We present a short and direct syntactic proof of the fact that adding the axiom of choice and the principle of excluded-middle to Coquand-Huet's Calculus of Constructions gives proof-irrelevanc

Barbanera, Franco

Berardi, Stefano

RERO DOC Digital Library

J. Functional Programming 6 (3): 519-525, May 1996 © 1996 Cambridge University Press 519Proof-irrelevance out of excluded-middle andchoice in the calculus of constructionsFRANCO BARBANERA AND STEFANO BERARDIDipartimento di Informatica, Universita' di Torino, Corso Svizzera 185,10149 Torino, Italy(e-mail: {barba.stefano} Sdi.unito.itJAbstractWe present a short and direct syntactic proof of the fact that adding the axiom of choiceand the principle of excluded-middle to Coquand-Huet's Calculus of Constructions givesproof-irrelevance.Capsule ReviewSystems of type theory are used to formalise proofs. For such formalisations it is alwaysimportant to know whether they are faithful, i.e. if there exists a formal proof, is there alsoan proof in intuitive mathematics? The present paper does not directly adress this issue butis relevant: if the axiom of choice and the excluded middle are added to certain type systems,then all proofs become provably equal. This is in the spirit of classical mathematics, in whichone cares more about the truth of a statement than about its provability. The property doesnot only hold for the calculus of constructions but also for simpler systems in the /l-cube.The proof does not carry over to the logical-cube.1 IntroductionThe present paper aims to be a contribution to the analysis of the intensional aspectsof Coquand-Huet's Calculus of Constructions (CC). We will show that adding theclassical principle of excluded-middle (<£//) and the axiom of choice {^<€) to CCyields the so called proof-irrelevance, i.e. any small class (element of Prop) has atmost one element for Leibniz equality or, equivalently, the only model for the theoryturns out to be necessarily the one where Prop is interpreted as a two elements setand each type is either empty or it has only one element.Proofs of similar results were previously devised by Coquand and Pottinger.Coquand (1990) showed that CC with the excluded-middle and a derivation rule fora strong version of disjoint sum yields proof-irrelevance. To do so he showed that,by assuming true to be not equal to false (with respect to Leibniz equality), it ispossible to define an interpretation of Girard's logically inconsistent system, "U, intohis extended CC. Thus, by the inconsistency of °U, it follows that true is equal tofalse, a fact that implies proof-irrelevance.use, available at https:/www.cambridge.org/core/terms. https://doi.org/10.1017/S0956796800001829Downloaded from https:/www.cambridge.org/core. University of Basel Library, on 11 Jul 2017 at 14:49:20, subject to the Cambridge Core terms of520 F. Barbanera and S. BerardiA similar argument was also used by Pottinger (1989) (see also Geuvers (1993,pp. 158-159)) to show that proof-irrelevance can also be obtained by extending CCwith the excluded-middle and the so-called axiom of definite descriptions, which canbe seen as a weaker form of the axiom of choice.The above-mentioned proofs then heavily rely on the properties of Girard's system<%, while the alternative proof we give here is direct and self-contained in nature. Itwill consist in constructing a small class and an embedding-projection pair showingthat the set of its parts is a retract of it. The existence of such a pair will then beproved to imply a formalisation of Russell's paradox, and hence the identification,with respect to Leibniz equality, of true and false. (A related proof technique is alsoexploited by Hurkens (1995) to define a paradoxical term for a restriction of %.)Our proof will make essential use of the ambiguity, typical of CC, between smallclasses and propositions. This ambiguity will allow us to define, in section 3.1, asmall class as a product indexed over all small classes. So, a similar proof could notgo through in systems like (higher-order) predicate logic or HAM, even though theyare close to CC in many aspects.We shall use a strong version of the axiom of choice to enhance the simplicity ofthe proof, even if the result holds also for weak versions of it.A complete formal description of our proof can easily be given in few lines ofcode in any current implementation of CC. In particular, the formalisation in theLEGO language of a variant of it can be found in Berardi (1994).A close examination of our proof shows that it works not only for the wholeCC, but it can also be carried over in a fragment of CC, i.e. its subsystem IP 2 (seeBarendregt (1992) and Geuvers (1994) for a definition of XP2 and its relationshipto logics).In what follows we assume the reader to be well acquainted with CC and itsproperties. We refer otherwise to Barendregt (1992), Coquand and Huet (1988) andGeuvers (1993).2 PreliminariesWe recall that it is possible to define all the logical operators inside CC, as wellas their introduction and elimination rules in natural deduction. For instance, wecan define 3x:A.P =Def ILY:Prop.((IIx:AP -> X) -»• X), where B -> C is short, asusual, for Yly.B.C with y £ FV(C). In the following, the terms in CC that representbinary logical operations ('A','V',...) will be used, for the sake of readability, in infixnotation.The Leibniz equality can, as usual, be defined as follows:Eq =Def XAPropAxyAUP (A -> Prop).(Py) -> (Px).In the rest of the paper we shall write simply 'a =A b' for (Eq A a b), where A is thetype of a and b.One definition more we recall is that of the type of Booleans and its elements:Bool =Def IL4:Prop./l -> A -> A,use, available at https:/www.cambridge.org/core/terms. https://doi.org/10.1017/S0956796800001829Downloaded from https:/www.cambridge.org/core. University of Basel Library, on 11 Jul 2017 at 14:49:20, subject to the Cambridge Core terms ofProof-irrelevance out of excluded-middle and choice 521true =Def ?A:Proplx y:A.x , false =Def XAProp.lxy.A.y.To have an inhabitant of the type false =Bool t r u e implies, as said above, proof-irrelevance, that is a =A b for any small type A and a, b : A. In fact, for any A anda,b : A, it is possible to define f : Bool -» A such that (f true) is convertible to a and(f false) is convertible to b.Giving explicitely all the CC-terms that form our proof could prevent the readerto single out the main ideas underlying it. So we shall often describe how to buildsuch CC-terms, without actually doing it. To make our argument still more readablewe shall often use the abbreviation 'derive A' for 'derive a term of type A'.2.0.1 Formalising 8JI and s?^ into CCLet us see how to formalise in CC the law of the excluded-middle and the axiomof choice. For the excluded-middle we can simply introduce a constant $Jt which,taken an element A of Prop returns an element of (A V ->A), i.e.8M : WA :Prop.(/l V ->A).It is worth recalling that introducing a constant in CC corresponds to working in acontext with a variable of suitable type.In CC, sets are necessarily introduced by comprehension, so the axiom of choicecan be seen as the possibility of getting, out of a proof of 3x:A.P(x), an element aof A and a proof of P(a). In particular, we can introduce two constants that, givenA : Prop, a predicate P on A and a term (proof) h : 3x :A.(P x) return, respectively,a witness a of type A and a proof of (P a), i.e. of the fact that a is indeed a witnessof 3x:A.(Px).We therefore add the following two constants to CC:: rL4:Prop.nP:(/l -> Prop).((3x:A(Px)) -> A): IL4:Prop.IIP:(A -> Prop).nh:3x:A.(Px).(P(ji/<gph))where (,*/<£> h) is short for (j/<<£> A P h).Note that these terms are uniform on A and P. So, our axiom of choice isstronger than the choice axiom of set theory. Moreover, if one defines 3 !x :A.(Px) as(3x:A.(Px)) A (Tlxy:A.(Px) -> (Py) -> (x =A y)), and replaces 3 by 3!, then st^?and •s/'i^ V become weaker and correspond, respectively, to the axiom i and to theaxiom of definite-descriptions described in Pottinger (1989) (see also Geuvers (1993,pp. 158-159)).2.0.2 Reasoning by cases in CC+SJi+stf^Since it will be necessary, in our proof, to reason by cases, we internalise in CC+&Jt+jtfc& such sort of reasoning by building an operator IfThenElse that, givenan element A : Prop, considered as condition, and two elements ci and C2 of a typeC : Prop, 'returns' (is equal to) c\ in case A is true (inhabited), and ci otherwise. Itis easy to realise that in the definition of such an operator, the use of the axiom SJlplays an essential role.use, available at https:/www.cambridge.org/core/terms. https://doi.org/10.1017/S0956796800001829Downloaded from https:/www.cambridge.org/core. University of Basel Library, on 11 Jul 2017 at 14:49:20, subject to the Cambridge Core terms of522 F. Barbanera and S. BerardiGiven A : Prop and c\,ci : C, we may build, by means of the formalisation of asimple standard argument in classical logic, a term (proof) p of type 3x:C.(((x =cc\) A A) V ((x =c C2) A (-'A))). We can then 'extract' from p, by means of J / ^ > ,a term (jaf^y p) : C and, using s/^st, prove it equal to ci or c2 in case /I is trueor false (i.e. inhabited or not), respectively. In particular, it is possible to proveA — ((s/Vr p) = c ci) and -.X - • ((j*«> p) = c c2).Our term IfThenElse will then beIfThenElse =Def UC :Prop.lci C 2 : C . ( J ^ ^ p).In the following we shall write (IfThenElse A c\ c2), instead of (IfThenElse AC c\ c2),to enhance readability.3 CC+SJt+d^ h Proof-IrrelevanceIn this section we present the proof of our main result. It will consist of two mainsteps:• The construction of a small class U : Prop and of an embedding-projectionpair showing that ^(U) (the 'powerset of U') is a retract of U.• The derivation of Russell's paradox from the existence of the above embedding-projection pair between ^(U) and U.3.1 U and the embedding-projection SP(^S) <t ULet us begin by defining the small class (proposition) U as the infinite product of allthe powersets of small classes.U =Def UXProp.^(X) : Prop,where SP{X) is short for the proposition (X —» Bool) : Prop, denoting the set of'subsets' of X.It is clear that ^"(U), being an element of Prop, is a 'component' of U itself andhence it is possible to define an embedding 3P{\S) «-» U. In fact, given an element /in ^(U), we can map it into the infinite sequence having / at 'position' U and anarbitrary value of &(X) at any other 'position' X.It is also easy to see that U can be trivially mapped onto ^(U): given an infinitesequence contained in U one can simply 'select' its component at 'position' U. So,it is intuitively possible to show that ^(U) < U, i.e. that SP^S) is a retract of U, bymeans of the embedding-projection pair informally described above.Let us actually build now the terms in CC+SJi+sPS that formalise it.The projection is trivial to describe formally.proju =Def ;.w:U.(uU) : U -» ^(U) .The formalisation of the embedding, instead, is not so immediate. Let / : ^(U).Following the informal description of the embedding, we can map / to IX :Prop.q* :use, available at https:/www.cambridge.org/core/terms. https://doi.org/10.1017/S0956796800001829Downloaded from https:/www.cambridge.org/core. University of Basel Library, on 11 Jul 2017 at 14:49:20, subject to the Cambridge Core terms ofProof-irrelevance out of excluded-middle and choice 523U, where the term q* is such that/x \ anything* otherwise.anything* can be any element of 9{X) in the product U(= TIX:Prop.0»(X)). Wecould choose it to be, for instance, lx:Xfalse, i.e. the empty subset of X, henceforthdenoted by 0X • &(X).Then our goal is now to get a formal description of the term q*.Note that the naive definition of q* as (lfThenElse(X = U) / 0x), where '= ' isthe CC-predicate stating that two small classes are isomorphic, cannot work becauseof typing problems. In fact / and 0*, which should have the very same type in(ifThenElse (X = U) / 0*), have type ^(U) and 0>(X), respectively. To get q* wecan, instead, proceed as follows. Let us consider the CC-predicate stating that twosmall classes are one the retract of the other.' < ' =Def XAB:Prop3g:A-*B3h:B^A.(e-p-pa\rg h),where e-p-pair, the predicate stating that two functions form an embedding-projection pair, is defined as follows.e-p-pair =Def Xg.A^BlW.B->•A.((h o g) =A_A {\6A)).Id is the obvious CC-term representing the polymorphic identity and 'o', used in infixnotation, is the CC-term denoting function composition. Also '< ' will be used ininfix notation.From the definition of '< ' it is straightforward to get a term, say t*, of type(0>(X)< ^(U)) -> (3g:0>(X)^>0>(\J)3h:0>([J)^>0>(X).(e-p-pa\rgh)). (1)In classical logic, unlike in the intuitionistic case, any formula of the form (Q -* 3x.S),with x ^ FV(Q), is equivalent to 3x.(Q -* S) in case the domain of x is non-empty.Now, since in CC+SJf+srf^ we can formalise classical reasoning, and the domains0>(X) -> 0"(U) and >^(U) -»• 0>{X) are both non-empty (they contain, for instance,the constant functions kx:0>{X)§\^ and lx:0>{U)$x, respectively), it is easy to get aterm, say t^, of type3g:0>(X)->0>{\J)3h:0>(\J)^>0>(X).((0>(X) < 0>(U)) -> (e-p-pair g h)). (2)Now, by using stf^gF and stf^d on t^ -, it is possible to get a pair of terms (<l>x>il/x)>and prove that they are an embedding-projection pair in case ^(X) < ^(U) (acondition trivially satisfied when X is U). In particular, (^x(#U /)) is the term q^we were looking for, i.e. a term of type &{X) equal to / in case X is U (if it returnsQx or something else otherwise, is not essential for our argument).Then we have that "^(U) < U by means of the embedding-projection pair(inju,proju), where=Def l/:^(U).AX:Prop.(^Ar(^u /)) : «?(U) -> U=Def : Uuse, available at https:/www.cambridge.org/core/terms. https://doi.org/10.1017/S0956796800001829Downloaded from https:/www.cambridge.org/core. University of Basel Library, on 11 Jul 2017 at 14:49:20, subject to the Cambridge Core terms of524 F. Barbanera and S. BerardiIn fact, since <f>x and \jtx come out of t^ - we can derivei / :^ (U) . (^u (<t>u / ) ) = ^ ( U H ^ ( U ) (IdFrom this, using the fact thatit is then possible to derive(proju o inju) = ^ ( U H 3 S ( U ) (I3.2 <?(U) <t U implies Russell's paradoxUsing U and the fact that ^(U) is a retract of it, it is possible to rephrase in oursetting the well known argument of Russell's paradox.The universe we consider is U. The existence of a projection from U to 3P{\S)enables us to consider the elements of U also as sets (an element u : U correspondsto the set (projy u) : ^ (U))). So, we can express the fact that u : U, seen as element,'belongs' to v : U, seen as set, by means of the following CC-predicatebelongs =Def l.uv:\J.(((pro]v v) u) =Bool t r u e ) : u ~* u ~* Prop.We will denote (belongs u v) by (u € v).We can now carry on Russell's argument by defining the collection of the elementsof our universe that do not belong to themselves.RussellClass =Def Au:ll. (IfThenElse ->(u € u) true false):The element of U corresponding to the element of ^(U) just denned is thenr =Def (injjj RussellClass ) : U.Such an object, as in Russell's argument, is paradoxical. In fact it is possible toderive, as shown below, (false =Bool t r u e ) ^>0^ fr°m t n e assumption (r e r) andfrom the assumption ->(r € r). Moreover, by SJl, we can derive ((r e r) V -i(r e r)),and hence, by means of the term formalising in CC the rule of elimination ofdisjunction, it is possible to obtain a closed term of type (false =Bool t r u e ) - Such aterm, as said before, gives proof-irrelevance.Let us see how to get (false =Bool t r u e ) b ° t n fr°m (r e r) an(* fr°m ~'(r € r).Let us assume (r e r). By expanding the definitions of r and €, we get((projy (injy RussellClass)) r) = B o o | true.Now, since (inj(j, projy) is an embedding-projection pair, i.e. (projy o injy) =<5»(UH3»(U)(ld ^ "(u))> w e 8e t ((RussellClass r) =Bool t rue). This, by definition, is((IfThenElse -i(r e r) true false) =Bool t r u e )and hence, by our assumption and the properties of IfThenElse , we can derive(false = B o O | true).Now let us assume instead ->(r € r). Following the same argument of the previoususe, available at https:/www.cambridge.org/core/terms. https://doi.org/10.1017/S0956796800001829Downloaded from https:/www.cambridge.org/core. University of Basel Library, on 11 Jul 2017 at 14:49:20, subject to the Cambridge Core terms ofProof-irrelevance out of excluded-middle and choice 525case it is possible, this time, to get -i(true =Bool t r u e ) a n d -L from it. By ex-falso-quodlibet, also in this case we derive (false =Bool t r u e ) -It is worth noticing that indeed, for the Russel's paradox, we do not really needinj(j, but only the fact that projy is surjective. To prove this fact one could proceedas follows. Consider the function i]/x : 0>(U) —> SP(X) as defined in the previoussubsection. \jix is surjective whenever 3?{X) is a retract of 2?{U). Define now thefollowing function.F =Def A/:0»(U).AX:Prop.(*Jf / ) : 0»(U) -> UBy the fact that (projy o f ) is equal to \//\j it follows that projy is surjective as well.It is also interesting to notice that in our argument we have derived proof-irrelevance by the possibility of deriving (false =Bool *rue)> e v e n if the definitionsof Bool, true and false are not really necessary. In fact, it would be possible towork in a context containing the variables A:Prop,x:A,y:A and to replace in ourargument A, x and y for Bool, true and false, respectively. We would then derivex =A y, and hence proof-irrelevance.AcknowledgementsWe wish to thank Mariangiola Dezani and Mario Coppo for their support andgentle guidance, and an anonymous referee for helping us in improving section 3.1and for the remarks at the end of section 3.2.The first author wishes also to thank Eleonora and Pino Lucci.ReferencesBarendregt, H. P. (1992) Typed Lambda Calculi. In Abramski et al., editors, Handbook ofLogic in Computer Science., Oxford University Press.Berardi, S. (1994) A formalization in LEGO of a proof of CC+gJl+sfg h Proof-Irrelevance.Technical Report, Department of Computer Science University of Torino.Coquand, T. (1990) Metamathematical investigation of a calculus of construction. In P.Odifreddi, editor, Logic and Computer Science. Academic Press.Coquand, T. and Huet, G. (1988) The Calculus of Constructions. Information and Computation76.Geuvers, H. (1993) Logics and Type Systems. PhD Thesis, University of Nijmegen.Geuvers, H. (1994) Conservativity between logics and typed A-calculi. Proc. BRA Workshopon Types for Proofs and Programs.Hurkens, A. J. C. (1995) A simplification of Girard's paradox. In M. Dezani-Ciancagliniand G. Plotkin editors, Proc. 2nd International Conference on Typed Lambda Calculi andApplications (TLCA'95): Lecture Notes in Computer Science 902. Springer-Verlag.Pottinger, G. (1989) Definite descriptions and excluded middle in the calculus of constructions.TYPES network, November.use, available at https:/www.cambridge.org/core/terms. https://doi.org/10.1017/S0956796800001829Downloaded from https:/www.cambridge.org/core. University of Basel Library, on 11 Jul 2017 at 14:49:20, subject to the Cambridge Core terms of

Proof-irrelevance out of excluded-middle and choice in the calculus of constructions

Abstract

Similar works

Full text

Available Versions

RERO DOC Digital Library