Formalizing Strong Normalization Proofs Kazuhiko Sakaguchi College - PowerPoint PPT Presentation

Proof Outline of the Equational Properties We can apply some automation techniques for these proofs. eliminating hypotheses case analysis ∀ m . n ≤ m ⇒ P [ n , m ] do !case: ifP → ∀ m ′ . P [ n , n + m ′ ] ֒ structural induction on term applying congruence tactic with some hypotheses: S m + n = S ( m + n ) , m + S n = S ( m + n ) 10 / 42

Proof Outline of the Equational Properties We can apply some automation techniques for these proofs. eliminating hypotheses case analysis ∀ m . n ≤ m ⇒ P [ n , m ] do !case: ifP → ∀ m ′ . P [ n , n + m ′ ] ֒ automation based on omega structural induction on term applying congruence tactic with some hypotheses: S m + n = S ( m + n ) , m + S n = S ( m + n ) 10 / 42

Proof Outline of the Equational Properties We can apply some automation techniques for these proofs. eliminating hypotheses case analysis ∀ m . n ≤ m ⇒ P [ n , m ] do !case: ifP → ∀ m ′ . P [ n , n + m ′ ] ֒ automation based on omega structural induction on term applying congruence tactic manual proof with some hypotheses: S m + n = S ( m + n ) , m + S n = S ( m + n ) 10 / 42

Example Lemma subst_shift_distr n d c ts t : n <= c -> shift d c (substitute n ts t) = substitute n (map (shift d (c - n)) ts) (shift d (size ts + c) t). Proof. elimleq; elim: t n; congruence’ => v n; elimif_omega. - rewrite !nth_default ?size_map /=; elimif_omega. - rewrite -shift_shift_distr // nth_map’ /=; congr shift; apply nth_equal; rewrite size_map; elimif_omega. Qed. 11 / 42

Performance Problem of omega Notation minn x y := (x - (x - y)). Lemma minnA x y z : minn x (minn y z) = minn (minn x y) z. Proof. omega. 12 / 42

Performance Problem of omega minn is the smallest number of two natural numbers. x − ( x − y ) is a frequently appearing pattern in proofs relevant to the de Bruijn representation. Notation minn x y := (x - (x - y)). Lemma minnA x y z : minn x (minn y z) = minn (minn x y) z. Proof. omega. 12 / 42

Performance Problem of omega minn is the smallest number of two natural numbers. x − ( x − y ) is a frequently appearing pattern in proofs relevant to the de Bruijn representation. Notation minn x y := (x - (x - y)). Lemma minnA x y z : minn x (minn y z) = minn (minn x y) z. Proof. omega. 12 / 42

Performance Problem of omega minn is the smallest number of two natural numbers. x − ( x − y ) is a frequently appearing pattern in proofs relevant to the de Bruijn representation. Notation minn x y := (x - (x - y)). Lemma minnA x y z : minn x (minn y z) = minn (minn x y) z. Proof. omega. associativity of minn 12 / 42

Performance Problem of omega minn is the smallest number of two natural numbers. x − ( x − y ) is a frequently appearing pattern in proofs relevant to the de Bruijn representation. Notation minn x y := (x - (x - y)). Lemma minnA x y z : minn x (minn y z) = minn (minn x y) z. Proof. omega. associativity of minn runs forever 12 / 42

Performance Problem of omega minn is the smallest number of two natural numbers. x − ( x − y ) is a frequently appearing pattern in proofs relevant to the de Bruijn representation. Notation minn x y := (x - (x - y)). Lemma minnA x y z : minn x (minn y z) = minn (minn x y) z. Proof. omega. associativity of minn runs forever Some techniques are required to use the omega tactic for proving the equational properties. 12 / 42

Part II Strong Normalization Theorem

λ → : Simply Typed λ -Calculus types and terms: U :: = X t :: = x | ( U → U ) | ( t t ) | ( λ x : U . t ) typing rules: reduction rules: Γ ( x ) = U ( λ x : U . t ) u → β t [ x : = u ] Γ ⊢ x : U t 1 → β t 2 u 1 → β u 2 Γ ⊢ t : U → V Γ ⊢ u : U t 1 u → β t 2 u t u 1 → β t u 2 Γ ⊢ t u : V t → β t ′ { x : U } + Γ ⊢ t : V λ x : U . t → β λ x : U . t ′ Γ ⊢ λ x : U . t : U → V 14 / 42

Proof Outline of the SN Theorem Our proofs are based on the Girard’s proof [GTL89]. 15 / 42

Proof Outline of the SN Theorem Our proofs are based on the Girard’s proof [GTL89]. Γ ⊢ t : U (2) Proof by induction on t . Proof by induction RED U ( t ) on t or U . SN → β ( t ) (1) Proof by induction on U . 15 / 42

Proof Outline of the SN Theorem Our proofs are based on the Girard’s proof [GTL89]. Γ ⊢ t : U (2) Proof by induction on t . Proof by induction RED U ( t ) on t or U . SN → β ( t ) (1) Proof by induction on U . 15 / 42

Proof Outline of the SN Theorem Our proofs are based on the Girard’s proof [GTL89]. Γ ⊢ t : U (2) Proof by induction on t . Proof by induction RED U ( t ) on t or U . SN → β ( t ) (1) Proof by induction on U . 15 / 42

Proof Outline of the SN Theorem Our proofs are based on the Girard’s proof [GTL89]. Γ ⊢ t : U (2) Proof by induction on t . Proof by induction RED U ( t ) on t or U . SN → β ( t ) (1) Proof by induction on U . 15 / 42

Proof Outline of the SN Theorem Our proofs are based on the Girard’s proof [GTL89]. Γ ⊢ t : U (2) Proof by induction on t . Proof by induction RED U ( t ) on t or U . SN → β ( t ) (1) Proof by induction on U . 15 / 42

Proof Outline of the SN Theorem Our proofs are based on the Girard’s proof [GTL89]. Γ ⊢ t : U (2) Proof by induction on t . Proof by induction RED U ( t ) on t or U . SN → β ( t ) (1) Proof by induction on U . 15 / 42

What is RED U ? in the Simply Typed λ -Calculus RED U ( reducibility ) is defined by induction on the type U as follows: def RED X ( t ) ⇐ ⇒ SN → β ( t ) def RED U → V ( t ) ⇐ ⇒ ∀ u . RED U ( u ) ⇒ RED V ( t u ) . 16 / 42

What is RED U ? in the Simply Typed λ -Calculus RED U ( reducibility ) is defined by induction on the type U as follows: def RED X ( t ) ⇐ ⇒ SN → β ( t ) def RED U → V ( t ) ⇐ ⇒ ∀ u . RED U ( u ) ⇒ RED V ( t u ) . In typical definitions, RED U is a set of typed terms. But this definition of RED U contains untyped terms. For example, ( λ x : U . x x ) ∈ RED X . 16 / 42

Part 1: Reducible Terms are SN CR 1 RED U ( t ) ⇒ SN → β ( t ) CR 2 t → β t ′ ∧ RED U ( t ) ⇒ RED U ( t ′ ) neutral ( t ) ∧ ( ∀ t ′ . t → β t ′ ⇒ RED U ( t ′ )) ⇒ RED U ( t ) CR 3 17 / 42

Part 1: Reducible Terms are SN CR 1 RED U ( t ) ⇒ SN → β ( t ) CR 2 t → β t ′ ∧ RED U ( t ) ⇒ RED U ( t ′ ) neutral ( t ) ∧ ( ∀ t ′ . t → β t ′ ⇒ RED U ( t ′ )) ⇒ RED U ( t ) CR 3 t is not of the form λ x . u . 17 / 42

Part 1: Reducible Terms are SN CR 1 RED U ( t ) ⇒ SN → β ( t ) CR 2 t → β t ′ ∧ RED U ( t ) ⇒ RED U ( t ′ ) neutral ( t ) ∧ ( ∀ t ′ . t → β t ′ ⇒ RED U ( t ′ )) ⇒ RED U ( t ) CR 3 t is not of the form λ x . u . CR 2 is proved by induction on U . CR 1,3 are proved together by induction on U . 17 / 42

Part 2: Typed Terms are Reducible First, we prove the following proposition (reducibility theorem) by induction on t . { x 1 : U 1 , . . . , x n : U n , y 1 : V 1 , . . . , y m : V m } ⊢ t : U ∧ ( ∀ i ∈ { 1, . . . , n } . RED U i ( t i )) ⇒ RED U ( t [ x 1 , . . . , x n : = t 1 , . . . , t n ]) 18 / 42

Part 2: Typed Terms are Reducible First, we prove the following proposition (reducibility theorem) by induction on t . { x 1 : U 1 , . . . , x n : U n , y 1 : V 1 , . . . , y m : V m } ⊢ t : U ∧ ( ∀ i ∈ { 1, . . . , n } . RED U i ( t i )) ⇒ RED U ( t [ x 1 , . . . , x n : = t 1 , . . . , t n ]) In case of n = 0, this proposition is equivalent to { y 1 : V 1 , . . . , y m : V m } ⊢ t : U ⇒ RED U ( t ) . 18 / 42

Part 2: Typed Terms are Reducible First, we prove the following proposition (reducibility theorem) by induction on t . { x 1 : U 1 , . . . , x n : U n , y 1 : V 1 , . . . , y m : V m } ⊢ t : U ∧ ( ∀ i ∈ { 1, . . . , n } . RED U i ( t i )) ⇒ RED U ( t [ x 1 , . . . , x n : = t 1 , . . . , t n ]) In case of n = 0, this proposition is equivalent to { y 1 : V 1 , . . . , y m : V m } ⊢ t : U ⇒ RED U ( t ) . Finally, we get a proof of the strong normalization theorem. 18 / 42

Typed Reducibility Unsuccessful Example Now, we redefine the reducibility as a set of typed terms. RED ′ Γ def X ( t ) ⇐ ⇒ SN → β ( t ) RED ′ Γ def ⇒ ∀ u . RED Γ U ( u ) ⇒ RED Γ U → V ( t ) ⇐ V ( t u ) def ⇒ Γ ⊢ t : U ∧ RED ′ Γ RED Γ U ( t ) ⇐ U ( t ) 19 / 42

Typed Reducibility Unsuccessful Example Now, we redefine the reducibility as a set of typed terms. RED ′ Γ def X ( t ) ⇐ ⇒ SN → β ( t ) RED ′ Γ def ⇒ ∀ u . RED Γ U ( u ) ⇒ RED Γ U → V ( t ) ⇐ V ( t u ) def ⇒ Γ ⊢ t : U ∧ RED ′ Γ RED Γ U ( t ) ⇐ U ( t ) In this definition, proof of CR 1 is unsuccessful. 19 / 42

A Proof of CR 1 in Untyped Settings CR 1 RED U ( t ) ⇒ SN → β ( t ) CR 3 neutral ( t ) ∧ ( ∀ t ′ . t → β t ′ ⇒ RED U ( t ′ )) ⇒ RED U ( t ) CR 1,3 are proved together by induction on U. 20 / 42

A Proof of CR 1 in Untyped Settings CR 1 RED U ( t ) ⇒ SN → β ( t ) CR 3 neutral ( t ) ∧ ( ∀ t ′ . t → β t ′ ⇒ RED U ( t ′ )) ⇒ RED U ( t ) CR 1,3 are proved together by induction on U. Proof. If U is a type variable, CR 1 is a tautology. The only remaining case is U = V → W . 20 / 42

A Proof of CR 1 in Untyped Settings CR 1 RED U ( t ) ⇒ SN → β ( t ) CR 3 neutral ( t ) ∧ ( ∀ t ′ . t → β t ′ ⇒ RED U ( t ′ )) ⇒ RED U ( t ) CR 1,3 are proved together by induction on U. Proof. If U is a type variable, CR 1 is a tautology. The only remaining case is U = V → W . RED V → W ( t ) ⇔ ∀ u . RED V ( u ) ⇒ RED W ( t u ) (definition of RED) ⇒ RED V ( x ) ⇒ RED W ( t x ) ( x is a fresh variable) ⇒ RED W ( t x ) (I.H. of CR 3 ) ⇒ SN → β ( t x ) (I.H. of CR 1 ) ⇒ SN → β ( t ) (basic property of SN) 20 / 42

A Proof of CR 1 in Untyped Settings CR 1 RED U ( t ) ⇒ SN → β ( t ) CR 3 neutral ( t ) ∧ ( ∀ t ′ . t → β t ′ ⇒ RED U ( t ′ )) ⇒ RED U ( t ) CR 1,3 are proved together by induction on U. Proof. If U is a type variable, CR 1 is a tautology. The only remaining case is U = V → W . RED V → W ( t ) ⇔ ∀ u . RED V ( u ) ⇒ RED W ( t u ) (definition of RED) ⇒ RED V ( x ) ⇒ RED W ( t x ) ( x is a fresh variable) ⇒ RED W ( t x ) (I.H. of CR 3 ) ⇒ SN → β ( t x ) (I.H. of CR 1 ) ⇒ SN → β ( t ) (basic property of SN) In typed settings, a term of type V is not always existing. 20 / 42

Solutions There are 2 ways to solve this issue: ◮ Construct finite set of types by traversing proof tree of Γ ⊢ t : U , and add it to Γ with fresh variables. ◮ Redefine RED U as a Kripke logical predicate. 21 / 42

Solution 1: Proof Tree Traversal � � Γ ( x ) = U = T ′ ( U ) T Γ ⊢ x : U � � P 1 P 2 = T ′ ( V ) ∪ T ( P 1 ) ∪ T ( P 2 ) T Γ ⊢ t u : V � � P 1 = T ′ ( U → V ) ∪ T ( P 1 ) T Γ ⊢ λ x : U . t : U → V T ′ ( X ) = ∅ T ′ ( U → V ) = { U } ∪ T ′ ( U ) ∪ T ′ ( V ) 22 / 42

Solution 1: Proof Tree Traversal It is possible to prove the following CR 1,2,3 in a similar method. CR 1 ( ∀ V ∈ T ′ ( U ) . V ∈ Γ ) ∧ RED Γ U ( t ) ⇒ SN → β ( t ) CR 2 t → β t ′ ∧ RED Γ U ( t ) ⇒ RED Γ U ( t ′ ) CR 3 ( ∀ V ∈ T ′ ( U ) . V ∈ Γ ) ∧ Γ ⊢ t : U ∧ neutral ( t ) ∧ ( ∀ t ′ . t → β t ′ ⇒ RED Γ U ( t ′ )) ⇒ RED Γ U ( t ) 23 / 42

Solution 1: Proof Tree Traversal It is possible to prove the following CR 1,2,3 in a similar method. CR 1 ( ∀ V ∈ T ′ ( U ) . V ∈ Γ ) ∧ RED Γ U ( t ) ⇒ SN → β ( t ) CR 2 t → β t ′ ∧ RED Γ U ( t ) ⇒ RED Γ U ( t ′ ) CR 3 ( ∀ V ∈ T ′ ( U ) . V ∈ Γ ) ∧ Γ ⊢ t : U ∧ neutral ( t ) ∧ ( ∀ t ′ . t → β t ′ ⇒ RED Γ U ( t ′ )) ⇒ RED Γ U ( t ) 23 / 42

Solution 2: Kripke Logical Predicate def RED ′ X ( Γ , t ) ⇐ ⇒ SN → β ( t ) def RED ′ · ∆ ∧ RED U ( ∆ , u ) ⇒ RED V ( ∆ , t u ) U → V ( Γ , t ) ⇐ ⇒ ∀ ∆ , u . Γ ≤ def ⇒ Γ ⊢ t : U ∧ RED ′ RED U ( Γ , t ) ⇐ U ( Γ , t ) 24 / 42

Solution 2: Kripke Logical Predicate ∀ x ∈ dom ( Γ ) . Γ ( x ) = ∆ ( x ) def RED ′ X ( Γ , t ) ⇐ ⇒ SN → β ( t ) def RED ′ · ∆ U → V ( Γ , t ) ⇐ ⇒ ∀ ∆ , u . Γ ≤ ∧ RED U ( ∆ , u ) ⇒ RED V ( ∆ , t u ) def ⇒ Γ ⊢ t : U ∧ RED ′ RED U ( Γ , t ) ⇐ U ( Γ , t ) 24 / 42

Solution 2: Kripke Logical Predicate ∀ x ∈ dom ( Γ ) . Γ ( x ) = ∆ ( x ) def RED ′ X ( Γ , t ) ⇐ ⇒ SN → β ( t ) def RED ′ · ∆ U → V ( Γ , t ) ⇐ ⇒ ∀ ∆ , u . Γ ≤ ∧ RED U ( ∆ , u ) ⇒ RED V ( ∆ , t u ) def ⇒ Γ ⊢ t : U ∧ RED ′ RED U ( Γ , t ) ⇐ U ( Γ , t ) CR 1 RED U ( Γ , t ) ⇒ SN → β ( t ) CR 2 t → β t ′ ∧ RED U ( Γ , t ) ⇒ RED U ( Γ , t ′ ) CR 3 Γ ⊢ t : U ∧ neutral ( t ) ∧ ( ∀ t ′ . t → β t ′ ⇒ RED U ( Γ , t ′ )) ⇒ RED U ( Γ , t ) 24 / 42

λ 2: System F [Gir72, GTL89] types and terms: U :: = . . . t :: = . . . | ( Π X . U ) | ( t U ) | ( Λ X . t ) additional typing rules: additional reduction rules: Γ ⊢ t : Π X . U ( Λ X . t ) U → β t [ X : = U ] Γ ⊢ t V : U [ X : = V ] t 1 → β t 2 X / ∈ Γ Γ ⊢ t : U t 1 U → β t 2 U Γ ⊢ Λ X . t : Π X . U t 1 → β t 2 Λ X . t 1 → β Λ X . t 2 25 / 42

Strong Normalization Proofs for System F It is impossible to define a reducibility for System F directly. 26 / 42

Strong Normalization Proofs for System F It is impossible to define a reducibility for System F directly. Proof outline of the part 1: 1. Define the reducibility candidates . This is a (type indexed) family of terms, and defined by conditions like CR 1,2,3 . 2. Define the reducibility with parameters . This corresponds to the reducibility of λ → . 3. Prove that the reducibility with parameters is a reducibility candidate. 26 / 42

Untyped Reducibility Candidates Set of terms R is reducibility candidate if and only if CR 1 R ( t ) ⇒ SN ( t ) CR 2 t → β t ′ ∧ R ( t ) ⇒ R ( t ) neutral ( t ) ∧ ( ∀ t ′ . t → β t ′ ⇒ R ( t ′ )) ⇒ R ( t ) . CR 3 27 / 42

Untyped Reducibility Candidates Set of terms R is reducibility candidate if and only if CR 1 R ( t ) ⇒ SN ( t ) CR 2 t → β t ′ ∧ R ( t ) ⇒ R ( t ) neutral ( t ) ∧ ( ∀ t ′ . t → β t ′ ⇒ R ( t ′ )) ⇒ R ( t ) . CR 3 t is not of the form λ x . u or Λ X . u . 27 / 42

Untyped Reducibility Candidates Set of terms R is reducibility candidate if and only if CR 1 R ( t ) ⇒ SN ( t ) CR 2 t → β t ′ ∧ R ( t ) ⇒ R ( t ) neutral ( t ) ∧ ( ∀ t ′ . t → β t ′ ⇒ R ( t ′ )) ⇒ R ( t ) . CR 3 t is not of the form λ x . u or Λ X . u . For example, SN is a reducibility candidate. 27 / 42

Untyped Reducibility with Parameters � R i ( t ) if Y = X i def RED Y [ X : = R ]( t ) ⇐ ⇒ SN ( t ) if Y / ∈ X def RED U → V [ X : = R ]( t ) ⇐ ⇒ ∀ u . RED U [ X : = R ]( u ) ⇒ RED V [ X : = R ]( t u ) def RED Π Y . U [ X : = R ]( t ) ⇐ ⇒ ∀ V , S . RC ( S ) ⇒ RED U [ Y , X : = S , R ]( t V ) 28 / 42

Untyped Reducibility with Parameters � R i ( t ) if Y = X i def RED Y [ X : = R ]( t ) ⇐ ⇒ SN ( t ) if Y / ∈ X def RED U → V [ X : = R ]( t ) ⇐ ⇒ ∀ u . RED U [ X : = R ]( u ) ⇒ RED V [ X : = R ]( t u ) def RED Π Y . U [ X : = R ]( t ) ⇐ ⇒ ∀ V , S . RC ( S ) ⇒ RED U [ Y , X : = S , R ]( t V ) Lemma If R is a sequence of reducibility candidates, RED U [ X : = R ] is a reducibility candidate. 28 / 42

Typed Reducibility Candidates 1 [Hur10] Set of terms R is reducibility candidate of Γ , U if and only if CR 1 # Γ ⊢ t : U ∧ R ( t ) ⇒ SN ( t ) CR 2 # Γ ⊢ t : U ∧ t → β t ′ ∧ R ( t ) ⇒ R ( t ′ ) CR 3 # Γ ⊢ t : U ∧ neutral ( t ) ∧ ( ∀ t ′ . t → β t ′ ⇒ R ( t ′ )) ⇒ R ( t ) . where # Γ = { b : Π X . X } + Γ 29 / 42

Typed Reducibility Candidates 1 [Hur10] Set of terms R is reducibility candidate of Γ , U if and only if CR 1 # Γ ⊢ t : U ∧ R ( t ) ⇒ SN ( t ) CR 2 # Γ ⊢ t : U ∧ t → β t ′ ∧ R ( t ) ⇒ R ( t ′ ) CR 3 # Γ ⊢ t : U ∧ neutral ( t ) ∧ ( ∀ t ′ . t → β t ′ ⇒ R ( t ′ )) ⇒ R ( t ) . where # Γ = { b : Π X . X } + Γ # Γ ⊢ b U : U b U is neutral and normal 29 / 42

Typed Reducibility with Parameters 1 � R i ( t ) if Y = X i def RED Γ Y [ X : = R : U ]( t ) ⇐ ⇒ SN ( t ) if Y / ∈ X def RED Γ V → W [ X : = R : U ]( t ) ⇐ ⇒ ∀ u . # Γ ⊢ u : V [ X : = U ] ⇒ RED Γ V [ X : = R : U ]( u ) ⇒ RED Γ W [ X : = R : U ]( t u ) def RED Γ ⇒ ∀ W , S . RC Γ Π Y . V [ X : = R : U ]( t ) ⇐ W ( S ) ⇒ RED Γ V [ Y , X : = S , R : W , U ]( t W ) 30 / 42

Typed Reducibility with Parameters 1 � R i ( t ) if Y = X i def RED Γ Y [ X : = R : U ]( t ) ⇐ ⇒ SN ( t ) if Y / ∈ X def RED Γ V → W [ X : = R : U ]( t ) ⇐ ⇒ ∀ u . # Γ ⊢ u : V [ X : = U ] ⇒ RED Γ V [ X : = R : U ]( u ) ⇒ RED Γ W [ X : = R : U ]( t u ) def RED Γ ⇒ ∀ W , S . RC Γ Π Y . V [ X : = R : U ]( t ) ⇐ W ( S ) ⇒ RED Γ V [ Y , X : = S , R : W , U ]( t W ) Lemma If R i is a reducibility candidate of Γ , U i for all i ≤ | X | , RED Γ V [ X : = R : U ] is a reducibility candidate of Γ , V [ X : = U ] . 30 / 42

Typed Reducibility Candidates 2 [Gal89] Set of pairs of type environment and term R is reducibility candidate of type U if and only if CR typed R ( Γ , t ) ⇒ Γ ⊢ t : U · ∆ ∧ R ( Γ , t ) ⇒ R ( ∆ , t ) CR 0 Γ ≤ CR 1 R ( t ) ⇒ SN ( t ) CR 2 t → β t ′ ∧ R ( t ) ⇒ R ( t ′ ) CR 3 Γ ⊢ t : U ∧ neutral ( t ) ∧ ( ∀ t ′ . t → β t ′ ⇒ R ( t ′ )) ⇒ R ( t ) . 31 / 42

Typed Reducibility Candidates 2 [Gal89] Set of pairs of type environment and term R is reducibility candidate of type U if and only if CR typed R ( Γ , t ) ⇒ Γ ⊢ t : U · ∆ ∧ R ( Γ , t ) ⇒ R ( ∆ , t ) CR 0 Γ ≤ CR 1 R ( t ) ⇒ SN ( t ) CR 2 t → β t ′ ∧ R ( t ) ⇒ R ( t ′ ) CR 3 Γ ⊢ t : U ∧ neutral ( t ) ∧ ( ∀ t ′ . t → β t ′ ⇒ R ( t ′ )) ⇒ R ( t ) . 31 / 42

Typed Reducibility with Parameters 2 � R i ( Γ , t ) if Y = X i def RED Y [ X : = R : U ]( Γ , t ) ⇐ ⇒ SN ′ ( Γ , t ) ∈ X if Y / def RED V → W [ X : = R : U ]( Γ , t ) ⇐ ⇒ Γ ⊢ t : V → W · ∆ ∧ ( ∀ ∆ , u . Γ ≤ ⇒ RED V [ X : = R : U ]( ∆ , u ) ⇒ RED W [ X : = R : U ]( ∆ , t u )) def RED Π Y . V [ X : = R : U ]( Γ , t ) ⇐ ⇒ ∀ W , S . RC W ( S ) ⇒ RED V [ Y , X : = S , R : W , U ]( t W ) 32 / 42

Typed Reducibility with Parameters 2 � R i ( Γ , t ) if Y = X i def RED Y [ X : = R : U ]( Γ , t ) ⇐ ⇒ SN ′ ( Γ , t ) ∈ X if Y / def RED V → W [ X : = R : U ]( Γ , t ) ⇐ ⇒ Γ ⊢ t : V → W · ∆ ∧ ( ∀ ∆ , u . Γ ≤ ⇒ RED V [ X : = R : U ]( ∆ , u ) ⇒ RED W [ X : = R : U ]( ∆ , t u )) def RED Π Y . V [ X : = R : U ]( Γ , t ) ⇐ ⇒ ∀ W , S . RC W ( S ) ⇒ RED V [ Y , X : = S , R : W , U ]( t W ) Lemma If R i is a reducibility candidate of U i for all i ≤ | X | , RED V [ X : = R : U ] is a reducibility candidate of V [ X : = U ] . 32 / 42

Comparison of the SN Proofs ◮ SN proofs with typed reducibility requires type preservation lemmas. On the other hand, SN proofs with untyped reducibility are completed without type preservation lemmas. (Untyped proofs are relatively simple.) ◮ Typed reducibilities are capturing the features of reducible terms. 33 / 42

Conclusion ◮ We formalized strong normalization proofs with 6 different definitions of the reducibility. ◮ $ wc -lc **/*.v ... 1808 72327 coq/LC/Debruijn/F.v 647 24413 coq/LC/Debruijn/STLC.v ... 3746 138149 total ◮ https://github.com/pi8027/lambda-calculus 34 / 42

Appendix

λ -Calculus and Representations of Binding named representation de Bruijn representation [dB72] (name-carrying term) (nameless terms) t :: = x ( ∈ Var ) t :: = x ( ∈ N ) | ( t t ) | ( t t ) | ( λ x . t ) | ( λ t ) 36 / 42

λ -Calculus and Representations of Binding named representation de Bruijn representation [dB72] (name-carrying term) (nameless terms) t :: = x ( ∈ Var ) t :: = x ( ∈ N ) This number indicates the | ( t t ) | ( t t ) index of corresponding binder. | ( λ x . t ) | ( λ t ) 36 / 42

λ -Calculus and Representations of Binding named representation de Bruijn representation [dB72] (name-carrying term) (nameless terms) t :: = x ( ∈ Var ) t :: = x ( ∈ N ) This number indicates the | ( t t ) | ( t t ) index of corresponding binder. | ( λ x . t ) | ( λ t ) Nameless terms don’t require a variable name in binding positions. 36 / 42

λ -Calculus and Representations of Binding named representation de Bruijn representation [dB72] (name-carrying term) (nameless terms) t :: = x ( ∈ Var ) t :: = x ( ∈ N ) This number indicates the | ( t t ) | ( t t ) index of corresponding binder. | ( λ x . t ) | ( λ t ) Nameless terms don’t examples: require a variable name in binding positions. λ x . λ y . ( λ z . y x z ) x a λλ ( λ 1 2 0 ) 1 2 36 / 42

λ -Calculus and Representations of Binding named representation de Bruijn representation [dB72] (name-carrying term) (nameless terms) t :: = x ( ∈ Var ) t :: = x ( ∈ N ) This number indicates the | ( t t ) | ( t t ) index of corresponding binder. | ( λ x . t ) | ( λ t ) Nameless terms don’t examples: require a variable name in binding positions. λ x . λ y . ( λ z . y x z ) x a λλ ( λ 1 2 0 ) 1 2 36 / 42

λ -Calculus and Representations of Binding named representation de Bruijn representation [dB72] (name-carrying term) (nameless terms) t :: = x ( ∈ Var ) t :: = x ( ∈ N ) This number indicates the | ( t t ) | ( t t ) index of corresponding binder. | ( λ x . t ) | ( λ t ) Nameless terms don’t examples: require a variable name in binding positions. λ x . λ y . ( λ z . y x z ) x a λλ ( λ 1 2 0 ) 1 2 36 / 42

λ -Calculus and Representations of Binding named representation de Bruijn representation [dB72] (name-carrying term) (nameless terms) t :: = x ( ∈ Var ) t :: = x ( ∈ N ) This number indicates the | ( t t ) | ( t t ) index of corresponding binder. | ( λ x . t ) | ( λ t ) Nameless terms don’t examples: require a variable name 0 in binding positions. λ x . λ y . ( λ z . y x z ) x a λλ ( λ 1 2 0 ) 1 2 36 / 42

λ -Calculus and Representations of Binding named representation de Bruijn representation [dB72] (name-carrying term) (nameless terms) t :: = x ( ∈ Var ) t :: = x ( ∈ N ) This number indicates the | ( t t ) | ( t t ) index of corresponding binder. | ( λ x . t ) | ( λ t ) Nameless terms don’t examples: require a variable name in binding positions. λ x . λ y . ( λ z . y x z ) x a λλ ( λ 1 2 0 ) 1 2 36 / 42

λ -Calculus and Representations of Binding named representation de Bruijn representation [dB72] (name-carrying term) (nameless terms) t :: = x ( ∈ Var ) t :: = x ( ∈ N ) This number indicates the | ( t t ) | ( t t ) index of corresponding binder. | ( λ x . t ) | ( λ t ) Nameless terms don’t examples: require a variable name in binding positions. λ x . λ y . ( λ z . y x z ) x a λλ ( λ 1 2 0 ) 1 2 36 / 42

λ -Calculus and Representations of Binding named representation de Bruijn representation [dB72] (name-carrying term) (nameless terms) t :: = x ( ∈ Var ) t :: = x ( ∈ N ) This number indicates the | ( t t ) | ( t t ) index of corresponding binder. | ( λ x . t ) | ( λ t ) Nameless terms don’t examples: require a variable name in binding positions. λ x . λ y . ( λ z . y x z ) x a λλ ( λ 1 2 0 ) 1 2 36 / 42

λ -Calculus and Representations of Binding named representation de Bruijn representation [dB72] (name-carrying term) (nameless terms) t :: = x ( ∈ Var ) t :: = x ( ∈ N ) This number indicates the | ( t t ) | ( t t ) index of corresponding binder. | ( λ x . t ) | ( λ t ) Nameless terms don’t examples: require a variable name 0 in binding positions. λ x . λ y . ( λ z . y x z ) x a λλ ( λ 1 2 0 ) 1 2 36 / 42

λ -Calculus and Representations of Binding named representation de Bruijn representation [dB72] (name-carrying term) (nameless terms) t :: = x ( ∈ Var ) t :: = x ( ∈ N ) This number indicates the | ( t t ) | ( t t ) index of corresponding binder. | ( λ x . t ) | ( λ t ) Nameless terms don’t examples: require a variable name 1 in binding positions. λ x . λ y . ( λ z . y x z ) x a λλ ( λ 1 2 0 ) 1 2 36 / 42