1% Revised version of Part II, Chapter 10 of HOL DESCRIPTION 2% Incorporates material from both of chapters 9 and 10 of the old 3% version of DESCRIPTION 4% Written by Andrew Pitts 5% 8 March 1991 6% revised August 1991 7\chapter{Theories}\label{semantics} 8 9\section{Introduction} 10 11The result, if any, of a session with the \HOL{} system is an object 12called a {\it theory\/}. This object is closely related to what a 13logician would call a theory\index{theories, in HOL logic@theories, in \HOL{} logic!abstract form of}, but there are some differences arising 14from the needs of mechanical proof. A \HOL{} theory, like a logician's 15theory, contains sets of types, constants, definitions and axioms. In 16addition, however, a \HOL{} theory, at any point in time, contains an 17explicit list of theorems that have already been proved from the 18axioms and definitions. Logicians have no need to distinguish theorems 19actually proved from those merely provable; hence they do not normally 20consider sets of proven theorems as part of a theory; rather, they 21take the theorems of a theory to be the (often infinite) set of all 22consequences of the axioms and definitions. A related difference 23between logicians' theories and \HOL{} theories is that for logicians, 24theories are static objects, but in \HOL{} they can be thought of as 25potentially extendable. For example, the \HOL{} system provides tools 26for adding to theories and combining theories. A typical interaction 27with \HOL{} consists in combining some existing theories, making some 28definitions, proving some theorems and then saving the new results. 29 30The purpose of the \HOL{} system is to provide tools to enable 31well-formed theories to be constructed. The \HOL{} logic is typed: 32each theory specifies a signature of type and individual constants; 33these then determine the sets of types and terms as in the previous 34chapter. All the theorems of such theories are logical consequences 35of the definitions and axioms of the theory. The \HOL{} system ensures 36that only well-formed theories can be constructed by allowing theorems 37to be created only by {\it formal proof\/}. Explicating this involves 38defining what it means to be a theorem, which leads to the description 39of the proof system of \HOL, to be given below. It is shown to be {\em 40sound\/} for the set theoretic semantics of \HOL{} described in the 41previous chapter. This means that a theorem is satisfied by a model 42if it has a formal proof from axioms which are themselves satisfied by 43the model. Since a logical contradiction is not satisfied by any 44model, this guarantees in particular that a theory possessing a model 45is necessarily consistent, \ie\ a logical contradiction cannot be 46formally proved from its axioms. 47 48This chapter also describes the various mechanisms by which \HOL\ 49theories can be extended to new theories. Each mechanism is shown 50to preserve the property of possessing a model. Thus theories built 51up from the initial \HOL{} theory (which does possess a model) using 52these mechanisms are guaranteed to be consistent. 53 54 55\section{Sequents} 56\label{sequents} 57 58The \HOL{} logic is phrased in terms of hypothetical assertions called 59{\em sequents}.\index{sequents!in natural deduction} Fixing a 60(standard) signature $\Sigma_\Omega$, a sequent is a pair $(\Gamma, 61t)$ where $\Gamma$ is a finite set of formulas over $\Sigma_\Omega$ 62and $t$ is a single formula over $\Sigma_\Omega$.\footnote{Note that 63the type subscript is omitted from terms when it is clear from the 64context that they are formulas, \ie\ have type \ty{bool}.} The set of 65formulas $\Gamma$ forming the first component of a sequent is called 66its set of {\it assumptions\/}\index{assumptions!of sequents} and the 67term $t$ forming the second component is called its {\it 68conclusion\/}\index{conclusions!of sequents}. When it is not ambiguous 69to do so, a sequent $(\{\},t)$ is written as just $t$. 70 71 72Intuitively, a model $M$ of $\Sigma_\Omega$ {\em 73satisfies}\index{satisfaction of sequents, by model} a sequent 74$(\Gamma, t)$ if any interpretation of relevant free variables as 75elements of $M$ making the formulas in $\Gamma$ true, also makes the 76formula $t$ true. To make this more precise, suppose 77$\Gamma=\{t_1,\ldots,t_p\}$ and let $\alpha\!s,\!x\!s$ be a 78context containing all the type variables and all the free variables 79occurring in the formulas $t,t_{1},\ldots,t_{p}$. Suppose that 80$\alpha\!s$ has length $n$, that $x\!s=x_{1},\ldots,x_{m}$ and that the 81type of $x_{j}$ is $\sigma_{j}$. Since formulas are terms of type 82$\bool$, the semantics of terms defined in the previous chapter gives 83rise to elements $\den{\alpha\!s,\!x\!s.t}_M$ and 84$\den{\alpha\!s,\!x\!s.t_{k}}_M$ ($k=1,\ldots,p$) in 85\[ 86\prod_{X\!s\in{\cal U}^{n}} \left( 87\prod_{j=1}^{m}\den{\alpha\!s.\sigma_{j}}_M(X\!s)\right) \fun \:\two \] 88Say that the model $M$ {\em satisfies\/} the sequent $(\Gamma,t)$ and 89write 90\[ 91\Gamma \models_{M} t 92\] 93if for all $X\!s\in{\cal U}^{n}$ and 94all $y\!s\in\den{\alpha\!s.\sigma_{1}}_M(X\!s)\times\cdots\times 95\den{\alpha\!s.\sigma_{m}}_M(X\!s)$ with 96\[ 97\den{\alpha\!s,\!x\!s.t_{k}}_M(X\!s)(y\!s)=1 98\] 99for all $k=1,\ldots,p$, it is also the case that 100\[ 101\den{\alpha\!s,\!x\!s.t}_M(X\!s)(y\!s)=1. 102\] 103(Recall that $\two$ is the set $\{0,1\}$.) 104 105In the case $p=0$, the satisfaction of $(\{\},t)$ by $M$ will be written 106$\models_{M} t$. Thus $\models_{M} t$ means that the dependently typed function 107\[ 108\den{t}_M \in \prod_{X\!s\in{\cal U}^{n}} 109\left(\prod_{j=1}^{m}\den{\alpha\!s.\sigma_{j}}_M(X\!s)\right) \fun \:\two 110\] 111is constant with value $1\in\two$. 112 113\section{Logic} 114 115A deductive system\index{deductive systems} 116${\cal D}$ is a set of pairs $(L,(\Gamma,t))$ where $L$ is a 117(possibly empty) list of sequents and $(\Gamma,t)$ is a sequent. 118 119A sequent $(\Gamma,t)$ follows from\index{follows from, in natural deduction} 120a set of sequents 121$\Delta$ by a deductive system 122${\cal D}$ if 123and only if there exist sequents 124$(\Gamma_1,t_1)$, $\ldots$ , $(\Gamma_n,t_n)$ such that: 125\begin{enumerate} 126\item $(\Gamma,t) = (\Gamma_n,t_n)$, and 127\item for all $i$ such that $1\leq i\leq n$ 128\begin{enumerate} 129\item either 130$(\Gamma_i,t_i)\in \Delta$ or 131\item $(L_i,(\Gamma_i,t_i))\in{\cal D}$ for some list $L_i$ of members of 132$\Delta\cup\{(\Gamma_1,t_1),\ldots,(\Gamma_{i-1},t_{i-1})\}$. 133\end{enumerate} 134\end{enumerate} 135The sequence $(\Gamma_1,t_1),\cdots,(\Gamma_n,t_n)$ 136is called a {\it proof\/}\index{proof!in natural deduction} of 137$(\Gamma,t)$ from $\Delta$ with respect to ${\cal D}$. 138 139Note that if $(\Gamma,t)$ follows from $\Delta$, then $(\Gamma,t)$ 140also follows from any $\Delta'$ such that $\Delta\subseteq\Delta'$. 141This property is called {\it monotonicity\/}\index{monotonicity, in deductive systems}. 142 143The notation\index{turnstile notation} $t_1,\ldots,t_n\vdash_{{\cal 144D},\Delta} t$ means that the sequent $(\{t_1,\ldots,t_n\},\ t)$ 145follows from $\Delta$ by ${\cal D}$. If either ${\cal D}$ or $\Delta$ 146is clear from the context then it may be omitted. In the case that 147there are no hypotheses\index{hypotheses!of sequents} (\ie\ $n=0$), 148just $\vdash t$ is written. 149 150In practice, a particular deductive system is usually specified by a 151number of (schematic) \emph{rules of inference}, 152\index{inference rules, of HOL logic@inference rules, of \HOL{} logic!abstract form of primitive} 153which take the form 154\[ 155\frac{\Gamma_1\turn t_1 \qquad\cdots\qquad\Gamma_n\turn t_n} 156{\Gamma \turn t} 157\] 158The sequents above the line are called the {\it 159hypotheses\/}\index{hypotheses!of inference rules} of the rule and the 160sequent below the line is called its {\it 161conclusion}.\index{conclusions!of inference rules} Such a rule is 162schematic because it may contain metavariables 163standing for arbitrary terms of the appropriate types. Instantiating 164these metavariables with actual terms, one gets a list of sequents 165above the line and a single sequent below the line which together 166constitute a particular element of the deductive system. The 167instantiations allowed for a particular rule may be restricted by 168imposing a {\em side condition\/} on the rule. 169 170 171\subsection{The \HOL{} deductive system} 172\label{HOLrules} 173 174The deductive system of the \HOL{} logic is specified by eight rules 175of inference, given below. The first three rules have no hypotheses; 176their conclusions can always be deduced. The identifiers in square 177brackets are the names of the \ML\ functions in the \HOL{} system that 178implement the corresponding inference rules (see \DESCRIPTION). Any 179side conditions restricting the scope of a rule are given immediately 180below it. 181 182\bigskip 183 184\subsubsection*{Assumption introduction [{\small\tt 185ASSUME}]}\index{assumption introduction, in HOL logic@assumption introduction, in \HOL{} logic!abstract form of} 186\[ 187\overline{t \turn t} 188\] 189 190\subsubsection*{Reflexivity [{\small\tt 191REFL}]}\index{REFL@\ml{REFL}}\index{reflexivity, in HOL logic@reflexivity, in \HOL{} logic!abstract form of} 192\[ 193\overline{\turn t = t} 194\] 195 196\subsubsection*{Beta-conversion [{\small\tt BETA\_CONV}]} 197\index{beta-conversion, in HOL logic@beta-conversion, in \HOL{} logic!abstract form of}\index{BETA_CONV@\ml{BETA\_CONV}} 198\[ 199\overline{\turn (\lquant{x}t_1)t_2 = t_1[t_2/x]} 200\] 201\begin{itemize} 202\item Where $t_1[t_2/x]$ is 203the result of substituting $t_2$ for $x$ 204in $t_1$, with suitable renaming of variables to prevent free variables 205in $t_2$ becoming bound after substitution. 206\end{itemize} 207 208\subsubsection*{Substitution [{\small\tt 209SUBST}]}\index{SUBST@\ml{SUBST}} \index{substitution rule, in HOL logic@substitution rule, in \HOL{} logic!abstract form of} 210\[ 211\frac{\Gamma_1\turn t_1 = t_1'\qquad\cdots\qquad\Gamma_n\turn t_n = 212t_n'\qquad\qquad \Gamma\turn t[t_1,\ldots,t_n]} 213{\Gamma_1\cup\cdots\cup\Gamma_n\cup\Gamma\turn t[t_1',\ldots,t_n']} 214\] 215\begin{itemize} 216\item Where $t[t_1,\ldots,t_n]$ denotes a term $t$ with some free 217occurrences of subterms $t_1$, $\ldots$ , $t_n$ singled out and 218$t[t_1',\ldots,t_n']$ denotes the result of replacing each selected 219occurrence of $t_i$ by $t_i'$ (for $1{\leq}i{\leq}n$), with suitable 220renaming of variables to prevent free variables in $t_i'$ becoming 221bound after substitution. 222\end{itemize} 223 224\subsubsection*{Abstraction [{\small\tt ABS}]} 225\index{ABS@\ml{ABS}}\index{abstraction rule, in HOL logic@abstraction rule, in \HOL{} logic!abstract form of} 226\[ 227\frac{\Gamma\turn t_1 = t_2} 228{\Gamma\turn (\lquant{x}t_1) = (\lquant{x}t_2)} 229\] 230\begin{itemize} 231\item Provided $x$ is not free in $\Gamma$. 232\end{itemize} 233 234\subsubsection*{Type instantiation [{\small\tt INST\_TYPE}]} 235\index{type instantiation, in HOL logic@type instantiation, in \HOL{} logic!abstract form of} 236\newcommand{\insttysub}{[\sigma_1,\ldots,\sigma_n/\alpha_1,\ldots,\alpha_n]} 237\[ 238\frac{\Gamma\turn t} 239{\Gamma\insttysub\turn t\insttysub} 240\] 241\begin{itemize} 242\item Where $t\insttysub$ is the result of substituting, in parallel, 243 the types $\sigma_1$, $\dots$, $\sigma_n$ for type variables 244 $\alpha_1$, $\dots$, $\alpha_n$ in $t$, and where $\Gamma\insttysub$ 245 is the result of performing the same substitution across all of the 246 theorem's hypotheses. 247\item After the instantiation, variables free in the input can not 248 become bound, but distinct free variables in the input may become 249 identified. 250\end{itemize} 251 252\subsubsection*{Discharging an assumption [{\small\tt 253DISCH}]}\index{discharging assumptions, in HOL logic@discharging assumptions, in \HOL{} logic!abstract form of}\index{DISCH@\ml{DISCH}} 254\[ 255\frac{\Gamma\turn t_2} 256{\Gamma -\{t_1\} \turn t_1 \imp t_2} 257\] 258\begin{itemize} 259\item Where $\Gamma -\{t_1\}$ is the set subtraction of $\{t_1\}$ 260from $\Gamma$. 261\end{itemize} 262 263\subsubsection*{Modus Ponens [{\small\tt 264MP}]}\index{MP@\ml{MP}}\index{Modus Ponens, in HOL logic@Modus Ponens, in \HOL{} logic!abstract form of} 265\[ 266\frac{\Gamma_1 \turn t_1 \imp t_2 \qquad\qquad \Gamma_2\turn t_1} 267{\Gamma_1 \cup \Gamma_2 \turn t_2} 268\] 269 270In addition to these eight rules, there are also four {\it 271axioms\/}\index{axioms!as inference rules} which could have been 272regarded as rules of inference without hypotheses. This is not done, 273however, since it is most natural to state the axioms using some 274defined logical constants and the principle of constant definition has 275not yet been described. The axioms are given in Section~\ref{INIT} and 276the definitions of the extra logical constants they involve are given in 277Section~\ref{LOG}. 278 279The particular set of rules and axioms chosen to axiomatize the \HOL\ 280logic is rather arbitrary. It is partly based on the rules that were 281used in the 282\LCF\index{LCF@\LCF}\ logic 283\PPL\index{PPlambda (same as PPLAMBDA), of LCF system@\ml{PP}$\lambda$ (same as \ml{PPLAMBDA}), of \ml{LCF} system}, since \HOL{} was 284implemented by modifying the \LCF\ system. In particular, the 285substitution\index{substitution rule, in HOL logic@substitution rule, in \HOL{} logic!implementation of} rule {\small\tt SUBST} is exactly 286the same as the corresponding rule in \LCF; the code implementing this 287was written by Robin Milner and is highly optimized. Because 288substitution is such a pervasive activity in proof, it was felt to be 289important that the system primitive be as fast as possible. From a 290logical point of view it would be better to have a simpler 291substitution primitive, such as `Rule R' of Andrews' logic ${\cal 292Q}_0$, and then to derive more complex rules from it. 293 294\subsection{Soundness theorem} 295\index{soundness!of HOL deductive system@of \HOL{} deductive system} 296\label{soundness} 297 298\index{inference rules, of HOL logic@inference rules, of \HOL{} logic!formal semantics of} 299\emph{The rules of the \HOL{} deductive system are {\em sound} for 300 the notion of satisfaction defined in Section~\ref{sequents}: for 301 any instance of the rules of inference, if a (standard) model 302 satisfies the hypotheses of the rule it also satisfies the 303 conclusion.} 304 305\medskip 306 307\noindent{\bf Proof\ } 308The verification of the soundness of the rules is straightforward. 309The properties of the semantics with respect to substitution given by 310Lemmas 3 and 4 in Section~\ref{term-substitution} are needed for rules 311\ml{BETA\_CONV}, \ml{SUBST} and 312\ml{INST\_TYPE}\index{INST_TYPE@\ml{INST\_TYPE}}.\footnote{Note in 313 particular that the second restriction on \ml{INST\_TYPE} enables 314 the result on the semantics of substituting types for type variables 315 in terms to be applied.} The fact that $=$ and $\imp$ are 316interpreted standardly (as in Section~\ref{standard-signatures}) is 317needed for rules \ml{REFL}\index{REFL@\ml{REFL}}, 318\ml{BETA\_CONV}\index{BETA_CONV@\ml{BETA\_CONV}}, 319\ml{SUBST}\index{SUBST@\ml{SUBST}}, \ml{ABS}\index{ABS@\ml{ABS}}, 320\ml{DISCH}\index{DISCH@\ml{DISCH}} and \ml{MP}\index{MP@\ml{MP}}. 321 322\section{\HOL{} Theories} 323\label{theories} 324 325A \HOL{} {\it theory\/}\index{theories, in HOL logic@theories, in \HOL{} logic!abstract form of} ${\cal T}$ is a $4$-tuple: 326\begin{eqnarray*} 327{\cal T} & = & \langle{\sf Struc}_{\cal T},{\sf Sig}_{\cal T}, 328 {\sf Axioms}_{\cal T},{\sf Theorems}_{\cal T}\rangle 329\end{eqnarray*} 330where 331\begin{myenumerate} 332 333\item ${\sf Struc}_{\cal T}$ is a type structure\index{type structures, of HOL theories@type structures, of \HOL{} theories} called the type 334structure of ${\cal T}$; 335 336\item ${\sf Sig}_{\cal T}$ is a signature\index{signatures, of HOL logic@signatures, of \HOL{} logic!of HOL theories@of \HOL{} theories} 337over ${\sf Struc}_{\cal T}$ called the signature of ${\cal T}$; 338 339\item ${\sf Axioms}_{\cal T}$ is a set of sequents over ${\sf Sig}_{\cal T}$ 340called the axioms\index{axioms, in a HOL theory@axioms, in a \HOL{} theory} 341 of ${\cal T}$; 342 343\item ${\sf Theorems}_{\cal T}$ is a set of sequents over 344${\sf Sig}_{\cal T}$ called the theorems 345% 346\index{theorems, in HOL logic@theorems, in \HOL{} logic!abstract form of} 347% 348of ${\cal T}$, with 349the property that every member follows from ${\sf Axioms}_{\cal T}$ by 350the \HOL{} deductive system. 351 352\end{myenumerate} 353 354The sets ${\sf Types}_{\cal T}$ and ${\sf Terms}_{\cal T}$ of types and 355terms of a theory ${\cal T}$ are, respectively, the sets of types and 356terms constructable from the type structure and signature of ${\cal 357T}$, \ie: 358\begin{eqnarray*} 359{\sf Types}_{\cal T} & = & {\sf Types}_{{\sf Struc}_{\cal T}}\\ 360{\sf Terms}_{\cal T} & = & {\sf Terms}_{{\sf Sig}_{\cal T}} 361\end{eqnarray*} 362A model of a theory $\cal T$ is specified by giving a (standard) model 363$M$ of the underlying signature of the theory with the property that 364$M$ satisfies all the sequents which are axioms of $\cal T$. Because 365of the Soundness Theorem~\ref{soundness}, it follows that $M$ also 366satisfies any sequents in the set of given theorems, ${\sf 367Theorems}_{\cal T}$. 368 369\subsection{The theory {\tt MIN}} 370\label{sec:min-thy} 371 372The {\it minimal theory\/}\index{MIN@\ml{MIN}}\index{minimal theory, of HOL logic@minimal theory, of \HOL{} logic} \theory{MIN} is defined by: 373\[ 374\theory{MIN} = 375\langle\{(\bool,0),\ (\ind,0)\},\ 376 \{\imp_{\bool\fun\bool\fun\bool}, 377=_{\alpha\fun\alpha\fun\bool}, 378\hilbert_{(\alpha\fun\bool)\fun\alpha}\},\ 379\{\},\ \{\}\rangle 380\] 381Since the theory \theory{MIN} has a signature consisting only of 382standard items and has no axioms, it possesses a unique standard model, 383which will be denoted {\em Min}. 384 385Although the theory \theory{MIN} contains only the minimal standard 386syntax, by exploiting the higher order constructs of \HOL{} one can 387construct a rather rich collection of terms over it. The following 388theory introduces names for some of these terms that denote useful 389logical operations in the model {\em Min}. 390 391In the implementation, the theory \theory{MIN} is given the name 392\theoryimp{min}, and also contains the distinguished binary type 393operator $\fun$, for constructing function spaces. 394 395\subsection{The theory {\tt LOG}} 396\index{LOG@\ml{LOG}} 397\label{LOG} 398 399The theory \theory{LOG} has the same type 400structure as \theory{MIN}. Its signature contains the constants in 401\theory{MIN} and the following constants: 402\[ 403\T_\ty{bool} 404\index{T@\holtxt{T}!abstract form of} 405\index{truth values, in HOL logic@truth values, in \HOL{} logic!abstract form of} 406\] 407\[ 408\forall_{(\alpha\fun\ty{bool})\fun\ty{bool}} 409\index{universal quantifier, in HOL logic@universal quantifier, in \HOL{} logic!abstract form of} 410\] 411\[ 412\exists_{(\alpha\fun\ty{bool})\fun\ty{bool}} 413\index{existential quantifier, in HOL logic@existential quantifier, in \HOL{} logic!abstract form of} 414\] 415\[ 416\F_\ty{bool} 417\index{F@\holtxt{F}!abstract form of} 418\] 419\[ 420\neg_{\ty{bool}\fun\ty{bool}} 421\index{negation, in HOL logic@negation, in \HOL{} logic!abstract form of} 422\] 423\[ 424\wedge_{\ty{bool}\fun\ty{bool}\fun\ty{bool}} 425\index{conjunction, in HOL logic@conjunction, in \HOL{} logic!abstract form of} 426\] 427\[ 428\vee_{\ty{bool}\fun\ty{bool}\fun\ty{bool}} 429\index{disjunction, in HOL logic@disjunction, in \HOL{} logic!abstract form of} 430\] 431\[ 432\OneOne_{(\alpha\fun\beta)\fun\ty\bool} 433\index{one-to-one predicate, in HOL logic@one-to-one predicate, in \HOL{} logic!abstract form of} 434\] 435\[ 436\Onto_{(\alpha\fun\beta)\fun\ty\bool} 437\index{onto predicate, in HOL logic@onto predicate, in \HOL{} logic!abstract form of} 438\] 439\[ 440\TyDef_{(\alpha\fun\ty{bool})\fun(\beta\fun\alpha)\fun\ty{bool}} 441\] 442The following special notation is used in connection with these constants: 443\begin{center} 444\index{existential quantifier, in HOL logic@existential quantifier, in \HOL{} logic!abbreviation for multiple} 445\index{universal quantifier, in HOL logic@universal quantifier, in \HOL{} logic!abbreviation for multiple} 446\begin{tabular}{|l|l|}\hline 447{\rm Notation} & {\rm Meaning}\\ \hline $\uquant{x_{\sigma}}t$ & 448$\forall(\lambda x_{\sigma}.\ t)$\\ \hline $\uquant{x_1\ x_2\ \cdots\ 449x_n}t$ & $\uquant{x_1}(\uquant{x_2} \cdots\ (\uquant{x_n}t) 450\ \cdots\ )$\\ \hline 451$\equant{x_{\sigma}}t$ 452 & $\exists(\lambda x_{\sigma}.\ t)$\\ \hline 453$\equant{x_1\ x_2\ \cdots\ x_n}t$ 454 & $\equant{x_1}(\equant{x_2} \cdots\ (\equant{x_n}t) 455\ \cdots\ )$\\ \hline 456$t_1\ \wedge\ t_2$ & $\wedge\ t_1\ t_2$\\ \hline 457$t_1\ \vee\ t_2$ & $\vee\ t_1\ t_2$\\ \hline 458\end{tabular}\end{center} 459 460The axioms of the theory \theory{LOG} consist of the following 461sequents: 462\[ 463\begin{array}{l} 464 465\turn \T = ((\lquant{x_{\ty{bool}}}x) = 466 (\lquant{x_{\ty{bool}}}x)) \\ 467\turn \forall = \lquant{P_{\alpha\fun\ty{bool}}}\ P = 468 (\lquant{x}\T ) \\ 469\turn \exists = \lquant{P_{\alpha\fun\ty{bool}}}\ 470 P({\hilbert}\ P) \\ 471\turn \F = \uquant{b_{\ty{bool}}}\ b \\ 472\turn \neg = \lquant{b}\ b \imp \F \\ 473\turn {\wedge} = \lquant{b_1\ b_2}\uquant{b} 474 (b_1\imp (b_2 \imp b)) \imp b \\ 475\turn {\vee} = \lquant{b_1\ b_2}\uquant{b} 476 (b_1 \imp b)\imp ((b_2 \imp b) \imp b) \\ 477\turn \OneOne = \lquant{f_{\alpha \fun\beta}}\uquant{x_1\ x_2} 478 (f\ x_1 = f\ x_2) \imp (x_1 = x_2) \\ 479\turn \Onto = \lquant{f_{\alpha\fun\beta}} 480 \uquant{y}\equant{x} y = f\ x \\ 481\turn \TyDef = \begin{array}[t]{l} 482 \lambda P_{\alpha\fun\ty{bool}}\ 483 rep_{\beta\fun\alpha}. 484 \OneOne\ rep\ \ \wedge{}\\ 485 \quad(\uquant{x}P\ x \ =\ (\equant{y} x = rep\ y)) 486 \end{array} 487\end{array} 488\] 489Finally, as for the theory \theory{MIN}, the set ${\sf 490Theorems}_{\theory{LOG}}$ is taken to be empty. 491 492Note that the axioms of the theory \theory{LOG} are essentially {\em 493definitions\/} of the new constants of \theory{LOG} as terms in the 494original theory \theory{MIN}. (The mechanism for making such 495extensions of theories by definitions of new constants will be set out 496in general in Section~\ref{defs}.) The first seven axioms define the 497logical constants for truth, universal quantification, existential 498quantification, falsity, negation, conjunction and disjunction. 499Although these definitions may be obscure to some readers, they are in 500fact standard definitions of these logical constants in terms of 501implication, equality and choice within higher order logic. The next 502two axioms define the properties of a function being one-one and onto; 503they will be used to express the axiom of infinity (see 504Section~\ref{INIT}), amongst other things. The last axiom defines a 505constant used for type definitions (see Section~\ref{tydefs}). 506 507The unique standard model {\em Min\/} of \theory{MIN} gives rise to a 508unique standard model of 509\theory{LOG}\index{LOG@\ml{LOG}!formal semantics of}. This is 510because, given the semantics of terms set out in 511Section~\ref{semantics of terms}, to satisfy the above equations one 512is forced to interpret the new constants in the following way: 513\index{axioms!formal semantics of HOL logic's@formal semantics of \HOL{} logic's|(} 514\begin{itemize} 515 516\item $\den{\T_{\bool}}\index{T@\holtxt{T}!formal semantics of} = 1 \in \two$ 517 518\item \index{universal quantifier, in HOL logic@universal quantifier, in \HOL{} logic!formal semantics of} 519$\den{\forall_{(\alpha\fun\bool)\fun\bool}}\in\prod_{X\in{\cal 520 U}}(X\fun\two)\fun\two$ sends $X\in{\cal U}$ and $f\in X\fun\two$ to 521\[ 522\den{\forall}(X)(f) = \left\{ \begin{array}{ll} 1 & \mbox{if 523$f^{-1}\{1\}=X$} \\ 0 & \mbox{otherwise} \end{array} \right. 524\] 525\index{universal quantifier, in HOL logic@universal quantifier, in \HOL{} logic!formal semantics of} 526 527\item \index{existential quantifier, in HOL logic@existential quantifier, in \HOL{} logic!formal semantics of} 528$\den{\exists_{(\alpha\fun\bool)\fun\bool}}\in\prod_{X\in{\cal 529 U}}(X\fun\two)\fun\two$ sends $X\in{\cal U}$ and $f\in X\fun\two$ to 530\[ 531\den{\exists}(X)(f) = \left\{ \begin{array}{ll} 532 1 & \mbox{if $f^{-1}\{1\}\not=\emptyset$} \\ 533 0 & \mbox{otherwise} 534 \end{array} 535 \right. \] 536 537\item $\den{\F_{\bool}} = 0 \in \two$\index{F@\holtxt{F}!formal semantics of} 538 539\item $\den{\neg_{\bool\fun\bool}}\in\two\fun\two$ sends $b\in\two$ to 540 \[ \den{\neg}(b) = \left\{ \begin{array}{ll} 541 1 & \mbox{if $b=0$} \\ 542 0 & \mbox{otherwise} 543 \end{array} 544 \right. \]\index{negation, in HOL logic@negation, in \HOL{} logic!formal semantics of} 545 546\item $\den{\wedge_{\bool\fun\bool\fun\bool}}\in\two\fun\two\fun\two$ sends 547$b,b'\in\two$ to 548 \[ \den{\wedge}(b)(b') = \left\{ \begin{array}{ll} 549 1 & \mbox{if $b=1=b'$} \\ 550 0 & \mbox{otherwise} 551 \end{array} 552 \right. \]\index{conjunction, in HOL logic@conjunction, in \HOL{} logic!formal semantics of} 553 554\item $\den{\vee_{\bool\fun\bool\fun\bool}}\in\two\fun\two\fun\two$ sends 555$b,b'\in\two$ to 556 \[ \den{\vee}(b)(b') = \left\{ \begin{array}{ll} 557 0 & \mbox{if $b=0=b'$} \\ 558 1 & \mbox{otherwise} 559 \end{array} 560 \right. \]\index{disjunction, in HOL logic@disjunction, in \HOL{} logic!formal semantics of} 561 562\item $\den{\OneOne_{(\alpha\fun\beta)\fun\bool}}\in\prod_{(X,Y)\in{\cal 563 U}^{2}} (X\fun Y)\fun \two$ sends $(X,Y)\in{\cal U}^{2}$ and 564 $f\in(X\fun Y)$ to 565 \[ \den{\OneOne}(X,Y)(f) = \left\{ \begin{array}{ll} 566 0 & \mbox{if $f(x)=f(x')$ 567 for some $x\not=x'$ in $X$} \\ 568 1 & \mbox{otherwise} 569 \end{array} 570 \right. \]\index{one-to-one predicate, in HOL logic@one-to-one predicate, in \HOL{} logic!formal semantics of} 571 572\item $\den{\Onto_{(\alpha\fun\beta)\fun\bool}}\in\prod_{(X,Y)\in{\cal 573 U}^{2}} (X\fun Y)\fun \two$ sends $(X,Y)\in{\cal U}^{2}$ and 574 $f\in(X\fun Y)$ to 575 \[ \den{\Onto}(X,Y)(f) = \left\{ \begin{array}{ll} 576 1 & \mbox{if $\{f(x):x\in X\}=Y$} \\ 577 0 & \mbox{otherwise} 578 \end{array} 579 \right. \]\index{onto predicate, in HOL logic@onto predicate, in \HOL{} logic!formal semantics of} 580 581\item $\den{\TyDef_{(\alpha\fun\bool)\fun(\beta\fun\alpha)\fun\bool}}\in 582 \prod_{(X,Y)\in{\cal U}^{2}} (X\fun\two)\fun(Y\fun X)\fun\two$ \\ 583 sends $(X,Y)\in{\cal U}^{2}$, $f\in(X\fun\two)$ and $g\in(Y\fun X)$ to 584 \[ \den{\TyDef}(X,Y)(f)(g) = \left\{ \begin{array}{ll} 585 1 & \mbox{if 586 $\den{\OneOne}(Y,X)(g)=1$}\\ 587 & \mbox{and $f^{-1}\{1\}= 588 \{g(y) : y\in Y\}$} \\ 589 0 & \mbox{otherwise.} 590 \end{array} 591 \right. 592\] 593\end{itemize} 594\index{axioms!formal semantics of HOL logic's@formal semantics of \HOL{} logic's|)} 595Since these definitions were obtained by applying the semantics of 596terms to the left hand sides of the equations which form the axioms of 597\theory{LOG}, these axioms are satisfied and one obtains a model of 598the theory \theory{LOG}. 599 600 601\subsection{The theory {\tt INIT}} 602\label{INIT} 603 604The theory \theory{INIT}\index{INIT@\ml{INIT}!abstract form of} is 605obtained by adding the following four axioms\index{axioms!abstract form of HOL logic's@abstract form of \HOL{} logic's} to the theory 606\theory{LOG}. 607\[ 608\index{BOOL_CASES_AX@\ml{BOOL\_CASES\_AX}!abstract form of} 609\index{ETA_AX@\ml{ETA\_AX}!abstract form of} 610\index{SELECT_AX@\ml{SELECT\_AX}!abstract form of} 611\index{INFINITY_AX@\ml{INFINITY\_AX}!abstract form of} 612\index{choice axiom!abstract form of} 613\index{axiom of infinity!abstract form of} 614\begin{array}{@{}l@{\qquad}l} 615\mbox{\small\tt BOOL\_CASES\_AX}&\vdash \uquant{b} (b = \T ) \vee (b = \F )\\ 616 \\ 617\mbox{\small\tt ETA\_AX}& 618\vdash \uquant{f_{\alpha\fun\beta}}(\lquant{x}f\ x) = f\\ 619 \\ 620\mbox{\small\tt SELECT\_AX}& 621\vdash \uquant{P_{\alpha\fun\ty{bool}}\ x} P\ x \imp 622P({\hilbert}\ P)\\ 623 \\ 624\mbox{\small\tt INFINITY\_AX}& 625\vdash \equant{f_{\ind\fun \ind}} \OneOne \ f \conj \neg(\Onto \ f)\\ 626\end{array} 627\] 628 629The unique standard model of \theory{LOG} satisfies these four axioms 630and hence is the unique standard model of the theory 631\theory{INIT}.\index{INIT@\ml{INIT}!formal semantics of} (For axiom 632{\small\tt SELECT\_AX} one needs to use the definition of 633$\den{\hilbert}$ given in Section~\ref{standard-signatures}; for axiom 634{\small\tt INFINITY\_AX} one needs the fact that $\den{\ind}=\inds$ is 635an infinite set.) 636 637The theory \theory{INIT} is the initial theory\index{initial theory, 638 of HOL logic@initial theory, of \HOL{} logic!abstract form of} of the 639\HOL{} logic. A theory which extends \theory{INIT} will be called a 640{\em standard theory}\index{standard theory}. 641 642\subsection{Implementing theories \texttt{LOG} and \texttt{INIT}} 643\label{sec:implementing-log-init} 644 645The implementation combines the theories \theory{LOG} and 646\theory{INIT} into a theory \theoryimp{bool}. It includes all of the 647constants and axioms from those theories, and includes a number of 648derived results about those constants. For more on the 649implementation's \theoryimp{bool} theory, see \DESCRIPTION. 650 651\subsection{Consistency} 652\label{consistency} 653 654A (standard) theory is {\em consistent\/}\index{consistent theory} if 655it is not the case that every sequent over its signature can be 656derived from the theory's axioms using the \HOL{} logic, or 657equivalently, if the particular sequent $\turn\F$ cannot be so derived. 658 659The existence of a (standard) model of a theory is sufficient to 660establish its consistency. For by the Soundness 661Theorem~\ref{soundness}, any sequent that can be derived from the 662theory's axioms will be satisfied by the model, whereas the sequent 663$\turn\F$ is never satisfied in any standard model. So in particular, 664the initial theory \theory{INIT} is consistent. 665 666However, it is possible for a theory to be consistent but not to 667possess a standard model. This is because the notion of a {\em 668standard\/} model is quite restrictive---in particular there is no 669choice how to interpret the integers and their arithmetic in such a 670model. The famous incompleteness theorem of G\"odel ensures that there 671are sequents which are satisfied in all standard models (\ie\ which are 672`true'), but which are not provable in the \HOL{} logic. 673 674 675 676 677 678\section{Extensions of theories} 679\index{extension, of HOL logic@extension, of \HOL{} logic!abstract form of} 680\label{extensions} 681 682A theory ${\cal T}'$ is said to be an {\em 683extension\/}\index{extension, of theory} of a theory ${\cal T}$ if: 684\begin{myenumerate} 685\item ${\sf Struc}_{{\cal T}}\subseteq{\sf Struc}_{{\cal T}'}$. 686\item ${\sf Sig}_{{\cal T}}\subseteq{\sf Sig}_{{\cal T}'}$. 687\item ${\sf Axioms}_{{\cal T}}\subseteq{\sf Axioms}_{{\cal T}'}$. 688\item ${\sf Theorems}_{{\cal T}}\subseteq{\sf Theorems}_{{\cal T}'}$. 689\end{myenumerate} 690In this case, any model $M'$ of the larger theory ${\cal T}'$ can be 691restricted to a model of the smaller theory $\cal T$ in the following 692way. First, $M'$ gives rise to a model of the structure and signature 693of $\cal T$ simply by forgetting the values of $M'$ at constants not 694in ${\sf Struc}_{\cal T}$ or ${\sf Sig}_{\cal T}$. Denoting this model 695by $M$, one has for all $\sigma\in{\sf Types}_{\cal T}$, $t\in{\sf 696Terms}_{\cal T}$ and for all suitable contexts that 697\begin{eqnarray*} 698\den{\alpha\!s.\sigma}_{M} & = & \den{\alpha\!s.\sigma}_{M'} \\ 699\den{\alpha\!s,\!x\!s.t}_{M} & = & \den{\alpha\!s,\!x\!s.t}_{M'}. 700\end{eqnarray*} 701Consequently if $(\Gamma,t)$ is a sequent over ${\sf Sig}_{\cal T}$ 702(and hence also over ${\sf Sig}_{{\cal T}'}$), then $\Gamma 703\models_{M} t$ if and only if $\Gamma \models_{M'} t$. Since ${\sf 704Axioms}_{\cal T}\subseteq{\sf Axioms}_{{\cal T}'}$ and $M'$ is a model 705of ${\cal T}'$, it follows that $M$ is a model of $\cal T$. $M$ will 706be called the {\em restriction}\index{restrictions, of models} of the 707model $M'$ of the theory ${\cal T}'$ to the subtheory $\cal T$. 708 709\bigskip 710 711There are two main mechanisms for making extensions of theories in \HOL: 712\begin{itemize} 713 714\item Extension by a constant specification (see Section~\ref{specs}). 715 716\item Extension by a type specification (see 717Section~\ref{tyspecs}).\footnote{This theory extension mechanism is 718not implemented in the \HOL{}4 system.} 719 720\end{itemize} 721The first mechanism allows `loose specification' of constants (as in 722the {\bf Z} notation~\cite{Z}, for example); the latter allows new 723types and type-operators to be introduced. As special cases (when the 724thing being specified is uniquely determined) one also has: 725\begin{itemize} 726 727\item Extension by a constant definition (see Section~\ref{defs}). 728 729\item Extension by a type definition (see Section~\ref{tydefs}). 730 731\end{itemize} 732These mechanisms are described in the following sections. They all 733produce {\it definitional extensions\/} in the sense that they extend 734a theory by adding new constants and types which are defined in terms 735of properties of existing ones. Their key property is that the 736extended theory possesses a (standard) model if the original theory 737does. So a series of these extensions starting from the theory 738\theory{INIT} is guaranteed to result in a theory with a standard 739model, and hence in a consistent theory. It is also possible to extend 740theories simply by adding new uninterpreted constants and types. This 741preserves consistency, but is unlikely to be useful without additional 742axioms. However, when adding arbitrary new 743axioms\index{axioms!dispensibility of adding}, there is no guarantee 744that consistency is preserved. The advantages of postulation over 745definition have been likened by Bertrand Russell to the advantages of 746theft over honest toil.\footnote{See page 71 of Russell's book {\sl 747Introduction to Mathematical Philosophy\/}.} As it is all too easy to 748introduce inconsistent axiomatizations, users of the \HOL{} system are 749strongly advised to resist the temptation to add axioms, but to toil 750through definitional theories honestly. 751 752 753 754 755 756\subsection{Extension by constant definition} 757\index{extension, of HOL logic@extension, of \HOL{} logic!by constant definition|(} 758\label{defs} 759 760A {\it constant definition\/}\index{constant definition} over a 761signature $\Sigma_{\Omega}$ is a formula of the form 762$\con{c}_{\sigma} = t_{\sigma}$, such that: 763\begin{myenumerate} 764 765\item 766$\con{c}$ is not the name of any constant in $\Sigma_{\Omega}$; 767 768\item 769$t_{\sigma}$ a closed term in ${\sf Terms}_{\Sigma_{\Omega}}$; 770 771\item 772all the type variables occurring in $t_\sigma$ also occur in $\sigma$. 773 774\end{myenumerate} 775 776Given a theory $\cal T$ and such a constant definition over ${\sf 777Sig}_{\cal T}$, then the {\em definitional extension\/}\index{constant definition extension, of HOL logic@constant definition extension, of \HOL{} logic!abstract form of} of ${\cal T}$ 778by $\con{c}_{\sigma}=t_{\sigma}$ is the theory ${\cal T}{+_{\it 779def}}\langle 780\con{c}_{\sigma}=t_{\sigma}\rangle$ defined by: 781\[ 782{\cal T}{+_{\it def}}\langle 783\con{c}_{\sigma}=t_{\sigma}\rangle\ =\ \langle 784\begin{array}[t]{l} 785{\sf Struc}_{\cal T},\ 786{\sf Sig}_{\cal T}\cup\{(\con{c},\sigma)\},\\ 787{\sf Axioms}_{\cal T}\cup\{ 788\con{c}_{\sigma}=t_{\sigma} \},\ 789{\sf Theorems}_{\cal T}\rangle 790\end{array} 791\] 792 793Note that the mechanism of extension by constant definition has 794already been used implicitly in forming the theory \theory{LOG} from 795the theory \theory{MIN} in Section~\ref{LOG}. Thus with the notation 796of this section one has 797\[ 798\theory{LOG}\; =\; \theory{MIN}\;\begin{array}[t]{@{}l} 799 {+_{\it def}} \langle \T\index{T@\holtxt{T}!abstract form of}\index{truth values, in HOL logic@truth values, in \HOL{} logic!abstract form of} \ =\ 800 ((\lquant{x_{\ty{bool}}}x) = (\lquant{x_{\ty{bool}}}x))\rangle\\ 801 {+_{\it def}}\langle {\forall}\index{universal quantifier, in HOL logic@universal quantifier, in \HOL{} logic!abstract form of}\ =\ \lquant{P_{\alpha\fun\ty{bool}}}\ P = 802 (\lquant{x}\T )\rangle\\ 803 {+_{\it def}}\langle {\exists}\index{existential quantifier, in HOL logic@existential quantifier, in \HOL{} logic!abstract form of}\ =\ 804 \lquant{P_{\alpha\fun\ty{bool}}}\ P({\hilbert}\ P)\rangle\\ 805 {+_{\it def}}\langle \F\index{F@\holtxt{F}!abstract form of} 806 \ =\ \uquant{b_{\ty{bool}}}\ b\rangle\\ 807 {+_{\it def}}\langle \neg\ =\ \lquant{b}\ b \imp \F \rangle\index{negation, in HOL logic@negation, in \HOL{} logic!abstract form of}\\ 808 {+_{\it def}}\langle {\wedge}\index{conjunction, in HOL logic@conjunction, in \HOL{} logic!abstract form of}\ =\ \lquant{b_1\ b_2}\uquant{b} 809 (b_1\imp (b_2 \imp b)) \imp b\rangle\\ 810 {+_{\it def}}\langle {\vee}\index{disjunction, in HOL logic@disjunction, in \HOL{} logic!abstract form of}\ =\ \lquant{b_1\ b_2}\uquant{b} 811 (b_1 \imp b)\imp ((b_2 \imp b) \imp b)\rangle\\ 812 {+_{\it def}}\langle\OneOne \ =\ \lquant{f_{\alpha \fun\beta}} 813 \uquant{x_1\ x_2} (f\ x_1 = f\ x_2) \imp (x_1 = x_2)\rangle\index{one-to-one predicate, in HOL logic@one-to-one predicate, in \HOL{} logic!abstract form of}\\ 814 {+_{\it def}}\langle\Onto \ =\ \lquant{f_{\alpha\fun\beta}}\index{onto predicate, in HOL logic@onto predicate, in \HOL{} logic!abstract form of} 815 \uquant{y}\equant{x} y = f\ x\rangle\\ 816 {+_{\it def}}\langle\TyDef \ =\ 817 \begin{array}[t]{@{}l} 818 \lambda P_{\alpha\fun\ty{bool}}\ rep_{\beta\fun\alpha}.\\ 819 \OneOne\ rep\ \ \wedge\\ 820 (\uquant{x}P\ x \ =\ (\equant{y} x = rep\ y)) \rangle\\ 821\end{array}\end{array} 822\] 823 824If $\cal T$ possesses a standard model then so does the extension 825${\cal T}{+_{\it def}}\langle\con{c}_{\sigma}=t_{\sigma}\rangle$. This 826will be proved as a corollary of the corresponding result in 827Section~\ref{specs} by showing that extension by constant definition 828is in fact a special case of extension by constant specification. 829(This reduction requires that one is dealing with {\em standard\/} 830theories in the sense of section~\ref{INIT}, since although 831existential quantification is not needed for constant definitions, it 832is needed to state the mechanism of constant specification.) 833 834\medskip 835 836\noindent{\bf Remark\ } Condition (iii) in the definition of 837what constitutes a correct constant definition is an important 838restriction without which consistency could not be guaranteed. To see 839this, consider the term $\equant{f_{\alpha\fun\alpha}} \OneOne \ f 840\conj \neg(\Onto \ f)$, which expresses the proposition that (the set 841of elements denoted by the) type $\alpha$ is infinite. The term contains the 842type variable $\alpha$, whereas the type of the term, $\ty{bool}$, 843does not. Thus by (iii) 844\[ 845\con{c}_\ty{bool} = 846\equant{f_{\alpha\fun\alpha}} \OneOne \ f \conj \neg(\Onto \ f) 847\] 848is not allowed as a constant definition. The problem is that the 849meaning of the right hand side of the definition varies with $\alpha$, 850whereas the meaning of the constant on the left hand side is fixed, 851since it does not contain $\alpha$. Indeed, if we were allowed to 852extend the consistent theory $\theory{INIT}$ by this definition, the 853result would be an inconsistent theory. For instantiating $\alpha$ to 854$\ty{ind}$ in the right hand side results in a term that is provable 855from the axioms of $\theory{INIT}$, and hence $\con{c}_\ty{bool}=\T$ is 856provable in the extended theory. But equally, instantiating $\alpha$ 857to $\ty{bool}$ makes the negation of the right hand side provable 858from the axioms of $\theory{INIT}$, and hence $\con{c}_\ty{bool}=\F$ is 859also provable in the extended theory. Combining these theorems, one 860has that $\T=\F$, \ie\ $\F$ is provable in the extended theory. 861\index{extension, of HOL logic@extension, of \HOL{} logic!by constant definition|)} 862 863\subsection{Extension by constant specification} 864\index{extension, of HOL logic@extension, of \HOL{} logic!by constant specification|(} 865\label{specs} 866 867Constant specifications\index{constant specification extension, of HOL logic@constant specification extension, of \HOL{} logic!abstract form 868of} introduce constants (or sets of constants) 869that satisfy arbitrary given (consistent) properties. For example, a 870theory could be extended by a constant specification to have two new 871constants $\con{b}_1$ and $\con{b}_2$ of type \ty{bool} such that 872$\neg(\con{b}_1=\con{b}_2)$. This specification does not uniquely 873define $\con{b}_1$ and $\con{b}_2$, since it is satisfied by either 874$\con{b}_1=\T$ and $\con{b}_2=\F$, or $\con{b}_1=\F$ and 875$\con{b}_2=\T$. To ensure that such specifications are 876consistent\index{consistency, of HOL logic@consistency, of \HOL{} logic!under constant specification}, they can only be made if it has 877already been proved that the properties which the new constants are to 878have are consistent. This rules out, for example, introducing three 879boolean constants $\con{b}_1$, $\con{b}_2$ and $\con{b}_3$ such that 880$\con{b}_1\neq \con{b}_2$, $\con{b}_1\neq \con{b}_3$ and 881$\con{b}_2\neq \con{b}_3$. 882 883Suppose $\equant{x_1\cdots x_n}t$ is a formula, with $x_1,\ldots, x_n$ 884distinct variables. If $\turn \equant{x_1 \cdots x_n}t$, then a 885constant specification allows new constants $\con{c}_1$, $\ldots$ , 886$\con{c}_n$ to be introduced satisfying: 887\[ 888\turn t[\con{c}_1,\cdots,\con{c}_n/x_1,\cdots,x_n] 889\] 890where $t[\con{c}_1,\cdots,\con{c}_n/x_1,\cdots,x_n]$ denotes the 891result of simultaneously substituting $\con{c}_1, \ldots, \con{c}_n$ 892for $x_1, \ldots, x_n$ respectively. Of course the type of each 893constant $\con{c}_i$ must be the same as the type of the corresponding 894variable $x_i$. To ensure that this extension mechanism preserves the 895property of possessing a model, a further more technical requirement 896is imposed on these types: they must each contain all the type 897variables occurring in $t$. This condition is discussed further in 898Section~\ref{constants} below. 899 900Formally, a {\em constant specification\/}\index{constant specification} 901for a theory ${\cal T}$ is given by 902 903\medskip 904\noindent{\bf Data} 905\[ 906\langle(\con{c}_1,\ldots,\con{c}_n), 907\lquant{{x_1}_{\sigma_1},\ldots,{x_n}_{\sigma_n}}t_{\ty{bool}}\rangle 908\] 909 910\noindent{\bf Conditions} 911\begin{myenumerate} 912 913\item 914$\con{c}_1,\ldots,\con{c}_n$ are distinct names that 915are not the names of any constants in ${\sf Sig}_{\cal T}$. 916 917\item 918$\lquant{{x_1}_{\sigma_1} 919\cdots {x_n}_{\sigma_n}}t_{\ty{bool}}\ \in\ {\sf Terms}_{\cal T}$. 920 921\item 922$tyvars(t_{\ty{bool}})\ =\ tyvars(\sigma_i)$ for $1\leq i\leq n$. 923 924\item 925$\equant{{x_1}_{\sigma_1}\ \cdots\ {x_n}_{\sigma_n}}t 926\ \in\ {\sf Theorems}_{\cal T}$. 927 928\end{myenumerate} 929The extension of a standard theory ${\cal T}$ by such a constant 930specification is denoted by 931\[ 932{\cal T}{+_{\it spec}}\langle(\con{c}_1,\ldots,\con{c}_n), 933\lquant{{x_1}_{\sigma_1},\ldots,{x_n}_{\sigma_n}}t_{\ty{bool}} \rangle 934\] 935and is defined to be the theory: 936\[ 937\langle 938\begin{array}[t]{@{}l} 939{\sf Struc}_{\cal T},\\ 940{\sf Sig}_{\cal T} \cup 941\{{\con{c}_1}_{\sigma_1}, \ldots, 942{\con{c}_n}_{\sigma_n}\},\\ 943{\sf Axioms}_{\cal T}\cup 944\{ t[\con{c}_1,\ldots,\con{c}_n/x_1,\ldots,x_n] \},\\ 945{\sf Theorems}_{\cal T} 946\rangle 947\end{array} 948\] 949 950\noindent{\bf Proposition\ }{\em 951The theory ${\cal 952T}{+_{\it spec}}\langle(\con{c}_1,\ldots,\con{c}_n), 953\lquant{{x_1}_{\sigma_1},\ldots,{x_n}_{\sigma_n}}t_{\ty{bool}} 954\rangle$ has a standard model if the theory ${\cal T}$ does.} 955 956\medskip 957 958\noindent{\bf Proof\ } 959Suppose $M$ is a standard model of ${\cal T}$. Let 960$\alpha\!s=\alpha_{1},\ldots,\alpha_{m}$ be the list of distinct type 961variables occurring in the formula $t$. Then $\alpha\!s,\!x\!s.t$ is a 962term-in-context, where $x\!s=x_{1},\ldots,x_{n}$. (Change any bound 963variables in $t$ to make them distinct from $x\!s$ if necessary.) 964Interpreting this term-in-context in the model $M$ yields 965\[ 966\den{\alpha\!s,\!x\!s.t}_{M} \in \prod_{X\!s\in{\cal U}^{m}} 967\left(\prod_{i=1}^{n}\den{\alpha\!s.\sigma_{i}}_{M}(X\!s)\right) 968\fun \two 969\] 970Now $\equant{x\!s}t$ is in ${\sf Theorems}_{\cal T}$ and hence by the 971Soundness Theorem \ref{soundness}\index{consistency, of HOL logic@consistency, of \HOL{} logic!under constant specification} this 972sequent is satisfied by $M$. Using the semantics of $\exists$ given in 973Section~\ref{LOG}, this means that for all $X\!s\in{\cal 974U}^{m}$ the set 975\[ 976S(X\!s) = \{y\!s\in\den{\alpha\!s.\sigma_{1}}_{M}(X\!s) \times\cdots\times 977 \den{\alpha\!s.\sigma_{n}}_{M}(X\!s)\; : \; 978 \den{\alpha\!s,\!x\!s.t}_{M}(X\!s)(y\!s)=1 \} 979\] 980is non-empty. Since it is also a subset of a finite product of sets in 981$\cal U$, it follows that it is an element of $\cal U$ (using properties 982{\bf Sub} and {\bf Prod} of the universe). So one can apply the global 983choice function $\ch\in\prod_{X\in{\cal U}}X$ to select a specific element 984\[ 985(s_{1}(X\!s),\ldots,s_{n}(X\!s)) = 986\ch(S(X\!s)) \in \prod_{i=1}^{n}\den{\alpha\!s.\sigma_{i}}_{M}(X\!s) 987\] 988at which $\den{\alpha\!s,\!x\!s.t}_{M}(X\!s)$ takes the value $1$. Extend 989$M$ to a model $M'$ of the signature of ${\cal 990T}{+_{\it spec}}\langle(\con{c}_1,\ldots,\con{c}_n), 991\lquant{{x_1}_{\sigma_1},\ldots,{x_n}_{\sigma_n}}t_{\ty{bool}} 992\rangle$ by defining its value at 993each new constant $(\con{c}_{i},\sigma_{i})$ to be 994\[ 995M'(\con{c}_{i},\sigma_{i}) = 996s_{i} \in \prod_{X\!s\in{\cal U}^{m}}\den{\sigma_{i}}_{M}(X\!s) . 997\] 998Note that the Condition (iii) in the definition of a constant 999specification ensures that $\alpha\!s$ is the canonical context of each 1000type $\sigma_{i}$, so that 1001$\den{\sigma_{i}}=\den{\alpha\!s.\sigma_{i}}$ and thus $s_{i}$ is 1002indeed an element of the above product. 1003 1004Since $t$ is a term of the subtheory $\cal T$ of ${\cal 1005T}{+_{\it spec}}\langle(\con{c}_1,\ldots,\con{c}_n), 1006\lquant{{x_1}_{\sigma_1},\ldots,{x_n}_{\sigma_n}}t_{\ty{bool}} 1007\rangle$, 1008as remarked at the beginning of Section~\ref{extensions}, one has that 1009$\den{\alpha\!s,\!x\!s.t}_{M'} = \den{\alpha\!s,\!x\!s.t}_{M}$. Hence by 1010definition of the $s_{i}$, for all $X\!s\in{\cal U}^{m}$ 1011\[ 1012\den{\alpha\!s,\!x\!s.t}_{M'}(X\!s)(s_{1}(X\!s),\ldots,s_{n}(X\!s)) = 1 1013\] 1014Then using Lemma~4 in Section 1015\ref{term-substitution} on the semantics of substitution together with 1016the definition of $\den{\con{c}_{i}}_{M'}$, one finally obtains that 1017for all $X\!s\in{\cal U}^{m}$ 1018\[ 1019\den{t[\con{c}_{1},\ldots,\con{c}_{n}/x_{1},\ldots,x_{n}]}_{M'}(X\!s)=1 1020\] 1021or in other words that $M'$ satisfies 1022$t[\con{c}_{1},\ldots,\con{c}_{n}/x_{1},\ldots,x_{n}]$. 1023Hence $M'$ is a model of ${\cal T}{+_{\it 1024spec}}\langle(\con{c}_1,\ldots,\con{c}_n), 1025\lquant{{x_1}_{\sigma_1},\ldots,{x_n}_{\sigma_n}}t_{\ty{bool}} 1026\rangle$, as required. 1027 1028\medskip 1029 1030The constants which are asserted to exist in a constant specification 1031are not necessarily uniquely determined. Correspondingly, there may 1032be many different models of ${\cal T}{+_{\it 1033spec}}\langle(\con{c}_1,\ldots,\con{c}_n), 1034\lquant{{x_1}_{\sigma_1},\ldots,{x_n}_{\sigma_n}}t_{\ty{bool}} 1035\rangle$ whose restriction to $\cal T$ is $M$; the above construction 1036produces such a model in a uniform manner by making use of the global 1037choice function on the universe. 1038 1039Extension by a constant definition, $\con{c}_\sigma=t_\sigma$, is a 1040special case of extension by constant specification. For let $t'$ be 1041the formula $x_\sigma=t_\sigma$, where $x_\sigma$ is a variable not 1042occurring in $t_\sigma$. Then clearly $\turn 1043\equant{x_\sigma}t'$ and one can apply the method of constant 1044specification to obtain the theory 1045\[ 1046{\cal T}{+_{\it spec}}\langle \con{c},\lquant{x_\sigma}t'\rangle 1047\] 1048But since $t'[\con{c}_\sigma/x_\sigma]$ is just 1049$\con{c}_\sigma=t_\sigma$, 1050this extension yields exactly ${\cal T}{+_{\it def}}\langle 1051\con{c}_{\sigma}=t_{\sigma}\rangle$. 1052So as a corollary of the Proposition, one has that for each standard 1053model $M$ of $\cal T$, there is a standard model $M'$ of ${\cal 1054T}{+_{\it def}}\langle\con{c}_{\sigma}=t_{\sigma}\rangle$ whose 1055restriction to $\cal T$ is $M$. In contrast with the case of constant 1056specifications, $M'$ is uniquely determined by $M$ and the constant 1057definition. 1058\index{extension, of HOL logic@extension, of \HOL{} logic!by constant specification|)} 1059 1060\subsection{Remarks about constants in \HOL{}} 1061\label{constants} 1062 1063Note how Condition (iii) in the definition of a constant specification 1064was needed in the proof that the extension mechanism preserves the 1065property of possessing a standard model. Its role is to ensure that 1066the introduced constants have, via their types, the same dependency on 1067type variables as does the formula loosely specifying them. The 1068situation is the same as that discussed in the Remark in 1069Section~\ref{defs}. In a sense, what is causing the problem in the 1070example given in that Remark is not so much the method of extension by 1071introducing constants, but rather the syntax of \HOL{} which does not 1072allow constants to depend explicitly on type variables (in the way 1073that type operators can). Thus in the example one would like to 1074introduce a `polymorphic' constant $\con{c}_\ty{bool}(\alpha)$ 1075explicitly depending upon $\alpha$, and define it to be 1076$\equant{f_{\alpha\fun\alpha}} \OneOne \ f \conj 1077\neg(\Onto \ f)$. Then in the extended theory one could derive 1078$\con{c}_\ty{bool}(\ty{ind})=\T$ and 1079$\con{c}_\ty{bool}(\ty{bool})=\F$, but now no contradiction results since 1080$\con{c}_\ty{bool}(\ty{ind})$ and $\con{c}_\ty{bool}(\ty{bool})$ 1081are different. 1082 1083In the current version of \HOL, constants are (name,type)-pairs. 1084One can envision a slight extension of the \HOL{} syntax with 1085`polymorphic' constants, specified by pairs 1086$(\con{c},\alpha\!s.\sigma)$ where now $\alpha\!s.\sigma$ is a 1087type-in-context and the list $\alpha\!s$ may well contain extra type 1088variables not occurring in $\sigma$. Such a pair would give rise 1089to the particular constant term 1090$\con{c}_\sigma(\alpha\!s)$, and more generally to 1091constant terms $\con{c}_{\sigma'}(\tau\!s)$ obtained from 1092this one by instantiating the type variables $\alpha_i$ with types 1093$\tau_i$ (so $\sigma'$ is the instance of $\sigma$ obtained by 1094substituting $\tau\!s$ for $\alpha\!s$). This new syntax of polymorphic 1095constants is comparable to the existing syntax of compound types (see 1096section~\ref{types}): an $n$-ary type operator $\textsl{op}$ gives rise to a 1097compound type $(\alpha_1,\ldots,\alpha_n){\textsl{op}}$ depending upon $n$ 1098type variables. Similarly, the above syntax of polymorphic constants 1099records how they depend upon type variables (as well as which generic 1100type the constant has). 1101 1102However, explicitly recording dependency of constants on type variables 1103makes for a rather cumbersome syntax which in practice one would like 1104to avoid where possible. It is possible to avoid it if the type 1105context $\alpha\!s$ in $(\con{c},\alpha\!s.\sigma)$ is actually the 1106{\em canonical\/} context of $\sigma$, \ie\ contains exactly the type 1107variables of $\sigma$. For then one can apply Lemma~1 of 1108Section~\ref{instances-and-substitution} to deduce that the 1109polymorphic constant $\con{c}_{\sigma'}(\tau\!s)$ can be abbreviated 1110to the ordinary constant $\con{c}_{\sigma'}$ without ambiguity---the 1111missing information $\tau\!s$ can be reconstructed from $\sigma'$ and 1112the information about the constant $\con{c}$ given in the signature. 1113From this perspective, the rather technical side Conditions (iii) in 1114Sections~\ref{defs} and \ref{specs} become rather less mysterious: 1115they precisely ensure that in introducing new constants one is always 1116dealing just with canonical contexts, and so can use ordinary constants 1117rather than polymorphic ones without ambiguity. In this way one avoids 1118complicating the existing syntax at the expense of restricting 1119somewhat the applicability of these theory extension mechanisms. 1120 1121 1122\subsection{Extension by type definition} 1123\index{extension, of HOL logic@extension, of \HOL{} logic!by type definition|(} 1124\index{representing types, in HOL logic@representing types, in \HOL{} logic!abstract form of|(} 1125\label{tydefs} 1126 1127Every (monomorphic) type $\sigma$ in the initial theory \theory{INIT} 1128determines a set $\den{\sigma}$ in the universe $\cal U$. However, 1129there are many more sets in $\cal U$ than there are types in 1130\theory{INIT}. In particular, whilst $\cal U$ is closed under the 1131operation of taking a non-empty subset of $\den{\sigma}$, there is no 1132corresponding mechanism for forming a `subtype' of $\sigma$. Instead, 1133subsets are denoted indirectly via characteristic functions, whereby a 1134closed term $p$ of type $\sigma\fun\ty{bool}$ determines the subset 1135$\{x\in\den{\sigma} : \den{p}(x)=1\}$ (which is a set in the universe 1136provided it is non-empty). However, it is useful to have a 1137mechanism for introducing new types which are subtypes of existing 1138ones. Such types are defined\index{extension, of HOL logic@extension, of \HOL{} logic!by type definition} in \HOL{} by introducing a new type 1139constant and asserting an axiom that characterizes it as denoting a 1140set in bijection (\ie\ one-to-one correspondence) with a non-empty 1141subset of an existing type (called the {\it representing type\/}). 1142For example, the type \ml{num} is defined to be equal to a countable 1143subset of the type \ml{ind}, which is guaranteed to exist by the axiom 1144{\small\tt INFINITY\_AX} (see Section~\ref{INIT}). 1145 1146As well as defining types, it is also convenient to be able to define 1147type operators. An example would be a type operator \ty{inj} which 1148mapped a set to the set of one-to-one (\ie\ injective) functions on 1149it. The subset of $\sigma\fun\sigma$ representing $(\sigma)\ty{inj}$ 1150would be defined by the predicate \OneOne. Another example would be a 1151binary cartesian product type operator \ty{prod}. This is defined by 1152choosing a representing type containing two type variables, say 1153$\sigma[\alpha_1;\alpha_2]$, such that for any types $\sigma_1$ and 1154$\sigma_2$, a subset of $\sigma[\sigma_1;\sigma_2]$ represents the 1155cartesian product of $\sigma_1$ and $\sigma_2$. The details of such a 1156definition are given in \DESCRIPTION's section on the theory of 1157cartesian products. 1158 1159Types in \HOL{} must denote non-empty sets. Thus it is only 1160consistent\index{consistency, of HOL logic@consistency, of \HOL{} logic!under type definition} to define a new type isomorphic to a 1161subset specified by a predicate $p$, if there is at least one thing 1162for which $p$ holds, \ie\ $\turn\equant{x}p\ x$. For example, it 1163would be inconsistent to define a binary type operator \ty{iso} such 1164that $(\sigma_1,\sigma_2)\ty{iso}$ denoted the set of one-to-one 1165functions from $\sigma_1$ {\em onto\/} $\sigma_2$ because for some 1166values of $\sigma_1$ and $\sigma_2$ the set would be empty; for 1167example $(\ty{ind},\ty{bool})\ty{iso}$ would denote the empty set. To 1168avoid this, a precondition of defining a new type is that the 1169representing subset is non-empty. 1170 1171To summarize, a new type is defined by: 1172\begin{enumerate} 1173\item Specifying an existing type. 1174\item Specifying a subset of this type. 1175\item Proving that this subset is non-empty. 1176\item Specifying that the new type is isomorphic to this subset. 1177\end{enumerate} 1178 1179\noindent In more detail, 1180defining a new type $(\alpha_1,\ldots,\alpha_n)\ty{op}$ consists in: 1181\begin{enumerate} 1182\item 1183Specifying a type-in-context, $\alpha_1,\ldots,\alpha_n.\sigma$ say. 1184The type 1185$\sigma$ is called the {\it representing type\/}, and the type 1186$(\alpha_1,\ldots,\alpha_n)\ty{op}$ is intended to be isomorphic to a 1187subset of $\sigma$. 1188 1189\item 1190Specifying a closed term-in-context, $\alpha_1,\ldots,\alpha_n,.p$ 1191say, of type $\sigma\fun\bool$. The term $p$ is called the {\it 1192characteristic function\/}\index{characteristic function, of type definitions}. This defines the subset of $\sigma$ to which 1193$(\alpha_1,\ldots,\alpha_n)\ty{op}$ is to be isomorphic.\footnote{The 1194reason for restricting $p$ to be closed, \ie\ to have no free 1195variables, is that otherwise for consistency the defined type operator 1196would have to {\em depend\/} upon (\ie\ be a function of) those 1197variables. Such dependent types are not (yet!) a part of the \HOL{} system.} 1198 1199\item 1200Proving $\turn \equant{x_{\sigma}} p\ x$. 1201 1202\item 1203Asserting an axiom saying that $(\alpha_1,\ldots,\alpha_n)\ty{op}$ is 1204isomorphic to the subset of $\sigma$ selected by $p$. 1205 1206\end{enumerate} 1207 1208To make this formal, the theory \theory{LOG} provides 1209the polymorphic constant \TyDef\ defined in Section~\ref{LOG}. 1210The formula 1211$\equant{f_{(\alpha_1,\ldots,\alpha_n)\ty{op}\fun\sigma}}\TyDef\ p\ f$ 1212asserts that 1213there exists a one-to-one map $f$ from $(\alpha_1,\ldots,\alpha_n)\ty{op}$ 1214onto the subset of elements of $\sigma$ for which $p$ is true. 1215Hence, the axiom that characterizes $(\alpha_1,\ldots,\alpha_n)\ty{op}$ is: 1216\[ 1217\turn \equant{f_{(\alpha_1,\ldots,\alpha_n)\ty{op}\fun\sigma}}\TyDef\ 1218p\ f 1219\] 1220 1221Defining a new type $(\alpha_1,\ldots,\alpha_n)\ty{op}$ in a theory 1222${\cal T}$ thus consists of introducing $\ty{op}$ as a new $n$-ary 1223type operator and the above axiom as a new axiom. Formally, a {\em 1224type definition\/}\index{type definitions, in HOL logic@type definitions, in \HOL{} logic!abstract structure of} for a theory ${\cal 1225T}$ is given by 1226 1227\medskip 1228 1229\noindent{\bf Data} 1230\[ 1231\langle (\alpha_1,\ldots,\alpha_n)\ty{op},\ \sigma,\ 1232p_{\sigma\fun\ty{bool}}\rangle 1233\] 1234 1235\noindent{\bf Conditions} 1236 1237\begin{myenumerate} 1238\item 1239$(\ty{op},n)$ is not the name of a type constant in ${\sf Struc}_{\cal T}$. 1240 1241\item 1242$\alpha_1,\ldots,\alpha_n.\sigma$ is a type-in-context with $\sigma 1243\in{\sf Types}_{\cal T}$. 1244 1245\item $p_{\sigma\fun\bool}$ is a closed term in ${\sf Terms}_{\cal T}$ 1246whose type variables occur in $\alpha_1,\ldots,\alpha_n$. 1247 1248\item 1249$\equant{x_{\sigma}}p\ x \ \in\ {\sf Theorems}_{\cal T}$. 1250\end{myenumerate} 1251 1252The extension of a standard theory ${\cal T}$ by a such a type definition 1253is denoted by 1254\[ 1255{\cal 1256T}{+_{tydef}}\langle(\alpha_1,\ldots,\alpha_n)\ty{op},\sigma,p\rangle 1257\] 1258and defined to be the theory 1259\[ 1260\langle 1261\begin{array}[t]{@{}l} 1262{\sf Struc}_{\cal T}\cup\{(\ty{op},n)\},\\ 1263 {\sf Sig}_{\cal T},\\ 1264 {\sf Axioms}_{\cal T}\cup\{ 1265\equant{f_{(\alpha_1,\ldots,\alpha_n)\ty{op} 1266\fun\sigma}}\TyDef\ p\ f\},\\ 1267 {\sf Theorems}_{\cal T}\rangle\\ 1268\end{array} 1269\] 1270 1271\medskip 1272 1273\noindent{\bf Proposition\ }{\em 1274The theory ${\cal T}{+_{\it 1275tydef}}\langle(\alpha_1,\ldots,\alpha_n)\ty{op},\sigma,p\rangle$ has a 1276standard model if the theory ${\cal T}$ does.} 1277 1278\medskip 1279 1280Instead of giving a direct proof of this result, it will be deduced as 1281a corollary of the corresponding proposition in the next section. 1282\index{extension, of HOL logic@extension, of \HOL{} logic!by type definition|)} 1283\index{representing types, in HOL logic@representing types, in \HOL{} logic!abstract form of|)} 1284 1285 1286\subsection{Extension by type specification} 1287\index{extension, of HOL logic@extension, of \HOL{} logic!by type specification|(} 1288\label{tyspecs} 1289\noindent 1290(\textbf{Note:} This theory extension mechanism is \emph{not} 1291implemented in the HOL4 system. It was proposed by T.~Melham and 1292refines a suggestion from R.~Jones and R.~Arthan.) 1293 1294\smallskip 1295\noindent The type definition 1296mechanism allows one to introduce new types by giving a concrete 1297representation of the type as a `subtype' of an existing type. One 1298might instead wish to introduce a new type satisfying some property 1299without having to give an explicit representation for the type. For 1300example, one might want to extend \theory{INIT} with an atomic type 1301$\ty{one}$ satisfying $\turn\uquant{f_{\alpha\fun\ty{one}}\ 1302 g_{\alpha\fun\ty{one}}}f=g$ without choosing a specific type in 1303$\theory{INIT}$ and saying that $\ty{one}$ is in bijection with a 1304one-element subset of it. (The idea being that the choice of 1305representing type is irrelevant to the properties of $\ty{one}$ that 1306can be expressed in \HOL.) The mechanism described in this section 1307provides one way of achieving this while at the same time preserving 1308the all-important property of possessing a standard model and hence 1309maintaining consistency. 1310 1311Each closed formula $q$ involving a single type variable $\alpha$ can 1312be thought of as specifying a property $q[\tau/\alpha]$ of types 1313$\tau$. Its interpretation in a model is of the form 1314\[ 1315\den{\alpha,.q}\in \prod_{X\in{\cal U}}\den{\alpha.\bool}(X) 1316\;= \prod_{X\in{\cal U}}\two \;=\; {\cal U}\fun\two 1317\] 1318which is a characteristic function on the universe, determining a 1319subset $\{X\in{\cal U}:\den{\alpha,.q}(X)=1\}$ consisting of those 1320sets in the universe for which the property $q$ holds. The most 1321general way of ensuring the consistency of introducing a new atomic 1322type $\nu$ satisfying $q[\nu/\alpha]$ would be to prove 1323`$\equant{\alpha}q$'. However, such a 1324formula with quantification over types is not\footnote{yet!} a part of 1325the \HOL{} logic and one must proceed indirectly---replacing the 1326formula by (a logically weaker) one that can be expressed formally with 1327\HOL{} syntax. The formula used is 1328\[ 1329(\equant{f_{\alpha\fun\sigma}}{\sf Type\_Definition}\ p\ f)\ \imp\ q 1330\] 1331where $\sigma$ is a type, $p_{\sigma\fun\ty{bool}}$ is a closed term 1332and neither involve the type variable $\alpha$. This formula says `$q$ 1333holds of any type which is in bijection with the subtype of $\sigma$ 1334determined by $p$'. If this formula is provable and if the subtype is 1335non-empty, \ie\ if 1336\[ 1337\equant{x_\sigma}p\ x 1338\] 1339is provable, then it is consistent to introduce an extension with a new 1340atomic type $\nu$ satisfying $q[\nu/\alpha]$. 1341 1342In giving the formal definition of this extension mechanism, two 1343refinements will be made. Firstly, $\sigma$ is allowed to be 1344polymorphic and hence a new type constant of appropriate arity is 1345introduced, rather than just an atomic type. Secondly, the above 1346existential formulas are permitted to be proved (in the theory to be 1347extended) from some hypotheses.\footnote{This refinement increases the 1348applicability of the extension mechanism without increasing its 1349expressive power. A similar refinement could have be made to the other 1350theory extension mechanisms.} Thus a {\em type 1351specification\/}\index{type specification} for a theory $\cal T$ is 1352given by 1353 1354\medskip 1355 1356\noindent{\bf Data} 1357\[ 1358\langle (\alpha_1,\ldots,\alpha_n)\ty{op},\sigma,p,\alpha,\Gamma,q\rangle 1359\] 1360 1361\noindent{\bf Conditions} 1362 1363\begin{myenumerate} 1364\item 1365$(\ty{op},n)$ is a type constant that is not in 1366${\sf Struc}_{\cal T}$. 1367 1368\item 1369$\alpha_1,\ldots,\alpha_n.\sigma$ is a type-in-context with 1370$\sigma\in{\sf Types}_{\cal T}$. 1371 1372\item $p_{\sigma\fun\bool}$ is a closed term in ${\sf Terms}_{\cal T}$ 1373whose type variables occur in $\alpha\!s=\alpha_1,\ldots,\alpha_n$. 1374 1375\item $\alpha$ is a type variable distinct from those in 1376$\alpha\!s$. 1377 1378\item $\Gamma$ is a list of closed formulas in ${\sf Terms}_{\cal T}$ 1379not involving the type variable $\alpha$. 1380 1381\item $q$ is a closed formula in ${\sf Terms}_{\cal T}$. 1382 1383\item The sequents 1384\begin{eqnarray*} 1385(\Gamma & , & \equant{x_\sigma}p\ x )\\ 1386(\Gamma & , & (\equant{f_{\alpha\fun\sigma}}{\sf Type\_Definition}\ 1387 p\ f)\ \imp\ q ) 1388\end{eqnarray*} 1389are in ${\sf Theorems}_{\cal T}$. 1390 1391\end{myenumerate} 1392The extension of a standard theory $\cal T$ by such a type 1393specification is denoted 1394\[ 1395{\cal T}{+_{\it tyspec}} \langle 1396(\alpha_1,\ldots,\alpha_n)\ty{op},\sigma,p,\alpha,\Gamma,q\rangle 1397\] 1398and is defined to be the theory 1399\[ 1400\langle 1401\begin{array}[t]{@{}l} 1402{\sf Struc}_{\cal T}\cup\{(\ty{op},n)\},\\ 1403 {\sf Sig}_{\cal T},\\ 1404 {\sf Axioms}_{\cal 1405 T}\cup\{(\Gamma , q[(\alpha_1,\ldots,\alpha_n)\ty{op}/\alpha])\},\\ 1406 {\sf Theorems}_{\cal T}\rangle 1407\end{array} 1408\] 1409 1410\noindent{\bf Example\ } To carry out the extension of \theory{INIT} 1411mentioned at the start of this section, one forms 1412\[ 1413\theory{INIT}{+_{\it tyspec}} \langle 1414()\ty{one},\ty{bool},p,\alpha,\emptyset,q\rangle 1415\] 1416where $p$ is the term $\lquant{b_\bool}b$ and $q$ is the formula 1417$\uquant{f_{\beta\fun\alpha}\ g_{\beta\fun\alpha}}f=g$. Thus the 1418result is a theory extending \theory{INIT} with a 1419new type constant $\ty{one}$ satisfying the axiom 1420$\uquant{f_{\beta\fun\ty{one}}\ g_{\beta\fun\ty{one}}}f=g$. 1421 1422To verify that this is a correct application of the extension 1423mechanism, one has to check Conditions (i) to (vii) above. Only the last 1424one is non-trivial: it imposes the obligation of proving 1425two sequents from the axioms of \theory{INIT}. The first sequent says 1426that $p$ defines an inhabited subset of $\bool$, which is certainly 1427the case since $\T$ witnesses this fact. The second sequent says in 1428effect that any type $\alpha$ that is in bijection with the subset of 1429$\bool$ defined by $p$ has the property that there is at most one 1430function to it from any given type $\beta$; the proof of this from the 1431axioms of \theory{INIT} is left as an exercise. 1432 1433\medskip 1434 1435\noindent{\bf Proposition\ }{\em 1436The theory ${\cal T}{+_{\it tyspec}}\langle 1437(\alpha_1,\ldots,\alpha_n)\ty{op},\sigma,p,\alpha,\Gamma,q 1438\rangle$ has a standard model if the theory ${\cal T}$ does.} 1439 1440\medskip 1441 1442\noindent{\bf Proof\ } 1443Write $\alpha\!s$ for $\alpha_1,\ldots,\alpha_n$, and suppose that 1444$\alpha\!s'={\alpha'}_1,\ldots,{\alpha'}_m$ is the list of type 1445variables occurring in $\Gamma$ and $q$, but not already in the list 1446$\alpha\!s,\alpha$. 1447 1448Suppose $M$ is a standard model of ${\cal T}$. Since $\alpha\!s,.p$ is 1449a term-in-context of type $\sigma\fun\ty{bool}$, interpreting it in 1450$M$ yields 1451\[ 1452\den{\alpha\!s,.p}_{M} 1453\in \prod_{X\!s\in{\cal U}^{n}}\den{\alpha\!s.\sigma\fun\ty{bool}}_M(X\!s) 1454= \prod_{X\!s\in{\cal U}^{n}} 1455 \den{\alpha\!s.\sigma}_M(X\!s)\fun\two . 1456\] 1457 1458There is no loss of generality in assuming that $\Gamma$ consists of a 1459single formula $\gamma$. (Just replace $\Gamma$ by the conjunction of 1460the formulas it contains, with the convention that this conjunction is 1461$\T$ if $\Gamma$ is empty.) By assumption on $\alpha\!s'$ and by 1462Condition~(iv), $\alpha\!s,\alpha\!s',.\gamma$ is a term-in-context.\footnote{Note the two commas in $\alpha\!s,\alpha\!s',.\gamma$. The first separates the two lists of type variables; the second splits type variables from term variables.} 1463Interpreting it in $M$ yields 1464\[ 1465\den{\alpha\!s,\alpha\!s',.\gamma}_{M} 1466\in \prod_{(X\!s,X\!s')\in 1467{\cal U}^{n+m}}\den{\alpha\!s,\alpha\!s'.\ty{bool}}_M(X\!s,X\!s') 1468={\cal U}^{n+m}\fun\two 1469\] 1470 1471Now $(\gamma,\equant{x_{\sigma}}p\ x)$ is in ${\sf Theorems}_{\cal T}$ 1472and hence by the Soundness Theorem~\ref{soundness} this sequent is 1473satisfied by $M$. Using the semantics of $\exists$ given in 1474Section~\ref{LOG} and the definition of satisfaction of a sequent from 1475Section~\ref{sequents}, this means that for all $(X\!s,X\!s')\in{\cal U}^{n+m}$ 1476if $\den{\alpha\!s,\alpha\!s',.\gamma}_M(X\!s,X\!s')=1$, then 1477the set 1478\[ 1479\{y\in\den{\alpha\!s.\sigma}_{M}\: :\: \den{\alpha\!s,.p}(X\!s)(y)=1\} 1480\] 1481is non-empty. (This uses the fact that $p$ does not involve 1482the type variables $\alpha\!s'$, so that by Lemma~4 in 1483Section~\ref{term-substitution} 1484$\den{\alpha\!s,\alpha\!s',.p}_M(X\!s,X\!s')=\den{\alpha\!s,.p}_M(X\!s)$.) 1485Since it is also a subset of a set in $\cal U$, it 1486follows by property {\bf Sub} of the universe that this set is an element of 1487$\cal U$. So defining 1488\[ 1489S(X\!s) = \left\{\hspace{-1mm} 1490\begin{array}{ll} 1491\{y\in\den{\alpha\!s.\sigma}_{M} : \den{\alpha\!s,.p}(X\!s)(y)=1\} 1492 & \mbox{\rm if $\den{\alpha\!s,.\gamma}_M(X\!s,X\!s')=1$, some $X\!s'$}\\ 14931 & \mbox{\rm otherwise} 1494\end{array} 1495\right.%\} 1496\] 1497one has that $S$ is a function ${\cal U}^n\fun{\cal U}$. Extend $M$ 1498to a model of the signature of ${\cal T}'$ by defining its value at 1499the new $n$-ary type constant $\ty{op}$ to be this function $S$. Note 1500that the values of $\sigma$, $p$, $\gamma$ and 1501$q$ in $M'$ are the same as in $M$, since these expressions do not 1502involve the new type constant $\ty{op}$. 1503 1504For each $X\!s\in{\cal U}^{n}$ define $i_{X\!s}$ to be the inclusion 1505function for the subset $S(X\!s)\subseteq\den{\alpha\!s.\sigma}_{M}$ 1506if $\den{\alpha\!s,\alpha\!s',.\gamma}_M(X\!s,X\!s')=1$ for some 1507$X\!s'$, and otherwise to be the function 1508$1\fun\den{\alpha\!s.\sigma}_{M}$ sending $0\in 1$ to 1509$\ch(\den{\alpha\!s.\sigma}_{M})$. Then 1510$i_{X\!s}\in(S(X\!s)\fun\den{\alpha\!s.\sigma}_{M'}(X\!s))$ because 1511$\den{\alpha\!s.\sigma}_{M'}=\den{\alpha\!s.\sigma}_M$. Using the 1512semantics of $\TyDef$ given in Section~\ref{LOG}, one has that for any 1513$(X\!s,X\!s')\in{\cal U}^{n+m}$, if 1514$\den{\alpha\!s,\alpha\!s',.\gamma}_{M'}(X\!s,X\!s')=1$ then 1515\[ 1516\den{\TyDef}_{M'}(\den{\alpha\!s.\sigma}_{M'} , 1517 S(X\!s))(\den{\alpha\!s,.p}_{M'})(i_{X\!s}) = 1. 1518\] 1519Thus $M'$ satisfies the sequent 1520\[ 1521(\gamma\ ,\ \equant{f_{(\alpha\!s)\ty{op}\fun\sigma}}\TyDef\ p\ f). 1522\] 1523But since the sequent $(\gamma,(\equant{f_{\alpha\fun\sigma}}{\sf 1524Type\_Definition}\ p\ f)\ \imp\ q )$ is in ${\sf Theorems}_{\cal T}$, 1525it is satisfied by the model $M$ and hence also by the model $M'$ 1526(since the sequent does not involve the new type constant $\ty{op}$). 1527Instantiating $\alpha$ to $(\alpha\!s)\ty{op}$ in this sequent (which 1528is permissible since by Condition~(iv) $\alpha$ does not occur in 1529$\gamma$), one thus has that $M'$ satisfies the sequent 1530\[ 1531(\gamma\ ,\ 1532(\equant{f_{(\alpha\!s)\ty{op}\fun\sigma}}\TyDef\ p\ f)\imp 1533q[(\alpha\!s)\ty{op}/\alpha]). 1534\] 1535Applying Modus Ponens, one concludes that $M'$ satisfies 1536$(\gamma\ ,\ q[(\alpha\!s)\ty{op}/\alpha])$ and 1537therefore $M'$ is a model of ${\cal T}'$, as required. 1538 1539\medskip 1540 1541An extension by type definition is in fact a special case of extension 1542by type specification. To see this, suppose 1543$\langle (\alpha_1,\ldots,\alpha_n)\ty{op},\ \sigma,\ 1544p_{\sigma\fun\ty{bool}}\rangle$ is a type definition for a theory 1545$\cal T$. Choosing a type variable $\alpha$ different from 1546$\alpha_1,\ldots,\alpha_n$, let $q$ denote the formula 1547\[ 1548\equant{f_{\alpha\fun\sigma}}{\sf Type\_Definition}\ p\ f 1549\] 1550Then $\langle 1551(\alpha_1,\ldots,\alpha_n)\ty{op},\sigma,p,\alpha,\emptyset,q\rangle$ 1552satisfies all the conditions necessary to be a type specification for 1553$\cal T$. Since $q[(\alpha_1,\ldots,\alpha_n)\ty{op}/\alpha]$ is just 1554$\equant{f_{(\alpha_1,\ldots,\alpha_n)\ty{op}\fun\sigma}}{\sf 1555Type\_Definition}\ p\ f$, one has that 1556\[ 1557{\cal T}{+_{tydef}} 1558\langle(\alpha_1,\ldots,\alpha_n)\ty{op},\sigma,p\rangle 1559={\cal T}{+_{\it tyspec}} 1560\langle(\alpha_1,\ldots,\alpha_n)\ty{op},\sigma,p,\alpha,\emptyset,q\rangle 1561\] 1562Thus the Proposition in Section~\ref{tydefs} is a special case of the 1563above Proposition. 1564 1565In an extension by type specification, the property $q$ which is 1566asserted of the newly introduced type constant need not determine the 1567type constant uniquely (even up to bijection). Correspondingly there 1568may be many different standard models of the extended theory whose 1569restriction to $\cal T$ is a given model $M$. By contrast, a type 1570definition determines the new type constant uniquely up to bijection, 1571and any two models of the extended theory which restrict to the same 1572model of the original theory will be isomorphic. 1573\index{extension, of HOL logic@extension, of \HOL{} logic!by type specification|)} 1574 1575 1576 1577%%% Local Variables: 1578%%% mode: latex 1579%%% TeX-master: "logic" 1580%%% End: 1581