On Lists and Other Abstract Data Types in the Calculus of Constructions

On Lists and Other Abstract Data Types in the Calculus of Constructions Jonathan P. Seldin Department of Mathematics Concordia University Montreal, Quebec, Canada seldin@alcor.concordia.ca January 29, 1999 Dedicated to Joachim Lambek on the occasion of his 75th birthday Abstract The representation of the inductively defined abstract data type for lists was left incomplete in [2, 9]. Here that representation is completed, and it is proved that all extra axioms needed are consistent. Among the innovations of this paper is a definition of cdr, whose definition was left for future work in [2, 9]. The results are then extended to other abstract data types, those of [1]. The method used to define cdr for lists is extended to obtain the definition of an inverse for each argument of each constructor of an abstract data type. These inverses are used to prove the injective property for the constructors. Also, Dedekind s method of defining the natural numbers is used to define a predicate associated with each abstract data type, and the use of this predicate makes it unnecessary to postulate the induction principle. The only axioms left to be proved are those asserting the disjointness of the co-domains of different constructors, and it is shown that those axioms can be proved consistent. Key words: Calculus of constructions, abstract data types, lists This work was supported in part by grant RGP-23391-98 from the Natural Sciences and Engineering Research Council of Canada. 1

The discussion of the representation of the inductively defined abstract data type for lists at the end of [2, 9] was left incomplete. The aim of this paper is to complete it. The matters left unfinished in [2, 9] include the definition of cdr and the proof that three axioms corresponding to two of the Peano axioms are consistent. These are the matters finished here. In order to make this paper as self-contained as is reasonable for a paper of this size, a brief presentation of the representation of lists is presented in 1. This presentation includes a discussion of the induction property associated with this data type. This induction property can be easily used to define a number of list functions, but defining cdr is not so easy; it will be defined in 2. In 3, it will be shown that two of the three axioms are, in fact, provable; these are the axioms asserting the injective property of cons with respect to each of its arguments, and the proof uses the car and cdr. In 4, it will be shown that the remaining axiom, which asserts that the empty list is not constructed by cons, is consistent. Finally, in 5, these methods will be extended to all of the abstract data types of [1]. In particular, the methods used to define car in 1 and cdr in 2 will be used to obtain an inverse for each constructor with respect to each argument. This will allow the proof of the injective property of constructors. The use of a predicate associated with each abstract data type that uses Dedekind s method of defining an inductively defined set will be used to eliminate the need to postulate an induction axiom. This will leave only the axioms asserting that the co-domains of different constructors are disjoint, and these can be proved consistent by the method of 4. A familiarity with [2] will be assumed throughout. The version of the calculus of constructions will be assumed to be TOC0. 1 Preliminaries Recall that the basic definitions are as follows [2, p. 86]: List λa : Prop. ( u : Prop)((A u u) u u), nil λa : Prop. λb : Prop. λf : A B B. λy : B. y, cons λa : Prop. λx : A. λl : ListA. λb : Prop. λf : A B B. λy : B. fx(lbfy). 2

It is easy to prove the following: and A : Prop ListA : Prop, A : Prop nila : ListA, A : Prop, x : A, L : ListA consaxl : ListA. Now to do recursion on lists, define Listrec λa : Prop. λb : Prop. λh : A B B. λy : B. λl : ListA. lbhy. Then given A : Prop, B : Prop, H : A B B, and M : B, ListrecABHM(nilA) = nilabhm and given, in addition, x : A and L : ListA, = M, ListrecABHM(consAxL) = consaxlbhm = Hx(LBHM) = Hx(ListrecABHML). This allows us to define functions by recursion. For example, the function append is characterized by appenda(nila)l 2 = L 2, appenda(consaml 1 )L 2 = consam(appendl 1 L 2 ). This can be defined by where and append λa : Prop. λl : ListA. λm : ListA. ListrecA(ListA)HMlm, H λx : A. λn : ListA. consaxn M λl : ListA. l. We can also define length, which satisfies lengtha(nila) = 0, lengtha(consaxl) = σ(lengthal). 3

The definition is length λa : Prop. ListrecAN(λx : A. σ)0. Other examples will be fairly obvious. Two important functions used with the data type list are car and cdr. The first satisfies car(consaxl) = x, while the second satisfies cdr(consaxl) = L. There are problems defining both of these. The problem in defining car is that its value for nila must be an object of type A. Since we do not know, in general, if there is any term in a given type, it is best to supply the object to be assigned to nila as an argument of car. Thus, given A : Prop, M : A, x : A, and L : ListA, we will want The definition is then caram(nila) = M, caram(consaxl) = x. car λa : Prop. λy : A. ListrecAA(λx : A. λu : A. x)y. The definition of cdr is more complicated, and is left until the next section. To incorporate the logical properties of lists, we want a predicate L similar to the predicate N for arithmetic: L λa : Prop. λx : ListA. ( y : ( A : Prop)(ListA Prop)) (( u : A)( l : ListA)(yAl ya(consaul)) ya(nila) yax). (There is an error in the corresponding formula and in a few other formulas in connection with lists, [2, 9].) This formula is based on Dedekind s definition of the set of natural numbers, and it works whenever the logic is second order or higher order. It is then easy to prove L : ( A : Prop)(ListA Prop), M : ( A : Prop)(LA(nilA)), 4

N : ( A : Prop)( u : A)( l : ListA)(LAl LA(consAul)), and P : ( B : ( A : Prop)(ListA Prop))( A : Prop) (( u : A)( l : ListA)(BAl BA(consAul)) BA(nilA) ( l : ListA)(LAl BAl)), for some closed terms M, N, and P. This gives us the desired induction property on lists. To complete our theory, we need results corresponding to Peano1 and Peano2: List1 List2 List3 ( A : Prop)( x : A)( l : ListA)( consaxl = ListA nila), ( A : Prop)( x : A)( y : A)( l : ListA)( m : ListA) (consaxl = lista consaym x = A y), ( A : Prop)( x : A)( y : A)( l : ListA)( m : ListA) (consaxl = lista consaym l = ListA m), We shall deal with List2 and List3 in 3 and with List1 in 4. 2 Definition of cdr There is no great problem in deciding what the value of cdr should be for nila: just assign nila. The problem is getting access to the argument L in Hx(ListrecABHM L). So we must proceed by indirection. The idea is similar to the idea used in defining the numerical predecessor function π: we will define a function on lists whose value is an ordered pair of lists in which the first list of the pair is the argument of the function and the second is the result of applying cdr to the first. This function is definable using Listrec: where G λa : Prop. λu : ListA. ListrecA(ListA ListA)HMu, H λx : A. λv : ListA ListA. M D(ListA)(ListA)(consAx(fst(ListA)(ListA)v))(fst(ListA)(ListA)v), D(ListA)(ListA)(nilA)(nilA). 5

Theorem 1 Suppose A : Prop and L : ListA. Then where L 1 = L and Proof By a list induction on L. Basis: L = nila. We have GAL = D(ListA)(ListA)L 1 L 2, L 2 = { nila if L = nila, L if L = consaxl. GA(nilA) = ListrecA(ListA ListA)HM(nilA) = D(ListA)(ListA)(nilA)(nilA). Here L 1 = L 2 = nila, and so the theorem is satisfied. Induction step: By the induction hypothesis, GAL = D(ListA)(ListA)LL, where Then L = { nila if L = nila, L if L = consaxl. GA(consAxL) = ListrecA(ListA ListA)HM(consAxL) = Hx(ListrecA(ListA ListA)HML) = Hx(D(ListA)(ListA)LL ) = D(ListA)(ListA)(consAxL)L, as desired. Definition 1 The term cdr is defined by cdr λa : Prop. λl : ListA. snd(lista)(lista)(gal), where G is the term defined above. Corollary 1.1 If A : Prop, x : A, and L : ListA, then cdra(nila) = nila, cdra(consaxl) = L. 6

Note that the first result here does not use the induction hypothesis, whereas the second does. Thus, if we formalize the proof of this corollary, we get the following: Corollary 1.2 There are closed terms R and S such that and R : ( A : Prop)(cdrA(nilA) = ListA nila) S : ( A : Prop)( x : A)( l : ListA)(Ll cdr(consaxl) = ListA l). 3 List2 and List3 As we have seen, we need List2 and List3 to hold to have the logical properties of lists. In this section, we will see that we can prove List2 and a formula which gives us the properties we need of List3. Theorem 2 There is a closed term M such that M : List2. Proof Assume an environment Γ 0 consisting of A : Prop, x : A, y : A, l : ListA, m : ListA, u : consaxl = ListA consaym. By the conversion properties of car, car(consaxl) = ListA x and car(consaym) = ListA y are both inhabited types. By the logical properties of equality, there is a term N such that Γ 0 N : x = A y, and the theorem follows. Unfortunately, we cannot prove List3 in the same way. However, we can prove a result which is just as good for our purposes. 7

Theorem 3 There is a closed term M such that M : ( A : Prop)( x : A)( y : A)( l : ListA)( m : ListA) (Ll Lm consaxl = ListA consaym l = ListA m). Proof Similar to the proof of Theorem 2. The extra antecedents Ll and Lm are necessary in order to use the second result of Corollary 1.2. 4 The consistency of List1 It does not appear possible to prove List1 or a variant of it in the way we were able to prove List2 and List3. However, it is possible to prove that adding it as a postulate to other appropriate postulates is consistent. The proof is similar to that for Peano1 in [2, 9]. Theorem 4 Let Γ be a strongly consistent environment. Then Γ, c : List1 is consistent. Proof This will be proved by showing that it is impossible to prove (1) Γ, c : List1, M : z where z does not occur free in Γ. Thus, suppose it is possible. Then there is a normal deduction of (1). There is thus a shortest such deduction, call it D. Since z is an atomic type, the only inferences in the left branch of D are by ( e) and (Eq ). It follows that the formula at the top of that branch is not discharged. That formula cannot be in Γ because Γ is strongly consistent, and it cannot be. Hence, it must be c : List1, and D has the following form: c : List1 D 1 (z) A : Prop D 2 (z) X : A caxlm 1 : D 3 (z) L : ListA D 4 (z) M 1 : B caxlm 1 z : z. ( e) 4 ( e) where B consaxl = ListA nila and A B C D E F ( e) 4 8

is an abbreviaiton for A B F 1 ( e) F 2 C F 3 ( e) D F ( e) E ( e) for some F 1, F 2, F 3. Now consider D 4 (z). Written without abbreviations in the conclusion, it is D 4 (z) M 1 : ( r : ListA Prop)(r(consAXL) r(nila)). Case 1. The last non-equality rule of D 4 (z) is ( e). Then, as before, the top formula of the left branch is not discharged and is c : List1. Thus, D 4 (z) has the form c : List1 D 5 (z) A : Prop D 6 (z) X : A D 7 (z) L : ListA D 8 (z) M 2 : B ca X L M 2 : D 9 M 1 : ( r : ListA Prop)(r(consAXL) r(nila)), ( e) 4 where B consa X L = ListA nila. But then c : List1 D 5 (z) A : Prop D 6 (z) X : A ca X L M 2 : D 7 (z) L : ListA D 8 (z) M 2 : B ca X L M 2 z : z ( e) 4 ( e) is a shorter proof of (1), contrary to hypothesis. Hence, this case is impossible. Case 2. The last non-equality rule of D 4 (z) is ( Ti). Then D 4 (z) is 1, [r : ListA Prop] standard proof D 41 (z, r) ListA : Prop Prop : Type (PTF v) M 2 : r(consaxl) r(nila) ListA Prop : Type ( Ti - 1) λr : ListA Prop. M 2 : ( r : ListA Prop)(r(consAXL) r(nila)), 9

where M 1 λr : ListA Prop. M 2. Now consider D 41 (z, r). By the argument of Case 1 above, the last non-equality rule is not ( e), so it must be ( Pi), and the left branch of D 41 (z, r) is, r : ListA Prop, [u : r(consaxl)] D 411 (z, r, u) M 3 : r(nila), where M 2 λu : r(consaxl).m 3. Now consider D 411 (z, r, u). by the argument of Case 1, the last rule is not ( e), and it clearly cannot be ( κi). Hence, it must be (Eq ). This requires (2) consaxl = nila, but since and consaxl = λb : Prop. λf : A B B. λy : B. fx(lbfy) nila = λb : Prop. λf : A B B. λy : B. y, the two terms on either side of (2) have distinct normal forms, and (2) is impossible. Hence, there is no proof of (1). This proof is very much like the proof of [2, Theorem 21]. In fact, the two proofs could be combined as two cases of a proof of the following: Corollary 4.1 If Γ is a strongly consistent environment, then is consistent. Γ, c 1 : Peano1, c 2 : List1 I conjecture that similar results can be obtained for other inductively generated free algebras. 10

5 Generalization to abstract data types For any closed proposition A, ListA is almost an example of the data types considered by [1, Definition 4.1]: Definition 2 A CC-data type structure consists of 1. a closed proposition D 0, called the universe of the structure; 2. a set {M 1,..., M n } of closed propositions called parameters of the CCdata type structure; and 3. a set {f 1,..., f m } of closed proofs of CC (the calculus of constructions), called constructors of the CC-data type structure. Each f j has type A 1,j... A nj j D 0, where each A i,j is either D 0 or is some M k. Definition 3 The signature of a CC-data type structure consists of the sets of propositions {M 1,..., M n } (the parameters) and {F 1 [u],..., F m [u]} ( types of constructors ), where each F j [u] is obtained from A 1,j... A nj j D 0 by replacing D 0 and all A k,j which are not parameters by u, which has type Prop. Definition 4 Given a signature {M 1,..., M n }, {F 1 [u],..., F m [u]}, the CCparametric data type for this signature is the one given by 1. D 0 ( u : Prop)(F 1 [u]... F m [u] X), 2. {M 1,..., M n }, 3. f j λx 1 : A 1,j..... λn nj : A nj j. λu : Prop. λy 1 : F 1 [u]..... λy m : F m. y j t 1... t nj, where t i { xi if A i,j is some M k, x i uy 1... y m if A i,j is D 0. Definition 5 A CC-data type is defined by induction as follows: D is a CCdate type if it is a CC-parametric data type and all of its parameters are CC-data types or are variables of type Prop. 11

Remark 1 Berardi limits parameters to CC-data types. This definition is generalized here to accomodate ListA, since A is such a variable. It is possible to abstract from such CC-data types with respect to these papameters, as is done in the case of lists. Berardi also defines what he calls an iterator, which corresponds to Listrec: Definition 6 The D-iterator is defined by Diter λu : Prop. λh 1 : F 1 [u].... λh m : F m [u]. λx : D. xuh 1... h m. Remark 2 This term corresponds exactly to Listrec. Listrec should probably have been called Listiter, since it is really an iterator rather than a recursion operator. Compare with the terms Z (iterator) and R (recursion operator) for natural numbers: the former satisfies whereas the latter satisfies Z(σx)f = f(zxf), RMN(σx) = Nx(RMNx). Clearly, Listrec is more like the former than the latter, and this is why defining cdr was so difficult. The basic property of Diter is given by Theorem 5 If B : Prop and H j : F j [B] for j = 1,..., m, then DiterBH 1... H m (f j t 1... t nj ) = H j T 1... T nj, where T i { ti if A i,j is some M k, DiterBH 1... H m t i if A i,j is D 0. Proof By Definition 4, DiterBH 1... H m (f j t 1... t nj ) = f j t 1... t nj BH 1... H m = H j T 1... T nj, where T i { ti if A i,j is some M k, t i BH 1... H m if A i,j is D 0, 12

and DiterBH 1... H m t i = t i BH 1... H m by Definition 6. Berardi also defines propositions induction D asserting that all elements of the domain of the data type D can be constructed by the constructors, and considers it surprising that these propositions cannot be proved. But it is not surprising that they cannot be proved: if = does not include η-conversion, then the induction predicate for the natural numbers is not true. For the term λa : Prop. λx : A A. x is a term of type N which is not convertible to any numeral (although it is η-convertible to 1 λa : Prop. λx : A A. λy : A. xy). This is why I have used N and L to obtain induction for natural numbers and lists. If this approach is applied to CC-data types, the result is the following definition: Definition 7 If D is a CC-data type, then the predicate Dpred is defined as follows: Dpred λx : D. ( y : D Prop)(closef 1 y... closef m y yx), where, for each j = 1, 2,..., m, closef j y ( x 1 : A 1,j )... ( x nj : A nj j)(y 1 x 1... Y nj x nj y(f j x 1... x nj ), where, for each i = 1,..., n j, y if A i.j is D 0, Y i D pred if A i,j is M k, a CC-data type whose predicate is D pred, λz : M k. T if A i,j is M k, a variable, and where, T. As in the case of N and L, we can prove the following: Theorem 6 The term Dpred satisfies Dpred : D Prop, and there are closed terms N j and P such that N j : ( x 1 : A 1,j )... ( x nj : A nj j)(dpred (f j x 1... x nj )), and P : ( B : D Prop)(closef 1 B... closef n B ( x : D)(Dpred x Bx)). 13

The last of these expresses the induction property for D, so to have this property it is sufficient to replace formulas of the form ( x : D)M by ( x : D)(Dpred x M). This leaves the unicity conditions. They are that each constructor is injective and that the co-domains of the constructors are mutually disjoint. The methods used for lists here can deal with these conditions for CC-data types satisfying certain conditions. Let us start with the disjointness of the co-domains of the constructors. This is expressed by axioms of the form c j,l : ( x 1 : A 1,j )...( x nj : A nj j)( y 1 : A 1,l )...( y nl : A nl l) ( f j x 1... x nj = D f l y 1... y nl ). Let us call these axioms c i,j : C i,j. If we assume that different constructors have different normal forms, then these axioms can be proved consistent by the method of Theorem 4. But by Definition 4, the constructors will have distinct normal forms when no two of them have the same type (since the terms are determined by their signatures). This gives us Theorem 7 Let D be a CC-data type in which no two constructors have the same type. Let Γ be a strongly consistent environment. Let Γ be an environment consisting of Γ together with all the c i,j : C i,j. Then Γ is consistent. Because of the way in which constructors are defined from their types, it is safe to assume that there are no CC-data types in which two constructors have the same type, so the restriction of this theorem is not a major one. Now let us turn to the injective property of constructors. In the case of natural numbers and lists, this is established by the use of inverses to the constructors. What we need is an inverse for each constructor f j for each of its arguments. Let us call π i,j the predecessor for argument i of the constructor f j. The property we want for π i,j : D A i,j is π i,j M = { ti if M = f j t 1... t nj, N otherwise, where N : A i,j is any term of the right type. The definition will depend on the type A i,j : if it is some M k then our definition will be like that of car, whereas if it is D then the definition will be like that of cdr. For the case in which there is more than one i for which A i,j is D, we will need n-tuples. 14

Definition 8 Tuples will be defined so that D n A 1... A n X 1... X n : A 1... A n, where the association for is to the right, so that A 1 A 2... A n 1 A n is A 1 (A 2 (... (A n 1 A n )...)). The definition will be for n 2, and will be as follows: D 2 D and D n+1 λu : Prop. λu 1 : Prop..... λu n : Prop. λx : u. λx 1 : u 1..... λx n : u n. Dux(D n u 1... u n x 1... x n ). Projection functions will be defined in the form kth n for 1 k n as follows (where 1th will mean fst and 2th will mean snd): kth 2 kth, fst n+1 λu : Prop. λu 1 : Prop..... λu n : Prop. λx : u u 1... u n. and, for k 2, fstu(u 1... u n )x, kth n+1 λu : Prop. λu 1 : Prop..... λu n : Prop. λx : u u 1... u n. (k 1)th n u 1... u n (sndux). Definition 9 Let D be a CC-data type. The terms π i,j of type D A i,j will be defined as follows: (1) if A i,j is M k for some k, then where π i,j λy : A i,j. λx : D. DiterA i,j H 1... H m x, H l { λx1 : A 1,j..... λx nj : A nj j. x i if l = j, λx 1 : A 1,l..... λx nl : A nl l. y if l j. (2) if A i,j is D, then let i 1,..., i r be the indices i s for which A isj is D, and assume that i = i s. Then where π isj λx : D. (s + 1)th D }.{{.. D} (G j x), G j λx : D. Diter(D... D)H }{{} 1... H m x and λx 1 : A 1,j.... λx nj : A n j j. D D }.{{.. D} (f j X 1... X nj )X i1... X ir if l = j, H l λx 1 : A 1,l..... λx nl : A nl l. D D }.{{.. D} x }.{{.. x} otherwise, 15

and where (D... D) if h = i A }{{} s for s = 1,..., r, h,j A h,j otherwise, and fst D }.{{.. D} x h if h = i s for s = 1,..., r, X h x h otherwise. Theorem 8 Let D be a CC-data type, and suppose i 1,..., i r are the indices i s for which A isj = D. Suppose X : D. Then where Y = X and G j X = D D }.{{.. D} Y Y 1... Y r, Y l = { tis if X = f j t 1... t nj and l = i s, X otherwise. Proof By induction on X as a member of the CC-data type D. Case 1. X = f l t 1... t nl where l j. Then G j X = Diter(D... D)H }{{} 1... H m X = H j T 1... T nj = D D }.{{.. D} X }.{{.. X}, and the theorem is satisfied. Case 2. X = f j t 1... t nj. By the induction hypothesis, so fst(g i,j t i ) = t i. Hence, G j t i = D D }.{{.. D} t i Y 1... Y r, G j X = Diter(D... D)H }{{} 1... H m X = H j T 1... T nj = D D }.{{.. D} (f j T 1... T nj )T i1... T ir, 16

where T h = t h for h i s and T is = fst D }.{{.. D} (G j t is ) for s = 1,..., r. Hence, by the induction hypothesis, as desired. G j X = D D }.{{.. D} Xt i1... t ir, Corollary 8.1 For CC-data types D, if A i,j = D, then π i,j (f l t 1... t nl ) = { ti if l = j, f l t 1... t nl if l j. Theorem 9 Let D be a CC-data type and suppose that A i,j is some M k. Suppose N : M k. Then π i,j N(f l t 1... t nl ) = { ti if l = i, N if l i. Proof We have, by Definition 9 (1), π i,j N(f j t 1... t nj ) = DiterA i,j H 1... H m (f j t 1... t nj ) while if l j, we have = H j T 1... T nj = T i = t i, π i,j N(f l t 1... t nl ) = DiterA i,j H 1... H m (f l t 1... t nl ) = H l T 1... T nl = N. Corollary 9.1 For any CC-data type D, π i,j (f j t 1... t nj ) = t i. 17

The unicity conditions can now be proved for CC-data types as in Theorems 2 and 3. This means that the environment Σ (which the author calls a context) of [1, p. 49] can be made smaller: it will only need the axiom c : 0 = N σ0, which is a special case of Peano1 and is thus known to be consistent. Remark 3 It is worth pointing out that Berardi is not simply interested in whether or not his axioms are consistent in the terms we have considered here. He is interested in whether or not they are consistent with set theory. This is because he is using these axioms to verify the strong normal form theorem for Girard s F, and he wants to show that this proof is valid in set theory. Merely proving the axioms consistent in the sense of this paper would only lead to the result that SN for the calculus of constructions implies SN for F, which is a much less interesting result. References [1] Stefano Berardi. Encoding of data types in pure construction calculus: a semantic justification. In Gérard Huet and Gordon Plotkin, editors, Logical Environments, pages 30 60. Cambridge University Press, 1993. [2] Jonathan P. Seldin. On the proof theory of Coquand s calculus of constructions. Annals of Pure and Applied Logic, 83:23 101, 1997. 18