plug_{□} N in M using H : τ} □-Elim

\frac{Γ ⊢ plug_{□} □N in M using H : τ}{Γ ⊢ □ eq(M, N, H) : Id_{τ}(plug_{□} □N in M using H , M[N])} □-Eq

Proof. Assume σ ∈ Fam(Γ). We define □σ ∈ Fam(Γ) by □σ_{set} := σ_{set} and

□σ_{rel}[γ, γ′: Γ_{set}, x: σ_{set}[γ], x′: σ_{set}[γ′]] = σ_{rel}[γ, x, x] × σ_{rel}[γ, x′, x′]

Furthermore, we put □σ_{reindex} = σ_{reindex}. The other components are straightforward. If M ∈ Sect(σ) then □M ∈ Sect(□σ) is given by □M_{el} = M_{el} and □M_{resp} is trivial. Finally, if M : Sect(τ{p(σ)}) and N ∈ Sect(□σ) and H ∈ Sect(Id(M{p(σ)^{+}}, M{p(σ^{+})})), i.e. as in the premises to rule □-Elim, then we define plug_{□} N in M using H ∈ Sect(τ) by

plug_{□} N in M using H_{el}[γ: Γ_{set}] := M_{el}[γ , N_{el}[γ] , N_{resp}[γ, Γ_{refl}[γ]].1]

The −_{resp} part of this section is combined using τ_{trans} out of an instance of H_{el} and M_{resp} applied to instances of N and an instance of σ_{reindex} applied to N. One cannot use H directly because it only works for elements over one and the same γ: Γ_{set}, whereas for the required −_{resp}-part we must compare elements over different (albeit related) elements of Γ_{set}. With σ_{reindex} being part of the definition of plug we cannot achieve □-Eq up to definitional equality for the same reason as in the situation of identity types where Id-Comp only holds propositionally. □

We remark that an analogue to the dependent quotient elimination rule Q-I-Elim is definable and that a definitional counterpart to □-Eq would be desirable, but cannot be interpreted in S_{1}.

An application of squash types is that they permit the definition of existential quantification as

∃x: σ.τ[x] := □Σx: σ.τ[x]

For this existential quantifier the usual intuitionistic introduction and elimination rules can be defined, but with the restriction that in the elimination rule the conclusion type must be at most single valued, i.e. any two elements of it must be propositionally equal. In particular, for this existential quantifier we can prove unique choice, i.e. if Γ ⊢ σ then the following type is inhabited:

(∃x: σ.1) × (Πx, x′: σ.Id(x, x′)) → σ

We also conjecture that the schemes “countable choice” and “dependent choice” from Sect. 5.1.4.2 (with ∀ replaced by Π) are inhabited.

We believe that one can define a choice operator for the squash type similar to the one in Sect. 5.1.7, but we have not checked the details.

5.3.5.1 Universes

We were also unable to identify a universe in S_{1} closed under Π-types. The obvious candidate would have as underlying set the type:

ΣS : U.ΣS_{r} : El(S) → El(S) → U.  type and relation
(Πs, s′ : El(S).El(S_{r} s s′) → El(S_{r} s′ s)) ×  symmetry
(Πs, s′, s′′ : El(S).El(S_{r} s s′) → El(S_{r} s′ s′′) → El(S_{r} s s′′))  transitivity

and the identity type as relation. Contrary to what we stated in [44] this universe is apparently not closed under the Π-type former, unless one assumes functional extensionality in the underlying target type theory. This universe does, however, contain the empty type and a unit type so that it may e.g. be used to derive Peano’s fourth axiom.

We conjecture that it is possible to add a universe to S_{1} using the method described in Sect. 5.2.2.6 with the same restriction on the source type theory, i.e. the extensional concepts are then only available inside the universe.

5.4 Discussion and related work

An interpretation of types, sorts or sets as sets together with (partial) equivalence relations with a corresponding relativisation of quantifiers and abstractions has been proposed by several authors with various aims.

The first was probably Gandy [35] who gives an interpretation of simple type theory (no dependency) in itself to establish relative consistency of an extensionality axiom (corresponding to our Propositions 5.1.5 and 5.3.11). In [36] he extends this result to Gödel-Bernays’ formulation of axiomatic set theory. There he emphasises the semantic character of his method by using the term inner model for the interpretation. Gandy also recognises the value of the interpretation itself as an explanation of the nature of extensionality: “The results of this paper may be … expressed by saying: in ordinary mathematics it is not possible to prove the existence of non-extensional quantities”.

Feferman [32, Sect. 4.4.2] strengthens Gandy’s result by proving conservativity of extensionality w.r.t. second-order formulae. His method does not seem to generalise easily to type dependency, which is why we must content ourselves with Conjecture 3.2.23. Luckhardt [63] applies Gandy’s method to higher-order Heyting arithmetic.

Assemblies together with (partial) equivalence relations as a formalisation of the notion of a set underlies Bishop’s approach to constructive analysis [9] and has also been used by Bénabou [8] where these objects are called ensembles empiriques (empirical sets). Bénabou’s setting differs from Bishop’s because the relation in empirical sets is “proof relevant” very much like the −_{rel}-part in groupoids, however the set of proofs that two objects are related carries a structure of topological space there. Bénabou’s motivating example is the set of stars where a “proof” that two stars are “equivalent” is a person who sees them identified. The set of persons is assumed to be endowed with a structure of a topological space expressing closeness. The “relation” thus defined is symmetric and transitive and moreover has the property of observational stability, namely that for any two points the set of proofs that they are related is open. Or to stay within the example, if p mixes up stars x and x′ and p′ is close enough to p then p′ identifies them, too. Bénabou then defines functional relations between empirical sets and proves that with this notion of morphism the empirical sets form a topos, in fact are the topos of sheaves over the topological space of observers. Bénabou’s main objective seems to be of a pedagogical nature, namely to find an intuitive way of explaining sheaves and toposes.

This bears some resemblance with the Scott-Fourman theory of existence and identity [95] and the construction of a topos out of a categorical model of higherorder logic (“tripos”) described in [51]. Again, a category is formed the objects of which are objects of some category endowed with an abstract equivalence relation and the morphisms are functional relations. We believe that Bénabou’s construction can be cast into this abstract framework. The motivating example in [51], the effective topos [50] is of a similar nature.

With the exception of Bishop’s approach (and ours) in all these constructions the morphisms between “setoids” are functional relations rather than functions preserving the relations. The reason for this is that functional relations provide the axiom of unique choice which is crucial to topos logic.^{5} In the Calculus of Constructions or extensions of it like S_{0}, this axiom may be phrased as follows:

\frac{Γ ⊢ σ Γ ⊢ P : Prf(∃x: σ.∀y: σ.x =^{L} y)}{Γ ⊢ AC!(P) : σ} AC!

This axiom thus blurs the distinction between proofs and datatypes present in S_{0} because it allows to construct an element of type σ out of a proof. Obviously, with functional relations instead of functions one achieves unique choice because one identifies elements of a type with premises to the unique choice axiom.

We have not considered functional relations and unique choice for two reasons. First, we want the interpretation function to map functions to functions, i.e. algorithms, rather than functional relations, i.e. specifications. Second, with functional relations as morphisms it does not seem possible to keep propositionally equal elements distinct intensionally^{6}, so that we lose the decidable semantic equality and also the choice principle. Of course, setoids with functional relations as morphisms have their own merits, but for this project we found it interesting to look at the other alternative. Some more thoughts on the issue of functions vs. functional relations and unique choice can be found in Sect. 6.5.1. We also remark that if we express totality of a functional relation using Σ-types instead of existential quantification then there is no difference between functions and functional relations. This is for example the case in the type theory suggested in Remark 5.1.11.

5Due to the set-theoretic nature of Bénabou’s setting, unique choice is present even if one takes functions instead of functional relations.

6We have no precise proof of this because there is more than one way of setting up a type-theoretic setoid model with functional relations as morphisms, but in the obvious one one has to make this identification for example in order to define substitution in families.

Bénabou also considers a categorical version of empirical sets called théorie d’appartenance et égalité formelle in which a “setoid” is simply a span in a category along with morphisms witnessing reflexivity, symmetry, and transitivity. These morphisms are to obey equational laws similar to the groupoid equations in Sect. 5.2. Morphisms between these objects are again (suitably defined) functional relations. Closely related to this is Carboni’s explicit description of the exact completion of a left exact category [14]. This category has as objects spans with structural morphisms witnessing reflexivity, symmetry, and transitivity; and morphisms are morphisms in the underlying category respecting the relations.

It deserves mention that in none of these categorical approaches is type dependency a primitive. It can be encoded using pullbacks or subsets of cartesian products, but only in an extensional setting where definitional and propositional equality are identified.

Jacobs [54] and Mendler [79] have looked at categorical re-formulations of the syntax of quotient types in the context of simple type theory and extensional type theory, respectively. Jacobs identifies (extensional) quotient types as left adjoint to equality, whereas Mendler proves that they correspond to coequalisers. For our purposes the syntax is not really important, we feel free to add or remove rules as long as this is sound w.r.t. the setoid semantics and corresponds to (constructive) mathematical practice.

Applications

In this chapter we describe some small applications of the extended type theories studied in this thesis. Most of the applications only use the extensional concepts qua constants; the additional definitional equalities gained by the interpretation in the various syntactic models are not used. This allows us to carry out the examples within the existing Lego system by merely working in a context containing assumptions for the various extensional concepts (see Appendix A). Most of the examples have been carried out in Lego, but we prefer to stick to the notation used so far and not give actual Lego syntax here. The main purpose of the examples is to explain the usefulness of extensional concepts as opposed to a direct encoding in pure intensional type theory according to one of the syntactic models.

This becomes particularly clear in Sect. 6.1 where subset types are heavily used and in Sect. 6.2 which explores an encoding of streams using functional extensionality. The example of category theory in type theory (Sect. 6.3) shows how the obvious encoding of categories in type theories with extensional concepts gets translated in the various setoid models. The resulting encodings of category theory in pure intensional type theory are quite complex, which we see as evidence for the structuring and taxonomic aspect of setoid models.

The explicit unfolding of the interpretation in the setoid models is pursued further in Sect. 6.4 where we show how a familiar encoding of coproduct types in extensional type theory gets interpreted in pure intensional type theory. On the one hand, this constitutes an interesting application of functional extensionality, on the other hand it exemplifies the elimination of this concept by way of the interpretation in the setoid models.

Section 6.5 aims at a comparison between quotient types and the usual settheoretic encoding of quotienting. This also sheds some light on the difference between setoid models and toposes and the role of “unique choice”. The last example (Sect. 6.6) provides evidence for the usefulness of the conservativity of equality reflection over intensional type theory with extensional concepts (Thm. 3.2.5).

In order to prove the practical usefulness of intensional type theory with extensional concepts, larger case studies taken from Computer Science and constructive mathematics would be required. However, we felt that subsequent research in this field would benefit more from the present short examples, each of which highlights a specific topic or problem raised in this work.

6.1 Tarski’s fixpoint theorem

Our aim is to give a formalisation of the following general form of Tarski’s fixpoint theorem [102]. Our formalisation is based on a previous one by Randy Pollack [91] which uses the Extended Calculus of Constructions [67] without extensional concepts added.

Definition 6.1.1 A poset (T, ≤) is a complete lattice if every subset P ⊂ T has a (necessarily unique) least upper bound (lub) ⋁ P in T.

Theorem 6.1.2 (Tarski) Let (T, ≤) be a complete lattice and f : T → T be monotone. The sub-poset of fixpoints of f is then a complete lattice, too.

“Informal” proof. We first note that if P ⊂ T then P has also a greatest lower bound in T given by ⋀ P := ⋁{x|x ≤ P }. This implies that the dual of a complete lattice is a complete lattice again.

Now we show that the lub of the set of “post-fixpoints” of f, i.e. ⋁{x|x ≤ f(x)}, is a fixpoint of f and that it is actually the greatest fixpoint, i.e. that

⋁{x|x ≤ f(x)} = ⋁{x|x = f(x)}

Both properties follow by expanding the definition of “least upper bound”. By duality we also obtain the existence of least fixpoints.

Next we observe that for any x ∈ T the sub-poset ↑ x = {y|x ≤ y} of elements above x is a complete lattice. The lub of P ⊂ ↑ x in ↑ x is given by the lub of P ∪{x} in T. The verification is by case distinction on whether or not P is empty.

Now given a subset P ⊂ {x|x = f(x)} of the fixpoints of f let l be its lub in T. First, we show that f restricts to ↑ l. Suppose that l ≤ x. We want to show that l ≤ f(x). Since l is a lub this amounts to showing that P ≤ f(x), but this follows from the assumption and the fact that P contains fixpoints only. Now let w be the least fixpoint of f viewed as a function on ↑ l. This fixpoint exists since by the above ↑ l is a complete lattice. We claim that w is the desired lub of P in {x|x = f(x)}. Obviously, w is an upper bound of P since w ≥ l ≥ P. On the other hand, if P ≤ w′ and w′ is a fixpoint of f then l ≤ w′ by definition of l and thus—since w is the least fixpoint of f above l—we have w ≤ w′ as required. □

The structure of this proof is somewhat intriguing since the facts about completeness and fixpoints are first proved for T and later on in the proof instantiated with other partial orders obtained from T by restriction. If we are to formalise this proof in some dependent type theory we therefore have to prove these preliminary facts for arbitrary posets and later on instantiate them. Now if we define a poset as a type together with a binary Prop-valued relation for example, then (without subset types) there is no way of identifying the up-closure ↑ x of an element x as a poset again.

In the formal proof by Pollack this difficulty is overcome by representing the underlying set of a poset not merely as a type, but as a type together with a Propvalued predicate^{1} which singles out the intended elements. The poset axioms are then relativised to the intended elements and so are further notions such as lubs and fixpoints. This is where the deliverables model from Chapter 4 comes in. Since in this model ordinary types are in fact modelled as types with Prop-valued predicates, we can get away with the previous naive definition of a poset as having merely a type as underlying set. The interpretation of the development in the model should then roughly give rise to Pollack’s proof, but we don’t even need to carry out the translation if we are merely interested in the existence of a proof. The formal proof obtained thus is substantially shorter than Pollack’s original proof and moreover follows much closer the informal proof given above. The reason is that we do not need to verify each time we apply an operation or a law that all the arguments satisfy the relativising predicate. A certain drawback of the use of subset types is the need for explicit coercion functions from subsets to their supersets. In Pollack’s proof coercions arise only at the level of the predicates, but not at the level of the terms themselves.

1Actually, Pollack uses partial equivalence relations rather than just predicates, but

Let us now describe the details of the proof. We work in the internal language of the deliverables model, i.e. we assume the additional term and type formers introduced there, notably subset types and proof-irrelevance. We also require a universe (U, El) to define a type of posets which makes the presentation more compact, but could in principle be avoided by using type variables. To increase readability we do not explicitly write down the El- and Prf-operators and we use the abbreviations for logical connectives and quantifiers introduced in Chapter 4. We also allow infix notation for the ordering ≤.

In the context T: U, ≤: T → T → Prop we define a proposition PO stating that (T, ≤) forms a partial order and CL stating that (T, ≤) is actually a complete lattice. The definition of CL uses four auxiliary predicates expressing that an element of T is a lower, upper, least upper bound or greatest lower bound of some property P : T → Prop.

since the present proof does not make use of quotienting, the extra generality offered by using PERs is not needed.

lower[P: T → Prop, x: T] = ∀z: T.(P z) ⇒ x ≤ z
upper[P: T → Prop, x: T] = ∀z: T.(P z) ⇒ z ≤ x
lub[P: T → Prop, x: T] = upper[P, x] ∧ lower[λy: T.upper[P, y] , x]
glb[P: T → Prop, x: T] = lower[P, x] ∧ upper[λy: T.lower[P, y] , x]
CL = PO ∧ ∀P: T → Prop.∃x: T.lub[P, x]

Furthermore, if f: T → T we define a predicate mon[f] stating that f is monotone w.r.t. ≤ and if in addition P: T → Prop we define a predicate closed[f, P] expressing that P is preserved by f. We also define predicates fix[f, x] := (x =^{L} f x) and prefix[f, x] := (x ≤ f x). Notice that all the definitions made so far depend on T and ≤ and that these can be instantiated using substitutions. E.g. the proposition PO[T, λx, y: T.y ≤ x] expresses that the dual of (T, ≤) is a poset.

We keep the variables T, ≤, f and assume proofs of the propositions CL[T, ≤] and mon[T, ≤, f]. We may then construct the following proofs:

fpu[f] : ∀u: T.lub[λx: T.prefix[f, x] , u] ⇒ fixpt[f, u]
lubfpsu[f] : ∀u ∈ T.lub[λx: T.prefix[f, x] , u] ⇒ lub[λx: T.fix[f, x] , u]

establishing that the lub of the set of pre-fixpoints is a fixpoint and actually the greatest fixpoint. We also prove that complete lattices have glbs.

Glb : ∀P: T → Prop.∃g: T.glb[P, g]

by constructing g as the lub of the lower bounds.

Now while keeping T, ≤, and f we instantiate the definitions made so far with different arguments. Whenever P : T → Prop we may form the subset type {x: T |P x} and define an order ≤′ on this type by pre-composing the relation ≤ by the injection wit(−).

≤′= λx, y: {x: T |P x}.wit(x) ≤ wit(y)

Henceforth we write ≤ instead of ≤′. Now we prove the proposition PO[{x: T |P x}, ≤], i.e. that a subset of a poset is a poset again and use this to establish the main lemma, namely that the up-closure of some element of a complete lattice is a complete lattice. The up-closure is represented as ↑ x := {y: T |x ≤ y}.

upsCL : ∀x: T.CL[↑ x, ≤]

Roughly, this proof upsCL is constructed as follows. Assuming x: T and P : {y: T |x ≤ y} → Prop we construct a predicate P′ on T as

λy: T.∃p: (x ≤ y).(P (y)_{p}) ∨ x =^{L} y

following the set-theoretic definition in the informal proof (Recall that (y)_{p} : ↑ x is an instance of the introduction operator for subset types.). The existential quantification over proofs that y lies in the subset is required to lift the predicate P to the whole of T. Another way of doing so would be to use the extend-operator from Sect. 4.6.2.

We may now use proof-irrelevance to deduce that if y: T and p: x ≤ y then P′ y iff (P (y)_{p}) ∨ x =^{L} y. (Had we used the extend-operator this would be an instance of {}-Elim-Nonprop-Comp.) We then follow the informal proof.

Now we prove that f is increasing on lubs of sets of fixpoints.

∀P: T → Prop.(∀a: T.(P a) ⇒ fixpt[f, a]) ⇒ ∀l: T.lub[P, l] ⇒ l ≤ (f l)

We then form the subset of fixpoints Fix := {x: T |x =^{L} f x} and focus on the main goal

CL[Fix, ≤]

where again ≤ refers to the restriction of the original ordering to Fix. It is trivial to show that this is again a partial order. Given P : Fix → Prop we use existential elimination on ∃l: T.lub[λa: T.∃p: fixpt[f, a].P (a)_{p}, l] giving a variable l: T and a proof that l is the lub in T of the P “lifted” to T using existential quantification over proofs as above. Next we use existential elimination with

Glb[↑ l, ≤, upsCL l] λc: ↑ l.f wit(c) ≤ wit(c)

giving w: ↑ l and a proof that it is the greatest lower bound of the post-fixpoints in ↑ l. Here we use f still as a function on T. We then need to show that l ≤ f(wit(c)) if c: ↑ l in order to get that w is actually a fixpoint of f. Another possibility would be to explicitly construct an f′: ↑ l → ↑ l and to take the least fixpoint of this function. One concludes as in the informal proof.

6.1.1 Discussion

The pattern of the formal proof follows quite closely the informal one except for the coercion functions between subsets and their supersets. B. Reus, who has been using a similar type theory to develop synthetic domain theory in Lego, has reported that these coercions are extremely cumbersome. In general, the coercions seem unavoidable, unless one gives up decidability and explicit proof objects; one could, however, imagine a system in which coercions from a subset type to a nonpropositional supertype in the sense of Sect. 4.6.2 may be elided. This ties in with Hayashi’s ATTT [43] where one has implicit coercions between refinement types and basic types. The details of this in the context of the deliverables model remain to be worked out, though.

Apart from its simplicity, the present formalisation using subset types also has the advantage of being more convincing than the proof in the pure Calculus of Constructions by Pollack, since it is closer to the intended set-theoretic understanding of posets and lattices.

6.2 Streams in type theory

We assume a type theory with functional extensionality, e.g. the internal language of the model S_{0} or S_{1}. For definiteness we assume S_{0} and thus functional extensionality w.r.t. Leibniz equality. Given a type σ (not necessarily in the empty context) we form a type of infinite lists (“streams”) over σ as

Str(σ) := N → σ

If S : Str(σ) we put

Hd_{σ}(S) := S 0 : σ

and

Tl_{σ}(S) := λn: N.S (Suc(n))

Now we define a bisimulation as a relation s, s′: Str(σ) ⊢ R : Prop with the property that ∀s, s′: Str(σ).R[s, s′] ⇒ Hd(s) =^{L} Hd(s′) and ∀s, s′: Str(σ).R[s, s′] ⇒ R[Tl(s), Tl(s′)]. In this case we can establish the coinduction principle

s, s′: Str(σ) ⊢ R[s, s′] ⇒ s =^{L} s′ true

In other words, bisimilar streams may be substituted for one another in an arbitrary context. The (straightforward) proof of this uses functional extensionality to reduce equality on streams to equality on σ and induction (R^{N}).

Streams can be constructed using co-iteration [61,111] as follows. If out : τ → σ and step : τ → τ then for init : τ we put

CoIt_{σ,τ}(out, step, init) = λn: N.out (step^{n} init) : Str(σ)

where −^{n} is the n-th iteration of a function defined using R^{N}. Now by the rules for definitional equality we have

Hd(CoIt_{σ,τ}(out, step, init)) = out init : σ  (6.1)
Tl(CoIt_{σ,τ}(out, step, init)) = CoIt_{σ,τ}(out, step, step init) : Str(σ)  (6.2)

For example if M : σ we may define a constant stream

Const(M) = CoIt_{σ,1}(λx: 1.M, λx: 1.x, ⋆)

It satisfies Hd(Const(M)) = M and Tl(Const(M)) =^{L} Const(M) by coinduction.

More generally, using coinduction we can show terminality of Str(σ), i.e. that any function f : τ → Str(σ) which satisfies the two equations 6.1 and 6.2 above up to propositional equality must be propositionally equal to λx: τ.CoIt_{σ,τ}(out, step, x).

To be independent of the “implementation” of streams as functions one also needs a prefixing^{2} operation: if M: σ and S: Str(σ) then

Pref(M, S) = λn: N.R_{[x:N]σ}^{N}(M, λx: N.λs: σ.S x , n)

satisfying Hd(Pref(M, S)) = M and Tl(Pref(M, S)) = S. Prefixing is also primitive in Coquand’s approach to infinite objects [18] and infinite lists in Martin-Löf’s non-standard type theory [73,74]. Using coinduction we can prove that Pref(Hd(S), Tl(S)) =^{L} S for S : Str(S).

Possibly terminating streams, i.e. solutions to domain equations of the form

Θ ≅ (σ ⊗ Θ)_{⊥}

have been proposed as a model of dataflow networks [57]—these are networks of agents communicating via channels with unbounded capacity playing a role in protocol verification [98,29].

If the infinite streams described above are used instead of possibly terminating ones, one has the advantage that liveness, i.e. the absence of deadlock modelled by a terminating stream, is built into the typing. A certain difficulty arises from the ubiquitous use of the fixpoint combinator for the definition of domain-theoretic streams. (For example, the behaviour of a dataflow network is defined as the least solution to a system of fixpoint equations obtained from the specification of the agents and the geometry of the network.) Since for the type Str(σ) obviously no fixpoint combinator can be available (for instance λs: Str(N).Const(Suc(Hd(s))) has no fixpoint and λs: Str(σ).Tl(s) has no unique fixpoint which could be obtained by an iterative process^{3}), we cannot immediately compute the solution of such equations. Not surprisingly, this is the point where we have to supply a proof of “liveness”, i.e. a proof that the domain-theoretic least fixpoint of a function on streams is indeed infinite. Fortunately, due to the simplicity of the above domain equation we can always compute a candidate for this least fixpoint which coincides with the least fixpoint if the latter happens to be infinite.

2In fact, prefixing is definable in terms of co-iteration using function types, but it seems more economic to define it directly as above. Prefixing can also be defined in terms of a generalised version of co-iteration, co-recursion, as is shown in [61].

3The domain-theoretic least fixpoint of these functions is in both cases the undefined stream.

Suppose that F : Str(σ) → Str(σ) and that σ is inhabited, e.g. by M : σ. If the least fixpoint of F^{4} is total then Hd(F s) must be independent of s so a “guess” for it is M_{0} := Hd(F (Const(M))). Continuing with the iteration, we obtain the tail of the fixpoint as the fixpoint of the function

λs: Str(σ).Tl(F (Pref(M_{0}, s)))

This suggests the following definition for the candidate for fixpoints.

Fix(F, M) = CoIt_{σ,Str(σ)→Str(σ)}(
λF: Str(σ) → Str(σ).Hd(F (Const(M))) ,
λF: Str(σ) → Str(σ).λx: Str(σ).Tl(F (Pref(Hd(F (Const(M))), x))) ,
F)

We acknowledge that this is not a very efficient implementation, but if so desired one may always translate instances of Fix using general recursion and prove once and for all that the thus extracted general recursive programs never deadlock.

Along with this candidate we define a totality predicate on “stream transformers” as a greatest fixpoint:

Total(F : Str(σ) → Str(σ)) = ∃P: (Str(σ) → Str(σ)) → Prop.(P F) ∧ (∀F.(P F) ⇒

∃x: σ.(∀s: Str(σ).Hd(F s) =^{L} x)∧

P (λs: Str(σ).Tl(F (Pref(x, s)))))

Here the first line is a higher-order encoding of the greatest fixpoint of the remainder when abstracted from P. Using coinduction it is possible to prove the following proposition:

4“Least fixpoint” is understood informally here via some again informal embedding of Str(σ) into Θ—the domain of possibly terminating streams.

∀F: Str(σ) → Str(σ).∀m: σ.

Total(F) ⇒ F (Fix(F, x)) =^{L} Fix(F, x)

and also that every other fixpoint of F equals Fix(F, x). This proof (which we have carried out in Lego) makes heavy use of the property that every function and predicate respects bisimilarity. It would highly complicate the proof if one did not have coinduction and instead used a defined “book-equality” on streams. If, for conceptual reasons, one is interested in such a development, one may always translate the present proof using the interpretation in one of the setoid models.

It is possible to justify the choice of Total using an intuitive domain-theoretic argument. It turns out that whenever F : Θ → Θ has an infinite least fixpoint in the domain-theoretic sense and the domain S of elements of the streams is flat, then F must satisfy the predicate Total. Indeed, if the least fixpoint of F is infinite then F ⊥ must be different from ⊥ and therefore m_{0} := Hd(F ⊥) must be different from ⊥. Thus, since S is flat, λs.Hd(F ⊥) must be the constant function λs.m_{0}. Now recall the “dinaturality principle” [90] for the least fixpoint Y(f ∘ g) = f(Y(g ∘ f)). Consider Tl(Y(F)). We have:

Tl(Y(F))
= Tl(Y(λs.Pref(Hd(F s), Tl(F s))))  since F s ≠ ⊥
= Tl(Y(λs.Pref(m_{0}, Tl(F s))))
= Y(λs.Tl(F (Pref(m_{0}, s))))  by dinaturality.

Thus Total(F) is satisfied for the predicate P := λF.“Y(F) is infinite”

A simple application of Fix and Total is the recursive definition of Const(M) as the fixpoint of F = λs: Str(σ).Pref(M, s). This satisfies Total with the obvious choice P = λf.f =^{L} F because Hd(F s) = M and Tl(F (Pref(M, s))) = F.

We remark that in a Lego development we have been able to prove “Total” for the central loop of the alternating bit protocol in the setup of Dybjer and Sander [29] and could thus redo their domain-theoretic proof in the setting of (total) type theory.

6.3 Category theory in type theory

Formulating category theory within type theory is a nice application of dependent types and propositional equality. Several authors have attempted to formalise bits of category theory in type-theoretic systems with varying results [33,48,4]. In fact, Luo [66] reports that giving a sound foundation for category theory was one of Martin-Löf’s original motivations for introducing his type theories [70].

Our own experience suggests that the simplest approach is to use propositional equality for both objects and morphisms. In this way we have managed to give a formal proof of the Yoneda Lemma in Lego—a nontrivial task because it necessitates the formalisation of presheaf categories which in turn mix up equality of objects and of morphisms. Our formalisation makes use of functional extensionality in various places.

Here we will not reproduce this fairly obvious formalisation, but rather explain how the definition of a category using propositional equality gets translated into setoids using the models S_{0} and S_{1}. The resulting structures bear resemblance with Hornung’s and Huet’s formalisations [33,48] which, however, lack object equality and therefore do not seem to permit the definition of functor categories. (In [33] this is possible using intensional equality for objects, however more complicated constructions mixing equality of objects and arrows do not seem to go through anymore.) This application shows how the setoids models can be used as a guideline for formalisations if one does insist on using (partial) equivalence relations rather than propositional equality.

Let us first recall the definition of a category using propositional equality.

Definition 6.3.1 In type theory with extensional concepts a category is given by a type ⊢ Ob of objects, a family of types

x, y: Ob ⊢ Mor[x, y]

of morphisms, an operation

x: Ob ⊢ id[x] : Mor[x, x]

an operation

x, y, z: Ob , f: Mor[x, y], g: Mor[y, z] ⊢ comp[x, y, z, g, f] : Mor[x, z]

and the following operations corresponding to the usual axioms where comp[x, y, z, g, f] is abbreviated by g ∘ f:

x, y: Ob , f: Mor[x, y] ⊢ idL[f] : Id_{Mor[x,y]}(f ∘ id[x], f)
x, y: Ob , f: Mor[x, y] ⊢ idR[f] : Id_{Mor[x,y]}(id[y] ∘ f, f)
x, y, z, w: Ob , f: Mor[x, y], g: Mor[y, z], h: Mor[z, w] ⊢
Ass[f, g, h] : Id_{Mor[x,w]}(h ∘(g ∘ f), (h ∘ g) ∘ f)

It should be clear that this definition is stable under constructions like functor category, arrow category, slice category, opposite category etc. and has—whenever x: σ ⊢ τ[x] is a family of types—a particular instance based on Ob = σ and Mor[x, y] = τ[x] → τ[y], called Full[σ, τ]^{5}. Of special interest is the category Full[U, El] for a universe (U, El), which can be compared to the category of small sets. The use of propositional equality on objects (Id_{Ob}) is needed for instance in the definition of slice categories.

The typing of composition may suggest that composable morphisms must have definitionally rather than propositionally equal domain and codomain, respectively, and that thus we cannot use propositional equality on objects. However, using Subst we can adapt the domain and codomain of a morphism. For instance, if X, X′, Y : Ob and P : Id_{Ob}(X, X′) and F : Mor[X, Y] then we have

F′ := Subst_{Ob,[x:Ob]Mor[x,Y]}(P, F) : Mor[X′, Y]

and using Id-Elim-J we can establish properties of F′. For example, if F is an isomorphism then so is F′.

5This corresponds to the category-theoretic notion of “full internal subcategory”

defined for example in [55, Thm. 4.5.7], where it is attributed to Pénon.

6.3.1 Categories in S_{0}

In the model S_{0}, a category according to the above definition (in the empty context, for simplicity) expands to the following. The objects are represented by a type ⊢ Ob and a partial equivalence relation x, y: Ob ⊢ x = y : Prop. (We use infix notation here to increase readability. This Prop-valued equivalence on objects is not to be confounded with definitional equality which is denoted x = y : Ob.) Morphisms are represented by a single type ⊢ Mor of morphisms and a relation

x, y: Ob , f, g: Mor ⊢ f =_{x,y} g : Prop

stating that f and g are equal qua morphisms from x to y. These data are subject to the following axioms where we have used conjunction (∧) and implication (⇒) instead of context extensions:

x, y: Ob , f, g: Mor ⊢ (x = x) ∧ (y = y) ∧ f =_{x,y} g) ⇒ g =_{x,y} f true

and

x, y: Ob , f, g, h: Mor ⊢ (x = x)∧(y = y)∧(f =_{x,y} g)∧(g =_{x,y} h) ⇒ (f =_{x,y} h) true

and

x, y, x′, y′: Ob , f, g: Mor ⊢ (x = x′) ∧ (y = y′) ∧ (f =_{x,y} g) ⇒ f =_{x′,y′} g true

The identity operation now takes the form

x: Ob ⊢ id[x] : Mor

with

x, x′: Ob ⊢ (x = x′) ⇒ id[x] =_{x,x} id[x′] true

and composition takes the form

x, y, z: Ob , f, g: Mor ⊢ comp[x, y, z, g, f] : Mor

with

x, y, z, x′, y′, z′: Ob , f, g, f′, g′: Mor ⊢
x = x′ ∧ y = y′ ∧ z = z′∧
f =_{x,y} f′ ∧ g =_{y,z} g′ ⇒
comp[x, y, z, g, f] =_{x,z} comp[x′, y′, z′, g′, f′] true

In view of Lemma 5.1.6, the laws are then expressed in terms of − =_{−,−} −, e.g. idL becomes

x, y: Ob , f: Mor ⊢ x = x ∧ y = y ∧ f =_{x,y} f ⇒ comp[x, x, y, f, id[x]] =_{x,y} f true

The salient feature of this encoding is the single type of morphisms independent of the respective domains and codomains. This makes it easy to replace domain and codomain of a morphism by propositionally equal ones, but it precludes the particular instance of a category based on a universe (Full[U, El]), since such a universe is not available in S_{0}. In the extension of S_{0} by universes described in Sect. 5.1.8 the situation is different. Here we can of course construct a category with U as its set of objects, but then we do not have a substitutive equality on objects (at least not an equality with extensional concepts). Let us sketch how a category looks in this extension under the assumption that Ob has trivial −_{set} and −_{rel}-components, and that Mor has trivial −_{type}-component. A category is then given by a type Ob of objects (for instance Ob = U) and a family of types x, y: Ob ⊢ Mor[x, y] such that each of the types Mor[x, y] is endowed with a partial equivalence relation:

x, y: Ob , f, g: Mor[x, y] ⊢ f =_{x,y} g : Prop
x, y: Ob , f, g: Mor[x, y] ⊢ f =_{x,y} g ⇒ g =_{x,y} f true
x, y: Ob , f, g, h: Mor[x, y] ⊢ f =_{x,y} g ∧ g =_{x,y} h ⇒ f =_{x,y} h true

The composition operation has the usual typing:

x, y, z: Ob , f: Mor[x, y], g: Mor[y, z] ⊢ comp[x, y, z, g, f] : Mor[x, z]

and the congruence laws and the other components are as one expects them to be. This encoding of categories is quite similar to the ones offered in [48,33]:

Of course this notion of category is not stable under constructions such as functor categories because of the lack of object equality. But in the extension of S_{0} with universes both notions of category coexist (and even mixed forms where Ob has nontrivial −_{set}- and −_{type}-components), and it makes sense to call a category “small” if it has a “set of objects”, i.e. if in the source type theory Ob = El(X) for some X : U (or if in the target type theory it has trivial −_{type}-component). One would then allow the formation of a functor category C → D only if C is “small”. The same restrictions on functor categories apply in set theory, but for size reasons, not for lack of substitutive equality. We remark that such a distinction between categories which have object equality and those which don’t also is made by Bénabou in [7], albeit for different reasons.

6.3.2 Categories in S_{1}

In S_{1} we have both dependency of morphisms on objects and a substitutive object equality. This is achieved by a “reindexing” function on morphisms. Again we only treat the case of a category in the empty context and use infix “=” (not to be confused with definitional equality) for the relations on objects and morphisms. A category then consists of a type ⊢ Ob and a partial equivalence relation x, y: Ob ⊢ x = y. Unlike in S_{0}, symmetry and transitivity must now be witnessed by terms which are part of the category structure.

x, y: Ob , p: x = y ⊢ Ob_{sym}[p] : y = x
x, y, z: Ob , p: x = y , q: y = z ⊢ Ob_{trans}[p, q] : x = z

Next we have a set of morphisms indexed over “existing” objects

x, y: Ob , x̄: x = x , ȳ: y = y ⊢ Mor[x̄, ȳ]

Notice that we do not indicate the dependency on x and y since these can be inferred from x̄ and ȳ. The equality relation is defined for arbitrary morphisms not necessarily with common domain and codomain.

x, y, x′, y′: Ob , x̄: x = x , ȳ: y = y , x̄′: x′ = x′ , ȳ′: y′ = y′ ,
f: Mor[x̄, ȳ] , g: Mor[x̄′, ȳ′] ⊢
f =_{x̄,ȳ,x̄′,ȳ′} g

This equality is again symmetric and transitive with the restrictions made in Def. 5.3.4. We do not explicitly state these. More interesting is the “reindexer” for morphisms over related objects:

x, y, x′, y′: Ob , x̄: x = x , ȳ: y = y , x̄′: x′ = x′ , ȳ′: y′ = y′ ,

p: x = x′, q: y = y′ , f: Mor[x̄, ȳ] , f̄: f =_{x̄,ȳ,x̄,ȳ} f
⊢
reindex[p, q, f̄] : Mor[x̄′, ȳ′]

and in addition the axiom on reindexing

Γ ⊢ ax[p, q, f̄] : f =_{x̄,ȳ,x̄′,ȳ′} reindex[p, q, f̄]

where Γ is the context in the judgement for “reindex”. Using symmetry and transitivity we can construct a proof that reindex[p, q, f̄] is related to itself. The identities take the form

x: Ob, x̄: x = x ⊢ id[x̄] : Mor[x̄, x̄]

x, x′: Ob, x̄: x = x, x̄′: x′ = x′, p: x = x′ ⊢ id resp[p] : id[x] =_{x̄,x̄,x̄′,x̄′} id[x′]

A special case of id resp is

x: Ob, x̄: x = x ⊢ id resp[x̄] : id[x̄] =_{x̄,x̄,x̄,x̄} id[x̄]

We abbreviate this term by \overline{id}[x̄]. Composition is defined similarly:

x, y, z: Ob , x̄: x = x, ȳ: y = y, z̄: z = z ,

f: Mor[x̄, ȳ], g: Mor[ȳ, z̄] , f̄: f = f, ḡ: g = g
⊢ comp[ḡ, f̄] : Mor[x̄, z̄]
x, y, z: Ob , x̄: x = x, ȳ: y = y, z̄: z = z ,
f: Mor[x̄, ȳ], g: Mor[ȳ, z̄] , f̄: f = f, ḡ: g = g
x′, y′, z′: Ob , x̄′: x′ = x′, ȳ′: y′ = y′, z̄′: z′ = z′ ,
f′: Mor[x̄′, ȳ′], g′: Mor[ȳ′, z̄′] , f̄′: f′ = f′, ḡ′: g′ = g′
p: x = x′, q: y = y′, r: z = z′, u: f =_{x̄,ȳ,x̄′,ȳ′} f′, v: g =_{ȳ,z̄,ȳ′,z̄′} g′
⊢ comp resp[p, q, r, u, v] : comp[ḡ, f̄] =_{x,y,x′,z′} comp[ḡ′, f̄′]

Again we can define a term \overline{comp}[ḡ, f̄] witnessing “existence” of comp[ḡ, f̄]. As an example of an equational law we give again the left identity law:

x, y: Ob , x̄: x = x , ȳ: y = y , f: Mor[x̄, ȳ], f̄: f =_{x̄,ȳ,x̄,ȳ} f

⊢ idL[f̄] : comp[f̄, \overline{id}[x̄]] =_{x̄,ȳ,x̄,ȳ} f

It follows from the fact that S_{1} forms a syntactic category with attributes closed under Π-types, Σ-types, and identity types that the above encoding of categories is stable under all constructions on categories which can be carried out with the encoding based on propositional equality using these type formers. This includes functor categories, arrow categories, slice categories, the instances Full(σ, τ), and many more. Of course, many of these instances do not fully exhaust the generality of the encoding, as for example the possible dependency of composition on the “existence proofs” f̄. Nevertheless, this generality has proven necessary in order to obtain a syntactic category with attributes and so one can expect counterexamples to every simplification of the above encoding. It is, however, difficult to construct such counterexamples explicitly because even with machine support the encoding becomes unmanageable as soon as one goes beyond the simplest cases.

6.3.3 Discussion

We have seen how some reasonable encodings of category theory in type theory arise as translations of an obvious encoding using propositional equality with extensional concepts added. We consider such an encoding useful for the following two reasons.

First, a development of category theory in constructive type theory permits to directly explore the constructive content of many category-theoretic arguments, which gets hidden if tools like set-theoretic quotienting and choice from equivalence classes are being used. A case in point is Lafont’s proof [20, Sect. 4.10] that the addition of function types to an algebraic theory constitutes a conservative extension. Second, type theory as a basis of category theory is philosophically appealing as the consistency of type-theoretic systems like TT, S_{0}, S_{1} even with universes can be proved within ordinary mathematics (probably even in primitive recursive arithmetic), whereas the relative consistency of a set-theoretic foundation of category theory like Mac-Lane’s universes [69, I.6] goes beyond ZFC.

6.4 Encoding of the coproduct type

In the literature on extensional type theory various encodings of type formers from simpler or more general ones have been proposed. In particular, we have the encoding of a sum (coproduct) type using natural numbers and functions by Troelstra [107, Ex. 11.4.7] and the encoding of inductive types like the natural numbers in terms of Martin-Löf’s well-ordering type [85,39]. By the conservativity theorem 3.2.5 these encodings can also be carried out within TT_{I} and therefore give rise to counterparts in the various setoid models. Since we have not looked at interpretations of the well-ordering type in the setoid models, we only work out the example with coproducts here and leave the study of well-ordering types to future work.

By coproduct type we mean a type former which to any two types σ and τ associates a type σ + τ together with the following term formers: if M : σ then inl_{σ,τ} : σ + τ and if M : τ then inr_{σ,τ}(M) : σ + τ. If z: σ + τ ⊢ ρ[z] and x: σ ⊢ L[x]: ρ[inl_{σ,τ}(x)] and y: τ ⊢ R[y]: ρ[inr_{σ,τ}(y)] then whenever M : σ + τ we have R_{ρ}^{σ+τ}(L, R, M) : ρ[M] and the definitional equalities R_{ρ}^{σ+τ}(L, R, inl(M)) = L[M] and R_{ρ}^{σ+τ}(L, R, inr(M)) = R[M].

The abovementioned encoding of coproducts in TT_{I} requires a type (called N_{2} in [72]) with two elements (called 0 and 1) and corresponding elimination rule which in the situation z: N_{2} ⊢ σ[x], L : σ[0], R : σ[1], and M : N_{2} gives an element R_{σ}^{N_{2}}(L, R, M) : σ in such a way that R_{σ}^{N_{2}}(L, R, 0) = L and R_{σ}^{N_{2}}(L, R, 1) = R. Moreover, for each type Γ ⊢ σ a term ⊥_{σ} : Id_{N_{2}}(0, 1) → σ is required. The type N_{2} may be defined as

N_{2} := Σm: N.Σn: N.Id_{N}(m + n, Suc(0))

where + is the obvious encoding of addition in terms of R^{N}; the terms ⊥_{σ} may be defined by induction on the structure of σ [107, p. 592, Prop 4.1]. The interesting case is when σ = Id_{τ}(M, N). Here one defines a function from N_{2} to τ using R^{N_{2}} which takes on the values M, N on 0, 1, respectively, and then obtains ⊥_{Id_{τ} (M,N)} using Resp . Unlike in the extensional theory studied in loc.cit., the term ⊥_{σ} may thus contain a variable of type Id_{N_{2}}(0, 1). We remark that this definition is not possible in the presence of an empty type, but becomes again possible if the empty type is contained in a universe [97]. Troelstra and van Dalen now offer the following encoding of the coproduct type σ + τ for types σ, τ:

σ + τ := Σn: N_{2}.(Id_{N_{2}}(n, 0) → σ) × (Id_{N_{2}}(n, 1) → τ)

Indeed, if M : σ then we have

inl(M) := (0, λp: Id(0, 0).M, λp: Id(0, 1).⊥_{τ} p) : σ + τ

and analogously we define the right injection using ⊥_{σ}. Conversely, assume z: σ + τ ⊢ ρ[z], x: σ ⊢ L : ρ[inl(x)] and y: τ ⊢ R : ρ[inr(x)] and M : σ + τ. Using R^{Σ} and R^{N_{2}} the task of finding an element of ρ[M] may be reduced to finding elements of the following two types:

u: Id(0, 0) → σ, v: Id(0, 1) → τ ⊢ ρ[(0, u, v)]

u: Id(1, 0) → σ, v: Id(1, 1) → τ ⊢ ρ[(1, u, v)]

These elements in turn can be constructed using Subst and L, R, provided we can show that the variables u and v are propositionally equal to the second and third components of some instance of inl and inr, respectively. Let us focus on the first type. If u: Id(0, 0) → σ and v: Id(0, 1) → τ then using functional extensionality and uniqueness of identity we find that Id_{Id(0,0)→σ}(u, λp: Id(0, 0).u (Refl(0))) is inhabited, and using functional extensionality and an instance of ⊥, we find that Id_{Id(0,1)→τ}(v, λp: Id(0, 1).⊥_{τ} p) is inhabited. Therefore, the triple (0, u, v) is propositionally equal to inl(u (Refl(0))). Similarly for the second type.

The two equalities associated with the coproduct type can only be shown propositionally. The reason is that in the above construction IdUni gets applied to a variable and thus no reduction is possible.

6.4.1 Development in the setoid models

The above argument goes through immediately in the model S_{1} because all the constructions used are supported by this model. It also goes through in S_{0} when we replace the identity type by Leibniz equality (which is substitutive by Prop. 5.1.8), but due to the presence of an impredicative universe the definition of the terms ⊥_{σ} requires some explanation. The terms ⊥_{σ} : Prf(0 =^{L} 1) → σ are again defined by induction on the structure of σ. If σ = Prop we choose some arbitrary proposition; if σ = Prf(P) then we define a function F : N_{2} → Prop with F 0 = tt and F 1 = P and define ⊥_{Prf(P)} as

λp: Prf(0 =^{L} 1).p (λx: N_{2}.Prf(F x)) I

where I = λx: Prop.λp: Prf(x).p is the canonical proof of tt.

Notice that this implies that each of the types [[Γ | σ]]_{set}, which all “live” in the empty context, is inhabited by some element ⊥′_{σ}. This in turn is not surprising since these types are generated from 1, Prop, N by × and →.

For simplicity we assume that N_{2} is available in the target type theory; if we were to carry out its definition in terms of N and the identity type then its underlying type would be N × N and the relation would be Leibniz equality restricted to pairs with sum equal to 1.

Now let σ and τ be families of setoids which arise as values of the interpretation function (so that ⊥ is available). The underlying type of (the interpretation of) σ + τ becomes

(σ + τ)_{set} := N_{2} × σ_{set} × τ_{set}

Notice here that the underlying type of a Leibniz equality is the extensional unit type which disappears at the left of a function space.

The injections inl and inr are defined using the default elements ⊥′ in the obvious way. The relation on this type singles out the elements which lie in the image of either injection and on these elements uses the relations on σ and τ.

The elimination rule applies to a family of setoids indexed over σ + τ, but by definition of families its underlying type (call it ρ) does not depend on σ + τ. The input to the elimination rule thus consists of functions σ_{set} → ρ and τ_{set} → ρ and an element M of σ + τ. The conclusion is then obtained by case distinction on the first component of M and application of either function to the second and third component, respectively. We omit the verifications.

Explicitly carrying out the construction in S_{1} is quite complicated and would probably not clarify much. The key step, however, where the elimination of functional extensionality takes place, is quite instructive and relatively easy to explain. The need for functional extensionality in the definition of the eliminator R^{σ+τ} came from the need for constructing an element of ρ[(0, u, v)] from an element of ρ[(0, u′, v′)] (for some u′ and v′) under the assumption that u, u′ and v, v′ are point-wise equal functions. In TT_{I} one first concludes that these functions are propositionally equal and then uses Subst ; within the model S_{1}, the family ρ comes with a “reindexer” which allows to pass between fibres over related elements, so that in order to pass between the two instances of ρ one only needs relatedness of (0, u, v) and (0, u′, v′) which is defined pointwise.

6.5 Some basic constructions with quotient types

In a series of books a collective of French mathematicians has under the pseudonym “N. Bourbaki” attempted to put all of mathematics, in particular geometry and algebra, on a solid axiomatic foundation based on set theory. They emphasise abstraction and modularisation: the set-theoretic encoding of a concept is used as little as possible and derived universal properties are employed instead. Their first book [10] is on basic set-theoretic constructions and contains a section on quotient sets where some universal constructions with them are given. As an application of the quotient type formers we shall in this section try to redo these constructions in a type-theoretic setting. The emphasis on abstraction in the Bourbaki approach makes it particularly apt for a development in type theory.

As in various places higher-order logic is required, we work in the impredicative type theory S_{0}. Parts of the development can also be carried out using the quotient types for first-order Martin-Löf type theory given in Sect. 3.2.6.1.

6.5.1 Canonical factorisation of a function

A function x: σ ⊢ f[x] : τ is a surjection if ∀y: τ.∃x: σ.f[x] =^{L} y holds; f is an injection if ∀x, x′: σ.f[x] =^{L} f[x′] ⇒ x =^{L} x′ holds. Notice that due to the lack of the axiom of choice it is not the case in type theory that every surjection has a right inverse. It is also not the case that if a function is both surjective and injective then it has an inverse. This would be equivalent to the axiom of unique choice (AC!) which is not available in S_{0}. (We come back to this point later.) If y: τ ⊢ g[y] : ρ is another function then we write g ∘ f for the function x: σ ⊢ g[f[x]] : ρ. We extend Leibniz equality to functions in the obvious way.

Now let x: σ ⊢ f[x] : τ be any function and consider the equivalence relation R[x, x′: σ] := (f[x])=^{L}(f[x′]). By definition of R the function f lifts to the quotient type σ/R, that is we have

x: σ/R ⊢ g[x] := plug_{R} x in f using ([x, x′: σ, p: R[x, x′]]p) : τ

and by Q-Comp we get x: σ ⊢ f[x] = g[[x]_{R}]. Using Qind we readily establish that g is injective and that h[x: σ] := [x]_{R} is surjective. The thus obtained factorisation of f into a surjection and an injection is initial among all such. This means that if x: σ ⊢ s[x] : ρ is surjective and y: ρ ⊢ i[y] : τ is injective and f =^{L} i ∘ s then there exists a unique (up to =^{L}) function x: σ/R ⊢ u[x] : ρ such that u ∘ h=^{L}s and i ∘ h=^{L}g. Indeed, we obtain u as the lifting of s.

Bourbaki now points out that the quotient σ/R is in bijective correspondence with the image of σ under f, i.e. the subset of τ consisting of those elements which have an inverse image in σ. In fact they factor f as a three-fold composition of the class-map, this bijection, and the injection from the image into τ. If we code the image of f in type theory as^{6}

Im(f) := Σy: τ.Prf(∃x: σ.(f x) =^{L} y)

6We could also use a subset type former, but since we haven’t explicitly described it in S_{0} we use Σ-types instead.

then we obtain another factorisation of f into a surjection and an injection, this time through Im(f). It is easy to see that this factorisation is terminal (up to propositional equality). Using either initiality or terminality we obtain a function l : σ/R → Im(f).

Since we lack unique choice, we are, however, unable to define an inverse to this. If we had AC! in the sense of Sect. 5.4 we could construct an inverse as follows. Given u : Im(f) we form the type Σz: σ/R.l[x] =^{L} u and prove using ∃- elimination that this type contains a unique element. If P is a proof term for this then we can form λu: Im(f).AC!(P) providing the desired inverse to l.

Let us note that in the model S_{0} the above mapping l is the function f itself, whereas an inverse to l would have to be a mapping in the other direction which need not necessarily exist, for instance if σ_{set} is empty.

We remark that if we had unique choice then we could define quotient types in the usual way as the subset of σ → Prop consisting of “equivalence classes”. We also remark that if we use the Σ-type instead of ∃ to define images then we have of course “choice”, but the projection from Im(f) to τ would not be injective.

Bourbaki also explains that any equivalence relation (in the sense of Sect. 5.1.10) R on σ can be seen as being of the above form using the function f which sends an element x: σ to the set of elements related to x. In the impredicative type theory S_{0} this can be mimicked by putting f[x] := λx′: σ.R[x, x′] : σ → Prop. We have

x, y: σ ⊢ (f[x] =^{L} f[y]) =^{L} R[x, y] true

by propositional extensionality. In first-order type theory (S_{1}) this is, however, not possible.

6.5.2 Some categorical properties of S_{0}

One may look at the issue of factorisation from a more modern category-theoretic view as follows. A regular epi is a surjection which can be obtained as the coequaliser of two functions. Conversely, a regular mono is an equaliser of a parallel pair. Let S_{0}/=^{L} be the category obtained from S_{0} by taking closed types as objects and functions up to propositional equality as morphisms. The regular epis in S_{0}/=^{L} are precisely those which can be obtained from class maps by pre- and post-composing with isomorphisms (notice that x: σ ⊢ [x]_{R} : σ/R is the coequaliser of the two projections from Σx: σ.Σy: σ.Prf(R[x, x′]) to σ. Similarly, the regular monos are precisely those which can be obtained in this way from projections out of Σ-types with propositional second component (= subset types). Here propositional extensionality is needed. In S_{0}/=^{L} the regular epis together with injections and the surjections with regular monos each form a factorisation system [5, p. 190]. The content of unique choice in the framework of S_{0} is precisely that all surjections are regular epis and that all injections are regular monos. We also remark without proof that S_{0}/=^{L} is regular [5, p. 187], i.e. has finite limits^{7} and coequalisers (given by quotient types) which are stable under pullback (the verification of the latter property requires the dependent elimination rule for quotients Q-I-Elim). In addition this category has the property that the regular monos are “classified” by the object Prop. It is also very easy to see that the category with the same objects, but with functional relations as morphisms (again up to propositional equality) is a topos. One only has to check that σ → Prop is a “power object” in the sense of [5]. We have not pursued this category-theoretic analysis any further in this thesis because it glosses over the distinction between definitional and propositional equality, which we consider as crucial in type theory.

6.5.3 Subsets and quotients

Let σ be a type and x, x′: σ ⊢ R[x, x′] : Prop an equivalence relation. If x: σ ⊢ P [x] : Prop we may form the “subset” τ := Σx: σ.Prf(P [x]) and denote by i[x: τ] := x.1 : σ the first projection which is injective by Pr-Ir. In first-order type theory, e.g. S_{1}, we must restrict to a predicate P which is single-valued, i.e. any two proofs of which are propositionally equal, or use the squash type former.

7In order to have a canonical choice for these finite limits it is advisable to identify objects with equal −_{set} component and extensionally equal −_{rel}-components.

On τ we have the induced equivalence relation R_{τ}[x, x′] := R[i[x], i[x′]]. Now we can define a bijective correspondence between the quotient of τ by R_{τ}

ρ := τ/R_{τ}

and the image of τ under the class map from σ to σ/R, i.e. the type

φ := Σz: σ/R.∃x: τ.z =^{L} [i[x]]_{R}

In one direction (from ρ to φ) we use the lifting of the obvious map from τ to φ obtained by restricting the codomain of x: τ ⊢ [i[x]]_{R} : σ/ρ. The other direction is more complicated. In set theory, i.e. in the development of [10], one uses a right inverse to the class map from τ to τ/R_{τ}. In type theory we use the (derived) dependent elimination rule Q-I-Elim from Sections 3.2.6.1 and 5.1.5.1. We define

ζ[z: σ/R] := Πx: τ.Prf(z =^{L} [i[x]]_{R}) → τ/R_{τ}

By ∃-elimination a term of type x: σ/R ⊢ ζ[x] gives rise to a function from φ to ρ, and such term can be defined using the dependent elimination rule for quotients provided we can find a term M with

x: σ ⊢ M[x] : ζ[[x]_{R}]

together with a proof of

x, x′: σ , p: Prf(R[x, x′]) ⊢ Subst (Qax_{R}(p), M[x]) =^{L} M[x′]

We define

M[z: σ] := λx: τ.λp: Prf(z =^{L} [i[x]]_{R}).[x]_{R_{τ}}

and the proviso is readily established using functional extensionality and the definitions of τ and R_{τ}. The verification that the function obtained thus is the required inverse is straightforward.

In S_{0} this inverse would have been obtained more easily by working in the model directly rather than by using the “internal language” given by the syntax for quotient types.

6.5.4 Saturated subsets

The predicate P from above is called saturated if for each x in P the whole equivalence class associated to x is contained in P, more precisely if

∀x, y: σ.P [x] ⇒ R[x, y] ⇒ P [y]

In [10] it is noted that a subset is saturated iff it is the inverse image under the class map of some subset of the quotient set σ/R. This is true in type theory as well. Indeed, if P is saturated then we define P′[z: σ/R] := ∃x: σ.P [x] ∧ [x]_{R} =^{L} z and we have that

x: σ ⊢ P [x] =^{L} P′[[x]_{R}]

using propositional extensionality and effectiveness of the quotient type as defined in Sect. 5.1.6.4. Without effectiveness this example does not go through even if we would replace equality of predicates by bi-implication. We could also define P′ using lifting (plug). That both definitions agree requires again effectiveness.

The other direction, i.e. that an inverse image along the class map is saturated, is straightforward and only requires Qax.

Bourbaki also defines the saturation of a subset P of σ as the inverse image of the image of P under the class map. We can show that this saturation is equal to x: σ ⊢ ∃x′: σ.R[x, x′] ∧ P [x′], but again this requires effectiveness.

In loc.cit. saturatedness is extended to predicates with parameters, i.e. relations, and then called compatibility. Of particular interest is the case of functional relations where the image along the class map defines a set-theoretic analogue to lifting (plug). Since (due to the lack of unique choice) functions and functional relations are different in our type theory, we cannot sensibly compare the two definitions.

In loc.cit. a more general notion of lifting is also defined which takes a function x: σ ⊢ h[x] : τ with x, x′: σ ⊢ R[x, x′] ⇒ Q[h[x], h[x′]] for equivalence relations R and Q on σ and τ, respectively into a function from σ/R to τ/Q. In type theory we do this by lifting the composition of h with the class map for τ/Q.

6.5.5 Iterated quotients

Let σ, R be as above and z, z′: σ/R ⊢ S[z, z′] : Prop be an equivalence relation on the quotient of σ by R. On σ we define an equivalence relation T by T [x, x′] := S[[x]_{R}, [x′]_{R}]. It is argued in [10] that the quotient types (σ/R)/S and σ/T are in bijective correspondence by relating elements which come from one and the same element in σ by taking equivalence classes. In type theory we can define the bijection by appropriately lifting the class maps. In the model S_{0} the thus obtained bijection is simply the identity on σ_{set} in accordance with the set-theoretic definition.

Conversely, if T is any equivalence relation on σ which has the property that R[x, x′] entails T [x, x′] for x, x′: σ, then (since T is saturated in both x and x′) we can by the analysis in Sect. 6.5.4 define an equivalence relation S on σ/R and find that T is equal to the relation defined by pre-composing S with the class map for σ/R. Bourbaki calls the thus obtained relation S the quotient of T by R denoted T/R. One thus obtains a bijective correspondence between (σ/R)/(T/R) and σ/T.

That the above line of reasoning goes through both in the set-theoretic framework of [10] and in type theory is a nice example for the emphasis on abstraction and modularity in the Bourbaki approach.

6.5.6 Quotients and products

Let R and S be equivalence relations on σ and τ, respectively. An equivalence relation R×S on the product σ×τ is defined component-wise. One has a bijective correspondence between (σ/R) × (τ/S) and (σ × τ)/(R × S). One direction is obtained by lifting the obvious map from σ × τ to σ/R × τ/S. For the other direction we consider the function x: σ, y: τ ⊢ [(x, y)]_{R×S} : (σ × τ)/(R × S) and lift along y to obtain

w: τ/S, x: σ ⊢ plug_{R×S} w in [y: τ][(x, y)]_{R×S} using H : σ × τ/R × S

where H uses reflexivity of R, the definition of R × S and Qax. Now in order to lift this function along x we must use Qind to replace w by an equivalence class and the lifted function by its definition. This method is of use when we want to define a binary function on a quotient type. By giving such a function on representatives and showing that it respects the relations component-wise, one has, strictly speaking, defined a function on (σ × τ)/(R × S). Pre-composition with the said bijection yields the desired binary function.

This concludes the type-theoretic analysis of Bourbaki’s constructions with quotients.

6.5.7 Quotients and function spaces

Motivated by the last construction we may ask whether quotienting is compatible with function spaces, e.g. whether the type σ → τ/S is isomorphic to the quotient of σ → τ by the equivalence relation σ → S := [u, v: σ → τ]∀x: σ.S[u x, v x]. In the model S_{0} and also in set theory this is the case, but apparently this is not derivable from our syntax for quotient types. The reason lies in the fact that in topos logic, where every surjection is isomorphic to a class map, this property implies the internal axiom of choice (IAC) from Sect. 5.1.4.2 which is in general not valid. (Recall that IAC means the proposition (∀x: σ.∃y: τ.P [x, y]) → (∃f: σ → τ.∀x: σ.P [x, f x]) for all types σ, τ.) Parts of the following development also appear in a category-theoretic guise in [5, p. 251 ff.].

IAC is equivalent to saying that all surjections (in the sense of Sect. 6.5.1) split internally, i.e.

∀s : φ → ψ.(∀y: ψ∃x: φ.(s x) =^{L} y) ⇒ ∃t: ψ → φ.∀y: ψ.s(t y) =^{L} y

In order to obtain IAC from this one starts from P with ∀x: σ.∃y: τ.P [x, y] and instantiates with s being the first projection from φ := Σx: σ.Σy: τ.Prf(P [x, y]) to ψ := σ. Surjectivity of this function is precisely the assumed premise to IAC, a splitting of this surjection on the other hand gives the conclusion of IAC.

That all surjections split internally is in turn equivalent to saying that if s : φ → ψ is surjective then so is ρ → s := λu: ρ → φ.s ∘ u for all types ρ. Let us call (following [5]) a surjection with this property powerful. To obtain an internal splitting of powerful s we instantiate with ρ = ψ and apply surjectivity of ρ → s to the identity on ψ. The other direction is easy.

Now under the assumption that for every equivalence relation S on τ the types σ → τ/S and (σ → τ)/(σ → S) are isomorphic, we find that every “class map” λx: τ.[x]_{S} is powerful. This is the case in S_{0}. Unlike in a topos it is, however, not the case in S_{0} that every surjection is isomorphic to a class map. For example the surjection onto Im(f) described above (Sect. 6.5.1) does not have this property. Thus we obtain that compatibility of quotienting with function spaces is not true in a topos, unless it satisfies IAC and thus is Boolean, and this can not be derived from our syntax for quotient types which (except for the choice operator) can be interpreted in any topos. The choice operator, on the other hand, is of no use here because it only works for non-quotiented context and we want compatibility of quotients with function spaces even if one of the involved types contains free variables of quotient type.

In view of this one may consider including the isomorphism between σ → τ/S and (σ → τ)/(σ → S) as a primitive in the syntax of quotient types.

6.6 Σ is co-continuous—intensionally

In [77], Mendler shows that in a locally cartesian closed category C every “Σfunctor” Σ_{f} : C/A → C/B sending u : X → A to f ∘ u : X → B preserves directed limits and in particular limits of ω-chains. In view of the correspondence between locally cartesian closed categories and extensional type theory [96,46], this result carries over to TT_{E} and by Thm. 3.2.5 also to TT_{I}. The result has applications to encodings of coinductive types in TT_{I} (in fact the encoding of streams as N → σ is a special case) and to the intensional formulation of bisimilarity avoiding the use of impredicativity, i.e. the quantification over all bisimulations [60]. We sketch the set-theoretic instance of a special case of Mendler’s result and give a translation into TT_{E}. The crux of this example is to demonstrate the power of the conservativity theorem 3.2.5 because a direct proof in TT_{I} seems to be very complicated.

6.6.1 Parametrised limits of ω-chains

As in Sect. 5.2 we use informal Martin-Löf type theory to refer to sets and families of sets and functions between them.

Consider an ω chain of sets and functions

⋯ ^{b_{i+1}}^{}B_{i+1} ^{b_{i}}^{}B_{i} ^{b_{i−1}}^{}⋯ ^{b_{1}}^{}B_{1} ^{b_{0}}^{}B_{0}

and let L be its limit with projections π_{i} : L → B_{i}. This means that b_{i} ∘ π_{i+1} = π_{i} for i ∈ ω and that for every “compatible family” (x_{i})_{i∈ω} with x_{i} ∈ B_{i} and b_{i}(x_{i+1}) = x_{i} there exists a unique element ⟨x_{i}|i ∈ ω⟩ ∈ L with π_{i}(⟨x_{i}|i ∈ ω⟩) = x_{i}.

This defines the limit up to isomorphism. Recall that such limit L always exists and that it may be explicitly constructed as the set of compatible families by

L := {f ∈ Πi ∈ ω.B_{i} | ∀i ∈ ω.b_{i}(f_{i+1}) = f(i)}

The projections are then defined by π_{i}(f ∈ L) = f(i) and if (x_{i})_{i∈ω} is a compatible family as above then we define the unique associated element of L as

⟨x_{i} | i ∈ ω⟩ = λi ∈ ω.x_{i}

The verification is routine.

Now suppose that the whole development so far depended upon some parameter ϑ ∈ Θ and that we form the disjoint union over all possible values of this parameter. This means that we consider the chain

⋯ ^{b′_{i+1}}^{}Σϑ ∈ Θ.B_{i+1}^{ϑ} ^{b′_{i}}^{}Σϑ ∈ Θ.B_{i}^{ϑ} ^{b′_{i−1}}^{}⋯ ^{b′_{1}}^{}Σϑ ∈ Θ.B_{1}^{ϑ} ^{b′_{0}}^{}Σϑ ∈ Θ.B_{0}^{ϑ}

Here the notation B_{i}^{ϑ} indicates the dependency of B_{i} on ϑ and may be used to denote substitution. This applies to the other meta-variables (L, b_{i},…) as well.

The functions b′_{i} are given by

b′_{i}(x ∈ Σϑ ∈ Θ.B_{i+1}^{ϑ}) := (x.1, b_{i}^{ϑ}(x.2)) ∈ Σϑ ∈ Θ.B_{i}^{ϑ}

Now we have:

Proposition 6.6.1 (Mendler) The set Σϑ ∈ Θ.L^{ϑ} with projections

π′_{i}((ϑ, f) ∈ Σϑ ∈ Θ.L) = (ϑ, π_{i}(f)) : Σϑ ∈ Θ.B_{i}^{ϑ}

is a limit of the chain of the b′_{i}.

Proof. Let x_{i} ∈ Σϑ ∈ Θ.B_{i}^{ϑ} with

b′_{i}(x_{i+1}) = x_{i} for i ∈ ω  (6.3)

be a compatible family. By applying the first projection to this equation and induction on i we find that all the first components x_{i}.1 are equal (to ϑ_{0} := x_{0}.1 for instance). Therefore we have x_{i}.2 ∈ B_{i}^{ϑ_{0}} and b_{i}^{ϑ_{0}}(x_{i+1}.2) = x_{i}.2 by applying the second projection to Eqn. 6.3. This allows us to form

(ϑ_{0}, ⟨x_{i}.2 | i ∈ ω⟩) ∈ Σϑ ∈ Θ.L^{ϑ}

It is routine to check that this satisfies the commutation requirement and that it is unique among those. □

We remark that the “proof-relevant” character of Σ is crucial here. If we replace it by “existential quantification”, i.e. ∃ϑ ∈ Θ.B_{i}^{ϑ} := ∅ if B_{i}^{ϑ} = ∅ for all ϑ and {⋆} otherwise, then ∃ϑ ∈ Θ.L^{ϑ} is not a limit of the sequence of the ∃ϑ ∈ Θ.B_{i}^{ϑ}. For example, if Θ = ω and B_{i}^{ϑ} = {⋆} iff ϑ ≥ i then x_{i} := ⋆ is a compatible family, but ∃ϑ ∈ Θ.L^{ϑ} is empty. This phenomenon is the gist of Hallnäs’ definition of bisimulation as an ω-limit by replacing ∃ by Σ.

6.6.2 Development in TT_{E}

The above proof can be formalised in TT_{E}—the extensional type theory introduced in Sect. 3.2.3.1—almost without changes. We assume a chain depending on ϑ: Θ:

Chapter 6. Applications 258 – ϑ: Θ , i: N ⊢ B[ϑ, i]

– ϑ: Θ , i: N ⊢ b[ϑ, i] : B[ϑ, Suc(i)] → B[ϑ, i] and define the type of compatible families by

CompFam[ϑ: Θ] := Σf: Πi: N.B[ϑ, i] . Πi: N.Id(b[ϑ, i] (f (Suc(i))) , f i) For simplicity we identify the limit L with this type. Now we make the following definitions:

– B′[i: N] := Σϑ: Θ.B[ϑ, i]

– b′[i: N] := λx: B′[Suc(i)].(x.1, b[x.1, i] x.2)

– CompFam′ := Σf: Πi: N.B′[i] . Πi: N.Id(b′[i] (f (Suc(i))) , f i)

– If x: σ ⊢ τ[x] then Σ!x: σ.τ = Σx: σ.(τ × Πy: σ.τ[y] → Id_{σ}(x, y)) and establish in TT_{E} ⊢_{E} Πx: CompFam′.Σ!z: (Σϑ: Θ.CompFam[ϑ]).Πi: N.Id_{B′[i]}((z.1, z.2.1 i) , x.1 i) true i.e. that Σϑ: Θ.CompFam[ϑ] is the limit of the B′[i]. Notice that if x: CompFam′ and i: N then x.1 i : B′[i] because x.2 is the proof of compatibility, and similarly for elements of CompFam.

6.6.3 Development in TT_{I}

Now from the conservativity theorem 3.2.5 it follows immediately that the same judgement holds in intensional type theory with functional extensionality and uniqueness of identity (TT_{I}), provided the assumptions on B and b are valid in TT_{I}. However, giving a direct derivation of this in TT_{I} is quite difficult, because the “candidate” z: Σϑ: Θ.CompFam[ϑ] already contains instances of Subst so for the verification we have to reason about terms containing instances of Subst . More precisely, we first construct a term

x: CompFam′, i: N ⊢_{I} Uniform : Id_{Θ}(\underbrace{(x.1 0).1}_{“ϑ_{0}”} , (x.1 i).1)

using x.2 (the proof that x.1 is compatible) and R^{N}. Then we construct an element of

x: CompFam′ ⊢_{I} CompFam[(x.1 0).1]

the first component of which (of type Πi: N.B[(x.1 0).1, i]) is given by

x: CompFam′ ⊢_{I} λi: N.Subst_{Θ,[ϑ:Θ]B[ϑ,i]}(Uniform[x, i] , (x.1 i).2)

The verification now uses IdUni (and the derived induction principle J) and Ext. The author has spend considerable time with Lego trying to formalise this completely without succeeding. The strategy is of course clear and is indeed dictated by the proof of Thm. 3.2.5, but carrying out all the necessary dependent substitutions in Lego turns out to be extremely cumbersome. The lesson is that machine-supported reasoning in TT_{I}, in order to be efficient, must be supported by tactics, which could very well be based on the conservativity theorem.

One could e.g. imagine that one would conduct parts of a development in TT_{E}. This has the advantage that certain terms which can be proven propositionally equal are syntactically identified, for instance Subst_{σ,τ}(P, M) and Subst_{σ,τ}(P′, M) for some M : τ[N_{1}] and P, P′ : Id_{σ}(N_{1}, N_{2}).

Conclusions and further work

We have compared extensional and intensional formulations of type theory and argued for the need for adding “extensional concepts” to the latter. These extensional concepts have been justified using syntactic models based on pure intensional type theory.

A natural next step would be to develop an implementation of the syntactic models along the lines of Sect. 1.4.1 so as to gain more experience with them. We think (although this may turn out to be wrong) that this implementation task is essentially straightforward and merely requires a lot of time. It is worth mentioning that in a certain sense such an implementation already exists in the form of the combinators for the syntactic models defined in Lego (Sect. 4.4 & 5.1.2), but the variable-free syntax they support is of very limited practical use.

A more difficult and also theoretically challenging question in this direction would be to develop an implementation of the groupoid model. This model as we have presented it is based on classical extensional set theory and as such is not amenable to a direct implementation. However, it seems that the fragment of the groupoid model which is actually taken on by the interpretation function from the syntax does admit an effective description, which we consider worthwhile to work out.

The intended application of such an endeavour—the idea of interpreting propositional equality on types as isomorphism (Sect. 5.2.4) in the absence of uniqueness of identity—has not been pursued deeply in this thesis. It appears to be quite a promising subject. For instance, preliminary investigation has shown that an extension of the type-theoretic definition of categories by additional axioms which allow one to conclude propositional equality of objects from isomorphism might give rise to an elegant syntactic formulation of coherent isomorphisms. Such a notion of category is stable under the notions of functor and slice category, and contains the particular example Full(U, El) if (U, El) is a universe with propositional equality as isomorphism as mentioned in Sect. 5.2.4. However, this universe must appear as a primitive in type theory. In order to be able to “construct” it from more general principles, some kind of “proof-relevant” quotient type former would be needed of which this universe would be an instance.

This leads us to another important question which has only been marginally addressed in this thesis: the expressiveness of the “source type theories” with extensional concepts w.r.t. to the setoid models in which they are interpreted. It seems that for every setoid in the model there exists an isomorphic one which is taken on by the interpretation function and that every section of definable families is definable. This would work by exhibiting a given setoid as the quotient of its −_{set} component by its −_{rel}-component. The resulting relation on the quotient type will, however, only be equivalent (not equal) to the original one, hence the isomorphism. Such a completeness result (if it holds) would not be all too useful since we still do not know which types and terms are definable. So what one would really like to have is an overview over the principles and rules (like countable choice or compatibility of quotients with exponentiation) which are valid in the setoid models.

More specially, the meta-theory of quotient types should be studied more thoroughly. We have made some attempts at that in the course of the examples in Sect. 6.5, but these were far from exhaustive. For instance, it would be interesting to shed some light on the role of effectiveness of quotient types in applications.

The interpretability of type formers in the setoid models ought to be studied from a more general perspective. For instance one would like to know whether the difficulties with interpreting inductive types and universes in S_{1} are inherent or stem from a flawed definition of the model. After two years of experience with setoid interpretation the author tends towards the first alternative, but this is of course only a personal impression.

Appendix A

Lego context approximating S_{0}

Below is a sequence of Lego declarations which simulates quotient types, proofirrelevance, and functional and propositional extensionality as supported by S_{0}, cf. App. B. This code is slightly more general than S_{0} as Lego supports an infinite hierarchy of universes. It should, however, be possible to interpret the code using the method described in Sect. 5.1.8. To be absolutely safe, one can of course avoid the use of Lego universes when working with quotient types. The code does not contain subset types as those can be simulated by Σ-types and it does not support the non-standard operations extend and choice as the syntactic restrictions for those cannot be stated in Lego. A version of this code extended by proofs of certain properties such as effectiveness of quotient types is part of the Lego distribution. Notice that Q refers to Leibniz equality.

A.1 Extensionality axioms

$[Bi Imp:{X,Y:Prop}(X->Y)->(Y->X)->Q X Y];  propositional extensionality
$[Pr Ir:{X:Prop}{x,y:X}Q x y];  proof irrelevance

$[Ext:{A:Type(0)}{B:A->Type(0)}{U,V:{a:A}B a}

({a:A}Q (F a)(G a))->Q F G];  functional extensionality

Appendix A. Lego context approximating S_{0} 263

A.2 Quotient types

[A|Type(0)][R:A->A->Prop];  all declarations are relative to A and R
$[QU : Set // R];  Q-Form. //R indicates the dependency of QU on R

$[QU class:A->QU//R];  Q-Intro
$[QU Ax:{a1,a2:A}(R a1 a2) -> Q (QU class a1) (QU class a2)];  Q-Ax
$[QU Elim:{C|Set}{f:A->C}  Q-Elim

        ({a1,a2:A}(R a1 a2) -> (Q (f a1) (f a2))) -> QU -> C];

$[QU Ind:{P:QU->Prop}({a:A}P(QU class a)) -> {q:QU}P q];  Q-Ind
[[C|Set][f:A->C][H:{a1,a2:A}(R a1 a2) -> Q (f a1) (f a2)][a:A] Q-Comp

        QU it f H (QU class a) ==> f a];

Discharge A;  relativising the declarations to A and R

A.3 Further axioms

One may add axioms approximating the substitutivity property of Leibniz equality (Prop. 5.1.8) and the special case of Prop. 4.6.7 where σ = N. The corresponding definitional equalities can, however, only be approximated by propositional equalities, which hampers their efficient use.

$[Q Subst:{A|Type(0)}{B:A->Type(0)}{a,a'|A}(Q a a')->(B a)->(B a')];
$[Q Subst Comp:{A|Type(0)}{B:A->Type(0)}{a:A}{b:B a}
        Q (Q Subst B (Q refl a) b) b];
$[extend : {P:Prop}(P -> Nat) -> Nat];
$[extend Comp : {P:Prop}{f:P->Nat}{p:P}Q (f p) (extend f)];

Appendix B

Syntax

For the convenience of the reader all of the rules appearing throughout this thesis are summarised in this appendix. Notice that some of the rules are incompatible with each other, e.g. Id-Uni-I and Univ-Id. Notice also that since the rules are literally the same as in the text, some appear in abbreviated form and others do not

Rules for TT

\overline{⋄ ⊢} Empty  \frac{Γ ⊢ σ}{Γ, x : σ ⊢} Compr

\frac{Γ, x: σ, Δ ⊢}{Γ, x: σ, Δ ⊢ x : σ} Var  \frac{\begin{matrix}Γ ⊢ σ = τ \\ Γ ⊢ M : σ \end{matrix}}{Γ ⊢ M : τ} Conv

\frac{Γ , x : σ ⊢ M : τ}{Γ ⊢ λx: σ.M^{τ} : Πx: σ.τ} Π-Intro \frac{Γ ⊢ M : Πx: σ.τ  Γ ⊢ N : σ}{Γ ⊢ App_{σ,τ} (M, N) : τ[x := N]} Π-Elim

\frac{Γ, x : σ ⊢ τ}{Γ ⊢ Πx : σ.τ} Π-Form \frac{\begin{matrix}Γ ⊢ M : σ \\ Γ ⊢ N : σ \end{matrix}}{Γ ⊢ Id_{σ}(M, N)} Id-Form \frac{Γ ⊢}{Γ ⊢ N} N-Form

\frac{Γ ⊢}{Γ ⊢ 0 : N} N-Intro-0  \frac{Γ ⊢ M : N}{Γ ⊢ Suc(M) : N} N-Intro-Suc

Appendix B. Syntax 265

\frac{Γ , x: N ⊢ σ Γ ⊢ M_{z} : σ[x := 0] Γ , x: N , p: σ ⊢ M_{s} : σ[x := Suc(x)] Γ ⊢ N : N}{Γ ⊢ R_{σ}^{N}(M_{z}, M_{s}, N) : σ[x := N]} N-Elim

\frac{Γ ⊢ M : σ}{Γ ⊢ Refl_{σ}(M) : Id_{σ}(M, M)} Id-Intro

\frac{Γ , x: σ, y: σ , p : Id_{σ}(x, y) ⊢ τ Γ , x: σ ⊢ M : τ[x := x][y := x][p := Refl_{σ}(x)] Γ ⊢ N_{1} : σ Γ ⊢ N_{2} : σ Γ ⊢ P : Id_{σ}(N_{1}, N_{2})}{Γ ⊢ J_{σ,τ} (M, N_{1}, N_{2}, P) : τ[x := N_{1}][y := N_{2}][p := P]} Id-Elim-J

Equality rules—a selection

\frac{Γ ⊢ σ}{Γ ⊢ σ = σ} T-Refl \frac{Γ ⊢ σ = τ}{Γ ⊢ τ = σ} T-Sym \frac{Γ ⊢ σ = τ  Γ ⊢ τ = ρ}{Γ ⊢ σ = ρ} T-Trans

\frac{Γ ⊢ M = M′ : N}{Γ ⊢ Suc(M) = Suc(M′) : N} C-Suc \frac{Γ ⊢ σ = σ′  Γ, x: σ ⊢ τ = τ′}{Γ ⊢ Πx: σ.τ = Πx: σ′.τ′} C-P i

\frac{⊢ Γ = Δ  Γ ⊢ σ = τ}{⊢ Γ, x: σ = Δ, y: τ} C-Compr

\frac{Γ ⊢ Πx: σ.τ = Πx: σ′.τ′  Γ, x: σ ⊢ M = M′ : τ}{Γ ⊢ λx: σ.M^{τ} = λx: σ′.M^{′τ′} : Πx: σ.τ} C-Abstr

Rules for sematically defined definitional equality (Sect. 4.7)

\frac{[[Γ | M]] = [[Γ | N]] ∈ Sect([[Γ | σ]])}{Γ ⊢ M = N : σ} Eq-Term

\frac{[[Γ | σ]] = [[Γ | τ]] ∈ Fam([[Γ]])}{Γ ⊢ σ = τ} Eq-Type

\frac{[[Γ]] = [[Δ]] ∈ Ob(C)}{⊢ Γ = Δ} Eq-Cont

Appendix B. Syntax 266

Computation rules. These are always understood under the premise that left and right hand sides both have the indicated type.

\overline{Γ ⊢ App_{σ,τ} (λx: σ.M^{τ} , N) = M[x := N] : τ[x := N]} Π-Beta
\overline{Γ ⊢ R_{σ}^{N}(M_{z}, M_{s}, 0) = M_{z} : σ[x := 0]} Nat-Comp-Zero
Γ ⊢ R_{σ}^{N}(M_{z}, M_{s}, Suc(N)) =
M_{s}[x := N][p := R_{σ}^{N}(M_{z}, M_{s}, N)] : σ[x := Suc(N)]

Nat-Comp-Suc

Γ ⊢ J_{σ,τ} (M, N, N, Refl_{σ}(N)) =
M[x := N] : τ[x := N][y := N][p := Refl_{σ}(N)]

Id-Comp

Rules for Σ-types and unit type.

\overline{⊢ 1} Unit-Form \overline{⋆ : 1} Unit-Intro
\frac{x: 1 ⊢ σ[x] ⊢ M : σ[⋆] ⊢ N : 1}{⊢ R_{σ}^{1}(M, N) : σ[N]  ⊢ R_{σ}^{1}(M, ⋆) = M} Unit-Elim/Comp
\frac{⊢ σ  x: σ ⊢ τ[x]}{⊢ Σx: σ.τ[x]} Σ-Form \frac{⊢ M : σ  N : τ[M]}{⊢ pair_{σ,τ} (M, N) : Σx: σ.τ[x]} Σ-Intro
\frac{\begin{matrix}p : Σx: σ.τ[x] ⊢ ρ[p] \\ x: σ, y: τ[x] ⊢ M[x, y] : ρ[pair_{σ,τ} (x, y)] \end{matrix}  ⊢ P : Σx: σ.τ[x]}{⊢ R_{σ,τ,ρ}^{Σ}(M, P) : ρ[P]} Σ-Elim
R_{σ,τ,ρ}^{Σ}(M, pair_{σ,τ} (N, O)) = M[N, O] : ρ[pair_{σ,τ} (N, O)]

Σ-Comp

Rules for the extensional unit type

\frac{Γ ⊢}{Γ ⊢ 1_{E}} Unit-Form \frac{Γ ⊢}{Γ ⊢ ⋆ : 1_{E}} Unit-Intro
\frac{Γ ⊢ M : 1_{E}}{Γ ⊢ M = ⋆ : 1_{E}} Unit-Eq

Rules for the Calculus of Constructions

\overline{⊢ Prop} Prop-Form \frac{⊢ S : Prop}{⊢ Prf(S)} Proof-Form
\frac{x: σ ⊢ S(x) : Prop}{⊢ ∀x: σ.S[x] : Prop} Prop-Intro
\overline{⊢ Prf(∀x: σ.S[x]) = Πx: σ.Prf(S[x])} Prop-Eq

Appendix B. Syntax 267

Universes

\overline{⊢ U} U-Form \frac{⊢ M : U}{⊢ El(M)} El-Form
\frac{⊢ S : U  x : El(S) ⊢ T : U}{⊢ Π̂(S, T) : U} U-Intro-Π
El(Π̂(S, T)) = Πx: El(S).El(T)

U-Eq-Π

\overline{⊢ N̂ : U} U-Intro-N \overline{⊢ El(N̂) = N} U-Eq-N

Peano’s fourth axiom

\frac{Γ ⊢ M : Id_{N}(0, Suc(0))  Γ ⊢ σ}{Γ ⊢ Peano_{σ}(M) : σ} Peano-4

Further rules for the identity type

\frac{Γ , x, y : σ , p : Id_{σ}(x, y) ⊢ τ[x, y, p] Γ ⊢ N_{1} : σ  Γ ⊢ N_{2} : σ Γ ⊢ M : τ[N_{1}, N_{1}, Refl_{σ}(N_{1})] Γ ⊢ P : Id_{σ}(N_{1}, N_{2})}{Γ ⊢ J′_{σ,τ} (M, N_{1}, N_{2}, P) : τ[N_{1}, N_{2}, P]} Id-Elim-J′
\frac{Γ ⊢ σ  Γ ⊢ M : σ  Γ ⊢ P : Id_{σ}(M, M)}{Γ ⊢ IdUni_{σ}(M, P) : Id_{Id_{σ}(M,M)}(P, Refl(M))} Id-Uni-I
\frac{Γ ⊢ σ  Γ ⊢ M : σ}{Γ ⊢ IdUni_{σ}(M, Refl(M)) = Refl(Refl(M)) : Id_{σ}(M, M)} Id-Uni-Comp
\frac{\begin{matrix}Γ ⊢ U, V : Πx: σ.τ \\ Γ, x: σ ⊢ P : Id_{τ} (U x, V x) \end{matrix}}{Γ ⊢ Ext_{σ,τ} (U, V, P) : Id_{Πx:σ.τ} (U, V)} Ext-Form

\frac{\begin{matrix}Γ, x: σ ⊢ τ[x] \\ Γ ⊢ M_{1}, M_{2} : σ \\ Γ ⊢ P : Id_{σ}(M_{1}, M_{2}) \\ Γ ⊢ N : τ[M_{1}] \end{matrix}}{Γ ⊢ Subst_{σ,τ} (M_{1}, M_{2}, P, N) : τ[M_{2}]} Leibniz

Appendix B. Syntax 268

Γ ⊢ Subst_{σ,τ} (M, M, Refl_{σ}(M), N) = N : τ[M]

Leibniz-Comp

Rules for extensional type theory

\frac{\begin{matrix}Γ ⊢ σ  Γ ⊢ M : σ  Γ ⊢ N : σ \\ Γ ⊢ P : Id_{σ}(M, N) \end{matrix}}{Γ ⊢ M = N : σ} Id-Defeq
\frac{\begin{matrix}Γ ⊢ σ  Γ ⊢ M : σ  Γ ⊢ N : σ \\ Γ ⊢ P : Id_{σ}(M, N) \end{matrix}}{Γ ⊢ P = Refl_{σ}(M) : Id_{σ}(M, N)} Id-Uni
\frac{Γ ⊢ M : Πx: σ.τ}{Γ ⊢ M = λx: σ.M x : Πx: σ.τ} Π-Eta

Rules for TT_{ℜ}

\frac{Γ ⊢_{I} M, N : σ  Γ ⊢_{I} P : Id_{σ}(M, N)}{Γ ⊢_{I} ℜ_{σ}(M, N, P) : σ} ℜ-Form
\frac{Γ ⊢_{I} ℜ_{σ}(M, N, P) : σ}{Γ ⊢_{I} ℜ_{σ}(M, N, P) = N : σ} ℜ-Eq

Rules for quotient types in TT_{E}

\frac{Γ ⊢ σ  Γ , x, x′: σ ⊢ ρ[x, x′]}{Γ ⊢ σ/ρ} Q-E-Form  \frac{Γ ⊢ M: σ  Γ ⊢ σ/ρ}{Γ ⊢ [M]_{ρ}: σ/ρ} Q-E-Intro
\frac{Γ ⊢ M, N : σ  Γ ⊢ H : ρ[M, N]}{Γ ⊢ [M]_{ρ} = [N]_{ρ} : σ/ρ} Q-E-Eq
\frac{\begin{matrix}Γ, x: σ/ρ ⊢ τ[x]  Γ, x: σ ⊢ M[x] : τ[[x]_{ρ}] \\ Γ , x, x′: σ , p: ρ[x, x′] ⊢ M[x] = M[x′] : τ[[x′]_{ρ}] \\ Γ ⊢ N : σ/ρ \end{matrix}}{Γ ⊢ plug_{ρ} N in M : τ[N]} Q-E-Elim
\overline{Γ ⊢ plug_{ρ} [N]_{ρ} in M = M[N] : τ[[N]_{ρ}]} Q-E-Comp

Rules for quotient types in TT_{I}

\frac{Γ ⊢ σ  Γ , x, x′: σ ⊢ ρ[x, x′]}{Γ ⊢ σ/ρ} Q-I-Form  \frac{Γ ⊢ M: σ  Γ ⊢ σ/ρ}{Γ ⊢ [M]_{ρ}: σ/ρ} Q-I-Intro

Appendix B. Syntax 269

\frac{Γ ⊢ M, N : σ  Γ ⊢ H : ρ[M, N]}{Γ ⊢ Qax_{ρ}(H) : Id_{σ/ρ}([M]_{ρ}, [N]_{ρ})} Q-I-Ax
\frac{Γ, x: σ/ρ ⊢ τ[x]  Γ, x: σ ⊢ M[x] : τ[[x]_{ρ}] Γ , x, x′: σ , p: ρ[x, x′] ⊢ H : Id_{τ[[x′]_{ρ}]}(Subst_{σ/ρ,τ} (Qax_{ρ}(p), M[x]) , M[x′]) Γ ⊢ N : σ/ρ}{Γ ⊢ plug_{ρ} N in M using H : τ[N]} Q-I-Elim
Γ ⊢ plug_{ρ} [N]_{ρ} in M using H = M[N] : τ[[N]_{ρ}]

Q-I-Comp

Proof irrelevance

\frac{Γ ⊢ A : Prop  Γ ⊢ M, N : Prf(A)}{Γ ⊢ Pr Ir(A, M, N) : Prf(M =^{L} N)} Pr-Ir

Rules for subset types

\frac{⊢ σ  , x: σ ⊢ P : Prop}{⊢ \{x: σ | P \}} \{\}-Form
\frac{⊢ M : σ  ⊢ H : Prf(P [M])}{⊢ (M)_{H} : \{x: σ | P \}} \{\}-Intro
\frac{⊢ M : \{x: σ | P \}}{⊢ wit(M) : σ} \{\}-Wit
\frac{⊢ M : \{x: σ | P \}}{⊢ cor(M) : Prf(P [wit(M)])} \{\}-Cor
⊢ wit((M)_{H}) = M ∈ σ ⊢ cor((M)_{H}) = H ∈ Prf(P [M])

{}-Beta

\frac{Γ, x: σ ⊢ τ[x] Nprop Γ, x: σ ⊢ P [x] : Prop Γ, p: \{x: σ | P [x]\} ⊢ M[p]: τ[wit(p)] Γ ⊢ N: σ}{Γ ⊢ extend_{σ,P,τ} (M, N) : τ[M]} \{\}-Elim-Nonprop
\frac{Same premises as \{\}-Elim-Nonprop and Γ ⊢ H : Prf(P [M])}{Γ ⊢ extend_{σ,P,τ} (M, N) = M[(N)_{H}] : τ[N]} \{\}-Elim-Nonprop-Comp

Appendix B. Syntax 270

Extensional concepts in S_{0}

\frac{Γ ⊢ A : Prop Γ ⊢ M, N : Prf(A)}{Γ ⊢ M = N : Prf(A)} Pr-Ir
\frac{Γ ⊢ P : Prop Γ ⊢ Q : Prop Γ ⊢ H : Prf(P ⇔ Q)}{Γ ⊢ Bi Imp(P, Q, H) : Prf(P =^{L} Q)} Bi-Imp

\frac{\begin{matrix}Γ ⊢ U, V : Πx: σ.τ \\ Γ, x: σ ⊢ H : Prf(U x =^{L} V x) \end{matrix}}{Γ ⊢ Ext(H) : Prf(U =^{L} V)} Ext

Quotient types in S_{0}

\frac{Γ ⊢ σ Γ , s, s′: σ ⊢ R[s, s′] : Prop}{Γ ⊢ σ/R} Q-Form  \frac{Γ ⊢ M: σ}{Γ ⊢ [M]_{R}: σ/R} Q-Intro
\frac{Γ ⊢ τ Γ , s: σ ⊢ M[s] : τ  Γ ⊢ N : σ/R Γ , s, s′: σ , p: Prf(R[s, s′]) ⊢ H : Prf(M[s] =^{L} M[s′])}{Γ ⊢ plug_{R} N in M using H : τ} Q-Elim
Γ ⊢ plug_{R} [N]_{R} in M using H = M[N] : τ

Q-Comp

\frac{Γ ⊢ M, N : σ Γ ⊢ H : Prf(R[M, N])}{Γ ⊢ Qax_{R}(H) : Prf([M]_{R} =^{L} [N]_{R})} Q-Ax

\frac{Γ , x: σ/R ⊢ P [x] : Prop Γ , s: σ ⊢ H : Prf(P [[s]_{R}]) Γ ⊢ M : σ/R}{Γ ⊢ Qind_{R}(H, M) : Prf(P [M])} Q-Ind

Rules for the choice operator

Γ ⊢ M : σ/R There exists a non-quotiented context Δ and a type τ and a term N with Δ ⊢ N : τ and a syntactic context morphism Γ ⊢ f ⇒ Δ such that M ≡ N[f] and σ/R ≡ τ[f]. Γ ⊢ choice(M) : σ Q-Choice Appendix B. Syntax 271

\frac{Γ ⊢ choice([M]_{R}) : σ  Γ ⊢ M : σ}{Γ ⊢ choice([M]_{R}) = M : σ} Q-Choice-Comp
\frac{Γ ⊢ M : σ/R  Γ ⊢ choice(M) : σ}{Γ ⊢ [choice(M)]_{R} = M : σ/R} Q-Choice-Ax

Rules for the identity type on universes

\frac{Γ ⊢ X, Y : U Γ ⊢ F : Iso[X, Y]}{Γ ⊢ UnivId(X, Y, F) : Id_{U}(X, Y)} Univ-Id
\frac{Γ ⊢ F : Iso[X, Y] Γ ⊢ M : El(X)}{Γ ⊢ Subst_{U,El}(X, Y, UnivId(F), M) = F M : El(Y)} Univ-Id-Eq
Γ ⊢ UnivId(X, X, id[X]) = Refl_{U}(X) : Id_{U}(X, X)

Univ-Id-Eq’

Rules for squash types

\frac{Γ ⊢ σ}{Γ ⊢ □σ} □-Form  \frac{Γ ⊢ M : σ}{Γ ⊢ □M : □σ} □-Intro
\frac{Γ ⊢ M, N : □σ}{Γ ⊢ □ ax(M, N) : Id_{□σ}(M, N)} □-Ax
\frac{\begin{matrix}Γ ⊢ σ, τ  Γ, x: σ ⊢ M[x] : τ  Γ ⊢ N : □σ \\ Γ , x, x′: σ ⊢ H : Id_{τ}(M[x], M[x′]) \end{matrix}}{Γ ⊢ plug_{□} N in M using H : τ} □-Elim
\frac{Γ ⊢ plug_{□} □N in M using H : τ}{Γ ⊢ □ Eq(M, N, H) : plug_{□} □N in M using H = M[N] : τ} □-Eq

Axioms of Choice and Unique Choice

\frac{Γ ⊢ σ Γ ⊢ τ}{Γ ⊢ (∀x: σ.∃y: τ.R[x, y]) → (∃f: σ → τ.∀x: σ.R[x, f x]) true} IAC
\frac{Γ ⊢ σ Γ ⊢ P : Prf(∃x: σ.∀y: σ.x =^{L} y)}{Γ ⊢ AC!(P) : σ} AC!

Appendix C

A glossary of type theories

We use various type theories sometimes in parallel, so that the following summary, which gives the name or symbol of each relevant type theory together with a brief description and a reference to its first appearance in the text, may be helpful.

TT, core type theory: Dependent type theory with dependent products, sums natural numbers, unit type, and identity types. (p. 30)

Calculus of Constructions: A part of TT together with an impredicative universe. In the C.o.C. propositional equality may be defined as Leibniz equality (see 2.3.4). It is generally weaker than the identity type; in S_{0} (see below) the two are, however, equivalent. (p. 30)

TT_{I}: The type theory TT together with the extensional concepts of functional extensionality and uniqueness of identity. The elimination operator J is replaced by the Leibniz principle Subst for convenience. The extensional concepts are merely assumed as constants. (p. 90)

TT_{E}: The type theory TT together with the equality reflection rule which identifies definitional and propositional equality. Also called “extensional type theory”. (p. 90)

TT_{ℜ}: Extension of TT_{I} with an intensional counterpart to equality reflection (“ℜ”). For every derivable judgement in TT_{E} there exists a decoration of this judgement with Subst and ℜ derivable in TT_{ℜ}. (p. 93)

D: Type theory defined by the deliverables model—a kind of subset interpretation of the Calculus of Constructions. D supports all type and term formers of the C.o.C. and in addition proof-irrelevance and subset types. The symbol D is also used for the deliverables model itself. (p. 130)

S_{0}: Type theory defined by the “non-dependent” setoid model in Sect. 5.1 (also called S_{0}). It includes the C.o.C. and supports proof-irrelevance, subset types, functional and propositional extensionality, and quotient types. The extensional concepts in S_{0} are based on Leibniz equality which in S_{0} is equivalent in strength to the identity type. S_{0} does not support universes, except for the impredicative universe of propositions. There exists an extension of S_{0} which makes universes available, but extensional concepts are then restricted to types inside the universe, see Sect. 5.1.8. (p. 160)

S_{1}: Type theory defined by the “dependent” setoid model in Sect. 5.3. It supports all type and term formers of TT_{I} including functional extensionality based on the identity type. Probably quotient types are also supported. Unlike S_{0} the type theory S_{1} caters for proper type dependency, however, it is not clear whether a universe is supported. (p. 212)

Source type theory: Type theory defined by a syntactic model, e.g. S_{1} or D.

Target type theory: Type theory used to construct a syntactic model. Usually TT or the C.o.C.

Appendix D

Index of symbols

The following summarises the mathematical symbols used throughout the thesis together with a brief explanation and a reference to their first appearance in the text.

−^{op}  opposite category  42
Sets  category of sets and functions  42
Subst  substitution operator for identity types  78
Id  identity type, propositional equality  20

Refl reflexivity operator for id. types (canonical element)

79

Sym  symmetry operator for id. types  79
Trans  transitivity operator for id. types  79

Resp compatibility of id. types with function application

79

J  elimination operator for id. types  21
IdUni  uniqueness of identity proofs  80
⊢  judgement relation in type theory  19

Γ ⊢ σ true judgement expresing that σ is nonempty

23

∘

composition (of morphisms, substitutions, and terms)

27

id  identity morphism  35

N  type of natural numbers  20

0, Suc canonical elements of N, zero and successor

21

R^{♢}  elimination operator for type former ♢  21
≡  syntactic identity  24
Int  type of positive and negative integers  173
Real  type of real numbers  182
Str(σ)  type of streams over σ  232
Hd_{σ}(−)  first element of a stream  232
Tl(−)  tail of a stream  233
CoIt  coiterator for streams  233
⋄  empty context  17
C  a category, category of contexts  34

⊤ terminal object, semantic equivalent to the empty context

34

Ob(C)  objects of category  38

Γ · σ semantic context extension, “comprehension”

35

Fam(Γ)  families over Γ, interpretation of types  35
Sect(σ)  sections of σ, interpretation of terms  35
σ{f}  semantic substitution  35
p(σ)  display map  35
q(f, σ)  weakened substitution  35

\overline{M} context morphism associated to section M

35

Hd(f) last component of a semantic context morphism

36

−^{+}  semantic weakening  44
Tel(Γ)  telescopes over Γ  64
()_{Γ}  empty telescope over Γ  64
ev_{σ,τ}  evaluation morphism  48

App  semantic application operation  46
λ_{σ,τ}(M)  semantic abstraction operator  46
[[−]]  interpretation function  63
1  (extensional) unit type  29, 139
v_{σ}  semantic counterpart to a variable  45
{e}(x)  Kleene application  39
Prop  type of propositions  31
Prf(P)  type of proofs of P  31
Prop  semantic counterpart of Prop  57
Prf  semantic counterpart of Prf  57
∀  impredicative universal quantification  31
⇒, ∨, ∧, ∃, tt, ff logical connectives defined in terms of ∀  31

Γ ⊢ P true judgement expressing that Prf(P) in non-empty

32

!_{Γ}  terminal projection  34
U  type-theoretic universe  32
El(T)  type of elements of T : U  32

−_{set}

underlying  type  of  a

specification/setoid/groupoid

128, 160, 207,188

−_{type}  component of a large setoid  184
−_{pred}  component of a deliverable  128
−_{rel}  relation component of a setoid/groupoid  160, 207, 188

−_{reindex} component of a family of setoids/groupoids

208, 192

−_{refl}  reflexivity of setoids/groupoids  207, 189
−_{sym}  symmetry of setoids/groupoids  208,189
−_{trans}  transitivity of setoids/groupoids  208,189
−_{ax}  axiom for −_{reindex}  208
−_{fun}  function component  128, 207, 190
−_{el}  element component  211
−_{resp}  compatibility component  128, 207, 190, 192

{σ | P }  subset type  145
(M)_{P}  subset introduction  146
wit  subset elimination  146
cor  subset elimination  146
extend  non-standard operator for subset types  149
[M]_{R}  quotient introduction  172, 111
σ/R  quotient type  172, 111
plug  quotient elimination (lifting)  172, 111
Qax  equality axiom for quotients  172, 111
Qind  induction for quotients  172
M =^{L} N  Leibniz equality  31
L Eq(M, N)  semantic Leibniz equality  167
Pr Ir  operator for proof irrelevance  143
Bi Imp  operator for propositional extensionality  168
Ext  operator for functional extensionality  84

ℜ intensional counterpart of equality reflection

93

⊢_{I}  judgement relation for TT_{I}  91
⊢_{E}  judgement relation for TT_{E}  91
|σ|  interpretation of TT_{I} in TT_{E}  91
−_{conn}  connectedness relation  208
Γ ⊢ f ⇒ Δ  syntactic context morphism  26
1_{E}  extensional unit type  139
□  squash type and term former  220
⊥  least element in a domain  236
⊥_{σ}  inhabitant of Id(0, 1) → σ  244
⋁  least upper bound  227

Bibliography

[1] Stuart Allen. A non-type-theoretic account of Martin-Löf’s types. In Symposium on Logic in Computer Science, 1987.

[2] Thorsten Altenkirch. Constructions, Normalization, and Inductive Types. PhD thesis, University of Edinburgh, 1994.

[3] Thorsten Altenkirch. Proving strong normalization of CC by modifying realizability semantics. In Henk Barendregt and Tobias Nipkow, editors, Types for Proofs and Programs, Springer LNCS 806, pages 3–18, 1994.

[4] Thorsten Altenkirch, Zhaohui Luo, et al. Equality for categories. E-mail, Apr.–Sep. 1990. Unpublished.

[5] Michael Barr and Charles Wells. Toposes, Triples and Theories. Springer, 1985.

[6] Michael Beeson. Foundations of Constructive Mathematics. Springer, 1985.

[7] J. Bénabou. Fibred categories and the foundations of naive category theory. Journal of Symbolic Logic, 50:10–37, 1985.

[8] J. Bénabou. Théorie des ensembles empiriques. Cahiers de poétique comparée, MEZURA, No. 17 & 21, Institut National des Langues et Civilisations Orientales, 2, rue de Lille, 75007 Paris, 1990.

[9] Errett Bishop and Douglas Bridges. Constructive Analysis. Springer, 1985.

[10] N. Bourbaki. Eléments de mathématique, Livre I, Théorie des ensembles— fascicule de résultats. Hermann, Paris, 1964.

[11] Rod Burstall. Programming with Modules as Typed Functional Programming. In Proc. Inter. Conf. on Fifth Generation Computer Systems, Tokyo, 1984.

[12] Rod Burstall and Butler Lampson. Pebble, a kernel language for modules and abstract data types. Information and Computation, 76:278–346, 1988.

[13] Rod Burstall and James McKinna. Deliverables: An approach to program semantics in constructions. In Symposium on Mathematical Foundations of Computer Science, 1993. also as LFCS technical report ECS-LFCS-91-133.

[14] A. Carboni. Some free constructions in realizability and proof theory. Journal of Pure and Applied Algebra, to appear.

[15] J. Cartmell. Generalized Algebraic Theories and Contextual Categories. PhD thesis, Univ. Oxford, 1978.

[16] Thierry Coquand. Metamathematical investigations of a calculus of constructions. In Piergiorgio Odifreddi, editor, Logic and Computer Science, pages 91–118. Academic Press Ltd., 1990.

[17] Thierry Coquand. Pattern matching with dependent types. In Workshop on Logical Frameworks, Baastad, 1992. Preliminary Proceedings.

[18] Thierry Coquand. Infinite objects in type theory. In H. Barendregt and T. Nipkow, editors, Types for Proofs and Programs. Springer, 1994. LNCS 806.

[19] Thierry Coquand and Gérard Huet. The Calculus of Constructions. Information and Computation, 76:95–120, 1988.

[20] R. Crole. Categories for Types. Cambridge University Press, 1993.

[21] Pierre-Louis Curien. Categorical Combinators, Sequential Algorithms and Functional Programming. Pitman, 1986.

[22] Pierre-Louis Curien. Alpha-conversion, conditions on variables and categorical logic. Studia Logica, 3:318–360, 1989.

[23] Pierre-Louis Curien. Substitution up to isomorphism. Fundamenta Informaticae, 19:51–86, 1993.

[24] N. J. Cutland. An Introduction to Recursive Function Theory. Cambridge University Press, 1980.

[25] N. G. de Bruijn. A survey of the project Automath. In J. P. Seldin and J. R. Hindley, editors, To H. B. Curry: Essays on Combinatory Logic, Lambda Calculus, and Formalism, pages 589–606. Academic Press, London, 1980.

[26] N. G. de Bruijn. Telescopic mappings in typed lambda calculus. Information and Computation, 91(2):189–204, April 1991.

[27] Gilles Dowek et al. The COQ proof assistant user’s guide, V5.6. Rapport technique 134, INRIA Rocquencourt, Dec. 1991.

[28] Peter Dybjer. Inductive sets and families in Martin-Löf’s type theory and their set-theoretic semantics. In G. Huet and G. Plotkin, editors, Logical Frameworks, pages 280–306, 1991.

[29] Peter Dybjer and Herbert Sander. A functional programming approach to the specification and verification of concurrent systems. In Specification and Verification of Concurrent Systems, pages 331–343. Springer, 1990. Workshops in Computing.

[30] Thomas Ehrhard. Une sémantique catégorique des types dépendants. Application au Calcul des Constructions. PhD thesis, Université Paris VII, [31] Robert Constable et al. Implementing Mathematics with the Nuprl Develop-

ment System. Prentice-Hall, 1986.

[32] Solomon Feferman. Theories of finite type. In Jon Barwise, editor, Handbook of Mathematical Logic, chapter D.4. North-Holland, 1977.

[33] G. Huet and A. Saïbi. Constructive category theory. Draft, presented at the Joint CLICS-TYPES Workshop on Categories and Type Theory, Gothenburg, Jan 8–10, 1995.

[34] D.M. Gabbay and R.J.G.B. de Queiroz. Equality in labelled deductive systems and the functional interpretation of propositional equality. In P. Dekker and M. Stokhof, editors, Proceedings of the Ninth Amsterdam Colloquium, pages 547–565, 1994.

[35] Robin Gandy. On the axiom of extensionality I. Journal of Symbolic Logic, 21:36–48, 1956.

[36] Robin Gandy. On the axiom of extensionality II. Journal of Symbolic Logic, 24:287–300, 1959.

[37] Herman Geuvers and Benjamin Werner. On the Church-Rosser property for expressive type systems and its consequences for their metatheoretic study. In Proceedings of the 9th Annual IEEE Symposium on Logic in Computer Science, 1994.

[38] Healfdene Goguen. A Typed Operational Semantics for Type Theory. PhD thesis, University of Edinburgh, 1994.

[39] Healfdene Goguen and Zhaohui Luo. Inductive data types: Well-ordering types revisited. Technical Report ECS-LFCS-92-209, LFCS, April 1992.

[40] Robert Goldblatt. Topoi: The Categorial Analysis of Logic. North-Holland, revised edition, 1984.

[41] R. Harper and J. C. Mitchell. On the type structure of Standard ML. ACM Trans. Programming Lang. and Systems, 15(2):211–252, 1993. Earlier version appears as “The Essence of ML” in Proc. 15th ACM Symp. on Principles of Programming Languages, 1988, pp. 28–46.

[42] R. Harper, J. C. Mitchell, and E. Moggi. Higher-order modules and the phase distinction. In Conference record of the 17th ACM Symposium on Principles of Programming Languages (POPL), pages 341–354, San Francisco, CA USA, 1990.

[43] Susumu Hayashi. Singleton, union, and intersection types for program extraction. Information and Computation, 109(1/2):174–210, 1994.

[44] Martin Hofmann. Elimination of extensionality for Martin-Löf type theory. In H. Barendregt and T. Nipkow, editors, Types for Proofs and Programs. Springer, 1994. LNCS 806.

[45] Martin Hofmann. A simple model for quotient types. In Proceedings of TLCA ’95, Edinburgh, Springer LNCS, 1995. To appear.

[46] Martin Hofmann. On the interpretation of type theory in locally cartesian closed categories. In Proceedings of CSL ’94, Kazimierz, Poland, September 1994. To appear as Springer LNCS.

[47] Martin Hofmann and Thomas Streicher. A groupoid model refutes uniqueness of identity proofs. In Proceedings of the 9th Symposium on Logic in Computer Science (LICS), Paris, 1994.

[48] Wolfgang Hornung. Entwicklung eines LEGO-Kontexts für die Verifikation kategorieller Aussagen. Diplomarbeit. Universität Erlangen, 1992.

[49] Gérard Huet. Cartesian closed categories and λ-calculus. In Guy Cousineau et al., editors, Combinators and Functional Programming Languages, volume 242 of LNCS, pages 123–135. Springer, Berlin, Heidelberg, New York, 1985.

[50] J. M. E. Hyland. The effective topos. In A. S. Troelstra and D. van Dalen, editors, The L. E. J. Brouwer Centenary Symposium, pages 165–216. North-Holland, 1982.

[51] J. M. E. Hyland, P. T. Johnstone, and A. M. Pitts. Tripos theory. Mathematical Proceedings of the Cambridge Philosophical Society, 88:205–232, 1980.

[52] Martin Hyland and Andrew Pitts. The Theory of Constructions: Categorical Semantics and Topos-Theoretic Models. In Categories in Computer Science and Logic. AMS, 1989.

[53] B. Jacobs, E. Moggi, and Th. Streicher. Relating Models of Impredicative Type Theories. In D. Pitt et al., editor, Proc. Conf. Category Theory and Computer Science, Paris, France, pages 197–218. Springer, LNCS vol. 530, 1991.

[54] Bart Jacobs. Quotients in simple type theory. manuscript.

[55] Bart Jacobs. Categorical Type Theory. PhD thesis, University of Nijmegen, 1991.

[56] Bart Jacobs. Comprehension categories and the semantics of type theory. Theoretical Computer Science, 107:169–207, 1993.

[57] Gilles Kahn. The semantics of a simple language for parallel programming. Information Processing, 74:471–475, 1974.

[58] François Lamarche. A Proposal about Foundations I. manuscript.

[59] Joachim Lambek and Philip Scott. Introduction to Higher-Order Categorical Logic. Cambridge University Press, 1985.

[60] Lars Hallnäs. An intensional characterisation of the largest bisimulation. Theoretical Computer Science, 53, 1987.

[61] François Leclerc and Christine Paulin-Mohring. Programming with Streams in COQ. A Case Study: The Sieve of Eratosthenes. In H. Barendregt and T. Nipkow, editors, Types for Proofs and Programs. Springer, 1994. LNCS 806.

[62] A. Levy. Basic Set Theory. Springer-Verlag, 1979.

[63] Horst Luckhardt. Extensional Gödel Functional Interpretation. A Consistency Proof of Classical Analysis, volume 306 of Lecture Notes in Mathematics. Springer, Berlin, 1973.

[64] Z. Luo. Program specification and data refinement in type theory. In S. Abramsky and T. S E. Maibaum, editors, TAPSOFT ’91. Proccedings of the International Joint Conference on Theory and Practice of Software Development. Volume 1: Colloquium on Trees in Algebra and Programming. LNCS 493., pages 142–168, 1991.

[65] Zhaohui Luo. An Extended Calculus of Constructions. PhD thesis, University of Edinburgh, July 1990.

[66] Zhaohui Luo. Type Theory, Logic, and Computer Science. Course notes for the LFCS Postgraduate Course on type theory, January 1991.

[67] Zhaohui Luo. Computation and Reasoning. Oxford University Press, 1994.

[68] Zhaohui Luo and Robert Pollack. LEGO proof development system: User’s manual. Technical Report ECS-LFCS-92-211, LFCS, Computer Science Dept, University of Edinburgh, 1992.

[69] Saunders Mac Lane. Categories for the Working Mathematician. Springer, 1971.

[70] Per Martin-Löf. A theory of types. manuscript, 1971.

[71] Per Martin-Löf. An intuitionistic theory of types: Predicative part. In H. E. Rose and J. C. Sheperdson, editors, Logic Colloquium 1973, pages 73–118. North-Holland, 1975.

[72] Per Martin-Löf. Intuitionistic Type Theory. Bibliopolis·Napoli, 1984.

[73] Per Martin-Löf. Mathematics of infinity. In P. Martin-Löf and G. Mints, editors, Proc. of COLOG ’88, Tallinn, USSR, pages 146–197. Springer LNCS vol. 417, 1988.

[74] Per Martin-Löf. Nondeterministic definitions in type theory. Lecture notes by Peter Dybjer, March 1991.

[75] James McKinna. Deliverables: A Categorical Approach to Program Development in Type Theory. PhD thesis, University of Edinburgh, 1992.

[76] Paul-André Mellies. Typed λ-calculi with explicit substitutions may not terminate. In Proceedings of TLCA ’95, Edinburgh, LNCS, 1995. to appear.

[77] N. P. Mendler. Σ is cocontinuous. Manuscript.

[78] N. P. Mendler. Inductive Definition in Type Theory. PhD thesis, Cornell University, 1988.

[79] Nax P. Mendler. Quotient types via coequalisers in Martin-Löf’s type theory. in the informal proceedings of the workshop on Logical Frameworks, Antibes, May 1990.

[80] Robin Milner and Mads Tofte. Commentary on Standard ML. MIT Press, 1991.

[81] John C. Mitchell and Gordon D. Plotkin. Abstract types have existential type. ACM Transactions on Programming Languages and Systems, 10(3):470–502, July 1988.

[82] Ieke Moerdijk and Saunders Mac Lane. Sheaves in Geometry and Logic. A First Introduction to Topos Theory. Springer, 1992.

[83] Eugenio Moggi. Computational lambda calculus and monads. In 4th Symposium on Logic in Computer Science. IEEE, 1989.

[84] Eugenio Moggi. A category-theoretic account of program modules. Math. Struct. in Comp. Sci., 1(1):103–139, 1991.

[85] B. Nordström, K. Petersson, and J. M. Smith. Programming in Martin-Löf’s Type Theory, An Introduction. Clarendon Press, Oxford, 1990.

[86] Adam Obtułowicz. Categorical and algebraic aspects of Martin-Löf type theory. Studia Logica, 3:299–317, 1989.

[87] Christine Paulin-Mohring. Extracting F_{ω}’s programs from proofs in the calculus of constructions. In Principles of Programming Languages (POPL), pages 1–17. ACM, 1989.

[88] Christine Paulin-Mohring. Extraction de programmes dans le Calcul des Constructions. PhD thesis, Université Paris VII, 1989.

[89] Andrew Pitts. Categorical logic. In Handbook of Logic in Computer Science (Vol. VI). Oxford University Press, 199? to appear.

[90] Gordon Plotkin. Generic notes on domains. Notes for lectures from several terms at the University of Edinburgh, 1989-90.

[91] Randy Pollack. A formalisation of Tarski’s fixpoint theorem in Lego. Part of the Lego-distribution and personal communication.

[92] Eike Ritter. Categorical Abstract Machines for Higher-Order Typed Lambda Calculi. PhD thesis, University of Cambridge, 1992.

[93] A. Salvesen and J. M. Smith. The strength of the subset type in Martin-Löf’s type theory. In IEEE Symposium on Logic in Computer Science, 1988.

[94] D. Sannella. Formal program development in Extended ML for the working programmer. In Proc. 3rd BCS/FACS Workshop on Refinement, Hursley Park, 1990, pages 99–130. Springer Workshops in Computing, 1991.

[95] D. S. Scott. Identity and existence in intuitionistic logic. In M. P. Fourman, C. J. Mulvey, and D. S. Scott, editors, Applications of Sheaves, pages 660– 696. Springer-Verlag, 1977.

[96] Robert A. G. Seely. Locally cartesian closed categories and type theory. Mathematical Proceedings of the Cambridge Philosophical Society, 95:33–48, 1984.

[97] Jan Smith. The independence of Peano’s fourth axiom from Martin-Löf’s type theory without universes. Journal of Symbolic Logic, 53(3), 1988.

[98] Thomas Streicher. A verification method for finite dataflow networks with constraints applied to the verification of the alternating bit protocol. Technical Report MIP 8706, Universität Passau, 1987.

[99] Thomas Streicher. Correctness and Completeness of a Categorical Semantics of the Calculus of Constructions. PhD thesis, Universität Passau, 1989.

[100] Thomas Streicher. Semantics of Type Theory. Birkhäuser, 1991.

[101] Thomas Streicher. Semantical Investigations into Intensional Type Theory. Habilitationsschrift, LMU München, 1993.

[102] Alfred Tarski. A lattice-theoretical fixpoint theorem and its applications. Pacific Journal of Mathematics, 5:285–309, 1955.

[103] Paul Taylor. Recursive Domains, Indexed Category Theory, and Polymorphism. PhD thesis, University of Cambridge, 1986.

[104] A.S. Troelstra. Aspects of constructive mathematics. In Jon Barwise, editor, Handbook of Mathematical Logic, chapter D.5, pages 973–1052. North-Holland, 1977.

[105] A.S. Troelstra. On the syntax of Martin-Löf’s type theories. Theoretical Computer Science, 51, 1987.

[106] A.S. Troelstra and D. van Dalen. Constructivism in Mathematics, An Introduction, volume I. North-Holland, 1988.

[107] A.S. Troelstra and D. van Dalen. Constructivism in Mathematics, An Introduction, volume II. North-Holland, 1988.

[108] David Turner. A new formulation of constructive type theory. In P. Dybjer, editor, Proceedings of the Workshop on Programming Logic, pages 258–294. Programming Methodology Group, Univ. of Göteborg, May 1989.

[109] F.W. von Henke, A. Dold, M. Grosse, H. Rueß, D. Schwier, and M. Strecker. Construction and deduction methods for the formal development of software. In Arbeitsberichte des Korso-Projekts. Springer LNCS, to appear 1995.

[110] P. L. Wadler. Comprehending monads. Mathematical Structures in Computer Science, 2:461–493, 1992.

[111] Gavin C. Wraith. A note on categorical datatypes. In Proc. Conf. Category Theory and Computer Science, Manchester, UK, pages 213–223. Springer LNCS vol. 389, 1989.