Computational applications of calculi based on monads

Pietro Cenciarelli

Doctor of Philosophy University of Edinburgh

September 1995

(Graduation date: July 1996)

A Giovanna e Renato

Abstract

This thesis studies various manifestations of monads in the mathematics of computation and presents three applications of calculi based on monads. The view that monads provide abstract mathematical interpretations of computational phenomena led E. Moggi to use the internal language of a category with a strong monad, which he called the computational lambda calculus, for describing denotational semantics of programming languages. Moggi argued that models of complicated forms of computation could be described modularly by using semantic constructors for manipulating monads. For the first application, we describe a theory of exceptions in the computational lambda calculus and give a computationally adequate interpretation of a fragment of ML, including the exception handling mechanism, in models of this theory. To our knowledge no other model of ML exceptions is available in the literature to date. We also show that normalization fails when exceptions are added to the simply typed lambda calculus. Building on top of the computational lambda calculus, A.M. Pitts proposed a predicate calculus to reason about the evaluation properties of programs: the Evaluation Logic. Following the tenets of synthetic domain theory, we interpret this logic in an ambient category with set-like structure and a fully reflective subcategory of domains with a monad for interpreting computation. We establish abstract conditions under which the monad extends to the ambient category to ensure good interaction with the logical structure. We also show that a monad and first order logical structure yield suitable evaluation relations, which can be used to give a standard interpretation of Evaluation Logic when higher order structure is not available. For the second application, we focus on side effects and investigate the use of Evaluation Logic in partial correctness reasoning. We show that, under fairly common circumstances, monads for side effects admit an extension to the ambient category which is more natural than that described for arbitrary monads and we validate special axioms for members of this class. The resulting theory of computation with side effects is then put to work on a textbook example of partial correctness specification. For our third application, we consider Moggi’s modular approach to denotational semantics. We develop the theory of this approach by determining which equations are preserved by a fairly general class of semantic constructors and which ones are reflected (conservativity). Moreover, we establish a correspondence between categories of computational models and categories of theories of the metalanguage, along the lines of Gabriel-Ulmer duality, in a type-theoretic framework. Using the Extended Calculus of Constructions, we develop a semantics for parallel composition by combining elementary notions of computation defined independently and we use LEGO to prove properties of such semantics formally.

Acknowledgements

I want to thank Rod Burstall for waking me up on the phone early one morning in Ithaca to inform me that I had been admitted to the PhD program and for giving me advice during the early stages of my work.

I am grateful for the financial support I received first from the Edinburgh University Faculty of Science and later from the EEC Jumelage project “Programming Language Semantics and Program Logics.”

Thanks to Eugenio Moggi for following my work from a thousand miles away and for his hospitality during my trips to Genoa, and to Gordon Plotkin and John Power, for helping me with useful comments and suggestions during the writing-up.

I learnt a lot from discussing computers and mathematics with Rod Burstall, Marcelo Fiore, Eugenio Moggi, Gordon Plotkin, Alex Simpson, Bob Tennent and Andrew Wilson. I should specially thank Andrew for being such a pleasant office mate, for helping me patiently with English and for teaching me that most things are be’er ’an a steen ’ahin’ ’i lug.

Alex, Aphro, Cottone, Jennie, Marcelo, Simona, Toby and Viky provided, with their friendship, the thing that Nature denied to this beautiful town: warmth. Jocelyne m’a donné la chose plus importante : son amour.

Declaration

This thesis was composed by myself. The work reported herein, unless otherwise stated, is my own.

Pietro Cenciarelli

Table of Contents

1. Introduction 1

2. The Computational Lambda Calculus 24 2.1 Strong endofunctors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 2.2 Strong monads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 2.3 The computational lambda calculus . . . . . . . . . . . . . . . . . . . . . 33 2.4 Structures and interpretation . . . . . . . . . . . . . . . . . . . . . . . . 38 2.5 Examples of computationally relevant monads . . . . . . . . . . . . . . . 42

3. Application: exceptions 48 3.1 Tiny ML with Exceptions . . . . . . . . . . . . . . . . . . . . . . . . . . 50 3.2 Exceptions and termination . . . . . . . . . . . . . . . . . . . . . . . . . 54 3.3 A theory of exceptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 3.4 Interpretation of the language . . . . . . . . . . . . . . . . . . . . . . . . 58 3.5 Interpretation of the metalanguage . . . . . . . . . . . . . . . . . . . . . 60 3.6 Semantic approximation of TMLE programs . . . . . . . . . . . . . . . . 65 3.7 Computational adequacy . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 4. Evaluation Logic 80

4.1 The calculus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 4.2 Hyperdoctrine semantics . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 4.3 The logic of a class of admissible monos . . . . . . . . . . . . . . . . . . . 92 4.4 Endofunctors and classes of admissible monos . . . . . . . . . . . . . . . 98 4.5 Monads and classes of admissible monos . . . . . . . . . . . . . . . . . . 102 4.6 Monads in the ambient category . . . . . . . . . . . . . . . . . . . . . . . 107 4.7 Standard semantics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 4.8 Evaluation relations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

5. Application: partial correctness 119 5.1 Nontermination and side effects . . . . . . . . . . . . . . . . . . . . . . . 121 5.2 Side effects in the ambient category . . . . . . . . . . . . . . . . . . . . . 126 5.3 Assertions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 5.4 Partial correctness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 5.5 Integer division . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 5.6 Inductive formulae . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

6. Semantic constructors 146 6.1 Categories of Σ-models . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 6.2 Semantic constructors . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 6.3 HML . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 6.4 Relative interpretation of HML . . . . . . . . . . . . . . . . . . . . . . . 168 6.5 Functorial semantics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 6.6 Finite limit presentation of category theory . . . . . . . . . . . . . . . . . 176 6.7 Models of HML . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182 6.8 Syntactic presentation of constructors . . . . . . . . . . . . . . . . . . . . 189

7. Application: constructing with LEGO 199 7.1 Structures and interpretation . . . . . . . . . . . . . . . . . . . . . . . . 201 7.2 Examples of constructors . . . . . . . . . . . . . . . . . . . . . . . . . . . 205 7.3 Parallel composition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209 7.4 A concrete model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212

8. Directions for further research 216 A. The metalanguage HML 221 B. Dom, the category of discourse 229 C. Signatures and theories 230 D. Encoding ML_{T} 233 E. Interpretation of ML_{T} 234 F. Correctness of the exception constructor 236 G. The operator pand of parallel composition 238 H. Commutativity of pand 239 I. Preservation of uniformity 249

1 Introduction

Programming language semantics is an area of applied mathematics which studies the meaning of computer programs. The notion of “meaning” depends on the context of discourse [Neu44,Flo67,SS71,Plo81].

In denotational semantics, programs are explained in terms of abstract mathematical entities, called “denotations,” which model their implementation-independent behaviour. In this context, formal metalanguages [Sco69,Plo77,Gor79,Plo85b,Abr87,Mog91b] can be used to link programs and their denotations: on one side they provide a language for addressing elements of mathematical structures, while on the other they provide a formal framework in which programs can be interpreted by means of translations.

How tightly should a metalanguage match the mathematical objects it describes and in what detail should it represent the structure of computation? In [Mog90a,Mog91b], Moggi proposed a categorical view: the use of strong monads to represent notions of computation abstractly and a formal metalanguage to match the categorical semantics. This approach goes one step towards the identification of abstract reasoning principles for computation. It also has a pragmatical significance, because abstraction is a basic ingredient to achieve modularity.

This thesis presents three applications of monads to the semantics of computation: in the first application monads provide a language for interpreting programs with exceptions; in the second, they provide a formal basis for reasoning about computations with states; in the third, they provide a structuring principle for a stepwise development of denotational models. As we shall see, sometimes practice feeds back into theory.

In this introduction, we describe the theoretical context of our exploration and, in the last section, we summarize our main results and give the outline of the thesis.

Programs, meanings and logics

Mathematical descriptions of programming languages are needed for the analysis and synthesis of computer programs. Both activities require logics to express the properties of interest and to guide the reasoning. Different kinds of semantics and logics may be appropriate for performing different tasks. Operational semantics, for example, yield notions of program equivalence which can be used for proving correctness of optimization steps, while denotational semantics may provide richer mathematical foundations for formal methods.

The use of formal systems to support reasoning about properties of computer programs is appealing because it allows one to disregard the mathematical details of the models. Such systems are available, for example, for reasoning about partial correctness [Hoa69] and noninterference [Rey81] for imperative languages, temporal properties of concurrent systems [Sti92], evaluation properties of programs with higher-order functional features [CP92,Pit91]. However, adopting the view of [Sco69] that formalism without eventual interpretation is in the end useless, we regard program logics and mathematical representations of the meaning of programs as parts of the same picture:

semantics axiomatic

logics

programming languages

meanings

denotational semantics operational semantics theory

model

In the next sections we shall encounter many inhabitants of this triangle; although most of them are based on denotational semantics, many others can be found in the operational setting, where a basic example is the triad of CCS [Mil80], temporal logics and labelled transition systems.

Each of the disciplines along the edges of this diagram addresses specific problems. At the bottom, mathematical structures are matched against the programs they represent. Operational and denotational semantics can be related by computational adequacy results, as in [Plo85b,Abr90b,Fio94b]. In denotational semantics, the usual criteria for assessing the well-fittedness of models are full abstraction [Mil77,Plo77,Wad76,HA80,AJM94,HO94] and universality [Mey88].

On the left edge, axiomatic semantics is specially relevant to the study of formal methods for program development and verification [Hoa69,Dij76,Gri81].

Finally, the most frequently asked questions on the right edge concern soundness and completeness, both for models based on operational and on denotational descriptions. Examples of completeness results in the setting of process algebras are provided by [BA91], where it is shown how to generate complete sets of axioms for strong bisimulation automatically from SOS descriptions of programming languages, and by [Win85] which gives a complete proof system for SCCS [Mil83], whose models are based on non-well-founded sets [Acz88].

The completeness of logical theories can also be studied “functorially” (see section 6.5), by identifying theories with categories with logical structure and models with structurepreserving functors. A classical result in this setting is the conceptual completeness of pretopoi [MR76]: if the functor Mod (T_{1}) → Mod (T_{2}) between categories of models induced by composition by a logical functor F : T_{2} → T_{1} between pretopoi is an equivalence, then F is an equivalence.

In the setting of domain theory, [Abr91] stresses the importance of “Stone-type” duality theorems, relating theories (viewed as categories) with the categories of their models, for understanding the relationship between semantics and program logics.

Metalanguages in denotational semantics

As remarked in [Abr91], “denotational semantics are always based, more or less explicitly, on a typed functional metalanguage.” Then, where should we place metalanguages in the above picture?

A leading example of metalanguage, at least from a historical point of view, is PCF. In 1969, D. Scott introduced a logic for computable functions, LCF [Sco69], to formalize principles of mathematical reasoning about partial recursive functions. LCF has enough power to axiomatize, for instance, integer arithmetics. The underlying term language of this logic, named “Programming language for Computable Functions” (PCF) in [Plo77], has been used to describe the semantics of non-trivial fragments of programming languages (including Pascal [AAW77]) through its standard interpretation in terms of cpos and continuous functions.

Scott remarked that PCF was not a programming language because, although allowing conditional expressions and recursive definitions, it featured neither assignments nor gotos. A different view was adopted in [Plo77], where PCF was endowed with a reduction relation in order to study the connections between operational and denotational semantics. A consequence of this approach, as advocated in [Plo91b, lecture III: Denotational Semantics], is that not only can programming languages be interpreted by translating them into a metalanguage, but also one can relate their denotational and operational semantics by exploiting a similar result proven once and for all for the metalanguage.

LCF was implemented by R. Milner in 1972 [Mil72,GMW79] and used as a mechanized logic for proving correctness of computer programs [Wey72,AA74], including interpreters and compilers [MW72,New75]. Structuring principles for LCF theories are sought in [SB83].

More elaborate type theories have been proposed as frameworks for studying more sophisticated programming language features, and even “implementational” issues such as garbage collection; the latter was addressed in [Laf88,Wad91] among other applications of linear logic to computer science. A logic for parametric polymorphism [Rey83] is proposed in [PA93], which is to System F what LCF is to PCF. However, this logic accounts for neither recursive functions nor types, which are both crucial in domain theory. Recursion is studied in FPC [Plo85a], a typed calculus which allows recursive definitions of types, as PCF allows recursive definitions of functions. In FPC, the latter can be obtained from the former as shown in [Gun92, 7.4]. Recursion is also addressed in [Plo93], where second order intuitionistic linear logic is combined with a formal theory of relational parametricity to obtain a framework in which general recursive type equations have universal solutions, with corresponding principles of induction and co-induction. The problem of finding appropriate logics for domain theory is a matter of current research. We shall return to this point later on.

In the above examples, metalanguages play the role of formal interfaces to mathematical models, that of term languages of logics and that of “target” languages for expressing denotations of programs. We can therefore place them in the centre of the triangle:

logics  models programming languages  languages meta-

The dashed lines indicate that programs are interpreted and reasoned about indirectly through the metalanguage. This approach has the following advantages. On the denotational edge, interpretations of different programming languages and notions of computation can be more easily related if represented in the same formal framework. On the axiomatic edge, program logics which refer to metalanguages, where computation is represented in mathematical terms, are less likely to be affected by the idiosyncrasies of specific programming languages.

As we shall see below, these benefits are further enhanced when an abstract notion of computation is adopted. The next two sections introduce a metalanguage and program logics based on this abstraction. They are used in this thesis to develop applications.

Monads and the computational metalanguage

Denotational semantics of real programming languages are complicated and often require a considerable mathematical overhead. Adequate descriptions of even simple computational gadgets such as local variables may need sophisticated tools such as possible worlds [OT92]. Moreover, the mathematical structure used for describing one form of computation may be incompatible with that for describing another, so that models for several interacting computational phenomena are often studied case by case.

As noted in [Mos92], the reason why conventional programming devices require elaborate “coding” techniques to be expressed in lambda notation is that the basic operations of lambda abstraction and application give little grasp on program composition. Various modifications of the theory of βη-equivalence have been proposed in order to study features of programming languages. Examples are the call-by-name and call-by-value lambda calculi introduced in [Plo75], which are shown to be correct with respect to the corresponding evaluation mechanisms.

Another example is the λ_{p}-calculus introduced in [Mog86], which is shown to be sound and complete with respect to interpretation in partial cartesian closed categories. The approach adopted in this calculus, which was first pursued in [Plo85b], is to take partial functions as primitive in domain theory, rather than total functions on spaces of partial elements, as in the tradition of [Sco69]. Partial combinatory and lambda calculi are described in [Fef95], while “free” logics for reasoning with possibly non-denoting terms are surveyed in [Ben86].

A category pC of partial maps can be defined axiomatically as proposed in [Ros86, Mog86] by choosing a class of monomorphisms closed under certain operations in a category C of “total” maps. Intuitively, the morphisms in the chosen class represent domains of partial functions. Under certain circumstances, there is an adjunction between C and pC defining a “lifting” monad in C (see section 2.5), of which pC is the Kleisli category (see [Mac71] for definitions).

In [Mog90a,Mog91b], Moggi proposed a generalization of this scenario where monads are taken as abstract notions of computation and program composition is abstractly interpreted as composition in the Kleisli category. The metalanguage arising from this categorical semantics of computation, called computational lambda calculus, is the internal language of a cartesian closed category with a strong monad (see section 2.2). Examples of computationally relevant monads are given in section 2.5.

The main feature of the computational lambda calculus is the explicit distinction between types of values and types of programs, called computational types. These are formed by applying a unary type constructor T: for every type A, there is a type T A inhabited by the programs computing values of A. Of course, one can form computations of computations and so on. Interpreting types as objects in a category C, T represents a map obj (C) → obj (C). For instance, integer programs which may raise exceptions can be interpreted as elements of the object T (int ) = int + E, where E interprets the type of exceptions.

Besides the type constructor T, the metalanguage features two type-indexed families of operations: val_{A} : A → T A and let_{A,B} : (A → T B) × T A → T B. Members of the first family construct trivial computations from values: val_{A}(a) is the program “return a,” which, in the case of exceptions, corresponds to the injection A → A + E. The operations of the family let perform program composition (while composition of functions corresponds to substitution as usual in the lambda calculus) allowing a program of type A → T B, accepting as inputs values of type A, to apply to computations, that is a term of type T A. In the case of exceptions, let_{A,B}(f, z) runs f on the value possibly produced by z, while, if z raises an exception e, it returns e.

These operations are equipped with a set of equations, which give a complete axiomatization of strong monads, where val corresponds to the unit, and let to an internal version of Kleisli lifting.

Other operations and constant types given by a signature Σ may also be included in the calculus, together with appropriate (equational) axioms, to make the notion of computation more concrete and represent specific programming languages. We shall call ML_{T} (Σ) such a particular theory in the computational lambda calculus. Computer programs are interpreted by translations into ML_{T} (Σ) mapping terms of type τ to terms of type T ([τ]), where ([τ]) is the translation of τ. This paradigm is explained in chapter 3.

By hiding the concrete structure of the domains of interpretation and by providing an abstract primitive operation of program composition, the computational metalanguage allows the intricacies of concrete models to be left out of denotational descriptions. In this way, such descriptions become simpler, because the mathematical structure required for interpreting one device of a programming language need not appear in the semantic equations which describe another. They also become easier to modify : if a new computational feature is added to the language, e.g. a mechanism for raising and handling exceptions, the domains of interpretation may have to change in order to accommodate new mathematical structure, which may cause massive rewriting in a traditional denotational description: in the case of exceptions, all semantic equations must deal with the possibility that subterms might raise exceptions. What has changed is the notion of program composition. However the equations need not change if this notion is captured by a simple let .

The benefits of the monadic approach have been exploited in several applications described in [Wad92], including a compiler for Haskell.

The abstraction over the notion of computation introduced by the use of monads in denotational semantics provides a basis for investigating general reasoning principles about programs and a structuring mechanism for a modular development of theories and models of computation. These topics are explored in the next two sections.

Monads and program logics

General program logics, that is logics providing general principles for reasoning about computation, may arise from an abstract understanding of program evaluation. The advantage of such logics is that programs from different languages, or from upgraded versions of the same language, can be reasoned about within the same framework.

Below we consider a few semantic scenarios for program logics based on abstract notions of computation: Fix-Logic, Evaluation Logic and modal operators in higher order logic. In the next section we shall encounter another, where evaluation modalities, which capture the notion of evaluation abstractly, are defined in a first order framework.

In the previous section, we saw that the idea of interpreting divergent computations in categories of partial maps can be generalized to other forms of computation by using monads. Similarly, consider the principle of Scott-induction proposed in [Sco69] to reason about recursively defined partial functions. This principle can be derived from an axiomatization of the initial algebra of a lifting monad. Fix-Logic, the predicate calculus proposed in [CP92], uses the computational metalanguage as term language and is interpreted in a category with a strong monad whose underlying functor has initial algebra. The assumption of such an algebra yields an abstract reasoning principle called fix induction.

In Fix-Logic, programs and logic are integrated by means of modalities extending predicates on values to predicates on computations. However, this extension is rather trivial as it only discriminates between computations of the form val (v). In Evaluation Logic (EL) [Pit91], whose underlying type system is again the computational metalanguage, A. Pitts introduced more general modalities in the context of intuitionistic first order predicate calculus to match operational descriptions of programs given in natural semantics style [Kah88]. There are two “evaluation” modalities, called necessity and possibility, and written respectively:

[x ⇐ E] ϕ(x) and ⟨x ⇐ E⟩ ϕ(x).

The intended meaning of these formulae is that the property ϕ(x) holds respectively of any and of some values x produced by the evaluation of E, where x is a variable of a type A and E is a program of type T A. Programs can be related to the values they compute by means of evaluation relations:

⇐_{A} ⊆ A × T A,

whose intended meaning is captured by the formula (a ⇐ E) =^{def} ⟨x ⇐ E⟩ (x = a), that is: “E can evaluate to a.” Conversely, for most notions of computation, the evaluation modalities can be defined from ⇐ as shown in section 4.8 using first order quantifiers.

The result is a powerful program logic which can be specialized by axiomatizing appropriate operations to suit specific forms of computation. Other program logics can be embedded into EL, including dynamic logic and Hoare logic (see [Pit91] and [Cen95]).

Several interpretations have been proposed of the evaluation modalities [Pit91,Mogb, Moga], of which we give a detailed account in chapter 4 (where we also propose yet another). Pitts’ original interpretation was based on hyperdoctrines, over which he defined the notion of T -modality. Both hyperdoctrines and T -modalities are categorical structure that must be provided on top of a model of the underlying type theory in order to interpret the logic.

A different approach was taken in [Mogb], where the logical structure is sought in the same category where types are interpreted. The idea is to define modal operators by making the categorical gear for interpreting computational types act upon that for interpreting logic. We shall call this semantics “standard” because interpretation is determined only by the structure of a strong monad. The advantage of a standard semantics is that it is subject to the same structuring mechanisms, based upon manipulation of monads, which apply to the underlying metalanguage (see next section).

However, it is not immediately obvious that logic and computation should live in the same semantic framework, as one may put limitations on the other. For example, formulae of LCF are limited to conjunctions of inequalities in order to preserve chaincompleteness and hence admissibility for fixed point induction. In order to extend this principle to first order logic, admissibility tests over formulae must be performed, as in Cambridge LCF [Pau87]. Similarly, Fix-Logic cannot be consistently extended with intuitionistic implication or existential quantification, as shown in [CP92]. As for EL, Moggi’s standard semantics needs higher order structure to interpret possibility, which is not available in categories of domains, unless many interesting predicates, such as “f is total” (which can be expressed in full EL as ∀ n. ⟨x ⇐ f(n)⟩ true ), are cut off.

The aim of integrating logic and computation in a unified theory of semantics is pursued in synthetic domain theory [Ros86,Pho90,Hyl90,Tay91,RS], where logic is interpreted in an ambient category with set-like structure, typically a topos, and computation in a full reflective subcategory of the former, with all the closure properties required to perform domain-theoretic constructions. The leading example of this setting is the effective topos [Hyl82], with its many full subcategories of PERs [FMRS90].

A dual approach can be adopted in the framework of axiomatic domain theory [Fio94b, FP94]. Instead of identifying inside a topos a good category of domains to interpret computation, one can look “around” such a category for an appropriate topos to interpret logic. In [Fio94a], it is shown that every small model of a given axiomatization of domains has a full and faithful representation in a model of cpos and continuous functions living in a suitable intuitionistic set theory.

If the logical structure is provided by an ambient category E, and the computational structure by a strong monad T defined on a subcategory D of E, Moggi’s standard semantics of EL requires an extension of T to E. This can be done by a general construction as shown in section 4.6, provided D is fully reflective in E, as it happens in both the synthetic and the axiomatic approaches mentioned above.

T -modal operators are proposed in [Mog91b] to give a uniform account of various program logics in a higher order setting. Let T be a monad on E, and let ⊤ : 1 → Ω classify the predicates of the logic; a T -modal operator is a T -algebra α : T Ω → Ω. Given such an α, a predicate ϕ : A → Ω over values of type A can be lifted to one over computations, written □_{α}ϕ, as follows: □_{α}ϕ =^{def} α^{∘}T ϕ : T A → Ω.

In some cases, the notion of T -modal operator may be too strong: interesting operators may fail to satisfy the equations which make them algebras of a monad. Then, algebras of the underlying functor of T can be considered instead.

Consider, for example, the “standard” operator α which classifies T ⊤ : T 1 → T Ω (if T does not preserve subobjects, the image of this morphism can be used). The unit and associative laws for such an α are given by special conditions, respectively on the unit and the multiplication of T, viz. that they are cartesian (see definition 4.5.3). As shown in chapter 5, the multiplication of the monad T X =^{def} (X × S)^{S} for computation with side effects does not satisfy this property and, in fact, the standard α for this monad is not associative. Still, α is an interesting one: the modality □_{α} maps ϕ to the predicate which holds of all programs p such that, for all states s : S, p(s) = ⟨x, s′⟩ for some state s′ and value x satisfying ϕ. Indeed, this modality can be used to interpret Hoare triples.

Monads and semantic modules

The problem of finding good structuring principles for programming language semantics has been addressed in various contexts. In the context of model theory, institutions [BG85], which use notions from category theory, provide a general framework for combining small specifications into descriptions of complex models. In the context of algebraic specification, [ST89] proposes a method for stepwise refinement of formally specified ML modules leading to correct program implementations. In the context of denotational semantics, [Mos88,Mos90] stress the importance of auxiliary notation as abstraction mechanisms to hide the detailed structure of the underlying data types from the semantic equations.

Here, we concentrate on the use of monads as a structuring mechanism in denotational semantics [Mog91c,CM93,CF94,LHJ95].

By introducing a layer of abstraction between programming languages and their concrete models, the computational metalanguage plays the role of an interface: to hide the details of implementation. However, if part of the mathematical structure is hidden, some extra work is needed to get from a semantic description given in terms of the metalanguage to a concrete model. Since the domains for interpreting programs may be quite complicated, it is crucial for usability of denotational semantics to develop tools for managing such complexity. Moggi’s proposal ([Mog90a,Mog91c]) is to work stepwise towards complicated models by means of semantic constructors, which allow computational features to be adjoined and reasoned about one at a time.

The idea is to mimic the stepwise methodology for program development: viewing theories as specifications and models as implementations, the problem of finding an implementation of a complex specification L_{2} can be reduced to that of finding an implementation of a simpler specification L_{1} and a constructor [ST87] mapping models of L_{1} to models of L_{2}.

In our setting, a specification is a theory ML_{T} (Σ) of the computational metalanguage over a signature Σ. An implementation of such a specification is a cartesian closed category with a strong monad and additional structure to interpret Σ. Calling Mod (Σ) the class of such objects, a semantic constructor is a function F : Mod (Σ_{1}) → Mod (Σ_{2}).

Starting from a model of a simple metalanguage ML_{T} (Σ_{0}), we can incrementally construct a model of ML_{T} (Σ_{n}) by providing a sequence of signatures Σ_{i} ⊂ Σ_{i+1}, with 0 ≤ i < n, and constructors F_{i} : Mod (Σ_{i}) → Mod (Σ_{i+1}). In general, the latter involve a reinterpretation of the type constructor T (that is, a change of monad) and of the operations in Σ_{i}.

The core of a semantic constructor is a monad constructor [Mog90a], that is a function mapping monads to monads. On top of that, structure for interpreting one signature must be “converted” into structure for interpreting another. The effort here is to prove that the structure produced by a constructor satisfies the axioms of the theory. In order to establish such a result, it is useful to know which equations are preserved by a monad constructor. Similarly, to study the conservativity of certain constructors, it is useful to know which equations are reflected.

Logical frameworks can be used to support reasoning about properties of semantic constructors, such as the ones mentioned above. Availability of several implementations of type theories running on computers [CAB^{+}86,Mag92,LP92,DFH^{+}93], makes it tempting to adopt one as a tool to develop programming language semantics. A framework combining the Extended Calculus of Constructions (XCC) [Luo82] with the metalanguage for computational monads was recently proposed in [Mog95b].

Type theories have long been used for formalizing various branches of mathematics (as in the AUTOMATH tradition [deB70]) as well as for developing a general theory of representation of formal systems (as in the ELF tradition [HHP87]). They provide selfexplaining primitive notation for formalizing mathematics, be it analysis [Jut77,CH85] or metatheories of various forms of calculi [Ber91,Alt92]. Generally, implementations provide machine-assistance in managing complicated syntax, environments for proof development and libraries.

Besides these pragmatical benefits, there may also be theoretical reasons in using powerful type theories to represent the constructions of denotational semantics. One case is the following.

A correspondence is often established, in categorical type theory, between theories of some formal calculus, with the appropriate notion of translation, and mathematical models, with the appropriate notion of morphism between models. Typical examples are the simply typed lambda calculus [LS86] and the higher order polymorphic lambda calculus [See87]. This correspondence can be exploited in the framework of functorial semantics [KR77] to characterize certain maps between categories of models as relative interpretations induced by theory translations. For example, relative interpretation of finite limit theories is characterized by the Gabriel-Ulmer duality established in [GU75]. Now, while there is a direct correspondence between theories of the computational metalanguage and cartesian closed categories with a strong monad, there is no good correspondence between theory translations (at least the kind of translations one needs to represent semantic constructors) and strong monad morphisms. However, the correspondence is restored when the metalanguage and its models are embedded into a type theory such as the Extended Calculus of Constructions. In chapter 6, we explore this matter in detail.

Summary of results and outline of the thesis

This thesis stems from three experiments with monads in denotational semantics: in the first, we use the computational lambda calculus to give an adequate model of ML exceptions; in the second, we use EL for reasoning about partial correctness of whileprograms; in the third, we develop in the Extended Calculus of Constructions (XCC, [Luo82]) examples of semantic constructors and prove properties of constructed models formally in LEGO [LP92].

While working out these applications, general questions were raised, sometimes requiring the development of a piece of theory. For example, the involvement of non-trivial mixed variance constructions in models of exceptions raised the question of whether normalization is preserved if the simply typed lambda calculus is augmented with exceptions. Evaluation relations were used to define left and right rules for necessity in EL, which make the proof system more manageable; the problem arose of finding a standard interpretation of such relations in a first order setting. Implementation in type theory suggested that most semantic constructors can be presented as theory translations, provided a general enough syntax is adopted; the natural question was how to characterize such constructors intrinsically.

The body of the thesis is composed of six chapters: three of them present an application; each is preceded by a chapter introducing and developing the relevant theory.

Chapter 2 contains some basic categorical definitions and introduces the computational metalanguage and its models based on monads. Examples of computationally relevant monads are provided. We claim no originality here.

Chapter 3 studies the semantics of a small but non-trivial fragment of ML, including the exception handling mechanism. To our knowledge, no other denotational description of ML exceptions has been previously worked out.

We give a theory over the computational metalanguage, with operations to construct, raise and handle exceptions. An abstract model of this theory is a bi-cartesian closed category with an object of exceptions which is a solution to a suitable recursive domain equation. Recursion comes in because ML’s exceptions may have parameters of arbitrary type and, in particular, parameters may be programs raising exceptions.

An analysis of the domain-theoretic constructions required to interpret the language reveals that models include the structure to interpret diverging computations and this suggests something that is not imediately clear from the operational semantics: programs with exceptions may fail to terminate even if no recursion is used. In particular, as shown in section 3.2, one can write a fixed point combinator for arrow types in the simply typed lambda calculus with exceptions. This failure of normalization was also noticed by M. Lillibridge in a yet unpublised paper [Lil95], which was unknown to us when we obtained this result.

The programming language is interpreted by a translation into the metalangauage. This interpretation is proven to be adequate with respect to a given operational semantics: a program e evaluates to a value v if and only if the translation of e is provably equal to the translation of v in the theory of the metalanguage. Part of the proof consists in defining appropriate logical relations between terms and their denotations in a concrete model in the category of cpos. Because of the recursive nature of computational types, such relations cannot be defined by induction on the structure of types and they are obtained instead by applying a technique suggested in [Pit].

There is a general pattern in the definition of logical relations for computational languages: two intertwined families are defined; members of one family, ≤, relate canonical terms and values, while members of the other, ⪯, relate general terms and computations. Relations in the first family between canonical terms of type A → B and values in the domain [[A → B]] = [[A]] → T [[B]], are defined “logically” by suitable conditions involving relations of the second family between programs of type B and computations in T [[B]]. In section 3.6, ⪯ is defined “by hand” from ≤ by looking at the concrete structure of computational types. However, we believe that ⪯ should be described more abstractly as a canonical lifting of ≤ over computations. This is a matter of further research (see chapter 8).

Except for the notions of relational structure and admissible action used in the proof of section 3.6, all material in this chapter is original.

Chapter 4 presents Evaluation Logic and addresses two questions about the interaction between computational and logical structure: how to use the former to get a standard interpretation of program logics in a synthetic domain theory setting and how to get such an interpretation when higher order structure is not available.

Our presentation of the calculus includes equality and all connectives of first order predicate calculus, while the one in [Pit91] has only equality, conjunction and disjunction, and the one in [Mogb] includes no disjunction, existential quantification and possibility. Note that the rules for necessity are different in [Pit91] and in [Mogb]. We adopt the latter and call “standard” the corresponding version of the logic. In the choice of primitive and derived rules, our presentation matches the view of strong monads as triples ⟨T, val , let ⟩, while the one in [Mogb] matches the more familiar view including unit, multiplication and strength.

We survey Pitts’ semantics based on hyperdoctrines [Pit91], Moggi’s first standard semantics [Mogb] and his second [Moga], which was introduced to capture monads for which the first would not work (e.g. the Plotkin powerdomain monad). Adopting the interpretation in [Mogb], which is used in chapter 5, we describe models of the full calculus.

As explained earlier, Moggi’s standard semantics (both of the above) require higher order structure to interpret possibility and this is typically found in an ambient category in which the category of domains is fully reflective. We consider a construction to extend a monad T, defined on a category C, to a monad T̃ on an ambient category E of which C is a fully reflective subcategory. We learnt this construction from Moggi but ours is the observation that the category of T̃-algebras is equivalent to that of T -algebras. This result (theorem 4.6.3) says that T̃ is, in some sense, a “minimal” extension of T. We also find abstract conditions allowing the extension to T̃ of the strength of T.

Although models of computation do live in categories with higher order logical structure, it is not clear why this structure should be necessary to get a standard interpretation of possibility and of the evaluation relations, as done in [Mogb]. We show how to obtain evaluation relations just from an endofunctor T and first order structure. Such relations can be integrated with evaluation modalities in a logic featuring left and right rules of the form:

□ left \frac{Γ, ϕ(M) ⊢ ψ Γ ⊢ x ⇐ E}{Γ, [x ⇐ E] ϕ(x) ⊢ ψ}  □ right \frac{Γ, x ⇐ E ⊢ ϕ(x)}{Γ ⊢ [x ⇐ E] ϕ(x)} x ∉ FV (Γ)

As we argue in chapter 4, such rules would simplify the structure of proofs in EL, where each modality is instead related with each logical operator by a separate rule.

For most notions of computation the modalities of EL are definable from evaluation relations by using first order quantification (see section 4.8), which means that, from our interpretation of such relations, a standard model of the logic is obtained in a first order framework, e.g. in a logos [FS90, 1.7]. We find the abstract conditions under which our definition of the evaluation relations corresponds to the one in [Mogb].

Our original contribution in this chapter consists in the theorems on extending monads to an ambient category (section 4.6) and the part on evaluation relations (section 4.8).

Chapter 5 sets Evaluation Logic to work on partial correctness.

Partial correctness specifications are formulae involving imperative programs and assertions about their states. Assertions are formulae which, unlike specifications, are interpreted “in a state.” We consider assertions of a very general form: they may contain any term of the programming language, including expressions with loops and side effects. There are two reasons for allowing such generality: first, the assumption made in Hoare Logic that expressions have no computational content is violated by most common programming languages, which include devices such as function procedures or block expressions. Second, this level of generality provides a good ground for testing the power of the evaluation modalities as a mechanism for integrating logic and computation.

We study the monad T X = (X × S)_{⊥}^{S} for partial computations with side effects: we show that this monad satisfies the conditions required by the standard interpretation of [Mogb] and validate the special axiom □ val^{∗} of section 4.1, which is used later to give a formal account of assertions in EL.

Two things should be remarked about these proofs. First, they are corollaries to more general theorems stating that the monad constructors FT =^{def} T ( × S)^{S} preserves monads satisfying the desired properties. We believe that one obtains greater insight into a notion of computation from an analysis of constructors such as F than from the study of the corresponding monad in isolation. Second, EL is used to reason about several interacting notions of computation. For example, if T and Q are strong endofunctors, the necessity modality for their composite can be obtained by composition as follows:

[x ⇐ z]_{T Q} ϕ(x) ≅ [y ⇐ z]_{T} [x ⇐ y]_{Q} ϕ(x),

where the modalities are indexed by the notion of computation adopted in the evaluation. In general, the strategy we adopt for reasoning about a notion of computation, say, to validate axioms, is to look at it at a lower level of abstraction by breaking it into more elementary pieces and then to prove the desired properties formally in the combined theory of such pieces. We shall call “modular” proofs that follow this strategy.

Next, we consider a version of EL for computation with side effects, called ELse, whose formulae are interpreted “in a state” and adopt it as a calculus of assertions. ELse is a theory in the version of Evaluation Logic of [Pit91]. Rather than working in a nonstandard model of this theory (e.g. by interpreting predicates on a type A as subobjects of [[A]] × S) we translate it into standard EL with constants for explicit manipulation of states. We introduce suitable axioms for such constants and validate them for monads of the form FT. Again, the proof is modular, in the sense discussed above. The soundness of interpretation of ELse in EL is then proven by formally deriving each inference rule of the former in the latter.

ELse can be used for reasoning about partial correctness. We generalize the familiar formalism of Hoare triples to include a simple form of annotated while-programs, that is terms obtained by alternating commands and assertions. Partial correctness specifications of possibly annotated while-programs are translated into ELse and the translation is shown to preserve the theorems of Hoare Logic.

Then, we take the text-book example of a formally specified program for integer division and prove its correctness in ELse. The proof requires fixed point induction to handle the recursive computations arising from while-loops. As explained earlier, the application of this rule in the presence of all connectives of first order logic includes a test of admissibility over formulae. We propose an improvement of the test presented in [Ten91] which recognizes more admissible formulae, e.g. the double negation of an admissible formula. Our proof of correctness is acknowledged in [Ten].

All material presented in this chapter is original.

Chapter 6 presents and develops the theory of semantic constructors introduced by E. Moggi in [Mog90a,Mog91c].

We introduce the notion of Σ-homomorphism (not in Moggi’s presentation), which defines morphisms in the category of models of ML_{T} (Σ). Σ-homomorphisms relate the interpretations of each constant of Σ in the source and target models and hence they can be used for studying semantic constructors from the point of view of the algebraic properties that they preserve and reflect.

To this effect, we consider constructors F endowed with families of Σ-homomorphisms M → FM, which we call “pointed.” Inspired by (but more general than) the parametric extensions of [Mog90b], pointed constructors include the ones for exceptions and for resumptions presented in chapter 7. We show that equations involving terms of a fairly general class are preserved by pointed constructors (theorem 6.2.5). Axioms of theories of computation can be validated in constructed models by using this result. We also consider the dual issue of conservativity and show that equations (again subject to restrictions) which are satisfied in a model FM are also satisfied in M (theorem 6.2.7).

Then, we study the “syntactic” presentation of constructors. This work stems from a joint paper with E. Moggi [CM93], where a higher order metalanguage, HML, is used to describe models of computation and translations of HML theories, also called relative interpretations, are used to describe semantic constructors. Our aim, here, is to give an intrinsic characterization of the constructors that can be represented in this fashion. Besides answering a mathematically natural question, this result may help finding more general type theories to capture more general constructors.

A natural setting for studying relative interpretation is functorial semantics [KR77], in which theories are viewed as categories with structure and models as structure-preserving functors, generally in the category of sets. Translations T_{2} → T_{1} are also structurepreserving functors. Hence, a translation maps models of T_{1} to models of T_{2} by composition. Gabriel and Ulmer [GU75] studied these maps for finite limit theories. They showed that locally finitely presentable categories (see definition 6.5.3) are categories of models of such theories and that functors between such categories (satisfying certain conditions) correspond to relative interpretations. We establish a similar result for theories of HML.

We define models of HML, which are fibrations of a special form, called λ\overline{ω}-categories. The soundness and completeness of HML with respect to interpretation in these models is proven. Then, we show that the category of HML theories is equivalent to the category λ\overline{ω}-Cat of λ\overline{ω}-categories and that interpretation of such theories correspond to morphisms in λ\overline{ω}-Cat. Hence, we obtain a functorial semantics of HML, where the syntax disappears and theories are abstractly represented as λ\overline{ω}-categories. Next, we show that the category Mod (T) of models of a theory T is equivalent to the category [T, Sets ]_{lex} of set valued models of a finite limit theory T, which is locally finitely presentable. Moreover, we show that the functors Mod (ϕ) : Mod (T_{1}) → Mod (T_{2}) induced by a relative interpretation ϕ : T_{2} → T_{1} satisfy the conditions required by the Gabriel-Ulmer duality. This result is used in theorem 6.8.12 to give a simple characterization of functors of the form Mod (ϕ).

The definition of semantic constructor is from [Mog90b]. Sections 6.3 and 6.4 use material from [CM93]. Section 6.5 surveys standard results in functorial semantics. Section 6.6 reviews some notions of fibred category theory used for modelling HML. All the rest, including what is described above, is our own contribution.

Chapter 7 develops in LEGO the semantic constructors for exceptions and for resumptions described in [CM93] and uses the logic provided by the underlying type theory, the Extended Calculus of Constructions, to prove properties of such constructors formally.

The type universe of XCC provides an intuitionistic set theory in which models of computation are embedded, as in synthetic domain theory. “Domains” are inhabitants of a type Dom and the embedding is provided by an externalization map E:Dom->Type. From this data one can define suitable types and terms whose interpretation in a model of the type theory determines a full internal subcategory Dom in the ambient category of types. All the constructions developed in the applications refer to this category of discourse.

Categorical structure in Dom is represented by suitable types whose inhabitants we call structures. The computational metalanguage is encoded in the type theory and a formal interpretation function is defined, mapping the syntax to Dom . This function is parametric in the appropriate structure, that is: products, exponentials and a monad.

Semantic constructors are represented as functions returning structure for interpreting one theory of the metalanguage from structure for interpreting another. We present two constructors from [CM93], one for exceptions and one for resumptions. The correctness of the first is proven in LEGO by showing that it maps monads to monads. The second is used to define a model of parallel computation with interleaving.

Resumptions are constructed on top of a model featuring operators of fixed point and nondeterministic choice. The constructor redefines these operations to adapt them to the new notion of computation, where other operations for manipulating resumptions become available. From these operations, we define an operator of parallel composition of which we give a formal proof of commutativity. The proof uses properties of the abovementioned operations, e.g. the uniformity of fixed points (see section 7.2). Hence, we prove lemmas showing that such properties are preserved by the constructor of resumptions. Finally, we make sure that all the pieces of structure being used are consistent with each other by looking for them in a concrete model of the type theory based on PERs.

The definitions of the exception and resumption constructors, and of the operator of parallel composition are based on similar definitions in HML due to Moggi. All the rest in this chapter is original.

Chapter 8 contains directions for further research.

Prerequisites.

• Category theory.

• Basic logic and type theory.

• Some feeling for LEGO (for chapter 7 and the appendices only).

2 The Computational Lambda Calculus

In this chapter we present a metalanguage ML_{T} (Σ), called computational lambda calculus [Mog91b], featuring computational types and polymorphic operations (á la ML) in a signature Σ to describe specific notions of computation. The first two sections contain definitions and discussion of the relevant mathematical concepts, in particular that of strong monad upon which the semantics of the metalanguage is based. ML_{T} (Σ) is introduced in section 2.3, while section 2.4 describes its interpretation in a cartesian closed category with a strong monad and additional Σ structure. In the last section we present some examples of computationally relevant monads.

2.1 Strong endofunctors

Definition 2.1.1 A monoidal category C = ⟨C, ⊗, 1, α, λ, ρ⟩ consists of a category C with a bifunctor ⊗ : C × C → C which is associative up to a natural isomorphism α : ( ⊗ )⊗ ≅ ⊗( ⊗ ) and an object 1 of C which is left and right unit for ⊗ up to natural isomorphisms λ : 1⊗ ≅ and ρ : ⊗1 ≅ , subject to the coherence conditions described in [EK66, II.1].

Definition 2.1.2 A monoidal category C is closed if each functor ⊗ B : C → C has a specified right adjoint [B, ].

We write η_{X}^{B} : X → [B, X ⊗B] for the unit of such an adjunction, ϵ_{X}^{B} : [B, X]⊗B → X for the counit (i.e. evaluation) and Λf : X → [B, Y] for the transpose of f : X ⊗ B → Y. If C is symmetric and closed, it is biclosed, that is also every B ⊗ has a right adjoint.

Let C be a monoidal closed category. The bijection ^{⌈} ^{⌉} : C(A, B) ≅ C(1, [A, B]) is defined as follows: the name ^{⌈}f^{⌉} : 1 → [A, B] of a morphism f : A → B is the element Λ(f^{∘}λ_{A}). Conversely, the arrow^{⌉}g^{⌈} : A → B of an element g : 1 → [A, B] is the morphism (Λ^{−1}g)^{∘}λ_{A}^{−1}. Then ^{⌉}^{⌈}f^{⌉}^{⌈} = f and ^{⌈}^{⌉}g^{⌈}^{⌉} = g. We write L_{A,B,C} : [B, C] ⊗ [A, B] → [A, C]

for the transpose of [B, C] ⊗ [A, B] ⊗ A ⟶^{id⊗ϵ} [B, C] ⊗ B ⟶^{ϵ} C. Then, L(^{⌈}f^{⌉},^{⌈}g^{⌉}) = ^{⌈}f^{∘}g^{⌉}.

Definition 2.1.3 A strong endofunctor T = ⟨T, st ⟩ on a monoidal closed category C consists of a map on objects T : obj (C) → obj (C) and a family of morphisms st_{A,B} : [A, B] → [T A, T B], the functorial strength of T, satisfying the following equations:

⌈id^{⌉} = st ^{∘}^{⌈}id^{⌉}  (2.1)
st ^{∘}L = L^{∘}(st ⊗ st ).  (2.2)

The underlying functor T : C → C of a strong endofunctor T = ⟨T, st ⟩ on C maps A to T A and f : A → B to ^{⌉}(st_{A,B} ^{∘}^{⌈}f^{⌉})^{⌈} : T A → T B.

Every monoidal closed category can be enriched over itself by taking the internal homs [A, B] as hom-objects, names of identities ^{⌈}id_{A}^{⌉} : 1 → [A, A] as identity elements and L as composition [EK66, Theorem 5.2]. The following is well known:

Proposition 2.1.4 Every strong endofunctor on a monoidal closed C can be viewed as a C-functor on the category C enriched over itself and viceversa. The underlying functor of the C-functor, as defined in [Kel82], is the same as that of the strong functor, as above.

Now we consider a different notion of strength and describe the correspondence with the one above in the more general setting of a V-category C, for V monoidal closed. C is said to be tensored over V if for every X ∈ V and A ∈ C there exists a tensor product X ⊗ A ∈ C and V-natural isomorphisms

C(X ⊗ A, ) ≅ [X, C(A, )].

Note that such isomorphisms give rise to an adjunction ⊗ A ⊣ C(A, ) : V ⇀ C_{0} between V and the underlying category of C, defined by

C_{0}(X ⊗ A, B) =^{def} V(1, C(X ⊗ A, B)) ≅ V(1, [X, C(A, B)]) ≅ V(X, C(A, B)).

The above adjunction yields natural isomorphisms α_{X,Y,A} : X⊗(Y ⊗A) → (X⊗Y)⊗A in C_{0} as implied by Yoneda and the following natural bijections:

X ⊗ (Y ⊗ A) ⟶ B
X ⟶ C(Y ⊗ A, B)
X ⟶ [Y, C(A, B)]
X ⊗ Y ⟶ C(A, B)
(X ⊗ Y) ⊗ A ⟶ B

Theorem 2.1.5 ([Koc72, 1.3]) Let V be a symmetric monoidal closed category, let A and B be V-categories tensored over V and let A_{0} and B_{0} be their underlying categories. There is a one-to-one correspondence between V-functors A → B and functors T : A_{0} → B_{0} equipped with a natural family of morphisms t_{X,B} : X ⊗ T B → T (X ⊗ B) satisfying the following diagrams:

1 ⊗ T B T B λ  t  T (1 ⊗ B) T λ  (X ⊗ Y) ⊗ T B  X ⊗ T (Y ⊗ B)  T ((X ⊗ Y) ⊗ B) α X ⊗ (Y ⊗ T B)  T (X ⊗ (Y ⊗ B)) t t id ⊗ t  T α

In the light of the above result, t is often called the tensorial strength of T. We can see the correspondence between tensorial and functorial strengths through Yoneda:

[B, C] ⟶ [T B, T C]
V(X, [B, C]) ⟶ V(X, [T B, T C])
C_{0}(X ⊗ B, C) ⟶ C_{0}(X ⊗ T B, T C)
X ⊗ T B ⟶ T (X ⊗ B)

The constructions are as follows: morphisms st_{A,B} : [A, B] → [T A, T B] are obtained from t by transposing [A, B]⊗T A ⟶^{t} T ([A, B]⊗A) ⟶^{T ϵ} T B. Vice versa, t_{X,B} is obtained from st as X ⊗T B ⟶^{η^{B}⊗id} [B, X ⊗B]⊗T B ⟶^{Λ^{−1}st} T (X ⊗B). We refer to the aforementioned paper for the proofs that the relevant diagrams commute.

From the above discussion we obtain an alternative definition of strong endofunctor T = ⟨T, t⟩ on a symmetric monoidal closed category C as consisting of a (conventional) functor T : C → C and a natural transformation t_{A,B} : A ⊗ T B → T (A ⊗ B) satisfying the commutative diagrams of 2.1.5. In the following definition, as in most of this thesis, we consider strengths defined in cartesian closed categories, where the isomorphisms α, λ and ρ are the canonical ones.

Definition 2.1.6 ([Mog90b]) Objects of the category of strong endofunctors are triples ⟨C, T, t⟩, where ⟨T, t⟩ is a strong endofunctor on a cartesian closed category C. Morphisms ⟨C, T, t^{T} ⟩ → ⟨D, S, t^{S}⟩ are pairs (U, σ), where the functor U : C → D preserves the cartesian closed structure on the nose and σ : UT \underrightarrow{.} SU is a natural transformation making the following commute:

UT (A × B) UA × UT B  σ id × σ  Ut^{T} t^{S} UA × SUB  S(UA × UB)

The equation expressing the diagram above in terms of the functorial strength is: [UT A, σ_{B}]^{∘}Ust^{T} = [σ_{A}, SUB]^{∘}st^{S}, that is, σ_{B}(Ust_{A,B}(f, w)) = st_{UA,UB}(f, σ_{A}w). This is an instance of diagram 2.6 of section 2.2 and it expresses the fact that σ is C-enriched. The condition that U preserves the universal structure on the nose is only to simplify the treatment, so that, for example, UA × UT B = U(A × T B).

Remark. Strong endofunctors are the objects of a 2-category the 2-cells of which, ϕ : (U, σ) ⇒ (V, ρ) : ⟨C, T, t^{T} ⟩ → ⟨D, S, t^{S}⟩, are natural transformations ϕ : U \underrightarrow{.} V such that Sϕ^{∘}σ = ρ^{∘}ϕT.

Remark. Two strong endofunctors T = ⟨T, st^{T} ⟩ and S = ⟨S, st^{S}⟩ defined on the same monoidal closed category C have an obvious composite: T S = ⟨T S, st^{T} ^{∘}st^{S}⟩, while their tensorial strengths are composed as follows to obtain:

t^{T S} =^{def} X ⊗ T SB ⟶^{t_{X,SB}^{T}} T (X ⊗ SB) ⟶^{T t_{X,B}^{S}} T S(X ⊗ B).

2.2 Strong monads

In section 2.1 we showed an equivalence between two definitions of strong endofunctor: the first involving a map of objects T and a family st of morphisms, the second involving a functor T and a natural transformation t. The former is more syntactic, in the sense that T may be viewed as a type constructor and st as a family of uniformly typed operations in the internal language of a category. Note that a map on objects T plus the operations of t do not suffice to make T a functor.

In this section we follow the same approach for strong monads on which Moggi’s computational metalanguage is based. The minimal version of this calculus described in [Mog91b] requires only the structure of a monad; however, a strength is needed to interpret terms with more than one free variable. First we introduce strong monads T as made of type constructors and operations defined in cartesian closed categories C. This definition is adopted in chapter 6 to represent monads in a type theory. Then we show in the internal language of C (with “signature” T) that strong monads correspond to monads over C, which look more familiar to the category theorist. In the following section, we present Moggi’s computational metalanguage as a sugared version of the language of strong monads.

Definition 2.2.1 A strong monad M = ⟨T, val, let ⟩ on a cartesian closed category C consists of a map on objects T : obj (C) → obj (C) and two families of morphisms val_{A} : A → T A and let_{A,B} : [A, T B] × T A → T B such that, for any f : A → T B and g : B → T C, the following diagrams commute:

⌈id^{⌉} [T A, T A]  [A, T A]^{^{⌈}val^{⌉}} Λlet 1  1 × A  A T B^{⌈}f^{⌉} × val  f λ [A, T B] × T A let

⌈g^{⌉} × (let ^{∘}(^{⌈}f^{⌉} × id )) Λ(let ^{∘}(^{⌈}g^{⌉} × f)) × λ  [B, T C] × T B T C 1 × (1 × T A) [A, T C] × T A  let  let

Note that let is an internal version of the lifting operation defined for Kleisli triples (another presentation of monads; see [BW85]).

In the following, we sometimes use lambda notation to address morphisms of a cartesian closed category C. This is fairly standard practice in category theory, where one speaks of the internal language of C, as in [LS86, I.10.6]. In particular, our category is endowed with families of morphisms val_{A} : A → T A and let_{A,B} : (A → T B) × T A → T B satisfying the following equations: for all x : A, z : T A, f : A → T B and g : B → T C,

let_{A,A} val_{A} z = z  (2.3)
let_{A,B} f (val_{A} x) = fx  (2.4)
let_{B,C} g (let_{A,B} f z) = let_{A,C} (λ x : A. let_{B,C} g (fx)) z  (2.5)

where “let f z” stands for let (f, z). Moreover we shall write “let f” for (λ z. let f z) and, in general, assume left associativity in unbracketed expressions. These equations are just the Curry-ed version of the diagrams in definition 2.2.1.

Proposition 2.2.2 A strong monad M = ⟨T, val, let ⟩ has an underlying strong endofunctor with the same map T on objects and strength

st_{A,B} : [A, B] ⟶^{[A,val]} [A, T B] ⟶^{Λlet} [T A, T B].

Proof. The above diagrammatical description of st translates in the internal language as st_{A,B} f =^{def} let_{A,B} (λ x : A. val_{B}(fx)). Then, equation 2.1 follows immediately from axiom 2.3: st (λ x. x) =^{def} let (λ x. val x) = let val = λ z. z.

Similarly, let g : A → B and f : B → C; since L f g = λ x. f(gx), equation 2.2 follows from 2.4 and 2.5:

L (st_{B,C} f) (st_{A,B} g) z = st_{B,C} f (st_{A,B} g z) = let_{B,C} (λ y : B. val_{C} (fy)) (let_{A,B} (λ x : A.val_{B} (gx)) z) = let_{A,C} (λ x : A. let_{B,C} (λ y : B. val_{C} (fy)) (val_{B} (gx))) z = let_{A,C} (λ x : A. val_{C} (f(gx))) z = st_{A,C} (λ x : A. f(gx)) z = st_{A,C} (L f g) z.

□

Remember that a C-natural transformation σ : (T, st^{T}) → (S, st^{S}) is a family of morphisms σ_{A} : T A → SA such that:

[T A, σ_{B}] [A, B]  [T A, SB] [T A, T B] [σ_{A}, SB]^{st^{S}}  ^{st^{T}} [SA, SB]

(2.6)

Proposition 2.2.3 Let C be a cartesian closed category; there is a one-to-one correspondence between strong monads ⟨T, val, let⟩ on C as defined in 2.2.3 and C-monads ⟨T, st , η, μ⟩.

Proof. We sketch the direction from strong monads to C-monads. From the following constructions: η_{A} =^{def} val_{A} : A → T A and μ_{A} =^{def} let_{T A,A}(λ z : T A. z) : T^{2}A → T A, unit and associativity laws as well as naturality follow from routine calculations. We show C-enrichment. In the case of η, diagram 2.6 corresponds to:

[T A, T B] [A, T B] [val , T B] Λlet [A, val ] [A, T B] [A, B] [A, val ]

which commutes because [val, T B]^{∘}Λlet = id_{[A,T B]}, that is, in the internal language, λ x : A. let_{A,B} f (val_{A} x) = f. Similarly, 2.6 specializes for μ as follows:

[A, B]^{st^{T}} [T A, T B]  [μ_{A}, T B] [T A, T B] ^{st^{T}}  [T^{2}A, μ_{B}]^{st^{T}}  [T^{2}A, T^{2}B] [T^{2}A, T B]

which, for f : A → B and w : T^{2}A amounts to:

μ_{B}(st_{T A,T B} (st_{A,B} f) w)
= let_{T B,B}(λ z : T B. z) (let_{T A,T B} (λ z : T A. val_{T B} (st_{A,B} f z)) w)
= let_{T A,B}(λ z : T A. let_{T B,B} (λ z : T B. z) (val_{T B} (st_{A,B} f z))) w
= let_{T A,B} (st_{A,B} f) w
= let_{T A,B} (λ z : T A. let_{A,B} (λ x : A. (val_{B}(fx)) z) w
= let_{A,B} (λ x : A. val_{B} (fx)) (let_{T A,A} (λ z : T A. z) w)
= st_{A,B} f (μ_{A}w).
□

From the correspondence established by Theorem 2.1.5 we get an alternative view of a strong monad in a cartesian closed category C as a 4-tuple ⟨T, t, η, μ⟩ consisting of a strong endofunctor ⟨T, t⟩ and a monad ⟨T, η, μ⟩ such that:

id × η η  A × T B A × B  t T (A × B)  id × μ A × T B A × T^{2}B  t t T (A × T B)  T (A × B) T^{2}(A × B) μ T t

(2.7)

Such diagrams follow from 2.3, 2.4 and 2.5, for η and μ defined as in the proof of Proposition 2.2.3 and t_{A,B} =^{def} A × T B ⟶^{(Λval)×id} [B, T (A × B)] × T B ⟶^{let} T (A × B), that is: t(x, w) =^{def} let (λ y. val(x, y)) w.

Definition 2.2.4 Objects of the category of strong monads are 5-tuples ⟨C, T, t, η, μ⟩, where ⟨T, t⟩ is a strong endofunctor on a cartesian closed category C and ⟨T, η, μ⟩ is a monad on C such that t, η and μ satisfy 2.7. Morphisms from ⟨C, T, t^{T} , η^{T} , μ^{T} ⟩ to ⟨D, S, t^{S}, η^{S}, μ^{S}⟩ are morphisms (U, σ) of the underlying strong endofunctors such that:

SUA UA UT A  σ η^{S} Uη^{T}  UT^{2}B  SUT B  S^{2}UB μ^{S} SUB σ Uμ^{T}  σ  Sσ UT B

In [Mog90b] strong monad morphisms are presented in terms of val and let . In this case, given x : UX, f : UX → UT Y and w : UT X, the equations are: val x = σ(Uval (x)) and σ_{Y} (Ulet_{X,Y} f w) = let_{UX,UY} (σ_{Y} ^{∘}f) (σ_{X}w).

Remark. Monad morphisms (U, σ) are similarly defined in [Str72], but with σ reversed. We adopt the above version because it simplifies the theory of semantic constructors discussed in section 6.2.

Remark. Strong monads are objects of a 2-category where 2-cells ϕ : (U, σ) ⇒ (V, ρ) are the same as those of the underlying 2-category of strong endofunctors.

Remark. Unlike strong endofunctors, strong monads compose only occasionally. Two monads ⟨T, η^{T} , μ^{T} ⟩ and ⟨S, η^{S}, μ^{S}⟩ on a category C give rise to a composite ⟨T S, η^{T S}, μ^{T S}⟩ on C when a distributive law λ satisfying suitable diagrams is provided (see [BW85, 9.2]). In that case, η^{T S} = T η^{S} ^{∘}η^{T} and μ^{T S} = T μ^{S} ^{∘}μ^{T} ^{∘}T λS. The same situation holds for strong monads, for which λ is also required to be C-natural.

2.3 The computational lambda calculus

In [Mog91b], Moggi proposed the use of monads for modeling computations and a formal metalanguage, the computational lambda calculus ML_{T} (Σ), to describe denotations of programs. The signature Σ, in which the metalanguage is parametric, contains operations for describing specific notions of computation; in chapter 3, for example, we present a metalanguage with operations for raising and handling exceptions. Singling out such operations is convenient in view of the modular approach to denotational semantics that we explore in in chapter 6. Here, we present ML_{T} (Σ) as a special form of lambda calculus and in the next section we define its interpretation in a cartesian closed category equipped with a strong monad and Σ-structure.

First we extend the usual definition of typed lambda calculus to capture a family of languages whose signatures may include type constructors and polymorphic operations. We write L(Σ) for a generic member of this family with signature Σ.

Let Σ_{τ} be a collection of constant type symbols K, each associated with a natural number α_{τ}(K) called its arity. Let χ be a collection of type variables. We call Σ_{τ}-polytypes, dropping “Σ_{τ}” when possible, the expressions freely generated from the following rules:

A1. 1 is a polytype;

A2. X ∈ χ is a polytype;

A3. if K ∈ Σ_{τ}, α_{τ}(K) = n and τ_{1}, … τ_{n} are polytypes, then K(τ_{1}, … τ_{n}) is a polytype (brackets are omitted when n = 0, in which case K is called “nullary”);

A4. if σ and τ are polytypes, then so is σ × τ;

A5. if σ and τ are polytypes, then so is σ → τ.

By writing a polytype as τ(X_{1}, … X_{n}), we mean that all type variables of τ are in X_{1}, … X_{n}. By Σ_{τ}-types we mean Σ_{τ}-polytypes with no variables. We call closed type scheme a nonempty list of polytypes τ_{1}(X_{1}, … X_{n}), … τ_{m}(X_{1}, … X_{n}), τ(X_{1}, … X_{n}), written ∀X_{1}, … X_{n}. τ_{1}, … τ_{m} ⟶ τ (∀X_{1}, … X_{n}. τ when m = 0).

A signature of a typed lambda calculus L(Σ) is a 4-tuple Σ = (Σ_{τ}, α_{τ}, Σ_{ϵ}, α_{ϵ}) where Σ_{τ} and α_{τ} are as above, Σ_{ϵ} is a collection of operation symbols and α_{ϵ} associates with each op ∈ Σ_{ϵ} a closed type scheme called its arity. We write op : ∀X_{1}, … X_{n}. τ_{1}, … τ_{m} ⟶ τ when α_{ϵ}(op ) = ∀X_{1}, … X_{n}. τ_{1}, … τ_{m} ⟶ τ.

A typed lambda calculus L(Σ) consists of collections of types, typed terms and equations between terms, each satisfying the closure conditions specified below. Let Σ = (Σ_{τ}, α_{τ}, Σ_{ϵ}, α_{ϵ}); the types of L(Σ) are Σ_{τ}-types as defined above. Let χ_{τ} be a collection of varibles, one for each type τ. The terms of L(Σ) are freely generated by the following rules: writing M : τ for “M is a term of type τ,”

B1. ∗ : 1;

B2. if x ∈ χ_{τ}, then x : τ;

B3. if op : ∀X_{1}, … X_{n}. τ_{1}, … τ_{m} ⟶ τ is an operation in Σ_{ϵ}, σ_{1}, … σ_{n} are types, and M_{j} : τ_{j}(σ_{1}, … σ_{n}) for j = 1, … m, then op_{σ_{1},...σ_{n}}(M_{1}, … M_{m}) : τ(σ_{1}, … σ_{n}); B4. if M : σ and N : τ, then ⟨M, N⟩ : σ × τ;

B5. if M : σ × τ, then π_{1}(M) : σ and π_{2}(M) : τ;

B6. if M : σ → τ and N : σ, then MN : τ;

B7. if x ∈ χ_{σ} and M : τ, then λ x : σ. M : σ → τ.

When the types are understood we shall drop the indices of the constant operations. We shall also drop the parentheses when the precedence is understood. The usual notions of free and bound variables, and of substitution extend immediately to L(Σ). Rather than decorating variables with their type, we shall use typing contexts to type-check terms. A typing context Γ is a list Γ = (x_{1}, … x_{n}) of variables, where no x_{i} is repeated. Such a list is written (x_{1} : τ_{1}, … x_{n} : τ_{n}), with x_{i} ∈ χ_{τ_{i}}, to make the type of each variable explicit. We write Γ ⊢ M : τ when M is a term of type τ in L(Σ) whose free variables are in context Γ and call Γ a context for M.

Note that there are no polymorphic terms in L(Σ): although, as we shall see in the next section, operations in the signatures we consider may have a polymorphic intended meaning, polytypes and type schemes live only in the metatheory. Formally, we decorate operations with type indices so as to type-check terms such as nil_{A} where nil : ∀X.list (X). Informally, we drop indices when we can.

Equations have the form M =_{Γ} N, where M and N are terms of same type in context Γ. The collection of equations of L(Σ) is called the theory of L(Σ). Such a theory is required to be closed under the usual inference rules of typed lambda calculi with unit and product types (see [LS86]). Theories include a special set of axioms, typically involving constants in Σ, such that anything in the theory derives from the axioms via the inference rules. When M =_{Γ} N is in the theory of L(Σ), we write Γ ⊢ M = N.

Equations are indexed by contexts in order for theories to make sense of possible empty types. For example, let L(Σ) contain no closed terms of type ∅ ∈ Σ_{τ} and let the following be an axiom:

x : τ, y : τ ⊢ λ z : ∅. x = λ z : ∅. y.

From this equation, x : τ, y : τ, z : ∅ ⊢ x = y follows. Interpreting ∅ in Sets as the empty set, the theory equates any two elements of an arbitrary set τ provided an element of the empty set can be found. If the indices were not there, the proviso would be lost, and soundness lost with it.

Let Σ_{τ} be a collection of constant type symbols not including T and let α_{τ} be defined on Σ_{τ} ∪ {T }, with α_{τ}(K) = 0 for K ∈ Σ_{τ} and α_{τ}(T) = 1. Let Σ_{ϵ} be a collection of operation symbols not including val and let , let α_{ϵ} map them to closed type schemes formed from polytypes over Σ_{τ} ∪ {T } and let ᾱ_{ϵ} extend α_{ϵ} to Σ_{ϵ} ∪ {val , let } with val : ∀X. X ⟶ T X and let : ∀X, Y. (X → T Y), T X ⟶ T Y.

Definition 2.3.1 A computational lambda calculus, or computational metalanguage, ML_{T} (Σ_{τ}, Σ_{ϵ}, α_{ϵ}) is a typed lambda calculus L(Σ_{τ} ∪ {T }, α_{τ}, Σ_{ϵ} ∪ {val , let }, ᾱ_{ϵ}) with Σ_{τ}, Σ_{ϵ}, α_{ϵ}, α_{τ}, and ᾱ_{ϵ} as above and with axiom schemes including equations 2.3, 2.4 and 2.5.

By abuse of notation we use “Σ” also to range over signatures (Σ_{τ}, Σ_{ϵ}, α_{ϵ}) of computational metalanguages. We write ML_{T} for the theory of ML_{T} (∅) including no other axioms than 2.3, 2.4 and 2.5. In [Mog91b], ML_{T} is presented in a sugared version, with the operator let written in the form:

Γ ⊢ M : T τ Γ, x : τ ⊢ N : T σ
Γ ⊢ let x ⇐ M in N : T σ

where x is bound in (let x ⇐ M in N). In the following we shall sometimes adopt the above syntax which we take as an abbreviation for let (λ x : τ. N) M. In particular, 2.3, 2.4 and 2.5 can be rewritten as:

T.η let x ⇐ M in val(x) = M
T.β let x ⇐ val(M) in N = N[M/x]
T.assoc let y ⇐ (let x ⇐ L in M) in N = let x ⇐ L in (let y ⇐ M in N).

The following ξ rules are derivable from β-reduction and the ξ rules for lambda abstraction and application. Note that this would not be possible had we taken let x ⇐ M in N as primitive notation.

M = N
val.ξ val(M) = val(N)
M = M′ N = N′
let.ξ (let x ⇐ M in N) = (let x ⇐ M′ in N′)

The converse of val.ξ expresses a mono requirement: given an interpretation of ML_{T} (Σ) in a strong monad T (as shown in the next section), this corresponds to the unit η of T being a monomorphism:

val(M) = val(N)
mono  M = N

Such a property is required of “computational models” (λ_{c}-models) in [Mog91b], as it allows a view of η as an existence predicate, like in a logic of partial elements. The availability of such a predicate makes it possible to reconstruct the base category from the Kleisli category of a monad. In particular, there is a correspondence between categories with a monad satisfying mono and theories (of programming languages) with equivalence and existence predicates. We shall use the mono requirement to prove Proposition 3.7.4.

2.4 Structures and interpretation

In [Rey83], Reynolds suggested that satisfactory models of polymorphic languages should exclude ad hoc polymorphism. The concept of parametric polymorphism, usually credited to Strachey, expresses the informal requirement that instances of polymorphic entities are assigned uniform meaning.

This can be made more precise by considering relational parametricity [Rey83]. Assume some notion of relation A ↔ B between objects A and B in a category C. Let ρ_{1}, ρ_{2} : χ → Obj (C) be assignments to the type variables in χ; the members of a typeindexed family R of relations R_{τ} : [[τ]]_{ρ_{1}} ↔ [[τ]]_{ρ_{2}} are called logical if R satisfies certain closure conditions (see [Plo73,Mit90] for definitions). In particular, if C has exponentials, a logical relation R_{σ→τ} is defined from R_{σ} and R_{τ} as follows:

R_{σ→τ} = {f, g | ∀ a, b. R_{σ}(a, b) ⊃ R_{τ}(fa, gb)}.

A polymorphic operator ω is called relationally parametric if its instances satisfy any logical relation. More precisely, we say that an Obj^{n}-indexed family of morphisms ω_{X_{1},...X_{n}} : [[σ]]_{X_{1},...X_{n}} → [[τ]]_{X_{1},...X_{n}} is relationally parametric if ω_{A_{1},...A_{n}}R_{σ→τ} ω_{B_{1},...B_{n}} for all type assignments A_{1}, … A_{n} and B_{1}, … B_{n}, and logical relations in a family R. This can be expressed diagrammatically as:

[[τ]]_{A_{1},...A_{n}} [[τ]]_{B_{1},...B_{n}} [[σ]]_{A_{1},...A_{n}} ω_{A_{1},...A_{n}}  R_{τ} [[σ]]_{B_{1},...B_{n}} ω_{B_{1},...B_{n}} R_{σ}

Example. Let ρ_{1}, ρ_{2} : χ → obj (C) be type assignments, and let h : ρ_{1} → ρ_{2} be a collection of morphisms h_{X} : ρ_{1}(X) → ρ_{2}(X), indexed by χ; h induces a logical relation ≃, where a ≃_{X} b if and only if b = h_{X}a. Using this notion of logical relation, an operator Y of arity ∀X. (X → X) ⟶ X is relationally parametric when, for all h : A → B, f : A → A and g : B → B, if hf = gh then Y_{B}g = h(Y_{A}f). A “uniform” fixed-point operator Y in Cpo , the category of cpos, is defined by Plotkin as one that satisfies the above property restricted to strict maps h.

□

Properties such as uniformity are not algebraic, that is they cannot be enforced on models by means of equations. Therefore, models of the computational metalanguage may have to be provided with built-in parametricity. In chapter 7 we use a uniform fixed point operator Y to define structures for denotational semantics. There, we adopt a more powerful metalanguage, the Extended Calculus of Constructions [Luo82], in which domain theoretic properties can be axiomatized.

Remark. The notion of naturality can be related to parametricity. Let list be the unary type constructor of LISP. The operator cons , of arity ∀X. X, list (X) ⟶ list (X), satisfies the condition that, for all f : A → B,

list (f)(cons_{A} a l) = cons_{B} f(a) (list (f) l),

where list (f) is often written map(f) (see remark in section 6.3). Similarly, the equation list (f) nil_{A} = nil_{B} holds, where nil is a polymorphic operator of arity ∀X. list (X). These conditions express the naturality of cons and nil . In order to express naturality in terms of parametricity, one should explain how a relation R_{list(A)} is defined logically from R_{A}. The notion of action of a functor on a relational structure (see section 3.6), can be used to this extent.

□

Let C be a cartesian closed category and let Σ_{τ} be a collection of type constructors, with arities given by a map α_{τ}. A Σ_{τ}-structure on C is a collection of functions [[K]] : obj (C)^{n} → obj (C), with n = α_{τ}(K), one for each K ∈ Σ_{τ}.

An interpretation [[τ]] of a Σ_{τ}-polytype τ(X_{1}, … X_{n}) in a Σ_{τ}-structure is a map obj (C)^{n} → obj (C) defined from the interpretation of the constants in Σ_{τ} and from the obvious interpretations of 1, × and →. When τ is a type, [[τ]] is an object of C. Interpretation of types extends to contexts, with [[x_{1} : τ_{1}, … x_{n} : τ_{n}]] = [[τ_{1}]] × … × [[τ_{n}]].

Lemma 2.4.1 Let τ(X_{1}, … X_{n}) be a polytype and let σ_{i}, i = 1, … n, be types; then, [[τ(σ_{1}, … σ_{n})]] = [[τ]]_{[[σ_{1}]],...[[σ_{n}]]}.

Proof. By trivial induction on the structure of τ. □

An interpretation [[op]] of an operation op : ∀X_{1}, … X_{n}. τ_{1}, … τ_{m} ⟶ τ is an Obj (C)^{n}- indexed collection of morphisms [[op ]]_{A_{1},...A_{n}} : [[τ_{1}]]_{A_{1},...A_{n}} × … [[τ_{m}]]_{A_{1},...A_{n}} → [[τ]]_{A_{1},...A_{n}}. Such a collection may be required to satisfy parametricity to obtain well behaved models. A Σ_{ϵ}-structure on C consists of an interpretation [[op]] for each op ∈ Σ_{ϵ}. A Σ-structure on C consists of a Σ_{τ} and a Σ_{ϵ} structure.

An interpretation [[ ]] of L(Σ) in a Σ-structure on C maps types to objects of C and terms M of type τ to morphisms [[M]]_{Γ} : [[Γ]] → [[τ]], parametrically in a context Γ such that Γ ⊢ M : τ. When using lambda-notation to address morphisms in C, the free variables of [[M]]_{Γ} are the ones in Γ. The interpretation [[M]]_{Γ} is defined by structural induction on M as follows:

C1. [[∗]]_{Γ} = ! : [[Γ]] → 1;

C2. [[x_{i}]]_{(x_{1}:τ_{1},...x_{n}:τ_{n})} = π_{i} : [[τ_{1}]] × … × [[τ_{n}]] → [[τ_{i}]];

C3. [[op_{σ_{1},...σ_{n}}(M_{1}, … M_{m})]]_{Γ} = [[op]]_{[[σ_{1}]],...[[σ_{n}]]} ([[M_{1}]]_{Γ}, … [[M_{m}]]_{Γ});

C4. [[⟨M, N⟩]]_{Γ} = ⟨[[M]]_{Γ}, [[N]]_{Γ}⟩; [[π_{i}(M)]]_{Γ} = π_{i}[[M]]_{Γ};

C5. [[M N]]_{Γ} = [[M]]_{Γ}[[N]]_{Γ}; [[λ x : σ. M]]_{Γ} = λ x : [[σ]]. [[M]]_{Γ,x:σ}.

In the above definition we used the fact that, for all terms M but lambda abstractions, a context for M is also a context for its immediate subterms. Moreover, if Γ is a context for λ x : σ. M, then (Γ, x : σ) is a context for M. In the clause for lambda abstraction, we defined interpretation at a context Γ by using interpretation at a bigger context (Γ, x : σ). However, this does not break the induction since the latter is applied to a smaller term. In C3 we used lemma 2.4.1.

Definition 2.4.2 A model of L(Σ), or Σ-model, is a pair (C, A), where C is a cartesian closed category and A is a Σ-structure on C satisfying the axioms of L(Σ).

Example. Any theory L(Σ) has a syntactic model T (Σ). The underlying category of T (Σ) is the cartesian closed category whose objects are Σ_{τ}-types and whose morphisms are freely generated from morphisms [M] : 1 → τ, where [M] is the equivalence class of closed terms N such that ⊢ M = N. This category has an obvious Σ_{τ} structure and Σ_{ϵ} structure assigning to every op : ∀X_{1}, … X_{n}. τ_{1}, … τ_{m} ⟶ τ and types σ_{1}, … σ_{n} a morphism [[op ]]_{σ_{1},...σ_{n}} = [λx_{1} : τ̃_{1}, … x_{m} : τ̃_{m}. op (x_{1}, … x_{m})](x_{1}, … x_{m}), where τ̃_{i} stands for τ_{i}(σ_{1}, … σ_{n}).

□

Proposition 2.4.3 (Soundness) All theorems of ML_{T} are true in a cartesian closed category with a strong monad.

Proof. Let Σ consist of Σ_{τ} = {T } and Σ_{ϵ} = {val , let } of appropriate arities; ML_{T} is of the form L(Σ). Any monad ⟨T, val , let ⟩ is a Σ-structure on C and, by definition, it satisfies axioms 2.3, 2.4 and 2.5. Then, the result follows from soundness of typed lambda calculi with products and unit type with respect to interpretation in cartesian closed categories. □

Proposition 2.4.4 (Completeness) ML_{T} is complete with respect to interpretation in cartesian closed categories with a strong monad.

Proof. The argument in the proof of soundness can be reversed: any model of ML_{T} is a cartesian closed category with a strong monad. Completeness follows from the existence of a syntactic model where equations are satisfied only if provable. We do not make this proof any more formal as it just repeats a similar one given in section 6.7 for a more powerful type theory. □

Models of L(Σ) are made of universal structure and “additional” structure to interpret the operations in Σ. In this chapter, we restricted the former to cartesian closedness, as universality was only meant for the unit type, products and exponentials. Metalanguages with a richer set of universal types can also be considered, for example, including sums, recursive types, (strong) natural numbers and so on. However, it may be impossible to interpret certain computational features in categories that are too rich in universal structure. A typical example is the inconsistency of coproducts, which are used in the next chapter to interpret exceptions, with fixed points in cartesian closed categories [HP90].

2.5 Examples of computationally relevant monads

Lifting. A lifting monad can be used to give an account of partiality. Let A be a set and let A_{⊥} = {X ⊆ A | |X| ≤ 1}. There is a bijection between partial functions A ⇀ B and total functions A → B_{⊥}, natural in A and B, mapping f : A ⇀ B into f^{†} such that f^{†}(a) = {b | f(a) is defined and equal to b}. The adjunction given by this bijection defines a monad in the category of sets, which we call the lifting monad:

T A =^{def} A_{⊥}

where η = id^{†} satisfies the mono requirement and μ maps ∅ ↦ ∅ and {X} ↦ X. Such a monad is strong, with (st f)∅ = ∅ and (st f){a} = {f(a)}. Note that the above “internal” definition of lifting generalizes to the category of cpos and also to topoi.

An appropriate operation to include in a metalanguage for nontermination is ⊥_{X} : T X, which yields the always diverging computation for each type X. This choice is justified as follows. The lifting monad on the category of sets arises from an adjunction Sets ⇀ PSets , where PSets is the category of sets A with a “point” ⊥_{A} : 1 → A; morphisms are point preserving functions. The right adjoint is the obvious forgetful functor PSets → Sets . This functor is monadic. In fact, any pointed set (A, ⊥_{A}) is a Σ-algebra on A and every A_{⊥} is the free language over Σ generated by A. Similar constructions can be carried out for finitary monads on arbitrary categories (with appropriate structure), among which the finite powerset monad P_{fin} and the monad for exceptions T X = X +E (see below for both cases).

Remark. In general, studying the Kleisli category of a monad T (in the example above, the category of partial functions) helps understanding the way in which programs compose. On the other hand, the study of T -algebras may provide some insight as to which operations to include in a metalanguage for T -computations.

□

The above definition of lifting can be made more general. A class of admissible monos (Rosolini) in a category C is a class of monos containing all the identities and closed under composition and pullback along arbitrary morphisms (see definition 4.3.8). Let N be a class of admissible monos in C. A N -partial map [m, f] : A ⇀ B, is an equivalence class of pairs (m, f) with domain m : X ↣ A ∈ N and f : X → B. We drop “N ” when understood. Partial maps compose in the category pC of partial maps: [m, f]^{∘}[n, g] is [n^{∘}g^{−1}m, f^{∘}m^{−1}g]. A lifting monad ⟨( )_{⊥}, η, μ⟩ in C is given by an adjunction C ⇀ pC in which the inclusion C → pC sending f into [id , f] is left adjoint. Above we wrote ( )^{†} for the natural isomorphism given by such an adjunction. Note that there can be no two lifting monads ⟨( )_{⊥}, η, μ⟩ and ⟨( )_{⊥}, η, μ′⟩ with μ ≠ μ′, so that ⟨( )_{⊥}, η⟩ is good enough notation for lifting.

The transpose h^{†} of a partial map is sometimes said to classify h. More generally, a partial map classifier for an object A is an object Ã together with a mono A ↣ Ã such that, for any N -partial map [m, f] : X ⇀ A there exists a unique total morphism χ[m, f] : X → Ã forming the following pullback:

A X  f m  χ[m, f]  Ã

The monad ⟨( )_{⊥}, η⟩ provides partial map classifiers η_{A} : A ↣ A_{⊥} ∈ N for all objects A of C. Conversely, partial map classifiers for all objects give a lifting monad whose Kleisli category is pC.

If C has initial object ∅ and ?_{1} : ∅ → 1 is admissible, then ⊥_{A} : 1 → A_{⊥} is obtained by transposing [?_{1},?_{A}]. However, in order to validate interesting axioms involving such operations, additional assumptions may be necessary. For example, if ∅ is strict, that is if any morphism into ∅ is an isomorphism, then (let f ⊥_{A}) = ⊥_{B} for any f : A → B_{⊥}. This is easy to see by writing (let f) as μ_{B} ^{∘}f_{⊥} and using lemma 5.1.6 stating that any map h : A → B is the pullback of h_{⊥} along η_{B}.

Nondeterminism. The bijection † described above, which involves partial functions, can be extended to arbitrary relations: there is a natural bijection between relations r : A ↔ B and functions r†A → PB such that r†(a) = {b | r(a, b)}. The resulting adjunction yields the powerset monad:

T A =^{def} PA

in the category of sets, in which η =^{def} id † satisfies the mono requirement and μ(H) is ⋃_{X∈H} X. Again, there is a strength st f X =^{def} ⋃_{x∈X} f(x).

The obvious operation to include in a metalanguage for nondeterministic computations is or : ∀ X. T X, T X ⟶ T X, with [[or ]](X, Y) = X ⋃ Y.

Note that the finite powerset monad on Sets arises as the classifying monad for the theory of semilattices, that is as the monad whose algebras are semilattices. As for lifting, the operation or (the join of a semilattice) associated with this monad is suggested by an analysis of the category of algebras.

Exceptions. Many programming languages feature mechanisms for “giving up” computations when exceptional situations arise. If a recovery action is to be attempted, it should be possible to perform a case analysis of programs, branching on whether or not an exception has occurred. Hence, designating an object E to interpret the outcome of aborted computations, the object

T X =^{def} X + E

provides suitable denotations for programs of type X in a category with sums. In particular, this T is the object map of a strong monad ⟨T, val, let⟩ where val = inj_{1} and (let N M) = case (M, N, inj_{2}). This yields a multiplication μ(w) = case (w, id , inj_{2}) and a strength t(x, z) = case (z, λ y. inj_{1}(x, y), inj_{2}).

Let’s consider this monad from the point of view of the operations. Given an object E in a category C, the slice category E/C has morphisms with domain E in C as objects and commuting triangles f^{∘}a = b as morphisms f : a → b. The category C has sums of the form ( ) + E if and only if the forgetful codomain functor E/C → C has left adjoint. Indeed, E/C is the Eilenberg-Moore category of the above monad T. T -algebras X + E → X can be viewed as handlers E → X, while in the next chapter, where exceptions are studied in detail, we shall see that suitable operations to raise exceptions arise from suitable assumptions on the structure of E (see end of section 3.5).

Resumptions have long been used in denotational semantics to capture the phenomenon of interruption in program evaluation. Clearly enough, the meaning of the program running P_{1} and P_{2} in parallel cannot be described in terms of nondeterministic functions [[P_{1}]] and [[P_{2}]] since it must take into account interleaved executions of the two programs. Hence, it should be possible to single out the atomic steps of a computation and the interpretation of a program of type A should be an object producing a value of type A after a finite number of atomic steps. For example, reading “inj_{1}(v)” as “return v” and “inj_{2}(…)” as “make one step and (…),” the program inj_{2}(inj_{2}(inj_{1}(v))) returns v after two (rather boring) atomic steps. Such programs can be interpreted as elements of the object

T A =^{def} μX. A + X

in a category C, where μ(F), written μX.F (X), is a “fixed point” operator on endofunctors F : C → C, that is F μ(F) ≅ μ(F). Inductive types (see section 6.3) such as μ(F) are interpreted in categories C in which every (suitable) functor F has an initial algebra F μ(F) → μ(F). In that case, the above equation defines the object map of the strong monad of resumptions, where val = inj_{1}, let f (inj_{1}a) = f(a) and let f (inj_{2}z) = let f z.

Programs of the kind described above are not so interesting because nothing much happens during an atomic step. In section 7.2 we show how to apply the simple resumption mechanism described above to computationally more elaborate situations, such as when programs sharing the same memory run in parallel, and we present operations appropriate for describing the mathematics of resumptions.

Remark. Lambda calculi of the form L(Σ) lack the syntactic means to describe inductive types. Signatures Σ_{τ}, for example, are not defined to include higher order constructors of the form μ : (type → type ) → type .

Interactive input is similar to resumption in that evaluation may have to be interrupted to input a value. The strong monad for interactive input features:

T A =^{def} μX. A + X^{I}

where I is the type of the input values. Again, the unit η is inj_{1}, while μ(inj_{1}z) = z and μ(inj_{2}w) = inj_{2}(μ^{∘}w). For the strength, let f : A → B, st f (inj_{1}a) = inj_{1}(fa) and st f (inj_{2}z) = inj_{2}((st f)^{∘}z). From these data one obtains let f =^{def} μ^{∘}T f, that is: let f (inj_{1}a) = f(a) and let f (inj_{2}z) = inj_{2}((let f)^{∘}z).

Given the above monad, an obvious operation to include in the metalanguage is input : T I, to be interpreted as inj_{2}(inj_{1}). This operation can be used to input values on the fly: let I interpret the type of integers,

[[n + input ]] = let x ⇐ input in val (n + x) = inj_{2}(λ x : I. inj_{1}(n + x)).

Others. A detailed discussion of computationally relevant monads can be found in [Mog90a]. Here we present a few examples.

T A = A × M  complexity, for M a monoid, see [Gur91].
T A = (A × S)^{S}  side effects, discussed in chapter 5.
T A = μX. A + (O × X) interactive output, see [Mog90a].
T A = R^{(R^{A})}  continuations, ibid.
(T A)k = ∑_{n:N} A(F^{n}k) dynamic allocation, ibid.

The latter is defined in a functor category C^{K}, where the objects of K intuitively represent stages of memory allocation and F : K → K increments the memory with one new location. A natural transformation σ : id_{K} \underrightarrow{.} F is also required, where Aσ_{k}(x) : AF k represents x : Ak after a new allocation.

3 Application: exceptions

In this chapter, the computational metalanguage is used to study the semantics of a fragment of Standard ML, called TMLE (Tiny ML with Exceptions), including the exception handling mechanism. To our knowledge, no denotational description of ML exceptions has been given before.

The fragment that we consider is nontrivial because ML’s exceptions have the capability of passing parameters to exception handlers and this has interesting consequences both on the metatheory of TMLE and on its semantics. One consequence is that, although the language provides no syntactic facilities for declaring either recursive functions or recursive types, programs may still fail to terminate. In fact, we discovered that, just like when adding references to the simply typed lambda calculus, it is possible to write a fixed point combinator in TMLE for any functional type. This failure of normalization has been noticed before in [Lil95]. However, the result, which is yet unpublished, was rediscovered by us independently.

As mentioned in section 2.5, models of nontermination generally involve a lifting monad. Even before realizing that TMLE programs could loop, we were led to lift computational types because a recursive domain equation arises in the interpretation of the type of exceptions. In fact, on the one hand the type of exceptions must be included in all computational types, as programs may produce exceptions, while on the other it must include computational types, as exceptions can carry programs as parameters.

Modelling the language in the cartesian closed category of complete posets, there are two places in which one can look for solutions to recursive equations: one is the subcategory of objects with least element and strict maps, and the other is the category of partial maps. We prefer the second approach to the first because it allows us to adopt the categorical sums of the (total) category of cpos in the interpretation of computational types. The universal property of such sums allows exceptions to be captured by a case analysis of the outcome of a computation. The universality of sums is crucial in the soundness proof of section 3.5.

In section 3.1, we define the language TMLE and its operational semantics. Then, we give an axiomatic account of exceptions by presenting a theory ML_{T} (Σ) of the computational lambda calculus featuring exception constructors and operations of raise and handle (section 3.3). In section 3.5 we give an interpretation [[ ]]_{ML_{T} (Σ)} of this metalanguage in a cartesian closed category with appropriate structure and prove it sound. In section 3.4, TMLE is interpreted via a translation ([ ]) into ML_{T} (Σ), while the denotational semantics obtained by composing [[ ]]_{ML_{T} (Σ)} with ([ ]) is shown to be adequate with respect to the given operational semantics in section 3.7.

The proof of adequacy is based on the definition of a suitable family of logical relations [Mit90]. Because of the circularity in the type of exceptions, such a family cannot be defined by induction on the structure of types and a proof of its existence is required. We follow the trace of a similar proof given by A. Pitts in [Pit] for a fragment of ML with one recursive type. Our case, however, is more involved than Pitts’ because the notion of computation itself upon which interpretation is based (that is the monad T X = (X+E)_{⊥}) carries the seed of recursion (viz. the type E). A lesser difference with [Pit] is that we solve our recursive equations in a category of partial maps, rather than in one of strict maps.

The monadic setting in which adequacy is proven highlights the existence of two intertwined families of logical relations, one between semantic values and (strongly) canonical TMLE terms, and the other extending the first to computations and arbitrary expressions of the language. This seems to be a general pattern when proving computational adequacy with logical relations and it can be exploited to develop such proofs modularly. The idea is to make semantic constructors (section 6.2) work not only on monads T but also on the actions of T on relational structures (section 3.6).

3.1 Tiny ML with Exceptions

Like in ML, TMLE exceptions can carry values, which we call arguments. We assume a possibly infinite set E = {ϵ_{1}, ϵ_{2} …} of exception names and a function ζ from E to the types of TMLE, mapping each ϵ into the type of its argument. To give programs something to do to, besides raising and handling exceptions, we assume a type nat of natural numbers, a constant n for each natural number n and a binary function symbol Op to perform some arithmetical operation op. These are the formation rules for types and expressions of TMLE:

(nat) ⊢ nat type

(exc) ⊢ exc type
⊢ σ_{1} type ⊢ σ_{2} type
(arrow)  ⊢ σ_{1} → σ_{2} type

(var) x_{1} : σ_{1}, … x_{n} : σ_{n} ⊢ x_{i} : σ_{i}  1 ≤ i ≤ n

(n) ⊢ n : nat
Γ ⊢ e_{1} : nat Γ ⊢ e_{2} : nat
(Op)  Γ ⊢ Op(e_{1}, e_{2}) : nat
Γ ⊢ e : nat Γ ⊢ e_{1} : σ Γ ⊢ e_{2} : σ
(if)  Γ ⊢ if e = 0 then e_{1} else e_{2} : σ

Γ, x : σ ⊢ e : τ
(fn) Γ ⊢ fnx :σ ⇒ e : σ → τ

\begin{aligned}& Γ ⊢ e_{1} : σ → τ Γ ⊢ e_{2} : σ \\ (appl) & Γ ⊢ e_{1}e_{2} : τ \end{aligned}

\begin{aligned}& Γ ⊢ e : ζ(ϵ) \\ (ϵ) & Γ ⊢ ϵ(e) : exc \end{aligned}

Γ ⊢ e : exc
(raise) Γ ⊢ raise_{τ} e : τ

Γ ⊢ e_{1} : τ Γ, x : ζ(ϵ) ⊢ e_{2} : τ

(handle)  Γ ⊢ e_{1} handle ϵ(x) ⇒ e_{2} : τ

This is the intuitive meaning of the operations raise and handle: an exception named ϵ is raised by raise_{τ} ϵ(e), where the program e, of type ζ(ϵ), is meant to produce a value to be passed to a handler. The typing rule for raise in ML is

Γ ⊢ e ⇒ exc
(ML raise) Γ ⊢ raise e ⇒ τ

where the symbol “⇒” relates what in ML literature are called phrases and semantic objects. Since τ does not occur in the premise, this rule allows raised exceptions to have arbitrary type. Instead, we index the term constructor raise with the types of the language to avoid polymorphic type checking.

In e_{1} handle ϵ(x) ⇒ e_{2}, if e_{1} raises an exception ϵ(v), the handler e_{2} is executed with x bound to v; otherwise the value of e_{1} is returned. Exceptions propagate throughout their context until they are handled. The evaluation of exception raising is eager : for example, raise_{nat} ϵ(raise_{nat} ϵ(4)) handle ϵ(x) ⇒ x evaluates to 4 rather than (lazily) to raise_{nat} ϵ(4). On the other hand, conditional expressions must be lazy in each branch, since we want if 0 = 0 then b elseraise_{nat} ϵ(e) to raise no exception.

We distinguish between canonical and strongly canonical terms, the former ranged over by c and the latter by b:

b ::= n | ϵ(b) | fnx :σ ⇒ e
c ::= b | raise_{σ} b.

The idea is that, among the canonical terms, the strong ones represent values that programs compute while the rest is computational gear. In TMLE, the gear is just raised exceptions. However in ML, one has semantic judgements such as s, Γ ⊢ phrase ⇒ A, s′ includeing an environment Γ, states s and s′, and a semantic object A, which may be, for instance, the constant FAIL, which is neither a value nor an exception, but rather the operational means of expressing a matching failure.

The operational semantics of TMLE is a relation ⇝ between the closed terms and the closed canonical terms of the language. This relation is defined by the following rules:

(b) b ⇝ b
e_{1} ⇝ n_{1} e_{2} ⇝ n_{2}
(Op1)  Op(e_{1}, e_{2}) ⇝ m  m = n_{1} op n_{2}

                                e_{1} ⇝ raise_{nat} b

(Op2) Op(e_{1}, e_{2}) ⇝ raise_{nat} b

                           e_{1} ⇝ n e_{2} ⇝ raise_{nat} b

(Op3)  Op(e_{1}, e_{2}) ⇝ raise_{nat} b
e ⇝ 0 e_{1} ⇝ c
(if1) if e = 0 then e_{1} else e_{2} ⇝ c

e ⇝ n e_{2} ⇝ c
(if2) if e = 0 then e_{1} else e_{2} ⇝ c n ≠ 0

e ⇝ raise_{nat} b ⊢ e_{1}, e_{2} : σ

(if3) if e = 0 then e_{1} else e_{2} ⇝ raise_{σ} b

\begin{aligned}& e_{1} ⇝ fnx :σ ⇒ e e_{2} ⇝ b [b/x]e ⇝ c \\ (app1) & e_{1}e_{2} ⇝ c \end{aligned}

e_{1} ⇝ raise_{σ→τ} b
(app2) e_{1}e_{2} ⇝ raise_{τ} b

e_{1} ⇝ b′ e_{2} ⇝ raise_{σ} b ⊢ e_{1} : σ → τ

(app3)  e_{1}e_{2} ⇝ raise_{τ} b

\begin{aligned}& e ⇝ b \\ (ϵ1) & ϵ(e) ⇝ ϵ(b) \end{aligned}

e ⇝ raise_{ζ(ϵ)} b
(ϵ2) ϵ(e) ⇝ raise_{exc} b

e ⇝ b

(rs1) raise_{σ} e ⇝ raise_{σ} b

e ⇝ raise_{exc} b

(rs2) raise_{σ} e ⇝ raise_{σ} b

e_{1} ⇝ b
(hnd1) e_{1} handle ϵ(x) ⇒ e_{2} ⇝ b

e_{1} ⇝ raise_{σ} ϵ′(b)

(hnd2) e_{1} handle ϵ(x) ⇒ e_{2} ⇝ raise_{σ} ϵ′(b) ϵ′ ≠ ϵ

e_{1} ⇝ raise_{σ} ϵ(b) [b/x]e_{2} ⇝ c
(hnd3)  e_{1} handle ϵ(x) ⇒ e_{2} ⇝ c

Remark. In the operational semantics of TMLE, every judgement has at most one derivation.

Remark. Exploiting the call-by-value discipline in function application, one can define sequential composition (e_{1}; e_{2}) as (fnx :σ ⇒ e_{2})e_{1}, where e_{2} does not contain free occurrences of x.

3.2 Exceptions and termination

Let α be an arbitrary TMLE type. Given an exception constructor ϵ with parameter of type ζ(ϵ) = exc → α, it is possible to write a looping program ⊥_{α} of type α: let K : exc → α be the term fnx :exc ⇒ ((raise_{α} x) handle ϵ(y) ⇒ y(x)), then

⊥_{α} =^{def} Kϵ(K).

Using the same technique, it is possible to define a fixed point combinator Y_{α→β} for arrow types. Let ϵ have parameter of type ζ(ϵ) = exc → (α → β). Given any term p of type (α → β) → (α → β), let K_{p} of type exc → (α → β) be the term fnx :exc ⇒ ((raise_{α→β} x) handle ϵ(y) ⇒ p (y(x))); then,

Y_{α→β} =^{def} fnp :(α → β) → (α → β) ⇒ (fnz :α ⇒ K_{p} ϵ(K_{p}) z).

The reason why TMLE programs can loop is that handle treats exception constructors as such by providing a sort of case analysis on exc. Note that the same would happen even if exceptions were not first class objects. Indeed, we would still be able to write a fixed point combinator for arrow types if the language included no type exc at all and the construction and raising of exceptions were grouped together by a single term constructor:

Γ ⊢ e : ζ(ϵ)
(raise ϵ) Γ ⊢ raise_{τ} ϵ(e) : τ

Remark. In [dG95], a lambda calculus with an ML-like exception handling mechanism is presented, in which the evaluation of well typed expressions cannot give rise to uncaught exceptions. In this calculus, all terms strongly normalise.

Remark. In an unpublished manuscript [Lil95], Mark Lillibridge noticed that adding exceptions to the simply typed lambda calculus makes normalization fail. In that paper, the untyped lambda calculus is encoded in a typed language with exceptions to conclude that exceptions are strictly more powerful than callcc . The argument uses results obtained in [HL93] proving strong normalization for an extension of F^{ω} with callcc and abort . However, the results in [HL93] only concern particular evaluation strategies, and it is not clear to us how that generalizes to arbitrary strategies.

Remark It is possible to mimic the raise and handling of exceptions with callcc by using a global stack to store handlers. Here is the ML code:

val stack = ref(nil): (unit -> unit) list ref;
fun push = ...
fun pop = ...
fun raise () = pop stack ();
infix handle;
fun A handle B =

    callcc(fn k =>
      ((push stack (fn x => throw k (B())));
       (let val res = A() in ((pop stack);res) end)));

3.3 A theory of exceptions

In this section we present the equational theory of a metalanguage ML_{T} (Σ) for computations with exceptions, which we use to give the denotations of TMLE programs. As for TMLE, we assume a function ζ from the set E = {ϵ_{1}, ϵ_{2} …} of exception names into the types of the metalanguage, mapping each exception name into the type of its argument. The signature Σ includes constant type symbols \underline{𝔑} and \underline{E}, with arities α_{τ}(\underline{𝔑}) = α_{τ}(\underline{E}) = 0, and the following constant operation symbols:

\underline{n} : \underline{𝔑},
\underline{op} : \underline{𝔑}, \underline{𝔑} ⟶ \underline{𝔑},
cond : ∀X. \underline{𝔑}, X, X ⟶ X,
\underline{ϵ} : ζ(ϵ) ⟶ \underline{E},
raise : ∀X. \underline{E} ⟶ T X,
handle_{ϵ} : ∀X. T X, (ζ(ϵ) → T X) ⟶ T X.

The constant \underline{𝔑} represents the type of natural numbers. As in TMLE, we assume a constant \underline{n} for each natural number n and a binary function \underline{op} representing some arithmetical operation op . The conditional cond branches on the value zero of its first argument.

The constant \underline{E} is the type of exceptions, whose constructors are the operations \underline{ϵ}, one for each exception name. The operation raise_{τ} allows exceptions to be raised in any context C[ ] in which “ ” holds the place of a term of type τ. The portion of a program following the raise of an exception is disregarded. In TMLE, this could be phrased: (raise; N) = raise, while, of course, (N; raise) = raise should not hold.

The first argument to handle_{ϵ} is the body whose possible exceptions are to be handled, while the second is a handler. There is nothing to be handled when the body is a value. Moreover, only an exception whose name is ϵ should be captured by handle_{ϵ}.

Formalizing the above description of the theory of exceptions, the axioms of ML_{T} (Σ) are the following:

(op ) \underline{op}(\underline{n}, \underline{m}) = \underline{n op m},
(cond .0) cond (\underline{0}, M, N) = M,
(cond .n) cond (\underline{n}, M, N) = N  (n ≠ 0),
(exception .η) let x ⇐ raise (U) in N = raise (U),
(handle .η) handle_{ϵ}(val(M), H) = val(M),
(handle .β1) handle_{ϵ}(raise (\underline{ϵ} L), H) = HL,
(handle .β2) handle_{ϵ}(raise (\underline{ϵ}′ L), H) = raise (\underline{ϵ}′ L) (ϵ′ ≠ ϵ).

From the β and the ξ-rule for lambda application, the ξ-rules for \underline{ϵ}, raise and handle are derivable:

L_{1} = L_{2}
(exception .ξ) \underline{ϵ}(L_{1}) = \underline{ϵ}(L_{2})

and similarly for the others.

Remark. Some of the axioms above are not “robust,” meaning that they may need to be rewritten in order to describe the behaviour of exceptions in more complicated computational settings than TMLE. For example, handle .η is rather weak when exceptions are considered in combination with side effects. In that case, we would like it to hold not only of values, but also of nonexceptional computations which alter the state. In the next chapter we introduce a family of evaluation relations ⇐_{X}⊆ X × T X, where v ⇐ M is read “M evaluates to v.” These predicates can be used to write more general axioms such as:

v ⇐ M ⊃ (v ⇐ handle_{ϵ}(M, H)).

3.4 Interpretation of the language

TMLE is interpreted via a translation ([ ]) into the computational metalanguage ML_{T} (Σ) for exceptions, that is [[e]]_{T MLE} =^{def} [[([e])]]_{ML_{T} (Σ)}. Types are translated as follows:

([nat]) = \underline{𝔑},
([exc]) = \underline{E},
([σ_{1} → σ_{2}]) = ([σ_{1}]) → T ([σ_{2}]).

The translation of types extends to typing contexts in the obvious way. We assume that TMLE and ML_{T} (Σ) share the same set E of exception names and that ([ζ(ϵ)]) = ζ(ϵ). Terms are translated as follows:

([x]) = val (x),
([n]) = val (\underline{n}),
([Op(e_{1}, e_{2})]) = let x_{1} ⇐ ([e_{1}]) in let x_{2} ⇐ ([e_{2}]) in val (\underline{op} (x_{1}, x_{2})),
([if e = 0 then e_{1} else e_{2}]) = let x ⇐ ([e]) in cond (x, ([e_{1}]), ([e_{2}])),
([fnx :σ ⇒ e]) = val (λ x : ([σ]). ([e])),
([e_{1}e_{2}]) = let f ⇐ ([e_{1}]) in let x ⇐ ([e_{2}]) in fx,
([ϵ(e)]) = let x ⇐ ([e]) in val (\underline{ϵ} x),
([raise_{σ} e]) = let x ⇐ ([e]) in raise_{([σ])}(x),
([e_{1} handle ϵ(x) ⇒ e_{2}]) = handle_{ϵ}(([e_{1}]), λ x : ζ(ϵ). ([e_{2}])).

All strongly canonical terms b : σ translate into terms ([b]) = val (|b|), where |b| : ([σ]) is the translation of b as a value rather than as a computation. Terms that are mapped to let expressions are strict when it comes to raised exceptions. Therefore, if exceptions are to be handled, the subterms of handle must not be filtered by a let, but passed immediately to handle . Similarly, as required from the operational semantics, if then else is strict in its first argument but not in the others. Note that ([e_{1}e_{2}]) gives a call-by-value interpretation of function application, according with the operational semantics.

Proposition 3.4.1 (Static adequacy) TMLE terms of type τ are interpreted as terms of type T ([τ]), that is, Γ ⊢ e : τ is derivable in TMLE if and only if ([Γ]) ⊢ ([e]) : T ([τ]).

Proof. By induction on the derivation of the typing judgements. For example, a derivation of Γ ⊢ raise_{σ} e : σ in TMLE must contain a subderivation of Γ ⊢ e : exc. Then, using the inductive hypothesis,

([Γ]) ⊢ ([e]) : T \underline{E} {([Γ]), x : \underline{E} ⊢ x : \underline{E} \atop ([Γ]), x : \underline{E} ⊢ raise_{([σ])}(x) : T ([σ])}

([Γ]) ⊢ let x ⇐ ([e]) in raise_{([σ])}(x) : T ([σ])

([Γ]) ⊢ ([raise_{σ} e]) : T ([σ]).
□

In section 3.7, where we prove that the above interpretation is adequate with respect to the operational semantics, we shall use the following substitution lemma, whose proof is easy enough to be left out.

Lemma 3.4.2 ([[b/x]e]) ≡ [|b|/x]([e]).

3.5 Interpretation of the metalanguage

In this section we describe a categorical interpretation of ML_{T} (Σ) and prove its soundness. The proof only relies on an axiomatic description of models: first we define the interpretation in terms of an abstract categorical structure, and only after proving its soundness do we look for a concrete category that exhibits such a structure.

The metalanguage is interpreted in a cartesian closed category C with initial object ∅ and coproducts. The injections are written inj_{i}^{X_{1},X_{2}} : X_{i} → X_{1} +X_{2}, i ∈ {1, 2}, dropping the superscripts when types are understood. When using lambda notation, we write case (f, g, x) : Y for the morphism mediating f : X_{1} → Y and g : X_{2} → Y applied to x : X_{1} + X_{2}. As usual, we write case (f, g) for λ x. case (f, g, x). Other structure is also needed in C; we introduce it while spelling out the interpretation.

We assume a strong natural numbers object [LS86, I.9] 1 →^{z} 𝔑 →^{s} 𝔑 to interpret \underline{𝔑}. Note that, since we have sums, this is the same as assuming an initial algebra for the functor F X = 1 + X. Let a : 1 → A and f : A → A, we write [a, f] : 𝔑 → A for the unique morphism such that [a, f]^{∘}z = a and [a, f]^{∘}s = f^{∘}[a, f]. Arithmetical operations can be defined as usual. For example, writing n for the morphism s^{n}(z), we can interpret \underline{op} as plus (m, n) =^{def} [m, s]n.

Let K : \underline{𝔑}, L : \underline{𝔑}, M : σ and N : σ in a context Γ,

[[ \underline{n}]]_{∅} = s^{n}(z),
[[ \underline{op}(K, L)]]_{Γ} = op ([[K]]_{Γ}, [[L]]_{Γ}),
[[cond (L, M, N)]]_{Γ} = [ [[M]]_{Γ,x:1} , [[N]]_{Γ,x:σ}] [[L]]_{Γ}.

As for computational types, since they must accommodate nonterminating programs, we assume a lifting monad ⟨( )_{⊥}, val_{⊥}, let_{⊥}⟩ in the category C. Then, choosing an object E in C to interpret \underline{E}, we use the following strong monad to model computational types:

T X = (X + E)_{⊥},
val (v) = val_{⊥}(inj_{1}(v)),
let (f) = let_{⊥}(case (f , raise )),

where raise_{X} =^{def} val_{⊥}^{∘}inj_{2} : E → T X.

Remark. The above definition makes sense for any strong monad in the place of ( )_{⊥}. This is, in fact, a first example of monad constructor (see chapter 6), that is, an operation F that, given a monad T, returns a new monad (FT)X = T (X + E) to interpret T -computations with exceptions. In section 7.2, we prove in LEGO that, if T is a strong monad, so is F(T).

□

The interpretation of \underline{ϵ}, raise and handle_{ϵ} is defined in terms of two E-indexed families of morphisms ϵ : [[ζ(ϵ)]] → E and \overline{ϵ} : E → [[ζ(ϵ)]] + E satisfying the following equations:

\overline{ϵ}(ϵ d) = inj_{1}(d)  (3.1)
\overline{ϵ}(ϵ′ d) = inj_{2}(ϵ′ d) (ϵ′ ≠ ϵ).  (3.2)

Intuitively, \overline{ϵ} extracts the argument of any exception with name ϵ while it returns the others unaltered. Let U : \underline{E}, L : ζ(ϵ), M : T τ and H : ζ(ϵ) → T τ in a context Γ,

[[ϵ L]]_{Γ} = ϵ [[L]]_{Γ},
[[raise_{σ} U]]_{Γ} = raise_{[[σ]]}[[U]]_{Γ} = val_{⊥}(inj_{2}[[U]]_{Γ}),
[[handle_{ϵ}(M, H)]]_{Γ} = let_{⊥}(case (val , \overline{H})) [[M]]_{Γ},

where \overline{H} = λ x : E. case ([[H]]_{Γ} , raise , \overline{ϵ}x) : E → T [[τ]] is a function that leaves exceptions whose name is not ϵ unchanged while running the handler on the argument of the others.

Summarizing the structure described so far, a model of ML_{T} (Σ) consists of: universal structure: a cartesian closed category C with sums, initial object ∅ and a

strong natural numbers object 1 →^{z} 𝔑 →^{s} 𝔑;

additional structure: a lifting monad ( )_{⊥} on the category C, an object E and operations ϵ : [[ζ(ϵ)]] → E and \overline{ϵ} : E → [[ζ(ϵ)]] + E satisfying equations (3.1) and (3.2).

Theorem 3.5.1 (Soundness) ⊢ M = N ⊃ [[M]] = [[N]].

Proof. It is required to prove that the interpretation satisfies the axioms of section 3.3. We provide details only for the ones involving the operations on exceptions, since (op ), (cond .0) and (cond .n) follow from routine calculations. Let x : σ, N(x) : T τ, U : \underline{E}, L : ζ(ϵ), M : τ and H : ζ(ϵ) → T τ,

(exception .η) [[let x ⇐ raise (U) in N(x)]] = let [[N]] [[raise (U)]] =
let_{⊥}(case ([[N]] , raise )) val_{⊥}(inj_{2}[[U]]) =
case ([[N]] , raise , inj_{2}[[U]]) = raise [[U]] = [[raise U]];
(handle .η) [[handle_{ϵ}(val (M), H)]] = let_{⊥}(case (val , \overline{H})) val_{⊥}(inj_{1}[[M]]) =
case (val , \overline{H} , inj_{1}[[M]]) = val [[M]] = [[val (M)]];
(handle .β_{1}) [[handle_{ϵ}(raise (\underline{ϵ} L), H)]] = let_{⊥}(case (val , \overline{H})) val_{⊥}(inj_{2}(ϵ[[L]])) =
\overline{H}(ϵ[[L]]) = (λ x : E. case ([[H]] , raise , \overline{ϵ}x)) ϵ[[L]] =
case ([[H]] , raise , \overline{ϵ}(ϵ[[L]])) = case ([[H]] , raise , inj_{1}[[L]]) =
[[H]] [[L]] = [[HL]];
(handle .β_{2}) [[handle_{ϵ}(raise (\underline{ϵ}′ L), H)]] = (as above)… \overline{H}(ϵ′ [[L]]) =
(as above)… case ([[H]] , raise , \overline{ϵ}_{i}(ϵ′ [[L]])) =
case ([[H]] , raise , inj_{2}(ϵ′[[L]]) = raise (ϵ′ [[L]]) = [[raise (ϵ′ L)]].
□

In the proof of lemma 3.7.3 we shall see that adequate models of the metalanguage should also satisfy the following additional properties:

1. the pullback of 1 →^{z} 𝔑 ←^{s} 𝔑 is 1 ← ∅ → 𝔑 and s is a mono;

2. for all objects X in C, the pullback of X ⟶^{inj_{1}} X + E ⟵^{inj_{2}} E is X ← ∅ → E.

Proposition 3.5.2 In any nontrivial category satisfying the requirement (1) above, if n ≠ m, then s^{n}(z) ≠ s^{m}(z).

Proof. Suppose s^{n}(z) = s(s^{n+m}z). Since s is a mono, it must be z = s(s^{m}z). Therefore, since 1 ×_{𝔑} 𝔑 = ∅, there is a morphism 1 → ∅ mediating the pair 1 ⟵^{id} 1 ⟶^{s^{m}z} 𝔑. □

Proposition 3.5.3 Let Γ ⊢ M : τ and Γ ⊢ U : \underline{E}; in any nontrivial category satisfying the requirement (2) above, [[val(M)]]_{Γ}(d_{1}) ≠ [[raise_{τ}U]]_{Γ}(d_{2}) for all d_{1}, d_{2} : 1 → [[Γ]].

Proof. If val_{⊥}(inj_{1}[[M]](d_{1})) = [[val(M)]](d_{1}) = [[raise_{τ}U]](d_{2}) = val_{⊥}(inj_{2}[[U]](d_{2})), since val_{⊥} is a mono, inj_{1}[[M]](d_{1}) = inj_{2}[[U]](d_{2}). Hence there is a morphism 1 → ∅ mediating the pair [[M]](d_{1}) : 1 → [[τ]] and [[U]](d_{2}) : 1 → E. Therefore, the category is trivial. □

We find the above semantic structure in Cpo , the category of cpos (complete posets; no least element required) and continuous functions. This category has the universal structure required of models of ML_{T} (Σ). In particular, (X_{1}, ⊑_{1})+(X_{2}, ⊑_{2}) = (X_{1}⊎X_{2}, ⊑), where ⊎ is the operation of disjoint union and, for i, j ∈ {1, 2}, inj_{i}(x) ⊑ inj_{j}(y) if and only if i = j and x ⊑_{i} y. However we choose E, the injections inj_{1} and inj_{2} satisfy the additional condition (2). Cpo has a strong natural numbers object (ω, ⊑_{id}), where ⊑_{id} is the discrete ordering. The obvious z and s satisfy the additional condition (1).

Lifting is defined by adjoining a least element. This operation is the object map of a lifting monad defined by an adjunction Cpo ⇀ pCpo , as described in section 2.5. The category pCpo has cpos as objects and partial continuous functions as morphisms. The domain of such a function f : A ⇀ B is a Scott-open subcpo of A. We write “f(d) ↓” to mean that d is in the domain of f. If f(d) ↓ and f(d) = c we write “f(d) ↓ c.” The category pCpo is Cpo -enriched, with f ⊑ g : A ⇀ B if, for all d ∈ A, f(d) ↓ c_{1} implies g(d) ↓ c_{2} for some c_{2} such that c_{1} ⊑ c_{2}.

The information carried by an exception is its name ϵ and its argument of type ζ(ϵ). Since the handling of an exception requires a case analysis over the name, it makes sense to think of exceptions as elements of an E-indexed sum

E ≅ ∑_{ϵ∈E}[[ζ(ϵ)]].  (3.3)

This equation is in fact recursive: arguments of exceptions can be arbitrarily typed and, in particular, they can be programs raising exceptions, so that E may again pop out of any of the summands [[ζ(ϵ)]]. Following the approach in [Fio94b], we look for a solution to (3.3) in the category of partial maps (pCpo ). This category has only partial exponentials, that is objects of the form A → B_{⊥}. However, this is not a problem, since we assumed that ζ(ϵ) = ([ζ(ϵ)]) and hence all exponentials in (3.3) are of the form A → T B.

It is possible to solve recursive domain equations X ≅ F (X, X) in pCpo when the functor F : pCpo^{op} × pCpo → pCpo is locally continuous (the idea of using categories of partial maps for denotational semantics is originally from [Plo85a] and was recently developed in [Fio94b], to which we refer for details). Using this feature, we obtain the object E to interpret exceptions as the minimal invariant [Fre90] of a suitable functor defined below. As we shall see, the invariance of E yields a canonical family of operations ϵ and \overline{ϵ}, while minimality yields a universal property to be used in the adequacy proof of section 3.7.

Let F be the family of functors F_{σ} = pCpo^{op} × pCpo → pCpo , indexed by the types of TMLE, defined by simultaneous induction as follows:

F_{nat}(X, Y) = 𝔑,

F_{exc}(X, Y) = Y,
F_{σ→τ}(X, Y) = F_{σ}(Y, X) → (F_{τ}(X, Y) + Y)_{⊥},

where ( ) → ( )_{⊥} is partial exponentiation. All functors in F are locally continuous and, hence, so is F_{E}(X, Y) =^{def} ∑_{ϵ∈E} F_{ζ(ϵ)}(X, Y). Let E be the minimal invariant object of F_{E}. It is easy to verify that [[σ]]_{T MLE} = F_{σ}(E, E). Then,

E ≅ ∑_{ϵ∈E} F_{ζ(ϵ)}(E, E) = ∑_{ϵ∈E}[[ζ(ϵ)]]_{T MLE} = ∑_{ϵ∈E}[[ζ(ϵ)]]_{ML_{T} (Σ)}.

Let α : F_{E}(E, E) → E be the above isomorphism; we call ϵ : [[ζ(ϵ)]] → E the components of α, that is, α(ϵ, d) = ϵ(d). Moreover, since E contains only elements of the form ϵ(d), the equations (3.1) and (3.2) define \overline{ϵ} completely.

Remark. Unlike ML, TMLE has no facilities for declaring exceptions. Of course, the monad T X = (X + E)_{⊥} could not model dynamic creation of exceptions, as E would have to change dynamically in order to accomodate new exceptions. To capture such a situation, a “possible world” semantics can be adopted, like in [OT92] for modelling dynamic allocation.

3.6 Semantic approximation of TMLE programs

Composing the translation ([ ]) of section 3.4 with the interpretation of the metalanguage defined in section 3.5, we obtain an interpretation [[ ]]_{T MLE} of TMLE. To make sure that [[ ]]_{T MLE} agrees with the operational semantics (computational adequacy), one would like to show that, if a program denotes a natural number n, then it evaluates to n. Proving such a statement is not easy, since straight induction on the structure of the program fails in the case of function application. Hence, the inductive hypotheses must be strenthened and this leads to proof techniques involving logical relations (see section 2.4).

Here we show the existence of a family of logical relations ≤, which we call formal approximation (see below) between semantic objects and TMLE programs. This family is used in the next chapter to show that [[ ]]_{T MLE} is computationally adequate. We believe that ≤ is also interesting in its own right, as it provides an example of a logical relation involving computational types.

In [Plo91a], a family of relations ≤_{σ} between semantic values in [[σ]] and canonical terms of type σ is defined for a metalanguage with recursive types. Using such relations, one can write a statement 𝔐 ⪯_{σ} M implying that the program M terminates if the mathematical expression 𝔐 denotes. Then, computational adequacy is proven by showing that [[M]] ⪯_{σ} M. Sometimes the argument is complicated by the fact that ≤_{σ} cannot be defined by induction on σ, and hence a lengthy proof is required of the existence of such a relation. In the case of Plotkin’s metalanguage, the problem arises from recursive types; for TMLE, it arises from the recursive type of exceptions.

We call Exp_{σ} the set of all closed TMLE terms of type σ and Can_{σ} ⊆ Exp_{σ} the set of all strongly canonical terms. Following [Plo91a], we look for a type-indexed family ≤ of relations of the form ≤_{σ}⊆ [[σ]]_{T MLE} × Can_{σ} to provide an appropriate notion of semantic approximation of TMLE expressions. We require that the members of such a family satisfy the following conditions:

A1. for all b ∈ Can_{σ}, the set {d | d ≤_{σ} b} is closed under taking least upper bounds of countable chains;

A2. n ≤_{nat} n;

A3. ϵ(d) ≤_{exc} ϵ(b) if and only if d ≤_{ζ(ϵ)} b;

A4. f ≤_{σ→τ} (fnx :σ ⇒ e) if and only if f(d) ⪯_{τ} [b/x]e for all d and b such that d ≤_{σ} b,

where 𝔐 ⪯_{τ} e stands for the conjunction of the two statements:

B1. if 𝔐 = val (d), then e ⇝ b, for some b such that d ≤_{τ} b; B2. if 𝔐 = raise_{τ}(d) then e ⇝ raise_{τ} b, for some b such that d ≤_{exc} b.

Considering B1, the relation ⪯_{τ}⊆ T [[τ]] × Exp_{τ} can be viewed as extending ≤_{τ} over computations and programs.

We call the members of a family satisfying clauses A1-4 formal approximation relations. Considering the mutual recursion in A3 and A4, such a family cannot be defined by a simple induction on types. Moreover, let Rel be the complete lattice of type-indexed families of relations R_{σ} ⊆ [[σ]]_{T MLE} × Can_{σ} ordered by type-wise inclusion; the operation ϕ : Rel → Rel obtained by reading clauses A2-4 as a system of equations R_{σ} = ϕ_{σ}(R) is not monotone, as R occurs both positively and negatively in the right hand side of A4. Hence, ≤ cannot be obtained by applying standard techniques of fixed point construction to ϕ.

Note that this same problem arises when computations use a memory where values of arbitrary type can be stored. The following example generalizes the Tiny-ML example considered in [Pit91], where memory locations could only contain integers.

Example. Let ≤_{ρ} be the relation between semantic and syntactic states derived from a family ≤_{σ}, where ρ assigns to each memory location l the type ρ(l) of value stored in it. In the case of state computations, the statement M ⪯_{σ} e spells out as: if M ↓ d then, for all a, S, S′, s, if d(S) ↓ (a, S′) and S ≤_{ρ} s, then there exist c and s′ such that s, e ⇝ s′, c and a ≤_{σ} c and S′ ≤_{ρ} s′. Note that the definition of ≤_{σ} depends on ≤_{ρ} which may involve types more complicated than σ.

□

Following the approach proposed in [Pit93], we obtain a family of formal approximation relations from a suitably defined invariant relation on the recursive object E of exceptions. The argument follows the trace of the proof of adequacy given in [Pit] for a small fragment of ML with a single recursive datatype declaration. However, some definitions and results obtained in that paper must be rephrased to apply to our setting, as they refer to the category Cppo_{⊥} of cpos with least element and strict continuous functions.

Definition 3.6.1 ([Pit, 4.1]) A relational structure R on a category C is specified by the following data:

• for each object A of C, a set R(A) of ‘relations on A;’

• for each morphism f : A → B in C, a binary relation between elements R ∈ R(A) and elements S ∈ R(B), written f : R ⊂_{R} S (or just f : R ⊂ S). These binary relations are required to satisfy the following properties:

- id_{A} : R ⊂ R, for all R in R(A);

- if f and g are composable, f : R ⊂ S and g : S ⊂ T, then g^{∘}f : R ⊂ T.

If R is a relational structure on pCpo , a relation S ∈ R(B) is said to be admissible [Pit, 4.3] when, for all R ∈ R(A), the subset

[R, S] =^{def} {f | f : R ⊂ S}

of pCpo (A, B) contains the always undefined function and is closed under taking least upper bounds of countable chains (chain-complete).

Let F : pCpo^{op} ×pCpo → pCpo be a functor; an admissible action of F on a structure R on pCpo is a family of operations F_{A,B} : R(A) × R(B) → R(F (A, B)) such that

C1. if S ∈ R(B) is admissible, so is F_{A,B}(R, S), for any R ∈ R(A);

C2. if f : A_{2} ⇀ A_{1} is such that f : R_{2} ⊂ R_{1} and g : B_{1} ⇀ B_{2} is such that g : S_{1} ⊂ S_{2}, with S_{2} admissible, then F (f, g) : F_{A_{1},B_{1}}(R_{1}, S_{1}) ⊂ F_{A_{2},B_{2}}(R_{2}, S_{2}).

We usually drop the subscripts in F_{A,B}. Of course, a functor may have more than one admissible action on a relational structure, so it is actually by an abuse of notation that we call an admissible action by the name of its corresponding functor.

Let Can be the set {c : σ | c ∈ Can_{σ}}, that is, the set of all strongly canonical terms tagged with their types; below, we use the following relational structure R on pCpo :

• a relation on R(A) is a subset of A × Can ;

• f : R ⊂ S if and only if, for all (d, b : σ) ∈ R, f(d) ↓ d′ implies (d′, b : σ) ∈ S.

Usually, we drop the type tag. It is easy to see that a relation S in R is admissible if and only if, for all b, the set {d | (d, b) ∈ S} is chain-complete. Admissibility is used in the proof of theorem 3.6.2.

Let A be a cpo; we call R_{adm}(A) the set of all admissible relations in R(A). Clearly R_{adm}(A) is closed under taking arbitrary intersections and so it is a complete lattice ordered by inclusion.

The inverse image of a relation R ∈ R(A) along a partial function f : B ⇀ A is defined as f^{∗}R = {(d, b) | if f(d) ↓ d′, then (d′, b) ∈ R} ∈ R(B). Clearly, f : f^{∗}R ⊂ R and, if f : S ⊂ R, then id : S ⊂ f^{∗}R. The operation f^{∗} : R(A) → R(B) is monotone and it satisfies id _{A}^{∗} = id_{R(A)} and (f^{∘}g)^{∗} = g^{∗}^{∘}f^{∗}. Moreover, it is easy to verify that, since the domain of f is Scott-open, f^{∗} preserves admissibility.

Theorem 3.6.2 Let F : pCpo^{op} × pCpo → pCpo be a locally continuous functor with an admissible action on R and let α : F (D, D) ≅ D be its minimal invariant object. There exists an admissible relation Δ ∈ R(D) such that

- α : F (Δ, Δ) ⊂ Δ and

- α^{−1} : Δ ⊂ F (Δ, Δ).

An admissible relation Δ satisfying these conditions is called F -invariant. In [Pit] it is shown that an invariant relation for a locally continuous F : Cppo_{⊥}^{op}×Cppo_{⊥} → Cppo_{⊥}, if it exists, is unique; the proof also adapts to pCpo .

To prove theorem 3.6.2, we need the following:

Lemma 3.6.3 Let F, D and α be as above; a relation Δ ∈ R(D) is F -invariant if and only if Δ = (α^{−1})^{∗}F (Δ, Δ).

Proof. (If) Using f : f^{∗}R ⊂ R,

- α : F (Δ, Δ) = (α^{−1}^{∘}α)^{∗}F (Δ, Δ) = α^{∗}((α^{−1})^{∗}F (Δ, Δ)) = α^{∗}Δ ⊂ Δ and
- α^{−1} : Δ = (α^{−1})^{∗}F (Δ, Δ) ⊂ F (Δ, Δ).

(Only if) Noticing that R ⊆ S if and only if id : R ⊂ S,

- composing α : F (Δ, Δ) ⊂ Δ and α^{−1} : (α^{−1})^{∗}F (Δ, Δ) ⊂ F (Δ, Δ) we obtain

id = α^{∘}α^{−1} : (α^{−1})^{∗}F (Δ, Δ) ⊂ Δ, and

- since f : R ⊂ S implies id : R ⊂ f^{∗}S,

α^{−1} : Δ ⊂ F (Δ, Δ) implies id : Δ ⊂ (α^{−1})^{∗}F (Δ, Δ).

□

Using the lemma, we prove theorem 3.6.2 by showing that there exists a fixed point of the operation ϕ : R_{adm}(D) → R_{adm}(D) defined as

ϕ(R) = (α^{−1})^{∗}F (R, R).

We follow the trace of [Pit, section 4], to which we refer for more detail. First, we separate and negative occurrences of the variable R in ϕ(R) and obtain the functor ψ : R_{adm}(D)^{op} × R_{adm}(D) → R_{adm}(D), where ψ(R, S) = (α^{−1})^{∗}F (R, S), from which ϕ(R) can be recovered as ψ(R, R). “Dualising” ψ, one obtains a monotone function

ψ^{†} : R_{adm}(D)^{op} × R_{adm}(D) → R_{adm}(D)^{op} × R_{adm}(D), i.e. ψ^{†}(R, S) =^{def} (ψ(S, R), ψ(R, S)).

Then, the Knaster-Tarski fixed point theorem yields a pair of admissible relations (Δ^{−}, Δ^{+}) = ψ^{†}(Δ^{−}, Δ^{+}) = (ψ(Δ^{+}, Δ^{−}), ψ(Δ^{−}, Δ^{+})). From the universal property of this object it follows easily that Δ^{+} ⊆ Δ^{−}.

The opposite inclusion also holds. In fact: Let δ : pCpo (D, D) → pCpo (D, D) be defined as δ(f) = α^{∘}F (f, f)^{∘}α^{−1}. Since F is a locally continuous functor, δ is continuous. Since Δ^{−} = ψ(Δ^{+}, Δ^{−}), we have id : Δ^{−} ⊂ (α^{−1})^{∗}F (Δ^{+}, Δ^{−}). Composing this inclusion with α^{−1} : (α^{−1})^{∗}F (Δ^{+}, Δ^{−}) ⊂ F (Δ^{+}, Δ^{−}), we obtain α^{−1} : Δ^{−} ⊂ F (Δ^{+}, Δ^{−}). Similarly, one obtains α : F (Δ^{−}, Δ^{+}) ⊂ Δ^{+}. Given f : Δ^{−} ⊂ Δ^{+}, the admissible action of F yields F (f, f) : F (Δ^{+}, Δ^{−}) ⊂ F (Δ^{−}, Δ^{+}), which, composed with the above inclusions, yields δ(f) = α^{∘}F (f, f)^{∘}α^{−1} : Δ^{−} ⊂ Δ^{+}. Hence, δ restricts to [Δ^{−}, Δ^{+}] → [Δ^{−}, Δ^{+}]. Since [Δ^{−}, Δ^{+}] contains the always undefined function and it is chain-complete (because Δ^{+} is admissible), the least fixed point of δ is in [Δ^{−}, Δ^{+}]. Since, by the universal property of D, this fixed point is the identity, id : Δ^{−} ⊂ Δ^{+} yields Δ^{−} ⊆ Δ^{+}. Therefore, Δ^{−} = Δ^{+} is a fixed point of ϕ as required. This concludes the proof of theorem 3.6.2.

□

Let F be the family of functors defined in section 3.5; a type-indexed family F̃, whose elements F̃_{σ} are families of operations (F̃_{σ})_{A,B} : R(A) × R(B) → R(F_{σ}(A, B)) is defined as follows:

F̃_{nat}(R, S) = {(n, n : nat) | n ∈ 𝔑},
F̃_{exc}(R, S) = {(d, b : exc) | (d, b : exc) ∈ S},
F̃_{σ→τ}(R, S) = {(f, fnx :σ ⇒ e : σ → τ) | for all (d, b : σ) ∈ F̃_{σ}(S, R),
- if f(d) ↓ val (d′) then [b/x]e ⇝ b′ and (d′, b′: τ) ∈ F̃_{τ}(R, S);
- if f(d) ↓ raise_{τ}(d′) then [b/x]e ⇝ raise_{τ}(b′) and (d′, b′: exc) ∈ S}.

Proposition 3.6.4 For all TMLE types σ, F̃_{σ} is an admissible action of F_{σ} on R.

Proof. We prove condition C1 by induction on the structure of σ, simultaneously for all members of F̃. The cases where σ is nat or exc are trivial. As for σ → τ, let S ∈ R(B) be admissible, let R be any relation in R(A) and let ⟨f_{i}⟩ be a countable chain of elements of F_{σ→τ}(A, B) such that, for all i ∈ ω, (f_{i}, fnx :σ ⇒ e) ∈ F̃_{σ→τ}(R, S); we show that (f_{ω}, fnx :σ ⇒ e) ∈ F̃_{σ→τ}(R, S), where f_{ω} = ⊔⟨f_{i}⟩. Let (d, b) ∈ F̃_{σ}(S, R). If f_{ω}(d) ↓, there must exist an n such that f_{m}(d) ↓ for all m ≥ n and f_{ω}(d) = ⊔⟨f_{i+n}(d)⟩. If f_{ω}(d) ↓ val (d′), then, it must be f_{m}(d) ↓ val (d_{m}), and hence [b/x]e ⇝ b′ for some b′ such that (d_{m}, b′) ∈ F̃_{τ}(R, S) for all m ≥ n. Since d′ = ⊔⟨d_{i+n}⟩, applying the inductive hypothesis to F̃_{τ}, it must be (d′, b′) ∈ F̃_{τ}(R, S) as required. A similar argument yields the required property when f_{ω}(d) ↓ raise_{τ}(d′) and this concludes the proof of condition C1. Note that the determinacy of evaluation in TMLE is used in the above argument (e.g. by assuming that there exist one b′ which works for all m ≥ n). As expected, this fails in the case of unbounded nondeterminism.

For C2, let R_{1} ∈ R(A_{1}), R_{2} ∈ R(A_{2}), S_{1} ∈ R(B_{1}) and S_{2} ∈ R(B_{2}); let f : A_{2} ⇀ A_{1} be a morphism such that f : R_{2} ⊂ R_{1} and let g : B_{1} ⇀ B_{2} be one such that g : S_{1} ⊂ S_{2}; we show that F_{σ}(f, g) : (F̃_{σ})_{A_{1},B_{1}}(R_{1}, S_{1}) ⊂ (F̃_{σ})_{A_{2},B_{2}}(R_{2}, S_{2}). Again, the proof is by induction on the structure of σ, where the cases σ = nat and σ = exc are trivial.

We show F_{σ→τ}(f, g) : F̃_{σ→τ}(R_{1}, S_{1}) ⊂ F̃_{σ→τ}(R_{2}, S_{2}). Let h ∈ F_{σ→τ}(A_{1}, B_{1}), that is, h : F_{σ}(B_{1}, A_{1}) ⇀ (F_{τ}(A_{1}, B_{1}) + B_{1}), we are required to prove that, if (h, fnx :σ ⇒ e) is in F̃_{σ→τ}(R_{1}, S_{1}) and F_{σ→τ}(f, g)(h) ↓ k, then (k, fnx :σ ⇒ e) is in F̃_{σ→τ}(R_{2}, S_{2}). Note that k = F_{σ→τ}(f, g)(h) = (F_{τ}(f, g) + g)^{∘}h^{∘}F_{σ}(g, f).

Let (d, b) ∈ F̃_{σ}(S_{2}, R_{2}). Assume that k(d) ↓ val (d_{1}). There must be a d_{2} such that h(F_{σ}(g, f)(d)) ↓ val (d_{2}) and F_{τ}(f, g)(d_{2}) ↓ d_{1}. Since h(F_{σ}(g, f)(d)) ↓ val (d_{2}), it must be F_{σ}(g, f)(d) ↓ d_{3}. Then, by the inductive hypothesis on F_{σ}(g, f), (d_{3}, b) ∈ F̃_{σ}(S_{1}, R_{1}) and hence, from the assumption that (h, fnx :σ ⇒ e) ∈ F̃_{σ→τ}(R_{1}, S_{1}), it follows that there exists a b′ such that [b/x]e ⇝ b′ and (d_{2}, b′) ∈ F̃_{τ}(R_{1}, S_{1}). Using the inductive hypothesis on F_{τ}(g, f), we get (d_{1}, b′) ∈ F̃_{τ}(R_{2}, S_{2}). So, we have shown that, if k(d) ↓ val (d_{1}), then [b/x]e ⇝ b′ and (d_{1}, b′) ∈ F̃_{τ}(R_{2}, S_{2}).

On the other hand, if k(d) ↓ raise_{τ}(d_{1}), it must be h(F_{σ}(g, f)(d)) ↓ raise (d_{2}) for some d_{2} such that g(d_{2}) ↓ d_{1}. Following the same reasoning as above, we obtain F_{σ}(g, f)(d) ↓ d_{3} for some d_{3} such that (d_{3}, b) ∈ F̃_{σ}(S_{1}, R_{1}). From the assumption on h, there must exist a b′ such that [b/x]e ⇝ raise_{τ}(b′) and (d_{2}, b′) ∈ S_{1}. Since g : S_{1} ⊂ S_{2}, we obtain (d_{1}, b′) ∈ S_{2} as required. So, we have shown that (k, fnx :σ ⇒ e) is in F̃_{σ→τ}(R_{2}, S_{2}), and hence F_{σ→τ}(f, g) : F̃_{σ→τ}(R_{1}, S_{1}) ⊂ F̃_{σ→τ}(R_{2}, S_{2}) as required. □

In view of the above proposition, we shall remove the tilde from F̃. Note that condition C2 is satisfied by the members of F without the admissibility condition on S_{2}.

Theorem 3.6.5 There exists a type-indexed family of relations ≤_{σ}⊆ [[σ]]_{T MLE} × Can_{σ} satisfying the clauses A1-4.

Proof. The family of operations (F_{E})_{A,B} : R(A) × R(B) → R(F_{E}(A, B)) defined as F_{E}(R, S) = {((ϵ, d), ϵ(b) : exc) | (d, b : ζ(ϵ)) ∈ F_{ζ(ϵ)}(R, S)} is an admissible action on R of the functor F_{E} defined in section 3.5. This can be shown with routine calculations using proposition 3.6.4. Let Δ ∈ R(E) be an invariant relation of F_{E}, which exists by theorem 3.6.2. Note that, since α^{−1}(ϵ(d)) = (ϵ, d), the inclusion α^{−1} : Δ ⊂ F_{E}(Δ, Δ) implies that any pair in Δ is of the form (ϵ(d), ϵ(b) : exc), and hence Δ = F_{exc}(Δ, Δ). We show that the relations ≤_{σ}=^{def} F_{σ}(Δ, Δ) form a family of approximation relations.

First, note that, for all σ, F_{σ}(Δ, Δ) ⊆ [[σ]]_{T MLE} × Can_{σ}. Moreover, since Δ is admissible, so is F_{σ}(Δ, Δ) and hence clause A1 is satisfied. Clauses A2 and A4 are also satisfied, trivially. As for A3, we have to show that (ϵ(d), ϵ(b) : exc) ∈ Δ if and only if (d, b : ζ(ϵ)) ∈ F_{ζ(ϵ)}(Δ, Δ). Since α^{−1} : Δ ⊂ F_{E}(Δ, Δ), if (ϵ(d), ϵ(b) : exc) ∈ Δ, then ((ϵ, d), ϵ(b) : exc) ∈ F_{E}(Δ, Δ) and hence (d, b : ζ(ϵ)) ∈ F_{ζ(ϵ)}(Δ, Δ). Conversely, if (d, b : ζ(ϵ)) ∈ F_{ζ(ϵ)}(Δ, Δ), then ((ϵ, d), ϵ(b) : exc) ∈ F_{E}(Δ, Δ) and (ϵ(d), ϵ(b) : exc) ∈ Δ follows from α : F_{E}(Δ, Δ) ⊂ Δ. □

3.7 Computational adequacy

One of the criteria traditionally considered in the literature to establish how well denotational semantics captures the observable behaviour of programs is computational adequacy. Adequacy is concerned with the data produced by programs. For example, it requires that, if v is a canonical term of ground type, [[MN]] = [[v]] if and only if MN ⇝ v. However, it does not say how [[M]] should behave when applied to possible elements of its domain which are not denoted by any N in the language: adequate models may fail to equate the denotations of two terms which agree on all operational observations. In [Blo88] and [Mey88], a denotational semantics is said to be computationally adequate with respect to a set O of observations when, for all closed terms M and M′ of ground type, [[M]] = [[M′]] if and only if M ≅_{O} M′, that is if and only if M and M′ agree on all observations in O.

Here we use operational semantics to observe TMLE programs. Therefore, since we interpret the programming language via a translation into the metalanguage, it makes sense to state computational adequacy as the requirement that the theory of the metalanguage and the operational semantics agree: let e be a closed TMLE program of type nat,

⊢ ([e]) = ([n]) if and only if e ⇝ n.

Remark. A stronger version of the if direction of this statement holds, as shown by theorem 3.7.1, in which no restriction is put on the type of e. However, the only if direction does not apply to arrow types or exceptions. Since the latter may include parameters of arbitrary type, equations such as ([ϵ(fnx :σ ⇒ x)]) = ([ϵ(fnx :σ ⇒ (fnx :σ ⇒ x)x)]) are clearly derivable in ML_{T} (Σ) but neither of the two TMLE terms involved evaluates to the other.

Remark. If the programming language allowed nondeterministic computations, the above statement of adequacy would not do: equality must be replaced by a membership predicate, relating programs with the values they may possibly produce. Note that membership is an example of evaluation relation ⇐_{X}⊆ X × T X, which we met already at the end of section 3.3. Using such predicates, adequacy can be rephrased as follows:

⊢ \underline{n} ⇐ ([e]) if and only if e ⇝ n.

Theorem 3.7.1 (Adequacy: if) Let e and c be closed TMLE programs, with c canonical; if e ⇝ c, then ⊢ ([e]) = ([c]).

Proof. The proof is a rather lengthy induction on the derivations of operational judgements. As an example we consider derivations of e_{1} handle ϵ(x) ⇒ e_{2} ⇝ c from (hnd3).

It must be that e_{1} ⇝ raise_{σ} ϵ(b) and [b/x]e_{2} ⇝ c with shorter derivations and hence, by inductive hypothesis, ([e_{1}]) = ([raise_{σ} ϵ(b)]) and ([[b/x]e_{2}]) = ([c]) are derivable. Then, omitting type indices:

([e_{1}]) = ([raise ϵ(b)])
([e_{1}]) = let x ⇐ val (\underline{ϵ}|b|) in raise (x)
([e_{1}]) = raise (\underline{ϵ}|b|)

handle_{ϵ}(([e_{1}]), λ x. ([e_{2}])) = handle_{ϵ}(raise (\underline{ϵ}|b|), λ x. ([e_{2}]))

handle_{ϵ}(([e_{1}]), λ x. ([e_{2}])) = (λ x. ([e_{2}]))|b|

([[b/x]e_{2}]) = ([c]) [|b|/x]([e_{2}]) = ([c])
handle_{ϵ}(([e_{1}]), λ x. ([e_{2}])) = ([c])
([e_{1} handle ϵ(x) ⇒ e_{2}]) = ([c])
□

An immediate consequence of the above and theorem 3.5.1 is the following:

Corollary 3.7.2 Let e and c be as above; if e ⇝ c, then ⊢ [[e]]_{T MLE} = [[c]]_{T MLE}.

In order to prove the “only if” direction of the adequacy theorem, we use the fact that all TMLE programs are semantically aproximated by their interpretation. This is established by the following lemma, where ⪯ and ≤ are the families of approximation relations described in the previous section.

Lemma 3.7.3 Let Γ ⊢ e : σ be a TMLE program, where Γ = (x_{1} : σ_{1}, … x_{n} : σ_{n}), and let d_{i} ≤_{σ_{i}} b_{i}, for 1 ≤ i ≤ n; then, [[([e])]]_{Γ}(d_{1}…. , d_{n}) ⪯_{σ} [b_{i}/x_{i}]e.

Proof. We write [[e]](\overline{d}) for [[([e])]]_{Γ}(d_{1}, … d_{n}) and [ \overline{b}]e for [b_{1}/x_{1}] … [b_{n}/x_{n}]e; for such \overline{d} and \overline{b}, we shall understand that d_{i} ≤_{σ_{i}} b_{i}, for 1 ≤ i ≤ n. The proof is by induction in the derivation of Γ ⊢ e : σ. The cases where the last rule applied is (var) or (n) are trivial.

(Op). [[Op(e_{1}, e_{2})]](\overline{d}) = let (λ x : 𝔑. let (λ y : 𝔑. val (op (x, y))) [[e_{2}]](\overline{d})) [[e_{1}]](\overline{d}); if this expression denotes val (m), then [[e_{1}]](\overline{d}) cannot be ⊥ since (let f) is strict, for any f, and val (m) = val_{⊥}(inj_{1} m) is different from ⊥. Similarly, [[e_{1}]](\overline{d}) cannot be raise (z). In fact, from

let (…) raise (z) =

let_{⊥}(case ((…), raise )) val_{⊥}(inj_{2} z) = case ((…), raise , inj_{2}(z)) = raise (z)

it would follow val_{⊥}(inj_{1} m) = val_{⊥}(inj_{2} z), which cannot be, since inj_{1}(m) ≠ inj_{2}(z) and val_{⊥} is injective. Therefore, [[e_{1}]](\overline{d}) must be val (n_{1}), for some n_{1}, and hence [[Op(e_{1}, e_{2})]](\overline{d}) = let (λ y : 𝔑. val (op (n_{1}, y))) [[e_{2}]](\overline{d}). By inductive hypothesis, we can assume [ \overline{b}]e_{1} ⇝ b_{1}, for some b_{1} such that n_{1} ≤_{nat} b_{1}, which means that b_{1} ≡ n_{1}. By a similar argument, we obtain [ \overline{b}]e_{2} ⇝ n_{2} and m = op (n_{1}, n_{2}). Then, from (Op1), [ \overline{b}]Op(e_{1}, e_{2}) ⇝ m.

Alternatively, assume [[Op(e_{1}, e_{2})]](\overline{d}) is raise (d). As [[e_{1}]](\overline{d}) cannot be ⊥, it must either be val (n) or raise (z). In the first case, we can assume [ \overline{b}]e_{1} ⇝ n. Moreover, it is easy to see that [[e_{2}]](\overline{d}) can be neither a value nor ⊥. So we assume [[e_{2}]](\overline{d}) = raise (w). Then,

raise (d) = let (λ x : 𝔑. let (λ y : 𝔑. val (op (x, y))) raise (w)) val (n) =
let (λ y : 𝔑. val (op (n, y)))raise (w) =
let_{⊥}(case (λ y : 𝔑. val (op (n, y)) , raise ))val_{⊥}(inj_{2} w)
case (λ y : 𝔑. val (op (n, y)) , raise , inj_{2}(w)) = raise (w)

forces w = d. The inductive hypothesis on [[e_{2}]](\overline{d}) yields [ \overline{b}]e_{2} ⇝ raise_{nat}b for some b such that d ≤_{exc} b. Then, using (Op3), we obtain [ \overline{b}]Op(e_{1}, e_{2}) ⇝ raise_{nat}b as required. A similar argument yields the result in the case of [[e_{1}]](\overline{d}) = raise (z).

(if). [[if e then e_{1} else e_{2}]](\overline{d}) = let [λ x : 1. [[e_{1}]](\overline{d}) , λ x : σ. [[e_{2}]](\overline{d})] [[e]](\overline{d}); assume this expression denotes val (d). Since it must be [[e]](\overline{d}) = val (n), we can assume [ \overline{b}]e ⇝ n. If n = 0, from the definition of [ , ], we obtain [[if e then e_{1} else e_{2}]](\overline{d}) = [[e_{1}]](\overline{d}).

Then, assuming [ \overline{b}]e_{1} ⇝ b for a b such that d ≤_{σ} b, the result follows from (if1). Similarly, the result follows from (if2) when n ≠ 0. The case where [[if e then e_{1} else e_{2}]](\overline{d}) is raise (d) follows the same pattern as for (Op).

(fn). Since [[fnx :σ ⇒ e]](\overline{d}) = val (λ x : [[σ]]. [[e]](\overline{d})), we are required to prove that λ x : [[σ]]. [[e]](\overline{d}) ≤_{σ→τ} fnx :σ ⇒ [ \overline{b}]e. This amounts to showing that, for d and b such that d ≤_{σ} b, [[e]](\overline{d}, d) ⪯_{τ} [ \overline{b}, b]e, which is immediate by inductive hypothesis.

(appl). [[e_{1}e_{2}]](\overline{d}) = let (λ f : [[σ]] → T [[τ]]. (let f [[e_{2}]](\overline{d}))) [[e_{1}]](\overline{d}). Assume this expression denotes val (d). As above, [[e_{1}]](\overline{d}) must be val (f), for some f, and so we have [[e_{1}e_{2}]](\overline{d}) = let f [[e_{2}]](\overline{d}). By the inductive hypothesis on e_{1}, [ \overline{b}]e_{1} ⇝ fnx :σ ⇒ e, with f ≤_{σ→τ} fnx :σ ⇒ e. By a similar argument, [[e_{2}]](\overline{d}) = val (d_{1}), [[e_{1}e_{2}]](\overline{d}) = f(d_{1}), [ \overline{b}]e_{2} ⇝ b_{1} and d_{1} ≤_{σ} b_{1}. Then, from the assumptions, val (d) = f(d_{1}) ⪯_{τ} [b_{1}/x]e ⇝ b_{2} and d ≤_{τ} b_{2}. Applying (app1), we obtain [ \overline{b}](e_{1}e_{2}) ⇝ b_{2} as required.

Alternatively, if [[e_{1}e_{2}]](\overline{d}) = raise (d), [[e_{1}]](\overline{d}) must be either val (f) or raise (z). In the first case, we can assume [ \overline{b}]e_{1} ⇝ fnx :σ ⇒ e and f ≤_{σ→τ} fnx :σ ⇒ e. From let f [[e_{2}]](\overline{d}) = raise (d), [[e_{2}]](\overline{d}) can be either val (d_{1}) or raise (z). In the first case, we can assume [ \overline{b}]e_{2} ⇝ b_{1}, for some b_{1} such that d_{1} ≤_{σ} b_{1}. From the assumptions, we obtain raise (d) = f(d_{1}) ⪯_{τ} [b_{1}]e and hence [b_{1}]e ⇝ raise_{τ} b for some b such that d ≤_{exc} b. Then, from (app1), [ \overline{b}](e_{1}, e_{2}) ⇝ raise_{τ} b as required. The cases where e_{1} or e_{2} raise exceptions follow the same routine.

(ϵ). [[ϵ(e)]](\overline{d}) = let (λ x : [[ζ(ϵ)]]. val (ϵ(x)))[[e]](\overline{d}). Assume this expression denotes val (d). It cannot be that [[e]](\overline{d}) = raise (d_{1}), because this would imply the identity val (d) = let_{⊥}(case (λ x : [[ζ(ϵ)]]. val (ϵ(x)) , raise )) val_{⊥}(inj_{2} d_{1}) = raise (d_{1}). Hence, it must be [[e]](\overline{d}) = val (d_{1}) and we can assume [ \overline{b}]e ⇝ b, for some b such that d_{1} ≤_{ζ(ϵ)} b. From (ϵ1), [ \overline{b}]ϵ(e) ⇝ ϵ(b). From val (d) = let (λ x : [[ζ(ϵ)]]. val (ϵ(x))) val (d_{1}) = val (ϵ(d_{1})), we have d = ϵ(d_{1}) ≤_{exc} ϵ(b) as required.

Otherwise, if [[ϵ(e)]](\overline{d}) = raise (d), it is easy to verify that there must be a d_{1} such that [[e]](\overline{d}) = raise (d_{1}) and therefore we can assume [ \overline{b}]e ⇝ raise b, for some b such that d_{1} ≤_{exc} b. Hence, applying the rule (ϵ2), we obtain [ \overline{b}]ϵ(e) ⇝ raise_{exc} b. Moreover, from raise (d) = let (λ x : [[ζ(ϵ)]]. val (ϵ(x))) raise (d_{1}) = raise (d_{1}), it is d = d_{1} ≤_{exc} b as required.

(raise). The expression [[raise_{σ}e]](\overline{d}) = (let raise ) [[e]](\overline{d}) cannot denote a value. Assume it denotes raise (d). Since [[e]](\overline{d}) cannot be ⊥, it must be either val (d_{1}) or raise (d_{1}). In the first case, we can assume [ \overline{b}]e ⇝ b, for some b such that d_{1} ≤_{exc} b. Moreover, from raise (d) = (let raise )(val d_{1}) = raise (d_{1}), it follows that d = d_{1}. Then, by (rs1), [ \overline{b}]raise_{σ}e ⇝ raise_{σ}b as required.

Otherwise, if [[e]](\overline{d}) = raise (d_{1}), we can assume [ \overline{b}]e ⇝ raise_{exc} b, for some b such that d_{1} ≤_{exc} b, and hence, by (rs2), [ \overline{b}]raise_{σ} e ⇝ raise_{σ} b. Moreover, from raise (d) = (let raise ) (raise d_{1}) = let_{⊥}(case (raise , raise )) val_{⊥}(inj_{2} d_{1}) = raise (d_{1}), it follows that d = d_{1} and hence d ≤_{exc} b as required.

(handle). [[e_{1} handle ϵ(x) ⇒ e_{2}]](\overline{d}) = let_{⊥}(case (val , \overline{e}_{2})) [[e_{1}]](\overline{d}), where \overline{e}_{2} stands for λ x : E. case (λ x : [[ζ(ϵ)]]. [[e_{2}]](\overline{d}) , raise , \overline{ϵ} x). Assume this expression denotes val (d); then, [[e_{1}]](\overline{d}) denotes either val (d_{1}) or raise (d_{1}). In the first case, we can assume that [ \overline{b}]e_{1} ⇝ b, for a b such that d_{1} ≤_{σ} b. Then, by (hnd1), [ \overline{b}](e_{1} handle ϵ(x) ⇒ e_{2}) ⇝ b and, from val (d) = let_{⊥}(case (val , \overline{e}_{2})) val (d_{1}) = val (d_{1}), we have d = d_{1} ≤_{σ} b as required.

If [[e_{1}]](\overline{d}) = raise (d_{1}), we can assume [ \overline{b}]e_{1} ⇝ raise_{σ} b_{1} and d_{1} ≤_{exc} b_{1}. Moreover, val (d) = let_{⊥}(case (val , \overline{e}_{2})) raise (d_{1}) = \overline{e}_{2}(d_{1}) = case (λ x : [[ζ(ϵ)]]. [[e_{2}]](\overline{d}) , raise , \overline{ϵ} d_{1}). From the definition of ≤_{exc}, it must be d_{1} = ϵ_{1}(d_{2}) and b_{1} = ϵ_{1}(b_{2}), for some ϵ_{1} and d_{2} ≤_{ζ(ϵ_{1})} b_{2}. Moreover, it must be ϵ = ϵ_{1} because, otherwise,

val (d) =
case (λ x : [[ζ(ϵ)]]. [[e_{2}]](\overline{d}) , raise , \overline{ϵ}(ϵ_{1} d_{2})) =
case (λ x : [[ζ(ϵ)]]. [[e_{2}]](\overline{d}) , raise , inj_{2}(ϵ_{1} d_{2})) =
raise (ϵ_{1}(d_{2})).

Hence, from \overline{ϵ}(ϵ d_{1}) = inj_{1}(d_{1}), we obtain val (d) = [[e_{2}]](\overline{d}, d_{2}) and so we can assume [ \overline{b}, b_{2}]e_{2} ⇝ b, for some b such that d ≤_{σ} b. Then, [ \overline{b}](e_{1} handle ϵ(x) ⇒ e_{2}) ⇝ b follows from (hnd3) as required.

Finally, if [[e_{1} handle ϵ(x) ⇒ e_{2}]](\overline{d}) = let_{⊥}(case (val , \overline{e}_{2})) [[e_{1}]](\overline{d}) = raise (d), then [[e_{1}]](\overline{d}) can be neither a value nor ⊥. So, it must be [[e_{1}]](\overline{d}) = raise (d_{1}) and we can assume [ \overline{b}]e_{1} ⇝ raise_{σ} b_{1}, for some b_{1} such that d_{1} ≤_{exc} b_{1}. As above, it must be d_{1} = ϵ_{1}(d_{2}) and b_{1} = ϵ_{1}(b_{2}), with d_{2} ≤_{ζ(ϵ_{1})} b_{2}. From the assumptions, we have:

[[e_{1} handle ϵ(x) ⇒ e_{2}]](\overline{d}) =

let_{⊥}(case (val , \overline{e}_{2})) raise (ϵ_{1} d_{2}) = \overline{e}_{2}(ϵ_{1} d_{2}) = case (λ x : [[ζ(ϵ)]]. [[e_{2}]](\overline{d}) , raise , \overline{ϵ}(ϵ_{1} d_{2})). If ϵ = ϵ_{1}, we obtain raise (d) = [[e_{2}]](\overline{d}, d_{2}), and we can assume [ \overline{b}, b_{2}]e_{2} ⇝ raise_{σ} b, for

b such that d ≤_{ζ(ϵ)} b. Then, applying (hnd3), [ \overline{b}](e_{1} handle ϵ(x) ⇒ e_{2}) ⇝ raise_{σ} ϵ(b) as required. Otherwise, if ϵ ≠ ϵ_{1}, we obtain raise (d) = raise (d_{2}), which implies d = d_{2} and hence d ≤_{ζ(ϵ_{1})} b_{2}, Moreover, applying (hnd2), [ \overline{b}](e_{1} handle ϵ(x) ⇒ e_{2}) ⇝ raise_{σ} ϵ_{1}(b_{2}) as required. □

Theorem 3.7.4 (Adequacy: only if) Let e be a closed TMLE program of type nat; if ⊢ ([e]) = ([n]) then e ⇝ n.

Proof. By soundness of ML_{T} (Σ), it is required to prove that, if [[e]]_{T MLE} = val (n), then e ⇝ n. Assuming [[e]]_{T MLE} = val (n), lemma 3.7.3 ensures that there exists a b such that e ⇝ b and n ≤ nat b. By definition of ≤ nat, b must be n and hence e ⇝ n. □

4 Evaluation Logic

In Moggi’s categorical semantics of computations, a strong monad T provides the abstract structure for interpreting computations: it provides computational types T X, for modelling programs computing values of type X, and a canonical lifting of computations with a parameter of type X to computations with a parameter of type T X. In this framework, composition of programs is captured with no commitment to any specific form of computation.

Evaluation Logic (EL) applies the same idea to first order predicate calculus: predicates ϕ over values of type X lift to predicates over programs of type T X, expressing the property of producing values satisfying ϕ, independently of the notion of evaluation. Since the term language of the logic, that is the computational lambda calculus, stems from an attempt to explain computation abstractly, EL’s semantics calls for an abstract understanding of the interaction between logic and computation.

Typically, interpretation of programs require domain-like objects. Categories of such objects can hardly accommodate anything more than a geometric logic. However, there are nonobservable properties, such as “f is total,” which can be expressed in EL, viz. ∀ n. ⟨x ⇐ fn⟩ true , but cannot be classified in a category of predomains. Even if not classifiable, such predicates could still be interpreted in such a category, without resorting to topos-teoretic structure. Nevertheless, as shown in section 4.4, having a subobject classifier allows a “standard” interpretation of the logic from the categorical structure of a strong monad T. Since standard interpretation is desirable for modularizing the construction of categorical models, as we see in chapter 5, we regard models with a classifying object as desirable.

An expressive program logic with a standard semantics can be obtained in the setting of synthetic domain theory. Based on the slogan that domains are sets, synthetic domain theory seeks a category C with all good properties for interpreting computations and which is fully reflective in an ambient topos E, with all good properties for interpreting logics. There are many significant examples of this situation among subcategories of PERs in the effective topos. Since standard models require a strong monad T to “act” on predicates, which live in E, we must understand under what circumstances T, whose natural domain is the category C, where computations run, can be assumed to live in E, where the logic is interpreted.

In section 4.1 we introduce the calculus. Section 4.2 presents Pitts’ original semantics [Pit91] based on hyperdoctrines. The following three sections describe a standard interpretation of EL based on the simplifying assumptions that a strong monad T is available in the category E where the logic is interpreted and that it has good interaction with the logical structure. Section 4.6 shows that the first of these assumptions can be made with no loss of generality because any monad T on a category C can be extended to a monad T̃ on an ambient category E in which C is fully reflective by composing T with the reflection. While the construction of T̃ is well known, we claim the observation that the category of T -algebras is equivalent to the category of T̃-algebras (theorem 4.6.3). This equivalence shows that T̃ is in a sense “minimal” among the monads on E which extend T. We also find necessary and sufficient conditions to make T̃ strong when T is strong.

Section 4.7 describes a more general standard semantics for Evaluation Logic, introduced in [Moga] to overcome the failure of the second of the above assumptions.

In the last section we propose a new standard semantics based on evaluation relations. We already came across such relations on several earlier occasions: in section 3.3 we gave an example of their use for expressing general axioms of a computational metalanguage, while in section 3.7 we suggested the use of evaluation relations to state metatheoretical properties such as computational adequacy. Moreover, in section 4.4 we show the pragmatical advantages of using such predicates in a program logic: in the context of Evaluation Logic, they provide left and right rules for the box modality (see next section), thus making the proof system more manageable.

Evaluation relations can be defined from an endofunctor and first order quantification and hence they may provide a standard interpretation of Evaluation Logic when the structure required in [Moga] is not available. We also show how our definition relates with the one in [Mogb] where higher order structure is required. This is our main contribution in this chapter.

Some of the propositions stated below are left unproven. When this happens, the result is either well known or it follows from routine calculation or the proof is available in the cited literature.

4.1 The calculus

Evaluation Logic is a typed predicate calculus with equality and “evaluation” modalities based on the computational lambda calculus presented in chapter 2.

The types and terms of the logic are the same as in section 2.3. The well-formed formulae are given by formation judgements Γ ⊢ ϕ prop which are derived from the following rules:

⊢ false prop

\begin{matrix}Γ ⊢ M : τ Γ ⊢ N : τ \\ Γ ⊢ M = N prop \end{matrix}

Γ ⊢ ϕ prop Γ ⊢ ψ prop Γ ⊢ ϕ ⊃ ψ prop Γ ⊢ ϕ prop Γ ⊢ ψ prop Γ ⊢ ϕ ∧ ψ prop

Γ ⊢ ϕ prop Γ ⊢ ψ prop Γ ⊢ ϕ ∨ ψ prop

Γ, x : τ ⊢ ϕ prop

Γ ⊢ ∀ x : τ. ϕ prop

Γ, x : τ ⊢ ϕ prop

Γ ⊢ ∃ x : τ. ϕ prop

Γ, x : τ ⊢ ϕ prop Γ ⊢ M : T τ Γ ⊢ [x ⇐ M] ϕ prop

Γ, x : τ ⊢ ϕ prop Γ ⊢ M : T τ Γ ⊢ ⟨x ⇐ M⟩ ϕ prop

We write “true ” for ∗ = ∗ and “¬ϕ” for ϕ ⊃ false . The modal operators above are called necessity and possibility and will sometimes be written “□” and “♢.” We assume that such operators have the same precedence of ∀ and ∃, which we assume higher than that of all other logical connectives.

The intended meaning of [x ⇐ M] ϕ is that for all values x to which M : T X evaluates, ϕ(x) holds, while ⟨x ⇐ M⟩ ϕ says that there exists a value x to which M evaluates such that ϕ(x). Indeed, □ and ♢ are more quantifiers over values produced by computations than they are modalities in the traditional sense. It may help the intuition to consider the following set theoretic interpretation for computations with side effects. Let the computational type T X be defined as (X × S)_{⊥}^{S}.

[[w : T X ⊢ [x ⇐ w] ϕ prop ]] = {w | ∀ s, x, s′. ws = (x, s′) ⊃ ϕ(x)}  (4.1)
[[w : T X ⊢ ⟨x ⇐ w⟩ ϕ prop ]] = {w | ∃ s, x, s′. ws = (x, s′) ∧ ϕ(x)}  (4.2)

The basic truth judgements of the logic are intuitionistic sequents in context, written Γ; Δ ⊢ ϕ, where Γ is a type context, Δ a finite set of formulae and ϕ is a formula, expressing the fact that ϕ is logically entailed by the assumptions in Δ. We write Γ ⊢ ϕ for Γ; ∅ ⊢ ϕ. In [CP92] it is argued that, an intuitionistic framework is more suitable than a classical one for capturing the behavioural properties of computation.

The rules for deriving truth judgements include the axioms of the computational lambda calculus introduced in section 2.3, the standard rules for intuitionistic predicate calculus with equality, and the following rules concerning the evaluation modalities. We divide them into general and special depending on whether or not they describe inferences that can be made for any notion of computation. Furthermore, we distinguish between rules that involve only the structure of a strong endofunctor and rules involving the operation of a monad.

General axioms for strong endofunctors:

□ true \frac{Γ ⊢ M : T τ}{Γ ⊢ [x ⇐ M] true}  ♢ false \frac{Γ ⊢ M : T τ}{Γ ⊢ ¬⟨x ⇐ M⟩ false}

Γ, x : τ; Δ, ϕ ⊢ ψ
□ intro Γ, z : T τ; Δ, [x ⇐ z] ϕ ⊢ [x ⇐ z] ψ  x ∉ F V (Δ)
Γ, x : τ; Δ, ϕ ⊢ ψ
♢ intro Γ, z : T τ; Δ, ⟨x ⇐ z⟩ ϕ ⊢ ⟨x ⇐ z⟩ ψ  x ∉ F V (Δ)

Γ ⊢ M : T τ Γ, x : τ ⊢ ϕ prop Γ, x : τ ⊢ ψ prop

□ ∧  Γ; [x ⇐ M] ϕ, [x ⇐ M] ψ ⊢ [x ⇐ M] (ϕ ∧ ψ)

Γ ⊢ M : T τ Γ, x : τ ⊢ ϕ prop Γ, x : τ ⊢ ψ prop

♢ ∨  Γ; ⟨x ⇐ M⟩ (ϕ ∨ ψ) ⊢ ⟨x ⇐ M⟩ ϕ ∨ ⟨x ⇐ M⟩ ψ

Γ ⊢ M : T τ Γ, x : τ ⊢ ϕ prop Γ, x : τ ⊢ ψ prop

□ ♢  Γ; [x ⇐ M] ϕ, ⟨x ⇐ M⟩ ψ ⊢ ⟨x ⇐ M⟩ (ϕ ∧ ψ)

General axioms for strong monads:

□ val \frac{Γ ⊢ M : τ Γ, x : τ ⊢ ϕ prop}{Γ; ϕ(M) ⊢ [x ⇐ val(M)] ϕ}  ♢ val \frac{Γ ⊢ M : τ Γ, x : τ ⊢ ϕ prop}{Γ; ⟨x ⇐ val(M)⟩ ϕ ⊢ ϕ(M)}

Γ ⊢ M : T τ Γ, x : τ ⊢ N : T σ Γ, y : σ ⊢ ϕ prop

□ let Γ; [x ⇐ M] [y ⇐ N] ϕ ⊢ [y ⇐ (let x ⇐ M in N)] ϕ

Γ ⊢ M : T τ Γ, x : τ ⊢ N : T σ Γ, y : σ ⊢ ϕ prop

♢ let Γ; ⟨y ⇐ (let x ⇐ M in N)⟩ ϕ ⊢ ⟨x ⇐ M⟩ ⟨y ⇐ N⟩ ϕ

Special axioms for strong endofunctors:

Γ ⊢ ϕ prop Γ, x : τ ⊢ ψ prop
□ ⊃ Γ; ϕ ⊃ [x ⇐ M] ψ ⊢ [x ⇐ M] (ϕ ⊃ ψ)

\begin{aligned}& Γ ⊢ M : T τ Γ, x : τ, y : σ ⊢ ϕ prop \\ □ ∀ & Γ; ∀ y : σ. [x ⇐ M] ϕ ⊢ [x ⇐ M] ∀ y : σ. ϕ \end{aligned}

\begin{aligned}& Γ ⊢ M : T τ Γ, x : τ, y : σ ⊢ ϕ prop \\ ♢ ∃ & Γ; ⟨x ⇐ M⟩ ∃ y : σ. ϕ ⊢ ∃ y : σ. ⟨x ⇐ M⟩ ϕ \end{aligned}

Γ ⊢ M : τ Γ ⊢ N : τ Γ ⊢ L : T σ Γ, x : σ ⊢ ϕ prop

♢ =  Γ; M = N ∧ ⟨x ⇐ L⟩ ϕ ⊣⊢ ⟨x ⇐ L⟩ (M = N ∧ ϕ)

Special axioms for strong monads:

Γ ⊢ M : T τ Γ, x : τ ⊢ N : σ Γ, y : σ ⊢ ϕ prop
□ T^{∗} Γ; [y ⇐ (let x ⇐ M in val(N))] ϕ(y) ⊢ [x ⇐ M] ϕ(N) (⊣ for ♢ T^{∗})
Γ ⊢ M : τ Γ, x : τ ⊢ ϕ prop
□ val^{∗}  Γ; [x ⇐ val(M)] ϕ ⊢ ϕ(M)  (⊣ for ♢ val^{∗})
Γ ⊢ M : T τ Γ, x : τ ⊢ N : T σ Γ, y : σ ⊢ ϕ prop
□ let^{∗} Γ; [y ⇐ (let x ⇐ M in N)] ϕ ⊢ [x ⇐ M] [y ⇐ N] ϕ (⊣ for ♢ let^{∗})

Note that the opposites of □ ∧, ♢ ∨, □ ⊃, □ ∀ and ♢ ∃ follow from □ intro , ♢ intro and the usual axioms for ∧, ∨, ⊃, ∀ and ∃. Except for quantification (∀ and ∃) and implication (⊃), which are not considered in [Pit91], Pitts’ axioms are the same as the above general and special axioms, provided Δ is empty in □ intro and ♢ intro . The reason for such a restriction is discussed in section 5.3.

Remark. The above axioms are presented so as to match the ⟨T, val, let⟩ view of a strong monad. In [Mogb], a different set of axioms is given, matching the ⟨T, η, μ, t⟩ view. Moggi’s axioms are equivalent to our general rules for necessity plus □ T^{∗}. In particular, Moggi’s □ μ is an instance of □ let , □ t^{∗} follows from □ ∧ and □ T^{∗}, while □ T follows from □ val and □ let . Note also that □ T^{∗} follows from □ val^{∗} and □ let .

Remark. □ val^{∗} implies the mono requirement, that is val(M) = val(N) ⊢ M = N. In fact, taking ϕ(x) ≡ (x = N), we have:

ϕ(N) ⊢ [x ⇐ val(N)] ϕ(x) ⊢ [x ⇐ val(M)] ϕ(x) ⊢ ϕ(M) ≡ (M = N).

Remark. As pointed out in [Pit91], the following evaluation properties of a program M : T τ can be expressed in the logic:

“M can evaluate to v” (written v ⇐ M): ⟨x ⇐ M⟩ (x = v)
“M can produce a value” (M ⇓):  ⟨x ⇐ M⟩ true
“M cannot produce a value” (M ⇑):  [x ⇐ M] false

Others, such as “M must evaluate to v” cannot be expressed.

4.2 Hyperdoctrine semantics

Pitts’ interpretation of Evaluation Logic is based on Lawvere’s categorical notion of hyperdoctrine ([Law69,Law70]). Such a notion can be variously specialized in order to suit the particular features of the logic being considered. We first focus on the connectives of the calculus presented in section 4.1 and later on the modalities.

Definition 4.2.1 A first order hyperdoctrine over a category C with products is a pseudofunctor H : C^{op} → Preord such that:

• each fibre H(X) is a Heyting prealgebra, that is it has finite meets, joins and Heyting implication; moreover, the functions H(f) preserve this structure;

• for all projections π_{X} : Y ×X → Y, the functions H(π_{X}) have left and right adjoints ∃_{X} ⊣ H(π_{X}) ⊣ ∀_{X} satisfying the Beck-Chevalley condition: for all f : A → B,

≅ H(B × X)  H(f)  ∃_{X}, ∀_{X} H(A) ∃_{X}, ∀_{X} H(B) H(f × X) H(A × X)

In the above definition C is called the base category; meets and joins are written ∧ and ∨, with ⊤ and ⊥ the empty ones; Heyting implication, written ⇒, is such that ( ) ∧ ϕ ⊣ ϕ ⇒ ( ); the functions H(f) are called reindexing and written f^{∗}. If posets are used instead of preorders, H is a functor and the diagram above commutes strictly.

Note that, when infinite joins are available, and reindexing preserves them, an adjunction f^{∗} ⊣ ∀_{f} is obtained by defining ∀_{f}ϕ =^{def} ⋁ {ξ | f^{∗}ξ ≤ ϕ}. Similarly, ∃_{f} ⊣ f^{∗} is obtained from infinite meets.

Remark. To model a calculus including a formal treatment of proofs, a more general notion of hyperdoctrine would be required, where fibres are general categories. On the other hand, we do not require the fibres to be posets so as to have hyperdoctrines of classes of admissible monos, as in section 4.3.

Definition 4.2.2 A first order hyperdoctrine H is said to have equalities if there exist left adjoints ∃_{Δ×id} to reindexing along morphisms Δ×id : A×B → (A×A)×B satisfying the Beck-Chevalley condition:

HA H(A × A)  H((A × A) × B) H(A × B) π^{∗} π^{∗}  ∃_{Δ×id} ∃_{Δ}  ≅

Writing “=” for ∃⊤, the above adjunction states that x, y : X; x = y ⊢ ϕ(x, y) if and only if x : X; true ⊢ ϕ(x, x).

Digression on Frobenious reciprocity. In [Pit91], where the logic features no connective ⊃ and the fibres need not have exponentials, the functions ∃_{Δ×id} are required to satisfy Frobenious reciprocity:

Definition 4.2.3 Let f : A → B be a morphism in a category C and let ∃_{f} ⊣ f^{∗} for a hyperdoctrine H on C. We say that ∃_{f} satisfies Frobenious reciprocity when, for all ϕ ∈ HA and ψ ∈ HB,

(∃_{f}ϕ) ∧ ψ ≅ ∃_{f}(ϕ ∧ f^{∗}ψ).

The logical intuition behind Frobenious reciprocity is that ∃ y. (ϕ(x, y) ∧ ψ(x)) if and only if (∃ y. ϕ(x, y)) ∧ ψ(x). The following proposition shows that, in a first order hyperdoctrine, all functions ∃_{f} satisfy this property.

Proposition 4.2.4 Let f be an arbitrary morphism in a category C, and let ∃_{f} ⊣ f^{∗} for a first order hyperdoctrine over C. The function ∃_{f} satisfies Frobenious reciprocity.

Proof. There is an obvious morphism ∃_{f}(ϕ ∧ f^{∗}ψ) → (∃_{f}ϕ) ∧ ψ. The inverse to this is obtained by exploiting the fact that f^{∗} preserves exponentials in the fibres:

{∃_{f}(ϕ ∧ f^{∗}ψ) → ∃_{f}(ϕ ∧ f^{∗}ψ) \atop ϕ ∧ f^{∗}ψ → f^{∗}∃_{f}(ϕ ∧ f^{∗}ψ)} ; ϕ → (f^{∗}ψ) ⊃ f^{∗}∃_{f}(ϕ ∧ f^{∗}ψ) ; ϕ → f^{∗}(ψ ⊃ ∃_{f}(ϕ ∧ f^{∗}ψ)) ; ∃_{f}ϕ → ψ ⊃ ∃_{f}(ϕ ∧ f^{∗}ψ) ; (∃_{f}ϕ) ∧ ψ → ∃_{f}(ϕ ∧ f^{∗}ψ)

□

The definition of hyperdoctrine is often given (e.g. [Pav90]) by requiring left and right adjoints to reindexing along arbitrary morphisms. However such adjoints can be obtained from the adjoints along projections when the hyperdoctrine has equality:

Proposition 4.2.5 For a first order hyperdoctrine with equality on a category C with products, there exist left and right adjoints ∃_{f} ⊣ f^{∗} ⊢ ∀_{f} for any morphism f in C.

Proof. Let Γ, x : A ⊢ M(x) : B; logically, the proposition Γ, y : B ⊢ ∃_{M}(ϕ(x)) prop is defined as ∃ x. (y = M ∧ ϕ) and Γ, y : B ⊢ ∀_{M}(ϕ(x)) prop as ∀ x. (y = M ⊃ ϕ). The bijection defining the adjunction for ∀_{M} is shown below while that for ∃_{M} is derived similarly.

Γ, x : A; ψ(M) ⊢ ϕ(x)

= Γ, y, B, x : A; ψ(y) ∧ y = M ⊢ ϕ(x) = Γ, y, B, x : A; ψ(y) ⊢ y = M ⊃ ϕ(x) = Γ, y, B; ψ(y) ⊢ ∀ x. (y = M ⊃ ϕ(x))

□

First order predicate calculus with equality is interpreted in a first order hyperdoctrine with equality H as follows. A formation judgement Γ ⊢ ϕ prop is interpreted as an object of H[[Γ]], which we write “[[ϕ]]” or even “ϕ” when no confusion arises. A truth judgement Γ; Δ ⊢ ϕ is true when ⋀ Δ ≤ ϕ in the poset [[Γ]]. The interpretation [[·]] of a formula is recursively defined as follows:

[[false ]] =^{def} ⊥
[[M = N]] =^{def} = (M, N)
[[ϕ ⊃ ψ]] =^{def} ϕ ⇒ ψ
[[ϕ ∧ ψ]] =^{def} ϕ ∧ ψ
[[ϕ ∨ ψ]] =^{def} ϕ ∨ ψ
[[∀ x : X. ϕ]] =^{def} ∀_{X}ϕ
[[∃ x : X. ϕ]] =^{def} ∃_{X}ϕ

We now turn to the evaluation modalities.

Definition 4.2.6 (Pitts) Let T be a strong monad on a category C with products; a T -modality on a (first order) hyperdoctrine H over C is specified by a family of orderpreserving functions

□_{A,B} : H(A × B) → H(A × T B),

one for each pair of objects A and B in C, satisfying the following conditions:

• (naturality) for all f : A → B in C, □_{A,C} ^{∘}(f × id_{C})^{∗} = (f × id_{T C})^{∗}^{∘}□_{B,C};

• (unit) for all A and B in C, (id_{A} × val_{B})^{∗}^{∘}□_{A,B} = id ;

• (lifting) for all f : A × B → T C in C, □_{A,B} ^{∘}⟨π, f⟩^{∗}^{∘}□_{A,C} = ⟨π, (let f)⟩^{∗}^{∘}□_{A,C}.

T -modalities □ and ♢ are used in [Pit91] to interpret the evaluation modalities as follows:

[[Γ, z : T τ ⊢ [x ⇐ z] ϕ]] =^{def} □_{Γ,τ}ϕ
[[Γ, z : T τ ⊢ ⟨x ⇐ z⟩ ϕ]] =^{def} ♢_{Γ,τ}ϕ

The general and special axioms of section 4.1 are sound with respect to the above interpretation, provided □ and ♢ have the following properties:

• □ preserves finite meets;

• ♢ preserves finite joins;

• ♢ϕ ∧ □ψ ≤ ♢(ϕ ∧ ψ);

• ∃_{Δ×id}(♢ϕ) = ♢∃_{Δ×id}ϕ;

• □ commutes with ∀_{X};

• ♢ commutes with ∃_{X}.

In [Pit91], several examples of operators in concrete models are given. Among them, the modalities for computations with side effect are based on a hyperdoctrine H over the category of cpos such that H(A), that is the semilattice of propositions on A, contains subsets of A × S, where S is the cpo of states.

The interpretation of Evaluation Logic just described requires the additional structure of a hyperdoctrine and T -modalities. However, a particular hyperdoctrine may be available on the category C, for which an appropriate modality for interpreting □ (possibly not T -modal, but still validating the general axioms) can be defined automatically from the monad T. Moreover, if such a hyperdoctrine has higher order structure, an appropriate modal operator ♢ can be defined from □. Moggi calls such models “standard.” We present standard interpretations in sections 4.4 through 4.7 after few mathematical preliminaries.

4.3 The logic of a class of admissible monos

In “standard” models, the structure required to interpret the logic is to be found in the same (base) category where types are interpreted. The idea is to define modal operators by making the categorical gear for interpreting computational types act upon that for interpreting the logic.

Logical structure can be found in topoi. They provide models for higher order logics, where predicates on a type A are interpreted in the category Sub (A) of subobjects of A. Such an interpretation relies on several features of topoi: for example, for every A, Sub (A) is a Heyting algebra; for any f : A → B there is a (logical) structure-preserving reindexing functor f^{∗} : Sub (B) → Sub (A) with left and right adjoints; Ω is an internal Heyting algebra, and so on.

Various fragments of logical systems can be interpreted in arbitrary categories in which only restricted classes M of subobjects are considered. For example, geometric logics such as that described in [Vic89], with operators ⋁ and ∧, can be modelled by the algebra of “observable” properties of cpos, where elements of M are domains of partial continuous functions or Scott-opens.

First we show what kind of structure M in a category C allows interpretation of predicate calculus. Then, in order to find suitable interpretations for the evaluation modalities, we study the interaction between structures M and strong monads for interpreting computation. Here, M-functors and M-natural transformations are introduced. We use fibrations to show how such objects arise naturally as 1 and 2-cells in a 2-category of categories with structure.

Definition 4.3.1 A class of display maps D in a category C is a collection of morphisms of C such that:

• D contains all the identities; • D is closed under composition;

• if d ∈ D and f is an arbitrary morphism in C with the same target, a pullback of d along f exists and, for any such pullback, f^{−1}d ∈ D.

In [Tay92], Taylor adopts a more liberal approach in defining the notion of display structure, which is a class of morphisms closed under a functorial choice of pullbacks.

Display maps arise in categorical models of dependent types, where they act as projections of dependent contexts: for every type τ depending on a context Γ, a context Γ, x : τ is defined together with a projection Γ, x : τ → Γ for modelling weakening. The “comprehension” of τ in Γ, x : τ can be abstractly modelled as follows. Let C^{→} be the category whose objects are arrows of C and morphisms are commuting squares and let cod : C^{→} → C be the codomain fibration.

Definition 4.3.2 (Jacobs) A comprehension category is a functor P : E → B^{→} such that:

• cod ^{∘}P : E → B is a fibration;

• if f is cartesian in E, then Pf is a pullback in B.

The idea is that, if σ and τ are objects in the fibre over [[Γ]] interpreting types Γ ⊢ σ type and Γ ⊢ τ type , the (weakened) judgement Γ, x : τ ⊢ σ type is interpreted by reindexing σ along Pτ : [[Γ, x : τ]] → [[Γ]]. In [Jac91], Jacobs defines display maps to be morphisms of the form Pτ. This is slightly more general than definition 4.3.1, as we argue below.

Proposition 4.3.3 Let D be a class of display maps; let D also indicate the category whose objects are elements of the class D and morphisms are commuting squares. The inclusion D ↪ C^{→} is a comprehension category.

This proposition justifies the use of terms such as “fibres,” “reindexing” etc. in the context of a category with a class of display maps.

It is easy to verify that D ↪ C^{→}→ C is a fibration whose cartesian morphisms are pullback squares. Morphisms in the fibre D_{A} over A are commuting triangles, and the reindexing functor f^{∗} is pulling back along f.

On the other hand, if an inclusion E ↪ C^{→} is a comprehension category, the objects of E need not yield a class of display maps. In fact, such a class must be closed under any choice of pullbacks, and hence all isomorphisms must be included in it. Hence, for example, the class of all identities is not a class of display maps although it forms a comprehension category E = C ↪ C^{→}.

Definition 4.3.4 Let D be a class of display maps in C; a fibration p : E → C is said to have D-products (D-sums) when:

• for all d ∈ D, d^{∗} has right (left) adjoint, written d^{∗} ⊣ ∀_{d} (∃_{d} ⊣ d^{∗});

• the Beck-Chevalley condition holds, that is, for all pullbacks of elements d ∈ D as below, the canonical natural transformation g^{∗}∀_{d} \underrightarrow{.} ∀_{b}f^{∗} (∃_{b}f^{∗} \underrightarrow{.} g^{∗}∃_{d}) is an isomorphism.

b  f  d g

When p : E → C is understood, we say that E has D-products (sums). We understand that a class D of display maps is the source of the fibration D ↪ C^{→} → C.

Let C be a category with binary products. The cartesian projections of C, that is morphisms that are part of a product diagram, form a class D_{π} of display maps. We say that a fibration has indexed products (sums) if it has D_{π}-products (sums). Similarly, if S is an object of C, the class of morphisms · → A such that S ← · → A is a product diagram forms a class D_{S} of display maps and a fibration with D_{S}-products (sums) is said to have S-indexed products (sums). If π : A × S → A is in D_{S} and A is understood, we write ∀_{S} for ∀_{π}.

Proposition 4.3.5 Any class D of display maps has D-sums, where ∃_{d}b = d^{∘}b.

Proposition 4.3.6 Let D be a class of display maps. All fibres D_{A} have terminal object 1_{A} and binary products a ×_{A} b =^{def} ∃_{b}(b^{∗}a) and reindexing preserves them.

It is well known that, if C is a category with finite limits, C^{→} has C^{→}-products if and only if all slice categories C/A are cartesian closed and reindexing preserves such structure (that is: cod : C^{→}→ C is a fibred CCC). This result can be generalized to arbitrary classes of display maps. Here we show one direction:

Proposition 4.3.7 In a class of display maps D with D-products, all fibres have exponentials and reindexing preserves them.

Proof. Let b : B → A in D; the exponential ( )^{b} in the fibre D_{A} is defined by the equation d^{b} =^{def} ∀_{b}b^{∗}d, as shown by the following figure:

b^{∗} ∃_{b}^{M_{B}}^{M_{A}}  ^{M_{A}} ( ) ×_{A} b b^{∗} ∀_{b}  ( )b_{A}

In order to show preservation of exponentials, let b, d ∈ D_{A} and let f have codomain A in C. Applying the Beck-Chevalley condition to the square

b  f f^{∗}b g

we obtain: f^{∗}(d^{b}) =^{def} f^{∗}∀_{b}b^{∗}d ≅ ∀_{f^{∗}b}g^{∗}b^{∗}d ≅ ∀_{f^{∗}b}(f^{∗}b)^{∗}f^{∗}d =^{def} (f^{∗}d)^{f^{∗}b}. □

Definition 4.3.8 (Rosolini) A class of admissible monos M is a class of display maps whose elements are all monos.

Elements of a class of admissible monos can be used for interpreting formulae in different fragments of predicate calculus, each fragment requiring different properties of M. A trivial example of class of admissible monos in C is that of all isos in C, modelling the predicates true . This class is reflective in C^{→}, with the unit of the reflection mapping f : A → B to id_{B}. If C has strict initial object 0, that is one such that any map into it is an isomorphism, false can be interpreted by adding to the above class all morphisms 0 → A. The collection of all monos in a category C with pullbacks forms a class of admissible monos M. If C is a topos, there is a reflection C^{→}→ M, whose unit η_{f} is the image of f.

With the structure described so far, we can interpret the negative fragment of predicate calculus with equality: let M be a class of admissible monos such that:

• M has M-products;

• Δ ∈ M;

• M has indexed products.

From proposition 4.3.6, each fibre has a terminal object to interpret true and binary products to interpret ∧. The first condition above allows the interpretation of implication, as shown by proposition 4.3.7. The second implies that Δ×id ∈ M. The third condition yields ∀_{X} for all types X (and, since M has equalities, also ∀_{f} for arbitrary f).

The interpretation of disjunction requires additional closure properties of M. One way to proceed is to assume sums in C and a factorization system (see section 4.7), so that A ⋃ B ↣ C is the image of the mediating morphisms A + B → C. The expected properties of ⋃, such as idempotence, hold in this setting. Another way is to use the same construction as in Sets , that is pulling back A along B and pushing out the result. However this construction yields an idempotent opertator only when C is a pre-topos. A third possibility is to resort to higher order structure:

Definition 4.3.9 Let C be a category with terminal object 1. A monomorphism ⊤ : 1 → Σ is called a classifier if, for every f in C with codomain Σ, f^{−1}⊤ exists and, moreover, f^{−1}⊤ = g^{−1}⊤ implies f = g. A mono of the form f^{−1}⊤ is called a Σ-object and f is called its classifying map. A classifier is called a dominance if the class of Σ-objects is closed under composition.

Clearly, the Σ-objects of a dominance form a class of admissible monos. Alternatively, one can waive the condition that a classifier has domain 1 (then, for example, id_{0} would be one) and define a dominance as a classifier whose Σ-objects form a class of admissible monos. Then, the domain of a dominance is forced to be a terminal object in C because the identities are classified.

There can be several (not isomorphic) dominances in a category. For example, in the category Cpo of cpos and continuous functions, id_{1} is a dominance classifying the class of all isos, while ⊤ : 1 → {⊥ ≤ ⊤} classifies the Scott-opens. The two-element poset {⊥ ≤ ⊤} is called Sierpiński space.

If the class M of Σ-objects of a dominance satisfies some of the closure properties described earlier in this section, one can interpret first order predicate calculus in M.

Proposition 4.3.10 Let ⊤ be a dominance in a category C and let the class M of its Σ-objects have indexed and M-products. The fibres of M are Heyting prealgebras, reindexing preserves the structure and has left and right adjoints satisfying the Beck-Chevalley condition.

The idea is to view Σ as an “object of propositions” and to define first order logical operators using implication and (higher order) universal quantification. In particular, let ξ =^{def} π_{Γ}^{∗}⊤ be the mono interpreting the generic predicate Γ, ξ : Σ ⊢ ξ prop in M_{Γ×Σ} and let ∀_{ξ} stand for ∀_{Σ}; from ⇒ and ∀_{X}, which we get from the above structure as shown earlier, we define ⊥, ∨ and ∃_{X} in M_{Γ} as follows:

⊥ =^{def} ∀_{ξ}ξ
ϕ ∨ ψ =^{def} ∀_{ξ}((ϕ ⇒ ξ) ⇒ (ψ ⇒ ξ) ⇒ ξ)
∃_{X}ϕ =^{def} ∀_{ξ}(∀_{X}(ϕ ⇒ ξ) ⇒ ξ).

Remark. The structure described in proposition 4.3.10 defines a tripos ([HJP80]) in C. In fact, tripoi are more general structures, which only require a generic predicate (⊤ for the fibration M) where no uniqueness is required of the classifying maps. However, uniqueness makes it easy to find “horizontal” (that is internal) structure corresponding to that just described. For example, ∀_{B} yields a map C(A × B, Σ) → C(A, Σ) natural in A; hence, applying Yoneda to C( , Σ^{B}) ≅ C( × B, Σ) \underrightarrow{.} C( , Σ), we obtain an internal ∀_{B} : Σ^{B} → Σ.

4.4 Endofunctors and classes of admissible monos

What is still missing of a standard model of EL is the modalities. In this section we describe a simple interpretation of □ and ♢ in a category with a class of admissible monos and validate the axioms for strong endofunctors, while in the next section we deal with the ones for monads.

Let C be a category with a class of admissible monos M as in proposition 4.3.10, and let ⟨T, t⟩ be a strong endofunctor mapping M to M; the following semantics for the evaluation modalities, proposed in [Mogb], is called standard in the sense that it is completely determined by the strong endofunctor ⟨T, t⟩:

(4.3)  \frac{Γ, x : X ⊢ ϕ prop}{Γ, w : T X ⊢ [x ⇐ w] ϕ prop}  \begin{matrix}ϕ \\ □_{Γ,X}ϕ =^{def} t_{Γ,X}^{∗}T ϕ \end{matrix}

(4.4)  \frac{Γ, x : X ⊢ ϕ prop}{Γ, w : T X ⊢ ⟨x ⇐ w⟩ ϕ prop}  \begin{matrix}ϕ \\ ♢_{Γ,X}ϕ =^{def} ∀_{ξ}(□_{Γ×Σ,X}(ϕ ⇒ ξ) ⇒ ξ) \end{matrix}

The interpretation of ♢ suggests that in a higher order Evaluation Logic, possibility can be expressed in terms of necessity:

⟨x ⇐ z⟩ ϕ =^{def} ∀ξ : Σ. ([x ⇐ z] (ϕ ⊃ ξ) ⊃ ξ).

Note that (4.2) of section 4.1 is obtained by interpreting this formula in the category of sets.

Lemma 4.4.1 The axiom □ ∧ is sound with respect to (4.3) in a category with a class of admissible monos M when T preserves meets. All other □-ed general axioms for strong endofunctors are sound with respect to interpretation in a category with the structure described in proposition 4.3.10. In particular, □ ♢ is sound when ♢ is interpreted as in (4.4).

Proof. All diagrams involved in the proof of proposition 4.4.1 are quite simple. To give an example, we show that □ ♢ is a consequence of the axioms for ∀ and □:

{ϕ, ψ, (ϕ ∧ ψ) ⊃ ξ ⊢ ξ \atop ϕ, (ϕ ∧ ψ) ⊃ ξ ⊢ ψ ⊃ ξ} ; [x ⇐ w] ϕ, [x ⇐ w] ((ϕ ∧ ψ) ⊃ ξ) ⊢ [x ⇐ w] (ψ ⊃ ξ) ; [x ⇐ w] ϕ, [x ⇐ w] ((ϕ ∧ ψ) ⊃ ξ), [x ⇐ w] (ψ ⊃ ξ) ⊃ ξ ⊢ ξ ; [x ⇐ w] ϕ, [x ⇐ w] (ψ ⊃ ξ) ⊃ ξ ⊢ [x ⇐ w] ((ϕ ∧ ψ) ⊃ ξ) ⊃ ξ ; [x ⇐ w] ϕ, ∀ ξ. ([x ⇐ w] (ψ ⊃ ξ) ⊃ ξ) ⊢ ∀ ξ. ([x ⇐ w] ((ϕ ∧ ψ) ⊃ ξ) ⊃ ξ) ; [x ⇐ w] ϕ, ⟨x ⇐ w⟩ ψ ⊢ ⟨x ⇐ w⟩ (ϕ ∧ ψ)

□

In order to validate the axioms for ♢, additional properties are required of □. Such properties are expressed in the logic by □ ∀ and □ ⊃.

Definition 4.4.2 (Moggi) Let C, ⟨T, t⟩, M and □ be as above and let M have Dproducts, for D a class of display maps. We say that □ commutes with D-products if diagrams of the following form commute: let d : A → B in D,

M_{A×T C} □_{B,C}^{M_{B×C}}  ^{M_{B×T C}} ∀_{d×id}  ∀_{d×id} □_{A,C}^{M_{A×C}}

□ ∀, which is known in the context of modal logics as Barcan formula, is just the EL spelling of the diagram above, with D =^{def} D_{π} the class of cartesian projections. It is easy to verify that □ ⊃ is sound when M has M-products and □ commutes with them. Note that, in any fibred cartesian closed M, for m : B → A ∈ M, m^{∗} always has a right adjoint ∀_{m}. In fact, defining ∀_{m}n =^{def} (m^{∘}n)^{m}, we have:

M_{A}(l, (m^{∘}n)^{m}) ≅ M_{A}(l ×_{A} m, m^{∘}n) = M_{A}(m^{∘}m^{∗}l, m^{∘}n) ≅ M_{B}(m^{∗}l, n).

Theorem 4.4.3 The general and special axioms for strong endofunctors are sound with respect to interpretation (4.3,4.4) in a category as in proposition 4.3.10 when □ commutes with indexed and M-products.

To prove this theorem, we introduce evaluation relations (a ⇐_{A} w), to be read “program w evaluates to value a,” over A × T A, and use them to obtain “left” and “right” rules for □. This makes the proof theory of the logic more manageable. Following the same idea of (4.4), define:

a ⇐_{A} w =^{def} ∀ ϕ : Σ^{A}. ([x ⇐ w] ϕ(x) ⊃ ϕ(a))  (4.5)

as in [Mogb]. It is quite easy to verify that [x ⇐ w] (x ⇐ w) holds in all models satisfying □ ∀ and □ ⊃ [Mogb, Theorem 2.13]. We call the following derived rules, □ right and □ left respectively:

Δ, x ⇐ w ⊢ ϕ(x) ; x ∉ F V (Δ) ; Δ, [x ⇐ w] (x ⇐ w) ⊢ [x ⇐ w] ϕ(x) ; Δ ⊢ [x ⇐ w] ϕ(x)

{Δ, ϕ(M) ⊢ ψ {Δ ⊢ M ⇐ w \atop Δ ⊢ ∀ P. ([x ⇐ w] P (x) ⊃ P (M))} ; Δ ⊢ [x ⇐ w] ϕ(x) ⊃ ϕ(M) \atop Δ, [x ⇐ w] ϕ(x) ⊢ ψ}

Note that, using □ left , one can derive the converse of □ right . Theorem 4.4.3 follows from Lemma 4.4.1 by showing that all general axioms for ♢ and special axioms for strong endofunctors are derivable from the axioms for □, □ right and □ left . As an example, we show the derivation of ♢ ∨:

ϕ, ϕ ⊃ ξ ⊢ ξ x ⇐ w ⊢ x ⇐ w ; □ left ; x ⇐ w, ϕ, [x ⇐ w] (ϕ ⊃ ξ) ⊢ ξ ; x ⇐ w, ϕ ⊢ ∀ ξ. ([x ⇐ w] (ϕ ⊃ ξ) ⊃ ξ) x ⇐ w, ϕ ⊢ ⟨x ⇐ w⟩ ϕ ∨ ⟨x ⇐ w⟩ ψ

… same as before x ⇐ w, ψ ⊢ ⟨x ⇐ w⟩ ϕ ∨ ⟨x ⇐ w⟩ ψ

x ⇐ w, ϕ ∨ ψ ⊢ ⟨x ⇐ w⟩ ϕ ∨ ⟨x ⇐ w⟩ ψ
x ⇐ w ⊢ (ϕ ∨ ψ) ⊃ (⟨x ⇐ w⟩ ϕ ∨ ⟨x ⇐ w⟩ ψ)
□ right
⊢ [x ⇐ w] ((ϕ ∨ ψ) ⊃ (⟨x ⇐ w⟩ ϕ ∨ ⟨x ⇐ w⟩ ψ))
∀ ξ. ([x ⇐ w] ((ϕ ∨ ψ) ⊃ ξ) ⊃ ξ) ⊢ ⟨x ⇐ w⟩ ϕ ∨ ⟨x ⇐ w⟩ ψ
⟨x ⇐ w⟩ (ϕ ∨ ψ) ⊢ ⟨x ⇐ w⟩ ϕ ∨ ⟨x ⇐ w⟩ ψ

Note that the condition of Lemma 4.4.1 that T preserves meets in the M-fibres disappears in the above theorem since □ ∧ is a consequence of □ ⊃ and □ ∀ as shown below:

\begin{matrix}{[x ⇐ w] ϕ ⊢ [x ⇐ w] ϕ \atop [x ⇐ w] ϕ, x ⇐ w ⊢ ϕ} & {[x ⇐ w] ψ ⊢ [x ⇐ w] ψ \atop [x ⇐ w] ψ, x ⇐ w ⊢ ψ} \\ [x ⇐ w] ϕ, [x ⇐ w] ψ, x ⇐ w ⊢ ϕ ∧ ψ \end{matrix} ; [x ⇐ w] ϕ, [x ⇐ w] ψ, ⊢ [x ⇐ w] (ϕ ∧ ψ)

4.5 Monads and classes of admissible monos

Proposition 4.5.1 The general axioms for strong monads are sound with respect to interpretation in a category with the structure described in proposition 4.3.10.

Next, we study the interaction between a class of admissible monos M and a strong monad T in order to find suitable conditions for validating the special axioms for strong monads.

In models satisfying □ T^{∗}, substitution in modal formulae corresponds to pullbacks. A minimal condition for the latter is that T preserves pullbacks of elements of M along morphisms of the form f × id . Moggi calls such functors strongly mono preserving and notices that they are not closed under composition. This may be unfortunate, since one cannot verify this property for complex functors by verifying it holds for their components, as we do in the next chapter. Definition 4.5.2 below imposes a stronger requirement on functors T that is preserved under composition and guarantees a good behaviour of the modalities under substitution.

Comprehension categories are the objects of a (two-)category Comp whose morphisms P → Q are fibration morphisms (F, G) : cod ^{∘}P → cod ^{∘}Q making the following diagram commute:

C^{→} C  B^{B^{→}} cod P E  H cod Q G F F^{→}

From this diagram it is clear that, when E and H are classes of admissible monos (or, for that matter, classes of display maps), and P and Q the inclusions, G is completely determined by F. In this case, we write F^{→}: E → H the restriction of the homonymous functor C^{→}→ B^{→}. We call Cat_{M} the full subcategory of Comp whose objects are categories with a class of admissible monos.

Definition 4.5.2 Morphisms in Cat_{M} are called M-functors.

Unfolding this definition, an M-functor (C, M) → (B, N) is a functor F : C → B such that m ∈ M implies F m ∈ N and F preserves pullbacks of elements of M (the cartesian morphisms of cod ^{∘}P). Obviously, M-functors are strongly mono preseving, thus making □ commute with substitution.

Remark. An M-functor F : C → D is a functor that lifts to the categories of partial maps, that is to a functor pF : pC → pD (see 2.5).

□

When T is an M-functor, □ T^{∗} is sound. In fact, note that, for N : τ → σ, the sequent w : T τ ⊢ let x ⇐ w in val(N) : T σ is interpreted as T N and hence □ T^{∗} corresponds to the implication (T N)^{∗}T ϕ ⊃ T (N^{∗}ϕ), while the opposite holds because (T N)^{∗}T ϕ is a pullback.

Digression on enriched M-functors. Let M be a class of admissible monos in a category C enriched over itself and let C have pullbacks of morphisms of the form (m^{∘} ) : [X, dom (m)] → [X, cod (m)], for m ∈ M. Then, M is a C-category. In particular, for m : A → B and n : C → D in M, the object [m, n] is the vertex of the vertex of the (inner) pullback square in the diagram below.

[A, C] [A, D]  [T A, T C] [T A, T D] [T B, T D] ^{∘}m  t t  ^{∘}T m  T n^{∘} n^{∘} π_{1}  π_{0}  t [m, n] [B, D]

The morphism mediating the pair id_{A} : [A, A] ← 1 → [B, B] : id_{B} is the identity map id_{m} : 1 → [m, m] and composition is similarly defined. It is easy to verify that cod : M → C is a C-functor with the projection π_{1} : [m, n] → [B, D] as strength. Moreover, a strong endofunctor ⟨T, t⟩ : C → C lifts to a strong endofunctor ⟨T^{→}, t^{→}⟩ on M with t^{→}: [m, n] → [T m, T n] the morphism mediating [T A, T C] ←^{t^{∘} π_{0}} [m, n] →^{t^{∘} π_{1}} [T B, T D] in the diagram above.

A strong M-endofunctor is a strong endofunctor T such that the morphism of Cendofunctors T^{∘}cod = cod ^{∘}T^{→}: M → C is a morphism of fibrations.

□

In order to validate the val^{∗} and let^{∗} axioms, we introduce the two-categorical notion of M-cartesian natural transformation. Cat_{M} is a two-category whose 2-cells F ⇒ G are natural transformations σ : F \underrightarrow{.} G making the following diagram commute: writing σ\overrightarrow{m} = (σ_{A}, σ_{B}) for m : A → B ∈ M,

M  F^{→} G^{→}  N σ^{→} F σ  B C  G  cod cod

Definition 4.5.3 Given M-functors F and G, a natural transformation σ : F ⇒ G is called M-cartesian when the components of σ^{→} are catresian.

Unfolding this definition, σ : F \underrightarrow{.} G is called M-cartesian when the naturality diagrams are pullbacks:

σ  Gm σ F m

Examples of M-cartesian natural transformations are the unit of the lifting monad described in 2.5 and that of the state readers monad described in 5.1. A nonexample is the unit of T X = 1.

Proposition 4.5.4 M-cartesian natural transformations are closed under horizontal and vertical composition.

In particular, if ⟨T, t^{T} ⟩ and ⟨S, t^{S}⟩ are strong M-endofunctors with t^{T} and t^{S} Mcartesian, then t^{T S} is also M-cartesian, just by straight composition of pullbacks. The condition that the tensorial strength t of an M-functor T is M-cartesian can be expressed in Evaluation Logic with the following equivalence:

Γ, x : τ ⊢ ϕ prop Γ, y : σ ⊢ ψ prop
□ t^{∗} Γ, x : τ, z : T σ; [y ⇐ z] (ϕ ∧ ψ) ⊣⊢ ϕ ∧ [y ⇐ z] ψ

While the left-to-right entailment holds in any model of the general axioms, □ t^{∗} does not hold, for example, when computations may fail to terminate, since any nonterminating z would make the formula to the left vacuously true. An immediate consequence of □ t^{∗} is:

Γ, z : T τ; [x ⇐ z] ϕ ⊢ ϕ x ∉ F V (ϕ).

When η is M-cartesian, □ val^{∗} is sound. Moreover, ♢ val^{∗} can be derived from □ val^{∗} even in models where □ ⊃ and □ ∀ do not hold. In section 4.1 we remarked that the mono requirement follows from □ val^{∗}. Now we show that, in models satisfying this rule, the components of η are strong monos.

We write f ↓ g, for two arbitrary morphisms f and g in a category C, when they satisfy the following diagonal fill-in property: for all u and v such that v^{∘}f = g^{∘}u, there exists a unique h such that

h u  v fg

The strong monos of C are the monos m such that e ↓ m for all epis e in C. Any equalizer is a strong mono. When η is M-cartesian, its components are equalizers, as shown by the following diagram:

η  T η η ηT

When T is an M-functor and μ is M-cartesian, □ let^{∗} is sound. From □ let^{∗}, □ ⊃ and □ ∀, one can derive ♢ let^{∗}. The property that μ is M-cartesian is expressed in [Mogb] by the axiom □ μ^{∗}, which is an instance of □ let^{∗}. As we shall see in section 5.3, such a property gives to □ a stronger modal flavour: in the formula [x ⇐ M] ϕ, whatever evaluation goes on in ϕ, happens “after” the evaluation of M.

4.6 Monads in the ambient category

Let C be a full reflective subcategory of E, let R ⊣ I be the reflection, with unit ρ and counit ϵ, and let T = ⟨T, η, μ⟩ be a monad on C. The adjunction F^{T} R ⊣ IU^{T} shown in the diagram below defines a monad T̃ on E.

C U T̃ RF T̃ I  E T̃ F^{T} E  ^{C^{T}} K U^{T}

Note that, since I is full, ϵ is invertible, and ϵ_{X}^{−1} = ρ_{X}. The unit of T̃ is η̃ = ηR^{∘}ρ, the multiplication is μ̃ = μR^{∘}T (ρT R)^{−1}, while the counit of the adjunction F^{T} R ⊣ IU^{T} is ϵ̃_{α:T X→X} = α^{∘}T ρ_{X}^{−1} : μ_{RX} → α. The functor K : C^{T} → E T̃ of comparison with algebras is: K(α : T X → X) = IU^{T} ϵ̃_{α} = α^{∘}T ρ_{X}^{−1}. Below we prove that such a functor is half of an adjoint equivalence of categories. This result shows that the extension T̃ of T to the ambient category, which is needed for a standard semantics of Evaluation Logic, is in a sense “minimal.”

Lemma 4.6.1 Any full reflective subcategory C of a category E is closed under retractions. In particular, if A is a retract of some object in C, then ρ_{A} : A ≅ RA.

Proof. Let A →^{a} B →^{b} A = id_{A} with B in C and let k = b^{∘}ρ_{B}^{−1}^{∘}Ra : RA → A. Then:

\begin{matrix}k^{∘}ρ_{A} = b^{∘}ρ_{B}^{−1}^{∘}Ra^{∘}ρ_{A} = b^{∘}ρ_{B}^{−1}^{∘}ρ_{B} ^{∘}a = id_{A} and \\ ρ_{A}^{∘}k = ρ_{A}^{∘}b^{∘}ρ_{B}^{−1}^{∘}Ra = Rb^{∘}Ra = id_{RA}. \end{matrix}

□

Corollary 4.6.2 Let H : J → C and let ν : l \underrightarrow{.} IH be limiting in E; then ρ_{l} is an iso and ν^{∘}ρ_{l}^{−1} : IR l \underrightarrow{.} IH is also a limit in E with vertex in C.

Proof. Let h : IR l → l be mediating for the cone (ρIH)^{−1}^{∘}IRν : IR l \underrightarrow{.} IH as in the diagram.

l ρ_{l}IR l h  IRIH ρIH  (ρIH)^{−1} IH IR ν ν

From ν^{∘}h^{∘}ρ_{l} = (ρIH)^{−1}^{∘}IR ν^{∘}ρ_{l} = ν it follows that h^{∘}ρ_{l} = id_{l}. Then Lemma 4.6.1 applies and IR l ∈ C is a limit for IH. □

Note that lemma 4.6.1 is also a direct consequence of its corollary since sections are limits. In particular, if A →^{a} B →^{b} A = id_{A}, a is a split equalizer of a^{∘}b and id_{B}.

Theorem 4.6.3 Let T be a monad in a category C which is fully reflective in a category E and let T̃ be the extension of T to E obtained as above. The category of T̃-algebras is equivalent to the category of T -algebras and the comparison functor K is the equivalence.

Proof. Let H : E T̃ → C^{T} be the functor mapping α : T RA → A to ρ_{A}^{∘}α and h : α → β to R(h). Note that H(h) = (ρ^{∘}h)†, where ( )† is the natural isomorphism given by R ⊣ I and inverse to ( ^{∘}ρ). We prove the theorem by showing that H is full (i) and faithful (ii) and that every T -algebra α is isomorphic to the H image of the T̃-algebra Kα (iii).

(i) Let α : T RA → A and β : T RB → B be T̃-algebras, and let f : H(α) → H(β) be a morphism of T -algebras. Calling h : A → B the morphism β^{∘}T (f^{∘}ρ_{A})^{∘}η_{A}, a simple calculation shows that ρ_{B} ^{∘}h = f^{∘}ρ_{A} and hence H(h) = (ρ_{B} ^{∘}h)† = (f^{∘}ρ_{A})† = f.

(ii) Let h, k : A → B be a morphisms between T̃-algebras α and β as above and let H(h) = H(k). Since β is a retraction, by lemma 4.6.1 ρ_{B} is an iso. Then, ρ_{B} ^{∘}h = H(h)^{∘}ρ_{A} = H(k)^{∘}ρ_{A} = ρ_{B} ^{∘}k implies h = k.

(iii) Let α : T A → A; the unit ρ_{A} : A → RA, which is an iso because A is in C, lifts to an isomorphism α → HKα of T -algebras. Moreover, it is routine to verify that H is left (and right) adjoint to K, where, for α : T RA → A and β : T B → B, the transpose of f : α → Kβ is f† : RA → B viewed as an algebra morphism Hα → β. □

Next theorem establishes a necessary and sufficient condition for the reflection R of E in C (not necessarily full), and hence for the monad T̃ obtained as described above, to have tensorial strength.

Theorem 4.6.4 Let C be a reflective subcategory of a category E with products, let R be the reflection, with unit ρ, and let T = ⟨T, η, μ⟩ be a monad on C. The monad T̃ defined as above has a tensorial strength if and only if R preserves products.

Proof. (If) This is an immediate consequence of A. Kock’s result in [Koc72], which establishes a one to one correspondence between strengths and monoidal structures for monads over symmetric monoidal closed categories. In particular, if the the natural transformation ξ_{A,B} : RA × RB → R(A × B) is the monoidal structure of R, then r_{A,B} =^{def} ξ_{A,B} ^{∘}(ρ_{A} ×1) is a tensorial strength. However, monoidal functors are not required to preserve the monoidal structure, i.e. ξ need not be an iso, so we have to work in the only if direction.

(Only if) We show that ξ_{A,B} =^{def} μ_{A×B} ^{∘}Rr_{B,A}^{∘}r_{RA,B} : RA × RB → R(A × B) is inverse to the transpose (ρ_{A} × ρ_{B})^{†} of ρ_{A} × ρ_{B} (since I preserves limits, we won’t distinguish between products in C and in E). To show ξ_{A,B} is a right inverse we prove that ξ_{A,B} ^{∘}(ρ_{A}× ρ_{B})^{†}^{∘}ρ_{A×B} = ρ_{A×B}. In fact,

ξ_{A,B} ^{∘}(ρ_{A} × ρ_{B})^{†}^{∘}ρ_{A×B} =
ξ_{A,B} ^{∘}(ρ_{A} × ρ_{B}) =
μ_{A×B} ^{∘}Rr_{B,A}^{∘}r_{RA,B} ^{∘}(1 × ρ_{B})^{∘}(ρ_{A} × 1) =
μ_{A×B} ^{∘}Rr_{B,A}^{∘}ρ_{RA×B} ^{∘}(ρ_{A} × 1) =
μ_{A×B} ^{∘}ρ_{R(A×B)}^{∘}r_{A,B} ^{∘}(ρ_{A} × 1) =
r_{A,B} ^{∘}(ρ_{A} × 1) = ρ_{A×B}.

By a similar chase, ξ_{A,B} is also shown to be a left inverse. Here the fact that (ρ_{A} × ρ_{B})^{†} = ⟨Rπ, Rπ⟩ is also used. □

Note that the property of preserving products is satisfied by interesting known reflections of the effective topos Eff. For example, the category of strictly effective objects in Eff is an exponential ideal (that is X^{Y} is strictly effective for X strictly effective and arbitrary Y) and this is necessary and sufficient condition for a full reflection to preserve products.

Proposition 4.6.5 Let T, T̃, R and ρ be as above. If T has tensorial strength t and R preserves products, T̃ has tensorial strength t̃_{A,B} =^{def} T ξ_{A,B} ^{∘}t_{RA,RB} ^{∘}(ρ_{A} ×1), where ξ is the tensorial structure of the reflection.

The extension of T to the ambient category E presented above has the questionable feature of mapping everything inside C. For example, if T is the identity on C, T̃ is the reflection R, while the identity on E would be a more natural choice. Moreover, when the interpretation described in 4.4 is adopted, T̃ may not have nice interaction with M even if T does. In section 5.2 we adopt a different solution to extend the monad ( × S)_{⊥}^{S} for side effects.

4.7 Standard semantics

There are significant cases in denotational semantics where the interpretation (4.3) of □ described in section 4.4 goes wrong. For example, let T be Plotkin’s powerdomain functor T X = F (X_{⊥}), where F A is the free semilattice over the cpo A. In [Moga], Moggi noticed that this functor fails to map monos to monos and proposed a new semantical framework for interpreting EL, where extra structure is required in the category hosting the logic while less is expected from the monad T over the category hosting programs. We only give a sketchy account of this setting (see [Moga] for details) since the simpler interpretation described above is enough to present our next application. It is assumed that:

• a stable factorization system (E, M) is available in a category E with finite limits;

• cod : E^{→}→ E has a full reflective subfibration q : C → E;

• q↘↙q^{⟶^{T}} is a monad fibred over E.

Via the reflection E^{→}→ C, T is extended to a monad T̃ : E^{→}→ E^{→} fibred over E as done in section 4.6, thus allowing interpretation of computational types in E. However, the above setting is more general, since dependent types are also supported. While describing our notation, we recall the standard interpretation of dependent types in a fibration E^{→}→ E.

Contexts are interpreted as objects of E and we write them as sequences (A, B …) of types. Types Γ ⊢ A type are morphisms (Γ, A) → Γ of E. Terms Γ ⊢ M : A are morphisms M : Γ → (Γ, A) such that A^{∘}M = id . Propositions Γ ⊢ ϕ prop are monos ↣ Γ in M. For the interpretation of val and let , note first that, from a monad T fibred over E, one obtains a strong monad T_{I} in each fibre E/I, and hence a strong monad T_{1} in E ≅ E/1. While the interpretation of val is quite straightforward, some attention must be paid to the binding discipline of let :

Γ ⊢ σ, τ types Γ ⊢ N : T σ Γ, x : σ ⊢ M : T τ
Γ ⊢ let x ⇐ N in M : T τ

The interpretation of let is [[let x ⇐ N in M]] =^{def} μ^{∘}T_{Γ}M′^{∘}N, as in the diagram below:

(Γ, σ, T τ)  (Γ, T τ)  (Γ, T^{2}τ) M′  T τ  T σ T M′ N M T τ  μ  (Γ, T σ) Γ (Γ, σ)  σ

Remark. Note that, while M may “depend” on x, not so its type. This situation can be generalized by assuming an evaluation predicate σ ⟵^{v} (⇐_{σ}) ⟶^{p} T σ as in section 4.8. Then, from a type Γ, x : σ ⊢ τ type , a new type Γ, w : T σ ⊢ Πx ⇐ w. τ type is obtained by pulling back τ along v and then applying ∀_{p}.

□

The factorization system comes in for interpreting □. Different factorization systems may be available in a category C and each choice may allow interpretation of different logical features. For example, the regular monos in the category of ω-sets have a classifier 1 → ∇2, which allows interpretation of higher order quantification. Below we provide the relevant definitions and sketch the interpretation of □.

Definition 4.7.1 A factorization system in a category C is a pair (E, M) of classes of morphisms of C such that: (A) both contain all isos and are closed under composition and (B) all morphisms in C are uniquely (up to isomorphism) of the form m^{∘}e for m ∈ M and e ∈ E. A factorization system is called stable if pullbacks of m^{∘}e, for m ∈ M and e ∈ E, factorize into m′^{∘}e′ as below:

e  m m′ e′

On factorization systems see [FK72] and the more recent [CJKP94]. As in [FK72], we

write H^{↑} =^{def} {e in C | ∀ h ∈ H. e ↓ h} and H^{↓} =^{def} {m in C | ∀ h ∈ H. h ↓ m}, for H a class of

morphisms in C and f ↓ g as in section 4.5. Proposition 4.7.4 gives an alternative view of factorization systems.

Definition 4.7.2 A prefactorization system in a category C is a pair (E, M) of classes of morphisms of C such that E = M^{↑} and M = E^{↓}.

Lemma 4.7.3 A factorization system is a prefactorization system.

Proof. First we show that, for all e ∈ E and m ∈ M, e ↓ m. Let v^{∘}e = m^{∘}u and let u = A ⟶^{e′} U ⟶^{m′} C and v = B ⟶^{e′′} V ⟶^{m′′} D be their factorizations. Then m^{∘}m′^{∘}e′ and m′′^{∘}e′′^{∘}e are both factorizations of the same morphism and hence there must be an isomorphism ϕ : V → U making the appropriate diagrams commute. It is routine to verify that m′′^{∘}ϕ^{∘}e′ : B → C is an appropriate diagonal fill-in morphism. The above shows that E ⊆ M^{↑} and M ⊆ E^{↓}. To see that M^{↑} ⊆ E, take f ∈ M^{↑} and write it f = m^{∘}e; m has an inverse to fill in the square m^{∘}e = id ^{∘}f. Hence f ∈ E because of 4.7.1.(A). Similarly for E^{↓} ⊆ M. □

Proposition 4.7.4 (E, M) is a factorization system in C if and only if it is a prefactorization system and all morphisms in C are of the form m^{∘}e for some m ∈ M and e ∈ E.

Proof. The “only if” half of this follows immediately from the lemma. In the other direction, it is easy to see that E and M in a prefactorization system satisfy 4.7.1.(A). Moreover, if a factorization f = m^{∘}e exists for any f in C, it must be essentially unique. In fact, from a square m^{∘}e = m′^{∘}e′, one obtains two opposite fill-in diagonals which are easily shown to be each other’s inverse. □

Remember that a monomorphism (epimorphism) is called regular when it is an equalizer (coequalizer). A category is called regular when it has finite limits, coequalizers and pullbacks of regular epis are regular epis. If m is a regular mono, e ↓ m for any epi e. In general, the converse does not hold, that is, elements of (regular monos)^{↑} need not be epis. Same thing for monos and regular epis. However, it is the case that:

Proposition 4.7.5 Regular epis and monos form a stable factorization system (E_{R}, M) in a regular category.

Proof. Let m^{∘}u = v^{∘}e for m : A → B a mono and e : C → D the coequalizer of f and g. The fill-in diagonal is the mediating morphism D → A obtained from u^{∘}f = u^{∘}g.

Then we only have to show that any f has a factorization f = m^{∘}e for some m ∈ M and e ∈ E_{R}, as the uniqueness follows from the fill-in property. Let (h, k) be the kernel pair of f and let e : B → D be their coequalizer. Since f^{∘}h = f^{∘}k, we obtain a mediating m such that f = m^{∘}e. Let (u, v) be the kernel pair of m. It is easy to show that, since e is epi, so is the mediating g : A → C; then, from u^{∘}g = v^{∘}g we get u = v and hence m is a mono. □

Note that the class M of a (proper) factorization system in E is a class of admissible monos and it extends to one fibred over E. A mono m ∈ M_{Γ,X} is a morphism in the fibre C/Γ and so is ⟶^{T m} T X. Define □_{Γ,X}m ∈ M_{Γ,T X} to be the image of T m.

Remark. It would be interesting to rephrase the above semantics in terms of an arbitrary fibration, using comprehension categories or, alternatively, locally small fibrations.

4.8 Evaluation relations

In the previous section we saw that a general standard semantics of the evaluation modality □ requires a category with a stable factorization system. We also saw that the proposed standard interpretation of ♢ requires structure to support higher order quantification. When such structure is available, an evaluation relation (a ⇐_{A} w) over A × T A can be defined from □ as in 4.5. However, given evaluation relations, only first order structure is needed to define □ and ♢:

[x ⇐ w] ϕ(x) =^{def} ∀ x : A. x ⇐ w ⊃ ϕ(x)  (4.6)
⟨x ⇐ w⟩ ϕ(x) =^{def} ∃ x : A. x ⇐ w ∧ ϕ(x)  (4.7)

Categorically, this corresponds to having a monic pair A ⟵^{p_{1}} (⇐_{A}) ⟶^{p_{2}} T A and defining □ϕ as ∀_{p_{2}}(p_{1}^{∗}ϕ) and ♢ϕ as ∃_{p_{2}}(p_{1}^{∗}ϕ).

When □ and ♢ are defined as above, all the axioms for strong endofunctors of section 4.1 are derivable, from the rules of first order predicate calculus. Then, we observe that there are cases, for example when working in a logos [FS90, 1.7], in which □ and ♢ can be defined from ⇐ but not vice versa.

Remark. Definitions (4.6) and (4.7) sometimes fail to yield the “expected” modalities. For example, let T be the monad for dynamic allocation of section 2.5, where (a ⇐ w) is read “w represents the value a after a few allocations,” and new : T (Loc ) is an operation for creating new locations. While there is no value l : Loc such that l ⇐ new , ⟨x ⇐ new ⟩ true holds for a ♢ defined as in [Mogb, example 4.11].

□

In section 4.4, we also observed that, given an evaluation relation and rules for the modalities in left and right form, such as □ left and □ right , inferences about modal formulae are easier than by using the rules in section 4.1, where each modality is related separately with each logical operator. The example was the derivation of ♢ ∨. Note that □ left and □ right are derivable for □ defined as in (4.6).

The above observations suggest that evaluation relations may yield both semantic and proof-theoretic benefits: a more general standard semantics and a more manageable proof system. A denotational account of evaluation could also allow a systematic approach to the study of computational adequacy.

In most cases there is an obvious evaluation relation associated with each notion of computation. Here are some examples (for the monad of dynamic allocations, described in 2.5, we write σ_{k}^{n} : k → F^{n}k for the morphisms σ_{k}^{0} = id_{k} and σ_{k}^{n+1} = σ_{F^{n}k}^{∘}σ_{k}^{n}):

Notion of computation  T A  a ⇐ z
exceptions  A + E  inl (a) = z
side effects  (A × S)^{S}  ∃ s_{1}, s_{2}. z(s_{1}) = ⟨a, s_{2}⟩
nondeterminism  P(A)  a ∈ z
dynamic allocation  (T A)k = ∑_{n:N} A(F^{n}k) z_{k} = (n, Aσ_{k}^{n}(a_{k}))

Given an endofunctor T : C → C, evaluation relations can be obtained from first order structure as follows. Assuming a lifting monad ⟨( )_{⊥}, θ⟩ (see 2.5) in C,

a ⇐_{A} z =^{def} ∀ f : A → A_{⊥}. (T f)z = (T θ)z ⊃ ∃ x : A. fx = θa.  (4.8)

For all monads mentioned above, this formula produces the expected evaluation relation. The purpose of the lifting is to have “enough” morphisms f over which to quantify, even in degenerate cases such as A = 1.

Remark. If the mono requirement is satisfied (see 2.3), the above ⇐ satisfies the axiom a ⇐ val (a). If □ is defined by (4.6), formulae such as □ let (4.1) can be derived from a ⇐ let (f, z) ⊃ ∃ x. x ⇐ z ∧ a ⇐ fx.

□

Below we show the conditions under which (4.8) is equivalent to (4.5). Let ϕ : X ↣ A; we adopt the interpretation [x ⇐ w] ϕ =^{def} ∃ z : T X. (T ϕ)z = w.

Theorem 4.8.1 If T preserves pullbacks of the unit θ of the lifting monad, then (4.5) implies (4.8).

Proof. Let f : A → A_{⊥}, and let ϕ be the domain of f:

X  A ϕ  θ A  f  A_{⊥}

Assuming (T f)w = (T θ)w, there exists z : T X such that (T ϕ)z = w:

w T A  T A T θ T A_{⊥} T f 1 w T ϕ z T X

Then, from (4.5), ϕ(a) holds and, therefore, there exists an x : A such that fa = θx:

X  Aθ A  f  A_{⊥} ϕ 1  x a

□

Theorem 4.8.2 If the unit θ of the lifting monad classifies all predicates of the logic, (4.8) implies (4.5).

Proof. Let ϕ be a predicate on A and let f be the transpose of the partial map [ϕ, ϕ] : A ⇀ A, that is:

ϕ X  A ϕ  θ A  f  A_{⊥}

Assuming [x ⇐ w] ϕ, that is a z such that (T ϕ)z = w, one has:

(T f)w = (T f)(T ϕ)z = (T θ)(T ϕ)z = (T θ)w

and hence, from (4.8), there exists x : A such that fx = θa. Then, a factorizes through ϕ because:

ϕ X  Aθ A  f  A_{⊥} x  a ϕ 1
□

5 Application: partial correctness

Partial correctness specifications are statements involving programs and assertions about their states. A well known example of a formal calculus based on such specifications is Hoare Logic (HL), which gives an intuitive grasp of simple while-programs.

To deal with more elaborate forms of computation than expressed by while-programs, HL requires some alteration. For instance, expressions of the programming language can be admitted inside assertions in so far as they are free from computational phenomena such as nontermination, side effects or exceptions. This “mathematical purity” is violated by many common programming devices such as function procedures, or block expressions.

In the block expression begin C result E, for example, the command C may fail to terminate, in which case the value of the whole expression is undefined, or it may modify variables which are not local to it. As for E, it may try to divide a number by zero, which may raise some exception. All such cases invalidate Reynolds’ approach to program specification and are in fact proscribed in [Rey81]. Tennent [Ten91] admits possibly undefined expressions in the assertion language by introducing atomic formulae, such as Kleene equalities, “localizing” the effects of nontermination. Still, it is not clear how meaningful a reasoning can be carried out in the style of Hoare triples with partial expressions.

As for expressions with side effects, noninterference specifications must be introduced for reasoning about assignments. The problem, here, is that assertions may change the state in which expressions are evaluated, as in the following instance of the assignment axiom: {begin b := false result ¬b} b′:= ¬b {begin b := false result b′}, which is false in all states where b is true. To prevent this, assertions should not interfere with the value of the expression being assigned, that is, in the example above, (b := false )#¬b. Sophisticated semantic tools must be used for languages with block structure to correctly validate equivalences of programs involving nonlocal variables: possible world semantics ([OT92,OT93]) provides a safe barrier to affecting nonlocal states.

For more than two decades Hoare Logic has been adapted to cope with a variety of computational features, including procedures, local variables, gotos and parallelism (see [Apt81]). Most of the proposed variations have the flavour of ad hoc solutions: every time a new set of proof rules and axioms are proposed to give an account of a programming construct, new semantics and new proofs of soundness must be found, most of the time from scratch. Such a painstaking process can be simplified and made more systematic by basing the logic on an abstract notion of computation.

In chapter 1 we argued that Moggi’s approach to denotational semantics based on monads supports a modular view of computation ([Mog90b,Wad92,CM93,Cen94]). The problem of finding robust theories of computation, that is to find sets of proof rules and axioms capable of surviving modifications to the semantics, can be addressed in the formal framework of Evaluation Logic, which is based on Moggi’s monadic approach. Still, we must first understand if, in this framework, simple things can be done in a simple fashion. With this goal in mind, we set EL to work on partial correctness.

In section 5.1 we study the interaction between the monad T X = (X×S)_{⊥}^{S} to interpret possibly nonterminating computations with side effects and a class of admissible monos M to interpret formulae. We give appropriate closure conditions on M to guarantee a natural behaviour of formulae with respect to substitution and we validate axioms to be used later on. In section 5.2 we adopt the semantic setting of section 4.6, where a strong monad T is defined on a category C “of predomains,” which is fully reflective in an ambient category E “of sets.” We look for the abstract properties such models should have in order to validate the axioms introduced in section 5.1. In particular, we establish sufficient conditions for the monad T X = (X × S)_{⊥}^{S}, which we assume defined in C, to extend directly to E, without using the reflection, as proposed in 4.6. It would be interesting to see whether other variations of the side-effects monad, e.g. the ones involving Phoa and Taylor’s synthetic version of Plotkin powerdomains, would support a similar extension.

Then we consider a different set of axioms, proposed by Pitts in [Pit91], where EL’s evaluation modalities have a stronger modal flavour. In section 5.3 we present a translation of this calculus, which we call ELse, into EL making implicit state variables visible. Using the results of 5.1 we show that the constants employed in this translation are defined for a large class of models and that theorems are translated into theorems.

In section 5.4 we show that Hoare Logic translates very naturally in ELse without committing to any of HL’s assumptions as to the computational behaviour of expressions. Again, all theorems in HL are shown to be derivable in ELse. Moreover, the translation extends to annotated programs, that is programs which syntactically include assertions such as loop invariants, thus supporting Floyd-Hoare’s method of inductive assertions (see [Hes92]) which is of practical importance in proofs of correctness. In 5.5 we develop a full proof of correctness for a textbook example of a while-program for integer division using, besides the axioms previously introduced, Scott induction. Section 5.6 discusses the admissibility of this principle.

5.1 Nontermination and side effects

State readers. First we consider simple computations of the form QA =^{def} A^{S}, which we call state readers. Note that, if M is a class of admissible monos, m ∈ M need not imply m^{X} ∈ M. For example, taking as M the class of Scott-opens in the category of cpos and η : N → N_{⊥} the property of being defined, η^{N} is the nonobservable predicate “f is total” on partial continuous functions.

Lemma 5.1.1 Let S be an object in a category C such that ( )×S ⊣ ( )^{S}. For all objects A in C, there is an adjunction π^{∗} ⊣ ∀_{s} : C/A ⇀ C/A × S. In particular, ∀_{s}f ≅ η^{∗}f^{S} for η the unit A → (A × S)^{S}, and vice versa f^{S} ≅ ∀_{s}ϵ^{∗}f, where ϵ is the evaluation map.

Lemma 5.1.2 Let M ⊆ M′ be classes of admissible monos both with S-products, and let ∀_{s} and ∀s^{′} be the respective families of quantifiers. If m ∈ M then ∀_{s}m ≅ ∀s^{′}m.

The above is an instance of a well known more general result, the absoluteness of indexed products (see [HP89, proposition 2.8]).

Theorem 5.1.3 Let a class of admissible monos M have S-products ∀_{S}. For m ∈ M, m^{S} ≅ ∀_{s}ϵ^{∗}m ∈ M and Q =^{def} ( )^{S} is an M-functor.

Proof. ( )^{S} preserves limits because it is a right adjoint, so it is enough to show that m^{S} ∈ M if m ∈ M. By lemma 5.1.1, there is an adjunction π^{∗} ⊣ ∀s^{′} : MA^{′} ⇀ M′_{A×S}, where M′ is the class of all monos in C, and m^{S} ≅ ∀s^{′}ϵ^{∗}m. Therefore, since M ⊆ M′, by lemma 5.1.2, m^{S} ≅ ∀_{s}ϵ^{∗}m ∈ M. □

Breaking into the structure of state readers, we can express □ and computational lifting for Q-computations in terms of ∀ and λ. Later we employ such axioms to validate properties of more complex computations built from Q.

\begin{aligned}& Γ, x : X ⊢ ϕ(x) prop \\ □ Q & Γ, r : QX; ∀ s. ϕ(r(s)) ⊣⊢ [x ⇐ r]_{Q} ϕ(x) \end{aligned}

x : A ⊢ e(x) : B
let Q  r : QA ⊢ let x ⇐ r in [e(x)] = λ s. e(r(s))

Lifting. Let ( )_{⊥} be a lifting monad defined from a class of admissible monos N as described in section 2.5. Like Q above, ( )_{⊥} preserves monos, but m ∈ N need not imply m_{⊥} ∈ N. A counterexample is m : 0 → 1 when N is the class of Scott-opens. However, the class of admissible monos M that we consider for interpreting the logic will contain, in general, more than domains of admissible partial functions and should not be confused with the class N of such domains from which ( )_{⊥} is defined. We will assume N ⊆ M. Theorem 5.1.8 establishes a sufficient condition on a class of admissible monos M to make ( )_{⊥} an M-functor.

Lemma 5.1.4 Let f : B → A be a map in C. If f^{∗} ⊣ ∀_{f} : C/A ⇀ C/B, then the exponential y^{f} is defined for all y in C/A and y^{f} ≅ ∀_{f}f^{∗}y.

Proof.

{x ⟶ ∀_{f}f^{∗}y \atop f^{∗}x ⟶ f^{∗}y} ; x ×_{A} f = f^{∘}f^{∗}x ⟶ y

□

Lemma 5.1.5 Let m : B → A be a mono. If the exponential y^{m} is defined for all y in C/A, then m^{∗} ⊣ ∀_{m} : C/A ⇀ C/B and ∀_{m}f ≅ (m^{∘}f)^{m}.

Proof.

{x ⟶ (m^{∘}f)^{m} \atop x ×_{A} m = m^{∘}m^{∗}x ⟶ m^{∘}f} ; m^{∗}x ⟶ f

□

Lemma 5.1.6 If a lifting monad ⟨( )_{⊥}, η⟩ is defined in a category C with pullbacks, then η_{A}^{∗} ⊣ ∀_{η_{A}} : C/A_{⊥} ⇀ C/A. In particular, for f : B → A, ∀_{η_{A}}f = χ(η_{B}, f) = f_{⊥}.

Lemma 5.1.7 Lifting preserves pullbacks.

Proof. Let Z = X ×_{A} Y be the vertex of the pullback of f along g, and let h : W → X_{⊥} and k : W → Y_{⊥} be such that f_{⊥}^{∘}h = g_{⊥}^{∘}k. The mediating W → Z_{⊥} is obtained from the obvious mediating W′ → Z, where W′ = (h^{∗}η_{X}) ×_{W} (k^{∗}η_{Y}). □

Theorem 5.1.8 Let a class of admissible monos M and a lifting monad ⟨( )_{⊥}, η⟩ be defined in C, and let the components of η be in M. If M has M-products, ( )_{⊥} is an M-functor.

Proof. Let m : B ↣ A in M. By lemma 5.1.6, ∀_{η_{A}} : C/A ⇀ C/A_{⊥} exists and m_{⊥} = ∀_{η_{A}}m. By lemma 5.1.4, η_{A}-powers exist in C/A_{⊥}, and, by lemma 5.1.5, we have (η_{A}^{∘}m)^{η_{A}} ≅ ∀_{η_{A}}m = m_{⊥}. But the exponential (η_{A}^{∘}m)^{η_{A}} in C/A_{⊥} must also be exponential in M_{A_{⊥}}, hence m_{⊥} ∈ M by hypothesis. Lemma 5.1.7 finishes the job. □

Theorem 5.1.9 Let M be a class of admissible monos in C with M and S-products. The strong endofunctor ( × S)_{⊥}^{S} is an M-functor and hence □_{A,B} : M_{A×B} → M_{A×T B} commutes with substitution.

Proof. Since ( × S) is an M-functor for any M, the result follows from Theorem 5.1.3, Theorem 5.1.8 and from the fact that M-functors compose. □

Cartesian units. Now we consider a family of monads suitable for interpreting computations with side effects. If T is a strong monad, one can model T -computations with side effects using the monad FT = T ( × S)^{S}. For example, we just showed that ( × S)_{⊥}^{S} is an M-functor by showing that F preserves M-functors and that ( )_{⊥} is one. We shall procede similarly to show that ( × S)_{⊥}^{S} validates the axiom □ val^{∗} (see section 4.1). We believe that one obtains greater insight into a notion of computation from an analysis of constructors such as F above than from the study of the corresponding monad in isolation.

Below we use EL to address the elements of a class of admissible monos M defined in a category with a strong endofunctor T. If ϕ ∈ M, T ϕ is written [x ⇐ z] ϕ(x). Similarly, a restricted form of the computational metalanguage can be used when only a strong endofunctor (rather than a monad) is available on C; in this case, T (f) is written let x ⇐ z in val(f(x)). When several such endofunctors are involved, we decorate the above operations with indices. For example:

[x ⇐ z]_{T Q} ϕ(x) ≅ [y ⇐ z]_{T} [x ⇐ y]_{Q} ϕ(x)
let_{T Q} x ⇐ z in val_{T Q}(e) = let_{T} y ⇐ z in val_{T} (let_{Q} x ⇐ y in val_{Q}(e)).

The condition that the unit of a monad T is M-cartesian is expressed in EL by the equivalence [x ⇐ val_{T} (x)]_{T} ϕ(x) ≅ ϕ(x). For example, let T be ( )^{S}, from □ Q we have: [x ⇐ val(x)] ϕ(x) ≅ ∀ s. ϕ((λ s. x)s) ≅ ∀ s. ϕ(x) ≅ ϕ(x). Here we assumed that S is not empty. Lemma 5.1.6 shows that the unit of ( )_{⊥} is also cartesian and hence, to get the result for ( × S)_{⊥}^{S}, we only have to show:

Theorem 5.1.10 F preserves monads with cartesian units.

Proof. Splitting FT into its components and spelling out the □ modalities for Q =^{def} ( )^{S} and R =^{def} ( × S) as shown above:

[x ⇐ z]_{FT} ϕ(x) ≅ [w ⇐ z]_{Q} [y ⇐ w]_{T} [x ⇐ y]_{R} ϕ(x) ≅ ∀ s. [x, s′ ⇐ z(s)]_{T} ϕ(x)

Then, writing val_{FT} (x) as λ s. val_{T} (x, s) and assuming T satisfies □ val^{∗}, we have:

[x ⇐ val(x)] ϕ(x) ≅ ∀ s. [x, s′ ⇐ (λ s. val_{T} (x, s))s]_{T} ϕ(x)
≅ ∀ s. [x, s′ ⇐ val_{T} (x, s)]_{T} ϕ(x) ≅ ∀ s. ϕ(x) ≅ ϕ(x)

□

Next we show that lifting preserves cartesian closed structure in the fibres. This is more precisely stated below, in the corollary to the following more general:

Theorem 5.1.11 Let ⟨( )_{⊥}, η⟩ be a lifting monad in C and let the exponential x^{y} be defined in C/A; then (x_{⊥})^{y_{⊥}} is defined in C/A_{⊥} and (x^{y})_{⊥} ≅ (x_{⊥})^{y_{⊥}}.

Proof. We show that there exists an isomorphism C(z, (x^{y})_{⊥}) ≅ C(z, (x_{⊥})^{y_{⊥}}), natural in z:

{z ⟶ (x^{y})_{⊥} ≅ ∀_{η_{A}}(x^{y}) \atop η_{A}^{∗}z ⟶ x^{y}} ; η_{A}^{∗}z × y ⟶ x ; η_{A}^{∘}(η_{A}^{∗}z × y) ⟶ η_{A}^{∘}x ; (η_{A}^{∘}η_{A}^{∗}z) × y_{⊥} ⟶ η_{A}^{∘}x ; η_{A} × (z × y_{⊥}) ≅ (η_{A} × z) × y_{⊥} ⟶ η_{A}^{∘}x ; z × y_{⊥} ⟶ (η_{A}^{∘}x)^{η_{A}} ≅ x_{⊥} ; z ⟶ (x_{⊥})^{y_{⊥}}

□

Corollary 5.1.12 Let a class of admissible monos M and a lifting monad ⟨( )_{⊥}, η⟩ be defined in C, and let the components of η be in M. If M has M-products, then (m^{n})_{⊥} ≅ (m_{⊥})^{n_{⊥}}, for m and n in the same M-fibre.

Note that the equivalence established in the above corollary can be expressed in EL as follows (a similar axiom also holds for ( × S)):

Γ, w : X_{⊥}; [x ⇐ w]_{⊥} (ϕ ⊃ ψ) ⊣⊢ [x ⇐ w]_{⊥} ϕ ⊃ [x ⇐ w]_{⊥} ψ

Part “⊢” of the above axiom holds for ( )_{⊥}-computations but not all interpretations of T validate it; for example, it does not hold for nondeterministic computations.

5.2 Side effects in the ambient category

Combining the synthetic domain theory view of domains as sets with Moggi’s view of monads as notions of computation, one gets a scenario for denotational semantics where a strong monad T is defined on a category C of predomains which is fully reflective in a category E of sets. In section 4.6 we showed that T can always be extended to a monad T̃ = T R : E → E, where R is the reflection, so that the respective categories of algebras are equivalent. Moreover, under mild conditions T̃ also has a tensorial strength.

However, assuming a class M of monos to interpret predicates in E, the interpretation of EL described in 4.1 requires T̃ to interact nicely with M. For example, T̃ should preserve monos in M; when T is the identity functor, this amounts to R preserving monos and this need not happen in general.

Example. Given an element q of a poset Q, let [q] =^{def} {x | x ≤ q or q ≤ x}. Consider the functor R : Poset → Set mapping a poset Q into the set {[q] | q ∈ Q} of maximal subsets of connected elements. It is immediate to verify that R is a full reflection. Let 2 be the vertical two-element poset and 2 the horizontal one. There is a mono m : 2 → 2 in Poset but no monos R2 = 2 → 1 = R2 in Set . So R cannot preserve monos.

□

We conclude that, to make the interpretation 4.3 work in the general case, additional conditions are required to make T̃ behave properly, such as R preserving finite limits (although something milder would be enough). Here we consider a simpler solution where T̃ is essentially the same functor as T, thus making the results established in section 5.1 directly applicable to T̃. Note, however, that similar constructions may not be available for all T. There is a natural T̃ =^{def} ( × S)_{⊥}^{S} in E which restricts to T in C. We show that each piece of the structure of T can be found in E extending the corresponding structure in C.

First, the inclusion C ↪ E preserves binary products because it is a right adjoint; assuming that R preserves binary products too, the inclusion also preserves exponentials; in fact, let A and B be in C and let B^{A} be their C-exponential; then:

\begin{matrix}E(X, B^{A}) ≅ C(RX, B^{A}) ≅ C(RX × A, B) ≅ C(RX × RA, B) ≅ \\ C(R(X × A), B) ≅ E(X × A, B). \end{matrix}

So, the only problem in taking T̃ = ( × S)_{⊥}^{S} is to find a suitable lifting monad to extend ⟨( )_{⊥}, η⟩.

Lemma 5.2.1 Let ⟨R, I, ρ⟩ : E ⇀ C be a reflection of a category E into its full subcategory C and let t : 1 → Σ be a dominance in C. If R preserves pullbacks of t, then t is a dominance in E.

Proof. We have to show that t is generic in a class of Σ-subobjects in E closed under composition. Without loss of generality we assume t = Rt. Let m = h^{−1}t = k^{−1}t. Since R preserves pullbacks of t, both Rh and Rk classify Rm, so Rh = Rk and hence h = k. This shows that t is generic. Let m = f^{−1}t : C → B, n = g^{−1}t : D → C and let h be the unique morphism whose transpose h^{†} classifies Rn^{∘}Rm. Since the squares describing naturality of ρ on n and m are pullbacks, it must be n^{∘}m = h^{−1}t, which makes n^{∘}m a Σ-subobject. □

Let t be a dominance in C; ⟨( )_{⊥}, η⟩ is defined in C iff t^{∗} ⊣ ∀_{t} : C/Σ ⇀ C. However, if, for example, E is locally cartesian closed, such an adjunction is also defined in E, as follows from lemma 5.1.5.

Theorem 5.2.2 Let ⟨R, I, ρ⟩ : E ⇀ C be a reflection of a category E in its full subcategory C and let ⟨( )_{⊥}, η⟩ be a lifting monad in C. If the reflection preserves pullbacks of t = η_{1} and the reindexing functor along t has right adjoint ∀_{t} : E → E/Σ, then ⟨( )_{⊥}, η⟩ extends to a lifting monad on E.

Proof. By lemma 5.2.1, t is a dominance in E. Then ∀_{t} provides each object of E with classifiers of partial maps whose domains are Σ-subobjects. So we have to check that, for every object A of C, η_{A} is a Σ-partial map classifier in E. Let (m, f) : B ⇀ A be a Σ-partial map, and let f^{†} be the transpose of f as in the diagram.

B C  RmRC RB  A A_{⊥} m  η_{A} ρ^{B} ρ_{C}  f^{†} χ(Rm, f^{†})

Since R preserves pullbacks of t, Rm is a Σ-subobject in C. Let χ(Rm, f^{†}) : RB → A_{⊥} classify (Rm, f^{†}) in C; it is easy to verify that, since the square describing naturality of ρ on m is a pullback, χ(Rm, f^{†})^{∘}ρ_{B} classifies (m, f) in E. □

5.3 Assertions

We now have a semantic setting in which to interpret a theory of the Evaluation Logic for possibly nonterminating programs with side effects and we know that substitution and □ val^{∗} hold in this setting. However, there is something “modal” to reasoning about while-programs with Hoare-triples that makes Hoare-like logics particularly intuitive and which is not captured by the above semantics.

If we want formulae to be interpreted “in a state,” like assertions in Hoare Logic, we must adopt a nonstandard interpretation of EL, as in [Pit91], where formulae with a free variable of type X are interpreted as predicates over X × S, for S the interpretation of states. Then, modelling computations on X as partial maps S ⇀ (X × S), we can give the following set theoretic interpretation of the evaluation modalities ([Pit91]), where side effects are “passed” across the brackets (compare it with the corresponding equations in section 4.1):

[[w : T X ⊢ [x ⇐ w] φ assert ]] = {w, s | ∀ x, s′. ws = (x, s′) ⊃ φ(x, s′)}
[[w : T X ⊢ ⟨x ⇐ w⟩ φ assert ]] = {w, s | ∃ x, s′. ws = (x, s′) ∧ φ(x, s′)}

Here, we adopt as primitive calculus Moggi’s version of the Evaluation Logic, EL ([Mogb]), which is based on a standard semantics, and derive inference rules for a calculus of assertions to be used in reasoning about programs without explicit reference to the states of computation. In the derived calculus of assertions, which we call ELse, the evaluation modalities have the above intuitive meaning. ELse is essentially the Evaluation Logic proposed by Pitts in [Pit91] with a few special constants to get hold of simple imperative programming constructs. We shall call “assertions” the formulae of ELse and “propositions” those of EL.

ELse. ELse has the same syntax as EL. The term language is the computational lambda calculus over a signature Σ which includes: the type Int of integers with the usual arithmetical operations; the type Bool of booleans with the usual boolean operations and the conditional cond_{X} : Bool → X → X → X; the operations up_{l} : Int → T 1 and ct_{l} : T (Int ) respectively of memory update and lookup; a fixed point operator rec : (T 1 → T 1) → T 1, with the fixed point property rec (M) = M(rec (M)). Intuitively, the program up_{l}(n) assigns value n to the memory location l, while the computation ct_{l} returns the value in l. For these operators we adopt the axioms given in [Pit91]. Simple while-programs can be translated into the computational metalanguage over Σ as shown in section 5.4. The inference rules of ELse include all general and special axioms of section 4.1, with empty Δ in □ intro and ♢ intro . Hence, ELse extends the calculus in [Pit91] to include all operators of first order predicate calculus.

Notational conventions. We let e_{1}; e_{2} stand for let x ⇐ e_{1} in e_{2} when x is not free in e_{2}. Similarly, when p : T 1, we drop the dummy z in [z ⇐ p] θ and write [p] θ instead. When no confusion arises, we shall informally use logical variables as names for locations. So, if x⃗ = x_{1}, … x_{n}, we write [x⃗ ⇐ ct ] θ for the formula [x_{1} ⇐ ct_{x_{1}}] … [x_{n} ⇐ ct_{x_{n}}] θ and let x⃗ ⇐ ct in e for let x_{1} ⇐ ct_{x_{1}} in (… (let x_{n} ⇐ ct_{x_{n}} in e) …). Finally, we simply write up (x⃗) for up_{x_{1}}(x_{1}); … up_{x_{n}}(x_{n}).

Examples. An example to illustrate the different meaning of necessity in ELse and EL is the judgement [u ⇐ ct_{x}] u ≥ 0 ⊢ [up_{x}(−1)] [u ⇐ ct_{x}] u ≥ 0, which is derivable from □ intro in EL, but false in ELse, where □ intro is subject to the restriction mentioned above. Conversely, ⊢ [up_{x}(1)] [u ⇐ ct_{x}] u ≥ 0 is derivable in ELse but false in EL, since □ let^{∗}, which is an axiom in ELse, is not sound under the interpretation (4.3) of EL when the μ of the monad T is not M-cartesian. Note that already the monad ( )^{S} fails to satisfy this axiom.

Translating assertions into propositions. Assertions Γ ⊢ φ assert translate into propositions Γ, s : S ⊢ ([φ])_{s} prop , where ([φ])_{s} may contain a free variable s. All theorems in ELse are shown to be derivable in EL once the invisible state variables have been made explicit.

As suggested in [Mogb], there is an obvious way of “simulating” ELse’s modalities in EL in the case of computations with side effects: the idea is to implement propagation of states across formulae manually, via two constants h : S → T 1 and k : T S. Intuitively, the program h(s) updates the current state with s, while k is the computation that returns the current state as value. Such gadgets are defined, for example, for all monads in the family F of section 5.1, which includes models for partial and nondeterministic computations with side effects. Let H be an arbitrary monad and let T =^{def} FH = H( × S)^{S}. Then, h(s) =^{def} val_{QH}(∗, s) = λ s′. val_{H}(∗, s) and k =^{def} λ s. val_{H}(s, s). For the two constants h and k we assume the following special axioms: let skip be the trivial program val(∗) : T 1,

Ax 1 h(s); k = h(s); val(s)
Ax 2 let s ⇐ k in h(s) = skip
□ h [x ⇐ (let y ⇐ w in (h(s); z))] ϕ ⊢ [y ⇐ w] [x ⇐ h(s); z] ϕ
□ k Γ ⊢ [s ⇐ k] ϕ ; = ; Γ, s : S ⊢ ϕ

Proposition 5.3.1 Ax 1/2 □ h and □ k are valid for all monads of the family F.

Proof. Again we use EL as the internal logic of a category where the functor R =^{def} ( ×S) and the monads H and Q =^{def} ( )^{S} are defined. We only show the argument for Ax 1, as for the others a similar routine is repeated. h(s); val(s) = let_{QHR} x ⇐ h(s) in val_{QHR}(s) = let_{QH} y ⇐ val_{QH}(∗, s) in val_{QH}(let_{R} x ⇐ y in val_{R}(s)) = val_{QH}(let_{R} x ⇐ ⟨∗, s⟩ in val_{R}(s)) = val_{QT}⟨s, s⟩ = val_{Q}((λ s′. val_{T}(s′, s′))s) = let_{QHR} x ⇐ val_{QH}(∗, s) in λ s′. val_{T}(s′, s′) = h(s); k.

□

Let K : T X → T (X × S) be the operator

K(w) =^{def} (let x ⇐ w in (let s ⇐ k in val(x, s))).

Intuitively, K runs the computation w and returns the final state as part of the result. An assertion Γ ⊢ φ assert in ELse is translated into a proposition Γ, s : S ⊢ ([φ])_{s} prop in EL as follows:

([e_{1} = e_{2}])_{s} =^{def} e_{1} = e_{2}
([φ ∧ ϑ])_{s} =^{def} ([φ])_{s} ∧ ([ϑ])_{s} (and similarly for all other first order connectives)
([ [x ⇐ w] φ])_{s} =^{def} [x, s′ ⇐ h(s); K(w)] ([φ])_{s′}

Proposition 5.3.2 If Γ; Δ ⊢ ϕ is a theorem in ELse, Γ, s : S; ([Δ])_{s} ⊢ ([ϕ])_{s} is a theorem in EL with □ val^{∗}, Ax 1/2, □ h and □ k.

Proof. All axioms in ELse can be translated and derived in El. Here we show a derivation of the axiom (□ let^{∗}), which best illustrates the differences between the two logics of assertions and of propositions. From Ax 2 and □ h the following sequent is derivable:

Lm K [x ⇐ (let y ⇐ w in z)] ϕ ⊢ [y, s ⇐ K(w)] [x ⇐ h(s); z] ϕ.

Then:

([ [y ⇐ (let x ⇐ z in w)] φ])_{s}
[y, s_{1} ⇐ h(s); K(let x ⇐ z in w)] ([φ])_{s_{1}}

[y, s_{1} ⇐ h(s); let y_{1} ⇐ (let x ⇐ z in w) in let s_{2} ⇐ k in [y_{1}, s_{2}]] ([φ])_{s_{1}}

[y, s_{1} ⇐ (let x ⇐ (h(s); z) in K(w))] ([φ])_{s_{1}}
\overline{(Lm K)}
[x, s_{2} ⇐ K(h(s); z)] [y, s_{1} ⇐ h(s_{2}); K(w)] ([φ])_{s_{1}}
[x, s_{2} ⇐ h(s); K(z)] [y, s_{1} ⇐ h(s_{2}); K(w)] ([φ])_{s_{1}}
([ [x ⇐ z] [y ⇐ w] φ])_{s}

□

Note that a slightly stronger version of the axioms in [Pit91] can be derived in EL. Consider the axiom:

Γ, x : X; Δ, φ ⊢ ψ
□ intro Γ, w : T X; Δ, [x ⇐ w] φ ⊢ [x ⇐ w] ψ  (x ∉ FV (Δ), Δ state-free)

In [Pit91] Δ must be empty, as usually happens in modal logics. This condition can be explained in our setting by noticing that one thing the modality does, as is clear from the above definition of ([ [x ⇐ w] φ])_{s}, is to bind a hidden state variable implicitly free in φ and ψ. Hence such a variable should not be free in Δ, that is, Δ should be independent of the state. One easy way to meet such condition is by requiring that Δ contains no modalities. That’s how we shall read the side condition of □ intro and how we shall use it in section 5.5.

The following proposition is an immediate consequence of 5.1.10, 5.2.2, 5.3.1 and 5.3.2.

Proposition 5.3.3 Models of the form F(H), where the unit of H is cartesian, support a standard interpretation of ELse.

5.4 Partial correctness

Partial correctness can be expressed by using an operation tr mapping annotated programs to assertions. An elementary annotated program is a pair (p, θ), where the assertion θ is understood as a postcondition of p : T 1. Intuitively, tr (p, θ) is the weakest liberal precondition of p satisfying θ, which is expressed in ELse by the formula [p] θ. This can be extended to a simple form of annotated programs Q obtained by alternating programs and assertions:

Q ::= nil | (p, θ); Q

In particular, (skip , θ); Q is an annotated program that starts with an assertion and Q; (p, true ) is one that ends with a program. The function tr is defined as follows:

tr (nil )  = true
tr ((p, θ); Q) = [p] (θ ∧ tr (Q)).

Intuitively, tr (Q) is satisfied by all states s such that all assertions in Q are true when they are reached during the execution of Q in s.

Annotation may provide valuable information for proving correctness. For example, the following derivable rule infers ζ ⊢ tr ((p, θ); Q) from ζ ⊢ tr (p, θ) and θ ⊢ tr (Q). Such a rule is used in 5.5 and referred to as TR Trans:

{ζ ⊢ tr (p, θ) \atop ζ ⊢ [p] θ}  {θ ⊢ tr (Q) \atop ⊢ θ ⊃ tr (Q)} ; ⊢ [p] (θ ⊃ tr (Q))
ζ ⊢ [p] (θ ∧ tr (Q))
ζ ⊢ tr ((p, θ); Q)

Given an input condition θ and an annotated program Q, we say partial correctness specifications are statements of the form θ ⊃ tr (Q). This echoes the usual view of Hoare triples in modal frameworks, where {ϑ}P {ζ} is interpreted as ϑ ⊃ [P] ζ (see, for example, the account of Hoare Logic in the modal mu-calculus given in [BS92]). Note also that, as one would expect in such contexts, the above formula can be converted into a statement of total correctness by changing [p] into ⟨p⟩ in the definition of tr .

Next we translate Hoare triples involving programs of a while-language into statements of partial correctness in ELse and show that all theorems of Hoare Logic translate into theorems of ELse.

Hoare Logic’s assertion language is a first order language L with equality (see [Apt81]). In the following we take L to be Peano arithmetic with minus. It will be convenient to assume that variables of L are variables of ELse, so that ϑ ∈ L is also an assertion in ELse.

Terms of type X in L are translated into terms of type T X of ELse by a family of functions ([ ])_{Γ}, indexed by (integer) contexts Γ = x_{1} : Int , … x_{n} : Int .

([x])_{Γ} = ct_{x}  if x ∉ dom (Γ)
([x])_{Γ} = [x]  if x ∈ dom (Γ)
([n])_{Γ} = [n]
([t_{1} + t_{2}])_{Γ} = let x ⇐ ([t_{1}])_{Γ} in let y ⇐ ([t_{2}])_{Γ} in [x + y]
([absurd ])_{Γ} = absurd
([t_{1} = t_{2}])_{Γ} = [x ⇐ ([t_{1}])_{Γ}] [y ⇐ ([t_{2}])_{Γ}] x = y and similarly for ≤, ≥, >, and <
([ϕ ∧ ψ])_{Γ} = ([ϕ])_{Γ} ∧ ([ψ])_{Γ}  and similarly for ∨ and ⊃
([∀x.ϕ])_{Γ} = ∀x.([ϕ])_{Γ,x}  and similarly for ∃.

The translation enforces EL’s disciplined interaction between logic and computation on HL. Logical and program variables, which are distinct in EL but not in HL, are separated, thus making explicit that bit of “computation” which is going on in HL’s assertions: reading the memory. A possibly open ϑ ∈ L is translated into a closed assertion ([ϑ]) in which free variables x are replaced by constants state readers ct_{x} whereas bound variables are treated as genuine logical variables.

Example. The assertion x = y holds of all states where locations x and y contain the same value. However, ∀ x. x = y requires the content of y to be equal to any integer x. Our translation distinguishes between logical and program variables as follows:

\begin{matrix}([x = y]) = & [u ⇐ ct_{x}] [v ⇐ ct_{y}] u = v \\ ([∀ x. x = y]) = & ∀ u. [v ⇐ ct_{y}] u = v \end{matrix}

□

The language W of while-programs, is the least class of programs such that:

• for every variable x ∈ Ide and L-term t, x := t ∈ W;

• if C, C_{1} and C_{2} ∈ W, then C_{1}; C_{2} ∈ W and, for every quantifier-free formula B ∈ L,

     if B then C_{1} else C_{2} and while B do C od ∈ W.

A while-program P is translated into a closed ELse-term ([P]) of computational type T 1 as follows (we omit the subscripts Γ):

([x := t]) = let x ⇐ ([t]) in up_{x}(x)
([C_{1}; C_{2}]) = ([C_{1}]); ([C_{2}])
([if B then C_{1} else C_{2}]) = let b ⇐ ([B]) in cond (b, ([C_{1}]), ([C_{2}]))
([while B do C od]) = rec (λ p : T 1. (let b ⇐ B in cond (b, ([C]); p , skip ))).

Note that here B is parsed as a boolean expression.

In the next section we prove the correctness of a program for integer division. This program is annotated with a loop invariant, which provides a guideline for the proof. Simple annotated while-programs of the form (C_{1}{ϑ_{1}}; C_{2}{ϑ_{2}} …), obtained by alternating commands with assertions, translate straightforwardly into annotated programs ((([C_{1}]), ([ϑ_{1}])); (([C_{2}]), ([ϑ_{2}])) …). This is not yet satisfactory since annotations should also be allowed, for example, in the body of while-loops. To handle this situation, the logic should be extended with recursive definitions of predicates, but we shall forgo this pleasure for the moment.

Hoare triples translate straightforwardly into partial correctness specifications in ELse:

{ϑ}P {ζ} =^{def} ([ϑ]) ⊃ tr ([P {ζ}])

Lemma 5.4.1 For all L-terms t with free variables y⃗, x⃗, ([t])y⃗ = let x⃗ ⇐ ct in [t]. For all formulae ϑ(y⃗, x⃗) ∈ L, ([ϑ])y⃗ ⊣⊢ [x⃗ ⇐ ct ] ϑ.

Lemma 5.4.2 (Substitution) Let ϑ(x) and t be in L. ([ϑ(t)])_{Γ} ⊣⊢ [x ⇐ ([t])_{Γ}] ([ϑ(x)])_{Γ,x}.

Proposition 5.4.3 If {ϑ}P {ζ} is a theorem in Hoare Logic, ([ϑ]) ⊢ tr ([P {ζ}]) is derivable in ELse.

Proof. As an example, we show the derivation of the axiom for assignment:

{ϕ(t)}x := t{ϕ(x)}.

For simplicity we assume that x is the only free variable in ϕ. The proof is presented in a natural deduction style and it makes use of the derivable judgement Lm 3: Γ; ϕ ⊢ [up_{y}(x)] [x ⇐ ct_{y}] ϕ (ϕ state-free) from section 5.5.

([ϕ(t)])
\overline{by lemma 5.4.2}
[x ⇐ ([t])] ([ϕ(x)])_{x}
\overline{by lemma 5.4.1}
[x ⇐ ([t])] ϕ(x)
\overline{by Lm 3}
[x ⇐ ([t])] [up_{x}(x)] [x ⇐ ct ] ϕ(x)
[let x ⇐ ([t]) in up_{x}(x)] [x ⇐ ct ] ϕ(x)
\overline{by lemma 5.4.1}
[([x := t])] ([ϕ(x)])
tr ([x := t {ϕ(x)}])
□

5.5 Integer division

Here we consider a classic textbook example, a partial correctness specification {ϑ}P {ζ} of a while-program for integer division. We translate such specification in ELse as shown in section 5.4 and derive it in the calculus of assertions. In fact, we derive a stronger version ([{ϑ}P′{ζ}]), where P′ is obtained by annotating P with a loop invariant.

Besides TR Trans introduced above, we use the following special axioms for cond , up and ct :

Γ; Δ, b = true ⊢ ϕ(M) Γ; Δ, b = false ⊢ ϕ(N)

\overline{Cond}

Γ; Δ ⊢ ϕ(cond (b, M, N))

Γ ⊢ [x ⇐ ct_{y}] ϕ
= Ct Up
Γ, x : X ⊢ [up_{y}(x)] ϕ

Moreover, in reasoning about while-loops, we use Scott-induction:

Γ; Δ ⊢ ϕ(↑) Γ, p : T 1; Δ, ϕ(p) ⊢ ϕ(M(p))
Ind  Γ; Δ ⊢ ϕ(rec (M))  (ϕ inductive in p)

where ↑ stands for the always diverging program rec (λ p. p). The side condition of Ind asks for fixed-point admissibility: since our predicates (and assertions) are arbitrary subsets of domains, not all formulae Γ, x : X ⊢ ϕ prop are suitable for fixed-point induction on x. In section 5.6 we give a criterion for establishing the side condition; we show that admissibility of a proposition ϕ can often be checked via syntactic analysis of ϕ (similarly for assertions) and prove the soundness of the proposed algorithm.

The following derivable sequents are used in the proof below:

Lm 1 Γ; Δ, [x ⇐ w] (ϕ ⊃ ψ) ⊢ [x ⇐ w] ϕ ⊃ [x ⇐ w] ψ
Lm 2 Γ, w : T X; ϕ ⊢ [x ⇐ w] ϕ  (x ∉ FV (ϕ), ϕ state-indep.)
Lm 3 Γ; ϕ ⊢ [up_{y}(x)] [x ⇐ ct_{y}] ϕ  (ϕ state-indep.)
Lm 4 Γ; Δ, [up_{y}(x)] ϕ ⊣⊢ [up_{y}(x)] [x ⇐ ct_{y}] ϕ

5. Application: partial correctness 139 These are the definitions of P, P′, θ, ζ and their translation in ELse:

{ϑ}P {ζ} =^{def} {x ≥ 0 ∧ y ≥ 0}P {a · y + b = x ∧ b ≥ 0 ∧ b < y}
P =^{def} b := x; a := 0 ; while b ≥ y do b := b − y; a := a + 1 od
ξ =^{def} a · y + b = x ∧ b ≥ 0
P′ =^{def} b := x; a := 0 ; {ξ}; while b ≥ y do b := b − y; a := a + 1 od
([{ϑ}P {ζ}]) ≡ ([x, y ⇐ ct ] ϑ) ⊃
[let x ⇐ ct_{x} in up_{b}(x) ; up_{a}(0) ; rec (λp : T 1. let b, y ⇐ ct in
cond (b ≥ y,

let b, y ⇐ ct in up_{b}(b − y) ; let a ⇐ ct_{a} in up_{a}(a + 1) ; p,

skip ))] [x, y, a, b ⇐ ct] ξ ∧ b < y
([{ϑ}P′{ζ}]) ≡ ([x, y ⇐ ct ] ϑ) ⊃
tr ((let x ⇐ ct_{x} in up_{b}(x) ; up_{a}(0) , [x, y, a, b ⇐ ct] ξ) ;
(rec(…) , [x, y, a, b ⇐ ct] ξ ∧ b < y))
≡ ([x, y ⇐ ct ] ϑ) ⊃
[z ⇐ (let x ⇐ ct_{x} in up_{b}(x) ; up_{a}(0))] (([x, y, a, b ⇐ ct] ξ) ∧
[w ⇐ rec(…)] [x, y, a, b ⇐ ct] ξ ∧ b < y)

We derive the above formula in natural deduction style, which allows greater compactness. Some obvious steps are omitted.

1. since ϑ ⊃ (0 · y + x = x ∧ x ≥ 0) is a tautology: [up_{b}(x); up_{a}(0)] (ϑ ⊃ (0 · y + x = x ∧ x ≥ 0))

2. from 1: ([up_{b}(x); up_{a}(0)] ϑ) ⊃ [up_{b}(x); up_{a}(0)] 0 · y + x = x ∧ x ≥ 0

3. since θ is state-independent, from 2: ϑ ⊃ [up_{b}(x); up_{a}(0)] 0 · y + x = x ∧ x ≥ 0 5. Application: partial correctness 140

4. from 3: [x, y ⇐ ct ] (ϑ ⊃ [up_{b}(x); up_{a}(0)] 0 · y + x = x ∧ x ≥ 0)

5. from 4: ([x, y ⇐ ct ] ϑ) ⊃ [x, y ⇐ ct ] [up_{b}(x); up_{a}(0)] 0 · y + x = x ∧ x ≥ 0

6. from 5: ([x, y ⇐ ct ] ϑ) ⊃ [x, y ⇐ ct ] [up_{b}(x); up_{a}(0)] [a, b ⇐ ct] ξ

7. from 6: ([x, y ⇐ ct ] ϑ) ⊃ [let x ⇐ ct_{x} in up_{b}(x); up_{a}(0)] [x, y, a, b ⇐ ct] ξ

8. since [↑] absurd is a tautology, obtain Φ(↑) ≡ ([x, y, a, b ⇐ ct ] ξ) ⊃ [↑] [x, y, a, b ⇐ ct] ξ ∧ b < y

9. since b < y ⊃ (ξ ⊃ (ξ ∧ b < y)) is a tautology: [up (x, y, a, b)] (b < y ⊃ (ξ ⊃ (ξ ∧ b < y)))

10. from 9: [up (x, y, a, b)] (b < y ⊃ (ξ ⊃ [skip ] [x, y, a, b ⇐ ct] ξ ∧ b < y))

11. from 10: ([up (x, y, a, b)] b < y) ⊃ [up (x, y, a, b)] (ξ ⊃ [skip ] [x, y, a, b ⇐ ct] ξ ∧ b < y)

12. since b < y is state-independent, from 11 obtain b < y ⊃ Ψ(skip ) ≡ b < y ⊃ [up (x, y, a, b)] (ξ ⊃ [skip ] [x, y, a, b ⇐ ct] ξ ∧ b < y)

13. assume Φ(p) ≡ ([x, y, a, b ⇐ ct ] ξ) ⊃ [p] [x, y, a, b ⇐ ct] ξ ∧ b < y

14. from 13: [up_{b}(b − y); up_{a}(a + 1)] (([x, y, a, b ⇐ ct ] ξ) ⊃ [p] [x, y, a, b ⇐ ct] ξ ∧ b < y)

15. since (b ≥ y ∧ ξ(x, y, a, b)) ⊃ ξ(x, y, a + 1, b − y), by Lm 3: (b ≥ y ∧ ξ) ⊃ [up (x, y); up_{b}(b − y); up_{a}(a + 1)] [x, y, a, b ⇐ ct ] ξ 5. Application: partial correctness 141

16. from 14 and 15: (b ≥ y ∧ ξ) ⊃ ([up (x, y); up_{b}(b − y); up_{a}(a + 1)] (([x, y, a, b ⇐ ct ] ξ) ⊃ [p] [x, y, a, b ⇐ ct] ξ ∧ b < y) ∧ [up (x, y); up_{b}(b − y); up_{a}(a + 1)] [x, y, a, b ⇐ ct ] ξ)

17. from 16: (b ≥ y ∧ ξ) ⊃ [up (x, y); up_{b}(b − y); up_{a}(a + 1); p] [x, y, a, b ⇐ ct] ξ ∧ b < y

18. from 17: [up (x, y, a, b)] (b ≥ y ⊃ (ξ ⊃ [up_{b}(b − y); up_{a}(a + 1); p] [x, y, a, b ⇐ ct] ξ ∧ b < y))

19. since b ≥ y is state-independent, from 18: b ≥ y ⊃ [up (x, y, a, b)] (ξ ⊃ [up_{b}(b − y); up_{a}(a + 1); p] [x, y, a, b ⇐ ct] ξ ∧ b < y)

20. from 19 obtain b ≥ y ⊃ Ψ(let …) ≡ b ≥ y ⊃ [up (x, y, a, b)] (ξ ⊃ [let b, y ⇐ ct in up_{b}(b − y); let a ⇐ ct_{a} in up_{a}(a + 1); p] [x, y, a, b ⇐ ct] ξ ∧ b < y)

21. from 12 and 20, by Cond obtain Ψ(cond (…)) ≡ [up (x, y, a, b)] (ξ ⊃ [cond (b ≥ y, let b, y ⇐ ct in up_{b}(b − y); let a ⇐ ct_{a} in up_{a}(a + 1) ; p, skip ))] [x, y, a, b ⇐ ct] ξ ∧ b < y

22. from 21, by Ct Up [x, y, a, b ⇐ ct ] (ξ ⊃ [cond (b ≥ y, let b, y ⇐ ct in up_{b}(b − y); let a ⇐ ct_{a} in up_{a}(a + 1) ; p, skip ))] [x, y, a, b ⇐ ct] ξ ∧ b < y 5. Application: partial correctness 142

23. from 22: ([x, y, a, b ⇐ ct ] ξ) ⊃ [x, y, a, b ⇐ ct ] [cond (b ≥ y, let b, y ⇐ ct in up_{b}(b − y); let a ⇐ ct_{a} in up_{a}(a + 1) ; p, skip ))] [x, y, a, b ⇐ ct] ξ ∧ b < y

24. from 23 obtain Φ(M(p)) ≡ ([x, y, a, b ⇐ ct ] ξ) ⊃ [let b, y ⇐ ct in cond (b ≥ y, let b, y ⇐ ct in up_{b}(b − y); let a ⇐ ct_{a} in up_{a}(a + 1) ; p, skip )] [x, y, a, b ⇐ ct] ξ ∧ b < y

25. by Ind, from 8 and 13… 24 obtain Φ(rec (M)) ≡ ([x, y, a, b ⇐ ct ] ξ) ⊃ [rec (λp : T 1. let b, y ⇐ ct in cond (b ≥ y, let b, y ⇐ ct in up_{b}(b − y); let a ⇐ ct_{a} in up_{a}(a + 1) ; p, skip ))] [x, y, a, b ⇐ ct] ξ ∧ b < y

26. from 7 and 25, by TR Trans: ([x, y ⇐ ct ] ϑ) ⊃ tr ((let x ⇐ ct_{x} in up_{b}(x) ; up_{a}(0) , [x, y, a, b ⇐ ct] ξ) ; (rec(…) , [x, y, a, b ⇐ ct] ξ ∧ b < y)).

□

5.6 Inductive formulae

Scott-induction was used in section 5.5 to prove properties of while loops. Here we establish a sufficient syntactic condition on formulae ϕ(x) to ensure their admissibility for fixed-point induction on x. In view of theorem 5.6.1, this condition can be expressed as x ∉ free_{−}(ϕ), where the set free_{−} is defined, together with its dual free_{+}, as follows:

free_{−}(absurd ) = ∅
free_{−}(t_{1} ≤ t_{2}) = ∅  and similarly for ≥, >, <, and =
free_{−}(ϕ ∧ ψ) = free_{−}(ϕ) ∪ free_{−}(ψ)  and similarly for ∨
free_{−}(ϕ ⊃ ψ) = free_{+}(ϕ) ∪ free_{−}(ψ)
free_{−}(∀x. ϕ) = free_{−}(ϕ) − {x}
free_{−}(∃x. ϕ) = free (ϕ) − {x}
free_{−}([x ⇐ t] ϕ) = free_{−}(ϕ)  if x ∉ free_{−}(ϕ)
= free_{−}(ϕ) ∪ free (t) − {x} otherwise
free_{+}(absurd ) = ∅
free_{+}(t_{1} ≤ t_{2}) = ∅  and similarly for ≥, >, <, and =
free_{+}(ϕ ∧ ψ) = free_{+}(ϕ) ∪ free_{+}(ψ)  and similarly for ∨
free_{+}(ϕ ⊃ ψ) = free_{−}(ϕ) ∪ free_{+}(ψ)
free_{+}(∀x. ϕ) = free (ϕ) − {x}
free_{+}(∃x. ϕ) = free_{+}(ϕ) − {x}
free_{+}([x ⇐ t] ϕ) = free (ϕ) ∪ free (t) − {x}

In the following theorem we take cpos as our domains. However, the proof also goes through in the context of models of synthetic domain theory. e.g. with extensional PERs, adopting the appropriate notion of ω-chain.

Theorem 5.6.1 Let Γ, x : X ⊢ ϕ be a formula in EL. A. If x ∉ free_{−}(ϕ), then, for all u ∈ [[Γ]] and ω-chains ⟨d_{n}⟩, if [[ϕ]](u, d_{i}) for all d_{i} in ⟨d_{n}⟩, then [[ϕ]](u, ⊔⟨d_{n}⟩).

B. If x ∉ free_{+}(ϕ), then, for all u ∈ [[Γ]] and ω-chains ⟨d_{n}⟩, if [[ϕ]](u, ⊔⟨d_{n}⟩), then [[ϕ]](u, d_{i}) for some d_{i} in ⟨d_{n}⟩.

Proof. We just discuss the interesting cases: implication and necessity. Assume x ∉ free_{−}(ϕ ⊃ ψ), that is, x ∉ free_{+}(ϕ) and x ∉ free_{−}(ψ). Let ⟨d_{n}⟩ be an ω-chain such that [[ϕ ⊃ ψ]](d_{i}) for all d_{i} ∈ ⟨d_{n}⟩. Assume [[ϕ]](⊔⟨d_{n}⟩). Since x ∉ free_{+}(ϕ), it must be [[ϕ]](d_{i}) for infinitely many d_{i} in ⟨d_{n}⟩, otherwise, pruning such elements from ⟨d_{n}⟩, one would get a subchain with the same l.u.b. and with no elements satisfying [[ϕ]]. So, there is a subchain ⟨c_{n}⟩ of ⟨d_{n}⟩ all elements of which satisfy [[ϕ]]. Then, by the assumption, [[ψ]](d_{i}) for all d_{i} in ⟨c_{n}⟩, and hence, since x ∉ free_{−}(ψ), ⊔⟨c_{n}⟩ = ⊔⟨d_{n}⟩ satisfy [[ψ]]. This shows that [[ϕ ⊃ ψ]](⊔⟨d_{n}⟩).

The definition of free_{−}([x ⇐ z] ϕ) says that, if ϕ is ω-inductive in x, then [x ⇐ z] ϕ is ω-inductive in z; also, if ψ(x, y) is ω-inductive in x, then [y ⇐ z] ψ(x, y) is ω-inductive in x. We show the first of these statements. Assume ∀s. ϕ(z_{i}(s)) holds for all z_{i} in the ω-chain ⟨z_{n}⟩, show that ∀s. ϕ(⊔⟨z_{n}⟩s) holds. For an arbitrary s̄, all elements of ⟨z_{n}(s̄)⟩ satisfy ϕ by hypothesis; then, since ϕ is ω-inductive in x, ϕ(⊔⟨z_{n}(s̄)⟩) = ϕ(⊔⟨z_{n}⟩s̄) must hold. □

Remark. Theorem 5.6.1 improves a similar one in [Ten91]. In particular, it allows formulae such as ¬(¬(x ⊑ 7)), rejected in [Ten91], to be recognized as admissible.

Remark. In the above proof we used the interpretation of necessity as in EL, rather than as in ELse. This is in fact the worse case, since it involves a quantification over states and, hence, x ∉ free_{+}(ϕ) implies neither x ∉ free_{+}([y ⇐ z] ϕ) nor z ∉ free_{+}([y ⇐ z] ϕ). However, such quantification disappears in ELse and hence the admissibility conditions for fixed-point induction are more liberal for assertions than for formulae.

5. Application: partial correctness 145 Remark. In view of the last remark, we conclude that theorem 5.6.1 validates the use of Scott induction in section 5.5, since p ∉ free_{−}(Φ(p)).

6 Semantic constructors

In this chapter we present and develop the theory of semantic constructors (see chapter 1), which were introduced by E. Moggi in [Mog90a,Mog91c] with the intention of achieving a modular approach to the study and development of denotational semantics.

To what extent can different notions of computation be studied in isolation? Which properties do models produced by a constructor retain of the models from which they are constructed and upon which properties are they conservative? We address these questions in the first two sections of this chapter. In the rest, we discuss the syntactic presentation of constructors, a technique introduced in [CM93], and relate the power of constructors with that of the metalanguages that are used to present them syntactically.

A direct method for presenting a constructor is to produce structure for interpreting one metalanguage from structure for interpreting another. In the next chapter, we develop applications where constructors for exceptions and resumptions are presented in this fashion by using the Extended Calculus of Constructions as metalanguage.

Here, we focus on an indirect method, where constructors are presented in a purely syntactical fashion as translations of metalanguages. In general, a translation L_{2} → L_{1} of formal languages yields, contravariantly, a relative interpretation Mod (L_{1}) → Mod (L_{2}) mapping models of one language into models of the other [KR77]. This situation extends to logical theories, where it is understood that theorems of one theory are translated into theorems of the other. For example, given a strong monad in a category C, a translation ML_{T} → ML_{T} gives a recipe to construct a new strong monad on C.

For some logics, a dual construction is also available. Let L_{1} and L_{2} be theories expressed in universal Horn clauses ([Kea75]). Such theories can be viewed as categories th (L_{i}) with finite limits (lex categories) in the same way as categories with finite products provide views of algebraic theories where no distinction is made between primitive and derived operations. In fact, this is the basic idea of categorical logic:

“a logical theory has an intrinsic existence independent of its presentation, and this existence is best represented by a category” ([See82]).

In this framework, one speaks of “functorial semantics” because interpretation of a theory L in a category C with appropriate structure is viewed as a structure-preserving functor th (L) → C. A well known result of P. Gabriel and F. Ulmer ([GU75]) states that any filtered colimit-preserving functor Mod (L_{1}) → Mod (L_{2}) with a left adjoint arises as relative interpretation from a lex functor th (L_{2}) → th (L_{1}) and hence from a translation L_{2} → L_{1}. The natural question is whether a similar duality can be established for theories of the computational metalanguage and whether a sufficiently rich class of constructors Mod (Σ_{1}) → Mod (Σ_{2}) can be obtained from translations ML_{T} (Σ_{2}) → ML_{T} (Σ_{1}).

In the setting of Gabriel-Ulmer duality, translations and interpretations live in the same category (of lex categories) and relative interpretation is studied as composition. To mimic this situation, we need a presentation-independent view of a theory ML_{T} (Σ) as an object of Mod (Σ). A natural candidate would be the syntactic category T (Σ) described in section 2.4. This category has a canonical strong monad and canonical Σ structure. Moreover, interpretation of ML_{T} (Σ) in a Σ-model (C, T, A) corresponds to a morphism ([[ ]], id ) = T (Σ) → (C, T, A) in Mod (Σ). However, interpretations and structure preserving functors do not coincide: since interpretation requires [[T τ]] = T [[τ]], morphism ([[ ]], σ) : T (Σ) → (C, T, A) correspond to interpretations only when σ = id .

This suggests that, in order for translations to capture interesting constructors, a more powerful syntax must be used than that of the computational metalanguage. For example, the constructor for resumptions (FT)X =^{def} μY. T (X + Y) that we present in the next chapter needs inductive types, which cannot be axiomatized in ML_{T} (Σ). The examples that we present in this chapter are written in HML, an expressive type theory, similar to the one in [Mog91a], in which the computational metalanguages can be easily axiomatized. We give an intrinsic characterization of the constructors that can be presented in HML. This characterization generalizes to presentations in any formal language whose models are described by finite limit theories; examples are the simply typed and the higher order polymorphic lambda calculi.

Synopsis. In section 6.1 we define the category Mod (Σ) of models of ML_{T} (Σ) introducing the notion of Σ-homomorphism (not in Moggi’s presentation). In 6.2 we introduce semantic constructors and we investigate the properties of a particular class of them, called “pointed.” Examples of such constructors are the ones for exceptions, resumptions, interactive input and output. In particular, we determine a class of equations preserved by pointed constructors (theorem 6.2.5) and one whose equations are reflected (that is, a sublanguage of ML_{T} (Σ) over which pointed constructors are conservative; theorem 6.2.7). Preservation of equations is also addressed in [Mog90b]. Our treatment differs from Moggi’s in that the latter considers a more restricted class of constructors and puts more constraints on the metalanguage (viz. lambda abstraction only on constant types). In section 6.3 we present HML and, in 6.4, we use it to present a rather powerful constructor that can be specialized to capture models of several forms of computation. Most of the material presented 6.3 and 6.4 is from [CM93] and we claim no originality there. After introducing the basic ideas of functorial semantics in section 6.5, we investigate the properties of categories of models of HML theories in 6.6 and 6.7. The class of syntactic constructors corresponding to HML translations is characterized in 6.8.

6.1 Categories of Σ-models

In section 2.4 we defined a suitable notion of signature for a typed lambda calculus L(Σ) and a notion of Σ-model, that is, a category in which the relevant structure is singled out. Some of the structure may be defined by universal properties and we called “additional” all the rest. It is reasonable to expect that models form a 2-category Mod (Σ) whose 1-cells are functors preserving the universal structure, while additional requirements (see example below) may be appropriate to relate the additional structure.

Example. Strong monad morphisms (C, T) → (D, S) were defined in section 2.2 as pairs (U : C → D, σ : UT \underrightarrow{.} SU) where the functor U preserves the universal structure of C in D, while the natural transformation σ relates the monads T and S with suitable diagrams.

□

Here we describe categories of models of computational metalanguages ML_{T} (Σ), whose objects we shall henceforth call Σ-models and whose morphisms are strong monad morphisms with extra conditions relating Σ-structures. In the next section the semantic constructors of the modular approach are introduced as natural maps between categories of models.

Defining morphisms between Σ-models is not straightforward because the usual mixed variance problem gets in the way of relating the Σ structure of the two models. In fact we must restrict signatures as shown below. (The notions of type scheme, polytype etc. were defined in section 2.4.)

A polytype is called computationally positive (negative) when it contains no negative (positive) occurrences of the type constructor T (we shall usually drop the word “computationally”. More formally: 1, K ∈ Σ_{τ} and X ∈ χ are both positive and negative polytypes; if τ_{1} and τ_{2} are both positive (negative), so is τ_{1} × τ_{2}; if τ_{1} is negative (positive) and τ_{2} is positive (negative), τ_{1} → τ_{2} is positive (negative); if τ is positive, so is T τ. For example, (T (K → T X) → X) → T X is positive, while T X → T X is neither positive nor negative. It is easy to verify that a polytype is both positive and negative if and only if it contains no occurrences of T.

Positive (negative) polytypes are not closed under “indiscriminate” substitution. As in section 6.2 we need a closure result, we characterize well behaved substitution in Lemma 6.1.1.

A type variable is said to “occur positively (negatively)” in a polytype according to the following rules: X occurs neither positively nor negatively in τ if it does not occur in τ; X occurs positively in X; X occurs positively (negatively) in τ_{1} × τ_{2} if it occurs positively (negatively) in τ_{1} or in τ_{2} or in both; X occurs positively in τ_{1} → τ_{2} if it occurs positively in τ_{2} or negatively in τ_{2} or both; X occurs negatively in τ_{1} → τ_{2} if it occurs negatively in τ_{2} or positively in τ_{2} or both; X occurs positively (negatively) in T τ if it occurs positively (negatively) in τ.

Let σ and τ be polytypes. We say that the substitution [σ/X]τ is sign-preserving when σ is positive if X occurs positively in τ and σ is negative if X occurs negatively (hence σ must be both when X occurs both ways). We call sign-reversing the obvious converse.

Lemma 6.1.1 Sign-preserving substitution preserves positive polytypes; sign-reversing substitution preserves negative polytypes.

Proof. Let α, β and γ range over the symbols + and −, to be read as “positive” and “negative,” and let ᾱ be the complement of α. We write (αβγ) for the statement “if τ is α, X occurs β-ly in τ and σ is γ, then [σ/X]τ is α.” We show the cases (+++), (−−+), (+ − −) and (− + −) by induction on τ.

For τ = 1 and τ = K ∈ Σ_{τ} all four cases hold trivially. For τ = X, (+ + +) holds because [σ/X]X is positive for positive σ, while the other cases hold trivially because their hypotheses are not satisfied. For τ = τ_{1} × τ_{2}, each statement holds because, using the inductive hypothesis, the same statement must hold for τ_{1} and τ_{2}. For τ = τ_{1} → τ_{2}, (αβγ) holds because, using the inductive hypothesis, (αβγ) must hold for τ_{2} and (ᾱβ̄γ) must hold for τ_{1}. For τ = T τ_{1}, (+++) and (+−−) hold because, by inductive hypothesis, identical statements must hold for τ_{1}, while the other cases hold trivially because their hypotheses are not satisfied. □

Let Σ_{τ} be a collection of constant type symbols. Let C and D be cartesian closed categories and let both have a Σ_{τ}-structure and an endofunctor, respectively T : C → C and S : D → D. Σ_{τ}-polytypes are interpreted in C and D from the above data. Let U : C → D be a functor preserving the universal and Σ_{τ} structure. We make the simplifying assumption that U does so on the nose, although this is not crucial for the development of the theory. In particular, this means that U[[K]] = [[K]] for all K in Σ_{τ} (all type constants but T are nullary in ML_{T} (Σ)). Given a natural transformation σ : UT \underrightarrow{.} SU, we associate with every computationally positive (negative) polytype τ(X_{1}, … X_{n}) and type assignments A_{1}, … A_{n} in C a morphism

σ^{+}(τ) : U[[τ]]_{A_{1},...A_{n}} → [[τ]]_{UA_{1},...UA_{n}}

(σ^{−}, with opposite direction, for negative τ) as follows: writing Uτ for U[[τ]]_{A_{1},...A_{n}}, τU for [[τ]]_{UA_{1},...UA_{n}}, σ_{τ} for σ_{[[τ]]_{A_{1},...An}} and (_{=})^{( )} : C^{op} × C → C for the functor mapping (A, B) to B^{A},

σ^{±}1 = id_{1}
σ^{±}X_{i} = id_{UA_{i}}
σ^{±}K = id_{[[K]]}
σ^{±}(τ_{1} × τ_{2}) = σ^{±}(τ_{1}) × σ^{±}(τ_{2})
σ^{+}(τ_{1} → τ_{2}) = σ^{+}(τ_{2})^{σ^{−}(τ_{1})} = λ f : Uτ_{1} → Uτ_{2}. σ^{+}(τ_{2})^{∘}f^{∘}σ^{−}(τ_{1})
σ^{−}(τ_{1} → τ_{2}) = σ^{−}(τ_{2})^{σ^{+}(τ_{1})} = λ f : τ_{1}U → τ_{2}U. σ^{−}(τ_{2})^{∘}f^{∘}σ^{+}(τ_{1})
σ^{+}(T τ) = S(σ^{+}(τ))^{∘}σ_{τ}

Proposition 6.1.2 Let U and σ be as above. If a polytype τ is both positive and negative, U[[τ]] = [[τ]]U and σ^{+}(τ) = σ^{−}(τ) = id .

Proof. By induction on τ, For example: if τ_{1} → τ_{2} is both positive and negative, so must be, by a simple argument, also τ_{1} and τ_{2}; hence σ^{+}(τ_{1} → τ_{2}) = σ^{−}(τ_{1} → τ_{2}) = id^{id} = id .

□

Σ-structures can be related in a simple diagrammatical way if they are restricted to positive type schemes, that is, type schemes involving only positive polytypes. Since this is the case in most examples of operations associated with notions of computation, we will henceforth restrict our signatures to include only operations with positive schemes. At the end of this section we discuss some nonexamples.

Definition 6.1.3 A Σ-homomorphism (C, T, A) → (D, S, B) between Σ-models is a strong monad morphism (U, σ) : (C, T) → (D, S) such that U preserves the Σ_{τ} structure on the nose and, for all op : ∀X_{1}, … X_{n}. τ_{1}, … τ_{m} ⟶ τ in Σ_{ϵ} and type assignments A_{1}, … A_{n}, the following diagram commutes:

U[[τ_{1}]]_{A_{1},...A_{n}} × … U[[τ_{m}]]_{A_{1},...A_{n}} [[τ_{1}]]_{UA_{1},...UA_{n}} × … [[τ_{m}]]_{UA_{1},...UA_{n}} σ^{+}(τ_{1}) × … σ^{+}(τ_{m}) [[op]]_{UA_{1},...UA_{n}} σ^{+}(τ) U[[op]]_{A_{1},...A_{n}} U[[τ]]_{A_{1},...A_{n}} [[τ]]_{UA_{1},...UA_{n}} (6.1)

If op is an operation for which the above diagram commutes, we say that (U, σ) is natural with respect to op .

Example. Let (U, σ) : (C, T) → (D, S) be a morphism of strong endofunctors and let operations val : ∀X. X ⟶ T X and let : ∀X, Y. (X → T Y), T X ⟶ T Y, satisfying the equations of section 2.2, be defined in C and D. The above diagram applied to such operations yields equations defining (U, σ) as a strong monad morphism. Conversely, let (U, σ) be a morphism between strong monads over C and D. The operations st : ∀X, Y. (X → Y), T X ⟶ T Y derived as in section 2.2 in C and D make the above diagram commute: σ_{B}(Ust_{A,B}(f, w)) = st_{UA,UB}(f, σ_{A}w), and this corresponds to saying that (U, σ) is a morphism of strong endofunctors.

Proposition 6.1.4 Σ-models and Σ-homomorphisms form a category Mod (Σ).

Proof. (Strong) monad morphisms (U, σ) : (C, T) → (D, S) and (V, ρ) : (D, S) → (E, R) compose as follows: (V, ρ)^{∘}(U, σ) = (V ^{∘}U, ρU^{∘}V σ). We show that (V, ρ)^{∘}(U, σ) is a 6. Semantic constructors 153 Σ_{ϵ}-homomorphism by proving the following equations:

(ρU^{∘}V σ)^{+}τ = ρ^{+}(τ)U^{∘}V σ^{+}(τ)  (6.2)
(ρU^{∘}V σ)^{−}τ = V σ^{−}(τ)^{∘}ρ^{−}(τ)U  (6.3)

Then, the result follows from the commutativity of the diagram below:

V σ^{+}(τ) V U[[op]]_{A_{1},...A_{n}} V U[[τ]]_{A_{1},...A_{n}} V [[op]]_{UA_{1},...UA_{n}} V [[τ]]_{UA_{1},...UA_{n}} [[op]]_{V UA_{1},...V UA_{n}} [[τ]]_{V UA_{1},...V UA_{n}} V σ^{+}(τ_{1}) × … V σ^{+}(τ_{m}) V U[[τ_{1}]]_{A_{1},...A_{n}} × … V U[[τ_{m}]]_{A_{1},...A_{n}} V [[τ_{1}]]_{UA_{1},...UA_{n}} × … V [[τ_{m}]]_{UA_{1},...UA_{n}} [[τ_{1}]]_{V UA_{1},...V UA_{n}} × … [[τ_{m}]]_{V UA_{1},...V UA_{n}}  ρ^{+}(τ)U ρ^{+}(τ_{1})U × … ρ^{+}(τ_{m})U

Equations 6.2 and 6.3 are proven by induction on τ, of which we show only a few cases as the others are similar. For a positive T τ:

(ρU^{∘}V σ)^{+}(T τ) =  (by definition of ( )^{+}(T τ))
R(ρU^{∘}V σ)^{+}(τ)^{∘}(ρU^{∘}V σ)_{τ} =  (by inductive hypothesis)
R(ρ^{+}(τ)U^{∘}V σ^{+}(τ))^{∘}ρ_{Uτ} ^{∘}V σ_{τ} = (since R is a functor)
Rρ^{+}(τ)U^{∘}RV σ^{+}(τ)^{∘}ρ_{Uτ} ^{∘}V σ_{τ} = (since ρ is a natural transformation)
Rρ^{+}(τ)U^{∘}ρ_{τU} ^{∘}V Sσ^{+}(τ)^{∘}V σ_{τ} = (since V is a functor)
(Rρ^{+}(τ)U^{∘}ρ_{τU})^{∘}V (Sσ^{+}(τ)^{∘}σ_{τ}) = (by definition of ( )^{+}(T τ))

ρ^{+}(T τ)U^{∘}V σ^{+}(T τ). Similarly, for positive τ_{1} → τ_{2}:

(ρU^{∘}V σ)^{+}(τ_{1} → τ_{2}) =

λf : V Uτ_{1} → V Uτ_{2}. (ρU^{∘}V σ)^{+}(τ_{2})^{∘}f^{∘}(ρU^{∘}V σ)^{−}(τ_{1}) =

λf : V Uτ_{1} → V Uτ_{2}. ρ^{+}(τ_{2})U^{∘}V σ^{+}(τ_{2})^{∘}f^{∘}V σ^{−}(τ_{1})^{∘}ρ^{−}(τ_{1})U =

(λg : V τ_{1}U → V τ_{2}U. ρ^{+}(τ_{2})U^{∘}g^{∘}ρ^{−}(τ_{1})U)^{∘}

(λf : V Uτ_{1} → V Uτ_{2}. V σ^{+}(τ_{2})^{∘}f^{∘}V σ^{−}(τ_{1})) = (λg : V τ_{1}U → V τ_{2}U. ρ^{+}(τ_{2})U^{∘}g^{∘}ρ^{−}(τ_{1})U)^{∘}V (λf : Uτ_{1} → Uτ_{2}. σ^{+}(τ_{2})^{∘}f^{∘}σ^{−}(τ_{1})) = ρ^{+}(τ_{1} → τ_{2})U^{∘}V σ^{+}(τ_{1} → τ_{2})

□

As to 2-cells in Mod (Σ), no natural condition can be stated for an arbitrary ν : U \underrightarrow{.} V to coherently relate U and V occurrences of operations in Σ. However, coherence is guaranteed when 2-cells are restricted to isomorphisms. [Pow94] studies (2- and tri-) categories with structure arising from modelling logical frameworks for computer science.

Remark. Some operations commonly associated with computational features of programming languages do not have positive type scheme. One example is the operator callcc_{A,B} : ((A → T B) → T A) → T A for computations with continuations; another example, introduced in section 6.4, is C_{A,B} : (A → T B) × (HT A → T B) × T A → T B, which performs case analysis on generalized resumptions.

When a signature Σ contains such operators, the general notion of Σ-homomorphism introduced above cannot be adopted. In that case, one can always reduce the amount of structure upon which morphisms in Mod (Σ) are required to be natural. For example, if naturality were only required on val and let , a morphism in Mod (Σ) would be just any strong monad morphism. However, as we shall see in the next section (theorems 6.2.5 and 6.2.7), the less we require of morphisms in Mod (Σ), the less we can say of semantic constructors in terms of preserving equations.

6.2 Semantic constructors

A semantic constructor F is a family of functions F_{Σ} mapping the objects of Mod (Σ) to the objects of Mod (Σ + Σ_{F}). When clear from the context, we shall understand that such maps act only on objects and write:

F_{Σ} : Mod (Σ) → Mod (Σ + Σ_{F}).

F_{Σ} is indexed by signatures of the metalanguage; each F is defined over a restricted range Sig_{F} of signatures. For example, uniform redefinitions, to be introduced below, can be defined only over operations with certain type schemes. Besides cutting off “unmanageable” signatures, Sig_{F} may also require a minimal supply of constant types and operations. This minimal supply may be thought of as the parameters of the constructor. An example of parameter is the type E of exceptions in the translation presented in section 7.2.

Example. Consider a constructor F mapping a monoid M into the group obtained by freely adjoining a unary operation “-” to M and quotienting by suitable equations: a + (−a) = 0, −(a + b) = (−a) + (−b), etc. This constructor is defined on any category of Σ-algebras, provided Σ includes +.

□

In Moggi’s definition [Mog91c], semantic constructors must satisfy a naturality condition that we shall discuss below. To state this condition a notion of signature morphism is required, which we provide in definition 6.2.1 for the general form of lambda calculus L(Σ) described in chapter 2.

Let ρ_{i}(Y_{1}, … Y_{l}), i = 1 … k, σ_{j}(Y_{1}, … Y_{l}), j = 1 … n, and τ(X_{1}, … X_{n}) be Σ-polytypes; a derived Σ-operation of arity ∀Y_{1}, … Y_{l}. ρ_{1}, … ρ_{k} ⟶ τ(σ_{1}, … σ_{n}) is either an operation in Σ (of same arity) or a sequence of m+1 derived Σ-operations op_{i} of arity ∀Y_{1}, … Y_{l}. ρ_{1}, … ρ_{k} ⟶ τ_{i}(σ_{1}, … σ_{n}), i = 1 … m, and op : ∀X_{1}, … X_{n}. τ_{1}, … τ_{m} ⟶ τ, which we write op (op_{1}, … op_{m}).

Definition 6.2.1 A signature morphism σ : Σ_{1} → Σ_{2} maps constant type symbols K of arity n in Σ_{1} to Σ_{2}-polytypes τ(X_{1}, … X_{n}), and constant operation symbols op of arity ∀X_{1}, … X_{n}. τ_{1}, … τ_{m} ⟶ τ in Σ_{1} to derived Σ_{2}-operations σ(op ) of arity ∀X_{1}, … X_{n}. σ(τ_{1}), … σ(τ_{m}) ⟶ σ(τ).

Remark. For computational metalanguages ML_{T} (Σ) signature morphisms only deal with constants in Σ, that is, they do not affect T, val or let . Other possibilities may be considered, e.g. mapping symbols to terms. We do not further discuss such notions since signature morphisms play a marginal role in the rest of this thesis. However, note that, since the naturality condition on constructors in definition 6.2.2 quantifies over such morphisms, the more general the notion, the harder it is for F_{Σ} to qualify as natural.

□

A signature morphism σ : Σ_{1} → Σ_{2} induces Σ_{1} structure in the underlying category of any Σ_{2}-model M: the structure for interpreting a symbol ξ ∈ Σ_{1} is obtained by interpreting σ(ξ) in M. If this Σ_{1}-structure satisfies the axioms of ML_{T} (Σ_{1}), we write Mod (σ) : Mod (Σ_{2}) → Mod (Σ_{1}).

Definition 6.2.2 (Moggi) A semantic constructor F is a Sig_{F}-indexed family of functions F_{Σ} from the objects of Mod (Σ) to the objects of Mod (Σ + Σ_{F}) satisfying the following naturality condition: for all signature morphisms σ : Σ_{1} → Σ_{2} in Sig_{F} such that Mod (σ) : Mod (Σ_{2}) → Mod (Σ_{1}), the following diagram commutes:

Mod (Σ_{2}) Mod (Σ_{1}) Mod (σ)  ^{F_{Σ_{2}}} F_{Σ_{1}}  Mod (Σ_{2} + Σ_{F}) Mod (σ + Σ_{F}) Mod (Σ_{1} + Σ_{F})

Naturality ensures that all components of F agree on the definition of Σ_{F} structure by restricting to the same F_{Σ_{0}} : Mod (Σ_{0}) → Mod (Σ_{0} + Σ_{F}), where Σ_{0} is the signature of parameters, and that reinterpretation of any Σ ∈ Sig_{F} can be described by considering each operation separately.

It is reasonable to expect that theories of (Σ + Σ_{F})-computation extend theories of Σ-computation. Hence, in order to show that the construction of a categorical structure FM out of a Σ-model M actually defines a map Mod (Σ) → Mod (Σ + Σ_{F}), it is useful to know whether F preserves the truth of certain formulae. In chapter 5, for example, we showed, in the context of Evaluation Logic, that the constructor (FT)X =^{def} T (X + S)^{S} preserves the validity of □ val^{∗}.

Example. Any F mapping Σ-algebras into (Σ + Σ_{F})-algebras endowed with a family of Σ-homomorphisms f_{A} : A → FA, preserves the truth of closed equations over Σ. Similarly, let F : Mod (Σ) → Mod (Σ+Σ_{F}); a morphism (U, σ) : M → FM⌉_{Σ} in Mod (Σ) relates interpretations of (positively typed) operations op ∈ Σ_{ϵ} in the two models. Let Γ ⊢ ω : τ, with positive Γ and τ, be a derived operation obtained by composing the primitive operations in Σ_{ϵ}, val and let ; it is easy to see that [[ω]] makes diagram 6.1 commute. Any equation ω_{1} = ω_{2} between closed terms of the above kind which holds in M also holds in FM, since [[ω_{1}]]^{FM} = σ^{+}U[[ω_{1}]]^{M} = σ^{+}U[[ω_{2}]]^{M} = [[ω_{2}]]^{FM}.

□

In the rest of this section we investigate the properties of semantic constructors F, which we call “pointed,” endowed with a family of morphisms (U, σ) : M → FM, where M and FM have the same underlying category and U is the identity. Note that theorem 6.2.4 holds for any (U, σ) in Mod (Σ). We shall ask two questions about pointed constructors: which equations do they preserve and which do they reflect? The first of these questions was first addressed in [Mog90b], where a solution is sought for a special class of pointed constructors (called parametric extensions) and for a fragment of the metalanguage in which lambda abstraction is only allowed on constant types.

We call “light” the terms of ML_{T} (Σ) freely generated by rules B1, B2, B4, B5 and B6 of section 2.3, together with the following:

B3.bis. Let op : ∀X_{1}, … X_{n}. τ_{1}, … τ_{m} ⟶ τ be an operation in Σ_{ϵ}, let σ_{1}, … σ_{n} be types such that σ_{i} is positive (negative) if X_{i} occurs positively (negatively) in τ, and let M_{j} : τ_{i}(σ_{1}, … σ_{n}) for j = 1, … m, then op_{σ_{1},...σ_{n}}(M_{1}, … M_{m}) is a term of type τ(σ_{1}, … σ_{n});

B7.bis. if x ∈ χ_{σ}, T does not occur in σ and M : τ, then λ x : σ. M is a term of type σ → τ.

Lemma 6.2.3 Light terms in positive contexts have positive type.

Proof. By induction on the structure of terms. The term ∗ has positive type 1. For pairs and projections the result follows immediately from the inductive hypotheses. A light term op (M_{1}, … M_{m}), where M_{j} : τ_{j}(σ_{1}, … σ_{n}) and op has positive type scheme ∀X_{1}, … X_{n}. τ_{1}, … τ_{m} ⟶ τ, must satisfy the conditions of B3.bis, which yield a positive τ(σ_{1}, … σ_{n}) by lemma 6.1.1. Let Γ be a context in which all types are positive. Let Γ ⊢ MN : τ_{2}; since M is light, by inductive hypothesis it must be Γ ⊢ M : τ_{1} → τ_{2} with positive τ_{1} → τ_{2}. Hence τ_{2} must be positive. Let Γ ⊢ λ x : τ_{1}. M : τ_{1} → τ_{2}; since τ_{1} must contain no occurrences of T, by inductive hypothesis, it must be Γ, x : τ_{1} ⊢ M : τ_{2} with positive τ_{2}; hence τ_{1} → τ_{2} is positive. □

Theorem 6.2.4 Let (id , σ) : ⟨C, T, A⟩ → ⟨C, S, B⟩ be a morphism of Σ-models. Any light term M and positive Γ such that Γ ⊢ M : τ in ML_{T} (Σ) satisfies the following diagram: writing [[ ]]^{T} for interpretation in ⟨C, T, A⟩ and [[ ]]^{S} for interpretation in ⟨C, S, B⟩,

[[Γ]]^{T} [[Γ]]^{S}  [[τ]]^{T} [[τ]]^{S} [[M]]_{Γ}^{T} σ^{+}(Γ)  σ^{+}(τ) [[M]]_{Γ}^{S}

Proof. The interesting cases are lambda abstraction and application, since for ∗ : 1 the result follows from the universality of 1, while for variables, application of constants, pairs and projections it follows from the universality of products. Let Γ ⊢ MN : τ_{2}. Assume Γ ⊢ M : τ_{1} → τ_{2} and Γ ⊢ N : τ_{1} make the diagram commute. The soundness of such assumptions depends on lemma 6.2.3, which ensures that both τ_{1} → τ_{2} and τ_{1} are positive. So τ_{1} must contain no occurrences of T and, by lemma 6.1.2, σ^{+}(τ_{1}) = σ^{−}(τ_{1}) = id ; we write τ_{1} for [[τ_{1}]]^{T} = [[τ_{1}]]^{S}. Since σ^{+}(τ_{1} → τ_{2}) = λ f : τ_{1} → [[τ_{2}]]^{T} . (λ x : τ_{1}. σ^{+}(τ_{2})(fx)) and [[N]]_{Γ}^{T} = [[N]]_{σ^{+}(Γ)}^{S}, we have:

σ^{+}(τ_{2})[[MN]]_{Γ}^{T} =  (by lambda abstraction)

(λ f : τ_{1} → [[τ_{2}]]^{T} . (λ x : τ_{1}. σ^{+}(τ_{2})(fx))) ([[M]]_{Γ}^{T}, [[N]]_{Γ}^{T}) =

(by definition of σ^{+}(τ_{1} → τ_{2}))
(σ^{+}(τ_{1} → τ_{2}) [[M]]_{Γ}^{T}) [[N]]_{Γ}^{T} =  (by inductive hypothesis on M)
[[M]]_{σ^{+}(Γ)}^{S}[[N]]_{Γ}^{T} =  (by inductive hypothesis on N)

[[M]]_{σ^{+}(Γ)}^{S}[[N]]_{σ^{+}(Γ)}^{S} =

[[MN]]_{σ^{+}(Γ)}^{S}

Similarly, let Γ ⊢ λ x : τ_{1}. M : τ_{1} → τ_{2} with no T in τ_{1}. Then (Γ, x : τ_{1}) is a positive context and we can assume the property for Γ, x : τ_{1} ⊢ M : τ_{2}. Therefore: σ^{+}(τ_{1} → τ_{2}) [[λ x : τ_{1}. M]]_{Γ}^{T} = (λ f : τ_{1} → [[τ_{2}]]^{T} . (λ x : τ_{1}. σ^{+}(τ_{2})(fx))) (λ x : τ_{1}. [[M]]_{Γ,x}^{T}) =

λ x : τ_{1}. σ^{+}(τ_{2}) [[M]]_{Γ,x}^{T} =  (by inductive hypothesis)

λ x : τ_{1}. [[M]]_{σ^{+}(Γ),x}^{S} = [[λ x : τ_{1}. M]]_{σ^{+}(Γ)}^{S}.

□

Theorem 6.2.5 Let (id , σ) : ⟨C, T, A⟩ → ⟨C, S, B⟩ be a morphism of Σ-models. If M and N are light terms of ML_{T} (Σ) with free variables in context Γ and T does not occur in Γ, then [[M]]_{Γ}^{T} = [[N]]_{Γ}^{T} implies [[M]]_{Γ}^{S} = [[N]]_{Γ}^{S}.

Proof. Theorem 6.2.4 applies to M and N because Γ is positive. Moreover σ^{+}(Γ) is the identity and hence [[M]]_{Γ}^{S} = σ^{+}(τ) [[M]]_{Γ}^{T} = σ^{+}(τ) [[N]]_{Γ}^{T} = [[N]]_{Γ}^{S}. □

An immediate corollary to this theorem is that all equations between closed light terms are preserved by pointed constructors. Note that, although the axiom schemes of most theories of computation involve only light terms, the above theorem ensures only the preservation of light instances of such schemes.

Remark. One may wonder whether, in case the category C is well pointed, preserving closed equations is enough to preserve also the open ones (over positive contexts). A category C with terminal object 1 is called well pointed when the homset functor C(1, ) is faithful, that is, when two morphisms f and g are equal whenever fx = gx for all global elements x. In general, an axiom scheme ∅ ⊢ F (M) = G(M) does not enforce [[F]] = [[G]] in all models M. However, assume M is well pointed. One can extend the language with one constant \underline{x} : τ, where τ is the type of the metavariable M, for each global element x : 1 → [[τ]] of M, and extend the interpretation with [[\underline{x}]] = x. Then, for all x : 1 → [[τ]], [[F]]^{∘}x = [[F (\underline{x})]] = [[G(\underline{x})]] = [[G]]^{∘}x and hence [[F]] = [[G]]. In order to make a similar argument work when two interpretations [[ ]]^{T} and [[ ]]^{S} are at stake, it is necessary that each global element 1 → SX factorizes as 1 → T X ⟶^{σ_{X}} SX for some global element of T X.

□

Our second question about pointed semantic constructors F is whether they are conservative on some class of equations, that is, for what M and N it is the case that [[M]]^{FM} = [[N]]^{FM} implies [[M]]^{M} = [[N]]^{M}.

We shall call “light” the polytypes of ML_{T} (Σ) freely generated by the rules A1-A5 of section 2.3, with the extra condition, in A5, that σ contains no occurrences of T in a light σ → τ. Lightly typed terms need not be light, nor light terms lightly typed.

Lemma 6.2.6 Let (σ, U) : ⟨C, T, A⟩ → ⟨D, S, B⟩ be a morphism of Σ-models. If the components of σ are monos and S is mono preserving, then σ^{+}(τ) is a mono for any light polytype τ.

Proof. By induction on the structure of τ. For exponentials it uses the fact that σ^{+}(τ_{1} → τ_{2}) = (σ^{+}(τ_{2}))^{τ_{1}} and that the functor ( )^{τ_{1}} preserves monos because it is a right adjoint. For T τ it uses the assumptions that the components of σ are monos and S is mono preserving. □

Theorem 6.2.7 Let M and N be light terms of light type τ in a positive context Γ, and let (id , σ) : ⟨C, T, A⟩ → ⟨C, S, B⟩ be a morphism of Σ-models. If the components of σ are monos and S is mono preserving, then [[M]]_{Γ}^{S} = [[N]]_{Γ}^{S} implies [[M]]_{Γ}^{T} = [[N]]_{Γ}^{T}.

Proof. M and N satisfy the diagram of theorem 6.2.4. Hence,

σ^{+}(τ)^{∘}[[M]]_{Γ}^{T} = [[M]]_{Γ}^{S} ^{∘}σ^{+}(Γ) = [[N]]_{Γ}^{S} ^{∘}σ^{+}(Γ) = σ^{+}(τ)^{∘}[[N]]_{Γ}^{T}.

Since, by lemma 6.2.6, σ^{+}(τ) is a mono, [[M]]_{Γ}^{T} = [[N]]_{Γ}^{T}. □

In [Mog90b], Moggi investigates similar properties for a variety of constructions of the modular approach, such as uniform redefinitions. Let T be a strong monad and let G(T) be a map obj (C) → obj (C) on the objects of the underlying category C of T. A constructor F such that (FT)X = T (GT X) can uniformly redefine operations of the form op_{X} : ζ(T X), where ζ( ) is a type scheme:

(Fop )_{X} =^{def} op_{GT X} : ζ(T (GT X)) ≡ ζ((FT)X)

Examples of constructors of the form (FT)X = T (GT X) are the one for complexity, FT A = T (A × M) for M a monoid, and all instances of the constructor of generalized resumptions described in section 6.4, among which the one for exceptions. An example of uniformly redefinable operation is or_{X} : T X × T X → T X of section 2.5, where ζ(X) is X × X → X.

Equations involving instances of redefinable operations are not always preserved by uniform redefinitions. For example, let op_{X} : T X; the identity monad satisfies op_{1} =_{T 1} x but, for FT X = T (A + E), Fop_{1} =_{FT 1} x does not hold, that is op_{1+E} =^{?!}_{1+E} x. However, equation schemes only involving uninstantiated occurrences of polymorphic operations are preserved. For example, the commutativity law or_{X}(x, y) =_{T X} or_{X}(y, x), is preserved by uniform redefinitions of or .

Remark. Preserving equations can be also studied syntactically, by reasoning about theories and translations rather than models and constructors. For example, a constructor Mod (t) : Mod (Σ) → Mod (Σ + Σ_{F}) deriving from a translation t of ML_{T} (Σ + Σ_{F}) into ML_{T} (Σ) would preserve the truth of equations M = N when t(M) = t(N) is a consequence of M = N in ML_{T} (Σ).

6.3 HML

As mentioned earlier, interesting semantic constructors can be presented as translations of metalanguages, provided a powerful enough syntax is adopted. In [CM93], a metalanguage HML is used to that effect. HML is not biased towards monads, but it is expressive enough to easily axiomatize desirable metalanguage features, including monads, and to describe concisely uniform redefinitions.

HML is defined in appendix A. There are rules for deriving well formed kinds, operators, type schemes, terms and formulae. There are also rules for deriving compound objects such as contexts, that is sequences of variable declarations, signatures, that is sequences of constant declarations, and theories, that is sequences of formulae.

In a pure type system [Bar92], kind and scheme would be called “variable universes,” because kinds and type schemes can be used in contexts as ranges of variables. An object u of kind k is called an operator, while an object e of type scheme σ is called a term. Besides judgements of well formedness, HML features equality judgements on operators and schemes, and truth judgements involving formulae of first order logic with equality.

Polymorphic operations are expressed in HML as follows. There is a constant kind Ω whose operators, called types, lift to type schemes. Variables of kind Ω can be “quantified” upon to form type schemes. For example, the signature of a theory of monads is:

T : Ω ⇒ Ω,
val : Πv : Ω. v ⇒ T v,
let : Πv_{1}, v_{2} : Ω. (v_{1} ⇒ T v_{2}) × T v_{1} ⇒ T v_{2}

while the axioms 2.3, 2.4, and 2.5 of section 2.2 provide the related theory.

The above type schemes are also types in the polymorphic lambda calculus, PLC [Gir72,Rey74], of which we shall consider the version described in [See87]. However, there are differences between HML and PLC in the treatment of polymorphism. For example, the orders of PLC, corresponding to kinds in HML, only admit exponentials of the form Ω^{A}. PLC has both product (Π) and sum (Σ) types, while HML only has products. Particularly significant is also that, unlike PLC, HML distinguishes between types and type schemes: there may be schemes, for example the ones involving Π, which may correspond to no operator of kind Ω. Motivations for such an approach can be found in [Mog91a], while the semantical implications of it are discussed in section 6.7.

Since types and type schemes are distinguished in HML, operators of the form k ⇒ Ω would not suffice to express uniform redefinitions in full generality. For example, the type scheme S(X) =^{def} ΠY : Ω. X × Y cannot be expressed using an operator S : Ω ⇒ Ω. Therefore HML features parametric schemes of the form S : k ⇒ scheme .

In HML, schemes have products and exponentials. These operations must be reflected in the world of kinds if they are to be used together with operators to form types. For example, the scheme X : Ω ⊢ T (X × X) : scheme requires an operator × : Ω × Ω → Ω. Below we present signatures and theories for reflecting products and sums. Exponentials can be treated similarly.

The following signatures and theories can be combined to describe computational models. Of course, the analysis of models must support this process as some theories may be inconsistent with each other.

Notation. Sometimes we leave type arguments implicit in polymorphic terms. For example, if F : (ΠX : Ω. X ⇒ X) and M : A : Ω, we may write F M for F [A]M. We assume that × binds more tightly than ⇒ and that application is left associative, reading (f g x) as (f g)x. If F : X × Y ⇒ Z and M : X, we may write F M for (λ y : Y. F My) : Y ⇒ Z.

Product reflection (signature). unit : Ω, In_{1} : 1 ⇒ unit , Out_{1} : unit ⇒ 1, prod : Ω × Ω ⇒ Ω, In_{×} : Πv_{1}, v_{2} : Ω. (v_{1} × v_{2}) ⇒ prod ⟨v_{1}, v_{2}⟩, Out_{×} : Πv_{1}, v_{2} : Ω. prod ⟨v_{1}, v_{2}⟩ ⇒ (v_{1} × v_{2})

Product reflection (theory). ∀ x : 1. Out_{1}(In_{1}x) = x, ∀ x : unit . In_{1}(Out_{1}x) = x, ∀v_{1}, v_{2} : Ω, x : v_{1} × v_{2}. Out_{×}(In_{×}x) = x, ∀v_{1}, v_{2} : Ω, x : prod ⟨v_{1}, v_{2}⟩. In_{×}(Out_{×}x) = x

Sum reflection (signature). 0 : Ω, + : Ω × Ω ⇒ Ω, Z : Πv : Ω. 0 ⇒ v, inj_{1} : Πv_{1}, v_{2} : Ω.v_{1} ⇒ v_{1} + v_{2}, inj_{2} : Πv_{1}, v_{2} : Ω.v_{2} ⇒ v_{1} + v_{2}, case : Πv_{1}, v_{2}, v : Ω. (v_{1} ⇒ v) × (v_{2} ⇒ v) × (v_{1} + v_{2}) ⇒ v

Sum reflection (theory). ∀v : Ω, f : 0 ⇒ v. f = Z(v), ∀v_{1}, v_{2}, v : Ω, f_{1} : v_{1} ⇒ v, f_{2} : v_{2} ⇒ v. (λ x. case f_{1} f_{2} (inj_{1}x)) = f_{1}, ∀v_{1}, v_{2}, v : Ω, f_{1} : v_{1} ⇒ v, f_{2} : v_{2} ⇒ v. (λ y. case f_{1} f_{2} (inj_{2}y)) = f_{2}, ∀v_{1}, v_{2}, v : Ω, f : (v_{1} + v_{2}) ⇒ v. case (λ x. f(inj_{1}x), λ y. f(inj_{2}y)) = f

As shown in chapter 3 in the case of a programming language with exceptions, programs of type B with a parameter of type A translate into terms of type A → T B in the computational metalanguage. Hence, interpretation of recursively defined programs requires fixed point operators over types of the form A → T B. The following is an axiomatization of such operators in HML. It requires a type constructor T which would typically be provided by the signature of monads.

Fixed points (signature). Y : Πv_{1}, v_{2} : Ω. ((v_{1} ⇒ T v_{2}) ⇒ (v_{1} ⇒ T v_{2})) × v_{1} ⇒ T v_{2}

Fixed points (theory). ∀v_{1}, v_{2} : Ω, f : (v_{1} ⇒ T v_{2}) ⇒ (v_{1} ⇒ T v_{2}). Y (f) = f(Y f)

Algebraically complete categories [Fre91] provide interpretations for data types which can be mathematically described as “minimal” solutions to recursive equations D ≅ F D, for F a covariant functor. More precisely, a category is called algebraically complete if every covariant endofunctor (in a suitable 2-categorical sense) has initial algebra. We write α_{F} : F (μF) → μF the initial F -algebra and It_{F} (β) : μF → B the unique F - homomorphism from α_{F} to β : F B → B. By a well known result due to Lambek [Lam68], α_{F} is an isomorphism with inverse γ_{F} =^{def} It_{F} (F α_{F}). In computer science, datatypes arising as initial algebras of covariant endofunctors are called inductive types.

Remark. Similarly, when C is algebraically complete and A is any category, a type constructor F̃ can be defined from a bifunctor F : A × C → C:

F̃A =^{def} μX. F (A, X).

F̃ is in fact a functor A → C mapping arrows f : A → B to

F̃f =^{def} It (H_{f})

where H_{f} = F (A, F̃B) ⟶^{F (f,F̃B)} F (B, F̃B) ⟶^{α_{F (B, )}} F̃B. It is easy to verify that the usual map function of LISP is the morphisms part of the list constructor List (A) =^{def} μX. (1+(A×X)).

□

In [CM93], inductive types are axiomatized in HML as follows:

Inductive types (signature). μ : (Ω ⇒ Ω) ⇒ Ω, α : ΠF : Ω ⇒ Ω.F (μF) ⇒ μF, It : ΠF : Ω ⇒ Ω, v : Ω.(Πv_{1}, v_{2} : Ω.(v_{1} ⇒ v_{2}) × F v_{1} ⇒ F v_{2}) × (F v ⇒ v) × μF ⇒ v

Inductive types (theory). ∀F : Ω ⇒ Ω, v : Ω, f : (Πv_{1}, v_{2} : Ω. (v_{1} ⇒ v_{2}) × F v_{1} ⇒ F v_{2}), β : F v ⇒ v.

strength (f) ⊃ ∀ x : F (μF). It f β (αx) = β(f(It f β)x), ∀F : Ω ⇒ Ω, v : Ω, f : (Πv_{1}, v_{2} : Ω. (v_{1} ⇒ v_{2}) × F v_{1} ⇒ F v_{2}), β : F v ⇒ v, g : μF ⇒ v.

strength (f) ∧ (∀ x : F (μF). g(αx) = β(f g x)) ⊃ g = It f β,

where strength (f) is a formula asserting that f preserves identities and composition. This is not completely satisfactory as the operations work on separate pieces of information, viz. F : Ω ⇒ Ω and f : Πv_{1}, v_{2} : Ω. (v_{1} ⇒ v_{2}) × F v_{1} ⇒ F v_{2}, rather than on some representation of a functor. For example, α is asked to deliver an initial algebra for a functor of which it is only given the map on objects. In chapter 7, we axiomatize inductive types in the Extended Calculus of Constructions, where functors can be represented by assembling in a Σ-type a map on objects, one on arrows and a proof that the latter is a strength for the former.

Remark on inductive types and fixed points. The axiomatization of fixed points given above is rather weak. However, it is enough to show the following. Let (F, f) be a strong endofunctor. A fixed point operator Y on arrow types yields an algebra morphism A → B for all F -algebras β : F B → B and isomrphisms α : F A → A. Writing

G =^{def} λ h : A → B. λ x : A. β (f h (α^{−1}x)), we have:

β^{∘}f(Y G) = λ z : F A. β (f (Y G) z)

= λ z : F A. (λ x : A. β (f (Y G) (α^{−1}x))) (αz)

= λ z : F A. G(Y G) (αz)

= λ z : F A. Y G (αz) = Y G^{∘}α. Since, in the theory of inductive types, α_{F} is an isomorphism, in the combined theory of inductive types and fixed points, (It_{F} f β) = Y G for the uniqueness of (It f β).

Vice versa, let ⟨T, val , let ⟩ be a strong monad; a fixed point operator Y of the form Y_{A,B} : (A → T B) → (A → T B) → A → T B satisfying F (Y F) = Y F can be defined as in [CP92] from an initial T -algebra and a fixed point element ω : 1 → T (μT) equalizing id_{μT} and val ^{∘}α_{T}.

6.4 Relative interpretation of HML

In this section we introduce the notion of relative interpretation of HML and show an application where a relative interpretation is used to present a semantic constructor syntactically.

The sets of raw kinds (K), operators (U), type schemes (S), terms (E) and formulae (P), which are part of the raw syntax of HML, are defined in appendix A. We collectively refer to the elements of these sets as raw expressions. Below we use the metavariables K, C, S, c and P to range respectively over the sets Const_{K}, Const_{O}, Const_{S}, Const_{E} and Const_{P} of constants. The sets Var_{O} and Var_{E} of variables are ranged over by v and x.

Let Const = Const_{K} ∪Const_{O}∪Const_{S} ∪Const_{E} ∪Const_{P} and let Const_{1} be a subset of Const ; we call HML(Const_{1}) the set of raw expressions over Const_{1}, that is the ones generated by the grammar in appendix A from the constants in Const_{1}. Given subsets Const_{1} and Const_{2} of Const , a raw translation of HML(Const_{2}) into HML(Const_{1}) is a map ([ ]) from Const_{2} to the raw expressions over Const_{1} such that ([K]) ∈ K, ([C]) ∈ U and it has no free variables, ([S]) ∈ S and it has at most one free variable v ∈ Var_{O}, ([c]) ∈ E and it has no free variables, ([P]) ∈ P and it has at most two free variables v ∈ Var_{O} and x ∈ Var_{E}.

This map has an obvious extension, which we also write ([ ]), to the raw expressions over Const_{2}, where ([S(u)]) = [([u])/v]([S]) and ([P (u, e)]) = [([u])/v] [([e])/x]([P]).

Let Σ be a well formed signature in HML; we call HML(Σ) the “pure” HML over Σ, that is the set of judgements which are derivable from the axiom ⊢ Σ sig and all the inference rules except for the ones for signatures and (add-prop). Let Σ_{1} and Σ_{2} be well formed signatures and let Const_{1} and Const_{2} be the sets of constants in Σ_{1} and Σ_{2} respectively; a translation θ : HML(Σ_{2}) → HML(Σ_{1}) is a raw translation of HML(Const_{2}) into HML(Const_{1}) such that, for all kinds K : kind , C : k,S : k ⇒ scheme , c : σ and P : (v : k)σ ⇒ prop in Σ_{2}, the following judgements are derivable:

⊢_{Σ_{1}} ([K]) kind , ⊢_{Σ_{1}} ([C]) : ([k]), v : ([k]) ⊢_{Σ_{1}} ([S]) scheme , ⊢_{Σ_{1}} ([c]) : ([σ]), v : ([k]), x : ([σ]) ⊢_{Σ_{1}} ([P]) prop .

The map induced on the raw syntax by a translation preserves derivability, that is, if Γ ⊢_{Σ_{2}} u_{1} = u_{2} : k is in HML(Σ_{2}) then ([Γ]) ⊢_{Σ_{1}} ([u_{1}]) = ([u_{2}]) : ([k]) is in HML(Σ_{1}), if Γ ⊢_{Σ_{2}} σ_{1} = σ_{2} is in HML(Σ_{2}) then ([Γ]) ⊢_{Σ_{1}} ([σ_{1}]) = ([σ_{2}]) is in HML(Σ_{1}) and, if Γ; Δ ⊢_{Σ_{2},∅} ϕ is in HML(Σ_{2}) then ([Γ]), ([Δ]) ⊢_{Σ_{1},∅} ([ϕ]) is in HML(Σ_{1}). This can be shown by induction on the length of derivation, with the aid of a substitution lemma.

Let ⊢_{Σ} T theory be derivable in HML; we call HML(Σ, T) the set of judgements that are derivable from the axioms ⊢ Σ sig and ⊢_{Σ} T theory and all the rules but the ones for signatures and theories. We also write T for HML(Σ, T) and call it a theory over Σ. When Σ and T are understood, we drop the indices in ⊢_{Σ} and ⊢_{Σ,T}.

Given theories T_{1} and T_{2} over Σ_{1} and Σ_{2} respectively, a relative interpretation θ : HML(Σ_{2}, T_{2}) → HML(Σ_{1}, T_{1}) is a translation as above such that, if Γ; Δ ⊢_{Σ_{2},T_{2}} ϕ is derivable, then so is ([Γ]); ([Δ]) ⊢_{Σ_{1},T_{1}} ([ϕ]).

A theory ML_{T} (Σ) of the computational metalanguage can be expressed in HML by giving a signature Σ̃ and a theory T over Σ̃ such that HML(Σ̃, T) is a conservative extension of ML_{T} (Σ), provided a suitable translation of ML_{T} (Σ) into HML(Σ̃). The advantage of representing theories of the computational metalanguage in HML is that type constructors become legal expressions of the language and so do polymorphic operations; we shall benefit from this approach in section 6.8 where translations of HML theories are viewed as functors, with no need of introducing naturality conditions on the operations.

In the rest of this section we show how a relative interpretation can be used to present a semantic constructor for resumptions. In section 2.5, we described resumptions of very primitive sorts of programs. Now we consider more realistic cases. For example, interleaved executions of possibly nonterminating programs acting on a shared store can be described by interpreting a program P of type A in a domain

D ≅ S → ((A + D) × S)_{⊥},

that is, as a partial function from stores into pairs (q, s), where the store s records the effects of one atomic step of evaluation and q is either a value of type A, in which case P has done, or what is left of P.

The computational structure described by the above equation can be split into three separate modules, one for resumptions, F, one for states, S, and one for nontermination, ( )_{⊥}:

(FT)A =^{def} μX . T (A + X)
(ST)A =^{def} S → T (A × S)
D =^{def} (F(S( )_{⊥}))A.

Below we describe a more general version of F, called the constructor of generalized resumptions. This constructor is defined by a relative interpretation ([ ]) : HML(Σ_{0} + Σ_{F}, T_{0} + T_{F}) → HML(Σ_{0}, T_{0}) and uniform redefinitions. Σ_{0} and T_{0} contain respectively the signatures and the theories of monads, sums and inductive types. Moreover, Σ_{0} contains the signature (and T_{0} the obvious axioms) of a strong endofunctor:

\begin{matrix}H : Ω ⇒ Ω \\ st : ΠX, Y : Ω.(X ⇒ Y) × HX ⇒ HY. \end{matrix}

Σ_{F} and T_{F} describe the mathematics of resumptions in terms of the operations:

\begin{matrix}τ : ΠX : Ω. T X → T X \\ C : ΠX, Y : Ω. (X ⇒ T Y) × (HT X ⇒ T Y) × T X ⇒ T Y \end{matrix}

the first of which performs one folding step with no T -computation involved, while the second is essentially a case analysis. The translation ([ ]) is as follows: writing F_{A}(X) for T (A + HX) and γ_{F_{A}} : μX.F_{A}(X) → F_{A}(μX.F_{A}(X)) for It_{F_{A}}(F_{A}(α_{F_{A}})),

([T A]) =^{def} μX. T (([A]) + HX)
([val_{A}(a)]) =^{def} α_{F_{A}}(val (inj_{1}([a])))
([τ_{A}(z)]) =^{def} α_{F_{A}}(val (inj_{2}([z])))
([let_{A,B} f]) =^{def} It_{F_{A}}(λw : T (A + H([T B])).
α_{F_{B}}(let (λc : A + H([T B]). γ_{F_{B}}(case ([f]) ([τ_{B}]) c)) w)
([C_{A,B} f g z]) =^{def} α_{F_{B}}(let (λc : A + H([T A]). γ_{F_{B}}(case ([f]) ([g]) c)) (γ_{F_{A}}([z]))).

Remark. ([let ]) is sequential composition. □

By suitably instantiating H, one obtains the constructors T (A + E) of exceptions, μX. T (A+X) of resumptions, μX. T (A+(O×X)) of interactive output and μX. T (A+X^{I}) of interactive input. All such constructors are pointed, in the sense that there is a strong monad morphism (id , T (inj_{1})) : (C, T) → (C, FT). All that is required to make theorems 6.2.5 and 6.2.7 work is that such morphisms are natural with respect to the operations associated with T -computations. Note that, in view of definition 6.1.3 one should exclude from Σ_{F} operations with nonpositive type scheme such as C_{A,B} in order to make F pointed.

Let Σ_{0} be the following HML signature:

G : (Ω ⇒ Ω) × Ω ⇒ Ω, S : Ω ⇒ scheme , T : Ω ⇒ Ω Uniform redefinitions of operations op of type scheme ΠX : Ω. S(T X) can be de-

scribed in HML by the following translation ([ ]) : HML(Σ_{0} + {op }) → HML(Σ_{0} + {op }):

([T A]) =^{def} T (GT ([A]))
([op_{A}]) =^{def} op_{GT ([A])}

Suitable instantiations of G and S yield appropriate uniform redefinitions for specific constructors and operations. In the next chapter we apply a uniform redefinition for the constructor of resumptions, where GT A = A + μX. T (A + X), to an operator or : T X × T X ⇒ T X of nondeterministic choice, where SX = X × X ⇒ X. The redefined or is then used in the context of computations with resumption to define an operator of parallel composition.

Remark There are interesting constructors in denotational semantics that cannot be described as HML translations. One is that for local variables, which involves a change of category.

6.5 Functorial semantics

In section 6.7, we introduce models of HML theories; moreover, we show that such theories can be viewed as categories with structure and their models as structure-preserving functors. This is often done in categorical logics and often referred to as functorial semantics [KR77]. In this section, we present the main ideas of functorial semantics and introduce locally finitely presentable categories, that are used in section 6.8 to characterize the categories of functorial models of HML theories.

The idea of functorial semantics is that certain kinds of logical theories correspond to certain choices of categorical properties P, sometimes called doctrines [KR77], so that theories of kind P are identified with categories with P structure. Such an approach was first adopted by Lawvere [Law75] to obtain a “presentation invariant” view of algebraic theories, where two theories are identified if the primitive operations of each one are derivable in the other. An historical overview of this subject can be found in [BW85, 4.5].

In the setting of functorial semantics, models of a theory T in a category E with P structure correspond to P-preserving functors from T to E; we write [T , E]_{P} the category of such functors. Translations ϕ : T_{2} → T_{1} of one theory into another also correspond to P-preserving functors; the map of models ϕ^{∗} : [T_{1}, E]_{P} → [T_{2}, E]_{P} obtained by precomposing with ϕ is often called a relative interpretation.

Example: algebras as functors. In [KR77], a presentation invariant view of an algebraic theory is given as a category T whose objects are the natural numbers 0, 1…, with n the n-fold categorical product of 1. Such categories are often called Lawvere theories. A morphism of Lawvere theories is a finite product-preserving functor F such that F 1 = 1. Of course, only finitary theories, that is theories on operations of finite arity, are thus represented.

A T -algebra is a functor T → Sets preserving finite products, and we write [T , Sets ]_{alg} the full subcategory of such objects in [T , Sets ]. Let ϕ : T_{2} → T_{1} preserve finite products; the relative interpretation ϕ^{∗} : [T_{1}, Sets ]_{alg} → [T_{2}, Sets ]_{alg} has left adjoint [GU75]. Let T_{0} be the Lawvere theory whose only morphisms are the projections; this is the initial object in the category of Lawvere theories and its category of algebras is Sets itself: [T_{0}, Sets ]_{alg} ≅ Sets . The relative interpretation induced by the unique T_{0} → T is the forgetful functor Uα = α(1), whose left adjoint is the free T -algebra construction F : Sets → [T , Sets ]_{alg}. We say that the monad induced on Sets by this adjunction classifies the theory T. A consequence of the Yoneda lemma is that T is equivalent to the dual of the full subcategory of [T , Sets ]_{alg} whose objects are free algebras of the form F (n), for n a natural number [KR77]. As Theorem 6.5.4 shows, the same phenomenon arises in the doctrine of finite limit theories. We use this property in section 6.8 to give a categorical characterization of HML relative interpretation.

Digression on algebras and monads. Any monad on Sets cassifies some algebraic theory, provided operations of arbitrarily large arity are allowed, in which case the theory is called infinitary. Vice versa, any (possibly infinitary) algebraic theory is classified by some monad on Sets . This is Linton’s classical result [Lin66]. Kelly and Power [KP93] extend this result to any locally finitely presentable category (see below), but only for finitary monads, that is monads whose underlying functor preserves filtered colimits. In [Rob95], E. Robinson points out that the correspondence between monads and algebraic theories in categories enriched over symmetric monoidal closed categories is rather general and does not depend on finiteness.

Let T be a strong monad (we are now describing a special case of the above situation, where C is enriched over itself and T is a C-monad). The correspondence between T - algebras and algebras of the theory T̂ classified by T is as follows: for every T -algebra α : T A → A there is a family of morphisms α̂_{B} = α^{∘}eval ^{∘}(st × id ) : A^{B} × T B → A, satisfying the axioms specified in [Rob95]. Using lambda notation, α̂_{B}(f, z) = α(T f(z)). The morphisms α̂_{B} represent all the operations of arity B of a T̂-algebra on A; these operations are indexed by T B. Conversely, any family F_{B} : A^{B} × T B → A satisfying the axioms, yields a T -algebra F_{A}(id_{A}). The two constructions are mutually inverse. Note that let_{B,A} = (μ̂_{A})_{B} provides the operations of arity B of the free algebra on T A.

□

A class of algebras closed under subalgebras, images and products is called a variety. Varieties can be characterized as classes of models of equational theories; this is known as Birkhoff’s variety theorem (see [Wec92]). Similarly, locally finitely presentable (lfp) categories (see below) can be characterized as categories of models of finite limit theories. Here, we state a classic result about such theories and lfp categories that we use in section 6.8. Proofs can be found in [Pit82,AR94], together with the pointers to the standard literature.

A finite limit theory, or lex (from left exact) theory is a category with all finite limits. We call Lex the category of small lex categories and finite limits-preserving functors (lex functors). The category [T , Sets ]_{lex} of set valued models of a lex theory T is cocomplete. In fact one can say more. The following definitions are from [Pit82, 4.19]:

Definition 6.5.1 Let A be a locally small category with small filtered colimits. We say that an object A of A is finitely presentable when the representable functor A(A, ) preserves small filtered colimits.

Definition 6.5.2 A class X of objects of a category A is called conservative when, given f : B → C in A, if A(A, f) : A(A, B) → A(A, C) is a bijection for each A ∈ X, then f is an isomorphism.

Definition 6.5.3 A is locally finitely presentable (lfp) if it is locally small, cocomplete and it contains a conservative set X of objects, each of which is finitely presentable and such that any finitely presentable object in A is isomorphic to some object in X.

Theorem 6.5.4 ([GU75]) If T is a small lex category, then [T , Sets ]_{lex} is lfp and its full subcategory of finitely presentable objects is equivalent to T^{op}. Conversely, if C is lfp, the dual of its full subcategory of finitely presentable objects is equivalent to a small lex category T and [T , Sets ]_{lex} ≅ C.

In [GU75], Gabriel and Ulmer go further and establish a duality between the category of finite limit theories and the one of lfp categories: the function mapping lex categories T to functor categories [T, Sets ]_{lex} extends to a functor [ , Sets ]_{lex} : Lex^{op} → LFP , where LFP is the category of lfp categories and filtered colimit-preserving functors with a left adjoint. Conversely, let C be an lfp category; we write C_{fp} the full subcategory of finitely presentable objects of C. This category is essentially small, i.e. equivalent to a small category and, in what follows, we shall leave the equivalence implicit. Let Ψ : C → D be a morphism in LFP ; the functor Φ which is left adjoint to Ψ restricts to a cocartesian functor Φ_{fp} : D_{fp} → C_{fp} and hence it yields a morphism Φ_{fp}^{op} : D_{fp}^{op} → C_{fp}^{op} in Lex . In this way, the map C ↦ C_{fp}^{op} extends to a functor ( )_{fp}^{op} : LFP → Lex^{op} which forms an adjoint equivalence with [ , Sets ]_{lex} (see [Pit82] for details).

In the next section we give examples of categorical notions that can be described by finite limit theories. Categories themselves are such an example. The existence of a finite limit theory of categories implies that the category Cat of small categories, is lfp. Our goal is to show that all the categorical structure of which models of HML are made is described by a finite limit theory, and hence that the categoy of such models is lfp. This allows us to give an intrinsic characterization of relative interpretation of HML theories by using the Gabriel-Ulmer duality.

6.6 Finite limit presentation of category theory

The categorical structure required for interpreting HML is now described formally in finite limit formulae, that is formulae of the form:

∀x. ϕ(x) ⊃ ∃!y. ψ(x, y)

where x and y are tuples of variables, and ϕ and ψ conjunctions of atomic formulae. Such formulae are equivalent to conjunctions of Horn clauses and are called universal Horn sentences in [KR77]. We usually drop the universal quantifier but understand that it is there to bind the free variables.

In [Kea75], Keane establishes a correspondence between finite limit formulae and lex categories: models of a first order theory whose axioms are finite limit formulae can be regarded as finite limit-preserving functors from a suitable lex category (an “abstract theory”) into Sets and homomorhisms between models as natural transformations. In this way, we obtain a representation of models of HML. The same result could be obtained by working with finite limit sketches instead (see [BW85] for details), but these are harder to read than the corresponding theories when complicated categorical structure is involved.

Categories. The finite limit theory of categories has signature consisting of two sorts C_{A} and C_{O} representing respectively the collections of arrows and that of objects, function symbols src and tgt of arity C_{A} → C_{O} representing source and target, a function symbol e of arity C_{O} → C_{A} for the identities and a predicate symbol m of arity C_{A} × C_{A} × C_{A} for composition. The axioms of the theory are:

tgt (f) = src (g) ⊃ ∃!h. m(f, g, h)

m(f, g, h) ⊃ tgt (f) = src (g) ∧ src (f) = src (h) ∧ tgt (g) = tgt (h)

m(f, g, u) ∧ m(g, h, v) ∧ m(f, v, w) ⊃ m(u, h, w)

src (e(a)) = a ∧ tgt (e(a)) = a

m(e(a), f, g) ⊃ f = g m(f, e(a), g) ⊃ f = g

The first two axioms state that composition is a partial function defined on composable arrows. The third axiom, expressing the commutativity of m, and its dual m(f, g, u) ∧ m(g, h, v) ∧ m(u, h, w) ⊃ m(f, v, w) are interderivable.

It is easy to verify that categories are set theoretic models of the finite limit theory of categories and functors are homomorphisms between such models. Hence, applying Keane’s result, there exists a lex category T_{Cat} such that:

Cat ≅ [T_{Cat} , Sets ]_{lex}.  (6.4)

Remark. In order to describe categories one needs source and target functions of type C_{A} → C_{A} and composition as above, where the part of objects is played by the identities. This theory is essentially algebraic [Fre72], that is, an equational theory involving partial operations, e.g. composition, ordered in a list such that the domain of each operation is defined by equations in the previous.

Slices of Cat . Let C be a category. We extend the above finite limit theory of categories as follows: there is a constant ^{⌈}A^{⌉} : C_{O} for each object A of C and a constant ^{⌈}f^{⌉} : C_{A} for each arrow f : A → B with axioms src^{⌈}f^{⌉} = ^{⌈}A^{⌉} and tgt^{⌈}f^{⌉} = ^{⌈}B^{⌉}. There are axioms e^{⌈}A^{⌉} = ^{⌈}id_{A}^{⌉} for the identities and similarly for composition. We call this extension the finite limit theory of C.

A model m of such a theory consists of a small category D (the internal category in Sets whose object of objects is m(C_{O}), whose object of arrows is m(C_{A}) and so on) together with a map of objects A ↦ m^{⌈}A^{⌉} from C to D and a map of arrows f ↦ m^{⌈}f^{⌉}, all satisfying suitable diagrams, making of m a functor C → D. It is routine to verify that homomorphisms h : m_{1} → m_{2} amount to commuting triangles

C h^{D_{1}}  D_{2}. m_{1}  m_{2}

Applying Keane’s result to the theory of C, there exists a lex category th (C) such that

C/Cat ≅ [th (C), Sets ]_{lex}.

Note that, since the equivalence [T_{1}, Sets ]_{lex} ≅ [T_{2}, Sets ]_{lex} implies T_{1} ≅ T_{2}, we conclude that th (∅) ≅ T_{Cat}, where ∅ is the empty category.

Functors. The finite limit theory of functors, which we write F : A → B, consists of two copies A and B of the above theory of categories, a function symbol F : A_{A} → B_{A} and the following axioms:

src (f) = src (g) ⊃ src (F f) = src (F g)

tgt (f) = tgt (g) ⊃ tgt (F f) = tgt (F g)
F (ex) = e(src (F (ex)))
m(g, f, h) ∧ m(F f, F g, k) ⊃ F h = k

Note that the derived operation F_{O} : A_{O} → B_{O} defined as F_{O}x = src (F (ex)) satisfies: src (F f) = F_{O}(src (f)) tgt (F f) = F_{O}(tgt (f)) F (ex) = e(F_{O}x).

We shall drop the subscript in F_{O} if no ambiguity arises. It is easy to verify that functors are set theoretic models of F : A → B.

Natural transformations. They are similarly defined by a theory ν : F \underrightarrow{.} G : A → B with a function symbol ν : A_{O} → B_{A} and axioms:

src (ν(x)) = F x

tgt (ν(x)) = Gx
m(ν(src (f)), Gf, h) ∧ m(F f, ν(tgt (f)), k) ⊃ h = k.

Adjunctions. We write F ⊣ G : A ⇀ B for the finite limit theory of adjunctions, which consists of two natural transformations η : I \underrightarrow{.} GF : A → A and ϵ : F G \underrightarrow{.} I : B → B satisfying the triangular laws ϵF^{∘}F η = id and Gϵ^{∘}ηG = id , that is:

\begin{matrix}m(F (η(x)), ϵ(F x), e(F x)) \\ m(η(Gy), G(ϵ(y)), e(Gy)). \end{matrix}

Cloven and split fibrations. A cloven fibration is a functor p : E → B with a choice of cartesian morphisms. The finite limit theory of such objects features a predicate cart on E_{A}, to capture cartesian morphisms, and a predicate cleav (f, a, h) ⊆ B_{A} × E_{O} × E_{A} assigning to each morphism f of B and object a in the fibre over the target of f a cartesian morphism h over f with target a:

cart (h) ∧ tgt (h) = tgt (k) ∧ m(v, p(h), p(k)) ⊃ ∃!w. p(w) = v ∧ m(w, h, k)
tgt (f) = p(a) ⊃ ∃!h. cleav (f, a, h)
cleav (f, a, h) ⊃ cart (h) ∧ p(h) = f ∧ tgt (h) = a.

If p : E → B is cloven and f : A → B is a morphism in B, f^{∗} : E_{B} → E_{A} mapping objects b over B to the source of the cartesian h such that cleav (f, b, h) is called reindexing along f. A cloven fibration is said to split when reindexing is consistent with composition, that is: (g^{∘}f)^{∗} = f^{∗}^{∘}g^{∗}. In finite limit clauses:

m(f, g, j) ∧ m(h, k, l) ∧ cleav (g, a, k) ∧ cleav (f, src (k), h) ⊃ cleav (j, a, l).

Fibred adjunctions. Let p : E → B and q : D → B be fibrations; a functor F : E → D such that q^{∘}F = p is said to be over B, and written F : p → q, when it preserves cartesian maps:

cart (h) ⊃ cart (F (h)).

When p and q are understood, we shall still write F : E → D to mean F over B. In particular, if A is an object of B, we understand B/A as the source of the domain fibration dom_{A} : B/A → B.

A morphism in the total category of a fibration p is called vertical if it is mapped by p to an identity. A fibred adjunction between functors F and G over B is an adjunction F ⊣ G with vertical unit and counit. It is easy to see that the unit is vertical if and only if so is the counit. Hence, to turn a pair of adjoint functors over B into a fibred adjunction, it is enough to postulate:

p(η(a)) = e(p(a)).

Fibred cartesian closed structure. Fibred terminal objects, fibred products, and fibred exponentials are defined “globally” by the fibred adjunctions shown in the picture and discussed below.

B prod Ep B Ep  id 1  B  E ×_{B} E p ×_{B} p  ẽxp B p  Δ  { \atop prod} Cart (E) ×_{B} E Cart (E) ×_{B} E |p| ×_{B} p  |p| ×_{B} p

A fibred terminal object for p is given by a fibred right adjoint to p : p → id_{B} over B. Let p : E → B be a fibration and F : C → B a functor; the pullback F^{∗}p of p along F in Cat is a fibration, which is cloven or split when p is cloven or split [Jac91, 1.1.3]. Note that, given two copies F : A → C and G : B → C of the theory of functors, there is a straightforward axiomatization in finite limit formulae of the pullback F^{∗}G. When q : D → B is a fibration, we write q ×_{B} p for the fibration (q^{∗}p)^{∘}q : D ×_{B} E → B. Fibred products are given by a fibred right adjoint prod to the obvious diagonal functor over B. Similarly, let |p| : Cart (E) → B be restriction of p to the category Cart (E) whose objects are the same as E and whose morphisms are the cartesian, and let { \atop prod} : Cart (E)×_{B} E → Cart (E) ×_{B} E map (A, B) to (A, prod (A, B)); fibred exponentials are given by a fibred right adjoint ẽxp to p̃rod [Jac91].

Generic objects. A generic object for a fibration p : E → B is an object ⊤ of E such that there exists a cartesian morphism X → ⊤ for each X in E. If p is split, a generic object is given by an object Ω of B and an equivalence ^{⌈} ^{⌉} : dom_{Ω} → |p|, where |p| : Split (E) → B is the restriction of p to the category Split (E) whose objects are the same as E and whose morphisms are the ones of the splitting [Jac91]. In this case, ⊤ = ^{⌈}id_{Ω}^{⌉} is generic.

Fibrations with a generic object are used to interpret type theories with type variables. A minimal example is simply typed λ-calculus with judgements of the form A : type ⊢ A → A : type .

D-products. The following construction endows a fibration p : E → B with right adjoints to reindexing functors along cartesian projections satisfying the Beck-Chevalley condition. In 4.3.4, we called such adjoints “D-products,” where D is the comprehension category of cartesian projections. In [See87], Seely calls weak completeness the corresponding notion in the world of indexed categories.

Let B have binary products. Let D be the category whose objects are projections a × b → b and whose arrows are pullbacks:

f b a × b  a × c c id × f

that we write as pairs (a, f). Hence, D_{O} = B_{O} × B_{O} and D_{A} = B_{O} × B_{A}. Let D : D → B be the domain functor (a, f) ↦ id_{a} ×f and C : D → B the codomain functor (a, f) ↦ f. Let D_{0} and D_{1} be the vertices of the pullbacks of p respectively along D and C. The functor P : D_{1} → D_{0} mapping (f, x), with f : a × px → px, to (f, f^{∗}x) is a fibred functor C^{∗}p → D^{∗}p over B. Then, p has D-products if and only if P has fibred right adjoint [Jac91].

6.7 Models of HML

To simplify the treatment of semantics, we consider only the equational fragment of HML, as the full type theory can be handled similarly. Therefore, we do not include predicates in the signatures, we allow only equations as formulae and we consider only truth judgements Γ; Δ ⊢_{Σ,T} ϕ with empty Δ. Moreover, since universal quantification is not available anymore, we allow theories to contain open equations ϕ as axioms and require that the free variables of ϕ are in dom (Γ) as side condition to the rule (axiom).

Below, when talking about an HML theory, we shall always understand an equational one.

This fragment of HML is similar to the polymorphic lambda calculus PLC, mentioned in section 6.3. There is a correspondence between theories of PLC and categorical structures called PL-categories [See87]. A PL category (F, B) consists of a category B with finite products and a distinguished object Ω such that ( × Ω) ⊣ ( )^{Ω}, and an indexed category F : B^{op} → Cat satisfying certain conditions [See87, Def. 2.1]. A type τ of PLC has a double interpretation in (F, B): it is interpreted as a morphism A → Ω of B in a judgement τ : Ω and as an object of F A in a judgement M : τ. To make this consistent, PL categories require an isomorphism:

hom (A, Ω) ⟶^{^{⌈} ^{⌉}} obj (F A)  (6.5)

such that F f^{⌈}g^{⌉} = ^{⌈}g^{∘}f^{⌉}. This condition forces F to be a functor (rather than a pseudofunctor) and therefore it corresponds to ^{⌈} ^{⌉} being natural in A.

Remark. PL-categories can otherwise be described as split fibrations p : E → B with extra structure. In particular, the natural isomorphism (6.5) corresponds to p having a generic object. Note that, if p : E → B is obtained by applying the Grothendieck construction [Jac91] to the indexed category of a PL-category, ⊤ is the object (^{⌈}id^{⌉}, Ω) in the fibre over Ω. In fact, for any object (X, A) of the total category E, there is a cartesian morphism (f, id ) : (X, A) → (^{⌈}id^{⌉}, Ω), where X = ^{⌈}f^{⌉}.

□

In the previous section, we saw that a generic object for a split fibration amounts to an equivalence B/Ω ≅ Split (E) over B. To model the lifting of HML types to type schemes, where no such equivalence is required, we only ask for a functor F : B/Ω → E over B. Proposition 6.7.1 below, ensures that such a functor behaves well with respect to reindexing, so that interpretation may commute with substitution.

Let p be a fibration and let A be an object of B. A fibred version of the Yoneda lemma [Jac91, 1.1.9] asserts that there is an equivalence of categories E_{A} ≅ Fib (B)(dom_{A}, p), natural in a suitable sense, where Fib (B) is the category of fibrations with base B and functors over B. In particular, the equivalence maps an object X over A to the functor ( )^{∗}X : B/A → E and, conversely, a functor F : B/A → E to F (Id_{A}).

Proposition 6.7.1 Let p : E → B be a fibration and let ⟶^{f}⟶^{g} A be morphisms in B; if F : B/A → E is a functor over B, then f^{∗}F (g) ≅ F (g^{∘}f).

Proof. f^{∗}F (g) ≅ f^{∗}g^{∗}F (Id_{A}) ≅ (g^{∘}f)^{∗}F (Id_{A}) ≅ F (g^{∘}f). □

In the case of split fibrations, fibred Yoneda yields an isomorphisms between E_{A} and Fib_{split}(B)(dom_{A}, p), and the equivalence of proposition 6.7.1 turns into an equality. This isomorphism says that types can be coherently lifted to type schemes by just distinguishing an object in the total category.

Definition 6.7.2 A λ\overline{ω}-category is a split fibration with fibred cartesian closed structure over a cartesian closed base, a distinguished object in the total category and right adjoints to reindexing along cartesian projections satisfying the Beck-Chevalley condition.

We use λ\overline{ω}-categories to model HML theories. Note that, besides the decay of the generic object to a mere “distinguished,” λ\overline{ω}-categories differ from PL-categories in that they support no Σ-types. On the other hand, they have all exponentials in the base to model polymorphism of higher order with full generality.

An interpretation of an HML theory T over a signature Σ in a λ\overline{ω}-category p : E → B is a map defined on the derivable judgements of T as follows (we write only the relevant part of a judgement inside the semantic brackets when the rest is understood):

Kinds. A Σ_{K}-structure in p is an assignment of an object [[K]] of B to each constant K : kind in Σ. Given such a structure, the kinds of T are interpreted as objects of B, where 1, × and ⇒ have the obvious meaning. Moreover, the kind interpretation [[Γ]]^{K} of a context Γ in B is: [[∅]]^{K} = 1, [[Γ, v : k]]^{K} = [[Γ]]^{K} × [[k]] and [[Γ, x : σ]]^{K} = [[Γ]]^{K}.

If (v_{1} : k_{1}, … v_{n} : k_{n}) is the context containing all the variables over kinds in Γ, we write Γ ↓ for the kind k_{1} × … × k_{n}; then, [[Γ]]^{K} = [[Γ ↓]].

Operators. A Σ_{KO}-structure is a Σ_{K}-structure together with an assignment of a global elemet [[C]] : 1 → [[k]] in B to each C : k in Σ. Given a Σ_{KO}-structure, operators Γ ⊢ u : k are interpreted as morphisms [[u]] : [[Γ]]^{K} → [[k]] in B. Ignoring variables ranging over schemes, interpretation of operators in B is just as usual for simply typed lambda calculi in cartesian closed categories.

All the rules for deriving operator equality are sound with respect to this interpretation; that is: if Γ ⊢ u_{1} = u_{2} : k is derivable, then [[Γ ⊢ u_{1} : k]] = [[Γ ⊢ u_{2} : k]].

Type schemes. A Σ_{KOS}-structure is a Σ_{KO}-structure together with an assignment of an object [[S]] in the fibre over [[k]] to each S : k ⇒ scheme in Σ. We use the same name for the functor

E dom  p B B/[[k]]  [[S]]

over B which corresponds to the object [[S]] by the isomorphism introduced after proposition 6.7.1.

Given a Σ_{KOS}-structure, a type scheme Γ ⊢ σ scheme is interpreted as an object [[σ]] in the fibre over [[Γ]]^{K}. If Γ ⊢ u : k and S : k ⇒ scheme , [[S(u)]] = [[S]][[u]]. If Γ ⊢ u : Ω, then [[Γ ⊢ u scheme ]] = [[u]]^{∗}⊤, where ⊤ is the distinguished object of p. Schemes of the form 1, σ_{1} × σ_{2} and σ_{1} ⇒ σ_{2} are interpreted in the obvious way using the fibred cartesian closed structure of p. If Γ, v : k ⊢ σ scheme , [[Πv : k. σ]] = Π_{Γ,k}[[σ]], where Π_{Γ,k} is right adjoint to the reindexing functor along the projection π_{Γ,k} : [[Γ]]^{K} × [[k]] → [[Γ]]^{K}. As for operators, if Γ ⊢ σ_{1} = σ_{2} is derivable, then [[σ_{1}]] = [[σ_{2}]].

The type scheme interpretation of a context Γ is an object [[Γ]]^{S} of E over [[Γ]]^{K} defined as follows: [[∅]]^{S} = 1, [[Γ, v : k]]^{S} = π_{Γ,k}^{∗}[[Γ]]^{S}, [[Γ, x : σ]]^{S} = [[Γ]]^{S} × [[σ]]. We write Γ ↑ for the product σ_{1} × … × σ_{n} of all schemes σ_{i} such that x_{i} : σ_{i} is in Γ. Since the reindexing functors preserve products, we have that [[Γ]]^{S} = [[Γ ↑]].

Terms. A Σ-structure is a Σ_{KOS}-structure together with an assignment of a morphism [[c]] : 1 → [[σ]] to each c : σ in Σ. Given a Σ-structure, a term Γ ⊢ e : σ is interpreted as a morphism [[e]] : [[Γ]]^{S} → [[σ]] in the fibre over [[Γ]]^{K}. Variables, constants, ∗ : 1, pairing, projection, λ-abstraction and λ-application are interpreted as usual using the cartesian closed structure in the fibres. If Γ, v : k ⊢ e : σ, then [[Λv : k. e]] = [[e]]†, where f† is the transpose of f for the adjunction π_{Γ,k}^{∗} ⊣ Π_{Γ,k}. If Γ ⊢ e : (Πv : k. σ) and Γ ⊢ u : k, then [[e[u]]] = ⟨id , [[u]]⟩^{∗}[[e]]††, where ( )†† is inverse to ( )†.

Equations. An equation Γ ⊢_{Σ,T} e_{1} =_{σ} e_{2} holds in (or is satisfied by) a λ\overline{ω}-category with a Σ-structure if [[e_{1}]] = [[e_{2}]].

□

Since the interpretation of a theory T over Σ in a λ\overline{ω}-category p is completely determined by a Σ-structure S in p, we can view interpretations as pairs (p, S). A model of T is an interpretation satisfying the axioms. If Γ ⊢_{Σ,T} e_{1} =_{σ} e_{2} holds in all models of T, we write:

Γ ⊧_{Σ,T} e_{1} =_{σ} e_{2}.

Theorem 6.7.3 (Soundness) Γ ⊢_{Σ,T} e_{1} =_{σ} e_{2} implies Γ ⊧_{Σ,T} e_{1} =_{σ} e_{2}.

Proof. As usual, we have to show that the inference rules preserve truth. All this is quite standard in categorical models of type theory, where each pair of β and η-rules correspond to suitable adjunctions. We only show Π.β as example:

[[Γ ⊢ [u/v]e : [u/v]σ]] =
⟨id , [[u]]⟩^{∗}[[Γ, v : k ⊢ e : σ]] =
⟨id , [[u]]⟩^{∗}([[Γ, v : k ⊢ e : σ]]†)†† =
⟨id , [[u]]⟩^{∗}[[Γ ⊢ Λv : k. e : (Πv : k. σ)]]†† =
[[Γ ⊢ (Λv : k. e)[u] : [u/v]σ]].

□

Any HML theory T has a syntactic model (p_{T} : E_{T} → B_{T}, S_{T}). Objects of B_{T} are kinds. Morphisms k_{1} → k_{2} of B_{T} are sequents v : k_{1} ⊢ u : k_{2} modulo the equations of T. Since the operators used to construct B_{T} have at most one free variable v, we can identify them up to renaming of v. Identities are v : k ⊢ v : k and composition is given by substitution. B_{T} has cartesian closed structure given by the obvious operations on kinds and operators.

Objects of E_{T} are sequents v : k ⊢ σ scheme modulo the equations of T. Morphisms (v_{1} : k_{1} ⊢ σ scheme ) → (v_{2} : k_{2} ⊢ τ scheme ) are pairs of sequents

((v_{1} : k_{1} ⊢ u : k_{2}), (v_{1} : k_{1}, x : σ ⊢ e : [u/v_{2}]τ))

modulo the equations of T. As for operators, schemes and terms are identified up to renaming of free variables. When the rest is understood, we write (k, σ) for the objects of E_{T} and (u, e) for the arrows. Identities and composition in E_{T} are obvious.

It is easy to see that p_{T} mapping (k, σ) to k and (u, e) to u is a fibration whose cartesian morphisms are the ones where e is an iso. Moreover, let v_{1} : k_{1} ⊢ u : k_{2} and let v_{2} : k_{2} ⊢ σ scheme ; the cleavage obtained by taking (u, id_{[u/v_{2}]σ}) as chosen cartesian morphism over u with target (k_{2}, σ) makes p_{T} split.

This fibration has a distinguished object v : Ω ⊢ v : scheme and fibred cartesian closed structure given by the obvious operations on schemes and terms. As for D-products, Π_{k_{1},k_{2}}(w : k_{1} × k_{2}, σ) =^{def} (v_{1} : k_{1}, Πv_{2} : k_{2}. [⟨v_{1}, v_{2}⟩/w]σ) is right adjoint to reindexing π_{k_{1},k_{2}}^{∗}(v_{1} : k_{1}, τ) = (w : k_{1} × k_{2}, [π_{1}(w)/v_{1}]τ). In fact, the derivable rule scheme

(ΠI T) \frac{w : k_{1} × k_{2}, x : [π_{1}(w)/v_{1}]τ ⊢ e : σ}{v_{1} : k_{1}, x : τ ⊢ Λv_{2} : k_{2}. [⟨v_{1}, v_{2}⟩/w]e : (Πv_{2} : k_{2}. [⟨v_{1}, v_{2}⟩/w]σ)}

yields a bijection (E_{T})_{k_{1}×k_{2}}(π_{k_{1},k_{2}}^{∗}τ, σ) → (E_{T})_{k_{1}}(τ, Π_{k_{1},k_{2}}σ), natural in σ and τ, with inverse:

(ΠE T) \frac{v_{1} : k_{1}, x : τ ⊢ e : (Πv_{2} : k_{2}. [⟨v_{1}, v_{2}⟩/w]σ)}{w : k_{1} × k_{2}, x : [π_{1}(w)/v_{1}]τ ⊢ [π_{1}(w)/v_{1}]e[π_{2}(w)] : σ} .

A canonical Σ-structure S_{T} can be found in p_{T} by interpreting each constant as itself. In particular, a constant S : k ⇒ scheme is interpreted as v : k ⊢ S(v) scheme .

Proposition 6.7.4 Interpretation in (p_{T}, S_{T}) is such that:

[[k]] = k
[[Γ]]^{K} = Γ ↓
[[Γ ⊢ u : k]] = w : Γ ↓⊢ [π_{i}(w)/v_{i}]u : k
[[Γ ⊢ σ scheme ]] = w : Γ ↓⊢ [π_{i}(w)/v_{i}]σ scheme
[[Γ]]^{S} = w : Γ ↓⊢ [π_{i}(w)/v_{i}]Γ ↑
[[Γ ⊢ e : σ]] = w : Γ ↓, x : [π_{i}(w)/v_{i}]Γ ↑⊢ [π_{i}(x)/x_{i}] [π_{i}(w)/v_{i}]e : [π_{i}(w)/v_{i}]σ.

Proof. It is a long induction on the derivation of judgements. We show one example for kinds (v) and one for terms (ΠI). Let Γ ↓= k_{1} × … × k_{n}.

(v) [[Γ ⊢ v_{j} : k_{j}]] =
(w : Γ ↓⊢ π_{j}(w) : k_{j}) =
(w : Γ ↓⊢ [π_{i}(w)/v_{i}]v_{j} : k_{j}).

Let w : Γ ↓ and u : k be operatos; we write π_{i}⟨w, u⟩ = π_{i}(w) and π⟨w, u⟩ = u the projections of Γ ↓ ×k. By inductive hypothesis, [[Γ, v : k ⊢ e : σ]] is equal to z : Γ ↓ ×k, x : [π_{i}(z)/v_{i}]Γ ↑⊢ [π_{i}(x)/x_{i}] [π_{i}(z)/v_{i}] [π(z)/v]e : [π_{i}(z)/v_{i}] [π(z)/v]σ; then, by (ΠI T) we have:

(ΠI) [[Γ ⊢ Λ v : k. e : (Π v : k. σ)]] =

w : Γ ↓, x : [π_{i}(w)/v_{i}]Γ ↑ ⊢ Λ v : k. [⟨w, v⟩/z] [π_{i}(x)/x_{i}] [π_{i}(z)/v_{i}] [π(z)/v]e :

Π v : k. [⟨w, v⟩/z] [π_{i}(z)/v_{i}] [π(z)/v]σ =

w : Γ ↓, x : [π_{i}(w)/v_{i}]Γ ↑ ⊢ Λ v : k. [π_{i}(x)/x_{i}] [π_{i}(w)/v_{i}]e : (Π v : k. [π_{i}(w)/v_{i}]σ) = w : Γ ↓, x : [π_{i}(w)/v_{i}]Γ ↑ ⊢ [π_{i}(x)/x_{i}] [π_{i}(w)/v_{i}]Λ v : k. e : [π_{i}(w)/v_{i}]Π v : k. σ.

□

Using the above proposition, it is trivial to verify that the axioms of T are satisfied by (p_{T}, S_{T}) because of their immediate derivability; hence (p_{T}, S_{T}) is a model.

Theorem 6.7.5 (Completeness) Γ ⊧_{Σ,T} e_{1} =_{σ} e_{2} implies Γ ⊢_{Σ,T} e_{1} =_{σ} e_{2}.

Proof. If Γ ⊧_{Σ,T} e_{1} =_{σ} e_{2}, then Γ ⊢_{Σ,T} e_{1} =_{σ} e_{2} must hold in (p_{T}, S_{T}). Since semantic identity in the λ\overline{ω}-category p_{T} corresponds to provable equality, the judgement w : Γ ↓, x : [π_{i}(w)/v_{i}]Γ ↑⊢ [π_{i}(x)/x_{i}] [π_{i}(w)/v_{i}]e_{1} =_{[π_{i}(w)/v_{i}]σ} [π_{i}(x)/x_{i}] [π_{i}(w)/v_{i}]e_{2} must be derivable. Then, the result is obtained by substituting Γ ⊢ ⟨v_{1}, … v_{n}⟩ : Γ ↓ for w and Γ ⊢ ⟨x_{1}, … x_{m}⟩ : Γ ↑ for x. □

Remark. In [See87], a relative interpretation of PLC theories is defined semantically to be an interpretation of one theory in the term model of another. Similarly, the syntactic and semantic notions of relative interpretation of HML coincide: any interpretation of an HML theory T_{1} in a syntactic λ\overline{ω}-category p_{T_{2}} factorizes through the canonical interpretation of T_{2} in p_{T_{2}} via a unique relative interpretation T_{1} → T_{2}.

6.8 Syntactic presentation of constructors

In this section we give a characterization of the semantic constructors which can be presented as relative interpretations of HML theories, as in the example of section 6.4.

Outline of the section. Our first step is to get rid of the syntax by adopting an abstract, presentation invariant view of HML theories as λ\overline{ω}-categories. To justify this step, we establish an equivalence between the category of HML theories and that of λ\overline{ω}-categories (theorem 6.8.4), like is done in [See87] for PLC. Then, the models of a theory T are defined functorially as morphisms of λ\overline{ω}-categories; this is justified by proposition 6.8.5. The category Mod (T) of such models is shown to be equivalent to the category [T, Sets ]_{lex} of set valued models of a finite limit theory T, which is locally finitely presentable. Moreover, we show that the functors Mod (ϕ) : Mod (T_{1}) → Mod (T_{2}) induced by a relative interpretation ϕ : T_{2} → T_{1} have left adjoints and that they preserve filtered colimits (theorem 6.8.10). This allows us to use the Gabriel-Ulmer duality to give an intrinsic characterization of functors of the form Mod (ϕ) (theorem 6.8.12).

Definition 6.8.1 A λ\overline{ω}-functor p_{1} → p_{2} between λ\overline{ω}-categories p_{1} : E_{1} → B_{1} and p_{2} : E_{2} → B_{2} is a morphism (J, H) of fibrations such that J : B_{1} → B_{2} preserves the cartesian closed structure, H : E_{1} → E_{2} preserves the distinguished object, the fibred cartesian closed structure and D-products. We call λ\overline{ω}-Cat the category of small λ\overline{ω}-categories and λ\overline{ω}-functors.

We make the simplifying assumption that all the structure is preserved “on the nose,” although this is not crucial for the development of the theory. In particular, preserving D-products means that, for all π_{A} : B × A → B in B, H_{B}Π_{A} = Π_{B}H_{B×A}.

Proposition 6.8.2 Any model of an HML theory T in a λ\overline{ω}-category p factorizes through the canonical interpretation in p_{T} via a unique λ\overline{ω}-functor p_{T} → p.

We omit the proof of this proposition, which only involves routine calculations.

In order to establish an equivalence between λ\overline{ω}-Cat and the category of HML theories, we must make our notion of theory more general. To represent in HML the information contained in a λ\overline{ω}-category, we must allow signatures to contain infinitely many constants (of finite arity) and theories to contain infinitely many axioms. Moreover, in order to capture the structure of the base category syntactically, we must allow the axioms of a theory to include equations between kinds and operators. We call HMLC the category of such theories and relative interpretations.

Now we can give a construction (dual to that of syntactic models) to produce an HML theory from a λ\overline{ω}-category p : E → B. Let Σ_{p} be the following signature: the objects of B are constant kinds; the arrows C : K_{1} → K_{2} of B are constant operators C : K_{1} ⇒ K_{2}; objects S in E_{K} are constant schemes S : K ⇒ scheme ; morphisms c : S_{1} → S_{2} of E above C : K_{1} → K_{2} are constant terms c : (Π v : K_{1}. S_{1}(v) ⇒ S_{2}(C(v))). We call T_{p} the theory over Σ_{p} whose axioms are equations C_{2}(C_{1}(v)) = C_{3}(v), for all C_{2}^{∘}C_{1} = C_{3} in B, c_{2}[C_{1}(v)](c_{1}[v](x)) = c_{3}[v](x), for all c_{2}^{∘}c_{1} = c_{3} in E and C_{1} = p(c_{1}), and all the equations describing the categorical structure of p, e.g. K_{1} ⇒ K_{2} = K_{3} for all K_{2}^{K_{1}} in B, etc. The canonical interpretation mapping each constant into itself makes of p a model of T_{p}.

Proposition 6.8.3 Any model of an HML theory T in a λ\overline{ω}-category p factorizes through the canonical interpretation of T_{p} in p via a unique relative interpretation T → T_{p}.

Let p be a model of T and let [[ ]] be the interpretation; the relative interpretation given by the above proposition maps constant kinds K to [[K]], constant operators C to [[C]](∗), constant type scheme S to [[S]](v) and constant terms c to [[c]](∗).

Theorem 6.8.4 HMLC ≅ λ\overline{ω}-Cat.

Proof. The function mapping λ\overline{ω}-categories p to HML theories T_{p} can be extended to a functor T_{( )} : λ\overline{ω}-Cat → HMLC mapping a λ\overline{ω}-functor F : p_{1} → p_{2} to the relative interpretation T_{p_{1}} → T_{p_{2}} obtained by applying the above proposition to T_{p_{1}} ⟶^{[[ ]]} p_{1} ⟶^{F} p_{2}. Similarly, the function mapping HML theories T to their syntactic models p_{T} extends to a functor p_{( )} : HMLC → λ\overline{ω}-Cat mapping a relative interpretation ϕ : T_{1} → T_{2} to the λ\overline{ω}-functor p_{T_{1}} → p_{T_{2}} obtained by applying proposition 6.8.2 to T_{1} ⟶^{ϕ} T_{2} ⟶^{[[ ]]} p_{T_{2}}. Moreover, from propositions 6.8.2 and 6.8.3, we obtain a bijection between the homsets HMLC (T, T_{p}) and λ\overline{ω}-Cat (p_{T}, p), natural in T and p. Hence p_{( )} ⊣ T_{( )}. It is easy to see that η : p → p_{T_{p}} is a natural isomorphism whose inverse is the λ\overline{ω}-functor associated with the canonical interpretation of T_{p} in p by proposition 6.8.2. Similarly, ϵ : T_{p_{T}} → T is a natural isomorphism whose inverse is the relative interpretation associated with the canonical interpretation of T in p_{T} by proposition 6.8.3. This shows that p_{( )} ⊣ T_{( )} is an adjoint equivalence between HMLC and λ\overline{ω}-Cat. □

Before the syntax can abandon the scene, a suitable functorial notion of category of models of a HML theory must be established. Let Σ be an HML signature; a Σ-homomorphism (p, S) → (q, R) between interpretations of a theory T over Σ is a λ\overline{ω}-functor (J, K) : p → q such that, for all constant kinds K, operators C, parametric schemes S and terms c in Σ, J[[K]]_{S} = [[K]]_{R}, J[[C]]_{S} = [[C]]_{R}, H[[S]]_{S} = [[S]]_{R} and H[[c]]_{S} = [[c]]_{R}. The category of models of a theory T over Σ and Σ-homomorphisms form a category Mod (T ).

Remark. Using the notion of Σ-homomorphism, proposition 6.8.2 can be rephrased as follows: let (p, S) be a model of a theory T over Σ; there exists a unique Σ-homomorphism (p_{T}, S_{T}) → (p, S); that is, the syntactic model (p_{T}, S_{T}) is initial in the category Mod (T ).

Proposition 6.8.5 Mod (T) ≅ p_{T}/λ\overline{ω}-Cat.

The object map of this equivalence is given by proposition 6.8.2. Let Σ be the signature of T, it is easy to verify that there is a one-to-one correspondence between Σhomomorphisms (p, S) → (q, R) and commuting triangles

pS  R p_{T} q.

In view of proposition 6.8.4 and 6.8.5, we write Mod (p) for the category p/λ\overline{ω}-Cat of models of the “λ\overline{ω}-theory” p. From now on, the syntax of HML will not concern us anymore.

In section 6.6, we wrote a finite limit theory of categories and invoked Keane’s result to conclude that there exists a lex category T_{Cat} such that Cat ≅ [T_{Cat}, Sets ]_{lex}. The same argument applies to λ\overline{ω}-categories, whose structure was also described in finite limit sentences: there exists a lex category T_{λ\overline{ω}} such that λ\overline{ω}-Cat ≅ [T_{λ\overline{ω}}, Sets ]_{lex}. Hence, from theorem 6.5.4, it follows that the category λ\overline{ω}-Cat is locally finitely presentable. Since any slice of a locally λ-presentable category is locally λ-presentable [AR94, 1.57], and hence any slice of an lfp category is lfp, the following proposition holds:

Proposition 6.8.6 The category Mod (p) is locally finitely presentable.

Digression on accessible categories. Closure under slicing does not hold for λaccessible categories [AR94], that is if the condition of co-completeness is removed: a slice of a λ-accessible category may not be λ-accessible, although it would be accessible for some λ′ > λ.

□

Next step towards our characterization theorem is to extend the map Mod to a functor λ\overline{ω}-Cat^{op} → LFP .

Proposition 6.8.7 Let h : A → B be a morphism in a category C with pushouts; the functor h/C : B/C → A/C has left adjoint.

Proof. Let F : A/C → B/C be the functor mapping f : A → C to the pushout of ←^{f} · →^{h} as in the figure.

· B h  D F (f) A C f  g

Given g : B → D, the bijection (B/C)(F f, g) ≅ (A/C)(f, g^{∘}h) = (A/C)(f, (h/C)g), natural in f and g, yields an adjunction F ⊣ h/C. □

Remember that a functor F : A → B creates filtered colimits when, for every filtered category J and functor G : J → A such that F^{∘}G has a colimit ν : F^{∘}G \underrightarrow{.} C, there exists a unique cone σ : G \underrightarrow{.} A such that F σ = ν and moreover σ is a colimit.

Let X be an object in a category C; we write cod_{X} : X/C → C the functor mapping arrows X → Y to their codomain Y. We drop the subscript when no confusion arises.

Lemma 6.8.8 Let X be an object in a category C; the functor cod_{X} creates filtered colimits.

Proof. Let J be a filtered category, let F : J → X/C be a diagram in X/C and let ν : cod_{X} ^{∘}F \underrightarrow{.} C be a colimit in C. Since J is filtered, the composites ν_{j} ^{∘}F (j), for all objects j of J, are equal to the same arrow g : X → C. As an object of X/C, g is the vertex of cone on F with components ν_{j} : F (j) → g; moreover, there can be no other cone μ such that cod_{X} ^{∘}μ = ν. Using the universality of ν, this cone is shown to be a colimit in X/C. □

Proposition 6.8.9 Let f : X → Y be an arrow in a category C with filtered colimits; the functor f/C : Y/C → X/C of precomposition with f preserves filtered colimits.

Proof. Let ν be a colimiting cone over a diagram F in Y/C. Since C has all filtered colimits and, by the above lemma, cod_{Y} : Y/C → C creates them, the cone cod_{Y} ^{∘}ν must be colimiting in C. Since cod_{Y} ^{∘}ν = cod_{X} ^{∘}(f/C)^{∘}ν and cod_{X} : X/C → C creates filtered colimits, it follows that (f/C)^{∘}ν is a colimit in X/C as required. □

Theorem 6.8.10 Let ϕ : p → q be a λ\overline{ω}-functor; the functor Mod (ϕ) =^{def} ϕ/λ\overline{ω}-Cat : q/λ\overline{ω}-Cat → p/λ\overline{ω}-Cat of precomposition with p is a morphism in LFP and hence the relative interpretation map Mod extends to a functor λ\overline{ω}-Cat^{op} → LFP .

Proof. Since λ\overline{ω}-Cat is lfp, hence complete, proposition 6.8.7 ensures that the functor ϕ/λ\overline{ω}-Cat = Mod (ϕ) has left adjoint, while proposition 6.8.9 ensures that it preserves filtered colimits. □

In view of the above theorem, we call Mod the relative interpretation functor.

In [BW85, 4.4], the finite limit theory generated by a finite limit sketch is obtained as the full subcategory of the category of models of the sketch whose objects are representable. Similarly, we obtain a functor th : λ\overline{ω}-Cat → Lex by composing Mod with the functor ( )_{fp}^{op} of section 6.5, which returns the subcategory of finitely presentable objects of an lfp category: th (p) = (p/λ\overline{ω}-Cat)_{fp}^{op}.

Let α be the natural transformation Mod \underrightarrow{.} ([ , Sets ]_{lex}^{∘}th^{op}) whose components are the equivalences of categories Mod (p) ≅ [(Mod (p))_{fp}^{op} , Sets ]_{lex}; the pair (th , α) forms a morphism of indexed lfp categories:

α^{th^{op}}^{λ\overline{ω}-Cat^{op}}^{Lex^{op}} [ , Sets ]_{lex} Mod LFP

Let Mod_{lex} be the category whose objects are lex functors into Sets and whose morphisms F → G, for F : T_{1} → Sets and G : T_{2} → Sets , are pairs (H, ν), where the functor H : T_{1} → T_{2} preserves finite limits and ν is a natural transformation F \underrightarrow{.} G^{∘}H; let α̂ : λ\overline{ω}-Cat^{→} → Mod_{lex} be the functor α̂(m) = α_{dom(m)}(m); noticing that models are fibred over theories by the domain fibration dom : λ\overline{ω}-Cat^{→}→ λ\overline{ω}-Cat, the functor th can alternatively be viewed as part of a morphism of fibrations:

λ\overline{ω}-Cat  th  Lex^{dom_{lex}}^{Mod_{lex}}^{λ\overline{ω}-Cat^{→}}  α̂ dom

The functor Mod is not full, that is, not all filtered colimit-preserving right adjoint functors Mod (q) → Mod (p) are syntactically induced by a relative interpretation p → q in λ\overline{ω}-Cat. In fact, we need an extra condition and the following lemma to justify it:

Lemma 6.8.11 Let θ : th (p) → th (q) be a lex functor; if θ^{∘}th (?_{p}) = th (?_{q}), where ?_{x} is the unique morphism ∅ → x from the initial object in λ\overline{ω}-Cat, then θ is of the form th (ϕ) for some λ\overline{ω}-functor ϕ : p → q.

We adopt the following informal argument as proof of this lemma. The idea is to use sketches to give a more concrete picture of categories of the form th (p). In fact, we consider a simplified scenario, where categories take the place of λ\overline{ω}-categories.

Consider the finite limit sketch of categories C described in [BW90, 9.1.4]; models in Sets of this sketch correspond to small categories and arrows between models to functors. The graph of C is:

arrows^{various} C_{R}  C_{Q}  C_{A}  C_{O} m  e src tgt

The nodes C_{A} and C_{O} represent the set of arrows and of objects; src and tgt represent the source and target maps while e yields the identities. The sketch C includes a cone over the diagram C_{A} ⟶^{src} C_{O} ⟵^{tgt} C_{A}, whose vertex C_{Q} represents composable pairs of arrows. The edge m represents composition. Similarly, C_{R} represents composable triples, with obvious arrows into C_{Q}.

For any finite limit sketch S, there exists a lex theory T such that the category of models of S in Sets is equivalent to [T, Sets ]_{lex} (see [BW90, 9.3.1]). Since the equivalence [T_{1}, Sets ]_{lex} ≅ [T_{2}, Sets ]_{lex} implies T_{1} ≅ T_{2}, from (6.4) we conclude that the lex category T_{Cat} introduced in section 6.6 is (equivalent to) the category associated with the above sketch C.

Similarly, given a specific category C, we call sk (C) the finite limit sketch obtained as follows: a node 1 is added to the graph of C together with a cone over the empty diagram with vertex 1. Moreover, for each object A of C, sk (C) has an edge ^{⌈}A^{⌉} : 1 → C_{O} and, for each arrow f : A → B, an edge ^{⌈}f^{⌉} : 1 → C_{A} with diagrams src ^{∘}^{⌈}f^{⌉} = ^{⌈}A^{⌉} and tgt ^{∘}^{⌈}f^{⌉} = ^{⌈}B^{⌉}. Identities and composition of C are represented in sk (C) straightforwardly. Applying to sk (C) the same argument that we applied above to C, we conclude that the finite limit theory associated with sk (C) is the lex category th (C) introduced in section 6.6. There is an obvious inclusion th (?_{C}) : T_{Cat} ≅ th (∅) ↪ th (C).

It is easy to verify that there is a one-to-one correspondence between lex functors θ : th (C) → th (D) such that θ^{∘}th (?_{C}) = th (?_{D}) and functors C → D. In fact, this equation ensures that θ is a C-homomorphism, that is, that it preserves the objects C_{A}, C_{O} and so on. Therefore, θ maps objects 1 → C_{O} of C to objects 1 → C_{O} of D and arrows to arrows in such a way that identities and composition are preserved. A similar correspondence can be established if categories are replaced by λ\overline{ω}-categories and functors by λ\overline{ω}-functors. This concludes our informal proof of lemma 6.8.11.

Theorem 6.8.12 (Characterization theorem) Let p and q be λ\overline{ω}-categories, let ?_{p} and ?_{q} be as in lemma 6.8.11 and let Ψ : Mod (q) → Mod (p) be a filtered colimit-preserving functor with a left adjoint; Ψ is of the form Mod (ϕ), for some λ\overline{ω}-functor ϕ : p → q, if and only if Mod (?_{p})^{∘}Ψ = Mod (?_{q}).

Proof. (Only if) Noticing that the functors Mod (?_{x}) : Mod (x) → Mod (∅) ≅ λ\overline{ω}-Cat are the codomain projections (x → y) ↦ y, the result follows immediately from the definition of Mod .

(If) For simplicity we treat the equivalences Mod (p) ≅ [th (p), Sets ]_{lex} as identities. Let Φ, Φ_{p} and Φ_{q} be left adjoints respectively to Ψ, Mod (?_{p}) and Mod (?_{q}). From Mod (?_{p})^{∘}Ψ = Mod (?_{q}), it follows that Φ^{∘}Φ_{p} = Φ_{q} and hence, since (Φ_{p})_{fp}^{op} = th (?_{p}) (and similarly for q), we have Φ_{fp}^{op}^{∘}th (?_{p}) = th (?_{q}). By lemma 6.8.11, it follows that Φ_{fp}^{op} = th (ϕ), for some ϕ : p → q. Then, Ψ = [Φ_{fp}^{op}, Sets ]_{lex} = [th (ϕ), Sets ]_{lex} = Mod (ϕ).

□

The intuition behind this theorem is that th (∅) = T_{λ\overline{ω}} provides a “signature” for all cartesian theories in Lex which describe λ\overline{ω}-categories. Functors Ψ : Mod (q) → Mod (p) induced by relative interpretations of λ\overline{ω}-theories correspond, in the Gabriel-Ulmer sense, to th (∅)-homomorphisms between finite limit theories: this is expressed by the condition in lemma 6.8.11 which is equivalent to Mod (?_{p})^{∘}Ψ = Mod (?_{q}).

This characterization of relative interpretation can be adapted to any formal language whose models are described by a finite limit theory. For example, theories of the simply typed lambda calculus with unit type and products correspond to catresian closed categories [LS86], which are set-valued models of a finite limit theory, as shown in section 6.6. Therefore, functors Ψ : Mod (T_{1}) → Mod (T_{2}) arising from relative interpretations T_{2} → T_{1} of simply typed lambda calculi, can be characterized as above. The same argument also applies to theories of the higher order polymorphic lambda calculus, exploiting the correspondence between such theories and PL-categories [See87].

7 Application: constructing with LEGO

In the previous chapter we presented semantic constructors. Here we use a type theory, the Extended Calculus of Constructions (XCC) [Luo82], as a formal framework for developing specific examples. We take advantage of an implementation of XCC, LEGO [LP92], to check the correctness of our implementation. Below we explain how we use LEGO to develop denotational semantics and list the features of XCC that are crucial to the applications that we present.

At the beginning of the ’80s, Dana Scott suggested that an intuitionistic universe of sets should be the natural setting in which to develop a theory of domains. Since then, but most notably in recent years, synthetic domain theory ([Ros86,Pho90,Hyl90,Tay91, RS]) has sought a good full subcategory of an elementary topos in which to carry out the mathematics of computation.

Our development of denotational semantics is consistent with synthetic domain theory: a category Dom to interpret computation is fully embedded in the category U of XCC types, which provides an intuitionistic universe of sets. We refer to Dom as the category “of domains.” This is done rather informally, since we do not actually axiomatize domain theoretic structure in Dom (for an axiomatic approach to domain theory see [Fio94b,Fio94a,Mog95a]).

The category of domains is implemented in LEGO by assuming a type Dom:Type (of names of domains) and a Dom-indexed family E:Dom->Type of domain-like types. The operation E, the likes of which are sometimes called “large eliminations,” embeds domains in the universe of types. In this way, the presentation of relevant categorical constructions, such as fixed-point operators or initial algebras of endofunctors, becomes very natural and requires none of the syntactic overhead that a full encoding of category theory in the type theory would call for.

In order to prove that a semantic structure is adequately represented by a term S of the type theory, one can show that S is interpreted as a structure of the appropriate form in models of the type theory. For example, in section 7.1 we notice that terms of type Monad in the implementation define internal monads in the category of types. Part of the effort in establishing a precise correspondence between intended mathematical objects and their description in type theory goes into understanding how the notion of equality adopted in the description relates to semantic identy in the models. We use Leibniz equality.

The applications that we present use the following features of the type theory. A universe (viz. Type(0)) is used for the synthetic domain theory set-up (Dom and E), as well as for defining uniform redefinitions (section 7.2). Dependent types are exploited for representing polymorphic operations, such as the natural transformations val and let of the computational metalanguage or the operations to raise and handle exceptions. Sigma types (dependent sums) provide a useful abstraction mechanism for structuring theories in proof development. We also use inductive sigma types in the definition of the internal category of domains (section 7.1). Moreover, type inference and coercion, specific to the LEGO system, allow agile notation.

Synopsis. In 7.1 we give a formal account of structures and interpretation of the computational metalanguage in LEGO. In 7.2 we implement a semantic constructor for exceptions and one for resumptions. The latter is used in section 7.3, where we present an application in which a model of a computational metalanguage featuring an operator of parallel composition is constructed from models of simpler forms of computation. Some of the material in this section comes from [CM93] and is due to Moggi. Ours is the implementation in LEGO including all the formal proofs. In the last section we discuss a concrete model of the type theory based on ω-sets and show that the structure we assumed in the application can be found in this model.

7.1 Structures and interpretation

In section 2.4 we defined a suitable notion of Σ-structure to interpret lambda calculi of the form L(Σ). Here we represent such structures in the XCC and write a small application in LEGO where they are used in a formal interpretation of the computational metalanguage ML_{T}. For simplicity, we consider a minimal version of the metalanguage with no unit or product types.

We represent categorical structure in XCC by defining types such as Functor, Monad etc, which we think of as signatures and whose terms represent structures, such as functors, monads and so forth, on a fixed category Dom . Order theoretic structure can be axiomatized in Dom as shown in [Fio94a]. Let Dom be a type, whose inhabitants we view as names of domains, and let E be an externalization map embedding domains in the universe of types:

[Dom : Type]
[E : Dom->Type];

The category Dom arises from these data as a full internal subcategory of the universe of types (see appendix B for the full definition):

defn  Dom1 = Sigma [X:Dom](Sigma [Y:Dom](E X)->E Y)] : Type (* arrows *)
defn  Dom2 = ... : Type         (* composable arrows *)
defn  d0 = ... : Dom1->Dom      (* domain *)
defn  d1 = ... : Dom1->Dom      (* codomain *)
defn  i = ... : Dom->Dom1       (* identity *)
defn  o = ... : Dom2->Dom1      (* composition *)

As shown by the definition of Dom1, the arrows of Dom are borrowed from the function spaces of the type theory. Inductive sigma types (Sigma) are used in the definition of Dom1 and Dom2; they provide the η rule for dependent pairs, which is used for making the diagrams involving the composition map commute. It is immediate to verify that this definition satisfies the appropriate equations. For example, here is the proof in LEGO that the domain of the identity arrow on X is X:

Goal {X:Dom}Eq X (d0 (i X));
Intros;
Immed;

In developing the modular approach in LEGO, we use a variety of structures, whose signatures are represented by types such as Sum, Prod, Exponential and Ind, all defined in appendix C. The signature Ind for inductive types includes the higher order operators mu and It described in section 6.3, taking functors as arguments. Here is the signature of strong monads (in the following, when mentioning a monad, we shall understand a strong one, unless otherwise stated):

[Monad =
<T:Dom->Dom>
<val:{X|Dom}(E X)->E(T X)>
<let:{X,Y|Dom}((E X)->E(T Y))->(E(T X))->E(T Y)> Unit ];

The axioms of a monad should really be part of the type Monad, and constructors F:Monad -> Monad should include a proof that F M satisfies the appropriate equations. However, to keep the implementation simple, we deal with the axioms separately. Below, we list the axioms of the theory of monads. The functions T, val and let are used to extract from a monad M the corresponding data, so that (T M):Dom->Dom, and so on.

[AX_LUNIT= [M:Monad]{X|Dom}{x:E(T M X)} Eq x (let M (val M|X) x)];
[AX_RUNIT= [M:Monad]{X,Y|Dom}{f:(E X) -> E(T M Y)}
            Eq f ([x:E X]let M f (val M x))];
[AX_ASSOC= [M:Monad]{X,Y,Z|Dom}{c:E(T M X)}{f:(E X) -> E(T M Y)}
            {g:(E Y) -> E(T M Z)}
            Eq (let M ([x:E X]let M g (f x)) c) (let M g (let M f c))];

Remark. Interpreting terms of type Monad in an extensional model of the type theory, one obtains an internal monad in Dom , and therefore a monad fibred over the universe of types. The use of a fibred monad is consistent with the semantics for Evaluation Logic proposed in [Moga].

□

The formal interpretation of the computational metalanguage ML_{T} requires the structure of products, exponentials and a monad. To write it in LEGO we must first encode ML_{T}. Assuming the type Grd of ground type symbols, the syntax of ML_{T} is defined by the types Ty, Con, Var and Exp representing types, contexts, variables and terms. Contexts are lists of types. De Bruijn’s method of variable binding is implemented by including context information inside variables. In particular, the variable x in the context (C, (x : A), D) has the form (Weak… (Weak (Vo C T)…), where D is represented by the successive applications of Weak. The type (Exp C A) represents well-formed ML_{T} terms of type A in context C. In appendix D, the types Ty, Var and Exp are inductive (the inductive types of LEGO, not to be confused with the inductive types in Dom provided by the signature Ind). This allows interpretation to be defined by induction on the structure of terms.

Remark We do not identify the variables of the object language with the ones of the type theory, as in the LF style, because this would make an inductive definition of interpretation unfeasible. In fact, let terms of type τ of the object language be interpreted by maps [[ ]]_{τ} : Exp (τ) → [[τ]] and suppose λ-abstractions are encoded in the type theory as terms ΛF, where F : Exp (σ) → Exp (τ) represents a term of type τ with a free variable of type σ in the object language. An interpretation [[ΛF]]_{σ⇒τ} : [[σ ⇒ τ]] ≡ [[σ]] → [[τ]] cannot be obtained from F, [[ ]]_{σ} and [[ ]]_{τ} unless we know how to map [[σ]] back into Exp (σ).

□

The encoding ϵ of ML_{T} in LEGO is defined as follows: Types and contexts are mapped respectively into terms of type Ty and Con. Terms Γ ⊢ M : σ are mapped into closed terms ϵ_{Γ,σ}(M) : Exp ϵ(Γ) ϵ(σ). We write Γ|Δ for the concatenation of two contexts. The symbols GR, TT and AR are the constructors of ML_{T} types, while VAR, LMB, APP, LET and VAL are the ones of ML_{T} terms (see appendix D).

ϵ(A) = GR A (for A:Grd)

ϵ(T σ) = TT ϵ(σ)

ϵ(σ → τ) = AR ϵ(σ) ϵ(τ)

ϵ_{Γ|x:σ|Δ,σ}(x) = VAR (Weak … (Vo ϵ(Γ) ϵ(σ)) …)

ϵ_{Γ,σ→τ}(λ x : σ. M) = LMB ϵ_{Γ|x:σ,τ}(M) ϵ_{Γ,τ}(M N) = APP ϵ_{Γ,σ→τ}(M) ϵ_{Γ,σ}(N) ϵ_{Γ,T τ}(let x ⇐ M in N) = LET ϵ_{Γ|x:σ,T τ}(N) ϵ_{Γ,T σ}(M) ϵ_{Γ,T σ}(val(M)) = VAL ϵ_{Γ,σ}(M).

Proposition 1 The map ϵ is a bijection between types (contexts) of ML_{T} and canonical terms of type Ty (Con) in XCC. For every type σ and context Γ of ML_{T}, ϵ_{Γ,σ} is a bijection between terms Γ ⊢ M : σ and canonical terms of type Exp ϵ(Γ) ϵ(σ) of XCC.

A formal interpretation of ML_{T} in Dom is defined in appendix E by recursion on the structure of the syntactic domains. The parameters of the interpretation are structures of type Prod, Exponential and Monad. Terms of type Grd, Ty and Con are interpreted respectively by I_Grd, I_Ty and I_Con as elements of Dom, while terms of type Var and Exp are interpreted by I_Var and I_Exp in the externalization of the appropriate domain;

for example, given terms P:Prod, X:Exponential and M:Monad, a term e:(Exp c t) of

type t in context c is interpreted as a map

     I_Exp P X M (e): (E (I_Con P X M c))->E (I_Ty X M t).

One of the benefits of making interpretation parametric in a notion of computaiton is that models can be augmented with new semantic structure with no need of rewriting the interpretation function. Using the above interpretation of the computational metalanguage, let F:Monad->Monad implement a monad constructor and let M be a structure of type Monad, interpretation in F(M) is simply:

     I_Exp P X (F M) (e): (E (I_Con P X (F M) c))->E (I_Ty X (F M) t).

7.2 Examples of constructors

In this section we inplement in LEGO two semantic constructors described in [CM93], one for exceptions and one for resumptions. We give a formal proof of the correctness of the first, that is, we show that it maps monads to monads. The second is used in the next section to define and reason about models of parallel computation based on interleaving.

Exceptions. In order to make the LEGO code less cryptical, we first introduce the constructor for exceptions as a translation, as we did for resumptions in section 6.4, using a simpler syntax: the computational metalanguage.

Let B be a collection of base type symbols, including the symbol E for the base type of exceptions, and let raise and handle be operations of arities ∀X.E ⟶ T X and ∀X.T X, (E → T X) ⟶ T X respectively. Let Σ_{1} = (B, +, inj_{1}, inj_{2}, case ) be a signature for sums and let Σ_{2} = (B, raise , handle ) be one for exceptions. A constructor Mod (Σ_{1}) → Mod (Σ_{2}) is defined by the following translation ([ ]) : ML_{T} (Σ_{2}) → ML_{T} (Σ_{1}):

([B]) =^{def} B  (B ∈ B)
([σ → τ]) =^{def} ([σ]) → ([τ])
([T τ]) =^{def} T (([τ]) + E)
([val (M)]) =^{def} val (inj_{1}([M]))
([let (M)]) =^{def} let (case ([M]) (λ x : E. val (inj_{2} x)))

([raise (M)]) =^{def} val (inj_{2}([M]))
([handle (M, N)]) =^{def} let (case (λ x. val (inj_{1} x)) ([N]))([M]).

Let (C, T, A) be a model of ML_{T} (Σ_{1}); the translation ([ ]) defines a strong monad ([T])X =^{def} T (X+E) and a Σ_{2}-structure (similarly) in C. There is a strong monad morphism (id , σ) : (C, T) → (C, ([T])), where σ = T (inj_{1}). Such a morphism extends to one in Mod (Σ_{2}), which makes this constructor pointed (in the sense of section 6.2).

Let Sum be the signature of the theory of sums described in appendix C, providing an operation + on domains, injections and an operation of case analysis; the above constructor is implemented in LEGO by a function Exceptions which, given S:Sum, a domain Exn:Dom of exceptions and a monad M:Monad, returns a 5-tuple of operations

(E T, E val, E let, raise, handle):
[Exceptions [S:Sum] [Exn:Dom] [M:Monad] =
        [E_T [X:Dom] : Dom = T M (sum S X Exn)]
        [E_val [X|Dom] [x:E X] : E (E_T X) = val M (in1 S|X|Exn x)]
        [E_let [X,Y|Dom] [f:(E X)->E(E_T Y)] : (E (E_T X)) -> E(E_T Y) =
                let M(case S f ([x:E Exn] val M (in2 S x)))]
        [raise [X|Dom][n:E Exn] : E (T M (sum S X Exn)) =
                (val M (in2 S|X|Exn n))]
        [handle [X|Dom][c:E(T M (sum S X Exn))]
                [h: (E Exn) -> E (T M (sum S X Exn))] : E(T M (sum S X Exn))=
                let M (case S ([x:E X] val M (in1 S x)) h) c]
        (E_T, E_val, E_let, raise, handle)];

The first three components of this tuple are extracted and wrapped up as a monad by

the function Exception Constructor:Sum->Dom->Monad->Monad. As mentioned earlier,

it must be separately verified that, if M satisfies the axioms AX LUNIT, AX RUNIT and AX ASSOC, so does the structure (Exception Constructor S Exc M). Below we formally verify the first axiom, while the others are proven in appendix F. Given a monad M, the function ax lunit returns a witness of (AX LUNIT M) (similarly for ax runit and ax assoc in the appendix).

Goal {S:Sum}{Exn:Dom}{M:Monad}AX_LUNIT (Exception_Constructor S Exn M);
Normal;
Intros;
Qrepl ax_case S|X|Exn|(T M(sum S X Exn)) (val M|(sum S X Exn));
Qrepl Eq_sym (ax_lunit M|(sum S X Exn)|x);
Immed;

Resumptions. Below we present Resumptions, which is an implementation in LEGO of the constructor F described in section 6.4 (for simplicity, H : Ω ⇒ Ω is the identity).

As with monads, we extract from a structure F of type Functor an object map

(FT F):Dom->Dom and a strength (str F)|X|Y: ((E X)->E Y)->(E(T X))->E(T Y).

Any structure M of type Monad has an obvious substructure (Monad to Functor M) of type Functor. Given S:Sum, F:Functor and A:Dom, (RF S F A) is the functor mapping X to T(A+X), which was written F_{A} in section 6.4. Similarly, (Res S Z M)A represents the domain μ(F_{A}) = μX.T(A+X), where T is the underlying endofunctor of the monad M and μ comes from the structure Z:Ind of inductive types.

[RF [S:Sum] [F:Functor] [X:Dom] : Functor =
        ([W:Dom] FT F (sum S X W),
        ([X1,X2|Dom][f:(E X1)->E X2] str F
          (case S (in1 S|X|X2) ([z: E X1] in2 S (f z)))), star:Functor)];
[Res [S:Sum] [Z:Ind] [M:Monad] =
     [X:Dom] mu Z (RF S (Monad_to_Functor M) X)];

Given sums, inductive types and a monad, Resumptions returns the following operations (see section 6.4 for an informal description):

      Res:Dom->Dom,

Rval:{X|Dom}(E X)->E (Res X),
Rlet:{X1,X2|Dom}((E X1)->E (Res X2))->(E (Res X1))->E (Res X2),

tau:{X|Dom}(E (Res X))->E (Res X) and

CH:{X1,X2|Dom}((E X1)->E (Res X2))->((E (Res X1))->E (Res X2))->
               (E (Res X1))->E (Res X2)
[Resumptions [S:Sum] [Z:Ind] [M:Monad] =
 [F [X:Dom] = RF S (Monad_to_Functor M) X]
 [Res = Res S Z M]
 [Rval [X|Dom] [x:E X] : E (Res X) =
       alg Z|(F X) (val M (in1 S x))]
 [tau [X|Dom][z:E (Res X)] : E (Res X) =
       alg Z|(F X) (val M (in2 S z))]
 [CH [X1,X2|Dom][f:(E X1)->E (Res X2)]
     [g:(E (Res X1))->E (Res X2)]
     [c:(E (Res X1))] : E (Res X2) =
        alg Z|(F X2) (let M
         ([d:E(sum S X1 (Res X1))] coalg Z|(F X2) (case S f g d))
         (coalg Z|(F X1) c))]
 [Rlet [X1,X2|Dom] [f:(E X1)->E (Res X2)] : (E (Res X1))->E (Res X2) =
         it Z|(F X1) ([c:E (T M (sum S X1 (Res X2)))] alg Z|(F X2)
                     (let M ([z: E (sum S X1 (Res X2))] coalg Z|(F X2)
                            (case S f (tau|X2) z)) c))]
 (Res, Rval, Rlet, tau, CH, star)];

We end this section with the implementation of uniform redefinitions (see section 6.2), which are used in the next section by a constructor F_{Σ} to convert the operations in Σ to a new computational setting. Here, we consider the case of unary operations; arbitrary arities are dealt similarly. Uniform redefinitions allow constructors of the form (7.1) below to redefine operations of the form (7.2):

(F T) X =^{def} T(G T X)  (7.1)

op_{X} : S(T X)  (7.2)

where G:Monad->Dom->Dom and S:Dom->Type. For example, let Exn be the domain of exceptions; in the exceptions constructor (F T) X =^{def} T(X+Exn), we have (G T X) = X+Exn, where G does not depend on T. Similarly, or_{X} : (E (T X))->(E (T X))->E (T X), the operator of nondeterministic choice introduced in the next section, is of the form (7.2), where (S X) is (E X)->(E X)->E X. A constructor F can uniformly redefine such operations as follows:

(Fop )_{X} =^{def} op_{(GT X)} : S(T(G T X)) ≡ S((F T) X).

In LEGO:

[Uniform_Redefinition1 [G:Monad->Dom->Dom][S:Dom->Type(0)][M:Monad] =
         [c:{X|Dom} S (T M X)] [X|Dom] c|(G M X)];

7.3 Parallel composition

In this section we give examples of formal proofs involving the modular constructions introduced earlier. We add a mechanism of resumptions to nondeterministic computations and, from the semantic structures thus obtained, we define an operator of parallel composition and prove in LEGO that this operator is commutative.

Let T:Dom->Dom be the object map of a monad M. Structures of type (Fix T) and (Nondetm M) provide operations respectively of fixed point and nondeterministic choice for M-computations:

[Fix [T:Dom->Dom] =
     <Yop:{X1,X2|Dom}(((E X1)->E(T X2))->(E X1)->E(T X2))->(E X1)->E(T X2)>
      Unit ];

[Nondetm [M:Monad] =
         <or : {X|Dom} (E (T M X)) -> (E (T M X)) -> E (T M X)> Unit];

The theory of nondeterminism states that or is commutative, i.e. or w z=or z w, and that it is natural, i.e. or(Tf w)(Tf z)=Tf(or w z), while the theory of fixed points includes the fixed point property of Yop and the axiom AX UNIFORMITY below.

A fixed point operator Y in the category of cpos is said to be uniform (see [Gun92, 4.2]) when, for any pair of continuous functions f : D → D and G : E → E and strict continuous function h : D → E such that h^{∘}f = g^{∘}h, we have Y g = h(Y f). Least elements and strictness can be axiomatized in Dom as shown in [Mog95a]. We shall not implement these axioms in LEGO: when required in a formal proof, we verify that a term denotes a strict morphism separately on our blackboard and allow ourself a free supply of witnesses of this condition, which we represent in LEGO with a constant predicate STRICT. The uniformity axiom is:

[AX_UNIFORMITY = [T|Dom->Dom][F:Fix T]{X1,X2,X3,X4|Dom}
                 {h:((E X1)->E(T X2))->(E X3)->E(T X4)}
                   (STRICT h)->
                     ({f:((E X1)->E(T X2))->(E X1)->E(T X2)}
                      {g:((E X3)->E(T X4))->(E X3)->E(T X4)}
                      ({k:(E X1)->E(T X2)} Eq (h(f k)) (g(h k)))->
                            {x:E X3} Eq (Yop F g x) (h (Yop F f) x))];

Starting from a monad M and structures F:(Fix (T M)) and N:(Nondetm M), we add resumptions to M-computation; the constructor Resumptions, F for short, is applied to M to obtain a monad F(M)=(Res,Rval,Rlet) and a Σ_{F}structure consisting of the operations tau and CH. Moreover, applying uniform redefinitions (not expanded here) to Yop and or, we produce new structures F F:Fix(T F M) and F N:(Nondetm F M), whose operations we call yrr and orr respectively.

The operation pand_{A,B} : Res(A) × Res(B) → Res(A × B) of parallel composition is defined formally in LEGO in appendix G. Here we give a more digestible version in lambda notation: using infix notation for orr and mix-fix notation for Rlet (as in the computational metalanguage),

pand_{A,B} = yrr (λ h : Res (A) × Res (B) → Res (A × B). λw : Res (A), z : Res (B).
CH (λ x : A. Rlet y ⇐ z in Rval ⟨x, y⟩, λ u : Res (A). h(u, z))w
orr CH (λ y : B. Rlet x ⇐ w in Rval⟨x, y⟩, λ v : Res (B). h(w, v))z).

Intuitively, pand_{A,B}(w, z) performs one step w ⇝ u of M-computation on w and then invokes pand_{A,B}(u, z), or it performs one step z ⇝ v of M-computation on z and then invokes pand_{A,B}(w, v). We look at the first of these branches, CH_{A,A×B}(f, g)w, of which the second is just the dual. CH_{A,A×B} performs case analysis on w : Res(A); if it is the M-computation of a value x, it returns the pair ⟨x, y⟩, where y is the value produced by z; this is done in f. Otherwise, if w is the M-computation of a resumption u, it runs pand_{A,B}(u, z), which is done by g.

Now we focus on an algebraic property of this operation: commutativity. Note that this cannot be expressed as pand_{A,B}(w, z) = pand_{B,A}(z, w), because the types are not quite right. Let (pswap|P|A|B) be the isomorphism (A × B) → (B × A), where the structure P:Prod provides the ×, and let Rstr be the morphism map of the functor Res; the precise statement of commutativity is:

  THM COMMUTATIVITY = {X1,X2|Dom} {w:E(Res X1)} {z:E(Res X2)}

                        Eq (pand z w) (Rstr (pswap P|X1|X2) (pand w z)).

Below is a sketch of the proof of THM COMMUTATIVITY, the gory LEGO details of which are given in appendix H.

Let H_{A,B} be the function of which pand_{A,B} is the fixed point, i.e. , pand_{A,B} = yrr(H_{A,B}), and let K : (Res(B) × Res(A) → Res(B × A)) → (Res(A) × Res(B) → Res(A × B)) be the function K(f, w, z) = (Rstr pswap) (f(z, w)). THM COMMUTATIVITY is an immediate consequence of:

yrr(H_{A,B}) = K(yrr(H_{B,A})).

To prove this equation we show that K^{∘}H_{B,A} = H_{A,B} ^{∘}K and that yrr is uniform (having proven the strictness of K on the blackboard). The equality K^{∘}H_{B,A} = H_{A,B} ^{∘}K follows from the commutativity of or and from the naturality of or and CH. The uniformity of yrr, is proven in appendix I. In particular, let the function Rfix of type

{S:Sum}{Z:Ind}{M:Monad}(Fix(T M))->Fix(Res S Z M) apply a uniform redefinition

to Fix-structures for the resumption constructor; we show:

Goal {S:Sum}{Z:Ind}{M:Monad}{F:Fix (T M)}
        (AX_UNIFORMITY F) -> AX_UNIFORMITY (Rfix S Z M F);

The proof of this statement uses the naturality of the fixed point operator of the structure Fix(T M) and the properties of inductive types, incliding Lambek’s lemma on initial algebras, the proof of which is shown in appendix C.

7.4 A concrete model

The interpretation of pand requires a certain amount of categorical structure in Dom . For example, Dom is assumed to support inductive types, whose universal properties are used for proving that pand is commutative. We show that all this structure can be found in a nontrivial model of XCC.

It is well known that, if k is an inaccessible cardinal number, all axioms of Zermelo-Frankel set theory are true in V_{k} (see [End77, theorem 9L]), so that V_{k} is a miniature (so to speak) version of the class of all sets. Luo’s ω-sets semantics for XCC (see [Luo82]) is based on a hierarchy of set universes V_{k} indexed by inaccessible cardinals. More precisely, as proposed by Tarski in 1938, ZF is augmented with a large cardinal axiom postulating for each cardinal number the existence of a larger inaccessible cardinal. In particular, this axiom yields ω inaccessible cardinals k_{0} < k_{1} < k_{2} … for indexing universes V_{k_{i}} with the required properties for interpreting the type hierarchy of XCC. Such universes satisfy the membership relation V_{k_{i}} ∈ V_{k_{i+1}}, the inclusion relation V_{k_{i}} ⊆ V_{k_{i+1}} and support predicative Π and Σ. An inaccessible k, with k_{i} < k for all i, is also provided to form the set of objects V_{k} of the all-containing category of sets, V_{k} = obj (Sets ), into which all universes embed with no foundational trouble.

As shown by a well known result of Reynolds concerning System F, there are features of XCC (viz. polymorphism) that cannot be given a simple set theoretic semantics. This led to the development of realizability models based on ω-sets. In [Luo82], Luo interprets types as ω-sets: Type(j) is interpreted as the full subcategory ω-Sets (j) of ω-Sets whose objects have carrier in the universe V_{k_{j}}. Then ω-Sets must be sufficiently large as to contain all the ω-Sets (j) and V_{k} comes to the rescue.

Prop is interpreted as the category PER of partial equivalence relations on N, whose good closure properties allow impredicative quantification over propositions. Such quantification is modelled in the fibration of PERs over ω-Sets, where the ω-set P_{0} of all PERs is a generic object. Note that PER is a small category and P_{0} is in ω-Sets (0), thus validating the axiom Prop:Type(0).

Notation. We write ω-Sets for the category of ω-sets whose carrier is a set in the universe V_{k}. The categories ω-Sets (j), for j = 0, 1 …, are similarly defined from universes V_{k_{j}} and they are full subcategories of ω-Sets. We write ω-Sets_{0}(j) for the ωset (obj (ω-Sets (j)), ω × obj (ω-Sets (j))) of objects at level j and similarly ω-Sets_{1}(j) for the object of arrows. Together, they form an internal subcategory of any of the ω-Sets (j + 1)… ω-Sets. We may refer to ω-Sets (j) as the intended external interpretation of Type(j) and to ω-Sets_{0}(j) as the internal one.

□

Let Dom_{0} be an ω-set providing the objects of the internal category Dom of predomains; the externalization map E:Dom->Type(0) is interpreted as a morphism of the form Dom_{0} → ω-Sets_{0}(0). The arrows of Dom are elements of the (Dom_{0} × Dom_{0})-indexed family {a : ω-Sets_{1}(0) | Dom (a) = E(X) ∧ cod (a) = E(Y)} obtained by pulling back ⟨Dom , cod ⟩ : ω-Sets_{1}(0) → ω-Sets_{0}(0)×ω-Sets_{0}(0) along [[E]]×[[E]]. The category ω-Sets has all finite limits because it is a full reflective subcategory of a complete category and hence such a pullback exists and it provides suitable domain and codomain maps for Dom .

To get inductive types it is enough to choose PER as Dom . PER is cartesian closed and the inclusion into ω-Sets factorizing through the equivalence Ψ : PER → Mod between PER and the category of modest sets is a full and faithful functor; [[E]] is the object map of such inclusion. Since PER is a small complete category, one gets initial T-algebras from the limit to the forgetful functor PER^{T} → PER (see [Lam93]).

To get fixed points we must give some domain structure to our objects. A suitable condition to ask for is extensionality which induces a canonical partial order in the domains of PERs (where antisymmetry holds modulo the relation). Moreover, any map between extensional PERs is continuous with respect to a suitable notion of ω-chain. So we further restrict PER and consider, as category of predomains, the algebraically complete subcategory ExP of extensional PERs studied in [FMRS90].

ExP is a small-complete cartesian closed category. This is because any full reflective subcategory of a small-complete category is also small-complete. Then, ExP gets all small limits from PER and hence it is suitable for modelling inductive types. As for cartesian closedness, we must make sure that, for A and B in ExP, the extensional PER A ⇒ B, as defined in [FMRS90], is complete. A way of doing this is by brute force, that is by showing that sup (μ) : A ⇒ B for any ascending sequence μ in A ⇒ B.

There is a more abstract proof based on the internal version of the above result on limits. Firstly, ExP is an internal category in ω-Sets, just like PER. If D is internally complete in ω-Sets, then the fibration [D] : Σ(D) → ω-Sets (see [Jac91, 1.4.4]) is complete (see [Pho92, 2.3.5]), so that we get exponentials B^{A} in D as Π_{A}B. Then, the fact that PER is complete relative to ω-Sets ([Pho92, 4.3.20]) fires the above implications and gives us exponentials in ExP.

Finally, we axiomatize fixed points only for endomorphisms on types of programs A ⇒ T B which we assume to have a least element. Such fixed points always exist since any map between extensional PERs is continuous.

8 Directions for further research

We have presented three applications of calculi based on monads and considered a variety of theoretical matters concerning the use of monads for modelling computation. Here, we list some issues that we believe deserve further attention.

Evaluation relations. In chapter 4, we obtained evaluation relations from an endofunctor and first order quantification; we argued that such relations are useful both semantically and proof-theoretically. In order to use evaluation relations in a program logic based on the computational metalanguage, we need general axioms relating them with the operations val and let . For example, while M ⇐ val (M) can be expected to hold of most notions of computation under the interpretation (4.8) of ⇐, not so for the rule

\begin{matrix}M ⇐ E N ⇐ F (M) \\ N ⇐ let (F, E) \end{matrix}

proposed in [CP92] to weaken the notion of evaluation in Fix-Logic, whose soundness depends on strong assumptions on let . In a weaker version of the above rule, the hypothesis N ⇐ F (M) can be replaced by val (N) = F (M). We have not yet investigated the strength of this or other axiomatizations.

Another question to be considered is how ⇐, as in (4.8), depends on lifting. From theorem 4.8.2, we reckon that (4.8) can be weaker (in the sense of producing a larger relation) than (4.5) when the lifting monad ( )_{⊥} does not classify all predicates of the logic. For example, if ( )_{⊥} is obtained from the trivial class of admissible monos including only isomorphisms, so that X_{⊥} ≅ X, we have that x ⇐_{1} w always holds. Then, in the case of the powerset monad, we obtain ∗ ⇐_{1} ∅, even though ∗ ∉ ∅. This raises the question of how can ⇐ be strengthened or weakened depending on the choice of ( )_{⊥} and whether this dependency can be exploited to capture different notions of evaluation.

A third question to investigate concerning the use of evaluation relations is whether, by exploiting the idea of propositions-as-types, they can be used to combine computational and dependent types. Computational types do not mix well with dependent types. To see this, consider the formation rule for let :

Γ ⊢ M : T τ Γ, x : τ ⊢ N : T σ
Γ ⊢ let x ⇐ M in N : T σ

If the type σ depends on the variable x : τ, the type T σ in the conclusion of this rule would incorrectly still depend on x. Instead, such an x should be bound to a possible value produced by M, as it is in let x ⇐ M in N. A relation ⇐_{A}, viewed as the type of all pairs of x : A and w : T A such that x ⇐_{A} w, can be used in combination with dependent products and sums to bind variables of type A to the result of A-computations. In view of the formulae (4.6) and (4.7), two natural candidates are:

Π x ⇐ M. σ(x) =^{def} Π x : A. (x ⇐_{A} M) → σ(x)
Σ x ⇐ M. σ(x) =^{def} Σ x : A. (x ⇐_{A} M) × σ(x).

Logical relations and computation. Logical relations are widely used in the study of lambda calculi [Tai67,Plo73,Sta85,MM85,Mit90,Her93] and programming language semantics [Rey83,Abr90a,AJ91,MR91,MS92,OT93].

In [Her93], a categorical view of logical predicates for the simply typed lambda calculus is given in terms of fibrations with logical structure. Let p : E → B be a fibred cartesian closed category with indexed products over a cartesian closed category B; in this case, E is also cartesian closed and p strictly preserves the cartesian closed structure [Her93, 3.3.11]. The idea is that B is a category of semantic objects, E is a category of predicates and the internal language of p provides a fragment of first order logic, with implication, conjunction and universal quantification, to talk about the semantic objects. Given a cartesian closed category L, viewed as a theory of the simply typed lambda calculus, and a structure-preserving functor [[ ]] : L → B, viewed as an interpretation of L in B, a family P = {P_{σ}}_{σ∈|L|} of logical predicates, indexed by the types of L, is defined by a structure preserving functor P : L → E such that p^{∘}P = [[ ]].

To convince oneself that such a P is “logical,” consider the predicate P_{σ→τ} over [[σ → τ]] = [[σ]] → [[τ]]; since P preserves the cartesian closed structure, we have that P_{σ→τ} is equivalent to P_{σ} → P_{τ}, which, in the internal language of p is written:

f : σ → τ ⊢ ∀ x : σ. P_{σ}(x) ⊃ P_{τ}(f(x)).

However, when computation is involved, Kleisli exponentials are used to interpret arrow types and hence the above picture must change. In chapter 3, programs of type σ → τ were interpreted as elements of [[σ]] → T [[τ]] and hence, in order to define the formal approximation relation ≤_{σ→τ} logically (section 3.6), we used a relation ⪯_{τ} extending ≤_{τ} to computations. We believe that a general categorical picture of logical relations involving computational types should emerge from an abstract understanding of the relation between the two families ≤ and ⪯.

Once such a picture is available, one can tackle the more ambitious goal of extending monad constructors to logical relations in the attempt to modularize the study of prooftheoretic and semantic properties of computation. For example, if ≤ and ⪯ are related by an action T̃ of the underlying functor of the monad T on a relational structure, corresponding families of relations could be obtained for the notion of computation F(T) by applying an “action constructor” F̃ to T̃.

Recursive predicates and computation. In section 5.4, while-programs were extended to include top-level assertions and, in section 5.5, this simple form of annotated programs were used in a proof of partial correctness. General annotated while-programs are obtained by including annotated programs (p, θ) in the syntax of while-programs. However, in order to express the weakest precondition of a while-loop whose body includes assertions, a fixed point operator on predicates is needed:

wp (while B do C od) =^{def} μP. B ⊃ (wp (C) ∧ [C] P).

In [BG87], A. Blass and Y. Gurevich deal with annotated while-programs by augmenting a universal quantification-free fragment of first order logic with inductive definitions of predicates. The Existential Fixed-Point Logic thus obtained allows them to remove the expressivity hypothesis in Cook’s completeness theorem for Hoare logic [Coo78]. According to the authors, the need for such an hypothesis in Cook’s proof indicates that first order logic is not the best one for dealing with programs. An interesting issue that we would like to explore in further research is the interaction between evaluation modalities and recursive predicates. This would also call for a comparison between a version of EL extended with a μ operator and existing modal μ-calculi (see [Sti92]).

Duality. Relative interpretations of HML theories are characterized by theorem 6.8.12 as morphisms in the slice category LFP /λ\overline{ω}-Cat. We argued that this characterization can be adapted to any formal language whose models are described by a finite limit theory:

Theorem 8.0.1 Any lfp category M fully embeds in the opposite of LFP /M via the inclusion I : M^{op} → LFP /M mapping X to ?_{X}/M : X/M → ∅/M ≅ M.

In order to turn the above theorem into a duality result, one should single out, by the intrinsic properties of its objects, a full subcategory H of LFP /M such that the above inclusion I restricts to H and is part of an adjoint equivalence M^{op} ≅ H. What we know of the objects G : A → M of such an H is that they are monadic functors (because so are the codomain functors cod_{X} : X/M → M) such that A ≅ G(∅)/M.

Semantic constructors and logics. The theory of semantic constructors, which was developed in chapter 6 for equational theories of computation, should be extended to richer logics, such as EL. Theorem 5.1.10 is an example where we ask whether a property expressed in EL is preserved by a semantic constructor. The closure of such constructors with respect to satisfaction of formulae should be investigated in further research. Related questions are whether the setting of synthetic domain theory that we adopted in chapter 4 is the most appropriate for studying the behaviour of semantic constructors with respect to logics and whether the standard interpretation of logic is beneficial in this context.

A The metalanguage HML

In the simply typed lambda calculus, types can be described separately from the terms. However, in some type theories where terms and types are mutually dependent, the formation rules of the ones cannot be given independently from the formation rules of the others. In HML, the integration of entities of different syntactic nature in a unique formal system is pushed further by including, besides types, objects such as signatures and theories that traditionally belong to the metatheory of the formal system.

Let s be a symbol in the set {sig , theory , kind , context , scheme , prop }; the prase “α s” in the conclusion of an HML sequent states the well formedness of an object α of the syntactic category corresponding to s, that is: signatures, theories, kinds, contexts, type schemes and formulae. Among these symbols, kind and scheme are “variable universes,” in the sense that a kind or a type scheme, that is an α such that (α s) is derivable, for s ∈ {kind , scheme }, can be used in a context as the range of a variable. An object u of kind k is called an operator, while an object e of type scheme σ is called a term. The well formedness of operators and terms is stated by sequents whose conclusion is u : k and e : σ respectively. Besides judgements of well formedness, HML features equality judgements on operators and schemes, and truth judgements involving formulae of first order logic with equality.

Note that prop could also be viewed as a variable universe: although there are no explicit expressions whose “type” is a formula, a truth judgement Γ; Δ ⊢_{Σ,T} ϕ (see below) asserting the truth of ϕ under the assumptions in Δ, can be viewed as introducing an invisible witness of ϕ. In this framework, the assumptions in Δ can be viewed as extending the context Γ and the axioms in the theory T as extending the signature Σ.

Type schemes depend on kinds, in the sense that, in a judgement Γ, v : k ⊢ σ scheme , σ may contain a free occurrence of v of kind k. Note that a scheme Γ ⊢ σ scheme cannot contain any variable x : σ ranging over a scheme that may be in Γ, that is: schemes do not depend on schemes. Formulae can contain both operator and term variables. Dependency relations between sorts [Jac91, 2.1.1] are often used to present type theories in view of a study of abstract models based on fibrations.

HML is inspired by the type theory described in [Mog91a]; the following definition comes, with minor changes, from [CM93], to which we added the raw syntax and the rules (add-P), (eqn) and (P).

Let Var_{O} and Var_{E} be disjoint countable sets of variables and let Const_{K}, Const_{O}, Const_{S}, Const_{E} and Const_{P} be disjoint sets of constants. The sets of raw kinds (K), operators (U), type schemes (S), terms (E), formulae (P), contexts (ℭ), signatures (𝔖) and theories (𝔗) of HML are given by the following grammar:

k ::= K | 1 | k_{1} × k_{2} | k_{1} ⇒ k_{2}
u ::= v | C | ∗ | ⟨u_{1}, u_{2}⟩ | π_{i}(u) | λ v : k. u | u_{1}(u_{2})
σ ::= u | S(u) | 1 | σ_{1} × σ_{2} | σ_{1} ⇒ σ_{2} | Π v : k. σ
e ::= x | c | ∗ | ⟨e_{1}, e_{2}⟩ | π_{i}(e) | λ x : σ. e | e_{1}(e_{2}) | Λ v : k. e | e[u]
ϕ ::= e_{1} =_{σ} e_{2} | P (u, e) | false | ϕ_{1} ∧ ϕ_{2} | ϕ_{1} ∨ ϕ_{2} | ϕ_{1} ⊃ ϕ_{2} | ∀ v : k. ϕ | ∃ v : k. ϕ |
∀ x : σ. ϕ | ∃ x : σ. ϕ
Γ ::= ∅ | Γ, v : k | Γ, x : σ
Σ ::= ∅ | Σ, K : kind | Σ, C : k | Σ, S : k ⇒ scheme | Σ, c : σ |
Σ, P : (v : k)σ ⇒ prop
T ::= ∅ | T , ϕ

where v ∈ Var_{O}, x ∈ Var_{E}, K ∈ Const_{K}, C ∈ Const_{O}, S ∈ Const_{S}, c ∈ Const_{E} and P ∈ Const_{P}. The above grammar defines the raw syntax of HML.

The usual notions of free variable, substitution and α-conversion applies to raw operators, schemes, terms and formulae. The only nonstandard notation occurs in signatures in the arity of predicates P : (v : k)σ ⇒ prop ; this indicates that σ has at most one free variable v of kind k.

The sequents of HML come in different shapes, depending on the kind of judgement they make. In the following table, the expressions in the first column define the set of judgements whose elements are classified in the second column and written as in the third.

𝔖 × K  kind formation  ⊢_{Σ} k kind
𝔖 × ℭ × U × K  operator formation Γ ⊢_{Σ} u : k
𝔖 × ℭ × S  scheme formation  Γ ⊢_{Σ} σ scheme
𝔖 × ℭ × E × S  term formation  Γ ⊢_{Σ} e : σ
𝔖 × ℭ × P  formula formation  Γ ⊢_{Σ} ϕ prop
𝔖 × ℭ  context formation  ⊢_{Σ} Γ context
𝔖 × ℭ × U × U × K  operator equality  Γ ⊢_{Σ} u_{1} = u_{2} : k
𝔖 × ℭ × S × S  scheme equality  Γ ⊢_{Σ} σ_{1} = σ_{2}
𝔖 × 𝔗 × ℭ × P^{∗} × P truth  Γ, Δ ⊢_{Σ,T} ϕ

where Δ ∈ P^{∗} is a possibly empty sequence of raw formulae. The type theory HML is defined by the following inference rules over the above sets of judgements:

Signatures

start \overline{⊢ ∅ sig}

add-K \frac{⊢ Σ sig}{⊢ Σ, K : kind sig} K ∉ dom (Σ)

add-C \frac{⊢_{Σ} k kind}{⊢ Σ, C : k sig} C ∉ dom (Σ)

add-S \frac{⊢_{Σ} k kind}{⊢ Σ, S : k ⇒ scheme sig} S ∉ dom (Σ)

A. The metalanguage HML 224 add-c \frac{∅ ⊢_{Σ} σ scheme}{⊢ Σ, c : σ sig} c ∉ dom (Σ)

add-P \frac{v : k ⊢_{Σ} σ scheme}{⊢ Σ, P : (v : k)σ ⇒ prop sig} P ∉ dom (Σ)

Theories

∅ \frac{⊢ Σ sig}{⊢_{Σ} ∅ theory} add-prop \frac{⊢_{Σ} T theory ⊢_{Σ} ϕ prop}{⊢_{Σ} T, ϕ theory}

Kinds

K \frac{⊢ Σ sig}{⊢_{Σ} K kind} Σ(K) = kind  1 \frac{⊢ Σ sig}{⊢_{Σ} 1 kind}  Ω \frac{⊢ Σ sig}{⊢_{Σ} Ω kind}
× \frac{⊢_{Σ} k_{1} kind  ⊢_{Σ} k_{2} kind}{⊢_{Σ} k_{1} × k_{2} kind}  ⇒ \frac{⊢_{Σ} k_{1} kind  ⊢_{Σ} k_{2} kind}{⊢_{Σ} k_{1} ⇒ k_{2} kind}

Contexts ∅ \frac{⊢ Σ sig}{⊢_{Σ} ∅ context} add-v \frac{⊢_{Σ} Γ context ⊢_{Σ} k kind}{⊢_{Σ} Γ, v : k context} v ∉ dom (Γ) add-x \frac{⊢_{Σ} Γ context Γ ⊢_{Σ} σ scheme}{⊢_{Σ} Γ, x : σ context} x ∉ dom (Γ)

A. The metalanguage HML 225 Operators

v \frac{⊢_{Σ} Γ context}{Γ ⊢_{Σ} v : k} Γ(v) = k C \frac{⊢_{Σ} Γ context}{Γ ⊢_{Σ} C : k} Σ(C) = k 1I \frac{⊢_{Σ} Γ context}{Γ ⊢_{Σ} ∗ : 1}
×I \frac{Γ ⊢_{Σ} u_{1} : k_{1} Γ ⊢_{Σ} u_{2} : k_{2}}{Γ ⊢_{Σ} ⟨u_{1}, u_{2}⟩ : k_{1} × k_{2}}  ×E \frac{Γ ⊢_{Σ} u : k_{1} × k_{2}}{Γ ⊢_{Σ} π_{i}(u) : k_{i}}
⇒I \frac{Γ, v : k_{1} ⊢_{Σ} u : k_{2}}{Γ ⊢_{Σ} (λ v : k_{1}. u) : k_{1} ⇒ k_{2}}  ⇒E \frac{Γ ⊢_{Σ} u : k_{1} ⇒ k_{2} Γ ⊢_{Σ} u_{1} : k_{1}}{Γ ⊢_{Σ} u(u_{1}) : k_{2}}

Operator equality Operator equality is the congruence generated by the following rules:

1.η \frac{Γ ⊢_{Σ} u : 1}{Γ ⊢_{Σ} ∗ = u : 1}

×.β \frac{Γ ⊢_{Σ} u_{1} : k_{1} Γ ⊢_{Σ} u_{2} : k_{2}}{Γ ⊢_{Σ} π_{i}⟨u_{1}, u_{2}⟩ = u_{i} : k_{i}}

×.η \frac{Γ ⊢_{Σ} u : k_{1} × k_{2}}{Γ ⊢_{Σ} ⟨π_{1}(u), π_{2}(u)⟩ = u : k_{1} × k_{2}}

⇒ .β \frac{Γ, v : k_{1} ⊢_{Σ} u_{2} : k_{2} Γ ⊢_{Σ} u_{1} : k_{1}}{Γ ⊢_{Σ} (λ v : k_{1}. u_{2})(u_{1}) = [u_{1}/v]u_{2} : k_{2}}

⇒ .η \frac{Γ ⊢_{Σ} u : k_{1} ⇒ k_{2}}{Γ ⊢_{Σ} (λ v : k_{1}. u(v)) = u : k_{1} ⇒ k_{2}}

Type schemes

1 \frac{⊢_{Σ} Γ context}{Γ ⊢_{Σ} 1 scheme}  S \frac{Γ ⊢_{Σ} u : k}{Γ ⊢_{Σ} S(u) scheme} Σ(S) = k ⇒ scheme

type \frac{Γ ⊢_{Σ} u : Ω}{Γ ⊢_{Σ} u scheme}  × \frac{Γ ⊢_{Σ} σ_{1} scheme  Γ ⊢_{Σ} σ_{2} scheme}{Γ ⊢_{Σ} σ_{1} × σ_{2} scheme}
⇒ \frac{Γ ⊢_{Σ} σ_{1} scheme  Γ ⊢_{Σ} σ_{2} scheme}{Γ ⊢_{Σ} σ_{1} ⇒ σ_{2} scheme}  Π \frac{Γ, v : k ⊢_{Σ} σ scheme}{Γ ⊢_{Σ} (Π v : k. σ) scheme}

Type scheme equality Type scheme equality is the congruence induced by operator equality.

Terms

x \frac{⊢_{Σ} Γ context}{Γ ⊢_{Σ} x : σ} Γ(x) = σ c \frac{⊢_{Σ} Γ context}{Γ ⊢_{Σ} c : σ} Σ(c) = σ 1I \frac{⊢_{Σ} Γ context}{Γ ⊢_{Σ} ∗ : 1}
×I \frac{Γ ⊢_{Σ} e_{1} : σ_{1} Γ ⊢_{Σ} e_{2} : σ_{2}}{Γ ⊢_{Σ} ⟨e_{1}, e_{2}⟩ : σ_{1} × σ_{2}}  ×E \frac{Γ ⊢_{Σ} e : σ_{1} × σ_{2}}{Γ ⊢_{Σ} π_{i}(e) : σ_{i}}
⇒I \frac{Γ, x : σ_{1} ⊢_{Σ} e : σ_{2}}{Γ ⊢_{Σ} (λ x : σ_{1}. e) : σ_{1} ⇒ σ_{2}}  ⇒E \frac{Γ ⊢_{Σ} e : σ_{1} ⇒ σ_{2} Γ ⊢_{Σ} e_{1} : σ_{1}}{Γ ⊢_{Σ} e(e_{1}) : σ_{2}}
ΠI \frac{Γ, v : k ⊢_{Σ} e : σ}{Γ ⊢_{Σ} (Λ v : k. e) : (Π v : k. σ)}  ΠE \frac{Γ ⊢_{Σ} e : (Π v : k. σ) Γ ⊢_{Σ} u : k}{Γ ⊢_{Σ} e[u] : [u/v]σ}

conv \frac{Γ ⊢_{Σ} e : σ_{1} Γ ⊢_{Σ} σ_{1} = σ_{2}}{Γ ⊢_{Σ} e : σ_{2}}

A. The metalanguage HML 227 Formulae Formulae are obtained by applying the usual logical operators of first order predicate calculus to the atomic formulae generated by the following rules:

eqn \frac{Γ ⊢_{Σ} e_{1} : σ Γ ⊢_{Σ} e_{2} : σ}{Γ ⊢_{Σ} e_{1} =_{σ} e_{2} prop}

P \frac{Γ, v : k ⊢_{Σ} σ scheme Γ ⊢_{Σ} u : k Γ ⊢_{Σ} e : [u/v]σ}{Γ ⊢_{Σ} P (u, e) prop} Σ(P) = (v : k)σ ⇒ prop

Truth inference The inference rules for truth judgements include the standard rules of intuitionistic predicate calculus with equality. Axioms are introduced by the rule: axiom \frac{⊢_{Σ} T theory}{Γ ⊢_{Σ,T} ϕ} ϕ ∈ T

The equational fragment of HML is the congruence generated by operator equality and the following rules:

1.η \frac{⊢_{Σ} T theory Γ ⊢_{Σ} e : 1}{Γ ⊢_{Σ,T} ∗ =_{1} e}

×.β \frac{⊢_{Σ} T theory Γ ⊢_{Σ} e_{1} : σ_{1} Γ ⊢_{Σ} e_{2} : σ_{2}}{Γ ⊢_{Σ,T} π_{i}⟨e_{1}, e_{2}⟩ =_{σ_{i}} e_{i}}

×.η \frac{⊢_{Σ} T theory Γ ⊢_{Σ} e : σ_{1} × σ_{2}}{Γ ⊢_{Σ,T} ⟨π_{1}(e), π_{2}(e)⟩ =_{σ_{1}×σ_{2}} e}

A. The metalanguage HML 228

⇒ .β \frac{⊢_{Σ} T theory Γ, x : σ_{1} ⊢_{Σ} e_{2} : σ_{2} Γ ⊢_{Σ} e_{1} : σ_{1}}{Γ ⊢_{Σ,T} (λ x : σ_{1}. e_{2})e_{1} =_{σ_{2}} [e_{1}/x]e_{2}}

⇒ .η \frac{⊢_{Σ} T theory Γ ⊢_{Σ} e : σ_{1} ⇒ σ_{2}}{Γ ⊢_{Σ,T} λ x : σ_{1}. e(x) =_{σ_{1}⇒σ_{2}} e}

Π.β \frac{⊢_{Σ} T theory Γ, v : k ⊢_{Σ} e : σ Γ ⊢_{Σ} u : k}{Γ ⊢_{Σ,T} (Λ v : k. e)[u] =_{[u/v]σ} [u/v]e}

Π.η \frac{⊢_{Σ} T theory Γ ⊢_{Σ} e : (∀v : k.σ)}{Γ ⊢_{Σ,T} Λ v : k. e[v] =_{Πv:k.σ} e}

conv-eq \frac{Γ ⊢_{Σ,T} e_{1} =_{σ_{1}} e_{2} Γ ⊢_{Σ} σ_{1} = σ_{2}}{Γ ⊢_{Σ,T} e_{1} =_{σ_{2}} e_{2}}

B Dom, the category of discourse

[Dom1:Type = Sigma [X:Dom](Sigma [Y:Dom](E X)->E Y)];
[Dom2:Type = Sigma [X:Dom](Sigma [Y:Dom](Sigma [Z:Dom]
                                     indprod ((E X)->E Y) (E Y)->E Z))];
(*  defn  mkarr = ... : {X,Y|Dom}((E X)->E Y)->Dom1  (internalization) *)
[d0 = sig_pi1|Dom|[X:Dom](sigma|Dom|[Y:Dom](E X)->E Y):Dom1->Dom];
[d1 = [Z: Dom1]sig_pi1 (sig_pi2 Z):Dom1->Dom];
[i = [X:Dom] mkarr ([x:E X] x):Dom->Dom1];
[o = [fg:Dom2] mkarr ([x:E (sig_pi1 fg)]
                       Snd (sig_pi2 (sig_pi2 (sig_pi2 fg)))
                        (Fst (sig_pi2 (sig_pi2 (sig_pi2 fg))) x)):Dom2->Dom1];

C Signatures and theories

[Sum = <sum:Dom->Dom->Dom>
       <in1:{X1,X2|Dom}(E X1)->E(sum X1 X2)>
       <in2:{X1,X2|Dom}(E X2)->E(sum X1 X2)>
       <case:{X1,X2,X|Dom}
                ((E X1)->E X)->
                ((E X2)->E X)->
                (E(sum X1 X2))->E X> Unit ];
[AX_INL = {S:Sum}{X1,X2,X|Dom}{f:(E X1)->E X}{g:(E X2)->E X}
                 Eq ([x1:E X1] (case S f g (in1 S x1))) f];
[AX_INR = {S:Sum}{X1,X2,X|Dom}{f:(E X1)->E X}{g:(E X2)->E X}
                 Eq ([x2:E X2] (case S f g (in2 S x2))) g];
[AX_CASE = {S:Sum}{X1,X2,X|Dom}{h: (E(sum S X1 X2)) -> (E X)}
                 Eq (case S ([x:(E X1)]h(in1 S x)) ([x:(E X2)]h(in2 S x))) h];
[Prod = <prod:Dom->Dom->Dom>
        <pin:{X1,X2|Dom}(E X1)->(E X2)->E(prod X1 X2)>
        <pout1:{X1,X2|Dom}(E (prod X1 X2))->E X1>
        <pout2:{X1,X2|Dom}(E (prod X1 X2))->E X2> Unit ];
[Exponential = <arr: Dom->Dom->Dom>
               <lmb: {X,Y|Dom}((E X)->E Y)->E(arr X Y)>
               <app: {X,Y|Dom}(E (arr X Y))->(E X)->E Y> Unit];

The usual axioms for products and exponentials can be defined as for sums.

C. Signatures and theories 231

[Ind = <mu:Functor->Dom>
       <alg:{F|Functor}(E (FT F(mu F)))->E(mu F)>
       <it:{F|Functor}{X|Dom}
           ((E(FT F X))->E X) -> (E (mu F)) -> E X> Unit ];
[AX_WEAK_INITIAL = {Z:Ind}{F|Functor}{X|Dom}
                   {a:(E (FT F X)) -> E X}
                     Eq ([z: E (FT F (mu Z F))] it Z a (alg Z z))
                        ([z: E (FT F (mu Z F))] a (str F (it Z a) z))];
[AX_UNIVERSAL = {Z:Ind}{F|Functor}{X|Dom}
                   {a:(E (FT F X)) -> E X}
                   {g:(E (mu Z F)) -> E X}
                     ({z: E(FT F (mu Z F))} Eq (g(alg Z z)) (a (str F g z)))
                     -> Eq ([x: E (mu Z F)] it Z a x) g];

C. Signatures and theories 232

The operations in Ind are shown to satisfy Lambek’s lemma, that is: the initial F-algebra alg is an isomorphism with inverse coalg = it(F(alg)):

[coalg [Z:Ind][F|Functor] = [x:E (mu Z F)] it Z (str F(alg Z|F)) x];
               (* Lemma LM_LAMBEK1: it(alg)=id
                  Lemma LM_LAMBEK2: coalg;alg=id
                  Lemma LM_LAMBEK3: alg;coalg=id *)
[LM_LAMBEK1 = {Z:Ind}{F|Functor}
      Eq ([x:E (mu Z F)]x) ([x:E (mu Z F)] it Z (alg Z|F) x)];
Goal LM_LAMBEK1;
Intros;
Claim {z:E (FT F (mu Z F))} Eq (alg Z z)(alg Z|F (str F ([y:E (mu Z F)]y) z));
Qrepl ax_universal Z (alg Z|F) ([y:E (mu Z F)]y) ?+1;
Immed;
Intros;
(* Due to a LEGO bug, "Qrepl ax_str_id..." would not work here *)
Refine (Eq_sym(ax_str_id F|(mu Z F)))
        ([k:(E (FT F (mu Z F)))->E (FT F (mu Z F))] P1 (alg Z (k z))) H1;
Save lm_Lambek1;

[LM_LAMBEK2 = {Z:Ind}{F|Functor}
      Eq ([x:E (mu Z F)]x) ([x:E (mu Z F)] alg Z (coalg Z x))];
[LM_LAMBEK3 = {Z:Ind}{F|Functor}
              Eq ([z:E (FT F(mu Z F))] z)
                 ([z:E (FT F(mu Z F))] coalg Z (alg Z z))];

The proofs of LM LAMBEK2 and LM LAMBEK3 are similar to the one above.

D Encoding ML_{T}

[Grd: Type];
Inductive [Ty: Type] Constructors
[GR: Grd->Ty]
[AR: Ty->Ty->Ty]
[TT: Ty->Ty];
[Con = list Ty]
[Con_elim = list_elim Ty];
Inductive [Var:Con->Ty->Type] Constructors
[Vo: {c:Con}{t:Ty}Var (cons t c) t]
[Weak: {c|Con}{s:Ty}{t|Ty}(Var c t)->Var (cons s c) t];
Inductive [Exp:Con->Ty->Type] Constructors
[VAR: {c|Con}{t|Ty}(Var c t)->Exp c t]
[LMB: {c|Con}{s,t|Ty}(Exp (cons s c) t)->Exp c (AR s t)]
[APP: {c|Con}{s,t|Ty}(Exp c (AR s t))->(Exp c s)->Exp c t]
[LET: {c|Con}{s,t|Ty}(Exp (cons s c) (TT t))->(Exp c (TT s))->Exp c (TT t)]
[VAL: {c|Con}{t|Ty}(Exp c t)->Exp c (TT t)];

E Interpretation of ML_{T}

[I_Grd: Grd->Dom];
[I_Ty [Ex:Exponential] [M:Monad]: Ty->Dom = Ty_elim
([_|Ty]Dom)
I_Grd
([_,_|Ty][X,Y:Dom]arr Ex X Y)
([_|Ty][X:Dom]T M X)];
[I_Con [P:Prod] [Ex:Exponential] [M:Monad]: Con->Dom = Con_elim
([_|Con]Dom)
(one:Dom)
([t:Ty][_:Con][X:Dom] prod P X (I_Ty Ex M t))];
[I_Var [P:Prod] [Ex:Exponential] [M:Monad] = Var_elim
([c|Con][t|Ty][_:Var c t](E (I_Con P Ex M c))->E (I_Ty Ex M t))
([c:Con][t:Ty]pout2 P|(I_Con P Ex M c)|(I_Ty Ex M t))
([c|Con][s:Ty][t|Ty][_:Var c t][F:(E (I_Con P Ex M c))->E (I_Ty Ex M t)]
  [x: E (prod P (I_Con P Ex M c) (I_Ty Ex M s))] F (pout1 P x))];

E. Interpretation of ML_{T} 235

[I_Exp [P:Prod] [Ex:Exponential] [M:Monad] =
[I_Ty=I_Ty Ex M] [I_Con=I_Con P Ex M] [I_Var=I_Var P Ex M] Exp_elim
([c|Con][t|Ty][_:Exp c t](E (I_Con c))->E (I_Ty t))
(* variables *)
([c|Con][t|Ty][v:Var c t] I_Var v)
(* lambda abstraction *)
([c|Con][s,t|Ty][_:Exp (cons s c) t]
  [F:(E (I_Con (cons s c)))->E (I_Ty t)]
  [x: E (I_Con c)] lmb Ex ([y: E (I_Ty s)] F (pin P x y)))
(* application *)
([c|Con][s,t|Ty][_:Exp c (AR s t)][_:Exp c s]
  [F:(E (I_Con c))->E (I_Ty (AR s t))]
  [G:(E (I_Con c))->E (I_Ty s)]
  [x:E (I_Con c)] app Ex (F x) (G x))
(* composition (let) *)
([c|Con][s,t|Ty][_:Exp (cons s c) (TT t)][_:Exp c (TT s)]
  [F:(E (I_Con (cons s c)))->E (I_Ty (TT t))]
  [G:(E (I_Con c))->E (I_Ty (TT s))]
  [x:E (I_Con c)] let M ([y:E (I_Ty s)] F(pin P x y)) (G x))
(* lifting (val) *)
([c|Con][t|Ty][_:Exp c t][F:(E (I_Con c))->E (I_Ty t)]
  [x:E (I_Con c)]val M (F x))];

F Correctness of the exception constructor

Goal {S:Sum}{Exn:Dom}{M:Monad}AX_RUNIT (Exception_Constructor S Exn M);
Normal;
Intros;
Equiv P ([x:E X]([z:E(sum S X Exn)]
                 (let M (case S f ([x'2:E Exn] val M (in2 S x'2)))
                          (val M z)))(in1 S x));
Qrepl Eq_sym (ax_runit M|(sum S X Exn)|(sum S Y Exn)|
                      (case S f ([x'2:E Exn] val M (in2 S x'2))));
Qrepl ax_inl
      S|X|Exn|(T M (sum S Y Exn))|f|([x'2:E Exn] val M (in2 S x'2));
Immed;

F. Correctness of the exception constructor 237

Goal {S:Sum}{Exn:Dom}{M:Monad}AX_ASSOC (Exception_Constructor S Exn M);
Normal;
Intros;
Qrepl Eq_sym (ax_assoc M|(sum S X Exn)|(sum S Y Exn)|(sum S Z Exn)|
              c|(case S f ([x:E Exn] val M (in2 S x)))|
              (case S g ([x:E Exn] val M (in2 S x))));
Claim {S|Sum}{M|Monad}{X,Y,A,B|Dom}{k:(E A)->(E (T M B))}
      {f:(E X)->(E (T M A))}{g: (E Y)->(E (T M A))}
      Eq ([w: E (sum S X Y)] let M k (case S f g w))
         (case S ([x: E X] let M k (f x))
         ([y: E Y] let M k (g y)));
Qrepl ?+1|S|M|X|Exn|(sum S Y Exn)|(sum S Z Exn)|
         (case S g ([x'2:E Exn] val M (in2 S x'2)))|
         f|([x'2:E Exn] val M (in2 S x'2));
Equiv P (let M (case S
                   ([x:E X]let M (case S g ([x'2:E Exn] val M (in2 S x'2)))
                                 (f x))
                   ([y:E Exn]
                     ([z: E (sum S Y Exn)]
                       let M (case S g ([x'2:E Exn] val M (in2 S x'2)))
                             (val M z))(in2 S y)))
                 c);
Qrepl Eq_sym (ax_runit M|(sum S Y Exn)|(sum S Z Exn)|
                    (case S g ([x'2:E Exn] val M (in2 S x'2))));
Qrepl ax_inr S|Y|Exn|(T M (sum S Z Exn))|g|([x'2:E Exn] val M (in2 S x'2));
Immed;
Normal;
Intros;
Equiv P1 (case S1 ([x:E X1]([z:E (T M1 A)] let M1 k z)(f1 x))
     ([y:E Y1]([z:E (T M1 A)] let M1 k z)(g1 y)));
Qrepl Sum_comp|S1|X1|Y1|(T M1 A)|(T M1 B)|
      f1|g1|([z:E (T M1 A)] let M1 k z);
Immed;

G The operator pand of parallel composition

Let F be the constructor of resumptions. Given M:Monad, let functions ROR and RY apply uniform redefinitions to the operations of structures N:(Nondetm M) and F:Fix(T M) to produce operations of structures (F N):(Nondetm F M) and (F F):Fix(T F M). The operator pand of parallel composition for computations with resumptions is defined as follows:

[pand [S:Sum] [P:Prod] [Z:Ind] [M:Monad] [N:Nondetm M] [F:Fix (T M)] =
[resumptions = Resumptions S Z M]
[Res: Dom->Dom = resumptions.1]
[Rval: {X|Dom}(E X)->E (Res X) = resumptions.2.1]
[Rlet: {X1,X2|Dom}((E X1)->E (Res X2))->(E (Res X1))->E (Res X2) =
       resumptions.2.2.1]
[CH: {X1,X2|Dom}((E X1)->E (Res X2))->((E (Res X1))->E (Res X2))->
       (E (Res X1))->E (Res X2) = resumptions.2.2.2.2.1]
[orr = ROR S Z M N]
[yrr =RY S Z M F]
[X,Y|Dom] [w:E(Res X)] [z:E(Res Y)]
       (((yrr [h:(E (prod P (Res X)(Res Y)))->E (Res (prod P X Y))]
              [v:E (prod P (Res X)(Res Y))]
              [v1:E (Res X)=pout1 P v] [v2:E (Res Y)=pout2 P v]
              orr (CH ([x:E X] Rlet ([y:E Y] Rval (pin P x y)) v2)
                      ([w:E (Res X)] h (pin P w v2)) v1)
                  (CH ([y:E Y] Rlet ([x:E X] Rval (pin P x y)) v1)
                      ([z:E (Res Y)] h (pin P v1 z)) v2)) (pin P w z)):
                                     E (Res (prod P X Y)))];

H Commutativity of pand

Goal THM_COMMUTATIVITY;
Expand THM_COMMUTATIVITY pand pand;
intros;
[CH=resumptions.2.2.2.2.1][orr=ROR S Z M N][yrr=RY S Z M F];
Intros 1;
Equiv P1
  (([X,Y|Dom][f:(E X)->E Y]Rlet
   ([x:E X]Rval (f x))) (pswap P|X1|X2)
  ((yrr ([h:(E (prod P (Res1 X1) (Res1 X2)))->E (Res1 (prod P X1 X2))]
       [v:E (prod P (Res1 X1) (Res1 X2))][v1=pout1 P v][v2=pout2 P v]
       orr (CH ([x:E X1]Rlet ([y:E X2]Rval (pin P x y)) v2)
       ([w'16:E (Res1 X1)]h (pin P w'16 v2)) v1)
           (CH ([y:E X2]Rlet ([x:E X1]Rval (pin P x y)) v1)
       ([z'16:E (Res1 X2)]h (pin P v1 z'16)) v2))
  (pin P w z))));
Qrepl Eq_sym (lm_pswap1 P z w);

Equiv P1
(([K:(E (prod P (Res1 X1) (Res1 X2)))->E (Res1 (prod P X1 X2))]
   [v:E (prod P (Res1 X2) (Res1 X1))]
([X,Y|Dom][f:(E X)->E Y]Rlet ([x:E X]Rval (f x))) (pswap P|X1|X2)
(K (pswap P v)))
  (yrr ([h:(E (prod P (Res1 X1) (Res1 X2)))->E (Res1 (prod P X1 X2))]
        [v:E (prod P (Res1 X1) (Res1 X2))][v1=pout1 P v][v2=pout2 P v]
  orr (CH ([x:E X1]Rlet ([y:E X2]Rval (pin P x y)) v2)
([w'16:E (Res1 X1)]h (pin P w'16 v2)) v1)
      (CH ([y:E X2]Rlet ([x:E X1]Rval (pin P x y)) v1)
([z'16:E (Res1 X2)]h (pin P v1 z'16)) v2)))
  (pin P z w));
Claim STRICT
([K:(E (prod P (Res1 X1) (Res1 X2)))->E (Res1 (prod P X1 X2))]
 [v:E (prod P (Res1 X2) (Res1 X1))]
 ([X,Y|Dom][f:(E X)->E Y]Rlet ([x:E X]Rval (f x))) (pswap P|X1|X2)
 (K (pswap P v)));
Claim
  [h = ([K:(E (prod P (Res1 X1) (Res1 X2)))->E (Res1 (prod P X1 X2))]
[v:E (prod P (Res1 X2) (Res1 X1))]
([X,Y|Dom][f:(E X)->E Y]Rlet ([x:E X]Rval (f x))) (pswap P|X1|X2)
(K (pswap P v)))]
  [f = ([h:(E (prod P (Res1 X1) (Res1 X2)))->E (Res1 (prod P X1 X2))]
        [v:E (prod P (Res1 X1) (Res1 X2))][v1=pout1 P v][v2=pout2 P v]
  orr (CH ([x:E X1]Rlet ([y:E X2]Rval (pin P x y)) v2)
([w'16:E (Res1 X1)]h (pin P w'16 v2)) v1)
      (CH ([y:E X2]Rlet ([x:E X1]Rval (pin P x y)) v1)

([z'16:E (Res1 X2)]h (pin P v1 z'16)) v2))]
  [g = ([h:(E (prod P (Res1 X2) (Res1 X1)))->E (Res1 (prod P X2 X1))]
        [v:E (prod P (Res1 X2) (Res1 X1))][v1=pout1 P v][v2=pout2 P v]
  orr (CH ([x:E X2]Rlet ([y:E X1]Rval (pin P x y)) v2)
([w'16:E (Res1 X2)]h (pin P w'16 v2)) v1)
      (CH ([y:E X1]Rlet ([x:E X2]Rval (pin P x y)) v1)
([z'16:E (Res1 X1)]h (pin P v1 z'16)) v2))]
  {k:(E (prod P (Res1 X1) (Res1 X2)))->E (Res1 (prod P X1 X2))}
Eq (h (f k)) (g (h k));
Qrepl Eq_sym (lm_Res_uniformity S Z M F (ax_uniformity F)
  ([K:(E (prod P (Res1 X1) (Res1 X2)))->E (Res1 (prod P X1 X2))]
   [v:E (prod P (Res1 X2) (Res1 X1))]
([X,Y|Dom][f:(E X)->E Y]Rlet ([x:E X]Rval (f x))) (pswap P|X1|X2)
(K (pswap P v)))
  ?+1
  ([h:(E (prod P (Res1 X1) (Res1 X2)))->E (Res1 (prod P X1 X2))]
        [v:E (prod P (Res1 X1) (Res1 X2))][v1=pout1 P v][v2=pout2 P v]
  orr (CH ([x:E X1]Rlet ([y:E X2]Rval (pin P x y)) v2)
([w'16:E (Res1 X1)]h (pin P w'16 v2)) v1)
      (CH ([y:E X2]Rlet ([x:E X1]Rval (pin P x y)) v1)
([z'16:E (Res1 X2)]h (pin P v1 z'16)) v2))
  ([h:(E (prod P (Res1 X2) (Res1 X1)))->E (Res1 (prod P X2 X1))]
        [v:E (prod P (Res1 X2) (Res1 X1))][v1=pout1 P v][v2=pout2 P v]
  orr (CH ([x:E X2]Rlet ([y:E X1]Rval (pin P x y)) v2)
([w'16:E (Res1 X2)]h (pin P w'16 v2)) v1)
      (CH ([y:E X1]Rlet ([x:E X2]Rval (pin P x y)) v1)
([z'16:E (Res1 X1)]h (pin P v1 z'16)) v2))

  (pin P z w));
Immed;
Refine ax_strict
([resumptions=Resumptions S Z M][Res'3=resumptions.1]
[Rval=resumptions.2.1][Rlet=resumptions.2.2.1]
[K:(E (prod P (Res'3 X1) (Res'3 X2)))->E (Res'3 (prod P X1 X2))]
[v:E (prod P (Res'3 X2) (Res'3 X1))]Rlet ([x:E (prod P X1 X2)]Rval
(pswap P|X1|X2 x)) (K (pswap P v)));
intros;
Refine Eq_sym;
Expand f g h;
Refine (ax_extensionality
 ([v:E (prod P (Res1 X2) (Res1 X1))][v1=pout1 P v][v2=pout2 P v]
  orr (CH ([x:E X2]Rlet ([y:E X1]Rval (pin P x y)) v2)
  ([w'16:E (Res1 X2)]Rlet
([x:E (prod P X1 X2)]Rval (pswap P|X1|X2 x))
(k (pswap P (pin P w'16 v2)))) v1)
      (CH ([y:E X1]Rlet ([x:E X2]Rval (pin P x y)) v1)
  ([z'16:E (Res1 X1)]Rlet
([x:E (prod P X1 X2)]Rval (pswap P|X1|X2 x))
(k (pswap P (pin P v1 z'16)))) v2))
 ([v:E (prod P (Res1 X2) (Res1 X1))]
   Rlet ([x:E (prod P X1 X2)]Rval (pswap P|X1|X2 x))

([v1=pout1 P (pswap P v)][v2=pout2 P (pswap P v)]
 orr (CH ([x:E X1]Rlet ([y:E X2]Rval (pin P x y)) v2)
([w'16:E (Res1 X1)]k (pin P w'16 v2)) v1)
     (CH ([y:E X2]Rlet ([x:E X1]Rval (pin P x y)) v1)
([z'16:E (Res1 X2)]k (pin P v1 z'16)) v2))));
Intros v P2 H1;
Qrepl Eq_sym(lm_pswap2 P v);
Qrepl Eq_sym(lm_pswap3 P v);
Qrepl Eq_sym (ax_or_naturality
  (Rnd S Z M N)(pswap P|X1|X2)
  (CH ([x:E X1]Rlet ([y:E X2]Rval (pin P x y)) (pout1 P v))
      ([w'16:E (Res1 X1)]k (pin P w'16 (pout1 P v)))(pout2 P v))
  (CH ([y:E X2]Rlet ([x:E X1]Rval (pin P x y)) (pout2 P v))
      ([z'16:E (Res1 X2)]k (pin P (pout2 P v) z'16))(pout1 P v)));
Qrepl ax_ch_naturality S Z M (pswap P|X1|X2)
  ([x:E X1]Rlet ([y:E X2]Rval (pin P x y)) (pout1 P v))
  ([w'16:E (Res1 X1)]k (pin P w'16 (pout1 P v)))
  (pout2 P v);
Qrepl ax_ch_naturality S Z M (pswap P|X1|X2)
  ([y:E X2]Rlet ([x:E X1]Rval (pin P x y)) (pout2 P v))
  ([z'16:E (Res1 X2)]k (pin P (pout2 P v) z'16))
  (pout1 P v);

Qrepl (ax_extensionality
  ([y:E X2] Rlet ([x:E (prod P X1 X2)]Rval (pswap P|X1|X2 x))
(Rlet ([x:E X1]Rval (pin P x y)) (pout2 P v)))
  ([y:E X2] (Rlet ([x:E X1]Rlet ([u:E (prod P X1 X2)] Rval (pswap P|X1|X2 u))
(Rval (pin P x y)))
    (pout2 P v)))
  ([y:E X2](Eq_sym
(ax_assoc (Resumptions_Constructor S Z M)
(pout2 P v)
([x:E X1]Rval (pin P x y))
([x:E (prod P X1 X2)]Rval (pswap P|X1|X2 x))))));
Equiv P2
 (orr (CH ([x:E X1] Rlet ([x:E (prod P X1 X2)]Rval (pswap P|X1|X2 x))
(Rlet ([y:E X2]Rval (pin P x y)) (pout1 P v)))
 ([w'16:E (Res1 X1)]Rlet([x:E (prod P X1 X2)]Rval(pswap P|X1|X2 x))
(k (pin P w'16 (pout1 P v)))) (pout2 P v))
      (CH ([y:E X2]
   (Rlet ([x:E X1](([p: E (prod P X1 X2)]Rlet
    ([u:E (prod P X1 X2)] Rval (pswap P|X1|X2 u))
    (Rval p)) (pin P x y)))
(pout2 P v)))
  ([z'16:E (Res1 X2)]Rlet([x:E (prod P X1 X2)]Rval(pswap P|X1|X2 x))
(k (pin P (pout2 P v) z'16))) (pout1 P v)));
Qrepl Eq_sym (ax_runit (Resumptions_Constructor S Z M)
  ([u:E (prod P X1 X2)] Rval (pswap P|X1|X2 u)));
Claim {P:Prod}{X1,X2|Dom}

  Eq ([x:E X1][y:E X2]pswap P|X1|X2 (pin P x y))
     ([x:E X1][y:E X2] pin P y x);
Equiv P2
 (orr (CH ([x:E X1] Rlet ([x:E (prod P X1 X2)]Rval (pswap P|X1|X2 x))
(Rlet ([y:E X2]Rval (pin P x y)) (pout1 P v)))
 ([w'16:E (Res1 X1)]Rlet([x:E (prod P X1 X2)]Rval(pswap P|X1|X2 x))
(k (pin P w'16 (pout1 P v)))) (pout2 P v))
      (CH (([K:(E X1)->(E X2)->E (prod P X2 X1)]
([y:E X2]Rlet ([x:E X1]Rval (K x y))(pout2 P v)))
    ([a:E X1][b:E X2]pswap P|X1|X2 (pin P a b)))
  ([z'16:E (Res1 X2)]Rlet([x:E (prod P X1 X2)]Rval(pswap P|X1|X2 x))
(k (pin P (pout2 P v) z'16))) (pout1 P v)));
Qrepl ?+1 P|X1|X2;
Qrepl (ax_extensionality
  ([x:E X1] Rlet ([x:E (prod P X1 X2)]Rval (pswap P|X1|X2 x))
(Rlet ([y:E X2]Rval (pin P x y)) (pout1 P v)))
  ([x:E X1] (Rlet ([y:E X2]Rlet ([u:E (prod P X1 X2)] Rval (pswap P|X1|X2 u))
(Rval (pin P x y)))
    (pout1 P v)))
  ([x:E X1](Eq_sym
(ax_assoc (Resumptions_Constructor S Z M)
(pout1 P v)
([y:E X2]Rval (pin P x y))
([x:E (prod P X1 X2)]Rval (pswap P|X1|X2 x))))));
Equiv P2

  (orr (CH ([x:E X1]
    (Rlet ([y:E X2](([p: E (prod P X1 X2)]Rlet
     ([u:E (prod P X1 X2)]Rval (pswap P|X1|X2 u))
     (Rval p)) (pin P x y)))
 (pout1 P v)))
   ([w'16:E (Res1 X1)]Rlet
([x:E (prod P X1 X2)]Rval (pswap P|X1|X2 x))
(k (pin P w'16 (pout1 P v)))) (pout2 P v))
       (CH ([y:E X2]Rlet ([x:E X1]Rval (pin P y x))(pout2 P v))
   ([z'16:E (Res1 X2)]Rlet([x:E (prod P X1 X2)]Rval(pswap P|X1|X2 x))
(k (pin P (pout2 P v) z'16))) (pout1 P v)));
Qrepl Eq_sym (ax_runit (Resumptions_Constructor S Z M)
  ([u:E (prod P X1 X2)] Rval (pswap P|X1|X2 u)));
Equiv P2
  (orr (CH (([K:(E X1)->(E X2)->E (prod P X2 X1)]
([x:E X1]Rlet ([y:E X2]Rval (K x y))(pout1 P v)))
     ([a:E X1][b:E X2]pswap P|X1|X2 (pin P a b)))
   ([w'16:E (Res1 X1)]Rlet
([x:E (prod P X1 X2)]Rval (pswap P|X1|X2 x))
(k (pin P w'16 (pout1 P v)))) (pout2 P v))
       (CH ([y:E X2]Rlet ([x:E X1]Rval (pin P y x))(pout2 P v))
   ([z'16:E (Res1 X2)]Rlet([x:E (prod P X1 X2)]Rval(pswap P|X1|X2 x))
(k (pin P (pout2 P v) z'16))) (pout1 P v)));
Qrepl ?+1 P|X1|X2;
Qrepl (ax_or_commutativity (Rnd S Z M N)

(CH ([x:E X1]Rlet ([y:E X2]Rval (pin P y x)) (pout1 P v))
   ([w'16:E (Res1 X1)]Rlet
([x:E (prod P X1 X2)]Rval (pswap P|X1|X2 x))
(k (pin P w'16 (pout1 P v)))) (pout2 P v))
(CH ([y:E X2]Rlet ([x:E X1]Rval (pin P y x)) (pout2 P v))
    ([z'16:E (Res1 X2)]Rlet
([x:E (prod P X1 X2)]Rval (pswap P|X1|X2 x))
(k (pin P (pout2 P v) z'16))) (pout1 P v)));
Equiv P2
  (orr (CH ([y:E X2]Rlet ([x:E X1]Rval (pin P y x)) (pout2 P v))
    (([K:(E (Res1 X2))->E (prod P (Res1 X1) (Res1 X2))]
      [z'16:E (Res1 X2)]Rlet
([x:E (prod P X1 X2)]Rval (pswap P|X1|X2 x))
(k (K z'16)))([z:E (Res1 X2)]pin P (pout2 P v) z))
    (pout1 P v))
(CH ([x:E X1]Rlet ([y:E X2]Rval (pin P y x)) (pout1 P v))
   ([w'16:E (Res1 X1)]Rlet
([x:E (prod P X1 X2)]Rval (pswap P|X1|X2 x))
(k (pin P w'16 (pout1 P v)))) (pout2 P v)));
Qrepl ax_extensionality
([z:E (Res1 X2)]pin P (pout2 P v) z)
([z:E (Res1 X2)]pswap P (pin P z (pout2 P v)))
([z:E (Res1 X2)] Eq_sym(lm_pswap1 P z (pout2 P v)));
Equiv P2
  (orr (CH ([y:E X2]Rlet ([x:E X1]Rval (pin P y x)) (pout2 P v))
   ([z'16:E (Res1 X2)]Rlet

([x:E (prod P X1 X2)]Rval (pswap P|X1|X2 x))
(k (pswap P (pin P z'16 (pout2 P v))))) (pout1 P v))
(CH ([x:E X1]Rlet ([y:E X2]Rval (pin P y x)) (pout1 P v))
     (([K:(E (Res1 X1))->E (prod P (Res1 X1) (Res1 X2))]
[w'16:E (Res1 X1)]Rlet
([x:E (prod P X1 X2)]Rval (pswap P|X1|X2 x))
(k (K w'16)))([w:E (Res1 X1)]pin P w (pout1 P v)))
(pout2 P v)));
Qrepl ax_extensionality
([w:E (Res1 X1)]pin P w (pout1 P v))
([w:E (Res1 X1)]pswap P (pin P (pout1 P v) w))
([w:E (Res1 X1)] Eq_sym(lm_pswap1 P (pout1 P v) w));
Immed;
Intros PP A B;
Refine ax_extensionality
([x:E A][y:E B]pswap PP|A|B (pin PP x y))
([x:E A][y:E B]pin PP y x);
Intros x;
Refine ax_extensionality
([y:E B]pswap PP (pin PP x y))
([y:E B]pin PP y x);
Intros y;
Qrepl Eq_sym (lm_pswap1 PP x y);
Refine Eq_refl;

I Preservation of uniformity

Goal {S:Sum}{Z:Ind}{M:Monad}{F:Fix (T M)}
        (AX_UNIFORMITY F) -> AX_UNIFORMITY (Rfix S Z M F);
Expand AX_UNIFORMITY Rfix Yop RY Uniform_Redefinition2;
Intros;
Equiv P
 (h ([w:E X1]alg Z|(RF S (Monad_to_Functor M) X2)
     (Yop F|X1|(sum S X2 (Res S Z M X2))
([h:(E X1)->E (Unwind S Z M X2)][x1:E X1] coalg Z
   (f ([x:E X1]alg Z|(RF S (Monad_to_Functor M) X2) (h x)) x1))
w)) x);
Qrepl Eq_push (lm_Lambek2 Z|(RF S (Monad_to_Functor M) X4))
 (h ([w:E X1]alg Z|(RF S (Monad_to_Functor M) X2)
     (Yop F ([h:(E X1)->E (Unwind S Z M X2)][x1:E X1] coalg Z
(f ([x:E X1]alg Z|(RF S (Monad_to_Functor M) X2) (h x)) x1))
      w)) x);
Equiv P (alg Z
 (([K:(E X1)->E (Unwind S Z M X2)][x3: E X3]
   (coalg Z (h ([w:E X1]alg Z|(RF S (Monad_to_Functor M) X2) (K w)) x3)))

    (Yop F ([h:(E X1)->E (Unwind S Z M X2)][x1:E X1] coalg Z
(f ([x:E X1]alg Z|(RF S (Monad_to_Functor M) X2) (h x))
 x1))) x));
Claim STRICT ([K:(E X1)->E (Unwind S Z M X2)][x3: E X3]
  (coalg Z (h ([w:E X1]alg Z|(RF S (Monad_to_Functor M) X2) (K w)) x3)));
Claim {j:(E X1)->E (Unwind S Z M X2)}
  [h1 = [K:(E X1)->E (Unwind S Z M X2)][x3: E X3]
   (coalg Z (h ([w:E X1]alg Z|(RF S (Monad_to_Functor M) X2) (K w)) x3))]
  [f1 = [h:(E X1)->E (Unwind S Z M X2)][x1:E X1]
coalg Z (f ([x:E X1]alg Z|(RF S (Monad_to_Functor M) X2) (h x)) x1)]
  [g1 = [k:(E X3)->E (Unwind S Z M X4)][x3:E X3]
coalg Z (g ([x:E X3]alg Z|(RF S (Monad_to_Functor M) X4) (k x)) x3)]
  (Eq (h1 (f1 j)) (g1 (h1 j)));
Qrepl Eq_sym
 (H ([K:(E X1)->E (Unwind S Z M X2)][x3: E X3]
   (coalg Z (h ([w:E X1]alg Z|(RF S (Monad_to_Functor M) X2) (K w)) x3)))
  ?+1
  ([h:(E X1)->E (Unwind S Z M X2)][x1:E X1]
coalg Z (f ([x:E X1]alg Z|(RF S (Monad_to_Functor M) X2) (h x)) x1))
  ([k:(E X3)->E (Unwind S Z M X4)][x3:E X3]
coalg Z (g ([x:E X3]alg Z|(RF S (Monad_to_Functor M) X4) (k x)) x3))
  ?+2 x);
Immed;
Refine ax_strict

I. Preservation of uniformity 251

  ([K:(E X1)->E (Unwind S Z M X2)][x3:E X3]
    coalg Z (h ([w:E X1]alg Z|(RF S (Monad_to_Functor M) X2) (K w)) x3));
Intros;
Equiv P1 [x3:E X3]coalg Z (g ([x:E X3]
  ([z:E (Res S Z M X4)] alg Z|(RF S (Monad_to_Functor M) X4) (coalg Z z))
  (h ([w:E X1]alg Z|(RF S (Monad_to_Functor M) X2) (j w)) x)) x3);
Qrepl (Eq_sym (lm_Lambek2 Z|(RF S (Monad_to_Functor M) X4)));
Qrepl Eq_sym (ax_eta (h ([w:E X1]alg Z|(RF S (Monad_to_Functor M) X2) (j w))));
Equiv P1 (([K:(E X3)->E (Res S Z M X4)][x3:E X3]coalg Z (K x3))
(g (h ([w:E X1]alg Z|(RF S (Monad_to_Functor M) X2) (j w)))));
Qrepl Eq_sym (H2 ([w:E X1]alg Z|(RF S (Monad_to_Functor M) X2) (j w)));
Qrepl ax_eta (f ([w:E X1]alg Z|(RF S (Monad_to_Functor M) X2) (j w)));
Equiv P1 ([x3:E X3]coalg Z
  (h (([K:(E (Res S Z M X2))-> E (Res S Z M X2)]
       [x:E X1] K (f ([w:E X1]alg Z|(RF S (Monad_to_Functor M) X2) (j w)) x))
      ([y:E (Res S Z M X2)]y)) x3));
Qrepl (lm_Lambek2 Z|(RF S (Monad_to_Functor M) X2));
Immed;

Bibliography

[AA74] L. Aiello and M. Aiello. Proving Program Correctness in LCF. In Programming symposium, Lecture Notes in Computer Science, vol. 19, pages 59–71. Springer-Verlag, 1974.

[AAW77] L. Aiello, M. Aiello, and R. W. Weyrauch. Pascal in LCF: Semantics and Examples of Proof. Theoretical Computer Science, 5:135–177, 1977.

[Abr87] S. Abramsky. Domain Theory and the Logic of Observable Properties. PhD thesis, University of London, 1987.

[Abr90a] S. Abramsky. Abstract interpretation, logical relations and Kan extensions. Journal of Logic and Computation, 1:5–40, 1990.

[Abr90b] S. Abramsky. The Lazy λ-calculus. In D. A. Turner, editor, Logical Foundations of Functional Programming, pages 65–116. Addison-Wesley, 1990.

[Abr91] S. Abramsky. Domain Theory in Logical Form. Annals of Pure and Applied Logic, 51:1–77, 1991.

[Acz88] P. Aczel. Non-Well-Founded Sets, 1988. CSLI Lecture Notes, 14, Stanford University.

[AGM] S. Abramsky, D. M. Gabbay, and T. S. E. Maibaum, editors. Semantic Structures, volume 3. Oxford University Press, Oxford, England, . To appear.

[AJ91] S. Abramsky and T. P. Jensen. A relational approach to strictness analysis for higher order polymorphic functions. In Proceedings 20th ACM Symp. on Principles of Programming Languages, 1991.

[AJM94] S. Abramsky, R. Jagadeesan, and P. Malacaria. Full abstraction for PCF (extended abstract). In Proceedings TACS ’94, number 789 in LNCS. Springer-Verlag, 1994.

[Alt92] T. Altenkirch. Brewing strong normalization proofs with lego. LFCS Report Series ECS-LFCS-92-230, Laboratory for the Foundations of Computer Science, Computer Science Department, University of Edinburgh, 1992.

[Apt81] K.R. Apt. Ten years of Hoare’s Logic: a survey - part 1. ACM TOPLS, 3, 4, 1981.

[AR94] J. Adámek and J. Rosický. Locally Presentable and Accessible Categories. LMS Lecture Notes Series 189. Cambridge University Press, 1994.

[BA91] B. Bloom and L. Aceto. Turning sos rules into equations. Technical report, Stiching Mathematisch Centrum, CWI, 1991. CS-R9218.

[Bar92] Henk Barendregt. Lambda calculi with types. In Handbook of Logic in Computer Science. Oxford University Press, 1992.

[Ben86] Ermanno Bencivenga. Free Logics. In Gabbay and Guenthner [GG86], pages 373–426. Volume 3.

[Ber91] Stefano Berardi. Girard’s normalization proof in lego. Unpublished draft, 1991.

[BG85] R. Burstall and J. Goguen. A Study in the Foundations of Program Methodology: Specifications, Institutions, Charters and Parchments. In Proc. of Summer Workshop on Category Theory and Computer Programming. University of Surrey, 1985.

[BG87] A. Blass and Y. Gurevich. Existential fixed-point logic. In E. Börger, editor, Computation Theory and Logic, pages 20–36. LNCS 270, Springer-Verlag, 1987.

[Blo88] B. Bloom. Can lcf be topped? Flat lattice models of typed lambda calculus. In IEEE Symposium on Logic in Computer Science, pages 282–290. Computer Society Press, 1988.

[BS92] J. Bradfield and C. Stirling. Local model checking for infinite state spaces. Theoretical Computer Science, 96:157–174, 1992.

[BW85] M. Barr and C. Wells. Toposes, triples and theories. Springer-Verlag, New York, 1985.

[BW90] M. Barr and C. Wells. Category theory for computing science. Prentice-Hall, London, 1990.

[CAB^{+}86] R.L. Constable, S.F. Allen, H.M. Bromley, et al. Implementing Mathematics with the NuPRL Proof Development System. Prentice Hall, 1986.

[Cen94] P. Cenciarelli. A modular development of denotational semantics in LEGO. Presented at the Types for Proofs and Programs Workshop, Båstad, June 1994.

[Cen95] P. Cenciarelli. Partial correctness in Evaluation Logic. In P. Dybier and R. Pollack, editors, Proceedings of the Joint CLiCS-Types Workshop on Categories and Type Theory, Göteborg, January 95. Programming Methodology Group, Göteborg University and Chalmers University of Technology, May 1995. Report 85.

[CF94] R. Cartwright and M. Felleisen. Extensible denotational languge specifications. In Proceedings of TACS 94. LNCS 789, 1994.

[CH85] T. Coquand and G. Huet. Constructions: a higher order proof system for mechanizing mathematics. In Proc. EUROCAL 85. Springer LNCS 203, 1985.

[CJKP94] A. Carboni, G. Janelidze, G. M. Kelly, and R Paré. On localization and stabilization for factorization systems. ??, 1994.

[CM93] P. Cenciarelli and E. Moggi. A syntactic approach to modularity in denotational semantics. In Proceedings of 5th Biennial Meeting on Category Theory and Computer Science. CTCS-5, 1993. CWI Tech. Report.

[Coo78] S. A. Cook. Soundness and completeness of an axiom system for program verification. SIAM J. Computing, 7:70–90, 1978.

[CP92] R.L. Crole and A.M. Pitts. New Foundations for Fixpoint Computations: FIX-hyperdoctrines and the FIX-logic. Information and Computation, 98:171–210, 1992.

[deB70] N.G. deBruijn. The mathematical language automath. In Symposium in Automatic Demonstration, Lecture Notes in Mathematics, volume Vol. 125, pages 29–61. Springer-Verlag, 1970.

[DFH^{+}93] Dowek, Felty, Herbelin, Huet, Murthy, Parent, Paulin-Mohring, and Werner. The Coq proof assistant user’s guide. Technical report, INRIA-Roquencourt, February 1993.

[dG95] Philippe de Groote. A simple calculus of exception handling. In Proc. TLCA-95, Edinburgh. Springer-Verlag, 1995.

[Dij76] E. W. Dijkstra. A Discipline of Programming. Prentice-Hall, 1976.

[EK66] S. Eilenberg and G. M. Kelly. Closed categories. In S. Eilenberg, D.K. Harrison, S. MacLane, and H. Rohrl, editors, Proceedings of the Conference on Categorical Algebra. Springer-Verlag, 1966. La Jolla, 1965.

[End77] H.B. Enderton. Elements of set theory. Academic Press, 1977.

[Fef95] S. Feferman. Definedness. In Proceedings of the mini-conference on Partial Functions and Programming: Foundational Questions, May 1995. U. C. Irvine.

[Fio94a] M. P. Fiore. First steps on the representation of domains. Manuscript (available from http://www.dcs.ed.ac.uk/home/mf/path.dvi), December 1994.

[Fio94b] M.P. Fiore. Axiomatic Domain Theory in Categories of Partial Maps. PhD thesis, Department of Computer Science, Edinburgh University, 1994. Also published as CST-113-94.

[FK72] P.J. Freyd and G. M. Kelly. Categories of continuous functors. J. of Pure and Applied Algebra, 2:169–191, 1972.

[Flo67] R. W. Floyd. Assigning Meanings to Programs. Proc. Symp. App. Math., 19, 1967.

[FMRS90] P.J. Freyd, P. Mulry, G. Rosolini, and D. Scott. Extensional pers. In Proc. of LICS ’90. IEEE, 1990.

[FP94] M.P. Fiore and G.D. Plotkin. An axiomatisation of computationally adequate domain theoretic models of FPC. In 9^{th} LICS Conf. IEEE, Computer Society Press, 1994.

[Fre72] P. Freyd. Aspects of topoi. Bull. Austral. Math. Soc., 7, 1972.

[Fre90] P.J. Freyd. Recursive types reduced to inductive types. In Proc. of LICS ’90, pages 498–507. IEEE Computer Society Press, 1990.

[Fre91] P. Freyd. Algebraically complete categories. In A. Carboni, M.C. Pedicchio, and G. Rosolini, editors, Category Theory - Proc. of the Int’l Conf. held in Como, Italy, July 1990, volume 1488 of Lecture Notes in Mathematics, pages 95–104. Springer-Verlag, Berlin, 1991.

[FS90] P.J. Freyd and A. Scedrov. Categories, Allegories. North-Holland, Amsterdam, 1990.

[GG86] D. Gabbay and F. Guenthner, editors. Handbook of Philisophical Logic. Kluwer Academic Publishers, 1986.

[Gir72] J.-Y. Girard. Interprétation fonctionnelle et élimination des coupures de l’arithmétique d’ordre superieur. PhD thesis, Université de Paris VII, 1972.

[GMW79] M.J. Gordon, A.J. Milner, and C.P. Wadsworth. Edinburgh LCF - A mechanised logic of computation, volume 78 of Lecture Notes in Computer Science. Springer Verlag, 1979.

[Gor79] M.J. Gordon. The denotational description of programming languages. Springer Verlag, New York, 1979.

[Gri81] D. Gries. The Science of Programing. Springer-Verlag, 1981.

[GU75] P. Gabriel and F. Ulmer. Lokal Präsentierbare kategorien. In Lecture notes in mathematics, vol.445, Berlin, 1975. Springer.

[Gun92] C.A. Gunter. Semantics of Programming Languages: Structures and Techniques. The MIT Press, 1992.

[Gur91] D.J. Gurr. Semantic Frameworks for Complexity. PhD thesis, Department of Computer Science, Edinburgh University, 1991. Also published as CST-72-91.

[HA80] M. C. B. Hennessy and E. A. Ashcroft. A mathematical semantics for a nondeterministic typed λ-calculus. Theoretical Computer Science, 11:227–245, [Her93] C. A. Hermida. Fibrations, Logical Predicates and Indeterminates. PhD

thesis, Department of Computer Science, Edinburgh University, 1993. Also published as CST-103-93.

[Hes92] W. H. Hesselink. Programs, Recursion and Unbounded Choice. Cambridge University Press, 1992.

[HHP87] R. Harper, F. Honsell, and G. Plotkin. A framework for defining logics. In Symposium on Logic in Computer Science, pages 194–204, 1987.

[HJP80] J.M.E. Hyland, P.T. Johnstone, and A.M. Pitts. Tripos theory. Math. Proc. Camb. Phil. Soc., 88:205–232, 1980.

[HL93] P. Harper and M. Lillibridge. Explicit Polymorphism and CPS Conversion. In Proc. 20th PoPL conference. Association for Computing Machinery, 1993.

[HO94] J.M.E Hyland and C.-H.L. Ong. Full abstraction for PCF: dialogue games and innocent strategies. Preprint, 1994.

[Hoa69] C. A. R. Hoare. An Axiomatic Basis for Computer Programming. Communications of the ACM, 12:567–580, 1969.

[HP89] J.M.E. Hyland and A.M. Pitts. The theory of constructions: categorical semantics and topos-theoretic models. Contemporary Mathematics, 92:137–199, 1989.

[HP90] H. Huwig and A. Poigné. A note on inconsistency caused by fixed points in a cartesian closed category. Theoretical Computer Science, 73:101–112, 1990.

[Hyl82] J.M.E. Hyland. The effective topos. In A.S. Troelstra and D. van Dalen, editors, The L.E.J. Brouwer Centenary Symposium. North-Holland, 1982.

[Hyl90] J.M.E. Hyland. First steps in synthetic domain theory. In A. Carboni, M.C. Pedicchio, and G. Rosolini, editors, Category Theory, volume 1488 of Lecture Notes in Mathematics, pages 95–104. Springer-Verlag, 1990.

[Jac91] B.P.F. Jacobs. Categorical type theory. PhD thesis, Katholieke Universiteit Nijmegen, 1991.

[Jut77] L.S. Jutting. Checking Landau’s Grundlagen in the AUTOMATH System. PhD thesis, Eindhoven University, Netherlands, 1977.

[Kah88] G. Kahn. Natural Semantics. In K. Fuchi and M. Nivat, editors, Programming of Future Generation Computers, pages 237–258, Amsterdam, 1988. Elsevier Science Publishers B. V. (North-Holland).

[Kea75] O. Keane. Abstract horn theories. In F.W. Lawvere, C. Maurer, and G.C. Wraith, editors, Model theory and topoi, pages 15–50, Berlin, 1975. Springer. Lecture notes in mathematics, vol.445.

[Kel82] G. M. Kelly. Basic concepts of enriched category theory. London Mathematical Society Lecture Note 64. Cambridge University Press, 1982.

[Koc72] A. Kock. Strong functors and monoidal monads. Archiv. der Mathematik, 23, 1972.

[KP93] G.M. Kelly and A.J. Power. Adjunctions whose counits are coequalizers, and presentations of finitary monads. Journal of Pure and Applied Algebra, 89:163–179, 1993.

[KR77] A. Kock and G.E. Reyes. Doctrines in categorical logic. In J. Barwise, editor, Handbook of mathematical logic, pages 283–313. North-Holland, 1977.

[Laf88] Y. Lafont. The linear abstract machine. Theoretical Computer Science, 59, [Lam68] J. Lambek. A fixed point theorem for complete categories. Math. Zeitschr.,

103:151–161, 1968.

[Lam93] J. Lambek. Least fixpoints of endofunctors of cartesian closed categories. Math. Struct. in Comp. Science, 3:229–257, 1993.

[Law69] F. W. Lawvere. Adjointness in foundations. Dialectica, 23, No.3/4:281–296, 1969.

[Law70] F. W. Lawvere. Equality in hyperdoctrines and comprehension schema as an adjoint. In Applications of Category Theory, 1970. Proceedings of the American Mathematical Society Symposia on Pure Mathematics XVII.

[Law75] F. W. Lawvere. Introduction. In F.W. Lawvere, C. Maurer, and G.C. Wraith, editors, Model theory and topoi, pages 3–14, Berlin, 1975. Springer. Lecture notes in mathematics, vol.445.

[LHJ95] S. Liang, P. Hudak, and M. Jones. Monad Transformers and Modular Interpreters. In Proceedings of the 22nd Symposium on Principles of Programming Languages, pages 333–343. ACM Press, January 1995. San Francisco.

[Lil95] Mark Lillibridge. Exceptions are Strictly More Powerful than Call/CC. Technical Report CMU-CS-95-178, Carnegie Mellon University, 1995.

[Lin66] F.E.J. Linton. Some Aspects of Equational Categories. In S. Eilenberg, D.K. Harrison, S. MacLane, and H. Rohrl, editors, Proceedings of the Conference on Categorical Algebra, pages 84–94. Springer-Verlag, 1966. La Jolla, 1965.

[LP92] Z. Luo and R. Pollack. Lego Proof Development System: User’s Manual. Technical Report ECS-LFCS-92-211, University of Edinburgh, Dpt. of Computer Science, 1992.

[LS86] J. Lambek and P. J. Scott. Introduction to Higher Order Categorical Logic. Number 7 in Cambridge studies in advanced mathematics. Cambridge University Press, 1986.

[Luo82] Z. Luo. An extended calculus of constructions. PhD thesis, Department of Computer Science, Edinburgh University, 1982. Also published as CST-65-90.

[Mac71] S. MacLane. Categories for the Working Mathematician. Springer-Verlag, 1971.

[Mag92] Lena Magnusson. The new implementation of alf. In Workshop on Logical Frameworks, 1992.

[Mey88] A.R. Meyer. Semantical paradigms: Notes for an invited lecture. In IEEE Symposium on Logic in Computer Science, pages 236–253. Computer Society Press, 1988.

[Mil72] R. Milner. Implementation and application of scott’s logic for computable functions. In ACM conference on Proving Assertions about Programs, pages 1–6. Ellis Horwood Limited, 1972.

[Mil77] R. Milner. Fully abstract models of typed lambda λ-calculi. Theoretical Computer Science, 4:1–22, 1977.

[Mil80] R. Milner. A Calculus of Communicating Systems, volume 92 of Lecture Notes in Computer Science. Springer-Verlag, 1980.

[Mil83] R. Milner. Calculi for Syncrony and Asyncrony. Theoretical Computer Science, 25:267–310, 1983.

[Mit90] J. C. Mitchell. Type systems for programming languages. In J. van Leeuwen, editor, Handbook of Theoretical Computer Science, volume II, pages 365 – 458. Elsevier Science Publishers, 1990.

[MM85] J. C. Mitchell and A. R. Meyer. Second order logical relations. In Logics of Programs, number 193 in LNCS, pages 225–236. Springer-Verlag, 1985.

[Moga] E. Moggi. A general semantics for evaluation logic. Unpublished manuscript.

[Mogb] E. Moggi. A semantics for Evaluation Logic. To appear in Fundamenta Informaticae.

[Mog86] E. Moggi. Categories of partial morphisms and the partial lambda-calculus. In Proceedings Workshop on Category Theory and Computer Programming, Guildford 1985, volume 240 of Lecture Notes in Computer Science. Springer-Verlag, 1986.

[Mog90a] E. Moggi. An abstract view of programming languages. Technical Report ECS-LFCS-90-113, University of Edinburgh, Comp. Sci. Dept., 1990.

[Mog90b] E. Moggi. Modular approach to denotational semantics. Unpublished manuscript, November 1990.

[Mog91a] E. Moggi. A category-theoretic account of program modules. Math. Struct. in Comp. Science, 1:103–139, 1991.

[Mog91b] E. Moggi. Notions of computation and monads. Information and Computation, 93(1), 1991.

[Mog91c] E. Moggi. A modular approach to denotational semantics. Invited talk, Conference on Category Theory and Computer Science, Paris 1991.

[Mog95a] E. Moggi. Metalanguages and applications. To appear in: Semantics and Logics of Computation, CISM Lecture Notes, Springer-Verlag. Presented at the Summer School on Semantics and Logics of Computation, Newton Institute, Cambridge, 25-29 September 1995.

[Mog95b] E. Moggi. Towards a framework for programming languages (and program logics). In P. Dybier and R. Pollack, editors, Proceedings of the Joint CLiCS-Types Workshop on Categories and Type Theory, Göteborg, January 95. Programming Methodology Group, Göteborg University and Chalmers University of Technology, May 1995. Report 85.

[Mos88] Peter D. Mosses. The modularity of action semantics. Technical Report DAIMI IR-75, Computer Science Department, Aarhus University, 1988.

[Mos90] Peter D. Mosses. Denotational semantics. In J. van Leeuwen, editor, Handbook of Theoretical Computer Science. Elsevier Science Publishers, 1990.

[Mos92] Peter D. Mosses. Action Semantics. Tracts in Theoretical Computer Science. Cambridge University Press, 1992.

[MR76] M. Makkai and G.E. Reyes. Model theoretic methods in the theory of topoi and related categories. Acad. Polon. Sci., 24:379–392, 1976.

[MR91] Q. Ma and J. C. Reynolds. Types, abstraction and parametric polymorphism 2. In Mathematical Foundations of Programming Languages, LNCS. Springer-Verlag, 1991.

[MS92] J. Mitchell and A. Shedrov. Notes on sconing and relators. In Computer Science Logic ‘92, volume 702 of Lecture Notes in Computer Science. Springer-Verlag, 1992.

[MW72] R. Milner and R. Weyhrauch. Proving compiler correctness in a mechanized logic. Machine Intelligence, 7:51–70, 1972.

[Neu44] J. Von Neumann. The EDAVAC report. In Computer from PASCAL to Von Neumann, ed. H. Goldstain, Princeton University Press, Princeton, NJ, 1972, [New75] M. Newey. Formal semantics of LISP with applications to program correct-

ness, 1975. Artificial Intelligence Memo 257, Stanford.

[OT92] P.W. O’Hearn and R.D. Tennent. Semantics of local variables. In Applications of Categories in Computer Science, volume 177 of Lecture Notes Series. Cambridge University Press, 1992.

[OT93] P.W. O’Hearn and R.D. Tennent. Relational parametricity and loval variables. In Proc. 20th PoPL conference. Association for Computing Machinery, 1993.

[PA93] G. Plotkin and M. Abadi. A Logic for Parametric Polymorphism. In M. Bezem and J. F. Groote, editors, Typed Lambda Calculi and Applications, Proceedings of TLCA ’93. Springer LNCS 664, 1993.

[Pau87] L. Paulson. Logic and Computation, volume 2 of Cambridge Tracts in Theoretical Computer Science. Cambridge University Press, Cambridge, 1987.

[Pav90] Duško Pavlović. Predicates and fibrations. PhD thesis, Rijksuniversiteit Utrecht, 1990.

[Pho90] W.K.-S. Phoa. Effective domains and intrinsic structure. In Proc. of 5th Annual Symposium on Logic in Computer Science, 1990.

[Pho92] Wesley Phoa. An introduction to fibrations, topos theory, the effective topos and modest sets. Technical Report ECS-LFCS-92-208, University of Edinburgh, LFCS, 1992.

[Pit] A. M. Pitts. Relational properties of domains. A revised version of Cambridge Computer Laboratory Technical Report Number 321. To appear in Information and Computation.

[Pit82] A.M. Pitts. The secret category theory lecture notes. Unpublished manuscript, 1982.

[Pit91] A.M. Pitts. Evaluation logic. In G. Birtwistle, editor, Workshops in Computing 283. 4th Higher Order Workshop, Banf. 1990, Springer Verlag, 1991.

[Pit93] A.M. Pitts. Computational adequacy via ‘mixed’ inductive definitions, volume 802 of Lecture Notes in Computer Science. Springer Verlag, 1993. Proc. 9th Int. Conf. on Mathematical Foundations of Programming Language Semantics, New Orleans.

[Plo73] Gordon Plotkin. Lambda-definability and logical relations. Technical report, School of Artificial Intelligence, University of Edinburgh, 1973.

[Plo75] Gordon Plotkin. Call-by-name, call-by-value and the λ-calculus. Theoretical Computer Science, 1, 1975.

[Plo77] Gordon Plotkin. LCF considered as a programming language. Theoretical Computer Science, 5, 1977.

[Plo81] Gordon Plotkin. A Structural Approach to Operational Semantics, 1981. Aarhus University, Department of Computer Science, DAIMI FN-19.

[Plo85a] G.D. Plotkin. Denotational semantics with partial functions. Lecture at C.S.L.I. Summer School, 1985.

[Plo85b] Gordon Plotkin. Types and Partial Functions, 1985. Lecture notes, Department of Computer Science, University of Edinburgh.

[Plo91a] Gordon Plotkin. Notes on a metalanguage, 1991. Domain Theory Lecture Notes (extending “The Stanford Manuscript”), University of Edinburgh.

[Plo91b] Gordon Plotkin. “The Stanford Manuscript”, 1991. Domain Theory Lecture Notes, University of Edinburgh (LFCS).

[Plo93] G.D. Plotkin. Second order type theory and recursion. Slides of a talk given at the Scott Fest, February 1993.

[Pow94] A. J. Power. Why tricategories? Technical Report ECS-LFCS-94-289, Department of Computer Science, Edinburgh University, 1994.

[Rey74] J.C. Reynolds. Towards a Theory of Type Structure, volume 19 of Lecture Notes in Computer Science. Springer-Verlag, 1974. Proc. Colloque sur la Programmation.

[Rey81] J.C. Reynolds. The craft of programming. Prentice Hall, 1981.

[Rey83] J.C. Reynolds. Types, abstraction and parametric polymorphism. In R.E.A. Mason, editor, Information Processing 83, pages 513–523. North-Holland, Amsterdam, 1983.

[Rob95] E.P. Robinson. Note on the presentation of enriched monads. Unpublished manuscript, 1995.

[Ros86] G. Rosolini. Continuity and Effectiveness in Topoi. PhD thesis, University of Oxford, 1986.

[RS] B. Reus and T. Streicher. Naïve synthetic domain theory - a logical approach. unpublished manuscript.

[SB83] D. Sannella and R. Burstall. Structured theories in LCF. Technical Report CSR-129-83, Department of Computer Science, Edinburgh University, 1983. Also appeared in Proceedings of the 8th Colloquium on Trees in Algebra and Programming, L’Aquila, Italy, 1983.

[Sco69] D. Scott. A Type-theoretical Alternative to CHUCH, ISWIM, OWHY. (Also in Theoretical Computer Science, 121, 411-440, 1993), 1969.

[See82] R.A.G. Seely. Review of topos theory. Journal of Symbolic Logic, 47, 1982.

[See87] R.A.G. Seely. Categorical semantics for higher order polymorphic lambda calculus. Journal of Symbolic Logic, 52(2), 1987.

[SS71] D. Scott and S. Strachey. Towards a Mathematical Semantics for Computer Languages. Oxford Univ. Comp. Lab, PRG 6, 1971.

[ST87] D. Sannella and A. Tarlecki. Toward a formal development of programs from algebraic specifications: implementations revisited. In H. Ehrig and al., editors, TAPSOFT 87, volume 250 of London Mathematical Society Lecture Note Series. Springer Verlag, 1987.

[ST89] D. Sannella and A. Tarlecki. Toward formal developmento of ml programs: foundations and methodology. Technical Report ECS-LFCS-89-71, Department of Computer Science, Edinburgh University, 1989. Extended abstract in Proc. Colloq. on Concurrent Issues in Programming Languages, Joint Conf. in Theory and Practice of Software Development (TAPSOFT), Barcelona, 1989. LNCS 352, pp. 357.

[Sta85] R. Statman. Logical relations and the typed lambda calculus. Inform. and Control, 65:85–97, 1985.

[Sti92] Colin Stirling. Modal and Temporal Logics. In D. Gabbay S. Abramsky and T. Maibaum, editors, Handbook of Logic in Computer Science. Oxford University Press, 1992.

[Str72] R. Street. The formal theory of monads. Journal of Pure and Applied Algebra, 2:149–168, 1972.

[Tai67] W. W. Tait. Intentional interpretation of functionals of finite type. J. Symbolic Logic, 32:198–212, 1967.

[Tay91] P. Taylor. The fixed point property in synthetic domain theory. In Proc. of 6th Annual Symposium on Logic in Computer Science, 1991.

[Tay92] Paul Taylor. Domains and duality. unpublished manuscript, 1992.

[Ten] R. D. Tennent. Denotational semantics. In Abramsky et al. [AGM]. To appear.

[Ten91] R.D. Tennent. Semantics of programming languages. Prentice Hall, 1991.

[Vic89] S. Vickers. Topology via logic. Cambridge University Press, Cambridge, 1989.

[Wad76] C. P. Wadsworth. The relationship between λ-expressions and their denotations in Scott’s model of the λ-calculus. SIAM J. Comput., September 1976.

[Wad91] Philip Wadler. Is there a use for linear logic? In Symposium on Parallel Evaluation and Semantics Based Program Manipulation (PEPM), Yale University. ACM/IFIP, June 1991.

[Wad92] Philip Wadler. The essence of functional programming. In Proc. 19th Annual Symposium on Principles of Programming Languages. ACM SIGPLAN-SIGACT, January 1992.

[Wec92] W. Wechler. Universal Algebra for Computer Scientists. In W. Brawer, G. Rozenberg, and A. Salomaa, editors, EATC Monographs on Theoretical Computer Science. Springer-Verlag, 1992.

[Wey72] R. W. Weyhrauch. Program Semantics and Correctness in a Mechanized Logic. In Proc. 1st USA-Japan Computer Conf., Tokyo, 1972.

[Win85] G. Winskel. A complete proof system for sccs with modal assertions. In S. N. Maheshwari, editor, Foundations of Software Technology and Theoretical Computer Science, pages 392–410. Springer-Verlag, 1985. Lecture Notes in Computer Science No. 206.

Index

action of a functor

admissible, 68 adequacy

computational, 3

of TMLE, 73–79 static ∼ of TMLE, 59

arrow of an element, 25 assertion, 18, 129–133

in Hoare logic, 135 inductive ∼s, 121

Barcan formula, 100 Beck-Chevalley condition, 87, 88, 94 block expression, 119

callcc , 55, 154 category

λ\overline{ω}, 184 algebraically complete, 166 ambient, 81, 107, 126 base, 87 comprehension, 93 finite limit theory of, 177 Kleisli, 7, 43 λ\overline{ω}, 21 locally finitely presentable, 21, 175 monoidal, 24 monoidal closed, 24 enrichment of, 25

of partial maps, see partial map, cat-

egory of ∼s PL, 183 tensored, 25

classifier, 97

of partial maps, 43 completeness, 3 conceptual, 3 of HML, 189 of the computational lambda calcu-

lus, 41 complexity, 47 computation, 7, 16 conservativity, 13 constructor

pointed, 20, 157

semantic, 13, 20, 155–162 of exceptions, 205, 206 of resumptions, 170, 207 of side effects, 124 parameters of, 155

syntactic presentation of, 20, 146, 189– 198 continuations, 47 cpo, 11, 49

Scott-open sub∼, 63, 69, 92 Cpo , 39, 63, 97 Cppo_{⊥}, 68

diagonal fill-in property, 106 display maps

class of, 92 doctrine, 173 domain, 11, 22, 43, 80, 81, 199

recursive ∼ equation, 48, 64

for exceptions, 64 domain theory

axiomatic, 11

synthetic, 11, 81, 126, 199 dominance, 97, 128 dynamic allocation, 47, 115 dynamic logic, 10

effective topos, 11, 81, 110 EL, see Evaluation Logic ELse, 19, 130 endofunctor

strong, 24–28 category of ∼s, 27 composition of ∼s, 28 general axioms for, 84 special axioms for, 85 underlying functor of, 25

Evaluation Logic, 9, 82–87

standard version of, 17 evaluation relation, 10, 57, 74, 114–118 exception, 45, 48–79, 115 existence predicate, 37 Extended Calculus of Constructions, 199

factorization system, 112 pre∼, 112 stable, 112

fibration

cloven and split, 179 finite limit, 95, 111, 113 formulae, 176 sketches, 177, 195 theories, see theory, finite limit

Fix-Logic, 9 fixed point, 167

combinator using exceptions, 54 in HML, 166 induction, 10, 20, 138 admissibility for, 143

uniformity of ∼ operators, 22, 39, 210 formal approximation relation, 67 FPC, 5 free logics, 6 Frobenious reciprocity, 88 full abstraction, 3 functor

λ\overline{ω}, 190

M, 92, 103, 122–124

enriched, 103

Gabriel-Ulmer duality, 14, 147, 176 generic

object, 181 predicate, 98

geometric logic, 92

handle, 51

Haskell, 8 HML, 20, 147, 163–168

raw syntax of, 168 Hoare logic, 10, 119, 129 Hoare triples, 12, 137 homomorphism

Σ, 20, 152, 154 Horn

clause, 177

universal ∼ sentence, 146, 177 hyperdoctrine, 87

first order, 87 with equalities, 88

image

inverse ∼ of a relation, 69 institution, 12 interactive

input, 46 output, 47

internal language of a category, 29

of a fibration, 218 interpretation of L(Σ), 40 of EL

based on hyperdoctrines, 87–91 standard, 80 of HML, 184 of the computational lambda calcu-

lus, 38–42 of the metalanguage for exceptions,

60–65 of TMLE, 58–59 relative, 14, 21, 146, 173 of finite limit theories, 14 of HML, 168–172

invariant F, 69 minimal ∼ object, 64

kind

of HML, 163 Kleisli triples, 29

L(Σ), see lambda calculus, L(Σ)

λ\overline{ω}-Cat, 21, 190 lambda calculus L(Σ), 34, 46 computational, 7, 33–37 higher order polymorphic, 14, 148 simply typed, 14, 148

LCF, 4

Cambridge, 11 LEGO, 15, 199, 200 Linton, 174 local variable, 172 logos, 18

map, 167 membership, 74 metalanguage, 1, 4

computational, see lambda calculus,

computational ML_{T} (Σ), 8, 13

model of, see model, of L(Σ) Mod (Σ), 148, 152 modality

T, 10, 90

T -modal operator, 11 evaluation, 9, 82

left and right rules for, 18, 101, 115 model

of L(Σ), 41, 147 of HML, 182–189 Σ, see model, of L(Σ) standard ∼ of EL, 91, 99 syntactic ∼ of L(Σ), 41, 147

modularity, 1 in denotational semantics, 146–148 in proofs, 19

monad, 7 algebras of, 43, 174 constructor, 61 lifting, 42, 122, 126, 128

in Cpo , 63 powerset, 44 strong, 1, 28–33

∼ morphism, 32, 149 category of ∼s, 32 composition of ∼s, 33 general axioms for, 85 special axioms for, 86 underlying strong endofunctor of,

30 mono

class of admissible ∼s, 43, 96, 114 regular, 112, 113 requirement, 37, 86, 116

name of a morphism, 25

natural numbers object, 60, 63 natural transformation

M-cartesian, 92, 104, 124 naturality, 39 necessity, 83

standard interpretation of, 99 nondeterminism, 44, 74, 115 noninterference, 119

object class of conservative ∼s, 175 finitely presentable, 175

operation, 7, 154

polymorphic, 33, 163 operator

of HML, 163

parametric extension, 20, 157 partial correctness, 18, 134–137 partial equivalence relation (PER), 11, 81 partial functions, 42 partial map

category of ∼s, 49 classifier, see classifier, of partial maps

PCF, 4 pCpo , 63 PLC, see lambda calculus, higher order

polymorphic polytype, 33

computationally positive (negative),

149 light ∼ of ML_{T} (Σ), 161

possibility, 83

standard interpretation of, 99 possible worlds, 65, 120 preservation of equations, 13, 160 products

D, 94, 181 indexed, 94

absoluteness of, 122

raise, 51

reindexing in a fibration, 180 in a hyperdoctrine, 88 in categories with display maps, 94

relation, 38 admissible, 68 evaluation, see evaluation relation logical, 16, 38, 49, 65, 217

relational parametricity, 38

relational structure, see structure, rela-

tional resumption, 45

Scott

induction, see fixed point, induction semantics

axiomatic, 3 denotational, 1, 2 functorial, 14, 21, 147, 173–176 operational, 2 of TMLE, 52 standard, 10 side effects, 47, 115 Sierpiński space, 97 signature

morphism, 156 of L(Σ), 34 of HML, 163

sketch

finite limit, see finite limit, sketches soundness, 3 of EL, 91–106 of HML, 186 of the computational lambda calcu-

lus, 41 of the metalanguage for exceptions,

62 Standard ML

exceptions in, 48 state reader, 121 strength, 28

functorial, 25 tensorial, 26, 109

strictness, 44, 68

of TMLE, 59 structure

Σ, 151 of L(Σ), 40 of HML, 186

additional, 42, 148

for exceptions, 62 relational, 68

substitution

sign-preserving (reversing), 150 sums

D, 94 indexed, 94

term

canonical of TMLE, 52

strongly ∼ of TMLE, 52 light ∼ of ML_{T} (Σ), 158

theory algebraic, 173 essentially algebraic, 178 finite limit, 21, 175

models of, 21 in the computational lambda calcu-

lus, 8, 14 Lawvere, 173 lex, see theory, finite limit of L(Σ), 35 of HML, 163

TMLE, 50–54 tripos, 98 type

computational, 7 constructor, 33 dependent, 93, 111, 200 inductive ∼ in HML, 167 product, 164 scheme

closed ∼ of L(Σ), 34

of HML, 163

parametric ∼ of HML, 164 sum, 164

uniform redefinition, 155, 161, 172, 208 universality, 3

variety, 175 while-programs, 136

annotated, 19

XCC, see Extended Calculus of Constructions