Selected Papers on Automath

SELECTED PAPERS ON AUTOMATH

STUDIES INLOGIC AND THE FOUNDATIONS OF MATHEMATICS VOLUME 133

Honorary Editor:

P. SUPPES

Editors: S . ABRAMSKY, London J. BARWISE, Stanford K.FINE, Los Angeles H.J. KEISLER,Madison A S . TROELSTRA,Amsterdam

ELSEVIER AMSTERDAM LAUSANNE NEW YORK OXFORD SHANNON TOKYO

SELECTEDPAPERS ON AUTOMATH

Edited by

R.P. NEDERPELT J.H. GEUVERS Eindhoven University of Technology The Netherlands R.C. DE VRIJER Vrije Universiteit Amsterdam The Netherlands with the assistance of

L.S.VAN BENTHEM JUTTING D.T. VAN DAALEN

1994

ELSEVIER AMSTERDAM-LAUSANNE. NEW YORK.OXFORD.SHANNON*TOKYO

ELSEVIER SCIENCE B.V. Sara Burgerhartstraat25 P.O. Box 211,1000 AE Amsterdam, The Netherlands

ISBN: 044489822 0 0 1994Elsevier Science B.V.All rights reserved.

No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without the prior written permission of the publisher, Elsevier Science B.V., Copyright & Permissions Department, P.O. Box 521, 1000AM Amsterdam,The Netherlands. Special regulations for readers in the U.S.A. - This publication has been registered with the Copyright Clearance Center Inc. (CCC), Salem, Massachusetts. Information can be obtained from the CCC about conditions under which photocopies of parts of this publication may be made in the U.S.A. All other copyright questions, including photocopying outside of the U.S.A., should be referred to the copyright owner, Elsevier Science B.V., unless otherwise specified.

No responsibility is assumed by the publisher for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions or ideas contained in the material herein. This book is printed on acid-free paper. Printed in The Netherlands

dedicated to N.G. de Bruijn

N.G. de Bmgn

vii

Preface Around 1967, N.G. (Dick) de Bruijn developed the first versions of Automath, a formal language suitable for the representation of mathematics. This topic, the formalization of a mathematical subject matter, fits in a respectable tradition. Whitehead and Russell, for instance, undertook a similar task in the first decade of the twentieth century. Their work culminated in the publication of Principia Mathematica, three sizeable volumes containing the formalization of a considerable amount of mathematics. However impressive the achievement of Whitehead and Russell was, they left large parts of the justification of their formalized mathematics to the reader. Precisely the novelty and the main virtue of de Bruijn’s efforts is that he incorporated automated verifiability as an essential ingredient of his design. The traditional systems all accomodate in one way or another common mathematical notions like axiom, theorem, proof and definition. What Automath adds to this, is the extra rigour that is required for a fully formalized representation of a mathematical argument. This involves issues that have remained somewhat out of focus in more traditional logical systems, such as the computational aspects of function application and the efficient handling of definitions. In order to achieve this, de Bruijn adopted a logical framework which deviates rather drastically from the logical mainstream at that time. A basic feature is that derivations are treated as objects in the formal system and that proof classes of propositions are treated as types. Automath has an inbuilt type mechanism that handles these aspects. Recently, type theory has become a fast developing branch of research. It has applications in mathematics and computer science, especially in the areas of proof checking and program verification. Many current proof systems pay tribute to de Bruijn and his early Automath investigations. The ideas developed in the Automath tradition and the results obtained in the project have been a starting point and a source of inspiration for many recent developments in the area. Therefore the time appears to be ripe for an anthology of papers about and around Automath. The present Volume contains a considered choice of the existing literature on Automath. Many of the papers included in this Volume have been published in journals or conference proceedings, but a number have only circulated as research reports or have remained unpublished. The aim of this book is to present a representative selection of existing articles and reports and of material contained in dissertations, giving a compact and more or less complete overview

viii of the work that has been done in the Automath research field, from the beginning to the present day. Six different areas have been distinguished, which correspond to the Parts A t o F of this Volume. These areas range from general ideas and motivation, to detailed syntactical investigations: A. Motivation and exposition B. Language definition and special subjects C. Theory D. Text examples E. Verification F. Related topics. For more detailed information about the organization of this Volume we refer the reader to the Contents and the subsequent section Hints for the reader. A survey of the contents and a detailed description of each of the selected papers can be found in Section 2 of the introductory paper by R.P. Nederpelt and J.H. Geuvers: Twenty-five years of Automath research.

ACKNOWLEDGEMENTS The editors are glad to have been assisted by the co-editors Bert van Benthem Jutting and Diederik van Daalen in a number of editorial matters, in particular as regards the selection and the arrangement of the contents. Thanks are due to Dick de Bruijn (who composed many figures), to Piet van Rooij (for his advise about the format of the references), to Sjaak Smetsers (for his help in composing figures), to Jan Joris Vereijken (for his help in encapsulating Postscript figures in IATfl) and to Jeff Zucker (for the careful reading of the introductory paper). The editors are very happy with the elegant and flexible layout provided by the UTEX Document Preparation System. They also wish to express their admiration for Anita Klooster of the Protex Text Editing Bureau, who retyped the majority of the papers in UTEX, in an extremely skilful and accurate fashion. We thank the Department of Mathematics and Computing Science of the Eindhoven University of Technology and its Section Computing Science, for their financial assistance which made this publication possible. Furthermore, the editors express their gratitude to the following persons, institutions and publishers for the permission to reprint one or more papers: Academic Press Inc. (Orlando), P. Braffort, Collhge International de Philosophie et ALAMO (Paris), Gesellschaft fur Mathematik und Datenverarbeitung MBH (Schloss Birlinghoven) , JAnos Bolyai Mathematical Society (Budapest),

ix Koninklijke Nederlandse Akademie van Wetenschappen (Amsterdam), Marcel Dekker Inc. (New York), G. Lebeau, Dept. de MathCmatique de 1’ UniversitC Paris Sud (Orsay), Presses du Centre National de la Recherche Scientifique (Paris), P. Dybjer, Programming Methodology Group (Goteborg), Springer-Verlag Inc. (Heidelberg) and Stichting Mathematisch Centrum (Amsterdam). The editors: Rob Nederpelt, Herman Geuvers, Roe1 de Vrijer.

This Page Intentionally Left Blank

xi

Contents Preface

vii

Contents

xi

Hints for the reader

xv

Notation

xvii

Introduction

1

R.P. Nederpelt and J.H. Geuvers: Twenty-five years of Automath research

3

PART A Motivation and exposition

55

A.l. N.G. de Bruijn: Verification of mathematical proofs by a computer A.2. N.G. de Bruijn: The mathematical language Automath, its usage, and some of its extensions A.3. D.T. van Daalen: A description of Automath and some aspects of its language theory A.4. J. Zucker: Formalization of classical mathematics in Automath A.5. N.G. de Bruijn: A survey of the project Automath A.6. D.T. van Daalen: The language theory of Automath. Chapter I, Sections 1-5 (Introduction) A.7. N.G. de Bruijn: Reflections on Automath A.8. R.P. Nederpelt: Type systems - basic ideas and applications

57

163 20 1 229

PART B Language deflnition and special subjects

249

B.l. B.2. B.3. B.4. B.5.

251 275 283 289

L.S. van Benthem Jutting: Description of AUT-68 N.G. de Bruijn: AUT-SL, a single line version of Automath N.G. de Bruijn: Some extensions of Automath: the AUT-4 family N.G. de Bruijn: AUT-QE without type inclusion L.S. van Benthem Jutting: Checking Landau’s ‘‘Grundlagen” in the Automath system. Appendix 9 (AUT-SYNT) B.6. D.T. van Daalen: The language theory of Automath. Chapter VIII, 1 and 2 (AUT-ll) B.7. N.G. de Bruijn: Generalizing Automath by means of a lambdatyped lambda calculus B.8. H. Balsters: Lambda calculus extended with segments. Chapter 1, Sections 1.1 and 1.2 (Introduction)

73 101 127 141

299 303 313 339

xii

Contents

PARTC Theory C.1. L.S. van Benthem Jutting: A normal form theorem in a A-calculus with types C.2. N.G. de Bruijn: Lambda calculus notation with nameless dummies, a tool for automatic formula manipulation, with application t o the Church-Rosser theorem C.3. R.P. Nederpelt: Strong normalization in a typed lambda calculus with lambda structured types C.4. R.C. de Vrijer: Big trees in a A-calculus with A-expressions as types (2.5. D.T. van Daalen: The language theory of Automath. Parts of Chapters 11, IV, V-VIII C.6. L.S. van Benthem Jutting: The language theory of A,, a typed A-calculus where terms are types

369 371

375 389 469 493 655

PART D Text examples

685

D.l. N.G. de Bruijn: Example of a text written in Automath D.2. L.S. van Benthem Jutting: Checking Landau’s “Grundlagen” in the Automath system. Parts of Chapters 0, 1 and 2 (Introduction, Preparation, Translation) D.3. L.S. van Benthem Jutting: Checking Landau’s “Grundlagen” in the Automath system. Chapter 4 (Conclusions) D.4. L.S. van Benthem Jutting and R.C. de Vrijer: A text fragment from Zucker’s “Real Analysis” D.5. L.S. van Benthem Jutting: Checking Landau’s “Grundlagen” in the Automath system. Appendices 3 and 4 (The PN-lines; Excerpt for “Satz 27”)

687

PART E Veriftcation

78 1

E.1. I. Zandleven: A verifying program for Automath E.2. L.S. van Benthem Jutting: Checking Landau’s “Grundlagen’’ in the Automath system. Parts of Chapter 3 (Verification) E.3. L.S. van Benthem Jutting: An implementation of substitution in a A-calculus with dependent types

783

PART F Related topics

839

F.l. N.G. de Bruijn: Set theory with type restrictions F.2. N.G. de Bruijn: Formalization of constructivity in Automath

841 849

70 1

72 1 733

763

805 809

...

Contents

Xlll

F.3. N.G. de Bruijn: The Mathematical Vernacular, a language for mathematics with typed sets F.4. R.M.A. Wieringa: Relational semantics in an integrated system F.5. N.G. de Bruijn: Computer program semantics in space and time

865 937 947

Bibliography

973

References

975

Indexes

995

Index of Names Index of Notations Index of Subjects

997 1003 1005

This Page Intentionally Left Blank

xv

Hints for the Reader The introductory contribution Twenty-five years of Automath research by R.P. Nederpelt and J.H. Geuvers has been written especially for this Volume. It contains a short historical sketch of the development of proof systems and a detailed survey of the contents of this book. The other papers in this Volume have first been distributed over the parts A to F on purely thematic grounds. Then, within the parts, the order is mainly determined by chronology. Therefore, the order in which the papers appear in this book is not to be taken as a hint for the order of reading.

For an exposition of the ideas underlying Automath, we suggest that the reader starts with either one of the following two papers: A.3. D.T. van Daalen: A description of Automath and some aspects of its language theory, A .5. N.G. de Bruijn: A survey of the project Automath. For a personal view of de Bruijn, looking back on his motivation for developing Automath and the related Mathematical Vernacular, see:

A.7. N.G. de Bruijn: RefEections on Automath. An introductory overview of the basic notions used in type systems like Automath, in relation to recent developments in logic, mathematics and computer science, can be found in:

A.8. R.P. Nederpelt: Type systems - basic ideas and applications. The reader with no experience of type systems and interested in obtaining a working knowledge of one of the Automath systems, is referred to:

B.l. L.S. van Benthem Jutting: Description of AUT-68. EDITORIAL NOTES Editor’s comments or new notes added by the authors are given in the running text between square brackets, in italics. For revisions which are more than simple rephrasings or obvious corrections, the same format is used. Omitted text is indicated as follows: [...I.

xvi

THE REFERENCES The contributions in this Volume (but for the new introductory paper Twentyfive years of Automath research) are identified with a letter-number combination. For example, B. 7 refers t o paper no. 7 in Part B of this Volume. All the references are listed at the end of the Volume. The reference list starts with the precise bibliographic data of the selected papers, ordered according t o the letter-number code. Thereafter, all references, including the selected papers, are listed alphabetically by author name and, for each author, by publication date. Within the papers, references to other papers which have been reproduced in whole or part in this Volume are indicated i n italics. For a paper that is fully reproduced in this Volume, we also give the letter-number code; e.g., [ d e Bruzjn 876 (B.7)].If only a part or parts of a paper or thesis are reproduced, we generally give the reference to the full work, without the letter-number code(s), again in italics; e.g., [van Daalen 801. If, however, the reference in question only concerns the text of that part which is reproduced in this Volume, then we do give the relevant letter-number combination. For reasons of readability, we deviate from the above conventions in the introductory paper Twenty-five years of Automath research: there we only use the short letter-number code when referring t o the papers or parts of papers reproduced in this Volume. All other references throughout this Volume are given in roman typeface. For example, we may cite [Barendregt 84a] or [de Bruijn 931.

xvii

Notation In the course of time, different notations have been used for several notions in Automath papers. We have tried to uniformize these notations in this Volume, but only if this created no technical problems. Below we give a list of the standard Automath notations as employed in this Volume. Unavoidably, however, there remain several locations where the notation deviates from the Automath standards.

Functional abstraction. Standard notation: [z : A ] B . This denotes the lambda abstraction of the variable x of type A over B. This notation for lambda abstraction was originally proposed by de Bruijn. In usual lambda calculus notation, one writes something like X,:A.B.

Exceptions: A . 8 : Ax : A . B . This paper has the usual lambda calculus notation. 0 B.8: X,.B. The paper deals with the type-free lambda calculus in the usual notation. 0 C.2: A, B. The lambda calculus is type-free, for the most part, and uses the ordinary X for abstraction. There is, however, a section on typed lambda calculus in which the notation T ( A ,X,B) is proposed for A,:A.B. 0 0.5: [ x , A ] B .In older Automath literature one finds a comma instead of a colon for the separation of abstraction variable and type. This is also the case in this paper, containing the literal rendering of an original Automath text. 0

Functional application. Standard notation: ( E )F. This denotes F applied to E. Note that it is a well-considered Automath decision to put the argument in front ofthe function: ( E ) F is the notation for the expression usually written as F ( E ) . Exceptions: 0 A.8: ( F E ) . This paper has the usual lambda calculus notation. 0 B.2: { E } F . In older Automath literature, one can find curly braces instead of angular brackets around the argument. This is also the case in this paper, in order to avoid confusion with the Backus-Naur normal form for abstract syntax, which uses angular brackets. 0 B.8: 6 E F . This paper uses a deviating notation for application. 0 C.2: A(F,E ) . This notation is in line with the one proposed in this paper for abstraction in typed lambda calculus. 0 E.3: F { E } . This paper employs the usual notation with the usual order of

xviii function and argument, but with curly braces instead of parentheses.

Substitution. Standard notation: A [ . := B ] . This meta-term denotes the result of the substitution of B for all free occurrences of the variable z in A. For simultaneous substitution of B1 for X I , . . . , B, for xn, one can find the notation A [ z l , .. . ,z, := B1,. . . , B,]. Many papers in this Volume use a notation for substitution that deviates from this standard. Sometimes, a meta-term like A [ z ]is employed to indicate that z may occur as a free variable in A . Then the result of substituting B for X can easily be described as A [ B ] . Exceptions: A . 2 : Q x ( B ) A .A special notation used in this paper. 0 A . 3 : A [ B ] or [z := B ] A . The notation A[B] is used as an informal notation for the result of the substitution of B for z in A[$].Formally, this substitution is denoted by [z := B ] A , hence with the substitution operator preceeding the term in which the substitution must take place. 0 A . 6 : A [ B ] .This is, again, the result of substituting B for z in A [ z ] . 0 8.3: A ( B ) . Here the notation A ( z ) is used to indicate that z may occur free in A . 0 B.6: A [ B ]or A [ z / B ] .The first notation is used if it is clear which variable z is intended. 0 B.8:C , ( B , A ) . A special notation used in this paper. 0 C.2: See Section 6 of this paper. 0 C.3: (z := B ) A . Note the deviating place and form of the substitution operator. 0 C . 4 : See Subsection 2.3.6 of this paper for the notation of simultaneous substitution. 0 C.5: A [ B ] or A [ z / B ] . (Cf. B.6.)See Subsection 11.10 of this paper for the notation of multiple substitution. 0 (7.6: See Definition 3.3 of this paper. 0 E . l : I[z/B]IA. 0 E.3: See Subsections 2.2.2 and 2.2.3 of this paper. 0 F.3: [ [ z / B ] ] ASee . Subsection 11.6. 0

Reduction and conversion. Standard notation: A + B , A ++ B, A = B , for a one-step reduction relation, a (multi-step) reduction relation and a conversion relation, respectively, holding between A and B. For special kinds of reduction, the relation symbols can be provided with a subscript. E.g., in lambda calculus, one-step ,&reduction of A to B is denoted by A +p B. Multiple subscripts point to a possible choice (in each step) of one of the relations mentioned in the subscript. For example, A - ~ p B, means ~ that

xix

there is a multiple reduction path “leading” from A to B , each step being either a @-stepor an 77-step. Exceptions : 0 A.3, A.6, B.6 and C . 5 : A 9 B is used for conversion. 0 B.6: A > B for (one-step) reduction. 0 C . 3 : A 2’ B , A 2 B for one-step and multi-step reduction respectively. 0 C.5: A > B, A 2 B for (generic) one-step and multi-step reduction respectively. (See the editorial note at the beginning of this paper). E . l : A > B, A 2 B for one-step and multi-step reduction respectively. Typing. Standard notation: A : B . This denotes that A has type B. Sometimes types can be defined by means of a typing function, e.g. typ(A) for the (canonical) type of A . Exceptions: A.3, A.6, B.5, (2.4, (7.5, 0.2, 0 . 3 , E . l , E.2 and F . l : A E B .

This Page Intentionally Left Blank

Introduction

This Page Intentionally Left Blank

3

Twenty-Five Years of Autornath Research R.P. Nederpelt and J.H. Geuvers

This introductory contribution consists of two parts. In Section 1, we give a concise historical overview of proof systems, leading to a short survey of the Automath project and a description of recent developments. The main subject, to be found in Section 2, is an explanatory survey of all papers selected for this Volume.

1. FORMAL PROOF SYSTEMS AND AUTOMATH 1.1. The origins

The study of valid inference, the basis of logic, seems t o have started with geometrical demonstrations (Thales, Pythagoras) and found an early culmination in Aristotle and his Orgunon (fourth century B.C.) (see [Kneale & Kneale 621). Aristotle’s investigations about inferences, and in particular the analysis and systematization of the syllogisms, were very influential throughout many centuries. Of equal influence were Aristotle’s ideas on the deductive organization of science. The “axiomatic method” was applied on a substantial scale in Euclid’s Elements. In Roman and Medieval times the findings of the Greek philosophers were taken as the basis of logic. There was hardly any progress until after the Renaissance, when Leibniz (1646-1716) made a large step forwards. He tried to develop a universal scientific language, which he called the Characteristicu Universalis. In particular, he desired to invent a calculus for logic, the calculus ratiocinator. His conviction was that, in this setting, a faulty argumentation would inevitably lead t o a mistake in calculation, and hence would become immediately detectable. His attempts to formalize and universalize the scientific language thus gave rise to the beginning of symbolic logic. At the end of the 19th century, it was Frege who invented the Begriffsschrift ([Frege 1879]), a formal language for logic, which he developed in his search for a foundation of arithmetic. In 1893 Frege published his Grundgesetze der Arithmetik ([Frege 18931) in which he ventured on a complete formalization

4

R.P. Nederpelt and J.H.Geuvers

of large parts of mathematics, based on logical principles. He stood up for a clear separation between axioms and theorems. Moreover, he advocated that the inferential machinery that one uses in mathematics should be introduced beforehand. A formal approach to the notion of ‘inference’ was, in his view, indispensable in order t o dissociate oneself from unclear, natural language based reasoning. However, Frege’s attempts turned out t o be too bold. In a letter to Frege, Russell pointed out that Frege’s system leads to a paradox. In the light of the history, Frege is hardly to blame, since such pioneering work is inevitably a hazardous shot in the dark. Whitehead and Russell, inspired by Frege’s work, wrote in their famous Principia Mathematica the following homage: “In all questions of logical analysis, our chief debt is to Frege” ([Whitehead & Russell 19101). 1.2. The influence of the paradoxes In order to prevent the paradoxes, Whitehead and Russell analysed the vicious circles present in all the known paradoxes. They came to the conviction that a hierarchy was necessary for a sound development of arithmetic and they proposed a type system: the simple type theory. It turned out that a refinement was necessary, which they called the ramified theory of types. This worked as they desired, albeit that they needed an extra axiom, in order to “soften” the strictness of the typing hierarchy. Only with this axiom of reducibility they were able to incorporate full arithmetic, in particular the real numbers, based on Dedekind cuts. This idea of using types emerged quite naturally, once the vicious circles had been detected. In fact, one may say that types existed since early mathematics was developed: categories like ‘natural number’ and ’real number’ in calculus, or ‘point’ and ‘line’ in geometry, grouped elements together in clusters with a common meaning or structure. In this sense, types were meant to emphasize the similarities between given entities. But at the same time, types can be of use in establishing differences between entities. The latter aspects turned out to be of great importance in combatting against the paradoxes. Hilbert and Ackermann ((Hilbert & Ackermann 1928)) were not fully content with the solution that Whitehead and Russell had given for the avoidance of paradoxes. In particular, Hilbert and his student Ackermann tried t o avoid the axiom of reducibility. A close examination of the paradoxes led them t o a division of the known paradoxes into two categories: the logical paradoxes and the semantical ones. For the logical paradoxes, the simple type theory appeared to be sufficient. The semantical paradoxes - like the famous liar’s paradox of Epimenides, or like Richard’s paradox - were rendered harmless by the distinction between object language and meta-language. The object lan-

Formal proof systems and Automath

5

guage accounts for the formal body of “mathematics” which is expressed inside this formalism. The meta-language is intended for expressing the intuitively simple “meta-mathematics” , which is used for discussions about the formalism, in particular for the study of properties such as consistency. (More recent ideas in this direction are due to Tarski.) The last mentioned distinction has since been generally accepted as a sound approach to foundational matters. For an analysis of “Hilbert’s program” see [Smorynski 771. Noteworthy is the purely formalistic conception of the nature of mathematics that was adopted by Hilbert. 1.3. Church’s contributions

One may regard Alonzo Church as the founder of type theory. His general investigations about functions gave rise to lambda calculus, the lambda being used as a symbol for abstraction of a function value over a variable. Church’s intentions ([Church 321) were to give a foundation for logic in terms of this general theory of functions. However, his attempts produced a n inconsistent logic, which caused many researchers of the time to turn away from lambda calculus. Church used lambda calculus also for investigations in computability ([Church 361). It turned out that the so-called lambda-definable functions coincide with Godel’s general recursive functions. This fact supported Church’s thesis that lambda-definability (and hence general recursiveness) is an adequate formalization for the intuitive notion of computability. In a new attempt to give a basis for logic by means of lambda calculus, Church introduced a system with types ([Church 401). This system is now known as the simple theory of types. These types were given as an independent set of entities. Both the lambda calculus framework and the types were proposed as objects for study in their own right. A recent adaptation is made by Barendregt et al. in Nijmegen, The Netherlands, (see e.g. [Barendregt & Hemerik 901 or [Barendregt 921) and is called X +Church. The discovery that a proposition can also be considered as a kind of type - t o be precize: the type of all of its proofs - can be viewed as an important byproduct of this approach. This notion, also called the notion of propositions-as-types (and proofs-as-objects) proved to be very fruitful in the following decades, in logic, mathematics and computer science. Later, Curry developed a type notion for lambda calculus that is different from Church’s. The difference is that Church gave a type-annotation for the binding variables in his term, which results in a unique type for each term. Curry used type-free terms and investigated all possible typings, giving a set of types for a term (possibly empty). For more details and for a contemporary discussion, see (Barendregt 921.

6

R.P. Nederpelt and J.H. Geuvers

1.4. The Automath project De Bruijn developed his ideas about a formal language for mathematics around 1967. He then was a full professor in the Mathematics Department of Eindhoven University of Technology, the Netherlands. (The university was called Technische Hogeschool Eindhoven, at that time.) It was his personal experience with reasoning in mathematics that brought him t o the conviction that a formal linguistic apparatus would be advantageous in many respects. (See de Bruijn’s own words about this matter in [ A . 7 ] , this Volume.) De Bruijn tailored the system to his own insights, which originated in a lasting and deep association with mathematical theories in different areas. Quite recently, his friend and colleague J.J. Seidel gave a description of the “highlights” in de Bruijn’s research work by selecting 14 of the most outstanding books and papers among his 175 or so official publications. As main areas of de Bruijn’s work, Seidel mentioned: number theory, combinatorics, asymptotics, functional analysis, optimal control, Fourier theory, type theory and the theory of quasicristals. It is remarkable, and typical for de Bruijn, that he did not revert to known theories for the development of his language for mathematics, not even as regards the underlying logic. As a matter of fact, he needed not much more than the lambda abstraction and application and the reduction mechanism of lambda calculus. For logic he only incorporated the absolute minimum, (re-)inventing the propositions-as-types notion as a unifying basis. De Bruijn baptized his system ‘Automath’, since it had to do with the “automation of mathematics”. However, connotations of this name in the direction of (automated) theorem proving were never intended. His aim was t o develop a formal language for the full range of mathematics, including logic, by the aid of which it would become possible to check mathematical theories which already have been developed. This purpose is considerably more modest than t o invent some artificial intelligence-like expedient. For the verification part, de Bruijn had the intention, from the beginning, to use a computer. This intended use of a computer influenced his design, in the sense that the formal language had t o be implementable on a machine. The then (and now) existing habits of rendering mathematical thoughts were much too informal and inaccurate for his aims. Soon after de Bruijn made public his ideas about Automath (cf. [ A . 1 ] in the present Volume), he appointed L.S. van Benthem Jutting at the Eindhoven University of Technology for research in this area. In 1969, R.P. Nederpelt started his work at the same university, as a Ph.D. student, under guidance of de Bruijn.

Formal proof systems and Automath

7

De Bruijn, van Benthem Jutting and Nederpelt continued t o work on the subject in the following decades, employed by the university. Apart from that, the Dutch Organization for Pure Scientific Research (ZWO) financed a project called Mathematical Language Automath, also located at Eindhoven University, from 1971 until 1976. From a historical point of view, it appears to be interesting to repeat the aims of this project, as formulated by de Bruijn (the original Dutch has been translated): 0

0

0

0

0

The design of a language in which all of mathematics can be expressed so accurately, that linguistic correctness automatically entails mathematical correctness. The development of programs which enable a computer to verify the books written in that language as regards linguistic acceptability, and hence also mat hemat ical correctness. The buildup in the mentioned language of a piece of mathematics, sufficiently voluminous and sufficiently usable to enable a large group of mathematicians to transfer their own mathematical texts into the language. The elaboration of the thoughts that such a language evokes, more or less automatically, as regards the build-up and the presentation of existing mathematics. The attainment of the situation that complicated and badly organized pieces of mathematics can be formulated in an absolutely reliable manner, by cooperation between mathematician and computer.

The following researchers were employed in the mentioned project, for longer or shorter periods: D.T. van Daalen, A. Kornaat, R. de Vrijer, I. Zandleven and J.I. Zucker. Moreover, programmers, typists and some 25 students participated in the work. The results of the project can be divided in the following areas: 0

Language-theoretical contributions.

0

Software.

0

Mathematics in Automath (14 different subjects).

In the present Volume one may find a number of publications that have been prepared or finished in the framework of this project. For example, Zucker’s [ A . 4 ] is a direct result of his work in the project. The same holds for de Bruijn’s [B.3],[B.4]and [F.1], van Daalen’s [A.3],Nederpelt’s Ph.D. thesis [C.3],de Vrijer’s [C.4]and Zandleven’s [ E l ] Much . of the work presented in van Daalen’s thesis ([vanDaalen S O ] ) and in van Benthem Jutting’s thesis ([vanBenthem Jutting 771) originates from this period.

8

R.P. Nederpelt and J.H. Geuvers

In retrospect, one may conclude that the project was successful. A definite drawback, however, has been that many of the results have only been published in unofficial notes and reports. The international community has not sufficiently been able to take note of all the results, ranging from language theory to computer implementations. One reason was that publication in international journals was not the main objective of the project, another that the subject was not really welcomed in the scientific community of the time, probably because of its isolation: for logicians, Automath was not logic; for mathematicians, it was not mathematics, either. And as regards computer science, the flowering of type theory (including Automath-like constructs) is only very recent. Anyway, there has been a continual lack of official publications concerning the Automath project, ever since its inception. Also after the end of the Automath project (1976), this situation has not really changed. However, the work on Automath continued, albeit with a smaller group (viz. de Bruijn, van Benthem Jutting, van Daalen, Nederpelt, de Vrijer, and (later) Wieringa and B a k e r s ) . The intention of the present Volume is that a coherent and representative selection from the Automath literature becomes widely available.

1.5. Related type systems At about the same time as the beginning of the Automath project, Howard invented his version of LLformulae-as-types”, intended as a formalization of the intuitionistic idea of “proofs-as-constructions” . The handwritten notes of the paper [Howard 801 were privately circulated in 1969. (For comparison, the report version [de Bruijn 68b] of [de Bmijn 7Oa (A.2)] appeared in November 1968.) The work of Howard is based on ideas that go back to [Curry and Feys 581. During the active period of the Automath project, other type systems were being developed, some of them also intended as systems for doing mathematics on a computer, others as a mechanism for typing in (functional) programming languages and again others as a system for foundational studies (like, e.g. the above-mentioned work of Howard). An early example of the latter kind is Martin-Lof’s system of Intuitionistic Type Theory, which was developed as a formal system for intuitionistic mathematics. In fact there are many different versions of the system, one of them impredicative, but most of them not. (Impredicativity means in typed lambda calculus that a type can be defined by quantification over the collection of all types.) The first formulation, just called ‘Theory of Types’ dates from 1971 ([Martin-Lof 71al) and is impredicative. It turned out t o be inconsistent by a result of Girard. This result has become known as Girard’s paradox and was first reported in [Girard 721, but see also [Coquand 861 for a general treatment

Formal proof systems and Automath

9

of the paradox in typed lambda calculi. Later versions are all predicative, like the one in [Martin-Lof 75a], which also has decidable type checking, due to the intensional treatment of equality. Martin-Lof also described a type theory with extensional (and hence undecidable) equality ([Martin-Lof 84]), in which type checking is not decidable. This is also the type theory used in the proof development system ‘Nuprl’. (See [Constable et al. 861.) The Martin-Lof type theories are also convenient as formalisms for program development, as the systems permit formal specifications for which programs can be constructed by means of the proof rules. This exploits the old idea that an intuitionistic proof of a formula of the form Vx € A . 3y € B [(p(z,y)] contains a procedure (algorithm) for constructing for every a E A an element b E B such that ~ ( ab), holds. For Martin-Lof’s intuitionistic type theory, this method is explained in [Nordstrom et al. 901, which also gives a good general overview of Martin-Lof’s systems. Another early example of the use of typed lambda calculus for foundational studies is the work of Girard in [Girard 711 and [Girard 721. There the polymorphic lambda calculus (system F ) is described and its higher order extensions. (The polymorphic lambda calculus was later rediscovered by Reynolds as a system for the typing of parametric functional programs, see [Reynolds 741.) The aim of Girard was not to give a calculus for doing formal mathematics, but to extend Godel’s Dialectica interpretation t o higher order arithmetic. This resulted in a lot of new results on the representability of recursive functions in typed lambda calculus and new techniques for proving normalization. (By now, Girard’s proof of normalization has become the standard method for these kind of proofs for higher order typed lambda calculi.) The systems of Girard are impredicative, which makes the normalization proof hard, proof-theoretically speaking. In contrast, all Automath-systems are predicative. Let’s point out here that, although the work of Girard has been very influential for later developments in the connections between typed lambda calculus and proof systems (e.g. the Calculus of Constructions), the polymorphic lambda calculus does not include logic but is purely a system for describing functions and data types. An early system that, like Automath, mixes computation and logic is Scott’s ‘Logic for Computable Functions’, a formal system for reasoning about the behaviour of recursively defined functions. The LCF system goes back to 1969 and marks the beginning of domain theory. (See [Scott 731.) The first implementation of the system was done by Milner around 1972, now known as Stanford LCF. Later versions of the system include Edinburgh LCF and Cambridge LCF, which further develop the basic ideas. The development of ML as an interactive metalanguage has been an important offshoot of Edinburgh LCF. (See [Gordon et al. 791.) The metalanguage ML allows the user to program tactics for proofsearch in LCF, and it also gives relatively great security against faulty proofs. Besides first order predicate logic, all the basic domain-theoretic constructions

10

R.P. Nederpelt and J.H. Geuvers

can be included in LCF as theories. The original formal system is now sometimes referred to as ‘PPX’ (Polymorphic Predicate X calculus), to distinguish it from its implementations. See [Paulson 871.

1.6. Recent Developments Recently there has been a boom in the research on typed lambda calculi and proof development systems, maybe best illustrated by the joint European (ESPRIT) research projects ‘Logical Frameworks’ and its successor ‘Types for Proofs and Programs’. (The latter has as a major aim the study of proof development systems based on typed lambda calculus.) A lot of research in the field is inspired by early work in the Automath project. We therefore want to mention here some lines of ongoing research. Our summary is not meant to be exhaustive but intends just to illustrate the broad actual interest in the topic, from both computer science and mathematics. One of the newer systems that is very close to Automath is LF, developed in Edinburgh and quite close to AUT-QE. (See [Harper et al. 871.) The system has been implemented and the implementation provides interactive proof development facilities. Furthermore the research in LF (an abbreviation for ‘Logical Framework’) has produced a large amount of examples of representations of formal systems in LF, showing the flexibility of the system. At the same time the problem of adequacy of representation has been taken very seriously from the start. (Given the representation of a formal system in LF, it is usually quite straightforward to show that if a statement p is provable in the formal system, then the type that interprets p in LF, say p , is inhabited in LF. The adequacy of the interpretation, stating that if p is inhabited in LF, then p is provable in the original formal system, is much more complicated.) A system that in fact unifies some of the Automath work with the work of Girard, is Coquand and Huet’s Calculus of Constructions (CC). It is a higher order dependent typed lambda calculus that includes constructive higher order predicate logic (by the formulas-as-types embedding) and at the same time includes many data types, due to the fact that they can be coded in Girard’s polymorphic lambda calculus. The system was first described in [Coquand 851 and not much later implemented by Huet in CAML. (See [Coquand & Huet 881 and [Coquand 901.) A lot of formal proofs have been done in the system, which are reported for example in [Coquand & Huet 851. Due to the representability of data types and the formulas-as-types embedding, it is also possible to write specifications (they are in fact formulas) in the system, which in turn allows the extraction of programs from proofs. The idea behind this programs-from-proofs method is the same as for Martin-Lof’s systems, but, due to the higher order logic and the definability of data types in CC, the actual mechanism is different.

Formal proof systems and Automath

11

The method is extensively described and implemented by Paulin-Mohring. (See [Mohring 861 and [Paulin-Mohring 891.) Very recently the Calculus of Constructions has been extended with so called Inductive Definitions, which amounts to the extension of the system with a scheme for inductively defining mathematical objects like sets and predicates, and also for constructing proofs and recursive functions by induction. This new system has been implemented as ‘Coq’ by researchers at INRIA. (See [Dowek et al. 911 for details.) Another implementation of the Calculus of Constructions has been done in Edinburgh by Pollack. The system is called ‘LEGO’ and it in fact allows the user to make a choice for a typed lambda calculus he or she wants to work with. Among the possible choices are of course CC, the already mentioned system LF and also an extended version of CC, called ECC. This system ECC is due to Luo ([Luo 89]), who has also provided the language theory for it. An interesting feature of the system is the possibility of representing a mathematical theory as a type, allowing theory abstraction and the description of morphisms between theories. In the system this is done by using so called C-types (a C-type is of the form Cz : A . B ( z ) with as canonical inhabitants the pairs (a,6) with a of type A and 6 of type B ( a ) ) ,allowing for the same kind of flexibility as can be obtained via de Bruijn’s notion of ‘telescope’ t o denote theories. (The subject ‘telescopic mappings’, by itself, would have been interesting enough for inclusion in the present Volume. However, de Bruijn’s paper [de Bruijn 91a] is very recent and can easily be tracked. Therefore, it has not been reproduced in this Volume. Telescopes are also discussed in Subsection 4.1.3 of [0.3]and in [A.4].) The pure study of the language theory of typed lambda calculi that originated from the Automath project, has also been continued, notably in Nijmegen by the research group of Barendregt. This resulted in the general treatment of different typed lambda calculi in one framework, first the ‘cube of typed lambda calculi’, which later resulted in the notion of ‘Pure Type System’ (PTS). (See [Geuvers & Nederhof 911, (Barendregt 921 and [Geuvers 931.) The framework allows proofs of many of the standard results like closure (under reduction) and uniqueness of typing, in a generic way. An implementation of arbitrary PTSs has been done by Helmink at Philips Research Laboratories under the name ‘Constructor’. Users of the system are allowed to select their own P T S to work in. We have already mentioned the system Nuprl ([Constable et al. 86]), developed at Cornell and based on the formulas-as-types approach and ideas on intuitionistic type theory from Martin-Lof. The actual system has also benefited a great deal from the work on LCF: Nuprl is implemented in ML and exploits ideas from LCF on goal directed interactive proof development. The Nuprl system actively supports the programs-from-proofs mechanism.

12

R.P. Nederpelt and J.H. Geuvers

The type theory of Martin-Lof has also been applied to theorem proving in Sweden itself, notably in Goteborg. This has led to a system called ALF (Another Logical Framework), constructed by Augustsson, Coquand and Nordstrom (see [Magnusson & Nordstrom 941). A proof system which is based on typed lambda calculus but does not treat proofs as formal objects is HOL (Higher Order Logic.) The system was developed in Cambridge by Gordon (see [Gordon & Melham 931) and is in fact based on Church’s simple theory of types ([Church 401) and LCF. The system is not a framework but supports a version of classical higher order predicate logic. Just as in Church’s original work, the typed lambda calculus is used to describe the higher order language while the derivation rules are functions in the metalanguage ML. The implementation is based on ideas from LCF about interactive theorem proving and is done in Lisp and in ML. Another interesting difference between HOL and systems such as Automath or CC is the extensional treatment of equality. HOL does not distinguish between definitional equality (conversion) and, what is in Automath terminology called ‘book equality’ (locally defined), but interprets the definitional equality as a proposition. A lot of experience with HOL has been gained, especially in the field of hardware verification. Of course there are also systems for proof development that do not use type theory at all. An example is the ‘high level formalized language for mathematics MIZAR’. (See [Trybulec 901.) Another example of such a system is the BoyerMoore Theorem Prover. (See [Boyer & Moore 881.) The system is a heuristic theorem prover in the sense that the theorem prover gives the user a lot of support for finding an actual proof. This of course has its price: the logical basis of the system is a quantifier-free variant of Peano arithmetic. It is remarkable that a lot of interesting results can still be proved in the system although this usually requires a serious reformulation of the theorems to make them manageable for the machine. The theorem prover has been applied to many examples, both from computer science (e.g. hardware verification) and mathematics or logic (like Godel’s incompleteness theorem).

2. SURVEY OF THE CONTENTS The papers which have been selected for the present book, are divided in six groups, in accordance with the global character of the topics treated. Each of these groups corresponds to a Part of this book, with the following headings:

Survey of the contents

Part Part Part Part Part Part

A B C D E F

13

Motivation and exposition Language definition and special subjects Theory Text examples Verification Related topics

Inside each of these parts, the papers are ordered chronologically, except when a strong relation in the themes of two papers appears to be more important than the ordering in time. In the present section we describe the contents of the papers which have been selected for this book. This description is meant to give a general idea of the subjects which are dealt with in the respective papers. Moreover, we take the opportunity to sketch the connections between the papers and the developments in the course of time. Often we go further than providing pure abstracts of the papers, because many of the selected papers lack such a r6sumC. Our purpose is then to give some insight into the contents of the different papers, with a view t o the aims and ideas of the Automath project. In particular, this applies to our comments about the (general) Part A, which are rather copious. For Parts B to F, however, which have more specialized subjects, we give more concise rCsumC’s. References to the papers included in this Volume will be indicated with the letter-number combination as given in the list of contents, printed in italics, e.g. [C.2].

Part A: Motivation and exposition

A.l. N.G.de Bruijn: Verification of mathematical proofs by a computer This is the first paper ever that has appeared about Automath. It was written as a companion paper t o a colloquium lecture which de Bruijn delivered at Eindhoven University of Technology, the 9th of January 1967. The paper has primarily been selected for historical reasons. De Bruijn presents it as a “preparatory study” for a project Automath and the paper as such is rather experimental. It is surprising, however, how clear the exposition is and how many of the main themes of the following Automath project are already incorporated. De Bruijn explains his ideas on the basis of a mathematical example concerning equivalence classes in a set. He uses this example to conceive a general plan of formalization. At the same time, the example serves as a good exercise for the discovery and the analysis of the mathematical and logical structures which are

R.P. Nederpelt and J.H. Geuvers

14

present in an average mathematical text, structural aspects which are grasped and understood implicitly by every mathematically educated reader, but which are hardly ever studied in isolation, or elaborated into the finest details. The chosen example is very appropriate, since the distance between the original text and the formalization is great: a considerable amount of work has to be got through in order to obtain the result desired. The formalization of the example consists of three stages: (1) the mathematical text in the usual phrasing, as it could be found in a mathematics book, (2) an elaboration and structuration, using the logical and mathematical formularium wherever appropriate, (3) a full formalization in six columns, with a line-wise development. Each line consists of:

(a) a “call”, or heading, establishing the textual function of the line: whether it concerns a definition of an expression, a context extension or contraction, a derivation step, etc., all with the necessary parameters, (b) the definition of the expression (if appropriate), (c) a “stack”, containing the context administration of variable introductions and assumptions, (d) a “proof”, being an abbreviated form of the asserted expression in the current context, (e) an elaborated version of the proof, (f) a reference number for the proof expression. The paper shows how de Bruijn goes about with the underlying deductive structure. It is intriguing to see how he “reinvents” the rules for natural deduction, still a bit chaotic, but uncompromising. As a major result, variables become first-class citizens, which is hardly the case in the usual conception of natural deduction (or mathematics). The difference between free and bound variables plays an important role. Moreover, de Bruijn employs a useful contextor block-mechanism for variables and assumptions. Finally, we may notice a formal treatment of substitution. The formalization as a whole seems a bit complicated and ad hoc. However, many of its features recur in the subsequent definitions of Automath languages, e.g. the treatment of variables, the substitution mechanism, the block structure and the formal shape of definitions. There are also meta-results: it becomes clear that the given formalization has possibilities for a mechanic verification; the formalization of a proof leads naturally to conclusions about the proof (e.g.

Survey of the contents

15

that a certain assumption is superfluous). Still absent is the propositions-astypes idea, that became so very fertile immediately after this preliminary phase.

N.G. de Bruijn: The mathematical language Automath, its usage, and some of its extensions This paper builds on an internal report of the Technische Hogeschool Eindhoven (the name of the Technological University of Eindhoven at that time), called Automath, a language for mathematics ([de Bruijn 68bl). That report was intended for the Symposium on Automatic Demonstration in Versailles, France (December 1968), which was attended by de Bruijn, and it has been published in the Springer Lecture Notes series. It is the first international publication about Automath. Some of the statements in this paper give an impression of the implicit “Automath programme” that de Bruijn had in mind. We think that it is worth while to quote a number of these phrases: A.2.

Automath is a language which we claim to be suitable for expressing very large parts of mathematics, in such a way that the correctness of the mathematical contents is guaranteed as long as the rules of the grammar are obeyed. The author feels that [...] Automath [...] is very close to the way mathematicians have always been writing, and that the abbreviation system used in Automath has been taken from existing mathematical habits. [Automath] is little more than [.. I the art of substitution.

De Bruijn explains how he uses the essential characteristics of a deductive system, by means of a context structure consisting of a set of nested blocks, in the vein of a “linearized” system of natural deduction. First, a basic abbreviation system is introduced, called PAL (which is an abbreviation for Primitive Automatic Language). A formal text in PAL (a PAL-book) consists of a set of consecutive lines, built from four parts: (1) an indicator referring to the top of a context stack,

(2) an identifier serving as a name (an abbreviation) for the string to be defined in that context, (3) the string which is abbreviated in the given context,

(4) a “category” (or type) for that string Note that PAL already has types, meant to restrict the set of terms in a natural way. (A simpler, pure abbreviation system without types, is called Semipal

16

R.P. Nederpelt and J.H. Geuvers

in the paper.) The terms used as strings are variables, constants or compound strings of the form f(a1,. . . ,an). De Bruijn takes some time to explain the rules for type respecting substitution which must be obeyed in a correct PAL-book. So-called PN-lines (the P N is for Primitive Notion) can be used for basic constants which cannot be defined in terms of previous ones. They may serve for the formalization of primitive notions (like N or the number 0) and axioms. There is a very important aspect in all this, that de Bruijn is very well aware of. Already in the beginning of the report he announces: “The way we handle propositions and assertions will be novel”. To be precise, he introduces and employs a formal version of what is known today as the propositions-as-types notion. As he says:

[...I we represent statements by categories. Saying we have a thing in such a category means asserting the statement. He elucidates this conception with an example concerning (defined) equality. (Note that equalities like “a = b” for set-elements do not fit in the basic linguistic equipment of the Automath languages; this so-called book equality, =, must be introduced as a primitive notion, together with the suitable axioms.) In this example he shows the following: if there is given an expression of type is(7,a, b) (that expression is to be interpreted as a witness for the equality of the elements a and b in the set v), then one can construct an expression of type is(q,b,a) (witnessing that b and a are equal), as well. De Bruijn adds the following remarks:

[...] the category [i.e. type] “is(<, x,y)” consists of all proofs for x = y. [...] “assume z = y” is replaced by “let p be a proof for z = y”. [.. I we have t o imagine the category “Zs(<,z, y)” to be empty if the statement x = y is false. De Bruijn dwells on this subject by giving a way t o insert logic in his system. For this purpose he introduces the category “bool”, consisting of all propositions, and the category “TRUE” which, in the context of an expression of type bool, is the set of assertions of this expression. He gives a n example showing how t o derive T R U E ( a n d ( v , v ) ) from T R U E ( a n d ( u , v ) ) . We note the following. In the setting described here, there is only one “ultimate category”, viz. type. “Inhabitants” of type (i.e. terms of type type) are so-called types. Types can represent sets, for example. There is one type designated for representing propositions, viz. bool. Hence, inhabitants of bool are propositions. So let p be an inhabitant of bool. Then the type of p is bool, and the type of bool is type. Putting the “degree” of type to be 1, we have that the degree of inhabitants of type (like bool) is 2 and the degree of inhabitants of inhabitants of type (like

Survey of the contents

17

the p above) is 3. Now Automath does not allow degrees higher than 3. Hence, the (intended) “proposition” p itself cannot be inhabited. So, the pure notion of propositions-as-types, to the effect that a proof of p should be represented by an inhabitant of p , cannot be applied here. Therefore the intermediate TRUE is required, “lifting” the proposition p to the term TRUE(p),being of degree 2 and hence inhabitable. (For a recent discussion of the use of TRUE and boo1 in Pure Type Systems, see [Barendregt & Hemerik 90, Pragmatics of AP]). He concludes the section about PAL with a number of remarks, a few of which are (again) worth being quoted:

[...] we do not need to subdivide our text into parts like “theorem”, “proof”, “definition”, “axiom”. We never announce a theorem before the proof starts, the result cannot be stated before it has been derived. The system PAL can deal with functions, but only in relation to arguments. That is to say, one can introduce a function f by giving its value f ( x ) for a variable x of some type and apply this function to an argument a of a corresponding type: f ( a ) . However, f on its own, as a function mapping x to f (x), cannot be expressed. For that reason de Bruijn extended PAL with lambda abstraction. He denotes Ax : A . t , where A is the type of z and t a term of degree 3, possibly containing x as a free variable, by [x : A]t. The corresponding product type : A . B, where B, a term of degree 2, is the type o f t , is denoted by [x: A]B. Note that abstraction over type, having degree 1, is not allowed. Roughly speaking, one may interpret Ax : A . t as the function mapping x to t (a term possibly depending on x), and IIz : A . B as the function type BA. However, the product type IIx : A . B is in principle a generalized product, in the sense that B , too, may depend on x. This is not the case with intended function types like BA,but this possible dependency turns out to be very useful in other settings, to be discussed later. Note that both A and n are represented by the same pair of square brackets [. . .] in Automath. This choice has rather farreaching consequences. Moreover, it was one of the reasons why de Bruijn’s system did not meet immediately with a kind reception in the lambda calculus community. The notational difference between the function f and the function value (with indeterminate argument) f (z) was not considered as very important by mathematicians. The function f was often written as f (x) in order to remind one of the dependency on one variable: think of the notation sin(z) for the sine function. However, his teaching in real and complex analysis had convinced de Bruijn that this distinction is essential. He began to use the lambda notation for ordinary mathematics, in the footprints of his colleague Freudenthal of Utrecht

nx

18

R.P. Nederpelt and J.H. Geuvers

University. It is interesting to see that his first attempts to develop a formal language for mathematics, as this paper shows, provide convincing justification for this separation o f f and f(z). In the paper, de Bruijn describes the consequences of the addition of lambda abstraction to PAL, in order to attain Automath. Of course, he adds function application and beta-reduction, but also eta-reduction. He writes (t)f for f(t), reversing the order of function and argument - a second obstacle to the Automath literature for lambda calculus circles. In this paper, de Bruijn gives a short motivation for his choice of a reversed order. In later work, it turned out that this minor revision has great advantages. The rest of the paper gives an overview of the use of Automath. It is interesting to see that de Bruijn already declares normal forms t o be only of theoretical interest. This practical insight is characteristic of his attitude. In the following sections of his paper, de Bruijn discusses various subjects, e.g. the treatment of implication, universal and existential quantification and predicates. Finally, he discusses two unsolved problems and he makes a number of remarks about processors for Automath and about superimposed languages, touching upon the question of artificial intelligence and automatic theorem proving (which he rejects as an aim for Automath). He also anticipates (in Subsection 12.7) a possible extension allowing more liberal abstractions, in particular over types. In this speculations he sets the ground for the extension AUT-QE, which would become the most important member of the Automath family.

A.3. D.T. van Daalen: A description of Automath and some aspects of its language theory This paper, dated to 1973, is a self-contained and clearly written exposition of the most important Automath systems AUT-68 (as the main system from [ A . 2 ] is now called) and AUT-QE. Both systems are, at the time of conception of this paper, well elaborated. AUT-68 contains most of the characteristic Automath aspects and is relatively simple, AUT-QE is a bit more complicated, but also more usable, since it can deal rather smoothly with predicates. In this paper, the description of AUT-68 is informal, with a discussion of its possibilities for formalizing mathematics. The usefulness of the propositionsas-types notion is explained concisely. Moreover, the paper contains a formal definition of AUT-QE, with a motivation of its special features. The points of machine verification and feasible decidability are emphasized in the introductory remarks: Since many common mathematical theories produce undecidable sets of theorems we must conclude that we cannot expect the computer to do all our work. Indeed theorems have to be given together with their proofs in order to allow verification. Thus the correctness

Survey of the contents

19

produced by the machine verification covers the arguments leading from axioms to conclusions only. Van Daalen uses the symbol E for expressing, in the meta-language, the relation ‘... has type ...’. In Subsection 2.9, van Daalen explains the difference between a type valued function and a function type. In AUT-68 this difference is not immediately visible, because of the identification of both concepts. This is due to the absence of the Il-constructor for function types (as we said before in our rCsumC of [ A . 2 ] ,the lambda abstraction, denoted by square brackets [. : .I, is “overloaded” in Automath, since it is also used for ll-abstraction). Van Daalen explains the application restriction intended to guarantee the well-typedness of an argument of a function (over a certain type). As regards the functional interpretation of logic - in relation with the propositions-as-types notion - it may be noted that the TRUES and book of [A.2] have disappeared. Instead, a distinction is introduced between two “ultimate types”, viz. a type called prop and a type called type. The terms of type prop should be considered as being propositions, those of type t y p e as sets. The difficulties with uninhabitable propositions, as we sketched in our previous rCsum6, now have disappeared, since the propositions have moved up one degree. Note that there still is a difference between propositions and sets, which is necessary, since it is desirable to treat these notions in a different manner. An important difference with the TRUEbooCapproach is, that the present treatment of propositions necessitates higher order terms for the introduction of predicates: the class of all predicates over ( is now expressed as . prop (of degree 1) instead of A,,c. 6001 (of degree 2). See also [ A . 4 , Section 51 and [ A . 6 , Subsection 5.21. Moreover, van Daalen discusses in Subsection 3.6 the difference between definitional equality (i.e. convertibility) and book equality, viz. the equality defined in the Automath object language. The latter form of equality was also a subject in [A.2]. Next, in Section 4, he motivates AUT-QE by explaining that arbitrary families of types indexed by I E a cannot be introduced in AUT-68. For example, the introduction of an arbitrary binary predicate over a given set is not possible. In AUT-QE, however, this shortcoming of AUT-68 is repaired. AUT-68 has no abstraction over types, as already said in (A.21, but also no other terms of degree 1 than type itself. In AUT-QE, abstraction over predicates is not permitted, neither do we have abstraction over types or propositions. But there are many terms of degree 1: apart from type and prop, abstractions like [I : &]type or [ x : a]prop are allowed, for terms a of degree 2. A new feature is necessary in AUT-QE, viz. type inclusion, as a consequence of the identification of type valued functions and function types. This causes a complication of the syntax, which is slightly peculiar. The uniqueness of types

20

R.P. Nederpelt and J.H. Geuvers

(up to conversion) is disturbed and the intuitive clarity of the system is a bit disturbed. Nevertheless, it is necessary in the Automath frame and it does not hamper the practical possibilities. The paper contains in Subsection 4.5 a table listing Automath notions and their interpretations, for the object-and-type interpretation as well as the proofand-proposition interpretation. Section 5 contains a formal definition of AUT-QE, with implicit a-conversion: ‘‘name clashes” are avoided by assuming that variable renaming has taken place before undesired bindings can occur. Or, otherwise said: “expressions with bound variables are considered as named versions [...] of some name-free skeleThe definition of ton”. (This idea is already present in de Bruijn’s [C.Z].) AUT-QE is fairly complicated, but its contents should be clear after the careful introduction. Finally, van Daalen mentions some of the problems connected with (theoretical and feasible) decidability. The keywords for this subject are: the ChurchRosser property (nowadays also called confluence), normalization and closure (i.e.: every reduct of a term in the language does, again, belong to the language). He sketches a decision procedure for Automath texts.

A.4. J. Zucker: Formalization of classical mathematics in Automath This paper accounts for an experiment carried out by Zucker, intended to formalize a part of classical real analysis in an Automath-like language. A fragment from Zucker’s text is presented and discussed in [ D . 4 ] . Zucker introduces AUTII, which re-establishes the difference between X and II (hence, there is no type inclusion, as defined in [ A . 3 ] ) .He gives a general description of AUT-II, concentrating on the aspects that differ from AUT-QE. The system has t-expressions of type r and pexpressions of type T, comparable t o the terms of type type and those of type prop, as introduced in [ A . 3 ] . Zucker carefully describes the different possible interpretations of his terms, in Section 2.2: ‘Formation of t-expressions’, and Section 2.3: ‘Formation of p e x pressions’. In particular, he has type valued functions, Cartesian products and types of pairs among his t-expressions, and generalized implication and conjunction, together with universal and existential quantification as interpretations for his pexpressions. The notion of irrelevance of proofs, essential for a proper treatment of (classical) logic, is discussed in detail: an object like the logarithm log depends in fact on two arguments, viz. a number 2 and a proof that this z is positive. However, strictly “different” proofs of the positiveness of z must not lead to different values of log(z). Zucker relates this irrelevance of proofs with the notion of strong existence (nowadays called ‘strong C-types’) and concludes that the two notions are inconsistent. Therefore, he adopts weak existence only.

Survey of the contents

21

Next, Zucker discusses predicates, quantifiers, equality and sets. Note that one cannot express equality between predicates on a given type or quantify over all such predicates, since there is no type of all such predicates (or, equivalently, the “category” of all such predicates has degree 1). Nor does working with the associated subtypes help, since, similarly, there is no type of all such subtypes. In order to overcome this difficulty, Zucker defines the type Powertype(a) of all sets of objects of type a, together with axioms by means of which one can go back and forth between predicates on a and their extension in Powertype(cr). Since Powertype(a) is a type (i.e. of degree 2, not I), we can express equality between sets of a given type, and also quantify over all such sets. He also gives a sketch of the development of classical real analysis in AUT-11, starting from Nu for natural numbers and R1 for reals. There is a primitive constant for recursion over a type a. He mentions that his language has been used to give a formal version of real analysis including derivatives, power series, exponential and logarithmic functions. An example text in AUT-II about differentiation, as written by Zucker, can be found in [D.4],with comments by van Benthem Jutting and de Vrijer. As further mathematical topics, formalized in the same setting by A. Kornaat, he mentions: set theory (including the equivalence of variants of Zorn’s lemma), combinatorics (including a proof of the Hall-Konig theorem) and metric spaces, up to the Heine-Bore1 and Bolzano-Weierstrass theorems. As regards the abstract structures that Zucker encountered during his translation work, he confirms what de Bruijn had predicted earlier, viz. that for linear orders and other algebraic structures the notion of telescope is indispensable. See also ID.5’1 and [de Bruijn 91a]. Important concluding remarks about his work can be found in Section 3:

[.. I as it turns out, this approach permits quite a natural development of classical real analysis; and (I think) this is because it reflects, to some extent, how mathematicians actually reason. In fact, one of the most interesting aspects of the project (to the author) is that it demonstrates the feasibility of founding a large part of everyday mathematics on the typed A-calculus, rather than on axiomatic set theory. A.5. N.G. de Bruijn: A survey of the project Automath This paper has been published in ([Seldin & Hindley SO]), the so-called Curry volume. The paper contains a number of general observations that shed a new light on important aspects of the Automath project. The date of publication is 1980. The work in the Automath project (see Section of the present paper) was finished by that time. Hence, it was a good

R.P. Nederpeit and J.H. Geuvers

22

moment to evaluate approximately 12 years of scientific work about the subject Automath. Apart from that, de Bruijn took the opportunity to “clarify a few points which many outsiders consider as uncommon or weird”. In particular, he points at his concept of types in relation with the propositions-as-types notion. And, finally, de Bruijn used the survey “to ventilate opinions and views i n mathematics which are not easily set down in more technical reports”. De Bruijn summarizes the purposes of the project Automath as follows: 0 [...] to develop a system of writing entire mathematical theories in such a precise fashion that verification of the correctness can be carried out by formal operations on the text. 0 [.. I it has to be possible to instruct computers how to check the correctness.

He adds: “Even if we do not use computers, they are to set the standard of what is ‘fformal” verification. ’’ De Bruijn formulates three motivations for the project:

Checking. [In particular:] things which are very hard and condensed, and where there is little intuitive or experimental support [such as] long and tedious proofs. [As areas of application for these cases he mentions combinatorics and computer science.] Understanding. If we want t o understand mathematics, we also have to get insight into the roles of axioms, definitions, proofs, theorems. [We think that] a good language may help us to understand the structure or the complexity of an argument. Processing. [One of the advantages of] the fact that a machine can read, check and store the mathematics that we produce [is] that two mathematicians use the same theorem with exactly the same conditions.

[..I

Next, he discusses the development of the different languages: Semipal, PAL, AUT-68, AUT-QE, AUT-ll and AUT-SL. (See also [A.2], [A.3], [A.6], [B.1] and [C.5]. For AUT-II: see [A.4] and [C.5],for AUT-SL: see [B.2], [C.3] and [B.7].) De Bruijn rather extensively explains the treatment of the propositions-astypes notion in Automath (Section 14). He shows the strong ‘)parallelism between proofs and “ordinary” mathematical objects” and notes that “proofs may depend on objects and objects may depend on proofs”. He also considers it attractive to make a separation between prop and type (we mentioned this distinction in our r6sumC’s of [A.,?] and IA.41). Other topics that already have been treated in the present introduction are e.g. the difference between definitional equality (convertibility) and book equality (Section 18; cf. [A.2] and [A.3]) and proof irrelevance (Section 24; cf. [A.4]).

Survey of the contents

23

An interesting discussion concerns the subjects verification (Section 20) and automatic theorem proving (Section 21). As to the latter subject, de Bruijn rejects (the artificial intelligence aspects of) automated theorem proving. However, he can conceive of (‘“attachments” to the verifier which find proofs of little gaps the writer might like to leave”. In Section 22, dealing with language extensions, he briefly mentions AUTSYNT (see also [D.3, 4.1.01 and [ B . 5 ] ) ,an interesting syntactic extension that has never been fully elaborated. De Bruijn concludes with a description of the mathematics produced in Autoniath (Section 25) and of work in progress (Section 26). A remarkable observation is the “constancy of the loss factor”, i.e. the nearly constant ratio between the “length” of an Automath text compared with the original “mathematical” text. De Bruijn establishes that this factor is “something like 10 or 20”, but “it does not increase if we go further in the book”. Evidence for this statement can be found in Subsection 4.3.2 of van Benthem Jutting’s thesis, see [D.3]. As regards work in progress, de Bruijn mentions: (i) programming language semantics (see also [F.4] and [ F . 5 ] ) ,(ii) abbreviation of segments (see [B.S]) and (iii) the Mathematical Vernacular, a formal version of “the strange mixture of words and formulas mathematicians use” for every-day writing and reading in mathematics (see also [F.3] and [Nederpelt 871). A.6. D.T. van Daalen: The language theory of Automath. Chapter I, Sections 1-5 (Introduction) In this Volume one can find several parts of van Daalen’s Ph.D. thesis, called The language theory of Automath ([van Daalen SO]). The present paper is the introduction part (Sections 1-5) of Chapter I: Introduction and summary. Other parts of this thesis can be found in [B.6] and [C.5]. We give a list of the most important subjects, present in van Daalen’s thesis, but not reproduced in this Volume: 0

0

different approaches to and notions connected with normalization and the Church-Rosser theorem (in Chapter 11) the theory of abbreviations (LSP) (Chapter 111)

0

the E-definition and the closure property for some Automath languages (in Chapter V)

0

a short definition of AUT-II (Section VIII.2)

In our opinion, Chapter I, Sections 1-5, reproduced as the present [ A . 6 ] , gives an extensive and well-organized impression of the state of affairs in 1980. It is the distillation of many years of research in the area, in a condensed form, in some respects even of a philosophical character.

24

R.P. Nederpelt and J.H. Geuvers

It is remarkable that van Daalen, just like de Bruijn in [ A . 5 ] ,considers it necessary to start with a kind of apologetic remark: “we like to make some general remarks [.. I hoping to clarify some points which have sometimes given rise to misunderstanding”. Between the lines one may read here that the value of the Automath project was not (yet) sufficiently recognized in the time that [ A . 5 ] and this thesis were developed. Both de Bruijn and van Daalen surmise that there has been a lack of information about some aspects of Automath. They may be right, considering the low number of international publications on the subject. Another factor is that the presentation of Automath at that time was not attached t o a respectable scientific current: neither logicians nor mathematicians recognized it as a part of their discipline. Both the subject and the formulation of Automath were original, and therefore isolated and strange to non-insiders. Van DaaJen’s defence in Subsection 1.1is short but convincing. He is an advocate of a “good formalism, which allows a formalization faithful to the informal ideas one had i n mind”. And, implicitly, van Daalen states that Automath is such a good formalism. Therefore, compromises are undesirable. For example, an Automath user should convince critics of the advantages of the new notation, and should not comply t o the (strong, but imperfect) tradition. In Subsections 1.3 and 1.4 van Daalen stresses the experimental character of the project: “can we develop formalisms [...] i n which mathematical texts actually can be formulated i n such a way that mechanical verification [.. I is actually possible?”. Requirements are that both writing and checking are practically feasible. The formalism should be “universal”, i.e. “suitable for large parts of mathematics”. All of the reasoning must be formalizable, including proofs, the handling of variables, abbreviations (definitions), etc. Next, van Daalen mentions possible spin-off in the region of didactics. As regards the foundations of mathematics and/or logic, he states explicitly that “Automath has no strong foundational claim [...] or philosophical position to defend”. And he rejects criticism that Automath contradicts the undecidability theorem for mathematics by explaining that the basic system of Automath contains no more than minimal predicate logic. All additions are at the risk of the user. As he says: “The computer is certainly not supposed to decide the truth of the axioms, it is even not supposed to decide derivability of the axioms, but just verifies derivations”. In Subsection 1.10 van Daalen distinguishes between pure systems, having the ordinary A-operations only, and the extended systems, which have additional logical operations. Both AUT-68 and AUT-QE are pure systems, AUT-lI is an extended system. There are no Automath languages which have arithmetic built in. In Section 2 van Daalen recapitulates the history and the various Automath

Survey of the contents

25

languages which have been developed. He then exhibits the main purposes of the thesis, being the formulation and comparison of various Automath language definitions and proving their decidability. The latter objective is reached by giving proofs of “desirable properties”, namely the well-known meta-theorems about (strong) normalization, the Church-Rosser property, closure (under reduction) and the like. Hence, detailed study of the involved reduction relations is indispensable. Important from the practical side is the difference between formal and feasible decidability (Subsection 2.8). Strong normalization gives formal decidability, but this is in general not a feasible operation, since the difference in size between a term and its normal form can be as forbidding as that between a numerical expression involving the Ackermann function and the numeral giving its value. Van Daalen describes roughly how practical feasibility can be obtained by using an appropriate reduction strategy. Van Daalen notices that slight variations in definitions may cause a major difference in the difficulty of the proofs of the meta-theorems. He gives some examples in Subsection 2.10. Section 3 contains a discussion of the subjects connected with bound variables, such as name-free versions of variables (see also [C.2]), and substitution (cf. [E.3]). Section 4 gives a general introduction in the terminology and syntax of the various systems. Subsection 4.6 contains an interesting intermezzo about interpretations, in particular regarding generalized Cartesian products and function types. In Subsection 4.8, the notion of type inclusion is explained. In Section 5 van Daalen opens an extensive discussion on the expressive power of Automath if used for mathematics. The basis is typed lambda-calculus, not set theory. He divides mathematics in a t-part for the construction of mathematical objects, and a p-part for reasoning about these objects. The letter t in the word t-part stands for “terms, types and type valued finctions”, the letter p in p-part for ‘$roofs, propositions and predicates”. In the rest of the section, van Daalen makes clear what the characteristic properties and limitations of Automath are as regards e.g. constants, typing and definitions. Moreover, the distinction between A-abstraction and axiom schemes for explicit definitions of functions is an important topic, dealt with in Subsection 5.6. Van Daalen compares the various features of Automath with other systems, like Seldin’s system of generalized functionality (cf. [Seldin 76]), Scott’s system of constructive validity (cf. [Scott 701) and Martin-Lof’s system of intuitionistic type theory (cf. [Martin-Lof 75al). The considerations as phrased in this section cumulate in Subsection 5.11 in a “natural” development of the Automath format. Here two diverging requirements play a role: the resulting formal language should be suited to the usual

26

R.P. Nederpelt and J.H. Geuvers

(informal) mathematical environments, but it must also be ready for mechanical proof-checking. Propositions-as-types turns out to be the key notion for the combination of these requirements.

A.7. N.G. de Bruijn: Reflections on Automath As the title suggests, this paper takes a retrospective view of the Automath project, by de Bruijn himself. The original Dutch version of the paper is dated March, 1990. The Automath project as such has become a part of history by that time, but, what is more important, it finally obtained recognition, albeit more in the circles of computer science than among mathematicians. Typed lambda calculus has become an important area of research and de Bruijn’s pioneering work is acknowledged among logicians and computer scientists. For example, the work on Pure Type Systems by Barendregt and others at Nijmegen University shows a direct relation with Automath: two “vertices” of Barendregt’s “cube” of typed lambda-systems are simplified versions of AUT68 and AUT-QE, respectively. See [Barendregt 921 and [Barendregt & Hemerik 901. The paper has aspects of a “causerie”. De Bruijn recalls his experiences with mathematics and mathematicians, leading to a description of how he came to the development of Automath. Consequently, it is a very personal document, with philosophical digressions about the influences which were fundamental for the process of growth of his ideas in the logico-mathematical field. In a loose and pleasant style, de Bruijn tells about his contacts with Beth, Erdos, Heyting, Brouwer, Scott and others. His interest in foundational matters developed slowly but steadily. His daily experiences as a highly esteemed mathematician, especially in analysis and combinatorics, led him to the basic question underlying Automath: can mathematics be formalized in such a manner that computers can do the job of verification? He describes his growing attention for the use of formalizations and his “discovery” of lambda-calculus and the block structures present in reasoning. De Bruijn describes two direct motives for his work on the Automath systems: his experience that a proper natural deduction framework can really help in the finding of a difficult proof, and the doubt glimmering in a sentence of the computer scientist Dijkstra at the end of a paper concerning the correctness of an algorithm: “And this, the author believes, completes the proof”. The link between thinking and calculation, the importance of a natural deduction framework, t h e distinctions between language and meta-language all these matters have had a direct influence on his thoughts about logic and mathematics, culminating in his design of the Automath languages. In Section 2, de Bruijn formalizes (with hindsight) his three main objectives for the Automath project:

Survey of the contents

27

(1) A system must be developed which is suited to the verification of mathematical theories, (2) The system must remain general, hence with no or hardly any built-in features for special applications,

(3) The system must be natural in the sense that mathematics and formalization follow the same order of development. In the rest of the section, he reconsiders the propositions-as-types notion, the mixing of objects and proofs, the treatment of equality and the abbreviation mechanism. His conclusion is that the project has attained its three objects, in particular the “naturality”. In Section 3 he lists a number of consequences, in particular regarding didactics and the Mathematical Vernacular, i.e. the common language which mathematician “speak” in their writings. (See [ F . 3 ] . )

A.8. R.P. Nederpelt: Type systems - basic ideas and applications This paper was meant as a companion paper for an invited lecture by the author at the yearly Dutch Computer Science Conference (“Computing Science in tmheNetherlands” 1990). The purpose was to explain t o a general audience of computer scientists what type theory is about, what the main concepts are and, in particular, the importance of type theory for computer science. Hence, the paper is no more than introductory and it covers an area which Aut,omath did not primarily aim at. However, many concepts developed in Automath are presented here in a general setting, with a link to corresponding areas which have recently attracted the attention of researchers, and with many references t o the literature. Therefore, this paper has been selected as the final entry in Part A, which concerns motivation and exposition. After a short historical introduction, mentioning Automath as a “milestone f o r the development of type theory”, Nederpelt reviews Pure Type Systems or PTSs (see Section 1.6 of the present introduction and [Barendregt 92]), as developed by Barendregt and others. Via untyped and typed lambda-calculus he arrives at the central rules for such Type Systems, related to abstraction and application. In the next section, the connection with logic is explained. It is shown that the propositions-as-types format is very much suited to both propositional and predicate logic. In an example, the coding of a derivation of a logical tautology is given, with explicit “proof objects”. Next, Nederpelt elucidates how mathematics can be treated in a type theoretical setting. Assumptions, variable introductions, axioms, primitive notions, definitions, theorems and proofs - they all have their natural counterpart in

28

R.P. Nederpelt and J.H. Geuvers

type theories, as was the case in the various Automath languages (cf. [ A . d ] ,

[A.41). The final section deals with the relation between typed lambda calculus and a number of concepts which are fundamental for higher programming languages. Subjects are: polymorphism, definition-like constructions such as the let- and where-constructions, products and sums, abstract d a t a types and recursion. These various subjects, all being of current interest in computer science, exemplify the usefulness of type theory in this area.

Part B: L a n g u a g e definition and special subjects B.l. L.S. v a n Benthem J u t t i n g : Description of AUT-68 This is an informal introduction to AUT-68, which served as lecture notes for a course on this subject given in 1981. Since it is an introductory and selfcontained note, we present this paper as the first entry in Part B of this Volume. Chronologically, it should be placed somewhere in the middle of this Part. Van Benthem Jutting starts with a short review of the backgrounds and history of AUT-68. This is followed by a step-wise description of the various syntactic features of a type free version of AUT-68. Subjects treated are e.g. books and contexts, lines, expressions, abstraction and application, substitution, reduction and conversion (or definitional equality). Next, he adds types and a type operator which provides for a “canonical” type of an expression. The restricting role of the types is dealt with in Section 8 (Correctness). Van Benthem Jutting continues with a summary of languagetheoretical meta-results, plus a number of technical Automath facilities which serve as a useful shorthand-help for actual text writing in AUT-68. In an appendix, an example text is given, followed by comments. The example shows how a number of important mathematical and logical language constructs can be rendered into AUT-68. This concerns, for example: propositions and proofs, sets and elements; introduction and elimination of implication and universal quantification; and a possible treatment of contradiction, negation and disjunction. B.2. N.G. de Bruijn: AUT-SL, a single line version of A u t o m a t h This short note, bearing the date May, 1971, is a n early elaboration of Nederpelt’s ideas about the possibility of “streamlining” the Automath format (cf. [Nederpelt 71bl). Contexts are treated as lambda-abstractions, instantiations of definitions are replaced by applications. Moreover, primitive notions and axioms are treated as lambda-abstractions, and definitions, being “only” abbreviations, are omitted. In this manner a simpler system is obtained, AUT-SL (where SL stands for

Survey of the contents

29

“single line”). AUT-SL is nothing more than a system of typed lambda calculus, but with, at least in principle, (almost) the same power as Automath. By its simplicity, it is easier to perceive and understand the various mechanisms of Automath, while, on the other hand, theoretical investigations can be applied to a unified and therefore less complex syntactic structure. The simplifications led to the first proof of strong normalization for an Automath system by Nederpelt in his thesis IC.31. His version of AUT-SL, developed in that thesis, was called AUT-A. A full term (a “book”) in AUT-SL is no more than a single long term constructed in typed lambda calculus. This term can for example represent a mathematical theory. If this theory is extended with more definitions, theorems, proofs and the like, then in the AUT-SL-version, this amounts to an extension of the original “single line” lambda-term at the end, where the part of the term representing “old” material remains unchanged. AUT-SL is in some respects more general than other Automath systems. For example, terms of any (finite) “degree” are possible: each term may have “inhabiting” terms, which in their turn may have inhabiting terms, etc. On the other hand, AUT-SL lacks type inclusion (see [A.3]and [A.6]),which is a serious handicap in applications (but see also [B.4]).Moreover, in practical situations the absence of abbreviations causes the generation of terms of a forbidding complexity. Finally, AUT-SL does not incorporate q-reduction. This, however, seems to be of minor importance in applications, as observed by van Benthem Jutting (cf. [D.3, Subsection 4.1.11). The paper contains a short introduction, a description of the syntax of AUTSL, an example and a verifying program for AUT-SL.

B.3. N.G. de Bruijn: Some extensions of A u t o m a t h : the AUT-4 family This paper investigates the possibility of extending the three degrees of Automath with a fourth one (cf. the simpler Automath system of [B.L], in which any finite degree is allowed). The fourth degree is added in order t o be able to incorporate a formal version of the notion ‘irrelevance of proofs’ (this notion has been explained in our resume’s of [ A . 4 ] and [A.5]). Usually, the three degrees in Automath (degrees 3, 2 and 1) are for ‘terms’, ‘types’ and ‘types of types’, e.g. for representing elements, sets and the class of all sets, or proofs, theorems and the class of all propositions, respectively. Now de Bruijn suggests maintaining the degrees 3, 2 and 1 for elements, sets and the class of sets, but to use degrees 4, 3 and 2 for proofs, theorems and the class of all propositions. In this manner, terms of degree 4 are always to be interpreted as proofs, and irrelevance of proofs can be more easily expressed. (In [/I.&], it was explained how in AUT-68, having only three degrees and only type as

30

R.P. Nederpelt and J.H. Geuvers

term of degree 1, the same result could be attained by the introduction of the categories TRUE and bool.) De Bruijn lists a number of possible other applications of this Automath language with four degrees.

B.4. N.G. de Bruijn: AUT-QE without type inclusion The syntactic notion of type inclusion (see [ A . 3 , Subsection 4.41 or [ A . 6 , Subsection 4.81) has always been a slightly peculiar ingredient of Automath languages like AUT-QE. Its motivation can be found in the syntactic simplification obtained by the identification of the (functional) X and the (generalized product binder) II. In this paper de Bruijn shows that type inclusion can be avoided in the syntax of Automath, provided that the Automath text itself contains a number of axioms (‘primitive notions’, or PN’s) which enable the user to mimic this type inclusion. Otherwise stated, type inclusion is now moved from the language syntax to the object language. As a consequence, each application of type inclusion must now be justified by the Automath writer in the Automath book; it is no longer an automatic type change that is looked after by the syntax (or, in practice, by the verifying program constructed for the language). A smooth treatment of this form of type inclusion requires a number of abbreviating features which de Bruijn describes in the paper. In a sense, de Bruijn violates his own objective of “naturality” (see [ A .7]), since this incorporation of type inclusion in the object languages complicates matters, to some extent. On the other hand, the user of Automath is now obliged to become conscious of the places in his text where type inclusion is desired (i.e., where the X’s are actually II’s). For a recent discussion concerning the transformation into AUT-AA (cf. (B.71) of a book written in AUT-QE without type inclusion, and for a comparison between AUT-QE with and without type inclusion: see [de Bruijn 91bI. B.5. L.S. van Benthem Jutting: Checking Landau’s “Grundlagen” in the Automath system. Appendix 9 (AUT-SYNT) This is Appendix 9 t o Jutting’s thesis. (This thesis is discussed in Subsection D.2 of the present survey. For other parts of this Ph.D. thesis, see Subsections D.3, D.5 and E.2.) In this appendix some preliminary remarks are made about a possible language extension called AUT-SYNT. We note that Subsection 4.1.0 of Jutting’s thesis, reproduced in ID.31, is also concerned with AUT-SYNT. The purpose of AUT-SYNT is to enable the user to suppress redundant parameters. There are various circumstances in which a user of Automath systems may become bothered by the obligation of Automath to explicitly provide in-

Survey of the contents

31

formation which is already implicitly present. An example where this may be desired is the case in which a ‘polymorphic’ definition, depending on a number of parameters, is applied. Jutting uses the example of the polymorphic conjunction. The introduction rule for the conjunction is: if propositions a and b are both derivable, then a A b is derivable as well. (In the propositions-as-type concept, we may read ‘inhabited’ for ‘derivable’.) For a general version of this rule, expressed in Automath, abstraction over a and b is required: given a proposition a and a proposition b , and given that u is a proof of a and v a proof of b, then andi (say) is a proof of a n d ( a , b ) . Note that a n d i depends on four parameters: a, b, u and v . Applying this rule, we need terms A and B representing the propositions, and proof terms p for A and q for B, respectively: a proof of A A B then looks like a n d i ( A , B, p , q). However, the proofs p and q implicitly contain the information concerning the propositions which are at stake, since the type of p is (convertible to) A and the type of q is (convertible to) B. Note that both the types of p and q are ‘calculable’ in each of the Automath languages. Hence, we can - at least in principle - do without the parameters A and B. This being the case, one can give a new definition of andi, this time with only two parameters, viz. u and v. This definition uses a syntactic type synt as a type for the parameters that contain the necessary information for the verification program, in order to restore the full parameter list. In the present paper Jutting describes this new syntactic feature. One may take advantage of AUT-SYNT by ‘predefining’ a number of syntactic metafunctions, like CAT for the calculated (“mechanical”) type, as desired above. Another function which can be predefined for use in AUT-SYNT is DOM, giving the “domain” of a lambda-abstraction. Jutting gives other examples, as well.

B.6. D.T. van Daalen: The language theory of Automath. Chapter VIII, 1 and 2 (AUT-ll) This contribution is taken from Chapter VIII of van Daalen’s thesis ( [ v a n Daalen SO]). See also [ A . 6 ] and [C.5] for other parts of this thesis. Chapter VIII deals with the Automath variant AUT-ll, developed by J. Zucker. For a description of the background, the properties and the practical applicability of this language, see Zucker’s [ A . 4 ] . For a text example in AUT-ll, see [D.4]. Van Daalen starts with a comparison of AUT-QE and AUT-ll. Both have been used in practical experiments, for the formalization of large units of mathematical texts. Van Daalen lists the correspondences between the two languages: both have three degrees, a generalized type structure and only quantification over term variables (not over type variables). Both employ the book format, with context indication. There is no built-in recursion. However, AUT-ll goes beyond AUT-QE. For example, it can handle pairs,

32

R.P. Nederpelt and J.H. Geuvers

projections and injections. For this purpose AUT-II has type constructs for the finite product (a special case of the generalized sum) and the finite sum (or disjoint union). As a consequence, AUT-II can deal with logical systems having, apart from =+ and V, also 3 and V as operators, together with the corresponding introduction and elimination rules. As already mentioned before, there is another important difference. The language AUT-QE has type inclusion (see [ A . 3 ] and [ A . 6 ] , and also [ B . 4 ] ) , since it does not distinguish between type valued functions and function types. AUT-ll, however, has a special symbol (viz. the II present in its name) for referring to a function type (a generalized Cartesian product, the letter IT refers to the p of product). Type inclusion is therefore unnecessary. In practical applications (see e.g. [ D . 4 ] )AUT-ll also had AUT-SYNT facilities (see [B.5] and [ D . 3 , 4.1.0]),but this is not part of the language. Van Daalen devotes a subsection to a short definition of AUT-IT in the style with E-formulas as he employs throughout his thesis. For many syntactic notions he refers to other parts of his thesis, which are for the greater part included in this Volume.

B.7. N.G. de Bruijn: Generalizing Automath by means of a lambdatyped lambda calculus This paper builds on previous work concerning the language AUT-SL (see [ B . 2 ] ;for a more general framework, see also [C . 3 ] and [ A . 5 ] ) . AUT-SL is a unified and simplified Automath version, incorporating all features of e.g. AUTQE, but for definitions and type inclusion. The Single Line approach of the papers mentioned above has been changed into a tree format, which reflects more clearly the internal structure of the terms involved. Moreover, by a generalizing adaptation of beta reduction, definitions can again be expressed. This is a major step forward for practical purposes. The system proposed in this paper has also been called AUT-AA, being an extension of AUT-A (again see [ C . 3 ] )with Definitions. A recent discussion of the same system has been given in [de Bruijn 91b]. Type inclusion, however, is left out in all mentioned versions of AUT-SL or AUT-Ah. De Bruijn first describes lambda trees, being his equivalent of terms in typed lambda calculus. Next, he explains various meta-syntactical notions, some of which are well-known from the usual Automath languages (degree, type), while others are specific for the tree approach (ascendant, implantation). The notion redex is replaced by that of AT-pair. As mentioned above, the reduction relation is refined in order t o accommodate local reductions, necessary for representing definitions in the language. The intuitive background is that the 'unfolding' of a definition is usually desired for only one specific instance of the defined word. For example, suppose that one

Survey of the contents

33

needs somewhere in a formal text, during a formal manipulation, the precise definition of ‘the square of x’ (or x2), being x x x. Then it is advisable to have a formal means to replace x 2 by x x x at that particular place, without the undesired side-effect that all occurrences of the string z2 are replaced by x x x, as would be the consequence of the usual form of beta reduction. A companion to local beta reduction is what de Bruijn calls AT-removal. Bot8hlocal reductions and AT-removals he calls mini-reductions, for which he claims the Church-ksser property. Finally, de Bruijn gives a n algorithmic definition of correctness of lambdatrees. Correctness here means that such a tree belongs to a certain sub-class of all lambda trees (AA), viz. those which obey the typing conditions for “wellbehaving” terms. The algorithmic definition seems suitable for machine verification.

B.8. H. Balsters: Lambda calculus extended with segments. Chapter 1, Sections 1.1 and 1.2 (Introduction) This is most of Chapter 1 (Introduction) of Bakers’s thesis. That monograph deals with the so-called Xu-calculus, being an extension of the ordinary lambda calculus. The u stands for segments, being new “terms” added to provide for certain desired abbreviation facilities. The motivation for the introduction of segments in lambda calculus originated with de Bruijn’s AUT-SL (see [B.2]), where many repetitions of (almost) equal symbol strings were necessary, due to the abolition of contexts. The context mechanism is very convenient in the more user friendly Automath versions (AUT-68, AUT-QE, AUT-n), not only since it reflects so neatly the natural, time-honoured manner of developing mathematically inspired theories, but also for pure practical reasons: it prevents a lot of unnecessary and awkward work. The Xa-calculus (see [de Bruijn 78al) is an attempt to reinstate the advantages of the context administration in the framework of lambda calculus. A segment is a formal and generalized version of such a context, in a lambda calculus format, which can be abbreviated. That is to say: a variant of beta reduction is used to give a formal connection between the name of a segment (a segment variable bound by a special A) and the abbreviated context or segment (being an argument for the term beginning with the mentioned A). Balsters elaborates these ideas of de Bruijn. Moreover, he uses a special name-free notation for segment variables, introduced by de Bruijn and described in [ C . 2 ]for ordinary lambda calculus. These nameless dummies are reference numbers, replacing variable names. A great advantage of the use of nameless dummies is that “name clashes” are avoided in the process of substitution. On the other hand, nameless dummies must be “updated” during a substitution process, in order to maintain the right references. This requires update

34

R.P. Nederpelt and J.H. Geuvers

functions (or reference mappings) which may be rather complicated, as can be seen in the parts of Balstersk thesis which are not reproduced in this Volume

([Balsters SS]). Balsters starts with the type free lambda calculus (Subsection 1.1). In Subsection 1.1.3, he describes his version of name-free notation, and gives an impression of the difficulties that can be expected. He employs a tree format for terms in order to be able to give a better explanation of what happens. Next, he discusses segments and segment variables, their formal format and their use. He eliplains carefully which desirable and undesirable effects may occur, and he adapts the format accordingly. The resulting system is a bit involved, but can be softened by using the name-free notation. This is made plausible in Subsection 1.1.6. Subsection 1.2 is concerned with a typed system, having simple types as in a system introduced by Church (nowadays also called A+ or A+-Church; see [Barendregt 921). The types play a restricting role as usual, thus limiting the set of terms to the set of well-typed (or correct) terms. Again, Balsters also gives a name-free variant. Types are defined for segments, as well. A number of examples are added to show how correctness of a term can be established and how types can be calculated for correct terms.

Part C: Theory

C.l. L.S. van Benthem Jutting: A normal form theorem in a X-calculus with types This short note was presented at a workshop in Oberwolfach, Germany, in 1971. It contains the first proof of (weak) normalization for terms in an Automath system. The format used is an Automath version of a typed lambda calculus. It is shown that normalization holds for such a system of lambda calculus provided that it has a kind of “weak functional behaviour”, which is expressed by means of a n o m , here called T , being a partial mapping from terms to terms. This norm .(a) (if defined) of a term a may be considered to be a rough “skeleton” of the intrinsic abstraction structure of the term a. It can be obtained syntactically by (repeatedly) replacing all variables by their types and by cancelling all applications together with the matching abstractions. The norm T was invented by Nederpelt, for the same purpose: proving normalization. (See also [C.9, Chapter 31 for a detailed description.) The domain of T consists of terms in the system under consideration. Its range is a subset of the same set, consisting of terms which may contain abstractions, but no applications and no variables. It is shown in the paper that a term a has the mentioned property of weak normalization if .(a) is defined. Jutting gives a

Survey of the contents

35

number of lemmas for this main theorem. The proof of Theorem 3, an important lemma, is not given. One may, however, also consult [C.3]for the details. C.2. N.G. de Bruijn: Lambda calculus notation with nameless dummies, a tool for automatic formula manipulation, with applica-

tion to the Church-Rosser theorem Early experiences with Automath showed that the usual naming of variables by means of letters (z,y, . . .) causes a lot of trouble. For an example, see our rCsumC of IB.81.We shall now go a little further into the matter. It is well-known that it is not a trivial affair to avoid so-called “name clashes” between bound and free variables in substitutions. This is an annoying matter, in particular since these names only serve the purpose of enabling a relative identification: a number of occurrences of the same letter z only points at the fact that these occurrences concern the same variable; the name z itself is irrelevant, and could be (consistently) replaced by any other name. The solution given by de Bruijn is to make the variables name-free. He accomplishes this by replacing each occurrence of a variable by a so-called reference number, being a positive integer which is a measure for its relative position in the term. For example, the term A,. (zy) becomes A . (1 2). Here the number 1 replaces the bound variable z; the 1 points at the binding A, being the first X t o the left (if one follows the path to the root of the “term tree”). The number 2 refers to an invisible X in front of the term, meant to “bind” this free variable 2, formerly named y. So, bound and free variables are treated similarly. For free variable there must be an imaginary “free variable list”, binding these variables in some fixed order. Note also that multiple occurrences of the same variable (name) can easily lead to dzflerent reference numbers. On the other hand, occurrences of different variable names can give rise to the same reference numbers. De Bruijn explains his approach of name-free variables. A disadvantage of his method is, that substitutions can cause a change of reference. For this purpose he introduces the necessary reference transforming mappings, which complicate matters to some extent. In a way, this is the counterpart of the difficulties caused by name clashes in the usual name carrying version. Nevertheless, de Bruijn gives a smooth demonstration of the usefulness of his notation for metalingual discussions by adding a proof of the Church-Rosser theorem for lambda terms in the name-free format. De Bruijn’s idea of nameless dummies has nowadays found many advocates and users. See for example [Abadi et al. 911.

36

R.P. Nederpelt and J.H. Geuvers

C.3. R.P. Nederpelt: Strong normalization in a typed lambda calc u l u s w i t h lambda s t r u c t u r e d types This is the complete Ph.D. thesis of Nederpelt. It contains the first proof of strong normalization for terms (under P-reduction) in an Automath system. This result is obtained in a particular way: it turns out that strong normalization is a consequence of weak normalization, as soon as two other properties hold: (1) the Church-Rosser property,

(2) the property that the reduction relation in the system under consideration is increasing, i.e., there is a natural number [ A (defined for each term A such that if A reduces to B, then IAl < IB(. (The term ‘increasing’ has been introduced in [Klop 801.) The paper concentrates on a simplified Automath-version, called AUT-A. for an earlier description by de Bruijn of a similar system, called (See also [B.2] AUT-SL.) Nederpelt starts with a general description of a typed lambda calculus called A , in which the types do not play the role of restricting application. (Note that this letter A has no connection with the A in the system name AUT-All mentioned in our resume of [B.7].) In fact, A is the ordinary untyped lambda-calculus to which general, term-like types have been added. Typing is a la Church (see [Barendregt 92]), i.e. all and only the binding variables are provided with type information. The notation of this typed lambda calculus is in the Automath fashion (or de Bruijn-like, as one could say), that is t o say with arguments which precede the “functions”. This is a nice notation for P-reduction, since the X of an abstraction and the matching application term (the ‘argument’) occur adjacently. It turns out that this simple notational convention is very appropriate for the definition of a variant version of P-reduction which is increasing (as defined above). Nederpelt calls this version PI-reduction. It is described in Section 11.6. The characteristic property is that the matching abstraction-application pair in a reduction is not erased; for example (in the usual notation) instead of (X=:A. B)C -+p B[z := C], one has ( & : A . B)C +pl (X=:A. B[z := C])C. Full ,&-reduction is a bit more complicated. Its definition makes an essential use of the matching abstraction-application pairs which are so clearly detectable in the de Bruijn-like notation. The PI-reduction is increasing, as Nederpelt shows. Hence, together with the Church-Rosser property (which the author proves in Chapter I1 of his thesis), this implies that the PI-reduction is strongly normalizing as soon as it is weakly normalizing, (This idea has later been generalized to the case of Combinatory (or Abstract) Reduction Systems by J.W. Klop in his thesis, [Klop 801; see also [Klop 921 and [Barendregt 921.) In order to associate this increasing PI-reduction with the usual @-reduction, Nederpelt introduces a simple reduction mechanism (called P2-reduction) which

Survey of the contents

37

erases superfluous abstraction-application pairs. (Cf. the AT-removal which we discussed in Section B.7.) In Chapter 111, Nederpelt gives a short algorithmic definition of AUT-A, in which the types accept the usual responsibilities of guaranteeing a nice functionargument behaviour. This is established by putting a rather general restriction on A, called the “applicability condition”. The system AUT-A is very close to many Automath-systems, as we described before (see again our rCsumC of

[B.21). The rules given here may be considered t o be an early version of some of the PTS-rules (see [Barendregt 921). For obtaining (weak) normalization, the applicability condition can be weakened. For this purpose, Nederpelt defines a partial function p on the set A giving a norm for a term, in the case that p is defined. (This p corresponds with the norm T in [ C. I].) For such pnormable terms, weak normalization is proved in a manner comparable to the one given in [ C . 1 ].This holds for both the ordinary @-reductionand the (increasing) @I-reduction. With the techniques developed in Chapter 11, strong normalization turns out to be a consequence. All the mentioned results are transferable to AUT-A, which has the (non-increasing) ordinary P-reduction.

R.C. de Vrijer: Big trees in a A-calculus with A-expressions as types This paper, dating to 1975, has been re-published as the final one of five entries in de Vrijer’s thesis ( [ d e Vrzjer 87al). Its aim was to prove a number of C.4.

theoretical meta-results concerning the Automath-languages, in particular the closure property, already mentioned in our rCsumC of van Daalen’s introduction to his thesis ( [ A . 6 ] ,1980): any reduct of a term in a given language is again a member of that language. This property was stated as a conjecture in [ C . 3 ] . See also [C.5] (the main parts of van Daalen’s thesis) for a systematic treatment of these subjects. The desired meta-results are: strong normalization, Church-Rosser, closure and decidability. De Vrijer states in the introduction to his thesis that “the problems of a particular Automath system cannot be considered to be solved to full satisfaction, until all the desirable results [.. I are established together”. For this purpose he defines so-called big trees, which are richer versions of reduction trees, incorporating, apart from proper reductions, the following “improper” steps: 0

passing to the type of a term,

0

passing to an arbitrary subterm.

38

R.P. Nederpelt and J.H. Geuvers

A system satisfies the property BT, if the big tree for all of its terms is wellfounded (i.e. has a finite height, and hence no infinite branches). The property BT implies the properties mentioned above. De Vrijer introduces a system AX, being a variant of AUT-QE. As he observes in the introduction to his thesis, the closure property becomes trivial, since the definition of AX was tailored t o this problem. However, the decidability and the soundness of the language definition of AX become complicated matters. Noteworthy is the manner in which de Vrijer handles the types. In order to prevent interference of derivability and term formation, he does not restrict his set of terms with a view to the applicability condition. Hence, the types have no influence on term construction. However, the @-reduction relation becomes restricted, in the sense that a redex ( & : A . B)C has a corresponding contractum B [ z := C] only if the argument part C of the redex has A as its type. In this setting it is still possible to define a restricted set of legitimate terms, by stating the requirement that each application ( B C )occurring in such a term must have the property that the argument part C “fits in” B. More formally: there must exist terms A and A’ such that C has A as its type, while B is convertible (in the new sense, using the restricted @-reduction relation) t o X,,A. A’. As a matter of fact, the requirement is more free, as in [C.3): it is sufficient that the type of B, or even the type of the type of B , has this property of being convertible to X=:A . A’. These types can be calculated, again as in [ C . 3 ] .The intuitive reason is that B may be a function without having the appearance of a function. For example, if B is an introduced variable with type X=:A. A‘, then B itself can never convert to a term in the required form, but the type of B trivially does so. De Vrijer proves the “big tree theorem” (big trees are well-founded) and shows as corollaries that the “full” AX is decidable and that it is a conservative extension of the “legitimate” fragment of AX. C.5. D.T. van Daalen: The language theory of Automath. Parts of Chapters 11, IV, V - VIII The main part of the introduction t o van Daalen’s thesis ( [ v a n Daalen SO]) can be found in [ A . 6 ] . Chapter VIII, dealing with AUT-II, is reproduced in [B.6]. The present entry contains a selection from the body of this thesis. In this selection one can find the definitions of important notions of the various Automath-systems and most of the desired meta-theoretic theorems, together with their proofs. Van Daalen deals with these topics in a systematic manner, using a style which provides the reader with the necessary intuition and background information. The selection starts with Subsections 11.8 - 11.11. Subsection 11.8 gives an informal analysis of the weak Church Rosser Property (if C reduces in one step to

Survey of the contents

39

both A and I?, then A and r have a common reduct). Subsection 11.9 discusses the so-called Postponement (of one kind of reduction with respect to another one), and Subsection 11.10 deals with multiple substitution. Subsection 11.11 contains a general result about reduction under substitution. It treats the following problem: “zf C[Q] reduces to A, what can be said about A in terms of reducts of C and I’?’’. An analogous lemma due to Barendregt turns out to be a corollary. Next, Subsection IV.2 is reproduced in this Volume. It concerns (weak and strong) normalization results for normable expressions. The norm p presented in this Subsection is a partial function on terms. It is quite similar to the norms 7 and p as given in [C.l]and (C.31, respectively (see the r6sum6’s in this Volume). Normability for terms is a much weaker requirement than the applicability condition present in (most of) the Automath systems. Normable terms have a very weak functional behaviour: for an application ( A B ) it is sufficient that the norms of both constituents, A and B, exist and that the norm of the argument, p ( B ) , is equal to the type given in the “abstraction head” of p ( A ) ; i.e., p ( A ) must be X=:+(B). p(C) for some C. Important properties of the set of normable terms are that the set is closed under taking subterms, under substitution and under reduction. Normability guarantees weak normalization and, together with a substitution theorem, also strong normalization. In this Subsection, van Daalen gives various proofs for these theorems. Also selected is Subsection IV.4.6 which gives an extension of these results to systems with more than &reduction, viz. 0-reduction and &reduction (for unfolding defined constants). The bulk of the selection from van Daalen’s thesis consists of the complete Chapters V to VII. In Chapter V the so-called E-definition is dealt with (the symbol E expresses the meta-relation ‘... has type ...I, as we already mentioned in our rCsum6 of [A.3]).By the aid of this E-definition van Daalen proves closure for AUT-QE with p- and v-reduction (cf. [A.6],[C.4] and [C.6]).Moreover, he shows the equivalence of the two kinds of definitions for a set of “legitimate” terms: the E-definition described above, and the algorithmic definition with (canonical) types (as e.g. in [ C.31) and possibly type inclusion. In Chapter VI, van Daalen tackles the Church-Rosser problem for a typed lambda calculus with p- and 7-reduction. Van Daalen takes a generalized typed lambda calculus, in the style of Nederpelt’s A (see [C.3]),being an Automathlike language without contexts and without definitions. In such a generalized typed lambda calculus the Church-Rosser property does not hold for p combined with 0, as a simple counterexample shows. However, for a “legitimate” (or ‘‘correct”) fragment, consisting of terms for which an applicability condition holds, it does, as van Daalen proves. (This was a conjecture in [C.9].)

40

R.P. Nederpelt and J.H. Geuvers

Chapter VII treats the language theory of Nederpelt’s A (or AUT-SL; see [ C . 3 ] ,[B.2] and the respective rCsumC’s in this Volume). Van Daalen follows the algorithmic approach of Nederpelt, but for the “single line” character. First, he proves closure for A in Subsection VII.3 (closure for A with 7-reduction is postponed until Subsection VII.5). Next, he uses the big tree theorem of de Vrijer (see [ C.41) to prove Church Rosser for @q and strong normalization. The proof of the equivalence of a number of systems, given in Subsection VII.6, shows that all the systems under consideration obey the described “nice” (desired) properties. Finally, the chosen fragments from Chapter VIII (Section 3 and Section 4) deal with the language theory of AUT-II (cf. [ A . 4 ] ) ,in particular the properties of closure and strong normalization. As we already mentioned in Section B.6 (see also Section A.4), AUT-ll is an extended system, having additional type forming operations, viz. generalized product (also known as ‘II-type’, which has arrow type formation as a special case), generalized sum (also known as ‘Ctype’, which has binary product as a special case), and binary sum, plus the corresponding term forming operations like abstraction, pairing and injection. Hence, AUT-ll must be provided with a number of additional reductions, like n-reduction (for projections of pairs), 0-reduction (for surjectivity of pairing) and +-reduction (for injections in binary sums). Van Daalen proves closure and strong normalization for the system with these extra operations and reductions. However, he does not include &-reduction (for binary sums) in his strong normalization result, due to some technical problems. Full Church-Rosser does not hold in this extended system, as is shown by means of a counterexample.

(2.6. L.S. van Benthem Jutting: The language theory of A,, a typed A-calculus where terms are types In this paper, completed in 1984, van Benthem Jutting revisits the system A introduced by Nederpelt in his thesis (see [ C.31). There is no a priori distinction between terms and types, A serves as both the function binder (the usual A) and the product binder (usually denoted by II). Van Benthem Jutting leaves thus out 7-reduction (see the motivation for this in Subsection 4.1.1 of [0.3]), concentrating on @-reduction. He calls the system Am. As he points out, “the importance of A, lies in the f a c t that at may be considered as basic to the theory of Automath”. In contrast to previous proofs due to Nederpelt and van Daalen of a number of theorems stated in this paper, the author uses “nameless variables” in the de Bruijn-style, including the necessary update functions. Cf. [ C.21 and (B.81. A, is a system with the customary restriction on application (“arguments” of functions must have a proper “type”, matching with the function domain). The corresponding system without this restriction is called A, as in Nederpelt’s

Survey of the contents

41

IC.31. The author proves Church-Rosser for this A and strong normalization for a subsystem of “normable” terms in A. This subsystem is comparable again to the work in [C.3]; see also IC.51. The proof of strong normalization, using noming functionals, extends proofs given in [Gandy 801 and [de Vrijer 87~1. The author also proves closure of Am under reduction. The last mentioned result was a conjecture in [C.5’] and was first proved in Chapter VII of van Daalen’s Ph.D. thesis (see [C.5]). Van Benthem Jutting now gives a new, direct proof of closure. Finally he shows that terms of Am are normable, and a substitution lemma then guarantees an upper bound for the length of reduction sequences, hence Am is strongly normalizable as well. (These, again, were results in [C.3] for a system with name-carrying variables; see also [ C.51, again, for a similar method of proving strong normalization.)

Part D: Text examples D . l . N.G. de Bruijn: Example of a text w r i t t e n in A u t o m a t h This is a short example dated March 1968. It gives a very early (albeit limited) demonstration of the use of Automath - to be precise: of AUT-68. Logic is treated in the TRUE-boodstyle of [ A . 2 ] (see our resum6 for details). Both boo1 and TRUE are introduced in the first three lines of the example as primitive notions. Moreover, a notion nonempty is necessary, formalizing the proposition that a certain type is inhabited. Two axioms (then2 and then3) are given, for the linkage of “we have a proof of the inhabitation of a type” to “we have an inhabitant of the type”, and vice versa. Next, axioms for (so-called book-) equality are given: IS is a binary relation given as a primitive notion for each type, obeying reflexivity, symmetry and transitivity. (See also [ A . 2 ] and [ A . 5 ] for more details about this book-equality.) Related to equality are the if-then-else construct, the equality of elements belonging to different types, and embedding. The notion of equality of booleans is given via a primitive pairing type and a kind of bi-implication. The usual implication is a straightforward lambda abstraction, due to the propositions-as-types concept. Subsequently, other logical connectives (non,and) and quantifiers (EXISTS, A L L ) are introduced in a natural manner. Further examples are concerned with predicates, e.g. on “subtypes” (defined with another predicate), with intuitionistic reasoning, with the rule of the excluded third (which is not incorporated, but may be added as an axiom if one desires so) and with sets. It turns out that this way of dealing with propositions is a bit complicated. In particular, the shift between propositions and their TRUEtypes is quite laborious. A similar remark holds for the negation of propositions and the emptiness

42

R.P. Nederpelt and J . H . Geuvers

of their corresponding TRUEtypes: given a proposition b, inhabitation of the type EMPTY( TRUE(b)) implies inhabitation of the type TRUE(non(b))and vice versa. This kind of transformations complicates matters considerably. We explained in our rCsum6s of [A.3] and [A.5] how these problems have been solved, in an elegant manner, by extending the system t o AUT-QE.

D.2. L.S. van Benthem Jutting: Checking Landau’s “Grundlagen” in the Automath system. Parts of Chapters 0, 1 and 2 (Introduction, Preparation, Translation) This entry contains parts of the introductory chapters of van Benthem Jut[D.3), ting’s Ph.D. thesis. Other parts of this thesis are reproduced in [B.5], [D.5]and [ E . 2 ] . Van Benthem Jutting’s thesis summarizes the experiences gained with his translation of Landau’s book Grundlagen der Analysis ([Landau 301). This book, first edited in 1930, was in its time a standard of precision in the development of a fundamental piece of analysis: it starts with Peano’s axioms for the natural numbers, and successively introduces the positive rational numbers, the (positive and negative) reals and the complex numbers by means of the standard constructions, viz. via equivalence classes and Dedekind cuts. Theorems about these number systems and the corresponding order relations are proved rather meticulously, unsurpassed in degree of elaboration for a long time since the original publication. Landau’s book is elementary, his prerequisites for the readers, however, appear to be a bit optimistic. In his Preface for the Student he claims: “I will ask of you only the ability to read German and to think logically - no high school mathematics, and certainly no higher mathematics”. This is in principle true, but it may give a wrong impression about a text book that contains, among other things, a full proof for the Dedekind-completeness of the order relation for the reds ... The book appeared to be a good test case for a translation in Automath, since 0

the subject is well-known and stable in mathematics,

0

its great value was recognized by the mathematical communities for several decades,

0

0 0

0

the theory is developed “from scratch” (albeit that knowledge of logic is presupposed), definitions, theorems etc. itre explicitly phrased, the proofs use small steps, leaving no essential transition to the inventiveness of the reader and hence being unambiguous and reliable, the same degree of precision is maintained throughout the book.

Survey of the contents

43

Moreover, it was interesting t o see whether such a renowned text would stand up to the ultimate precision of the Automath language. The full translation took Jutting quite some years. The complete computer printout of the translated text runs to approximately 500 pages of paper in A3 format. (Landau’s book itself numbers 134 pages of mathematical text.) In the part of Jutting’s Ph.D. thesis now under discussion, the author starts in Chapter 0 with an introduction and motivation for the translation and the Automath version used. Next, in Chapter 1, he extracts the presupposed logic from Landau’s text and gives comments about the way in which logic is expressible in Automath (in particular: AUT-QE). (Details about the incorporation of logic are given in Chapter 4; see [ 0 . 3 ] . )The axiomatic Automath lines (“PN-lines”) are listed and the development of logical concepts and theorems necessary for the Landau translation is elucidated. (The actual PN-lines as they occur in the preliminary AUT-QE text, are given in Appendix 3 of Jutting’s thesis, which is reproduced in this Volume: see [ 0 . 5 ] . ) The reproduced part of Chapter 2 contains an abstract of Landau’s book and an overview of the deviations in the Automath translation from Landau’s text. These deviations are generally of minor importance and are only made for the benefit of the expounded theory. There are, however, a few important and necessary changes, caused by Landau’s appeal to both intuitive and met& concepts, which cannot be expressed in the Automath (object) language. See Subsection 2.1, (vii) t o (x).

D.3. L.S. van Benthem Jutting: Checking Landau’s “Grundlagen” in the Automath system. Chapter 4 (Conclusions) This chapter of Jutting’s thesis (see [0.2], and also [ 8 . 5 ] , [ D . 5 ] and [E.3] for other parts of his thesis reproduced in this Volume) discusses possibilities of representing logic in Automath, in particular in the systems AUT-68 and AUTQE. Apart from that, the AUT-SYNT extension is introduced. This contains extra features for omitting certain subexpressions that can be derived mechanically (by a computer), thus relieving the task for the Automath writer. See our introduction to [B.5]for a discussion, and the actual [B.5]for examples. Next, in Subsection 4.1.1 Jutting discusses 7-reduction in Automath and gives plausible arguments for his observation that ‘$-reduction does not add considerably to the expressive power of Automath”: there are only two occurrences of 7-reduction in all of the Landau translation, and these two cases are avoidable. The distinction between props (proposition types) and types (set types) is shown to be essential in Subsection 4.1.2: this has to do with the different approaches for the double negation law and the axiom of choice, and also with the possibility of incorporating the so-called “irrelevance of proofs” notion. For

44

R.P. Nederpelt and J.H. Geuvers

the last-mentioned notion: see [ A . 4 ] and Section 24 of [ A . 5 ] ;see also [ B . 3 ] . In Subsection 4.1.3 the notions of strings and telescopes are considered. Telescopes are also mentioned in [ A . 4 ] and elaborated in [de Bruijn 91a]. Telescopes are the formal counterpart in a A-calculus-like environment of a notion connected with dependent products. An example of a telescope is the notion ‘group’ in algebra. Such notions, essential in many parts of mathematics, can be expressed quite satisfactory as prefixes of lambda calculus terms, or as contexts in type systems or in the Automath languages. See also [Barendregt 921. The segment calculus of de Bruijn and Balsters (see [B.8] or the full [Balsters 861) is also strongly connected with the notion of ‘telescope’. In Subsection 4.2 van Benthem Jutting gives some comments on the translation, notably about the choice of language (why AUT-QE instead of AUT-68) and some shortcomings of the translation. He concludes this Chapter with a remarkable observation about the complexity of the Automath text compared with the original Landau text (this has also been mentioned in [ A . 5 ] ) :the “loss f x t o r ” , i.e. the ratio between the number of expressions in the translation and the number of words in Landau’s book, is more or less constant, and thus does not grow in the course of the translation.

D.4. L.S. van Benthem Jutting, R.C. de Vrijer: A text fragment from Zucker’s “Real Analysis” When J. Zucker was a member of the team working in the Automath project (1975 - 1976), he developed a variant of Automath, called AUT-IT, with II-types and C-types. See ( A . 4 ) for a description of this research and Section A.4 for a resume of that paper. Zucker’s aim was to transform the syntax of Automath into a new format, especially suited t o mathematicians and the mathematical style. Of course, he maintained an abbreviation mechanism for making definitions. He added, however, a useful paragraph system, in order to obtain greater flexibility in the management of constants. This paragraph system was first used by van Benthem Jutting for his Landau translation ([vanBenthem Jutting 771). Other syntactic extras are described in [ A . 4 ] . Zucker tested his AUT-IT by formalizing a well-known mathematical theory, viz. the theory of real functions, including continuity, differentiation and the power series. The AUT-IT “book” which contains this interesting material does, unfortunately, only exist in Zucker’s own handwriting. It has not been published as a report, nor has it been checked for syntactical correctness. Zucker’s participation in the Automath project was too short t o attain these aims. The verifying program for AUT-IT has never even been written. Van Benthem Jutting and de Vrijer have chosen a representative part of Zucker’s AUT-IT book, with the purpose of giving an impression of Zucker’s intentions. The text fragment deals with the definition and some elementary

Survey of the contents

45

properties of differentiation. The AUT-II text is reproduced at the end of [D.4]. The section starts with an introduction by van Benthem Jutting and de Vrijer. This introduction contains a description of the AUT-rI syntax, a recapitulation of those AUT-ll notions occurring in text lines preceding the chosen fragment (in so far as they are necessary for the understanding of the fragment), and a synopsis of the reproduced text.

D.5. L.S. van Benthem Jutting: Checking Landau’s “Grundlagen” in the Automath system. Appendices 3 and 4 (The PN-lines; Excerpt for “Satz 27”) In this section, two Automath text examples which were used in the AUTQE version of Landau’s Grundlagen der Analysis ([Landau 301) are reproduced. Both examples appear as appendices in van Benthem Jutting’s thesis. (For other parts of van Benthem Jutting’s thesis which are reproduced in this book, see [D.2] (Introduction), [D.3], [E.2] and [B.5].) Appendix 3 is the AUT-QE text containing the primitive concepts and axioms (PN-lines) which occur as preliminaries for the actual Landau-translation. Since Landau did not elaborate logic in his book (he presupposed this as existing knowledge of the reader), van Benthem Jutting had to incorporate the axioms, notions and rules of classical logic into his AUT-QE text. Moreover, he had to give an axiomatic account of a few notions occurring in elementary set theory. In this Appendix 3 we find axioms for contradiction, equality and individuals, followed by axioms for subtypes, products and sets. See [0.2, Subsection 1.31, for a detailed description of the AUT-QE lines, in van Benthem Jutting’s own words. Appendix 4 of van Benthem Jutting’s thesis contains the Automath translation of “Satz 27” (i.e. Theorem 27), the final theorem in Chapter 1, Section 3 of Landau’s book Grundlagen der Analysis. This theorem reads as follows.

Satz 27: I n jeder nicht leeren Menge naturlicher Zahlen gibt es eine kleinste. (That is, every non-empty set of natural numbers contains a smallest element.) As van Benthem Jutting notes in Subsection 2.1, (vi) (cf. [D.2]), this theorem has been reworded and proved in terms of predicates and not of sets. The reproduced AUT-QE text is an excerpt of the full translation, consisting of those Automath lines only which contain necessary information for Satz 27 and its proof. (A precise description of excerpt is given in Subsection 3.3 of [E.2].) We give a short commentary on this excerpted text. The AUT-QE text of Appendix 4 starts with notions and theorems from logic (not, present in Landau’s book): implication ( I M P ) , modus ponens ( M P ) , the transitivity of implication ( T R I M P ) , the primitive notion contradiction ( C O N ) , negation ( N O T ) ,the axiom of the excluded third ( E T ) , and so on. For example, the AUT-QE text in the lines between the “paragraph markers” +AND and

R.P. Nederpelt and J.H. Geuvers

46

-AND, on the second page of this example text, contains a proof of the theorem that -(a A b) and a imply l b . (See [ E l ]for an explanation of the paragraph system employed. An extra feature is that the reopening of a paragraph is also possible; this is denoted by means of an asterisk, e.g. +*OR for the reopening of paragraph +OR.) A predicate P on type SIGMA is a term of type [X,SIGMA]PROP.That is, P is a function from SIGMA to the class of all propositions. The text shows how the universal and existential quantification over a type SIGMA and a predicate P can be defined, namely as ALL(SIGMA,P) and SOME(SIGMA,P), respectively. For example, ALL(SIGMA,P), formalizing V+EC P ( z ) ,can be defined by just P itself. We illustrate this remarkable fact for those readers who are not acquainted with this type-theoretic feature, by means of a short Automath text:

*

SIGMA * P * P * B * S *

SIGMA P ALL B S RES

:=

---

.-

___

:=

P

; ; ; ; ;

TYPE

[X,SIGMA]PROP [X,SIGMA]PROP .- _ _ _ ALL( SIGMA,P ) .- _ _ _ .SIGMA := ( S ) B ; ( S ) P

That is, if B “proves” A L L ( S I G M A , P ) and S is an “element” of SIGMA, then ( S ) Bis of type (S)P . In other words: If VZEx P ( 2 )holds and if S E C, then ( S ) P ,i.e. the proposition P ( S ) ,is inhabited. So this shows that the natural deduction rule of V-elimination is a simple consequence of defining ALL( SIGMA,P) as P itself. The text between the paragraph markers +E and -E introduces the primitive notion of equality on types, plus the relevant theorems about equality. The introductory AUT-QE text ends with establishing the relation between predicates on types, and sets. The actual Landau translation starts with the paragraph marker +LANDAU. The notions of natural numbers and induction are easily recognizable in the translation. A number of theorems necessary for the proof of Satz 27 and also present in Landau’s book, are proved beforehand: Satz 1, Satz 3, Satz 4, etc. For example, Satz 46 can be deciphered as the Landau statement: 2

+ y/ = + y)’ (2

(where y’ stands for the successor of y). The proof of this Satz 4 b is coded in the same AUT-QE line, and can be read

as: “apply T27, occurring in the previous paragraph no. 24,to y”. The last Automath-line in this Appendix 4 gives the desired Satr 27 and its proof, in a context ending with S. We can read: if S is an element of S O M E ( P ) ,

Survey of the contents

47

then S O M E ( [ X , N A T ] M I N ( P , X )is ) inhabited. In other words, if the predicate P holds for some element of C (i.e. if the set connected with P is non-empty), then there is a minimal natural number for which P holds (i.e. a minimal element of that set). Note that S A T 2 27 is the name of the proof, and not of the theorem. This is a somewhat confusing practice, customary in Automath translations.

Part E: Verification

E.l. I. Zandleven: A verifying program for Automath In this paper the organization of the first Automath verifier is described. The task of the computer program was t o check whether a given Automath text was written in conformity with the language definition. Of course, the correctness of a text is decidable, because of the meta-theorems concerning confluence and strong normalization of the Automath languages. (See Part C of this Volume.) But this is not a feasible way, since normal forms may have a forbidding length. Therefore, Zandleven constructed an interactive program, so that the user can be consulted by the program as soon as it encounters a (too much) time-consuming task. Moreover, the user can instruct the computer about what task should be performed, and the user can add new information (Automath lines) from the keyboard. Verification is preceded by the “translation”, which acts as a pre-processor by checking the context-free part of the text: parentheses, commas and the like. The heart of the program is the conversion checker: are given terms tl and t 2 inter-convertible or not? Note that this is a matter that is left implicit in the Automath languages. One has no formal means t o communicate in the language how certain conversion chains connect one term to another. One could say that it requires some kind of artificial intelligence to establish convertibilty in a clever way. This is absolutely necessary, since (as we emphasize once more) the brute-force comparison of the normal forms is impracticable. Another important feature is substitution. Since the verifier of Zandleven uses actual variable names (cf. [C.2], which suggests another approach; see also [C.S]), one has to be very careful to avoid name clashes. Substitution is the kernel of both @-reduction and definitional reduction (unfolding a defined notion), being the basic constituents of conversion. Hence, it must be treated with wariness. Zandleven also incorporates a-reduction (“renaming”) and 77reduction (“extensionality”). (See [E.3]for a modernized version of the described implementation of substitution, making use of nameless variables (“de Bruijn indices”) and structure sharing.) The paper contains streamlined versions of the procedures dealing with sub-

48

R.P. Nederpelt and J.H. Geuvers

stitution and the various reductions. It employs functions CAT and DOM for the calculation of a “canonical’’ type (“category”) and the domain of a term (if existing). In testing inter-convertibility of two terms, the program tries to find a common reduct, in view of the Church-Rosser theorem. In doing this, the program makes a n appeal to an inbuilt strategy for deciding which of the terms should be reduced, and which redex must be singled out. Zandleven gives a short discussion of this strategy. The manageability of the checking of the correctness of an Automath line is heavily dependent on the convertibility procedure. Finally, Zandleven describes a paragraph system for a smooth treatment of multiple names (identifiers): the requirement that all introduced names are mutually distinct turns out t o be untenable, especially when texts become more complex.

E.2. L.S. van Benthem Jutting: Checking Landau’s “Grundlagen” in the Automath system. Parts of Chapter 3 (Veriflcation) This is the major part of Chapter 3 of van Benthem Jutting’s Ph.D. thesis. It contains a commentary on the computer verification in 1975 of the AUT-QE translation of Landau’s book Grundlagen der Analysis. (We refer to Section D.2 for details about this translation project and for a listing of the other parts of this thesis reproduced in this Volume.) Subsection 3.0 describes the most important facts and features of the verification program in general, such as the stages discernible in the checking process, the possibilities to interfere interactively in this process and mechanisms to prevent unnecessary re-verification. A table lists data of the final run for the verification of the complete Landau translation, and gives e.g. time, number of reductions, number of Automath lines and number of expressions per chapter and for the full text. Remarkable is the extremely low figure for the number of g-reductions performed: only 2 in the complete verification. See Section D.3 or Subsection 4.1.1 of [D.3] for more details about this fact. There is also an account of the amount of memory required for the Burroughs B6700 computer in operation at that time. Subsection 3.1 is about the strategy of the program, used in establishing pequality and/or definitional equality (cf. [ E l ] ) Subsection . 3.3 (not reprinted here) explains the procedure of excerpting an AUT-QE book with respect to a given line in the book: find all the relevant lines for this given line, and skip the rest. The state of the art in computer programming in 1975 was less rigorous than nowadays. Since programs in use then (and even now) contain bugs, there is no full guarantee of the absolute reliability of the final verification of Landau’s book in that year. Apart from that, there have been detected a number of

Survey of the contents

49

shortcomings in the program as regards the binding of variables, which were listed and discussed in Subsection 3.2 (not reprinted here). In spite of these observations, van Benthem Jutting concludes in Subsection 3.2 that “it is hard to believe [.. I that any incorrect A UT-QE lines have been accepted b y the machine during verification”.

E.3. L.S. van Benthem Jutting: An implementation of substitution in a X-calculus with dependent types Substitution is fundamental in many mathematical disciplines, in particular in computer science (cf. assignments, functional programs and unification in logic programming). Nevertheless, it is often treated, surprisingly, as a metaoperation. For example, in the traditional lambda calculus, where substitution is the kernel of the fundamental operation called /?-reduction, substitution itself is generally presented as a mechanism outside the object language. In actual implementations of languages using functional concepts, one cannot avoid a formalization of substitution in the coding of function application. This was also the case in the Automath verifier (developed about 1974, see [ E .l ] ) , since /?-reduction and &reduction (for the unfolding of definitions) are fundamental operations in all Automath languages. It appeared to be a good strategy to code substitution in such a manner that the actual copying of expressions, a time- and memory-consuming operation, would be delayed as long as possible. Zandleven designed a method for this purpose which was used in the verification program for Automath. Instead of substituting an expression for a (free) variable, this expression was stored in a so-called environment, and the free variable would point at the appropriate part of the environment. Substitution is implemented by changing the environment. This idea can be advantageous, since many occurrences of the same free variable may point t o the same environment entry. The unpleasant alternative of copying one and the same expression at all places of these occurrences, is thus avoided. The chosen set-up is sometimes described as structure sharing. A related notion is lazy evaluation, see e.g. [Turner 791. Since Zandleven aIso chose to code free variables as natural numbers in the ‘nameless variables’-style (also called ‘de Bruijn indices’ or relative addressing), he could use the values of these variables as the desired pointers for locating the appropriate environment. Hence, a variable, being a natural number, could either be actually free (coding a free variable), or bound to an environment entry (intended t o be an expression substitutable for the variable). In the paper presently under discussion, dated 1988, van Benthem Jutting gives a compact description of this coding of substitution, which had not been properly documented before. He considers both single and multiple substitution, and the combination of both, intended for P-reduction, and (definitional) 6-

R.P.Nederpelt and J.H. Geuvers

50

reduction. Update operations play an important role. (See also de Bruijn’s original paper on nameless variables, [ C . 2 ] ,and the applications in (B.81 and

1c.61. ) Van Benthem Jutting gives soundness results for his operations, thus justifying the definitions. He also considers a typing operation, in the same name-free setting. Recently, the notion of ‘explicit substitution’ has been investigated again in [Abadi et al. 911, with a link to term rewriting. The same explicit substitution in a uniform notation in tree style, inspired by Automath, is the subject of [Kamareddine & Nederpelt 931.

Part F: Related topics

F.l. N.G. de Bruijn: Set theory with type restrictions De Bruijn prepared this paper for an audience of mathematicians, which he addressed at the International Colloquium on Infinite and Finite Sets in Keszthely, Hungary, 1973. It is an attempt to arouse interest among his colleagues for a subject which was novel and not immediately attractive for set theorists. Therefore, it has an expository, informal character. De Bruijn makes a plea for a general type theory, “(also applicable] to cases where the objects to be discussed are not sets”. He introduces the E-notation for the meta-relation “... has type ...” (cf. [ A . 3 ] ) .He explains that AE B can mean other things than A is a member of B, for example: A is a proof for B, or A is the description of a geometrical construction for something expressed by B. He warns the reader that “B is completely determined b y A”, hence one should not confuse E with the membership symbol E. Next, he explains the use of the type-theoretical framework for e.g. axioms, propositions, the introduction of variables and assumptions. (“There is a slightly unfamiliar feature: most mathematicians have not got used to giving names to proofs And after that he touches on the characteristic elements of Automath, including the lambda calculus aspects. He opposes some aspects of the usual set theory (for example of the Zermelo-Fraenkel type) to the Automath approach. Finally, de Bruijn explains why a more liberal (higher order) typing is desirable.

[..I”.)

F.2. N.G. de Bruijn: Formalization of constructivity in Automath In the previous paper, de Bruijn already mentioned a remarkable interpretation of the typing relation, other than the two usual ones: ‘being a member of’ and ‘being a proof of’. In this paper he discusses this third interpretation: ‘being a geometrical construction for’.

Survey of the contents

51

In Section 1, de Bruijn gives a noteworthy argument for the uniform treatment of the first two interpretations: “the substitution machinery is the same for both”. An object dependent on parameters (variables for objects) and a theorem dependent on parameters (assumptions) are both usable by the technique of giving appropriate substitutions for the parameters. These things are even interwoven: “we see that s o m e of the parameters are object-like, and others are proof-like” . The main subject of the paper is the usability of Automath,for describing geometrical constructions. Here, too, substitutions for parameters play a n important role. De Bruijn discusses several specific problems connected with the formalization of these constructions, such as constructibility (of a geometrical object), obseruability (“does the point lie inside or outside the circle?”) and selectability (“take one of the intersection points of the two circles”). In the paper he explains how these matters can obtain a solution in a n Automath setting. He warns that geometry is “ n o t the easiest example for the study of constructions”. In particular, the notion ‘arbitrary’ is rather vague: “If one took a n arbitrary point and a n arbitrary line then the point should n o t be so arbitrary t o lie accidentally o n the line!”. The paper concludes with a short comparison of this approach to geometrical constructions with the semantics of computer programs. De Bruijn mentions a number of correspondences between the two disciplines: the constructive nature of the respective activities, the importance of having proofs concerning the obtained results of the activities (in particular that the specifications are complied with) before a new step is taken and the roles that subroutines play in the constructive process. The subject ‘semantics of computer programs’ is reconsidered in the papers [F.4] and [ F . 5 ] .

F.3. N.G. de Bruijn: The Mathematical Vernacular, a language for mathematics with typed sets An underlying source for de Bruijn’s investigations in mathematical languages like the Automath family, has always been his discontent with the traditional Zermelo-Fraenkel-based set theory. In doing his daily mathematical work, he was always aware of the fact that the usual style of going about with mathematical theories and proofs was an activity with its own rules and manners, fully independent of the ZF-axioms. The early Automath work was, in a way, an attempt to formalize this everyday behaviour of himself and his colleagues. Of course, de Bruijn realized from the beginning that the extreme precision of the Automath languages was too much of a good thing for the average practitioner of mathematics. Therefore, he was always interested in an intermediate stage, “between ordinary mathematical presentation [...] and fully coded presentation in Automath-like systems”. Starting around 1978, he developed a special

52

R.P. Nederpelt and J.H. Geuvers

language for this purpose, which he baptized Mathematical Vernacular (MV). In his own words: ‘IMV is] the very precise mixture of words and formulas used b y mathematicians an their better moments”. It has always been his conviction that such an MV would describe more adequately how people think, which in particular would be of value for mathematical education. In this paper he focuses on a formalizable fragment of the rather complicated language which “mathematicians use to convince each other”. He gives a list of rules for the formation of mathematical “sentences”, in particular useful for the usual manipulation of axioms, definitions, theorems and proofs. MV permits rather big steps, where the intermediate justification need not be given. Only the essential information should be written in MV, just as is normal in the current style of exposition. De Bruijn restricts his MV essentially t o three grammatical categories: the sentence, the substantive and the name. Examples are, respectively: ‘5 is a real number’, ‘real number’ and ‘5’. Adjectives are used to make new substantives from old ones, as in the transition from ‘triangle’ to ‘isosceles triangle’. He makes a fundamental distinction between a substantive, and a name describing the corresponding type. For example, ‘real number’ is a substantive, usable in the sentence ‘5 is a real number’. But the name R for the set of the real numbers plays another role: one cannot say ‘5 is an P. De Bruijn uses the special typing symbol ‘:’ for the first case: ‘5 : real number’, as opposed to the ‘E’ in ‘5 E 8’.(Hence, this usage of ‘:’ is different from the formal relation ‘:’ in statements in type theory, as in ‘a : A’.) In the paper he makes a precise distinction between different language levels. For example, he also introduces a ‘meta-typing’, denoted with a double colon: ‘real number :: substantive’. First he introduces his MV-language, “the general framework of organization of mathematical texts”, next the rules about validity. He pays attention to the contextual structure of MV ‘books’, in the flagstaff form introduced in the early Automath phase (see also [A.1], [A.8], [Fitch 521 and [Nederpelt 871). The influence of Automath is noticeable throughout this paper, albeit that the goals are not the same. A difference is, for example, that equality is treated in its own right, so that the practical difficulties connected with equational reasoning in the Automath languages are avoided. These ideas are elucidated with an example taken from an earlier version (1982) of this paper. In the example a number of logical and set-theoretical notions are introduced, with the appropriate definitions and axioms and a few proved theorems. It ends with the Peano axioms for natural numbers and the beginning of Hilbert’s axiomatization of geometry. The example is followed by an extensive commentary.

Survey of the contents

53

F.4. R.M.A. Wieringa: Relational semantics in an integrated system In this paper, prepared in 1980, Wieringa shows how the Automath format can be used for the description of the syntax and the semantics of computer programs. The programming language is supposed to be ALGOL-gO-like, hence block-structured, allowing declarations of variables and their types and with sequentially ordered statements for assignments t o variables. The semantics is designed for the establishment of program correctness. Wieringa uses relational semantics, describing the relation between initial and final state of a program. The semantics deals with incomplete information. The attempt made in this short, introductory paper is t o use Automath for the mentioned purposes, and also for the usual purpose: in the formalization of mathematical reasoning. So Automath-like constructs are employed 0

for logic and mathematics,

0

for the syntax of the programming language and

0

for its semantics.

These ideas are due to de Bruijn, and were formerly published in unofficial reports ([de Bruijn 73d], [de Bruijn 75bl). Wieringa defines the state of a program as a function giving for each data type (like bool, i n t ) a stack of elements of that datatype. In this setting he gives examples of a few program primitives, like assignment, selection, sequential composition and block structure, in an Automath-like style. Next, he uses the same style for a description of the relational semantics for these primitives.

F.5. N.G. de Bruijn: Computer program semantics in space and time De Bruijn extends the relational semantics described in [F.4] with a time space T attached to the state space. He takes T to be discrete, viz. 2 U {co}, with addition and order. The discrete timing is meant to deal with recursion, the main subject of this paper. The element 00 represents non-termination. t’), Changes in the extended state space are formalized as quadruples (w, t , w’, with w and w’ in the state space and t and t‘ in T , where t < t’. Semantic information is described by predicates on the set of such quadruples. These predicates represent “an m o u n t of information” , where more information means smaller predicates. (The “biggest” predicate TRUE gives no information at all.) Given a program x, the ideal situation is that we can find the predicate Totinf (x),giving all the information about x. That is: the quadruple (w, t , w‘, t‘) satisfies Totinf(x) iff there is an execution of x leading from initial state (w, t ) t o final state (w’, t’). Usually, it suffices to find a weaker predicate R such that Totinf (x)C R. In fact, the standard situation is the other way round: given a so-called specafication R, find a program x satisfying R.

54

R.P. Nederpelt and J.H. Geuvers

First, de Bruijn formulates the semantics of a number of primitive program constructs, such as ‘skip’, ‘non-termination’ and ‘assignment’. Next, he does the same for sequential composition (‘concatenation’) and selection (‘if-then-else’). As other program constructs, which provide examples for his approach to the semantics of recursion, he considers procedures and the while-statement, and proves theorems concerning the ‘partial correctness’ and the ‘total correctness’ for these semantics. Section 8 acts as an interlude, in which de Bruijn opposes the notions of syntax and semantics, and makes a comparison between the relevance of these two notions for a time-honoured subject such as geometrical constructions (see also [ F . 2 ] )versus their roles in computer science. In Section 9 he discusses the relation of his semantics with fixed point semantics. De Bruijn ends the paper with a comment on program abortion.

PART A Motivation and Exposit ion

This Page Intentionally Left Blank

57

Verification of Mat hematical Proofs by a Computer A preparatory study for a project Automath

N.G. de Bruijn

1. INTRODUCTION The Automath can become an automaton that turns out mathematical theorems in perfect form, with complete proof, provided that it is constantly prompted by a mathematician. The kind of man-machine co-operation needed for this situation can be illustrated suitably by comparing it t o operating an automobile. It can be expected that the Automath can be realized inside existing computers. We can distinguish four stages in working with Automath. (1) C, the creative mathematician, creates something. He writes it down in a style that is clear to himself (or did that long ago). Possibly he has overlooked a number of important details entirely. Filling those gaps often requires much less creativity than the main job did (but sometimes much more!). (2) R, the reproductive competent mathematician, formulates theorem and proof in a way that is absolutely flawless for the modern mathematician. He has to be well-acquainted with the area, including some of its background. And he should be skilled in axiomatics too. (3) P, the mathematical programmer, translates his predecessor’s text into a number of statements which are digestible for the Automath. He does not necessarily have to understand the mathematical content, but he should be well-trained in handling mathematical patterns of reasoning as well as in handling the codes of Automath. And he should have enough experience for filling the little gaps that R has still left.

(4) A, the Automath, considers P’s statements as hints for the construction of a perfect text. P’s hints will be accepted by A only if A recognizes them as steps allowed by A’s standards. All what A does is perfect. Whether A’s

58

N.G. de Bruijn production is interesting or relevant depends completely on C, R and P. If all ends well, then A has produced what R intended. Whether that is also what C meant is usually difficult t o trace.

The Automath forces us to a final and merciless check of all mathematical texts that we wish to submit to it. Already before it starts its work, it has its influence on the behaviour of the mathematician. The Automath might play an important r61e in the communication among mathematicians, in particular in the publication system. A long proof with lots of uninteresting details might get its ultimate formulation in Automath code. And then its correctness will not just be a matter of confidence like so often in our present world; it can be established beyond any doubt, and whenever one wants. What Automath has to do is quite impressive in comparison to the size of the original text. It is like a n iceberg in the sense that only a relatively small part is visible. That part consists of the coded statements we offer. What Automath does with them remains invisible. By way of illustration we shall give a simple theorem on equivalence classes in Section 4. The first stage was written by C (judging by the style it seems to have been done around 1930). R made the second stage, and possibly also the list in the columns ELABORATED in the third stage. P writes the column CALLS, as well as the expressions as far as they have been introduced by CALLS (see the arrows). And A writes the rest of the expressions, takes care of the stack, writes the column PROOF, also the column ELABORATED, if we wish, and carries the full responsibility. Usually R will have the hardest job of all, since published mathematical work can be full of gaps. But his attempts to get to the most suitable form for P, might often have the positive side-effect of clarifying the first stage. Without a substantial amount of experience the work will be very timeconsuming both for R and for P. One might compare it to learning to write mathematical texts in Chinese. After a long period of learning it will become just as easy as in the mother’s tongue. But there is an advantage that appears at once: writing in the foreign language forces us to be very clear in organizing our ideas.

2. IDENTIFIERS AND EXPRESSIONS

Identifiers. We distinguish three kinds: variables, bound variables and constunts. The bound variables are chosen by the Automath itself; it does not even

Verification of mathematical proofs by a computer (A.l)

59

mention the choices it made. The constants are chosen by the user. They will be introduced by means of OnAll and OnEx. The variables indicate the substitution places in expressions; the user can choose identifiers for them in cases where he defines the expressions himself, the Automath can modify them at will. Note that in the following line (representing the definition of an expression)

ezpr 225(z, y, z ) := ( e z p r 127(z,y)) n t

,

the identifiers z, y, z are variables both in the left-hand and the right-hand side, but that they are bound variables in the formula as a whole.

Expressions. Every variable is an expression. Furthermore, there is a list with a number of primitive expressions, like z n y, z = y, z E y. Using expressions we can form new expressions by means of substitution of expressions for variables. Example: from 1(z,y), 2(u, v), 3 ( p , q ) we can build 4('L1, v , p , q ) := 1(2(%v), 3 ( P , q ) )

'

Another way t o build new expressions is by quantification. Examples 6(z,y,z) := VtlEs5(u,y,z)

8(z,y1.1

:=

1.

1

E 5 I 7(u, Y, 2))

There are three types of expressions: element, set and boolean. For every expression its type has to be indicated somehow, as well as the types of its variables. In case of substitution and quantification specific rules concerning those types are to be issued. For example, in z E y we may substitute for z either an element expression or a set expression, for y a set expression only, and the result of the substitution is a boolean.

Saturated expressions arise from ordinary expressions if we replace every variable by a constant. And recursively, we get saturated expressions if in an ordinary expression we replace all variables by saturated expressions. Every line in a proof is a saturated expression. One can also admit semi-saturated expressions (where only some of the variables are replaced by constants). These can be used only at places where the remaining variables are valid.

3. BRIEF DESCRIPTION OF SOME ELEMENTARY OPERATIONS 3.1. Generalities

The rules will be given for building formula number (k). A formula ( 1 ) is

N.G. de Bruijn

60

called valid if 1 < k, provided that between ( 1 ) and ( k ) no operations of the type OffAll, OffEx, KillEx, OffAss have been carried out. An identifier is called a constant if it had been introduced prior to ( k ) by means of OnAll or OnEx, and has not been dismissed meanwhile by OffAll, O m x or KillEx. All the time the Automath sees t o it that bound variables are replaced by identifiers which are different from the variables introduced by the user, and if necessary it will replace the user's bound variables by new identifiers. The user need not know those identifiers. Many of the rules mentioned below are to be called by means of just a single formula number in parentheses. Often we can agree to omit that reference if it is just ( k - 1).

3.2. Stack operations (macro-operations)

OnAll(a,2). The Automath establishes that 2 is a well-formed set expression in which only valid identifiers occur. It writes on top of the stack (a,V, ( k ) ) and writes as formula

OffAll a. The Automath establishes that the stack contains some ( a , V , ( l ) ) with 1 < k, that above this point there are nothing but ( ,V, ( ))%,and that the latter ( ,V, ( ))'s had not been introduced previously by means of set expressions containing a . It now cancels (a,V, ( I ) ) from the stack and writes

where Z is the content of ( k - 1) with a replaced by y (y being a n available identifier), and X is the right-hand side of formula ( 1 ) .

SaveAll a. Just like OffAll a, but now without cancelling (a,V, ( I ) ) from the stack. OnEx a. The Automath notes that ( k - 1) has the form 3 y EB~( y , . . .). It puts (a,3, ( k ) ) on top of the stack and writes aEX B(a,. . .)

(k) I (k

+ 1) .

In cases where that ( k - 1) was nothing but 3 y E ~it omits that line ( k

+ 1).

Verification of mathematical proofs by a computer ( A . l )

61

O m x a. The Automath establishes that the stack contains a triple (a, 3, ( l ) ) , that above it the stack contains no identifiers introduced by means of set expressions containing a, and that above it the stack contains no assumptions containing a. It now cancels (a,3, ( 1 ) ) from the stack and writes %EX

(2)

(k)

where Z is the content of (Ic - 1) with a replaced by y, and X the right-hand side of (1).

SaveEx

a. Just like OffEx a, but now without canceling the (a, 3, ( 1 ) ) from

the stack.

KillEx a. Just like OffEx a, but the Automath notes that 2 does not contain the identifier a and writes 2

(k) ,

OnAss 2. The Automath notes that Z is a boolean expression containing constants only. It puts A s s ( k ) on top of the stack and writes 2

(k) .

OffAss(k). The Automath finds Ass(l) on top of the stack, notes that formula ( k - 1) reads Y ,that ( 1 ) reads 2, it cancels Ass(1) from the top of the stack and writes

3.3. Micro-operations 3.3.1. Various operations with wide scope Subst (j)with ( l ) , (s), ( t ) (not just three, but arbitrary many formula numbers are allowed). The Automath establishes that ( 1 ) , (s), ( t ) are valid, and read, respectively, 21 E 5’1,22 E S2, 2 3 E S3 (the xi’s and Si’s are expressions), that (j)is valid and starts with v a € S ~VbESz VcESs

it copies formula (j),omitting the three V’s, and replacing a, b, c, by it writes the result as formula ( k ) .

2 1 , 22, 2 3 ;

N.G. de Bruijn

62

String ( I ) , ( m ) (, p ) . The Automath notices that (I), ( m ) , ( p ) are valid formulas of the type a € b, a c b, a = b that can be linked like a E b, b C c, c = d which have as result a E d. It now writes the result as formula (Ic). Reverse ( I ) . If ( I ) holds, and reads one of a c b, a 3 b, a = b, a V b, a A b then the Automath writes as formula (Ic) the corresponding formula from the sequence b 3 a, b c a, b = a, b V a, b A a. Calls of the type “exprdef”. With these calls the user introduces new expressions by means of substitution or quantification. The Automath accepts them only after checking the subexpressions involved, but does not object to the introduction of earlier defined expressions with a new number. Example exprdef e z p r 1 6 ( z , y, z ) = e z p r 2 ( e z p r 3 ( z ,y), 2) , exprdef ezpr18(z, y, w)= ezpr2(ezpr3(z1y), w), exprdef ezpr19(z,y, z ) = e z p r 2 ( e z p r 3 ( z ,y), z )

.

.

Calls of the type “exprequal” Example: exprewal ezp7-7(2,Y,2) ,a, ( I ) , ( m ) produces

ezpr7(a, U , P ) = ezpr7(a,V,Q ) if a is a valid idcntifier, ( 1 ) is the valid formula U = V , and ( m )the valid formula P = Q. The Automath watches the types.

Calls of the type “tautsubst”. There is a list of tautologies (possibly authorized by the Automath). For example, it might contain Tautology 24(a, b ) := ( a n b ) c a If z and y are constants, then the call tautsubst 24(ezpr 1 6 ( z ,y), ezpr 2 4 ( z , y)) will produce (after type check)

( e v W ,9)) n (ezpr2 4 ( z ,Y))

c

ezpr W z ,Y)

3.3.2. General remark concerning the derivation rules Rule 1,.. . Each call will involve one or more formula numbers. The Automath notes that these numbers are still valid and that they have the form required for those

Verification of mathematical proofs by a computer (A.1)

63

derivation rules. In some cases such a rule will contain some expression twice (like S in rule 4). The Automath then has to check that the two expressions it is supposed to substitute are essentially equal. This may mean that it has to dig into the definitions of those expressions until it turns out that they are identical indeed. The rules mentioned here have the arbitrary order in which they turned up in examples.

Rule 1 (1).

Z#@

(1)

4EZ

(k)

where y is a new identifier.

Rule 2 (1).

Rule 3 ( 1 ) .

Rule 4 ( l ) , ( m ) .

Rule 7 ( 1 ) , ( m ) .

X E A ~ B X E A

(1)

(k)

64

Rule 8 ( I ) , ( m ) .

Rule 9 ( I ) ,( m ) .

Rule 10 ( l ) , ( m ) .

Rule 11 ( I ) .

Rule 12 ( I ) .

Rule 13 ( I ) .

Rule 14 (I), (m).

Rule 15 ( I ) .

Rule 16 ( I ) , (m).

Rule 17 ( I ) .

N.G. de Bruijn

Verification of mathematical proofs by a computer (A.l)

65

Rule 19 ( l ) , (m),(n).

4. ELABORATED EXAMPLE 4.1. First stage

Definition. A relation = on a set A is called an equivalence relation if it is reflexive, symmetric and transitive, i.e., if (a) x 3 z for all z E A , (b) if z = y then also y = z, (c) if z = y and y = z then also x

= z.

Definition. A subset u of A is called an equivalence class if cr consists of all elements of A which are equivalent to one particular element. Theorem. T h e equivalence classes are mutually disjoint. It is even true that for two different equivalence classes all elements of the one are inequivalent t o all elements of the other one. Proof. Let u be the set of all elements equivalent to u,and T the one of all elements equivalent to v. Assume that z E cr, y E T , z = y. Then we have u = z, z = y, y = v (according to (a) there is no difference between u E 2 and z 3 u,etc.). From (c) it follows that u E v. In the same way it turns out that every element equivalent to u is equivalent to v as well, and the other way around. It follows that cr = T , so we have proved the second statement. The 0 first one now follows at once. 4.2. Second stage

Preliminary remarks. The relation = can be described as the set of all pairs

N.G. de Bruijn

66

[a,bl with a E A , b E B, a = 6. We call this set S . It is a subset of A x B. The set of all equivalence classes is called T . In order t o avoid complications in connection with the admissability of definitions, we act as if T is a given set satisfying (3) below. We note that a careful analysis of the proof pays 0% it turns out that the assumption of reflexivity is superfluous. It is not hard to see that we neither have to require that S c A x A . Type declarations. A , S, T are sets.

Assumptions.

Assert ions. V ~ E T V T E T#( ~

*

*

0

V ~ E T ' ~ ~ #E 7T ( ~(

nT

= 0)

,

~1 @ s)).

V ~ E ~ ~ Y[z, E T

Proof. Let (T E TI T E T . There exist a E A and b E A such that is the set of all y E A with [a,yl E S , and T the set of all y E A with [b,yl E S. Suppose that u n T # 0. Then there is an z E u n T , whence z E u, z E T . From z E u we infer that z E A , [a,zl E S. Likewise we conclude from z E T that [b, z1 E S. According to (1) we also have [z, a1 E S. From [b, z1 E S , [z, a1 E S we conclude [b, a1 E S, using (2). For every u E o we have u E A , [a, u1 E S . From this and [b, a1 E S we infer (again using (2)) that rb,u] E S. And from u E A , [b,u] E S we conclude that uE

7.

For every u E T we have u E A , [b,u] E S . We already obtained that [b, a1 E S, so by (1) we get [a, b] E S . From [a, bl E S and [b, ul E S we derive (again by (2)) that [a, u1 E S . And from u E A , [a, u1 E S we conclude that u E u. So it has been proved that for all u E (T we have u E T , and conversely. Therefore u = T . So u n T # 8 implies u = T , which proves the first assertion. Next we start from the assumption u # T . It follows from the above that now u n T = 0. Take some z E u and some y E T , and assume that [z, y1 E S . We shall derive a contradiction.

Verification of mathematical proofs by a computer ( A . l )

67

Since x E u we have x E A , [a,xl E S, and since y E r we have y E A , rb,yl E S. From [a,xl E S and rx,yl E S it follows that ra,y1 E S (according to (2)). Therefore y E u. But we had y E r , so y E n r. This contradicts

~ n ~ = 0 .

0

4.3. Third stage The third stage is given in the tables below. It follows the second stage step by step. This third stage has a stack structure, but that is not an essential difference between the second and the third stage. It would have been easy to impose that structure on the second stage too, with a definite gain in readability. The A , S, T are valid all through the argument. For the sake of clarity they are omitted from the stack. One might also put the assumptions (l),(2), (3) on the stack with OnAss, and discharge them after (71) and (72). It would have the effect that the final conclusion would have the form of an implication, and that there would be no assumptions at all.

CALLS

EXPRESSIONS

PROOF

expr. ~ ( z , Y ) expr. 2(l,Y) expr. 3(+,Y) expr. 4(2) expr. 5 expr. 6 ( r ,Y, 2) expr. 7 ( 1 ,Y, 2) expr. 8 ( l , Y ) expr. 9(z) expr. 10

datum expr. 5

datum 5

datum expr. 10

datum 10

expr. ll(s)

t

expr. 12(2, u)

t

11(r) := {y E A 12(q y)} 1 2 ( z , a ) := a = 11(z)

expr. 13(u)

t

1 3 ( ~:= ) 3

expr. 14

+

14:=P(A)

z 12(2, ~ u) ~

expr. 15

15 := {a E 14 113(a)}

datum expr. 16

1 6 : = T = 15

datum 16

ELABORATED

EXPRESSIONS

CALLS OnAll

T)

(0,

101(u) := E ( U , 15)

String (4143) OnAll (T,T)

201(u) := €(a, 15)

String (6),(3) Rule 5 (5),(3) OnEx a Rule 5 (7),(3) OnEx b expr. 17(X,p ) . expr. 18(X,p) -

1

17(A,p) := Anp 18(X,p) := 17(X,p) # 0

OnAss 18(u,r) Rule 1

102(kp) := 3uE17(A,p)

OnEx x Rule 2 Rule 4 (17),(10)

103(X,p,x) := €(I,17(X,t())

Rule 3 (16) Rule 5 (20),(13)

s 3 ln 'sl v s 3 ln 'uJ s 3 ln'ul

(z'fi)zv(fi'x)z =: (Z'fi'Z)9ZI

S S ) 'A ' n

LZ) 'A

CALLS

EXPRESSIONS

STACK

PROOF

u r a b (:14)

Subst. (2) with (9)7(12),(36) Rule 7 (41),(40)

Rule 6 (10),(42),(36) OffAll u

Rule 9 (34),(33) KillEx x OffAss (14) Rule 12

OnAss 19 ( u , T ) Rule 7 (48),(49) OnAll (x,u) Rule 4 (51),( 10) OnAll (y, T ) Rule 4 (54),(13) OnAss 2(x, y)

ELABORATED

NR.

x u

L Ond(49)

x,'d, (51)

Y, 'd, (54)

Ond(57) I

(42) (43) 'd"uE7 u E U = T

U = T

(u n T

# 0) + (u = T )

CALLS

1

EXPRESSIONS

Rule 8 (53),(57) Subst. (2) with

1

136(x, y, z ) := 2(z,y) A 2(y, z )

STACK

ELABORATED

(58) (59)

(9),(52),(55)

Rule 7 (59),(58) Rule 6 (10),(60),(55)

Rule 10 (61),(54)

117(X, p ) := X

np

118(A,p,x) := z E 117(X,p)

SaveEx y Rule 13 Rule 14 (50),(64) ORASS (57) Rule 11 OffAll y, OffAll x, OffAss (49)

NR.

119(X, p ) := 3,Ex 118(X, p , X) 12O(X,p) := 117(X,p) # 0 121(x, y) := 2(z, y)

+ contr.

122(1, y) := 72(2, y) 1 2 3 ( ~ , ~:= ) VydyEP122(2, y) 124(X, p ) := V,Ex

123(x, p )

125(A,p) := 19(X,p)

+ 124(X,p)

125(u,r) 125(u, T ) 109(u, r )

127(X) := V,ET

109(X,p)

128 := VXET 127(X)

128

130

73

The Mat hemat ical Language Automath, its Usage, and Some of its Extensions* N.G. de Bruijn

1. INTRODUCTION

1.1. Automath is a language which we claim to be suitable for expressing very large parts of mathematics, in such a way that the correctness of the mathematical contents is guaranteed as long as the rules of grammar are obeyed. Since the notions “mathematics1’and “expressing” are rather vague, we had better discuss a specific example. Assume we have a very elaborate textbook on complex function theory presenting everything from scratch. That is, we start with chapters on logic and inference rules, set theory, the number systems, some geometry, some topology, some algebra, and we never use anything that is not derived, unless it has been explicitly stated as an axiom. Assume the book has been most meticuously written, without leaving a single gap. Then we claim it is possible to translate this text line by line into Automath. The grammatical correctness of this new text can be checked by a computer, and that can be considered as a final complete check of the given piece of mathematics. Moreover we claim that it is possible to do so in practice. The line by line translation will be a matter of routine; the main difficulty lies in the detailed presentation of such a large piece of mathematics. The mere labour involved in the translation will not increase if we proceed further into mathematics.

1.2. Automath was developed in 1967-1968 at the Eindhoven University of Technology, The Netherlands. The author is indebted to Mr. L.S. van Benthem Jutting for very valuable help in trying out the language in several parts of mathematics, and both t o him and t o Mr. L.G.F.C. van Bree for their assistance with the programming (in ALGOL) of processors by means of which books written in Automath can be checked. In particular, Mr. Jutting is currently translating Landau’s “Grundlagen der Analysis”. *Reprinted from: Laudet, M., Lacombe, D. and Schuetzenberger, M., eds., Symposium on Automatic Demonstration, p. 29-61, by courtesy of Springer-Verlag, Heidelberg.

74

N.G. de Bruijn

1.3. In this paper we shall not attempt a complete formal definition of Automath, for which we refer to [de Bruijn 68b]. Nevertheless we hope t o make the language intuitively clear in this paper. After all, the author feels that very little is essentially new in Automath, that it is very close to the way mathematicians have always been writing, and that the abbreviating system used in Automath has been taken from existing mathematical habits. But the way we handle propositions and assertions will be novel, among other things. 1.4. One of the principles of the language is that the reader (be it a human being or a computer) never has t o search in the previous text for definitions or arguments. The text presented t o him tells him precisely where to find information needed for checking that text.

1.5. We indicate the possibility of building languages defined in terms of Automath but adapted to special purposes (superimposed languages, see Sec. 10). This is one of the reasons for keeping Automath as primitive as possible. Actually it is little more than what might be called the art of substitution. Automath has an even more primitive sub-language PAL (see Sec. 4), but PAL is definitely too primitive to deal with things like predicates, quantifiers and functions. As a preliminary, we shall introduce a simple language SEMIPAL, which is not a sublanguage of PAL.

1.6. An Automath book is a sequence of lines written according t o the rules of grammar. An important feature is that things which have been derived in a book (e.g. inference rules, definitions, theorems) can be applied later in that same book. It turns out to be possible that even very primitive parts of mathematical logic can be explained in that book, and therefore it is unnecessary to feed that kind of logic into the grammar.

1.7. There is one vital thing that we do not attempt t o formalize: the interpretation. When reading or writing a book in a formal language like Automath, we try t o be constantly aware of the relation between the text and the (mathematical or non-mathematical) objects we imagine that the text refers to. It is in this sense that many words occurring in the book (identifiers) are names of the objects outside. The book itself deals with names only. There may be several different interpretations, and there seems to be no way to discuss these interpretations in the book.

The mathematical language Automath (A.2)

75

2. PRELIMINARY DESCRIPTION OF THE LANGUAGE

2.1. An Automath book is written in lines. Everything we say is said in a certain context; we shall attach a context indicator (or indicator for short) to every line. Usually the context structure can be described by a set of nested blocks (see 3.10), such as in a system of natural deduction. Lines written in a block have a kind of validity inside that block. The context structure will make it possible to express a certain functional relationship. On top of that we have another way of dealing with functions: something that is essentially Church’s lambda conversion calculus. Although these two features do not make each other entirely superfluous, they create a certain abundancy in the language. By virtue of this abundancy, many things can be written in various ways. One might experience this as a drawback, but, on the other hand, it gives something of the flexibility of every-day mathematical language. 2.2. In every line a new name (an identifier) is introduced. It is very essential that to every identifier a category is attached. In every-day language this amounts to stating what kind of a thing we are talking about. For example, we might introduce the identifier “two” and say that its category is “integer”. We shall not admit that “two” has several categories simultaneously. This may have the drawback that we have to invent different notations for the integer 2 and the complex number 2. Accordingly, we have to express ourselves by means of one-to-one mappings of the integers into the complex numbers, instead of care-free identification. (We should not forget that care-free identification is a matter of tradition. The average mathematician is not inclined to identify a unit matrix with the number 1, but he identifies all 1’s he knows as long as they belong to one of the “number systems”.)

In connection with the above example we remark that it is by no means necessary to write mathematics in such a way that “two” has the category “integer”. Another possibility, as well rooted in existing habits as the previous one, is to write that both “two” and “integer” have the category “object”, and t o add that “two E integer” is a true statement. If we do this, there is no harm in saying that “two E complex number” is also true.

2.3. It will be possible to introduce new categories. For this purpose we use the special symbol type. For example, we may introduce the identifier “integer” and attach the category type to it. This will have the consequence that later in the text (at least in the context where “integer” was introduced) we have the right to use “integer” as the category of an identifier.

N.G. de Bruijn

76

2.4. Another feature of Automath is an abbreviation system which is essentially taken from existing conventions in mathematics; this can make the labour of writing and reading bearable, especially if we select suggestive identifiers for all notions introduced in the book. In essence, this abbreviation system occurs already in SEMIPAL.

3. STRUCTURE O F THE LINES

3.1. A line consists of 4 parts: (i)

an indicator,

(ii) an identifier, (iii) a definition, (iv) a category.

3.2. In every line the identifier part (ii) is a symbol that has not been used in previous lines. (This stipulation is unusual in every-day mathematics: a symbol like 2 is used repeatedly in different senses. But assuming we have infinitely many symbols available, it would do no harm to replace all these 2’s by different symbols whenever necessary.) An identifier used as identifier part of a line will be called a proper identifier. There is a second kind of identifiers: those that play the rBle of bound variable. Again, in constrast with existing habits we shall use each bound variable only once, and a bound variable has to be different from previously introduced proper identifiers. There are three kinds of proper identifiers: block openers, primitive notions, and compound notions. This depends on the definition part of the line. If the definition part is -, then the identifier part is called a block opener (or “free variable”). If the definition part is PN, then the identifier part is called a primitive notion. If the definition part is an expression (see Sec. 3.3), then the identifier part is called a compound notion. There is a second classification of identifiers, which bears no relation to the classification above. Some identifiers are object names, others are types. An identifier is a type if and only if it is the identifier part of a line whose category is type. All other identifiers (including bound variables) are called object names. 3.3. The definition part of a line is either an expression or one of the symbols PN or -. If the definition part is an expression, that expression is composed of

The mathematical language Automath (A.2)

(i)

77

proper identifiers of previous lines;

(ii) bound variables; (iii) the symbols

?

)

(

0

[

1

which are used as :par tion marks. 3.4. The category part of a line is either the symbol type or an expression. If

it is an expression, we can say the same things as in 3.3. 3.5. The indicator part of a line is either the symbol 0 or a block opener introduced in a previous line. The indicator is used in order to describe context.

3.6. A book is organized as a string of lines, but the context indicators induce a second structure in the form of a rooted oriented tree. The root is the symbol 0, the other vertices are the identifiers of the lines of the book. The edges are all oriented towards the root. The edge starting at the identifier x points to the indicator of the line that has x as its identifier part.

3.7. As an example we take the following book: indicator 0 0 0

identifier a

definition PN

X

-

b

....

X

C

PN

X

Y

Y Y

-

d

0

e

.... ....

X

W

-

W

f

Y

9

.... ....

z

category

type

.... ....

type type

.... .... .... ....

type

....

In this example we have written .... in order to suppress expressions we do not intend to discuss at this moment. (So "...." is not a symbol used in Automath, but in our discussion about Automath.) In this example x, Y, z , w are block openers, a and c are primitive notions, b, d, e, f , g are compound notions.

N.G. de Bruijn

78

The tree of this book is

C

0 Figure 1

3.8. It has to be remarked that the tree is a combinatorial thing, and that the way it is drawn in a plane is quite irrelevant. Note that the primitive notions and the compound notions are end-points of the tree. The block openers are usually not end-points. To every point # 0 of the tree we can attach the definition part and the category part of the line of which that point is the identifier part. If we do this, the tree contains all the information of the book, and can be referred to as the tree of knowledge. But one thing the tree does not reveal: it does not show the order of the lines in the book. If we want to know whether the tree is grammatically correct, it is useful to know the order of the lines. Given the set of lines of a valid book, there may be several ways t o arrange them. The only condition an arrangement has to satisfy is that no expression occurring in a line contains identifiers of later lines. All such arrangements produce legitimate books. Anyway, if we want to extend the book by a further line then the order of the previous lines is irrelevant. At that moment, it is only the tree of knowledge that counts.

3.9. If p is a point of an oriented rooted tree, different from the root, then we can consider the subtree of all those points of the tree for which the oriented path to the root passes through p ( p itself is the root of the subtree). In the case of our tree of knowledge, we shall refer to these subtrees as blocks. In the tree of 3.7, the point x determines the block containing x, c, y, z , d , w , f , g ; the block opener of that block is 2.

3.10. Quite often a book has been written in an order that makes the block structure immediately clear. This is the case if every block consists of a set of

The mathematical language Automath (A.2)

79

consecutive lines. In this case we shall say we have a nested book. (We remark that it is not always possible to transform a correct book into a correct nested book simply by rearrangements of the lines. In order to get a nested book we might have to duplicate pieces of the text.) In a nested book we can indicate the block structure by means of vertical bars in front of the lines. Corresponding to each block we draw a vertical line spanning all lines belonging to the block. We agree that if block B is contained in block A , then the line for B is drawn t o the right of the line for A . Once the lines have been drawn, the indicators can be omitted since they can be retraced. In the example below we present a nested book twice, once with indicators, once with bars. The version with the bars is certainly more readable for the human mathematician. A computer will of course prefer the one with the indicators. -

~

a

PN

5

-

a,

-

type type

.... ....

b

....

t

-

....

C

PN

....

W

-

....

d

....

....

-

a

PN

type

-

type

y

:= := :=

b

:=

2

:= := :=

PN

:=

........

x

c

w d

.... ........ -

-

.... .... ....

As in this example we shall always separate identifier part and definition part by the symbol := which suggests that the identifier on the left is defined by the expression on the right. Needless to say, the vertical bars and the symbol := do not belong to the language. They are just devices for easier reading. Quite often we shall print both the vertical bars and the indicators.

3.11. Sometimes we shall talk about the indicator string of a line. If the indicator is 0, the indicator string is empty. In all other cases the indicator string describes the reversed path from the indicator in question to the root of the tree (excluding the root). For example, the indicator string of the last line in the example of 3.7 is (x,y), the one of the last line in the example of 3.10 is (x,z, w).

4. HOW TO WRITE PAL 4.1. PAL is a sublanguage of Automath, in the sense that every correct PAL book is also a correct Automath book. PAL is quite easy to learn. In PAL we d o not use the lambda conversion, and we have no bound variables.

N.G. de Bruijn

80

Let us take an example. At this stage the reader must not expect an example with deep mathematical significance, since that would require quite a long book. The interpretation we have in mind is this one: Assume that nat (natural number) and real (real number) are available as categories. If a and b are given reals, then their product is introduced as a primitive notion. If n is a natural number and 2 is a real, then the power xn is introduced as a primitive notion. If n is a natural number and y is a real number, then we define d ( y ) := y n ; e(Y) := 4 Y ) * Y (= yn+% f ( Y ) := 4 Y ) . 4 Y ) (= Y 2 9 d Y ) := e ( d ( y ) ) (= Y ~ ( ~ + ' ) In ) . PAL this can be written as follows:

0

a b

1

.-..-.!rod

!1

power Y d e

f 9

-

-

:=

PN

.-.-

-

..:=

-

PN

.-.-

-

:= :=

.-

power(n,y) prod(d,y) prod(d,d)

:=

e(d)

real real real

3 4

nat real real

6 7 8

real real real real real

10 11 12 13

5

9

This happens to be a nested book in the sense of 3.10, but that does not have any consequence for the present discussion. It is also a very simple case in the sense that the categories are all very simple. Although we are not going to do it in this paper, it may help the reader to provide the identifier parts (as far as they are not block openers) with the indicator strings in parentheses. That means that he writes prod ( a ,b ) in line 5, power(n,x) in line 8 , d ( n , y ) in line 10, e(n,y) in line 11, f(n,y ) in line 12, g ( n , y ) in line 13. This makes it easy to see what we intend with the other expressions: prod (d, d ) indicates that both a and b in prod ( a ,b ) are replaced by d. Now what does e ( d ) mean in line 13? By line 11, e depends on two variables (n and y ) . We agree that we add the letters of the indicator string of line 11 on the left until we have enough entries. So e ( d ) has to be interpreted as e ( n , d ) : the first entry of the string n, y is added on the left. In general: if p is introduced with indicator string (21,...,zn), and if k < n, then ~(21, ...,zk) has to be interpreted as p ( z 1 , ...,Zn-kr 21, ...,Zk).

The mathematical language Automath (A.2)

81

4.2. Before we describe the rules of PAL, we first describe a simpler language t o be called SEMIPAL. This language is different from PAL and Automath in that it does not attach a category to a line. Its relation t o PAL is simple. If we just cancel from a correct PAL book the entire category column, then we get a correct SEMIPAL book. (On the other hand, we can always transform a correct SEMIPAL book into a correct PAL book just by adding type as the category of every line.)

4.3. The rules of SEMIPAL are given in this and the next section. The reader may take the 13 lines of Sec. 4.1 for an example, by just cancelling the category column.

(i) As the first line of the book any one of the lines 0 0

..._ .-

.... ....

is acceptable. (Here (ii) We can add an ( n writing U

"...."

PN -

stands for an arbitrary identifier.)

+ 1)-st line to a correct SEMIPAL book A of n lines by

....

..-

c,

where u is either 0 or one of the previous block openers, and C is either -, or PN, or an expression valid at u, a notion to be defined presently. 4.4. The notion expression valid at u (where u is an indicator) is relative to the given correct book A. We define it by recursion.

(1) If b is a block opener, either equal to u or contained in the indicator string (see Sec. 3.11) of u, then b is an expression valid at u. Example: At y the expressions n, y are valid. (2) If b is the identifier of a line of A, but not a block opener, and if the indicator of that line is either 0 or u or contained in the indicator string of u, then b is an expression valid at u. Example: At y the expressions nat, real, d, e , f , g are valid.

(3) Let b be the identifier part of one of the lines of A, and assume that b is not a block opener. Let n be the length of the indicator string of b. Let k be a second integer, 0 < k 5 n. We assume that El, ...,C k are expressions valid at u. If n > k we have the extra assumption that the (n- k)-th entry of the indicator string of b is a n expression valid at u (that is, it is equal to u or contained in the indicator string of u). Then

N.G. de Bruijn

82

is an expression valid at u.

4.5. In the SEMIPAL book that is obtained from the example of Sec. 4.1 (by

omitting the category column) we give a few examples of expressions valid at y:

4.6. As a preparation to discussion of normal forms, we define the completion of an expression valid at u. Let C be an expression valid at u ; its completion C' will also be valid at u.

(i) If C consists of a single block opener, then C' = C. (ii) Let C = b(C1, ...,Ck) (see the end of Sec. 4.4) and let indicator string of b. Then

If k = 0, n - k # 0 this has to be read as b(u1, ...,u,-k),if k b(C1, ..., C k ) , if k = n - k = 0 it has to be read as just b.

u1;

...,u,

be the

# 0, n - k = 0 as

An expression is said to have normal form (in the sense of SEMIPAL) if it contains no compound notions (see Sec. 3.2). Let C be an expression valid at u. We shall define, again recursively, a reduction to normal form C*. We first complete the expression C t o C' (4.6). If C' is a single identifier, but not a compound notion, then we take C* = C'. If C' is a single identifier and if that identifier is a compound notion, we define C* to be the normal form of R, where R is the definition part of the line whose identifier part is C'. If C' = b(C1, ...,C,) with n > 0, and if b is a primitive notion, then we take 4.7.

C" = b(C:, ..., C:)

,

where Ct is the normal form of Ci (i = 1, ...,n). If C' = b(C1, ...,C,) with n > 0, and if b is a compound notion, with indicator string u1, ...,un,then we obtain C' as follows. Let R* be the normal form of the definition part of the line whose identifier is b. In 52' replace every occurrence of ui by Ct (the normal form of Xi). This gives C'.

The mathematical language Automath (A.2)

a3

Warning: The substitution of the C,t for ui is only carried out for explicit occurrences of ui in R*, and not for new ui’s that arise after substitution (the C,t’s themselves may contain uj ’s) . As an example we give the normal form of the expression e ( d ) of line 13 in the example of Sec. 4.1:

4.8. Two expressions C1, C2 both valid at u are called definitionally equal if they have the same normal form. If we want to show definitional equality it is not always necessary to compute these normal forms; it will often suffice if we can transform both forms into a single form by partial reduction. If we replace an expression in a correct SEMIPAL book by a definitionally equal one, we get a new correct SEMIPAL book. The normal forms of corresponding expressions in both books will be the same. 4.9. We shall describe the notion of a correct PAL book in two stages. We start with a book A written according to the preliminary description of Sec. 3. That is, the definition part of a line is -, or PN, or an expression; the category part is type or an expression; the indicator part is 0 or a previous block opener. By a certain duplication operation to be described presently, we get something which we shall require to be a correct SEMIPAL book A’. Finally, we shall require certain conditions regarding the categories. The duplication means the following thing. We replace every line U

a

.-.-

R

C

(where u may be 0 or a block opener, R may be an expression or - or PN, C is an expression or type) by two lines U U

a+ a

:=

.-.-

C

52 ,

unless C is type, in which case we write the single line U

a

.-.-

R.

We of course assume that for every identifier we can create an entirely new identifier by adding the plus sign. As an example we deal with the first 5 lines of the book of Sec. 4.1:

N.G. de Bruijn

a4

nat real U+

a b+ b prod+ prod

....._ .._ .-

PN PN real -

._ ...-

real

.-._

real PN

-

._ .-

4.10. We define the notion ‘‘correct PAL book” by recursion. The definition will be such that if A is correct, then A’ is a correct SEMIPAL book. A one-line book is correct if and only if that line has one of the following two forms: 0 0

.... ....

._ ..-

PN

type,

-

type

.

Now assume that a book A consisting of n lines is a correct PAL book. We shall state the conditions for any line to be added. (i)

The indicator u is either 0 or a block opener of A.

(ii) The definition part is either (see Sec. 4.11 for this).

-,

or PN, or an acceptable expression at u

(iii) The category part is either t y p e , or an acceptable expression at u with category type. In the case where the definition part is an expression (see (ii)), we require that the category part is definitionally equal (in the sense of the SEMIPAL book A’) to the category of that expression.

4.11. Let u be one of the block openers of the SEMIPAL book A’ obtained by duplication of A. We will define a collection of expressions that we call acceptable at u; to each one of these expressions we will attach what we will call a category. The latter is either an expression or the symbol type. The expressions to be considered for acceptability, as well as their categories, will only contain identifiers of A, and no identifiers with signs attached to them. The acceptable expressons will be automatically valid at u in the sense of Sec. 4.4. The description of “acceptable” closely resembles the one of “valid” (Sec. 4.4).

+

(1) Let b be one of the following:

The mathematical language Automath (A.2)

85

- a block opener whose indicator string is contained in the indicator string

of u; -

the identifier of a line of A (but not a block opener) whose indicator is either 0, or u, or contained in the indicator string of u (cf. (1)and (2) in Sec. 4.4).

Then b is an acceptable expression at u , and its category is the category part of the line whose identifier is b. (2) Let b be the identifier part of one of the lines of A, and assume that b is not a block opener. Let n be the length of the indicator string of b. Let k be a second integer, 0 5 k 5 n. We assume that the expressions C1, ...,Ck are acceptable at u, with categories 0 1 , ...,Rk. If n > k we have the extra condition that the (n- k)-th entry of the indicator string of b is either equal to u or contained in the indicator string of u. Let v1, ..., v k be the last k entries in the indicator string of b. We require, for i = 1,...,k , that

is definitionally equal (in the sense of A') to Ri. (If i = 1 we have t o read (1) as v:. If any of the v+ does not occur in A', we have to read (1) as type, and the condition is just that R; = type.) Under these conditions we proclaim b(C1, ...,C k ) to be acceptable at u, and we give it the category b+(C1, ...,C k ) . If b+ does not occur in A', the new expression b(C1, ...,C k ) is given the category type. One minor modification should be made: we promised that the category would not be an expression containing identifiers with plus signs. Therefore we replace b+(C1, ..., C k ) by the result of an application of a substitution such as described at the end of Sec. 4.7.

5. HOW TO USE PAL FOR MATHEMATICAL REASONING

5.1. In Section 4 we explained how to express things by means of PAL. Seemingly, expressing things covers only a small part of mathematics, for usually we are interested in proving statements. Mathematics has the same block structure as we have in PAL, but there are two ways to open a block. One is by introducing a variable that will have a meaning throughout the block, the other one is by making an assumption that is valid throughout the block. We shall be able to deal with the second case as efficiently as with the first one, if we represent statements by categories. Saying we have a thing in such a category

N.G. de Bruijn

86

means asserting the statement. This can be done in three ways: by means of -, or PN, or an expression. These three correspond to assertion by assumption, by axiom, by proof, respectively. 5.2. As an example we shall deal with equality in a n arbitrary category. The following piece of text introduces equality as a primitive notion, and states the three usual axioms. 0

t

E

X

Y

1

X

i

X

.-..-.....-

reflex asp 1 symm

:= :=

PN

1 2 3 4 5

-

6

:=

PN

asp 2 trans

:= :=

-

7 8 9

PN

10

Y is

Y asp 1 asp 1 z

asp 2

-

-

PN

.-.-

-

This book is not a nested one since line 5 does not belong to the block opened by y. Even so, the vertical bars, with an interruption at line 5 , can be helpful. We now show how this piece of text can be used in later parts of the book. Assume we have the following lines (in some order) in the book:

0 7 7 0

a

0 0

b known

.-....-.:=

.... .... .... ....

type

77 77

zs(v,a, b )

We wish to derive a line: 0

result

:=

....

is (77, b, a )

*

We have to find a definition part for this line. What we want is to apply line 7. The indicator string is (E,x,y,asp 1). In ordinary mathematical terms, we have to furnish a value for 5, a value for x , a value for y , and a proof for the statement obtained from “ x = y” by these substitutions. A proof for the statement means, in our present convention, something of the category is (71, a , b). Indeed we have something, viz. “known”. The reader can easily verify that 0

result

:=

symm(7, a, b,known)

is (77, b, a )

is an acceptable line. The above application was given entirely in context 0, but it can be done in any block that contains 77, a, b and known.

The mathematical language Automath (A.2)

87

We are, of course, inclined to see the categories as classes, and things having that category as elements of those classes. If we want to maintain that picture, we have to say that the category “is (t,z, y)” consists of all proofs for z = y. In this picture the usual phrase “assume z = y” is replaced by “let p be a proof for 2 = y”. Another aspect is that we have to imagine the category “is (t,z, y)” to be empty if the statement z = y is false. The latter remark points at a difference between these assertion categories and the “ordinary” categories like “nut” and “reul” in Sec. 4. In the spirit of the example of Sec. 4 it is vital to know what the expressions are, and it seems pretty useless to deal with empty categories. With the assertion categories it is different. The interesting question is whether we can find something in such a category, it doesn’t matter what. 5.3.

5.4. A modern mathematician has the feeling that asserting is something we do with a proposition. The author thinks that this is not the historic point of view. The primitive mathematical mind asserts the things it can, and is unable to discuss things it cannot assert. To put it in a nicer way, it has a kind of constructivist point of view. It requires a crooked way of thinking to build expressions that can be doubted, i.e. to build things that might or might not be asserted. A possible way to do this in PAL is to talk about the category “bool” consisting of all propositions, and to attach to each proposition an assertion category. We start the book like this:

’1 b

L:uE

.-..-.-

PN

:=

PN

type bool type

-

The standard interpretation is simple. If we write in a certain context

...

.-

....

TRUE(c)

,

where c is (in that context) a proposition, then the interpretation in every-day mathematical language is that we are asserting c. 5.5. In PAL we are able to write axioms and prove theorems about propositions (e.g. tautologies). In later parts of the book we will be able to use these axioms and theorems (just like the derivation of “result” in Sec. 5.2). This means that in a PAL book we are able to derive inference rules that can be applied later in that same book. As a very primitive example we shall write the following in PAL. After introducing bool and TRUE we introduce the conjunction of two propositions. We present some axioms concerning that conjunction, and we show that from z A y we can derive y A z. Finally we show how in a later piece of text the result can be used as an inference rule.

N . G . de Bruijn

88

bool

0 0 b

b

0

X

T R YE

X

Y

Y Y

and asp 1

asp 1 asp 2 Y asp 3 asp 3 asp 3 0 0 0 0

~

2; asp 3 ax 2 ax 3 theorem U 2,

known derived

._ .-

._ .~.........._ ..-

._ .-

PN

-

type bool

PN

type

-

bool bool bool TRUE ( x ) TRUE(Y) TRUE(and)

-

PN -

PN -

..PN ._ .PN .-.- ax l(y,x,ax 3,az 2) .-..... .._ .... ...... .-.- theorem(u,v,known)

TRUE( a n d ) TRUE(x) T R UE ( Y ) TRUE(and(y,x)) bool bool TRUE(and(u,v)) TRUE(and(v,u ) )

5.6. The reader will have observed from the above examples that we do not need to subdivide our text into parts like “theorem”, “proof”, “definition”, “axiom”. Every line is a result that can be used whenever we wish. It may require a large number of lines t o translate the proof of a theorem into PAL. (Needless to say, we can always try to reduce the number of lines, but that makes the lines more complicated and hard to read.) Some of the lines represent definitions of notions introduced only for the sake of the proof. Other lines represent subresults, usually called lemmas. The usual idea about theorems and proofs is, at least formally, that we are not allowed to refer to results obtained inside a proof. In PAL (and in Automath), however, we are free to use every line everywhere. We never announce a theorem before the proof starts, the result is not stated before it has been derived.

6. EXTENDING PAL TO AUTOMATH

6.1. I t was shown in Sec. 4 how we can deal with functional relationship in PAL. Once a function has been defined (either by P N or by definition in terms of previous notions) it can be applied. That is, a function f is introduced by saying what the value of f ( x ) is for every x of a certain category. And if we have, at a later stage, an expression C having that same category, it will be possible t o talk about f(C). A thing that we can not write in PAL, however,

The mathematical language Automath (A.2)

89

is “let f be any function, mapping category C1 into category C2”. If we wish to deal with such mappings the way it is done in mathematics, we want several things: (i)

We need the facility of building the category of the mappings of C1 into

(ii) If f is an element of that mapping category, and if x is something having category C1, then we have to be able to form the image of x under f . (iii) If a mapping of C1 into C2 is explicitly given in the PAL way then we have to be able to recognize that mapping as a member f of that mapping category. (iv) If we apply (ii) to the f obtained in (iii), we can (making z a block opener) obtain a function given in the PAL way. This function should be equivalent to the one we started from in (iii).

6.2. Let us consider (iii) more closely. The “PAL way” of giving a function is the following one: We have somewhere in the book

X

x

:=

- C1

u

:=

A

C2

1 2

where A is an expression possibly depending on x. (That is, its normal form may contain z) But it is only fair to remark that C2 may also depend on x; C1, on the other hand, can not contain x. Let us assume that neither C1 nor C2 is the symbol type. The mapping described here attaches to every x of type C1 a value depending on x, which value has category also depending on x. We shall use the notation

[x: El] C2 for the category of this mapping, and [X : El] A

for the mapping itself. There is an objection against using the old identifier x for this new purpose, and therefore we replace it by a new identifier t. This t will never occur as identifier part of a line. It is called a bound variable, and we may assume that it will be used here, but never again. We shall write i2,(E)A for the result of substitution of C for x in the expression A . (It should be remarked that A may contain x implicitly, which can happen if the above block contains lines between line 1 and line 2. In order to

N.G. de Bruijn

90

make such implicit occurrences explicit, we have to transform A by application of definitions up to a point where further implicit occurrence is impossible.) We can now phrase the rule of functional abstraction: In Automath we have the right to deduce from lines 1 and 2 the acceptability of the line U

...

.._

[t : El] R,(t)A

[t : Ci] &(t)C2

Accordingly we have the right to consider [t : El] O,(t) we have (if C1 and Cz are expressions) U

z

X

w

:= :=

-

CZ

C2

3

as a category. So if

4

C1 type

5

we have the right to add U

...

.-

[t : Ell %(t)&

type

6

This makes it possible t o open a new block with 21

f

:

=

-

It : El] R,(t)Cz ,

7

that is, we can start an argument with: let f be any mapping of the described kind. We also have the possibility to write line 7 with PN instead of -. 6.4. Now returning to point (ii) Sec. 6.1, we introduce the following rule. If we have a line

and also a line U

...

..-

A

El

9

then we take the liberty t o write U

...

:=

(~)r

R,(A)c~.

10

The interpretation is that (A) I? is the result of the substitution of A into I?. We write this instead of r ( A ) since, in the case that I' is a single identifier, the latter notation already had an entirely different meaning in PAL: it was used t o change context. That is, r(A) is the mapping we obtain from r if we substitute A for u, and it is even questionable whether this is possible, since u need not be of category C1. 6.5. In connection with this notation ( ) we take the liberty to extend the notion of definitional equality by the following pair of rules:

The mathematical language Automath (A.2)

91

(i) If C1, C2, C3 are expressions, where C2 contains the bound variable t, but C1 and CJ do not, then we postulate the definitional equality of

That is, it does not make a difference whether substitution is carried out before or after functional abstraction. (ii) If C1 and C2 are expressions that do not contain the bound variable x,then we postulate the definitional equality of

The above rules (i) and (ii) explain why we prefer to write (z) f instead of f (x). By way of these rules, (x)f is in agreement with the convention [t : C1]C2 for functional abstraction, and the latter is in agreement with the general mathematical habit to write quantifiers like VXESl

UXES,

n,=, m

to the left of the formulas they act on. 6.6. The description of Automath in the preceding sections was not as complete

as the description of SEMIPAL and PAL in Sec. 4. For a complete and more formal definition of Automath we refer to the report mentioned in Sec. 1.2.

7. HOW TO USE AUTOMATH FOR MATHEMATICAL REASONING

7.1. If we write elementary mathematical reasoning in PAL as described in Section 5, one of the first things we can not do is to derive an implication. There are two things we wish to do with implication, and only one of the two can be done in PAL. First assume we have introduced implication as a primitive notion, then it is easy to write "modus ponens" as an inference rule:

N.G. de Bruijn

92

0 0 b b

bool b TRUE

C

impl

C

C

asp 1 asp 2

modpon

...-.._ ..-.._ ....._ .-

PN

type

-

bool

PN

type

-

PN -

PN

bool bool TRUE(b) T R UE(impl) TR UE(c)

By means of this piece of text we are able to use the inference rule

A, A = + B B in all possible situations. The second thing we want to do is this. If we have 0 0

P

._ .-

.-.-

....

bool

....

bool T R UE (PI TRUE(q)

....

9 10 11 12

(it might have been given in any other context instead of 0) then we want to construct something in TRUE(imp1 ( p , q ) ) . This cannot be done by means of the rules of PAL. The problem can be solved in Automath, however. We first say that if we have a mapping from TRUE(b)into TRUE'(c),then impl(b,c) is true:

.. .. [ x : TRUE(b)]TRUE(c) TRUE(imp1)

C

13 14

Using the axiom, and functional abstraction, we can derive from lines 11, 12 0 0

first

:=

[y : TRUE(p)]then(y)

second

:=

axiom(p,q,first)

[y : TRUE(p)]TRUE(q) T R (impl(PI q )

15 16

That is, we have derived an assertion of impl ( p ,q). So we have the inference rule

A B

-

A=+B available in all possible cases. If we wish, we can write the application of this inference rule in one line instead of two, viz.

The mathematical language Automath (A.2)

0

...

93

axiom(p,q,[y : TRUE(p)]then(y))

:=

TRUE(impl(p,q)) 17

As a second example we introduce the all-quantifier for a predicate P on an arbitrary type <. 7.2.

0

I

b

bool b TRUE

f

0

t:

P all

P P

X

3: X

P

asp 6

asp 6

._ .._ .._ .._ ...._ .._ .._ .._ .._ .._ .-

PN -

PN -

type bool type

1 2 3

type [u : f ] bool

4

TRUE ( a l l )

5 6 7 8

PN

TRUE((2)P )

9

-

[v : <] TRUE((v)P )

10

PN

TRUE(al1)

11

PN

bool

<

-

Note the close resemblance between the text of Sec. 7.1 and this one. Actually we are able to define “impl” in terms of “all”: we can write instead of line 5 of Sec. 7.1 c

imp1

:=

all( TRUE(b),[t: TRUE(b)]c )

bool

If we do this after having accepted the text of 7.2, then we can replace the PN’s in line 8 and line 14 of Sec. 7.1 by proofs. The reader may check that the PN in line 8 (Sec. 7.1) can be replaced by ax l(TRUE(b),[s: TRUE(b)]c,asp 1, asp 2)

,

and the one in line 14 (Sec. 7.1) by

ax 2( TRUE(b),[s: TRUE(b)]c, asp 4)

.

7.3. Next we discuss the existence quantifier. There are various different approaches to this. The simplest one, and therefore the easiest one for application, is connected with the Hilbert operator. It says, if for any given category there exists an object for which a given property holds, then we have a way of selecting such an object as if we were in possession of a standard algorithm that selects for us. We can write this as follows. We start again with the introduction of bool and TRUE, then we take an arbitrary category ( and an arbitrary predicate on that category, and we introduce existence as a primitive notion. It says that “existence” is true if and only if we have something in that category E.

N.G. de Bruijn

94

._ ..-..-._

0 O b

l

0

E P P

1

2,

asp 1

V

z o ;

1

asp 2 Halbert axiom 3

P asp 2 asp 2

._ .._ .._ .._ ..-._ .-.._ .._ .._ .-

type

1

-

bool

PN

type

2 3

-

type

PN

-

PN

boo1

-

-

PN -

PN PN

4 5 6

[u : <] bool

7

E TRUE((v)P ) TRUE( exists)

8 9

TRUE (exists)

10

t TRUE ((Hilbert) P )

11 12

~

In combination with other axioms this way of defining existence easily leads to non-contructive things, e.g. the axiom of choice. A different way of introducing existence is to say that it is not true that the negation of the predicate holds for all objects in the given category. This of course requires a definition of negation, which can be done in several ways. We shall not discuss it here. The difficulties about existence arise already at a lower level, viz. with the notion of non-emptiness of a category. In that case the following may be a useful substitute for the kind of non-emptiness related to the Hilbert operator:

1

..LEPTY

-

:=

[c : bool] [u : [ x :

<] TRUE(c)]TRUE(c)

type type

If we have something in NEPTY, if c is any proposition, and if we can prove that whenever we have an x in [ then c is true, then we have proved c. So if we have something in NEPTY, we have a kind of inference rule: If we want to prove a proposition c then we may act as if we know an x with category t. 7.4. There is no objection against higher order predicate calculus in Automath. For example, we can talk about the category R of all predicates on the category of natural numbers, say, about the. category S of all predicates on R, etc.:

0

0 0

nat R S

:= := :=

.... [ n :nat] bool [ T : R] bool

type type type

7.5. Every language has its advantages and disadvantages. The disadvantages of Automath are obvious: it is tedious t o have to write in full detail, carefree identification of things in different categories is forbidden (see Sec. 2.2), and

The mathematical language Automath (A.2)

95

embedding of types into other types is not an automatic facility. In order to compensate for these disadvantages, the user should try to exploit the advantages the language has. One advantage is that we do not have to announce theorems and lemmas in a formal way, and therefore repetition of arguments is much easier suppressed than in ordinary mathematics. And, of course, we can invent all sorts of tricks. We present just one such trick here. Consider an axiom like the line TRUE in Sec. 5.4. Once we have written it this way, we cannot get rid of it: if we want to do mathematics without it, we have to write a new book. There is a way, however, to introduce the axiom in such a way that, so to speak, it is only available to those who have authority t o use it. We introduce a new primitive notion AUTH (for authority) and then state the axiom for those users who have something in A U T R

0

b a I

,

I

a

.-

;RUE*

:= :=

-

AUTH

-

bool

PN

type .-

If later we have c in AUTH and d in bool, we can use TRUE*(c,d). If c in AUTH is valid in a large part of the book, we can get rid of the awkward obligation t o mention our authority, by defining (in a context where c is available)

8. UNSOLVED PROBLEMS ABOUT AUTOMATH

8.1. It is very probable (but not yet proved) that the following is true. If the lines 21

'11

... ...

.-...-

xi

Ai

C2

A2

occur in a book, if C1 and Cz are definitionally equal, then A1 and A2 are definitionally equal. We only say roughly what definitional equality is: Two expressions are definitionally equal if one of them can be transformed into the other by replacing an identifier in one of the expressions by the expression that defines it, and also by application of one of the operations of the lambda calculus. They are also called definitionally equal if they can be connected by a chain of pairwise definitionally equal expressions.

96

N.G. de Bruijn

We do not express the notion by means of normal forms, as in 4.7, since we are not yet sure about normal forms. 8.2. Probably every expression occurring in an Automath book is definitionally equal to an expression that does not contain any ) followed by a. [. This means an expression

(possibly k = 0, h = 0 , or m = 0), where the Greek capitals again represent expressions of that form, the PI,...,/& are bound variables, and is either a block opener or the identifier part of a line with PN.

9. PROCESSORS FOR AUTOMATH

9.1. A processor is a computer program that enables a computer to check line by line whether any given input represents a correct Automath book. One of the things the computer gets to do is to check whether two expressions are definitionally equal. Even if the conjectures of Sec. 8 are true, it can be very impractical t o use normal forms for checking that equality. It is already impractical in PAL, where there is no difficulty with the normal forms (see Sec. 4.7). A good processor should have a good strategy for checking definitional equality. In cases where the general strategy is failing, it may pay t o assist the computer by giving hints as to what to do first. It is to be expected that very few hints will be needed in general. That is, at least as long as we do not try to condense a larger number of lines into a single one. Such a condensation is quite often possible, it saves identifiers, but makes things harder to write and harder to check. (An additional disadvantage of condensed writing is the repetition of expressions which might have been abbreviated by means of extra lines. Another aspect of the same thing is giving an argument twice where a lemma might have been more efficient.) 9.3. There are several attractive possibilities for man-machine interaction if a terminal is available for direct communication in conversational mode. (The Automath processor in operation in 1968 at the Eindhoven University of Technology, Eindhoven, did not yet provide such facilities.) For lines the machine rejects, it can produce diagnostics by means of which the operator can carry out corrections or add hints. It will be very practical for the operator to suppress the category of a line (unless the definition is - or PN), and t o ask the machine what category it finds. If it does not coincide with the one the operator has in

The mathematical language Automath (A.2)

97

mind, the operator can ask the machine to check definitional equality of the two expressions.

10. POSSIBILITIES FOR SUPERIMPOSED LANGUAGES

10.1. For practical purposes it will be attractive to make languages which bear the same relation to Automath as a programming language has to some particular machine language. We shall call such languages superzmposed on Automath. They require a compiler for translation into Automath.

10.2. A very simple thing a superimposed language might do is admitting repetition of names (such as the repeated use of the letter 2 for many different purposes in the book). The compiler has to rename everything in order t o meet the requirement that in Automath the identifier parts of the lines are distinct. 10.3. In complicated cases the superimposed language will require a fixed correct Automath book as a basis. If we have written a book in the superimposed language, then the compiler starts from the basis, and next it translates the given book into Automath lines which are subsequently added t o the basis, and checked by the Automath processor.

10.4. In a superimposed language standard mathematical notation might be used more freely. For example, in the superimposed language one might write p := a b c. The compiler sees that a, b, c were previously introduced as reals, it sees that no change of context has been mentioned, it knows that “real” and “plus” are identifiers in the basis. It writes

+ +

p := plus(plus(a, b ) , c) real and it keeps the context indicator of the previous line. 10.5. A superimposed language might be very different from Automath in its approach t o things like propositions, assertions, predicates. The user of the superimposed language need not even notice that Automath has a slightly unconventional approach t o these things.

10.6. It is not strictly necessary that the text presented in a superimposed language is entirely unambiguous and free of gaps. Just as the human mathematician has been trained to guess what the sentences in his textbook mean exactly, the compiler can be trained to guess the meaning of what is said in the superimposed language. It cannot be expected to do very much in this direction,

98

N.G. de Br;ijn

but whatever it can do, will be very helpful. Writing absolutely meticuously is very much harder than writing almost meticuously, and it will be a great gain if a machine can bridge the gap between the two.

11. AUTOMATIC THEOREM PROVING 11.1. Automath is not intended for automatic theorem proving. Theorem proving is a difficult and time-consuming thing for a machine. Therefore it is almost imperative to devise a special representation of mathematical thinking for any special kind of problem. Using a general purpose language like Automath would be like using a contraption that is able to catch flies as well as elephants and submarines. 11.2. There is a case for automatic proof writing in Automath if we have to produce a tedious long proof along lines that can be precisely described beforehand. Let us take a n example. Assume that P is a proposition on magic squares, and that we want to prove a theorem saying that there is no 8 x 8 magic square that has property P . We can write a computer program for this and run it on a computer. The computer says that none exist. Now quite apart from the question whether the computer is right, we have to admit that a formal mathematical proof has not been produced. Even if we had a complete mathematical theory about the machine, the machine language, the programming language, our proof would depend on intuitive feelings that the program gives us what we want, and it would definitely depend on a particular piece of hardware. For those who are willing to take Automath, at least temporarily, as their only final conscience of mathematical rigour, there is a way out. We can rewrite the magic square program in such a way that the search is stepwise accompanied by the production of Automath lines that give account of a detailed mathematical reasoning, ending with the conclusion that there is no 8 x 8 magic square with property P. This way we get a complete proof that can be checked by any mathematician. If we leave the checking to a computer, we get again into the question of whether the processor and the computer do what we expect them t o do, but that is an entirely different matter.

12. EXTENSIONS O F AUTOMATH 12.1. If we feel we should have a more powerful language than Automath, this can have two reasons.

The mathematical language Automath (A.2)

99

12.2. One reason is that we feel that the language is clumsy, and that we want to make it more handy, without changing the scope of what we can say. For some purposes this might be possible by extension of the language, i.e. by adding new grammar rules without cancelling the old ones. It is hardly necessary t o consider such extensions for the present purpose, since it can be expected that the same goal can be reached by means of superimposed languages. We might think about facilities for easy identification of two things of different categories (see Sec. 2.2), embedding of one category into another, etc. If such matters can be handled satisfactorily, they can be handled by a superimposed language. The only reasons for doing it without such a language may be computer time and memory space. 12.3. A different reason for extension can be that we feel that Automath is not strong enough, just as we extended PAL to Automath since PAL was not strong enough for modern mathematics. One might suspect that no single language will ever be entirely satisfactory. It is an old mathematical habit to mix language and metalanguage: we write a text in a language; we discover facts about that text; we use these facts in the subsequent text. This of course means an extention of the language. We mention an example, though not a very important one. Let q be any identifier in an Automath book, and let p be a block opener. If it happens that q does not implicitly depend on p , this is an observation about the book, and there seems t o be no way t o write it as an assertion in the book. It will be an extension of the language if we design some way to write this independence, a way to derive it from the book, and a way t o use that written information if we need it. This kind of thing is done in ordinary mathematical language, but in Automath it is not necessary. If q does not depend on p , then we are able t o define r := q in a context where p is not valid, and then we need not bother about p any more.

12.4. There is a class of extensions of Automath that is very easy t o describe: We start the book with a number of lines some of which have not been written according to the rules; we want to write the rest of the lines in the book according to the rules. We give an example that does not belong t o Automath, but t o the language we get from Automath if PN’s are forbidden: Then we can write all axioms in the basis as theorems without proofs, and talk PN-free language ever after. One might even think of an infinitely long basis. For example, one might like t o have all the natural numbers as a priori given, and devote a line or two to each one of them. 12.5. In Automath we have the right to indulge in functional abstraction with

N.G. de Bruijn

100

respect t o every type. In private discussions Prof. Dana Scott said he did not like the idea of introducing “bool” as such a type, at least not in intuitionism. It is very easy t o extend Automath by introducing a symbol type*, and saying that if C has category type*, then we do not have the right of functional abstraction with respect to C. It seems fair to admit the category C3 := [z: El] C2 if C1 has category type and Ez has category type’, and to say that C3 has category type’. If we do all this, we can introduce “bool” as something of category type*, and “nut” (the natural numbers) as something of category type. 12.6. In Automath we did not allow functional abstraction with respect to type itself. For example, if we have

then we can not write 0

...

.-

[t : type] bool

[t : type] b ( t )

.

It is difficult t o see what happens if we admit this.

12.7. A possibility that seems less dangerous than the one of 12.6 is the following one: if we have 0

5

:=

....

:=

[t : [] b ( t )

type

then we allow t o write 0

...

[t :

r] type

This gives more information about [t : (1 b ( t ) than just saying that it has category type, but on the other hand it puts an end t o uniqueness of category. Moreover, we permit lines such as 0

a

:

=

-

[t : r1 type

<.

in order to introduce an arbitrary way of attaching a type to each t in Once we have opened these possibilities, it will be pretty obvious what the further operational rules have to be. We mention a single case where this extension of our language is needed. In connection with recursive definitions, we might wish to say: let P I ,P2, ... be an infinite sequence of categories. This can be done by means of a block opener with category [n: nut]type.

101

A Description of Automath and Some Aspects of its Language Theory D.T. van Daalen 0. SUMMARY This note presents a self-contained introduction into Automath, a formal definition and an overview of the language theory. Thus it can serve as an introduction to the papers [van Benthem Jutting 731 and [Zandleven 73 (E.l)]. Among the various Automath languages this paper concentrates on the original version AUT-68 (because of its relative simplicity) and one extension AUT-QE (in which most texts have been written thus far). The contents are: 1. Introductory remarks. 2. Informal description of AUT-68. 3. Mathematics in Automath: propositions and types. 4. Extension of AUT-68 to AUT-QE. 5. A formal definition of AUT-QE. 6. Some remarks on language theory.

1. INTRODUCTORY REMARKS 1.1. According to the claims for the formal system Automath one should be able to formalize many mathematical fields in it in such a precise and complete fashion that machine verification becomes possible. The flexibility required to meet the indicated universality is provided by having a rather meagre basic system. The Automath user himself has to add appropriate primitive notions to the basic system in order to introduce the concepts and axioms specific to the part of mathematics he likes t o consider. In this respect, the basic system may be compared with some usual system of logic (e.g. first order predicate calculus) t o which one adds mathematical axioms in order to form mathematical theories.

102

D.T. v i l ~Daalen

1.2. In spite of this analogy, however, the basic system itself does not contain any logic in the usual sense. Basic for the system are the concepts of type and function (instead of, e.g., the concept of set or of natural number), which are formalized by a certain typed A-calculus. When representing mathematics in Automath one has to deal with the question of coding: How to formalize general mathematical concepts in the form of types and functions (see Section 2.2). Clearly an appropriate formalization will incorporate as much as possible of the basic type-and-function framework. Section 3 discusses this coding problem and in particular proposes a suitable way of representing propositions, predicates and proofs (a functional interpretation of logic). 1.3. In order to satisfy the claim of automatic verification of correctness the system certainly has to be decidable (and even feasibly decidable on now-existing computing machines). Since many common mathematical theories produce undecidable sets of theorems we must conclude that we cannot expect the computer to do all our work. Indeed theorems have to be given together with their proofs in order t o allow verification. Thus the correctness produced by the machine verification covers the arguments leading from axioms to conclusions only. The Automath user himself is responsible for his choice of primitive notions and all the coding (and decoding) involved.

2. INFORMAL DESCRIPTION OF AUTOMATH

2.1. Introduction Here we treat the original version of Automath, now named AUT-68. We chose this system as a n example because of its relative simplicity. The discussion will be informal and intuitive and in fact restricted to the object-and-type fragment of the language (thus leaving the proof-and-proposition fragment t o Section 3).

2.2. Intuitive framework (This section may be skipped by formalists.) The mathematical entities discussed in the language fall into two sorts: objects and types. The types may be considered as classes or sets of a certain kind, which may have objects as their elements. All types are supposed to be disjoint, for each object belongs to just one type. This uniqueness of types permits one to speak about the type of an object.

A description of Automath (A.3)

103

The typestructure is built up by starting from ground types and forming function types from these. Each mathematician may choose the ground types himself (as primitive notions), e.g. the type of natural numbers. An example of a function type is the type a + /3 (where Q and /3 are types) of the functions from Q to /3. More generally, the function types are formed by taking products, as follows: The language allows one to express dependence of types on objects (of some given type). That is, one can describe certain families of types bx indexed by the objects z of a given type a. Now every function type is formed as the generalized Cartesian product of such px,usually denoted l l x ~ a / 3 x ,and containing as objects just these functions that associate to any object z of type Q an object of type Px.The type Q + /3 is the special case where all Dz are a fixed type p.

2.3. Expressions, degrees and formulas; correctness The language as such only expresses the constructions of types and objects and the typing relations between objects and types. The expressions of the language have degree 1, 2 or 3. Types and objects are denoted by expressions of degree 2 and 3 respectively (for short 2-expressions, 3-expressions). For convenience we introduce the 1-expression t y p e to provide a type for the types. Further 1-expressions will be introduced in Sections 3 and 4. The symbol E expresses the typing relation: ... has type ... . So if A denotes an object then we have the E-formulas A E (Y and Q E type. The 2-expressions and 3-expressions are built up from variables and constant-expressions by means Of:

(i) the substitution mechanism (Section 2.5). (ii) functional abstraction and application (Sections 2.8 and 2.10). The constant-expressions have the form c ( q ,...,zk)where 21,...,zk are variables and c is either a primitive constant introduced as a primitive notion (Section 2.6) or a defined constant (Section 2.7). Expressions and formulas are correct if they are constructed according to the rules of the language, which are informally discussed in the sequel. 2.4. Variables and contexts

A mathematical statement generally presupposes certain assumptions on the variables used. For example: “let z be a natural and y a real number”. In Automath, in accordance with this usage, each variable of degree 3 (object-variable) ranges over a certain type, called the type of the variable. The 2-variables (typevariables) are supposed to range through the types and have t y p e as their type.

D.T. van DaaJen

104

Expressions and formulas containing free object- or type-variables, say X I , ..., X k , can only be correct relative to a certain context: 1.e. a finite sequence of Eformulas x 1 E a l l ..., x k E a h , called assumptions, in which the free variables have to be explicitly introduced with their types. Some of the types ai may depend on the variables given earlier in the sequence. For instance, a3 may contain both x 1 and 22 as free variables. It is understood that all a, are correct expressions themselves: a 1 relative to the empty Context, a 2 relative to x 1 E a 1 , etc.

2.5. Substitution mechanism Let us, in informal discussion, exhibit the possible dependence of an expression C on variables X I , ...,x k by writing c [ X I , ...,x k ] for c. Then we write C [ A l l..., A k ] for the result of simultaneously substituting Ai for xi (for i = 1,...,k) in C. Suppose that under assumptions 2 1 E LY1,...,Xk

E

a k

we have a correct E-formula A[Xl,...,Xk] E a [ X 1 ,

..., X k ] .

Then the substitution mechanism yields the substitution instance

A [ A l ,. ‘ . i

Ak]

E

[All * . * , A k ]

for any sequence A 1 , ...,A k of suitable candidates for 2 1 , ...,X k . 1.e. these A 1 , ...,A k have to be of the appropriate types where, however, in view of the possible dependence of types on variables, the substitution has to take place in the types too. So we require A 1

E airA

2

E

a 2

[Ail,...,A

k E a k

[ A i l..., A k - i ]

.

2.6. Primitive notions As mentioned before, one has to add primitive notions to the basic system in order to introduce the specific concepts of the piece of mathematics one wants to study. For example, in order to write about the natural numbers, one might introduce the primitive type-constant nat and the object-constant 1 by axiomatically stating: nat E type 1 Enat.

A description of Automath (A.3)

105

In general, primitive notions are introduced by stating an axiomatic E-formula p ( z 1 , ...,zk) E Q [XI, ...,z k 3 under certain assumptions z1 E al,...,Xk E Qk. Here either a is type (and p is a type-constant) or in the current context we have Q E type already ( p being an object-constant). All correct substitution instances p ( A 1 , ...,Ah) of such a constant-expression p ( z 1 , ...,zk)are then produced by the substitution mechanism, described above.

For example, the concept of successor in the natural number system can be introduced under the assumption z E nat by stating: successor(z) E nat. Using the substitution mechanism we get successor( 1)

E nat

successor(successor(1)) E nat

,

etc

.

Notice that primitive constant-expressions may not only contain object-variables (like the z in successor(z)) but also type-variables. 2.7. Abbreviations

In mathematics one often introduces abbreviations, i.e. new names for possibly long and complicated expressions. In Automath this abbreviation facility is also present; indeed, it will appear that by the particular format of the language every derived statement gives rise to the introduction of a new defined constant. Although this kind of explicit definition is often considered theoretically uninteresting, we feel that it is essential in practice for the actual formalization and verification of complicated theories. Just like primitive notions, abbreviations are introduced under certain assumptions and so may contain free variables in general. Thus new constantexpressions d(z1, ...,zk) are introduced, abbreviating expressions D which are correct in the current context. Clearly the type of d ( q , ...,zk)must be the same as that of D. Example: 2, 3, ... can be introduced by 2 := successor(1) 3 := successor(2) ,

etc

.

Further, the notion of “successor of successor’’ might be abbreviated by stating (under assumption z E nat) that plustwo(z) := successor(successor(z)) . Again, all correct substitution instances with their types are produced by the substitution mechanism.

106

D.T. van Daalen

2.8. Functional abstraction: A-calculus

We have mentioned functional abstraction and application as further tools for constructing expressions. By these devices a form of typed A-calculus is incorporated into the basic system. In A-calculus, intuitively speaking, Ax.B denotes the function which to any object x associates the object B. Or (exhibiting the dependence on x) Xx.B [x] is the map which, with any A, associates B [A]. In Automath (where all functions have a domain) such explicitly given functions are denoted by abstraction expressions [x : a]B, where B may contain x as a free variable; a is the type of z and the domain of the function. In case B is a 3-expression1 [x : a]B attaches objects to the objects of type a and is called an object-valued function. If B is a 2-expression, [x : a]B attaches types to the objects of type a and is called a type-valued function. In AUT-68 no abstraction expressions of degree 1 are formed (in contrast with AUT-QE). Notice that possible free occurrences of x in B are bound by the abstractor [z : a] and are not free in [x : a]B any more. An important restriction on abstracting is that such a bound variable must be a 3-variable. Thus we only quantzfy (cf. Section 3.4) over (the objects of) a given type and quantification over type is not possible. 2.9. Type of abstraction expressions

Suppose that under the assumption x E a we have B E p. If p is not a 1-expression then we may form both the abstraction expressions [x : a] B and [x : a]p. According to Section 2.8 [x : a]B denotes an object-valued function and [z : a]p denotes a type-valued function. The latter abstraction expression [x : a ] p [ x ]however, , is also used with a different meaning in Automath, that is, to denote the corresponding function type I I Z ~/3= [x] (which is the type of [z : a] B [x] by Section 2.2). So we obtain [z : a]B E [x: a]p and [z : a]p E type. Example: The successor function can be introduced (in the empty context) by succfun := [x : nat] successor(x) E [x: nat] nat . The double use of 2-expressions mentioned above does not cause ambiguity, because it is always clear whether an expression acts as a function or as a type in a formula. In fact in AUT-68 abstraction expressions of degree 2 are exclusively used with the second meaning, i.e. as function types.

2.10. Functional application In full (i.e. type-free) A-calculus any expression - as a function - may be applied t o any expression - even itself - as an argument.

A description of Automath (A.3)

107

In Automath, as a typed A-calculus, all functions have domains and any form of self-application is ruled out by the application restrictions: The application expression ( A ) B (denoting the result of applying B as a function to A as an argument) is correct only i f (i) B is a function and so has a domain, say a. (ii) A is an object of type a. The notation ( A ) B ,with the argument in front, is somewhat unusual; it is convenient, however, since abstractions are written in front too.

2.11. Type of application expressions Assume that B E [x : a]P. Here [x : a]P [x]is a 2-expression acting as a type and so denotes I I z ~p=[x].Hence B must be considered as a function with domain a. Now if A E a we are allowed to form the application expression ( A ) B having P [A]as its type. Note that B need not be of the form [x : a]C itself. It may, e.g., be a single object variable or object constant with type [x: a]/3. Example: As an alternative expression for the number 3 we might introduce 3alt := (2)succfun E nat

.

2.12. Equality We will define a relation of definitional equality among the correct expressions, appropriate to the interpretation of expressions suggested above. The relation is denoted ... = ... and generated by: (i) abbreviational or &equality, 3. (ii) A-equality. The latter is generated in turn by P-equality, =pl and 7-equality, =,,. Usually in A-calculus the A-equality also explicitly embodies a-equality (renaming of bound variables). In this note, however, we take the point of view of simply ignoring the names of the bound variables. So a-equal expressions are identified and are a fortiori definitionally equal by the reflexivity of the =-relation (cf. also Section 5.3.2).

2.12.1. &equality Assume the defined constant d has been introduced in suitable context by d(zl,...,xk) := D [xi,...,xk]

108

D.T. van DaaJen

Then d ( q , ...,z k ) abbreviates D and we write d(z1, ...,d k ) for the substitution instances:

=6

D. And further

2.12.2. ,&equality Assume ( A ) [ z: a]B [z] is a correct expression (so A E a). Now P-equality exploits the interpretation of [z : a]B as a function with domain a and simply amounts to evaluating the result of the application:

( A ) [ z: a]B =p B [ A ] . 2.12.3. 11-equality In mathematics one usually considers functions as eztensional objects, in the sense that functions with the same domain and which are pointwise equal are identified. In Automath this extensional equality is partly covered by the 77-equality: If z does not occur free i n B then [z : a]( z ) B =,, B (for correct expressions only). This is intuitively sound only if domain B = a,which indeed is the case by the correctness of [z : a]( z ) B . (Strictly speaking one also needs uniqueness of types (see Section 6.4.2.2).] 2.12.4. Definitional equality Now definitional equality = is defined to be the equivalence relation on the correct expressions, generated by =6, =pl =,, and by monotonicity: If A = A' and B' is produced from B b y replacing one specific occurrence of A in B b y (an occurrence of) A' then B = B'. Or, using suggestive dots for the unchanged part of the expression B : If A = A' then ...A... = ...A' ... . Example of the monotonicity rule: If A = A' then ( C )( A ) D = ( C )(A')D (if both expressions are correct). [Later, we will use 9 to denote the restriction of = to the correct ezpressions.] 2.13. The format: books and lines 2.13.1. Actual Automath texts are written in the form of books. A book consists of a finite sequence of lines. Each line must be placed in a certain contest (the context of the line) and introduces a new identifier of a certain type. All lines consist of four consecutive parts, separated by suitable marks or spaces: (i)

context part, indicating the context of the line. In general the context part consists of the context indicator, i.e. the last variable of the current context. Fkom this the complete context can easily be recovered. If the context of

A description of Automath (A.3)

109

the line is x 1 E a l , ...,X k E Q k , the sequence of variables 2 1 , ...,X k is called the indicator string of the line. The empty context can be indicated by an empty context part. (ii)

identifier part, consisting of the new identifier.

(iii) middle part, containing the symbol E B (cf. 2.13.2), the symbol P N (cf. 2.13.3) or the definition of the new identifier (cf. 2.13.4). (iv) category part, containing the type of the new identifier. Assume an Automath book is given, in which the variable x k has been introduced with type a k in the context x 1 E a 1 , ...,x k - 1 E a k - 1 . Then we may add lines with context indicator X k , so having x 1 E a l , ...,zk E a k as their context. Below we discuss the three different kinds of lines.

2.13.2. The block opening lanes have middle part EB (for e m p t y block opener) or, in alternative notation, a bar . An EB-line introduces a new variable and thus allows extension of the current context by one assumption. Example: x k * y := EB E a (“let y be of type a”)introduces a new variable y of type a. Lines having y as their context part - which may appear later in the book - then have x 1 E al,...,X k E a k , y E a as their context. ~

2.13.3. The primitive notion lines have middle part PN and introduce the primitive notions. For example: Xk

*P:=PNE~

introduces the primitive constant expression iomatic E-statement p ( x 1 , ...,x k ) E a.

p(x1,

...,x k )

and contains the ax-

2.13.4. The abbreviation lines look like: x k * d : = D E Q ,

where the middle part D is the definition of d , i.e. the expression to be abbreviated. This line contains, relative to the preceding book and the current context, both the derived E-statement D E a and the defining axiom for the new defined constant d :

2.14. Correctness of lines; validity A line is correct if both the middle part (if not EB or PN) and the category part are correct expressions with respect to the preceding book and the current

D.T. van Daalen

110

context, and the category part is the type of the middle part (if not E B or PN). For the correctness of the expressions, all identifiers used have to be valid. Constants are valid in a book from the line on in which they are introduced. Free variables are valid in a line if they occur in its context. We speak about the block of lines in which a free variable is valid (whence block opener).

2.15. Shorthand facility Assume that a primitive or defined constant c was introduced in a certain context X I E al,...,xk E (Yk. Then if later in the book c occurs with fewer than k arguments, the argument list is completed by adding a suitable initial segment of the original indicator string (cf. 2.13.1 (ii)) 21,...,Xk. In other words the expression x(Ai+l, ...,Ak) is shorthand for c(x1, ...,xi, Ai+l,..., A k ) and the single constant c is shorthand for c(x1, ..., xk). Clearly the completing variables have to be valid, that is, the initial segments of the original and the current context have to coincide. The shorthand facility accords with usual mathematical practice where free variables are often considered as fixed throughout an argument and are not mentioned explicitly.

2.16. Paragraph system For each variable and constant it must be possible to retrace from which line it originates. This condition is clearly satisfied when all names are unique. A more liberal method of naming, however, is allowed by the so-called paragraph system, for a description of which we refer to [Zandleven 73 (E.l), Section 111. Both shorthand facility and paragraph system do not really concern the language definition but are present for convenience only. 2.17. Example In the following AUT-68 booklet the examples of the preceding sections are now written in the proper format.

*

nat 1 x * successor * 2 * 3 * plustwo * succfun * 3alt * *

x

x

:= PN := P N

.-.-

:= := := := := :=

~

PN successor( 1) successor(2) successor(successor) [x : nat] successor(x) (2)succfun

tYP= nat nat nat nat nat nat

[x : nat] nat nat

Here the middle part of plustwo uses the shorthand facility. It is left to the reader t o establish 3 = 3alt.

A description of Automath (A.3)

111

3. MATHEMATICS IN AUTOMATH: PROPOSITIONS AS TYPES 3.1. Functional i n t e r p r e t a t i o n of logic Up till now we have described Automath as a calculus of objects and their types only. A major part of mathematics, however, consists of making statements and reasoning with them, i.e. deals with logic. Now there are different ways of coding some logic into the objects-and-types framework. Here we only mention a so-called functional interpretation of logic, which gives rise to the propositions-as-types notion. This idea of interpreting logic was developed independently by de Bruijn and certain others, of whom we mention Howard [Howard 801, Prawitz [Prawitz 711, Girard [Girard 721 and Martin-Lof [Martin-Lof 75a].

3.2. Propositions as types So far we have introduced type as the only 1-expression. We have C E t y p e and l? E C for the types C and the objects r of type C respectively. Now we introduce another 1-expression, the basic symbol prop. Originally in AUT-68 no distinction was made between t y p e and prop. The latter 1-expression acts just like type and was introduced later to allow difference of treatment between types which are to be considered as propositions and types which are just types of objects. If C E prop we consider C as a proposition. If further I? E C, we consider r as some construction establishing the truth of C (a “proof” of C). Thus the formula r E C is conceived as asserting the proposition C. 3.3. Interpreting implication Let a E prop and p E prop. Now we may say we have a “proof” of the implication a ---* p if from a n assumption of the truth of a we can argue and conclude the truth of p. That is, if for any construction establishing the truth of a we can produce a construction for the truth of p or, equivalently, if we have a map from “proofs” of a to “proofs” of p. Now in Automath terminology: we say we “prove” a ---* if for any x E a we can produce some B E p. 1.e. if we have some C in the function type [z : alp. So we let [x : a]p denote the implication a 4 p and have [z : a]p E prop. This corresponds to the second interpretation of abstraction expressions in Section 2.9. Now by this interpretation we obtain the modus ponens (from a and a + p infer p) by simple functional application. For let A E a and C E [z : a]p ( A and C thus being “proofs” of a and a ---* ,d respectively). Then by the application rule we construct ( A ) C establishing the truth of p.

D.T. v m Daalen

112

3.4. Universal quantification; negation In exactly the same manner a functional interpretation of universal statements can be given. Namely if a E type and for z E a we have p E prop then we . identify the function type [z : a l p with the universal statement V , E ~ ~Here functional application corresponds to the “instantiation” rule in logic. Thus by this interpretation of logic in Automath one gets the (V, +)-fragment of first order predicate logic for free. However, in Automath only positive statements are made and statements like: “C is not of type r” cannot be expressed. In order to interpret negation we introduce as a primitive notion the proposition con (for “contradiction”) together with some suitable axiom (primitive notion). Here are different possibilities, e.g. the intuitionistic absurdity rule (for any proposition a,from con infer a) or the classical double negation law. Then an Automath theory (i.e. book) is consistent if, in the empty context, it does not produce some C E con. For Q E prop we define non(a) as a + con or, in Automath notation, [z : a]con. Now the double negation law can be stated by introducing the primitive notion dnl as follows: Zfa E prop, z E non(non(a)) then dnl(a, z) E a. By also choosing suitable definitions for the other connectives (A, V) and the existential quantifier we can smoothly obtain full classical first order predicate calculus.

3.5. Assumptions, axioms, theorems In Automath-books the E-formula usual three kinds of lines again: (i)

r E C for proposition C can occur in the

EB-lines: u * z := EB E C. These must be interpreted as assumptions: “let C hold” or “let z be a proof of C”. Now in a line where z is valid we may refer to z whenever we want to w e the assumed truth of C.

(ii) PN-lines: u * p := PN E C. These serve as axioms, or rather as axiom schemes (by the dependence on the variables contained in the context 0). (iii) abbreviation lines: 0 * d := r E C must be considered as derived statements, i.e. theorems, lemmas etc. Here the middle part r “proves” the proposition C from the assumptions in the context u ,

3.6. Book-equality The definitional equality (cf. Section 2.12) of Automath only covers a small

A description of Autornath (A.3)

113

part of the usual mathematical equality. Further a statement of definitional equality cannot be handled as an actual proposition; e.g. it cannot be negated or even assumed (as in: let A = B). As the Automath-counter part of the usual mathematical ... equals ..., the book-equality IS(a,A , B) - where A and B are objects of type a - can be introduced by suitable primitive notions, some of which are shown in the example below.

a 2

Y X

Y i

* *

*

*

*

a 2

Y

IS REFL

* i * SYM

._ .-

:= -

._ .-

:= P N := P N := ~

:= P N

etc. and also:

a

* P

P * f

f *

X

Y i

* *

*

X

..:=

.-.._ .-

~

~

~

Y := i ISAXl := P N

By the axiom of reflexivity (REFL) above, definitional equality implies bookequality: if A E a , B E a , A = B then REFL(a, A ) E IS(a,A , B).

4. EXTENSION OF AUT-68 TO AUT-QE

4.1. Function-like expressions

Expressions C such that C E [x: a]p or C = [x : a]P are called function-like expressions. Whereas in AUT-68 function-like 3-expressions may have any form, e.g. they can be variables or primitive constant expressions, the only functionlike 2-expressions are (possibly abbreviated) abstraction expressions. This is because function-like 1-expressions are absent in AUT-68. Thus we discuss explicitly constructed families of types Pz where x ranges over some type a (namely by forming the abstraction expression [x : a ] P [ x ] ) but we cannot discuss arbitrary families of types indexed by x E a. Indeed, we cannot introduce a family of types as a primitive notion or as a variable.

D.T. van Daalen

114 4.2. Supertypes or quasi-expressions

In AUT-QE on the other hand such arbitrary type-valued functions are admitted, however, by extending the class of 1-expressions. The new 1-expressions, quasi-expressions (whence AUT- Q E ) or supertypes, have the form [z1 : a11 ... [Xk : a k ] type or [XI : a11 ... [zk: a k ] prop

,

where a l , . . . , a h are 2-expressions, i.e. propositions or types. For example, an arbitrary type-valued function on a can be introduced by an EB-line:

.-

* * f

[z : a]type

.

If for a we take the type of natural numbers, then f is an arbitrary sequence of types. 4.3. The use of AUT-QE

Similarly we have arbitrary prop-valued f u n c t i o n s in AUT-QE. These are especially useful in our interpretation of logic, for a prop-valued function with domain a is nothing but a predicate over a . For example, by an EB-line

a * R

.-

[z : nat] [y : nat] prop

~

an arbitrary binary predicate (rather: relation) on the natural numbers is introduced. The presence of predicate and relation variables in AUT-QE allows us to write axiom s c h e m e s with such variables, e.g. to introduce a further equality axiom (cf. Section 3.6) we can write:

y

* i

i

*

j

..-.....-.-

j

*

ISAX2

:=

a

*

P

P * x Z

*

Y

[z : a]prop

~

a

~

a

~

~

~

PN

~~

IS(X,Y) ( X P

(YP

We emphasize, however, that abstraction over such 2-variables (e.g. type-variables, prop-variables, predicate-variables) in AUT-QE is still forbidden, so both AUT-68 and AUT-QE may still be called first-order systems. 4.4. Type-inclusion and prop-inclusion

Just as in AUT-68 the function-like 2-expression f (cf. Section 4.2) also codes its corresponding function space, i.e. the type of those g with domain a such that

A description of Automath (A.3)

115

for A E o we have (A)g E (A)f. As prop behaves just like type, the predicate P (cf. Section 4.3) also denotes the proposition V = E .~P ( z ) . As a consequence, we allow the transition from C E [z : a]type to C E type. This transition or, in general, from E

[XI : a11

... [ Z k : a k ] [YI : PI]... [Ym : Pm] type

CE

[XI : CYI]

,.. [ X k : a k ] type

to

is called type-inclusion. The similar transition with prop instead of type is called prop-inclusion. By this type-inclusion and prop-inclusion AUT-QE contains AUT-68 as a proper subsystem. Notice that for 2-expressions uniqueness of types - if A E a,A E ,B then a = 3'/ - is lost. 4.5. Let us finish with a table in which some Automath notions are listed with their possible meanings in the propositions-as-types interpretation.

Automath-notions

object-and-type interpretation

2-expressions 3-expressions ... E ... function-like 2-expressions

types objects ... has type ... type-valued functions function types

variable introductions primitive object introductions abbreviations lines definitions or abbreviations EB-lines PN-lines

proof-and-proposition interpretation propositions proofs ... proves ... predicates implications universal statements assumptions axioms theorems

5. A FORMAL DEFINITION OF AUT-QE

5.1. The language, to be defined now, is the one accepted by the current checker (cf. [Zandleven 73 (E.1)])except for two points: (i) Paragraph facilities are not present here so all constant names have to be distinct (cf. Section 2.16). (ii) There is no shorthand facility (i.e. all expressions are written out in full) (cf. Section 2.15).

D.T. van Daalen

116

The actual formalism has been chosen in this way in order to keep as close as possible to the preceding informal book-and-line description. A definition along more usual natural deduction lines may possibly be more elegant. For technical reasons we preferred to avoid redundancy almost completely in our definition. As a consequence of this, some useful extra rules follow as derived rules in the section on language theory. 5.2. Our aim is to define formally what correct AUT-QE books are.

The description consists of (i) Preliminaries, mainly devoted to the context free part of the language (Section 5.4). (ii) Simultaneous definition of correctness of books, contexts, lines, expressions, E-formulas and Q-formulas (Section 5.5). The 4-formulas only serve as a help in our definition; they do not appear in the book. The kernel of (ii) is the definition of correctness of expressions and formulas relative to a certain book and context. Here the book serves to determine the set of primitive notions and abbreviations, and the context serves to determine the set of valid free variables. Most concepts are introduced by ordinary inductive definitions. These consist of a finite set of rules of the form: “if ... then ...”. Here only such conclusions may be drawn which follow from a finite number of applications of the rules. 5.3. Notational conventions 5.3.1. An extensive use is made of syntactic variables throughout the definition. Often certain assumptions on these variables are implicit by their specific choice, e.g. u and always run over contexts. Syntactic variables may always be indexed or primed.

<

5.3.2. As for substitution and a-conversion (renaming of bound variables) we adopt the following point of view: expressions with bound variables are considered as named versions - named to facilitate reading - of some actually namefree skeleton (cf. [ d e Bruijn 72b (C.2)]).Thus we identify a-equal expressions and assume that a-conversion is applied whenever necessary t o avoid clash of variables. We use ... = ... to denote syntactic identity (symbol-for-symbol equality) modulo a-equality. E.g. [z : C ]...2 ...z... = [p : C]...p ... y ... . 5.3.3. Correctness of expressions A and formulas cp relative to a book B and a context u are abbreviated by B ; u I- A and B ; u I- cp respectively. Sometimes we write I- A or u I- A for B ;u I- A and I- cp or u I- cp for U; u I- cp when there

117

A description of Automath (A.3)

is no particular need to emphasize the current book or context. The notions I-(i) A and I-(z) A E B are used to express that A is an i-expression and I- A (respectively I- A E B).

5.4. Preliminaries 5.4.1. Alphabet (1) As variables and constants we allow any alphanumeric string. Such a string is considered atomic and is thus counted as one single symbol. Syntactic variables for variables are x , y , a, ... . Among the constants (syntactic variable c ) we distinguish primitive (syntactic variables p , q ) and defined or abbreviational constants (syntactic variable d).

( 2 ) Improper symbols (i)

Some brackets and braces: [, 1, (, ), (, ).

(ii) Some separation marks: !, *, I-, El :=, =, semicolon and comma. (iii) Some reserved symbols: EB, PN.

5.4.2. Expressions (syntactic variables A , B,C, D, ..., C,A,I', ...) (i)

Variables: x.

(ii)

Abstraction expressions: [x : C] A.

(iii) Applications expressions: @)A. (iv) Constant-expression instances: c(C1, ..., C,) (k may be 0, in which case we write just c instead of c( )). (v) Basic constants: type, prop. As special syntactic variables for 2-expressions we take a , p, ... .

5.4.3. Formulas (syntactic variable

'p)

(i) E-formulas: C E A. (ii) 9-formulas: C Q A.

6.4.4. Additional concepts (1) Contexts (syntactic variables u,E): A n y finite (possibly empty) sequence of E-formulas xi E X i , separated by commas, where all xi are different.

D.T. van Daalen

118

(2) Lines (syntactic variable A) (i) EB-lines

:

(ii) PN-lines

:u

~7

(iii) Abbreviation lines: u

*z:=EBEC. *~:=PNEC.

* d := A

EC

(3) Books (syntactic variable a): Any finite (possibly empty) sequence of lines, separated from one another b y exclamation signs (!).

5.4.5. Free variables We define the free variable se