% $Id: mlcf.tex,v 1.30 2008/01/25 13:30:18 logik Exp $
\documentclass[11pt,a4paper]{amsbook}
% \documentclass[11pt,draft,fleqn,a4paper]{amsbook}

\usepackage{amsmath,amssymb,bussproofs,enumerate,infrule,latexsym,verbatim}

% \usepackage{showidx}% prints index entry in the margin
% \usepackage[notcite,notref]{showkeys}% prints labels in the margin

% for pdftex
% \usepackage[backref]{hyperref}

\makeindex
% \listfiles% causes the log file to list all the files used in typesetting


\theoremstyle{plain}
% \newtheorem{theorem}{Theorem}[chapter]
\newtheorem{theorem}{Theorem}[section]
\newtheorem*{theorem*}{Theorem}
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem*{lemma*}{Lemma}
\newtheorem{corollary}[theorem]{Corollary}
\newtheorem*{corollary*}{Corollary}
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem*{proposition*}{Proposition}
\newtheorem{claim}[theorem]{Claim}
\newtheorem*{claim*}{Claim}
\newtheorem*{namedtheorem}{\theoremname}
\newenvironment{named}[1]{\renewcommand{\theoremname}{#1}
   \begin{namedtheorem}}
   {\end{namedtheorem}}

\theoremstyle{definition}
\newtheorem{definition}[theorem]{Definition}
\newtheorem*{definition*}{Definition}
\newtheorem{notation}[theorem]{Notation}
\newtheorem*{notation*}{Notation}
\newtheorem{example}[theorem]{Example}
\newtheorem*{example*}{Example}
\newtheorem{examples}[theorem]{Examples}
\newtheorem*{examples*}{Examples}
\newtheorem{exercise}[theorem]{Exercise}
\newtheorem*{exercise*}{Exercise}
\newtheorem{exercises}[theorem]{Exercises}
\newtheorem*{exercises*}{Exercises}

\theoremstyle{remark}
\newtheorem{remark}[theorem]{Remark}
\newtheorem*{remark*}{Remark}
\newtheorem*{acknowledgement*}{Acknowledgement}

% minlog.mac contains the macros for all tex-files of the minlog
% documentation in order to avoid code duplication and different
% notations.
\input{minlog.mac}

\renewcommand*{\bs}           {\mathit{b}\!\mathit{s}}
\renewcommand*{\Eq}           {\mathsf{Eq}}
\renewcommand*{\FV}           {\mathsf{FV}}
\renewcommand*{\glossary}     {\index}
\renewcommand*{\mi}           {\mathrm{[}\textbf{mi}\mathrm{]}}
\renewcommand*{\qedsymbol}    {{\ \fini\par}}
\renewcommand*{\termProdElimLeft} {\mathsf{Fst}}
\renewcommand*{\termProdElimRight}{\mathsf{Snd}}
\renewcommand*{\termSumIntroLeft} {\mathsf{Inl}}
\renewcommand*{\termSumIntroRight}{\mathsf{Inr}}
\renewcommand*{\thesection}   {\thechapter.\arabic{section}} %Urban
\renewcommand*{\thesubsection}{\thesection.\arabic{subsection}}%Urban
\renewcommand*{\thetheorem}   {\thesection.\arabic{theorem}} %Urban
\renewcommand*{\thetable}     {\thesection.\arabic{table}} %Urban

\allowdisplaybreaks[4]

\begin{document}
\frontmatter

\begin{titlepage}
\vglue  5 true cm
\centerline{\huge Minimal Logic for Computable Functionals}
\bigskip\bigskip 
\centerline{Helmut Schwichtenberg} 
\vglue  10 true cm
\centerline{Mathematisches Institut der Universit\"at M\"unchen}
\centerline{\today}
\end{titlepage}

\tableofcontents
% \listoftables

% \chapter*{Preface}\mylabel{C:Preface}

\mainmatter


\chapter{Minimal Logic}
\mylabel{C:Logic} One of our goals is to study program extraction from
proofs.  We shall cover the theoretical foundations of the subject,
but also try to gain some practical experience.  For the latter we
will make use of the system \textsc{Minlog}.

\textsc{Minlog} is intended to reason about computable functionals,
using mi\-ni\-mal logic.  It is an interactive prover with the following
features.
\begin{itemize}
\item Proofs are treated as first class objects: they can be
  normalized and then used for reading off an instance if the proven
  formula is existential, or changed for program development by proof
  transformation.
\item To keep control over the complexity of extracted programs, we
  follow Kreisel's proposal and aim at a theory with a strong
  language and weak existence axioms.  It should be conservative over
  (a fragment of) arithmetic.
\item \textsc{Minlog} is based on minimal rather than classical or
  intuitionistic logic.  This more general setting makes it possible
  to implement program extraction from classical proofs, via a refined
  $A$-translation (cf.\ \cite{BergerBuchholzSchwichtenberg02}).
\item Constants are intended to denote computable functionals.  Since
  their (mathematically correct) domains are the Scott-Ershov partial
  continuous functionals, this is the intended range of the
  quantifiers.
\item Variables carry (simple) types, with free algebras as base
  types.  The latter need not be finitary (so we allow e.g.\ countably
  branching trees), and can be simultaneously generated.  Type
  parameters (ML style) are allowed, but we keep the theory
  predicative and disallow type quantification.  Also predicate
  variables are allowed, as placeholders for formulas (or more
  precisely, comprehension terms).
\item To simplify equational reasoning, the system identifies terms
  with the same normal form.  A rich collection of rewrite rules is
  provided, which can be extended by the user.  Decidable predicates
  are implemented via boolean valued functions, hence the rewrite
  mechanism applies to them as well.
\end{itemize}

\input{acknow}


\section{Natural Deduction}
\mylabel{S:NatDed} The system we pick for the representation of proofs
is Gentzen's\index{Gentzen} natural deduction, from \cite{Gentzen34}.
Our reasons for this choice are twofold.  First, as the name says this
is a \emph{natural} notion of formal proof, which means that the way
proofs are represented corresponds very much to the way a careful
mathematician writing out all details of an argument would go anyway.
Second, formal proofs in natural deduction are closely related (via
the \indexentry{Curry-Howard correspondence}) to terms in typed
$\lambda$-calculus.  This provides us not only with a compact notation
for logical derivations (which otherwise tend to become somewhat
unmanagable tree-like structures), but also opens up a route to
applying the computational techniques which underpin
$\lambda$-calculus.

\subsection{First Order Languages}
\mylabel{SS:FOL} For first order languages we use the standard language 
containing $\to$, $\land$, $\forall$, $\ex$%
\index{AAAlog@$\to\land\ex$}\label{not:prop} as primitive logical
operators.  We assume countably infinite supplies of individual
variables, $n$-place predicate (or relation) symbols (constants or
variables) for all $n \in \D{N}$, symbols (again constants or
variables) for $n$-ary functions for all $n \in \D{N}$.  0-place
predicate symbols are also called propositional symbols.  0-argument
function symbols are also called (individual) constants.  The language
will \emph{not}, unless stated otherwise, contain = as a primitive.

\emph{Atomic} formulas\glossary{atomic
  formula}\glossary{formula!atomic} are formulas of the form $Rt_1
\dots t_n$, $R$ a predicate symbol, $t_1, \dots, t_n$ individiual
terms.  For formulas which are either
atomic or $\falsum$ we use the term \emph{prime} formula%
\glossary{prime formula}\glossary{formula!prime}.

We use certain categories of symbols, possibly with sub- or
superscripts or primed, as metavariables for certain syntactical
categories (locally different conventions may be introduced):
\begin{itemize}
\item $x,y,z,u,v,w$ for individual variables;
\item $f,g,h$ for function symbols;
\item $c, d$ for individual constants;
\item $t,s,r$ for terms;
\item $P,Q$ for atomic formulas;
\item $R$ for predicate symbols;
\item $A,B,C,D,E,F$ for arbitrary formulas in the language.
\end{itemize}
We introduce abbreviations:
\begin{alignat*}{2}%\label{not:defop}
&\neg A &&:= A \to \falsum,
\\
&A \leftrightarrow B &&:=(A \to B) \land (B \to A),
\\
&\excl x A &&:= \neg \forall x \neg A
\quad\hbox{(the classical existential quantifier)}.
\end{alignat*}In writing formulas we save on parentheses by assuming that $\forall,
\ex, \neg$ bind more strongly than $\land$, and that in turn $\land$
binds more strongly than $\to, \leftrightarrow$.  Outermost
parentheses are also usually dropped.  Thus $A \land \neg B \to C$ is
read as $((A \land (\neg B))\to C)$.  In the case of iterated
implications we sometimes use the short notation
\[
A_1 \to A_2 \to  \dots A_{n-1} \to A_n \quad\hbox{for} \quad
 A_1 \to (A_2 \to  \dots (A_{n-1} \to A_n)\dots).
\]
To save parentheses in quantified formulas, we use a mild form of the
\indexentry{dot notation}: a dot immediately after $\forall x$ or
$\ex x$ makes the scope of that quantifier as large as possible,
given the parentheses around.  So $\forall x.A\to B$ means
$\forall x(A\to B)$, not $(\forall x A) \to B$.

We also save on parentheses by writing e.g.\ $Rxyz$, $Rt_0t_1t_2$
instead of $R(x,y,z)$, $R(t_0,t_1,t_2)$, where $R$ is some predicate
symbol.  Similarly for a unary function symbol with a
(typographically) simple argument, so $fx$ for $f(x)$, etc. In this
case no confusion will arise.  But readability requires that we write
in full $R(fx,gy,hz)$, instead of $Rfxgyhz$.

\subsection{Natural Deduction}
\mylabel{SS:NatDed} We give an inductive definition of derivation
terms in Table~\ref{Tab:minNat}, where for clarity we have written the
corresponding derivations to the left.

\begin{table}
\label{Tab:minNat}
\begin{center}
\begin{tabular}{|c|c|} \hline 
&
\\
derivation & term
\\
&\\ \hline &
\\
$u \colon A$ & $u^A$
\\
&\\ \hline &
\\
\AxiomC{$\phantom{M} \mid M$}
\noLine
\UnaryInfC{$A$}
\AxiomC{$\phantom{N} \mid N$}
\noLine
\UnaryInfC{$B$}
\RightLabel{$\andI$}
\BinaryInfC{$A\land B$}
\DisplayProof &
$\langle M^A,N^B\rangle^{A\land B}$
\\
&\\ \hline &
\\
\AxiomC{$\phantom{M} \mid M$}
\noLine
\UnaryInfC{$A\land B$}
\RightLabel{$\andEzero$}
\UnaryInfC{$A$}
\DisplayProof
\quad
\AxiomC{$\phantom{M} \mid M$}
\noLine
\UnaryInfC{$A\land B$}
\RightLabel{$\andEone$}
\UnaryInfC{$B$}
\DisplayProof
&
$(M^{A\land B} 0)^A$\qquad $(M^{A\land B} 1)^B$
% $\pi_0(M^{A\land B})^A$\qquad $\pi_1(M^{A\land B})^B$
\\
&\\ \hline &
\\
\AxiomC{[$u \colon A$]}
\noLine
\UnaryInfC{$\phantom{M} \mid M$}
\noLine
\UnaryInfC{$B$}
\RightLabel{$\impI \, u$}
\UnaryInfC{$A\to B$}
\DisplayProof
&
$(\lambda u^A M^B)^{A\to B}$
\\
&\\ \hline &
\\
\AxiomC{$\phantom{M} \mid M$}
\noLine
\UnaryInfC{$A\to B$}
\AxiomC{$\phantom{N} \mid N$}
\noLine
\UnaryInfC{$A$}
\RightLabel{$\impE$}
\BinaryInfC{$B$}
\DisplayProof
&
$(M^{A\to B} N^A)^B$
\\
&\\ \hline &
\\
\AxiomC{$\phantom{M} \mid M$}
\noLine
\UnaryInfC{$A$}
\RightLabel{$\allI \, x$\quad\hbox{(with var.cond.)}}
\UnaryInfC{$\forall x A$}
\DisplayProof
&
$(\lambda xM^A)^{\forall x A}$ (with var.cond.)
\\
&\\ \hline &
\\
\AxiomC{$\phantom{M} \mid M$}
\noLine
\UnaryInfC{$\forall x A$}
\AxiomC{$t$}
\RightLabel{$\allE$}
\BinaryInfC{$\subst{A}{x}{t}$}
\DisplayProof
&
$(M^{\forall x A}t)^{\subst{A}{x}{t}}$
\\
&\\ \hline
\end{tabular}
\end{center}
\caption{Derivation terms for $\land$, $\to$ and $\forall$}
\end{table}

Notice that we have left out the standard connectives $\ex$ and
$\lorc$, although they could easily be included, with the rules given
below.  The reason for this omission is that for simplicity we want
our derivation terms to be pure lambda terms formed just by lambda
abstraction, application, pairing and projections.  This would be
violated by the rules for $\ex$ and $\lorc$, which require additional
constructs.

\begin{table}
\label{Tab:minNatorex}
\begin{center}
\begin{tabular}{|c|c|} \hline 
&
\\
derivation & term
\\
&\\ \hline &
\\
\AxiomC{$t$}
\AxiomC{$\phantom{M} \mid M$}
\noLine
\UnaryInfC{$\subst{A}{x}{t}$}
\RightLabel{$\excI$}
\BinaryInfC{$\ex x A$}
\DisplayProof
&
$\bigl(\excI_{x,A} t M^{\subst{A}{x}{t}} \bigr)^{\ex x A}$
\\
&\\ \hline &
\\
\AxiomC{$\phantom{M} \mid M$}
\noLine
\UnaryInfC{$\ex x A$}
\AxiomC{$[u \colon A]$}
\noLine
\UnaryInfC{$\phantom{N} \mid N$}
\noLine
\UnaryInfC{$B$}
\RightLabel{$\excE \, u$ (var.cond.)}
\BinaryInfC{$B$}
\DisplayProof
&
$\bigl(%\excE_{x,A,B} 
M^{\ex x A}(u^A. N^B)\bigr)^B$ (var.cond.)
\\
&\\ \hline &
\\
\AxiomC{$\phantom{M} \mid M$}
\noLine
\UnaryInfC{$A$}
\RightLabel{$\orcIzero$}
\UnaryInfC{$A\lorc B$}
\DisplayProof
\quad
\AxiomC{$\phantom{M} \mid M$}
\noLine
\UnaryInfC{$B$}
\RightLabel{$\orcIone$}
\UnaryInfC{$A\lorc B$}
\DisplayProof
&
$\bigl(\orcI_{0,B} M^A\bigr)^{A\lorc B}$ \,
$\bigl(\orcI_{1,A} M^B\bigr)^{A\lorc B}$
\\
&\\ \hline &
\\
\AxiomC{$\phantom{M} \mid M$}
\noLine
\UnaryInfC{$A \lorc B$}
\AxiomC{$[u \colon A]$}
\noLine
\UnaryInfC{$\phantom{N} \mid N$}
\noLine
\UnaryInfC{$C$} \
\AxiomC{$[v \colon B]$}
\noLine
\UnaryInfC{$\phantom{K} \mid K$}
\noLine
\UnaryInfC{$C$}
\RightLabel{$\orcE \, u,v$}
\insertBetweenHyps{\hskip.3cm}
\TrinaryInfC{$C$}
\DisplayProof
&
$\bigl(M^{A \lorc B}(u^A.  N^C, v^B. K^C)\bigr)^C$
\\
&\\ \hline
\end{tabular}
\end{center}
\caption{Derivation terms for $\ex$ and $\lorc$}
\end{table}

In spite of this omission we can use $\ex$ and $\lorc$ in our logic,
if we allow appropriate axioms as constant derivation terms, e.g.\ for
$\ex$
\begin{align*} 
\excI_{x,A} \colon&
\forall x. A\to \ex x A\\ 
\excE_{x,A,B} \colon&
\ex x A\to(\forall x.A\to B)\to B
\end{align*} 
with the usual proviso $x\notin \FV(B)$.  For $\lorc$ we could introduce
similar axioms; however, we do not do so here, since in the presence
of e.g.\ the booleans we can define $\lorc$ from $\ex$ via
\[
A \lorc B :\equiv \ex p.  (p = \true \to A) \land (p = \false \to B).
\]

Notice that there is one price to pay in this approach: derivations in
normal form are not as normal as they could be.  In particular, in the
presence of the constants $\excI_{x,A}$ and $\excE_{x,A,B}$ the
subformula property clearly is weaker than than it would be with the
$\ex, \lorc$-rules and \emph{permutative
  conversion}\index{conversion!permutative}: permute an elimination
immediately following an $\ex, \lorc$-rule over this rule to the
minor premise.


\section{Embedding Classical and Intuitionistic Logic}
\mylabel{S:Class} In minimal logic all propositional symbols play the
same role.  We now distinguish a special propositional symbol:
$\falsum$, to be read \inquotes{falsum}\index{falsum}.  We then obtain
classical and intuitionistic logic by allowing appropriate additional
assumptions.

\subsection{Ex-Falso-Quodlibet and Stability}
\mylabel{SS:EfqStab} To obtain \emph{intuitionistic
  logic}\index{logic!intuitionistic} we use as additional assumptions
the \emph{ex-falso-quodlibet}\index{ex-falso-quodlibet} formulas
$\Efq_R$ for every predicate symbol $R$ different from $\falsum$:
\[
\forall \vec{x}. \falsum \to R \vec{x}. \eqno(\Efq_R)
\]
Similarly one obtains \emph{classical logic}\index{logic!classical} by
allowing for every predicate symbol $R$ different from $\falsum$ the
\indexentry{principle of indirect proof} as an additional assumption,
i.e.\ the formula
\[
\forall\vec{x}. \neg \neg R \vec{x} \to R \vec{x};\eqno(\Stab_R)
\]
this formula is also called \indexentry{stability} of $R$.

Notice that with $\falsum$ for $R \vec{x}$ both formulas are trivially
derivable; e.g.\ for stability we have $\neg \neg \falsum \to \falsum
= ((\falsum \to \falsum) \to \falsum) \to \falsum$.  The derivation is
\[
\AxiomC{$v \colon( \falsum \to \falsum)\to \falsum$}
\AxiomC{$u \colon \falsum$}
\RightLabel{$\impI u$}
\UnaryInfC{$\falsum \to \falsum$}
\BinaryInfC{$\falsum$}
\DisplayProof
\]
Let
\begin{align*}
\Efq  &:= \set{\Efq_R}{\hbox{$R$ predicate symbol $\ne \falsum$}},
\\
\Stab &:=\set{\Stab_R}{\hbox{$R$ predicate symbol $\ne \falsum$}}.
\end{align*}
We call the formula $B$ \emph{classically (intuitionistically)
derivable} and write $\vdash_c B$ ($\vdash_i B$) if there is a derivation
of $B$ from stability assumptions $\Stab_A$
(ex-falso-quodlibet assumptions $\Efq_A$).  Similarly we define
classical (intuitionistic) derivability from $\Gamma$ and write
$\Gamma\vdash_c B$ ($\Gamma\vdash_i B$), i.e.
\begin{align*}
\Gamma \vdash_i B &\defiff \Gamma \cup \Efq \vdash B,
\\
\Gamma \vdash_c B &\defiff \Gamma \cup \Stab \vdash B.
\end{align*}

\begin{lemma*}[Ex-falso-quodlibet]
  $\vdash_i \falsum \to A$ for every formula $A$.
\end{lemma*}

\begin{proof}
By induction on $A$ we construct for every formula $A$ a derivation
$\C{D}_A$ of $\falsum \to A$.
\emph{Case} $A$ atomic formula.  Use $\Efq_A$.  \emph{Case} $A\land B$.  
\[
\AxiomC{$\C{D}_A$}
\noLine
\UnaryInfC{$\falsum \to A$}
\AxiomC{$u \colon \falsum$}
\BinaryInfC{$A$}
\AxiomC{$\C{D}_B$}
\noLine
\UnaryInfC{$\falsum \to B$}
\AxiomC{$u \colon \falsum$}
\BinaryInfC{$B$}
\BinaryInfC{$A\land B$}
\RightLabel{$\impI u$}
\UnaryInfC{$\falsum \to A\land B$}
\DisplayProof
\]
\emph{Case} $A \to B$.  
\[
\AxiomC{$\C{D}_B$}
\noLine
\UnaryInfC{$\falsum \to B$}
\AxiomC{$u \colon \falsum$}
\BinaryInfC{$B$}
\UnaryInfC{$A \to B$}
\RightLabel{$\impI u$}
\UnaryInfC{$\falsum \to A \to B$}
\DisplayProof
\]
\emph{Case} $\forall x A$.  
\[
\AxiomC{$\C{D}_A$}
\noLine
\UnaryInfC{$\falsum \to A$}
\AxiomC{$u \colon \falsum$}
\BinaryInfC{$A$}
\UnaryInfC{$\forall x A$}
\RightLabel{$\impI u$}
\UnaryInfC{$\falsum \to \forall x A$}
\DisplayProof
\]
\emph{Case} $\ex x A$.  
\[
\AxiomC{$x$}
\AxiomC{$\C{D}_A$}
\noLine
\UnaryInfC{$\falsum \to A$}
\AxiomC{$u \colon \falsum$}
\BinaryInfC{$A$}
\BinaryInfC{$\ex x A$}
\RightLabel{$\impI u$}
\UnaryInfC{$\falsum \to \ex x A$}
\DisplayProof
\]
This concludes the proof.
\end{proof}

\begin{lemma*}[Stability]
  For every formula $A$ without $\ex$, $\vdash_c \neg \neg A \to A$.
\end{lemma*}

\begin{proof}
Induction on $A$.  In the constructed derivations we omit (for brevity)
the introductions at the end.
\emph{Case} $A$ atomic formula.  Use $\Stab_A$.  

\emph{Case} $A \land B$.  Use $\vdash( \neg \neg A \to A) \to ( \neg
\neg B \to B) \to \neg \neg(A \land B) \to A \land B$, which can be
derived easily from $\vdash \neg \neg(A \land B) \leftrightarrow (\neg
\neg A \land \neg \neg B)$ (Exercise: derive the latter formula).

\emph{Case} $A \to B$.  Use $\vdash(\neg \neg B \to B) \to \neg \neg( A \to
B) \to A \to B$.  A derivation is
\[
\AxiomC{$u \colon \neg \neg B \to B$}
\AxiomC{$v \colon \neg \neg(A \to B)$}
\AxiomC{$u_1 \colon \neg B$}
\AxiomC{$u_2 \colon A \to B$}
\AxiomC{$w \colon A$}
\BinaryInfC{$B$}
\BinaryInfC{$\falsum$}
\RightLabel{$\impI u_2$}
\UnaryInfC{$\neg(A \to B)$} 
\BinaryInfC{$\falsum$}
\RightLabel{$\impI u_1$}
\UnaryInfC{$\neg \neg B$}
\BinaryInfC{$B$}
\DisplayProof
\]
\emph{Case} $\forall x A$.  Clearly it suffices to show
$\vdash(\neg \neg A \to A) \to \neg \neg \forall x A \to A$.
A derivation is
\[
\AxiomC{$u \colon \neg \neg A \to A$}
\AxiomC{$v \colon \neg \neg \forall x A$}
\AxiomC{$u_1 \colon \neg A$}
\AxiomC{$u_2 \colon \forall x A$}
\AxiomC{$x$}
\BinaryInfC{$A$}
\BinaryInfC{$\falsum$}
\RightLabel{$\impI u_2$}
\UnaryInfC{$\neg \forall x A$}
\BinaryInfC{$\falsum$}
\RightLabel{$\impI u_1$}
\UnaryInfC{$\neg \neg A$}
\BinaryInfC{$A$}
\DisplayProof
\]
This concludes the proof.
\end{proof}

\begin{lemma*} 
  $\Gamma \vdash A \imp \Gamma \vdash_i A$ and $\Gamma \vdash_i A
  \imp \Gamma \vdash_c A$.
\end{lemma*}

\begin{proof}  
It suffices to show  $\vdash_c \Efq_A$.  This can be seen as follows; 
for brevity assume $R$ to be unary.
\[
\AxiomC{$\forall x. \neg \neg Rx \to Rx$}
\AxiomC{$x$}
\BinaryInfC{$\neg \neg Rx \to Rx$}
\AxiomC{$u \colon \falsum$}
\RightLabel{$\impI v^{\neg Rx}$}
\UnaryInfC{$\neg \neg Rx$}
\BinaryInfC{$Rx$}
\RightLabel{$\impI u$}
\UnaryInfC{$\falsum \to Rx$}
\RightLabel{$\allI$}
\UnaryInfC{$\forall x. \falsum \to Rx$}
\DisplayProof
\]
This concludes the proof.
\end{proof}

% The constructions in Lemmata~\ref{L:efq} and \ref{L:stab} can easily
% be implemented.  In \textsc{Minlog} the commands are
% \texttt{proof-of-stab-at} and \texttt{proof-of-efq-at}.

Note that neither of the two implications can be reversed.
Counterexamples are
\begin{align*}
&\not\vdash\falsum \to P,\quad\hbox{but}\quad\vdash_i\falsum \to P,
\\
&\not\vdash_i ((P \to Q) \to P) \to P,\quad\hbox{but}\quad\vdash_c
((P \to Q) \to P) \to P.
\end{align*}
Apart from $\not\vdash_i ((P \to Q) \to P) \to P$ the proofs are easy.
However, to prove the non-derivability of the Peirce formula $((P \to
Q) \to P) \to P$ in intuitionistic logic requires a more careful study
of intuitionistic derivability.  

\begin{lemma*}[Proof by cases]
  $\vdash_c(A \to B) \land(\neg A \to B) \to B$.
\end{lemma*}

\begin{proof}
Let $C$ abbreviate $(A \to B) \land(\neg A \to B)$
\[
\AxiomC{$\C{D}_{\Stab}$} 
\noLine
\UnaryInfC{$\neg \neg B \to B$}
\AxiomC{$w\colon \neg B$}
\AxiomC{$u \colon C$}
\UnaryInfC{$\neg A \to B$}
\AxiomC{$w\colon \neg B$}
\AxiomC{$u \colon C$}
\UnaryInfC{$A \to B$}
\AxiomC{$v \colon A$}
\BinaryInfC{$B$}
\BinaryInfC{$\falsum$}
\RightLabel{$\impI v$}
\UnaryInfC{$\neg A$}
\BinaryInfC{$B$}
\BinaryInfC{$\falsum$}
\RightLabel{$\impI w$}
\UnaryInfC{$\neg \neg B$}
\BinaryInfC{$B$}
\DisplayProof
\]
where $\C{D}_{\Stab}$ is a derivation provided by the Stability
Lemma..
\end{proof}

\subsection{Equivalence}
\mylabel{SS:Equiv} Call two formulas $A$ and $B$
\emph{equivalent}\index{formulas!equivalent} in minimal (classical,
intuitionistic) logic if $\vdash A\leftrightarrow B$ ($\vdash_c
A\leftrightarrow B$, $\vdash_i A\leftrightarrow B$).

\begin{lemma*}[Equivalence]
  Let $\vdash_{mic}\in \{\vdash,\vdash_i,\vdash_c\}$.  Then
  $\vdash_{mic} A_1\leftrightarrow A_2$ and $B_2$ is obtained from $B_1$
  by replacing one subformula $A_1$ of $B_1$ by $A_2$, then we also have
  $\vdash_{mic} B_1\leftrightarrow B_2$.
\end{lemma*}

\begin{proof}
Induction on $B_1$.  If all of $B_1$ had been replaced, the claim is
obvious.  Otherwise $B_1$ must be a composed formula.

\emph{Case} $C_1 \land D_1$.  Assume the replacement takes places in
$C_1$.  We have to show $\vdash_{mic} C_1 \land D_1\leftrightarrow
C_2 \land D_1$.  $\to$:
\[
\AxiomC{$\C{D}$}
\noLine
\UnaryInfC{$C_1 \to C_2$}
\AxiomC{$C_1 \land D_1$}
\UnaryInfC{$C_1$}
\BinaryInfC{$C_2$}
\AxiomC{$C_1 \land D_1$}
\UnaryInfC{$D_1$}
\BinaryInfC{$C_2 \land D_1$}
\DisplayProof
\]
where $\C{D}$ is known by induction hypothesis.  $\leftarrow$ is proved
similarly.

\emph{Case} $C_1 \to D_1$.  Assume the replacement takes places in
$C_1$.  We have to show $\vdash_{mic}(C_1 \to
D_1)\leftrightarrow(C_2 \to D_1)$.  $\to$:
\[
\AxiomC{$C_1 \to D_1$}
\AxiomC{$\C{D}$} 
\noLine
\UnaryInfC{$C_2 \to C_1$}
\AxiomC{$u \colon C_2$}
\BinaryInfC{$C_1$}
\BinaryInfC{$D_1$}
\RightLabel{$\impI u$}
\UnaryInfC{$C_2 \to D_1$}
\DisplayProof
\]
where again $\C{D}$ is known by induction hypothesis.  $\leftarrow$ is
proved similarly.  Assume now that the replacement takes places in
$D_1$.  We must show $\vdash_{mic}(C_1 \to D_1)\leftrightarrow(C_1 \to
D_2)$.  $\to$:
\[
\AxiomC{$\C{D}$} 
\noLine
\UnaryInfC{$D_1 \to D_2$}
\AxiomC{$C_1 \to D_1$}
\AxiomC{$u \colon C_1$}
\BinaryInfC{$D_1$}
\BinaryInfC{$D_2$}
\RightLabel{$\impI u$}
\UnaryInfC{$C_1 \to D_2$}
\DisplayProof
\]
where again $\C{D}$ is known by induction hypothesis.  $\leftarrow$ is
proved similarly.  

\emph{Case} $\forall xC_1$.  We must show
$\vdash_{mic}\forall xC_1\leftrightarrow\forall xC_2$. $\to$:
\[
\AxiomC{$\C{D}$} 
\noLine
\UnaryInfC{$C_1 \to C_2$}
\AxiomC{$\forall xC_1$}
\AxiomC{$x$}
\BinaryInfC{$C_1$}
\BinaryInfC{$C_2$}
\UnaryInfC{$\forall xC_2$}
\DisplayProof
\]
where again $\C{D}$ is known by induction hypothesis.  Observe that
$\C{D}$ does not contain free assumptions.  $\leftarrow$ is proved
similarly.

\emph{Case} $\ex xC_1$.  Similar.
\end{proof}


\section{Glivenko's Theorem}
\mylabel{S:Glivenko} As an illustration of what can be done in
intuitionistic propositional logic we prove Glivenko's theorem, which
says that every negation, which is a classical tautology, can be
derived intuitionistically.

\subsection{Valuations}
\mylabel{SS:Casesneg}

\begin{lemma*}
  $\vdash (A \to B) \to (\neg A \to B) \to \neg \neg B$.
\end{lemma*}

\begin{proof}
  Assume $\neg B$.  Then $\neg A$, hence $B$, hence $\falsum$.
\end{proof}

For $\sigma \in \{0,1 \}$ let
\[
A^{\sigma} := \begin{cases} 
  A &\text{if $\sigma = 1$}\\
  \neg A &\text{if $\sigma = 0$}
\end{cases}
\]

A \indexentry{valuation} $v$ is a mapping from propositional variables
into \indexentry{truth values}, which are taken here to be $0$ and
$1$, for falsity and truth.  Call a formula a \indexentry{tautology}
if for every valuation $v$ its truth value $v(A)$ is $1$.  For
$* \in \{\to, \land \}$ let $\sigma * \tau$ be the truth value given
by the well-known truth table for the connective $*$.

\subsection{Intuitionistic Derivability and Valuations}
\mylabel{SS:val}

\begin{lemma*}
  $\vdash_{i} A^{\sigma} \to B^{\tau} \to (A * B)^{\sigma * \tau}$ for
  $* \in \{\to, \land \}$.
\end{lemma*}

\begin{proof}
  \emph{Case} $\to$.
  \begin{align*}
    &\vdash B \to A \to B
    \\
    &\vdash A \to \neg B \to \neg(A \to B)
    \\
    &\vdash_{i} \neg A \to A \to B
  \end{align*}
  \emph{Case} $\land$.
  \begin{align*}
    &\vdash A \to B \to A \land B
    \\
    &\vdash \neg A \to \neg(A \land B)
    \\
    &\vdash \neg B \to \neg(A \land B)
  \end{align*}
  Notice that these formulas are slightly stronger than required.
\end{proof}

\begin{lemma*}
  Let $A$ be a formula in propositional logic, and let $P_1, \dots, P_n$
  be all propositional variables in $A$.  The we have, for every valuation
  $v$,
  \[
  \vdash_i P_1^{v(P_1)} \to \dots \to P_n^{v(P_n)} \to A^{v(A)}.
  \]
\end{lemma*}

\begin{proof}
  By induction on $A$.  \emph{Case} $P_i$.  Clear.  \emph{Case} $A * B$.
  Use
  \[
  \vdash_{i} A^{v(A)} \to B^{v(B)} \to (A * B)^{v(A) * v(B)},
  \]
  which holds by the previous lemma.
\end{proof}

\subsection{Glivenko's Theorem}
\mylabel{SS:Glivenko}

\begin{theorem*}[Glivenko]
  $\vdash_i \neg A$ for $\neg A$ a tautology.
\end{theorem*}

\begin{proof}
  By the final lemma in \ref{SS:val} we have, for every valuation $v$,
  \[
  \vdash_i P_1^{v(P_1)} \to \dots \to P_n^{v(P_n)} \to \neg A,
  \]
  since by assumption $v(\neg A)=1$.  We show
  \[
  \vdash_i P_1^{v(P_1)} \to \dots \to P_k^{v(P_k)} \to \neg A
  \quad \hbox{for every valuation $v$,}
  \]
  by induction on $i := n-k$.  \emph{Base}
  $i=0$.  Clear, by what we just noted.  \emph{Step}.  We must show
  \[
  \vdash_i P_1^{v(P_1)} \to \dots \to P_{k-1}^{v(P_{k-1})} \to \neg A.
  \]
  By IH we have
  \begin{align*}
    &\vdash_i P_1^{v(P_1)} \to \dots \to P_{k-1}^{v(P_{k-1})} \to P_k \to 
    \neg A,
    \\
    &\vdash_i P_1^{v(P_1)} \to \dots \to P_{k-1}^{v(P_{k-1})} \to \neg P_k \to 
    \neg A.
  \end{align*}
  Using the lemma in \ref{SS:Casesneg} we obtain
  \[
  \vdash_i P_1^{v(P_1)} \to \dots \to P_{k-1}^{v(P_{k-1})} \to
  \neg \neg \neg A.
  \]
  The claim follows from $\vdash \neg \neg \neg A \to \neg A$. --
  Applying the inductively proven claim with $i=n$ (i.e., $k=0$)
  yields $\vdash_i \neg A$, as required.
\end{proof}


\section{Negative Translation}
\mylabel{S:NegTrans} Having defined classical and intuitionistic logic
out of minimal logic by adding axioms, we next show that in fact, both
logics can be embedded into minimal logic, as long as we restrict
ourselves to the language based on $\{{\to}, {\land}, {\forall},
{\falsum}\}$.  This restriction will be in force for the rest of the
present chapter.

\subsection{Negative Formulas}
\mylabel{SS:NegFlas} A formula $A$ of the $\{{\to}, {\land},
{\forall}, {\falsum}\}$-language is called
\emph{negative}\index{formula!negative}, if every atomic formula of
$A$ different from $\falsum$ occurs negated.

\begin{lemma*} 
  For negative $A$ we have $\vdash\neg \neg A \to A$.
\end{lemma*}

\begin{proof} 
  Use the Stability Lemma and $\vdash\neg \neg\neg R \vec{t} \to\neg R
  \vec{t}$.
\end{proof}

We now define the G\"odel-Gentzen (or
\inquotes{negative}) translation of classical logic into minimal
logic.  The basic idea is to double negate every atomic formula.

\begin{definition*}
[Negative translation $^g$ of
G\"odel-Gentzen\index{Goedel-Gentzen-translation@G\"odel-Gentzen
translation $^g$}]
\begin{alignat*}{2}
&\falsum^g       &&:= \falsum,
\\
&R \vec{t}^g     &&:= \neg \neg R \vec{t},
\\
&(A \land B)^g   &&:= A^g \land B^g,
\\
&(A \to B)^g     &&:= A^g \to B^g,
\\
&(\forall x A)^g &&:= \forall x A^g.
\end{alignat*}
\end{definition*} 

Notice that $A^g$ is the same as $A$ for negative $A$.

\begin{theorem*}
  For all formulas $A$ we have
  \begin{enumeratea}
  \item \label{T:negtrans:a}
    $\vdash_c A \leftrightarrow A^g$,
  \item \label{T:negtrans:b}
    $\Gamma \vdash_c A$ iff $\Gamma^g \vdash A^g$, where
    $\Gamma^g := \set{B^g}{B \in \Gamma}$.
  \end{enumeratea}
\end{theorem*}

\begin{proof} (a).  The claim follows easily from 
  the Equivalence Lemma..
  
  (b) $\Leftarrow$.  Obvious.  $\Rightarrow$.  By induction on the
  classical derivation.  For a stability assumption $\neg \neg R
  \vec{t} \to R \vec{t}$ we have $(\neg \neg R \vec{t} \to R
  \vec{t})^g = \neg \neg R \vec{t}\to\neg \neg R \vec{t}$, and this is
  easily derivable.

\emph{Case} $\impI$.  Assume
\[
\AxiomC{$[u \colon A]$}
\noLine
\UnaryInfC{$\C{D}$}
\noLine
\UnaryInfC{$B$}
\RightLabel{$\impI u$}
\UnaryInfC{$A\to B$}
\DisplayProof
\]
We have by induction hypothesis
\[
\AxiomC{$[u \colon A^g]$}
\noLine
\UnaryInfC{$\C{D}^g$}
\noLine
\UnaryInfC{$B^g$}
\RightLabel{$\impI u$}
\UnaryInfC{$A^g\to B^g$}
\DisplayProof
\]

\emph{Case} $\impE$.  Assume
\[
\AxiomC{$\C{D}_0$}
\noLine
\UnaryInfC{$A \to B$}
\AxiomC{$\C{D}_1$}
\noLine
\UnaryInfC{$A$}
\BinaryInfC{$B$}
\DisplayProof
\]
We have by induction hypothesis
\[
\AxiomC{$\C{D}_0^g$}
\noLine
\UnaryInfC{$A^g\to B^g$}
\AxiomC{$\C{D}_1^g$}
\noLine
\UnaryInfC{$A^g$}
\BinaryInfC{$B^g$}
\DisplayProof
\]
The other cases are treated similarly.
\end{proof}

\begin{corollary*}[Embedding of classical logic] For negative $A$,
  \[
  \vdash_c A\iff \vdash A.
  \]
\end{corollary*}

\begin{proof} 
  By the theorem we have $\vdash_c A$ iff $\vdash A^g$.  Since $A$ is
  negative, every atom distinct from $\falsum$ in $A$ must occur
  negated, as $\neg R \vec{t}$, and hence in $A^g$ it appears in same
  form.
\end{proof}

Since every formula is classically equivalent to a negative formula,
we have achieved an embedding of classical logic into minimal logic.

Note that $\not\vdash\neg \neg P\to P$.
% (as we shall show in section \ref{Compl}).  
The corollary therefore does not hold for all formulas $A$.

\subsection{Formulas Implying Their Negative Translation}
\mylabel{SS:Spreading} We introduce a further observation (due to
Leivant; see Troelstra and van Dalen \cite[Ch.2,
Sec.3]{TroelstravanDalen88}) which will be useful for program
extraction from classical proofs (cf.\ Chapter~\ref{C:Class}).  There
it will be necessary to actually transform a given classical
derivation $\vdash_c A$ into a minimal logic derivation $\vdash A^g$.
In particular, for every assumption constant $C$ used in the given
derivation we have to provide a derivation of $C^g$.  Now for some
formulas $S$ -- the so-called \emph{spreading} formulas -- this is
immediate, for we can derive $S \to S^g$, and hence can use the
original assumption constant.

Recall that our formulas may contain \emph{predicate
variables}\index{predicate variable} denoted by $X$, which are place
holders for comprehension terms, i.e.\ formulas with distinguished
variables.  We use the obvious notation
$\subst{A}{X}{\set{\vec{x}}{B}}$ or shortly $A[\set{\vec{x}}{B}]$ or
even $A[B]$ for substitution for predicate variables.  Clearly the
G\"odel-Gentzen translation of $X \vec{t}$ is $\neg
\neg X \vec{t}$.

Recall also that an assumption constant consists of an uninstantiated
formula (e.g.\ $X 0 \to (\forall n. X n \to X(n+1)) \to \forall n X n$
for induction) together with a substitution of comprehension terms for
predicate variables (e.g.\ $X \mapsto \set{n}{n < n+1}$).  Then in
order to immediately obtain a derivation of $C^g$ for $C$ an
assumption constant it suffices to know that its \emph{uninstantiated}
formula $S$ is spreading, for then we generally have $\vdash
S[\vec{A}^g] \to S[\vec{A}]^g$ (see the theorem below) and hence can
use the same assumption constant with a different substitution.

We define \emph{spreading} formulas\index{formula!spreading} $S$,
\emph{wiping} formulas\index{formula!wiping} $W$ and \emph{isolating}
formulas\index{formula!isolating} $I$ inductively.
\begin{alignat*}{2}
S \;\;&:=\;\; \falsum \mid R \vec{t} \mid X \vec{t} \mid S \land S
\mid I \to S \mid \forall x S, 
\\ 
W \;\;&:=\;\; \falsum \mid X \vec{t} \mid W \land W \mid 
S \to W \mid \forall x W, 
\\
I \;\;&:=\;\; R \vec{t} \mid W \mid I \land I.
\end{alignat*}
Let $\C{S}$ ($\C{W}, \C{I}$) be the class of spreading (wiping,
isolating) formulas.

\begin{theorem*}
  \begin{alignat*}{2}
    &\vdash S[\vec{A}^g] \to S[\vec{A}]^g
    &\quad& \text{for every spreading formula $S$,}
    \\
    &\vdash W[\vec{A}]^g \to W[\vec{A}^g]
    &&\text{for every wiping formula $W$,}
    \\
    &\vdash I[\vec{A}]^g \to \neg \neg I[\vec{A}^g]
    &&\text{for every isolating formula $I$.}
  \end{alignat*}
  We assume here that all occurrences of predicate variables are
  substituted.
\end{theorem*}

\begin{proof}
For brevity we write $S^g$ for $S[\vec{A}]^g$ and $S$ for
$S[\vec{A}^g]$, and similarly for $W$ and $I$.

\emph{Case} $\falsum \in \C{S}$.  We must show $\vdash \falsum \to
\falsum^g$.  Take $\lambda u^{\falsum} u$.

\emph{Case} $R \vec{t} \in \C{S}$.  We must show $\vdash R \vec{t} \to
\neg \neg R \vec{t}$.  Take $\lambda u^{R \vec{t}} \lambda v^{\neg 
R \vec{t}}.vu$.

\emph{Case} $X \vec{t} \in \C{S}$, with $X$ substituted by
$\set{\vec{x}}{A}$.  We must show $\vdash A^g[\vec{t}] \to A^g[\vec{t}]$,
which is trivial.

\emph{Case} $S_1 \land S_2 \in \C{S}$.  We must show $\vdash S_1 \land
S_2 \to S_1^g \land S_2^g$.  Take
\[
\AxiomC{IH}
\noLine
\UnaryInfC{$S_1 \to S_1^g$}
\AxiomC{$u \colon S_1 \land S_2$}
\UnaryInfC{$S_1$}
\BinaryInfC{$S_1^g$}
\AxiomC{IH}
\noLine
\UnaryInfC{$S_2 \to S_2^g$}
\AxiomC{$u \colon S_1 \land S_2$}
\UnaryInfC{$S_2$}
\BinaryInfC{$S_2^g$}
\BinaryInfC{$S_1^g \land S_2^g$}
\DisplayProof
\]

\emph{Case} $I \to S \in \C{S}$.  We must show $\vdash (I \to S) \to
I^g \to S^g$.  Recall that $\vdash \neg \neg S^g \to S^g$ by the
Stability Lemma, because $S^g$ is negative.  Take
\[
\AxiomC{Stab}
\noLine
\UnaryInfC{$\neg \neg S^g \to S^g$}
\AxiomC{IH}
\noLine
\UnaryInfC{$I^g \to \neg \neg I$}
\AxiomC{$v \colon I^g$}
\insertBetweenHyps{\hspace{.5em}}
\BinaryInfC{$\neg \neg I$}
\AxiomC{$w_1 \colon \neg S^g$}
\AxiomC{IH}
\noLine
\UnaryInfC{$S \to S^g$}
\AxiomC{$u \colon I \to S$}
\AxiomC{$w_2 \colon I$}
\insertBetweenHyps{\hspace{.5em}}
\BinaryInfC{$S$}
\BinaryInfC{$S^g$}
\insertBetweenHyps{\hspace{.5em}}
\BinaryInfC{$\falsum$}
\RightLabel{$\impI w_2$}
\UnaryInfC{$\neg I$}
\insertBetweenHyps{\hspace{.5em}}
\BinaryInfC{$\falsum$}
\RightLabel{$\impI w_1$}
\UnaryInfC{$\neg \neg S^g$}
\insertBetweenHyps{\hspace{-2em}}
\BinaryInfC{$S^g$}
\DisplayProof
\]

\emph{Case} $\forall x S \in \C{S}$.  We must show $\vdash \forall x S
\to \forall x S^g$.  Take 
\[
\AxiomC{IH}
\noLine
\UnaryInfC{$S \to S^g$}
\AxiomC{$u \colon \forall x S$}
\AxiomC{$x$}
\BinaryInfC{$S$}
\BinaryInfC{$S^g$}
\DisplayProof
\]

\emph{Case} $\falsum \in \C{W}$.  We must show $\vdash \falsum^g \to
\falsum$.  Take $\lambda u^{\falsum} u$.

\emph{Case} $X \vec{t} \in \C{W}$, with $X$ substituted by
$\set{\vec{x}}{A}$.  We must show $\vdash A^g[\vec{t}] \to A^g[\vec{t}]$,
which is trivial.

\emph{Case} $W_1 \land W_2 \in \C{W}$.  We must show $\vdash W_1^g \land
W_2^g \to W_1 \land W_2$.  Take
\[
\AxiomC{IH}
\noLine
\UnaryInfC{$W_1^g \to W_1$}
\AxiomC{$u \colon W_1^g \land W_2^g$}
\UnaryInfC{$W_1^g$}
\BinaryInfC{$W_1$}
\AxiomC{IH}
\noLine
\UnaryInfC{$W_2^g \to W_2$}
\AxiomC{$u \colon W_1^g \land W_2^g$}
\UnaryInfC{$W_2^g$}
\BinaryInfC{$W_2$}
\BinaryInfC{$W_1 \land W_2$}
\DisplayProof
\]

\emph{Case} $S \to W \in \C{W}$.  We must show $\vdash (S^g \to W^g)
\to S \to W$.  Take
\[
\AxiomC{IH}
\noLine
\UnaryInfC{$W^g \to W$}
\AxiomC{$u \colon S^g \to W^g$}
\AxiomC{IH}
\noLine
\UnaryInfC{$S \to S^g$}
\AxiomC{$v \colon S$}
\BinaryInfC{$S^g$}
\BinaryInfC{$W^g$}
\BinaryInfC{$W$}
\DisplayProof
\]

\emph{Case} $\forall x W \in \C{W}$.  We must show $\vdash \forall x W^g
\to \forall x W$.  Take 
\[
\AxiomC{IH}
\noLine
\UnaryInfC{$W^g \to W$}
\AxiomC{$u \colon \forall x W^g$}
\AxiomC{$x$}
\BinaryInfC{$W^g$}
\BinaryInfC{$W$}
\DisplayProof
\]

\emph{Case} $R \vec{t} \in \C{I}$.  We must show $\vdash \neg \neg R
\vec{t} \to \neg \neg R \vec{t}$, which is trivial.

\emph{Case} $W \in \C{I}$.  We must show $\vdash W^g \to \neg \neg W$,
which trivially follows from the IH $\vdash W^g \to W$.  Take
\[
\AxiomC{$v \colon \neg W$}
\AxiomC{IH}
\noLine
\UnaryInfC{$W^g \to W$}
\AxiomC{$u \colon W^g$}
\BinaryInfC{$W$}
\BinaryInfC{$\falsum$}
\DisplayProof
\]

\emph{Case} $I_1 \land I_2 \in \C{I}$.  We must show $\vdash I_1^g \land
I_2^g \to \neg \neg (I_1 \land I_2)$.  Take
\[
\AxiomC{IH}
\noLine
\UnaryInfC{$I_2^g \to \neg \neg I_2$}
\AxiomC{$I_1^g {\land} I_2^g$}
\UnaryInfC{$I_2^g$}
\BinaryInfC{$\neg \neg I_2$}
\AxiomC{IH}
\noLine
\UnaryInfC{$I_1^g \to \neg \neg I_1$}
\AxiomC{$I_1^g {\land} I_2^g$}
\UnaryInfC{$I_1^g$}
\BinaryInfC{$\neg \neg I_1$}
\AxiomC{$\neg (I_1 \land I_2)$}
\AxiomC{$I_1$}
\AxiomC{$I_2$}
\insertBetweenHyps{\hspace{.5em}}
\BinaryInfC{$I_1 \land I_2$}
\BinaryInfC{$\falsum$}
% \RightLabel{$\impI w_1$}
\UnaryInfC{$\neg I_1$}
\BinaryInfC{$\falsum$}
% \RightLabel{$\impI w_2$}
\UnaryInfC{$\neg I_2$}
\BinaryInfC{$\falsum$}
\DisplayProof
\]
This completes the proof.
\end{proof}

Notice that the G\"odel-Gentzen translation double negates every atom,
and hence may produce triple negations.  However, because of $\vdash
\neg \neg \neg A \leftrightarrow \neg A$ and the Equivalence Lemma we
can systematically replace triple negations by single negations.  As a
guide for the implementation, we carry out some of the details here.

Let $A^*$ (the \emph{reduced form} of $A$) be obtained from $A$ by
replacing $\neg \neg \neg A$ by $\neg A$ whenever possible.  So
\begin{alignat*}{2}
&\falsum^*       &&:= \falsum,
\\
&R \vec{t}^*     &&:= R \vec{t},
\\
&(A \land B)^*   &&:= A^* \land B^*,
\\
&(A \to B)^*     &&:= \begin{cases}
(\neg C)^* &\hbox{if $A \to B = \neg \neg \neg C$}\\
A^* \to B^*, &\hbox{otherwise}\end{cases}
\\
&(\forall x A)^* &&:= \forall x A^*.
\end{alignat*}

We simultaneously construct derivations of $A \to A^*$ and $A^* \to A$.

\begin{lemma*}
  \begin{enumeratea}
  \item  $\vdash A \to A^*$,
  \item  $\vdash A^* \to A$.
  \end{enumeratea}
\end{lemma*}

\begin{proof}
\emph{Case} $A$ prime formula.  Then $A^*$ is $A$, and we can take
$\lambda u^A u$.

\emph{Case} $\forall x A$.  (a).  We must show $\vdash
\forall x A \to \forall x A^*$.  Take
\[
\AxiomC{IH(a)}
\noLine
\UnaryInfC{$A \to A^*$}
\AxiomC{$u \colon \forall x A$}
\AxiomC{$x$}
\BinaryInfC{$A$}
\BinaryInfC{$A^*$}
\DisplayProof
\]
(b).  We must show $\vdash
\forall x A^* \to \forall x A$.  Take
\[
\AxiomC{IH(b)}
\noLine
\UnaryInfC{$A^* \to A$}
\AxiomC{$u \colon \forall x A^*$}
\AxiomC{$x$}
\BinaryInfC{$A^*$}
\BinaryInfC{$A$}
\DisplayProof
\]

\emph{Case} $\neg \neg \neg A$.  (a).  We must show
$\vdash \neg \neg \neg A \to (\neg A)^*$.
\[
\AxiomC{IH(a)}
\noLine
\UnaryInfC{$\neg A \to (\neg A)^*$}
\AxiomC{$u \colon \neg \neg \neg A$}
\AxiomC{$v \colon \neg A$}
\AxiomC{$w \colon A$}
\BinaryInfC{$\falsum$}
\RightLabel{$\impI v$}
\UnaryInfC{$\neg \neg A$}
\BinaryInfC{$\falsum$}
\RightLabel{$\impI w$}
\UnaryInfC{$\neg A$}
\BinaryInfC{$(\neg A)^*$}
\DisplayProof
\]
(b).  We must show $\vdash (\neg A)^* \to \neg \neg \neg A$.
\[
\AxiomC{$v \colon \neg \neg A$}
\AxiomC{IH(b)}
\noLine
\UnaryInfC{$(\neg A)^* \to \neg A$}
\AxiomC{$u \colon (\neg A)^*$}
\BinaryInfC{$\neg A$}
\BinaryInfC{$\falsum$}
\DisplayProof
\]

\emph{Case} $A \to B$ not of the form $\neg \neg \neg C$.  (a).  We
must show $\vdash (A \to B) \to A^* \to B^*$.
\[
\AxiomC{IH(a)}
\noLine
\UnaryInfC{$B \to B^*$}
\AxiomC{$u \colon A \to B$}
\AxiomC{IH(b)}
\noLine
\UnaryInfC{$A^* \to A$}
\AxiomC{$v \colon A^*$}
\BinaryInfC{$A$}
\BinaryInfC{$B$}
\BinaryInfC{$B^*$}
\DisplayProof
\]
(b).  We must show $\vdash (A^* \to B^*) \to A \to B$.
\[
\AxiomC{IH(b)}
\noLine
\UnaryInfC{$B^* \to B$}
\AxiomC{$u \colon A^* \to B^*$}
\AxiomC{IH(a)}
\noLine
\UnaryInfC{$A \to A^*$}
\AxiomC{$v \colon A$}
\BinaryInfC{$A^*$}
\BinaryInfC{$B^*$}
\BinaryInfC{$B$}
\DisplayProof
\]
\end{proof}


\section{Notes}
\mylabel{S:LogicNotes} The proof of Glivenko's theorem is taken form
Mints' book \cite{Mints00}.


% \include{alg}
% $Id: mlcf.tex,v 1.30 2008/01/25 13:30:18 logik Exp $
\chapter{Algebras}\mylabel{C:Alg}

A free algebra is given by \emph{constructors}, for instance zero and
successor for the natural numbers.  We want to treat other data types
as well, like lists and binary trees.  When dealing with inductively
defined sets, it will also be useful to explicitely refer to the
generation tree.  Such trees are quite often infinitely branching, and
hence we allow infinitary free algebras from the outset.

The freeness of the constructors is expressed by requiring that their
ranges are disjoint and that they are injective.  Moreover, we view
the free algebra as a domain and require that its bottom element is
not in the range of the constructors.  Hence the constructors are
total and non-strict.  For the notion of totality cf.\ \cite[Chapter
8.3]{Stoltenberg94}.

To make a free algebra into a domain and still have the constructors
injective and with disjoint ranges, we model e.g.\ the natural numbers
as shown in Figure~\ref{F:nat}.
\begin{figure}
% \begin{picture}(168,108)
\begin{picture}(170,120)
\put(48,0){\makebox(0,0){$\bullet$}}
\put(36,0){\makebox(0,0){$\bottom$}}
\put(48,0){\line(-1,1){24}}
\put(24,24){\makebox(0,0){$\bullet$}}
\put(12,24){\makebox(0,0){$0$}}
\put(48,0){\line(1,1){24}}
\put(72,24){\makebox(0,0){$\bullet$}}
\put(90,24){\makebox(0,0){$S \bottom$}}

\put(72,24){\line(-1,1){24}}
\put(48,48){\makebox(0,0){$\bullet$}}
\put(30,48){\makebox(0,0){$S 0$}}
\put(72,24){\line(1,1){24}}
\put(96,48){\makebox(0,0){$\bullet$}}
\put(120,48){\makebox(0,0){$S(S \bottom)$}}

\put(96,48){\line(-1,1){24}}
\put(72,72){\makebox(0,0){$\bullet$}}
\put(48,72){\makebox(0,0){$S(S 0)$}}
\put(96,48){\line(1,1){24}}
\put(120,72){\makebox(0,0){$\bullet$}}
\put(150,72){\makebox(0,0){$S(S(S \bottom))$}}

\put(120,72){\line(-1,1){24}}
\put(96,96){\makebox(0,0){$\bullet$}}
\put(66,96){\makebox(0,0){$S(S(S 0))$}}
\put(120,72){\line(1,1){24}}
\put(147,99){\makebox(0,0){.}}
\put(150,102){\makebox(0,0){.}}
\put(153,105){\makebox(0,0){.}}
\put(159,111){\makebox(0,0){$\bullet$}}
\put(181,111){\makebox(0,0){$\infty$}}
\end{picture}
\caption{The domain of natural numbers}
\label{F:nat}
\end{figure}
Notice that for more complex algebras we usually need many more
\inquotes{infinite} elements; this is a consequence of the closure of
domains under suprema.  To make dealing with such complex structures
less annoying, we will normally restrict attention to the \emph{total}
elements of a domain, in this case -- as expected -- the elements
labelled $0$, $S 0$, $S(S 0)$ etc.


\section{Examples of Finitary and Infinitary Algebras}
\mylabel{S:ExAlg}
We shall consider some examples of free algebras, generated from
constructors.  
\begin{enumerate}
\item The easiest example is the algebra $\typeUnit$\index{unit},
which has just one nullary constructor called
$\termUnit$\index{Dummy}.  It consists of exactly one element.
\item Almost as easy is the next example, the algebra
$\typeBool$\index{boole}, which has just two nullary constructors
called $\true$ and $\false$ (sometimes we use
\texttt{True}\index{True} and \texttt{False}\index{False} instead).
It consists of exactly two elements.
\item The next example is the simplest algebra with infinitely many
elements, the algebra $\typeN$\index{nat} of natural numbers.  Its
constructors are a nullary constructor $0$ (also written
\texttt{Zero}) and a unary constructor $\suc$ (also written
\texttt{Succ}).
\item We shall also allow parametrized algebras, depending on type
parameters.  The simplest example is the algebra $\typeL{\rho}$
(sometimes we use (\texttt{list $\rho$})\index{list} instead) of lists
of objects of a given type $\rho$.  Its constructors are a nullary
constructor $\nil$\index{Nil} and a binary constructor
$\cons$\index{Cons}; the latter takes an object $x$ of type $\rho$ and
a list $l$ and constructs out of these the new list obtained by
putting $x$ to the front of $l$.
\item Another important parametrized algebra is the disjoint union of
the algebras given by types $\rho_1$ and $\rho_2$.  It is called
($\rho_1$ \texttt{yplus} $\rho_2$)\index{yplus} (\inquotes{y} from
t\emph{y}pe), and is given by two unary constructors
$\termSumIntroLeft$\index{Inl} and $\termSumIntroRight$\index{Inr} of
types $\rho_1 \to \rho_1 + \rho_2$ and $\rho_2 \to \rho_1 + \rho_2$,
respectively.
\item We also admit simultaneously generated free algebras.  An
example is provided by the obvious way to simultaneously generate
trees and finite lists (of arbitrary length) of trees.  The algebra
$\tree$\index{tree} has one nullary constructor $\leaf$\index{Leaf}
(taking a natural number as parameter) and one unary constructor
$\branch$\index{Branch}, building a tree from a tree list.  The
algebra $\tlist$\index{tlist} has one nullary constructor
$\emp$\index{Empty} and one binary constructor $\tcons$\index{Tcons};
the latter takes an object $t$ of type $\tree$ and a tree list $l$ and
constructs out of these the new tree list obtained by putting $t$ to
the front of $l$.
\end{enumerate}
All these algebras are \emph{finitary}\index{algebra!finitary}, in the
sense that every constructor takes only finitely many arguments.  Then
for any two elements of the algebra we can decide whether they are
equal.  

When dealing with inductively defined sets, it will also be useful to
explicitely refer to the generation tree.  Such trees are quite often
countably branching, and hence we also allow
\emph{infinitary}\index{algebra!infinitary} free algebras from the
outset, whose constructors may take infinitely many arguments.  Notice
that then equality is \emph{not} decidable any more, and hence needs
to be axiomatized.  

For an example of an infinitary algebra, consider the countable
ordinals.  They can be seen as generated from a nullary constructor
$0$, a unary constructor for the successor and a constructor building
the supremum out of a countably infinite list of ordinals (given by a
function from the natural numbers to ordinals).

Clearly the generation process of the elements of a free algebra
allows \emph{recursive}\index{definition!recursive} definitions
of functions on such algebras.  For the examples above, they have
(when no parameters are present) the following form.
\begin{enumerate}
\item For the algebra $\typeUnit$ we may just define
\[
f(\termUnit) = a
\]
\item Similarly for the algebra $\typeBool$ we can explicitely
define
\begin{align*}
f(\true) &= a,
\\
f(\false) &= b.
\end{align*}
\item For the algebra $\typeN$ of natural numbers we obtain the
familiar recursion scheme
\begin{align*}
f(0) &= a,
\\
f(\suc(n)) &= h(n, f(n)).
\end{align*}
\item For the parametrized algebra $\typeL{\rho}$ we have a very
similar recursion scheme:
\begin{align*}
f(\nil) &= a,
\\
f(\cons(x,l)) &= h(x,l,f(l)).
\end{align*}
\item For the disjoint union of given types $\rho_1$ and $\rho_2$, the
  algebra does not require recursive calls, and hence the recursion
  scheme is simply
\begin{align*}
f(\termSumIntroLeft(x)) &= g(x),
\\
f(\termSumIntroRight(y)) &= h(y).
\end{align*}
\item Somewhat more interesting are simultaneously generated free
algebras.  Here we may define
\begin{align*}
f(\leaf(n)) &= h_1(n),
\\
f(\branch(l)) &= h_2(l,g(l)),
\\
g(\emp) &= b,
\\
g(\tcons(x,l)) &= h_3(x,l,f(x),g(l)).
\end{align*}
\end{enumerate}


\section{Recursion, Strong Normalization}\mylabel{S:Rec}
% Based on Normalization for simultaneous free algebras
% (by Holger Benl, Ulrich Berger and Helmut Schwichtenberg)
% in papers/temp00/n.tex
We give a predicative proof of strong normalization for terms with
recursion operators in a system of simultaneously defined free
algebras.  The proof uses a variant of the Tait's\index{Tait}
strong computability predicates.

It is well known that in a system of simultaneously defined free
algebras every term (possibly involving recursion operators) is
strongly normalizing.  However, the standard proof reduces the problem
to strong normalization of second order propositional logic (called
system $F$ by Girard \cite{Girard71}).  This latter result requires a
method not formalizable in analysis.  Here we give a much simpler
proof, which only uses predicative methods.

\subsection{Types}
\mylabel{SS:Types}
Our type system is defined by three type forming operations: arrow
types\index{arrow types} $\rho \to \sigma$, pair types\index{pair
types} $\rho \typeProd \sigma$ and the formation of inductively
generated types $\mu \vec{\alpha} \,\vec{\kappa}$, where $\vec{\alpha}
= (\alpha_j)_{j=1,\dots,N}$ is a list of distinct \inquotes{type
variables}, and $\vec{\kappa} = (\kappa_i)_{i=1,\dots,k}$ is a list of
\inquotes{constructor types}, whose argument types contain
$\alpha_1,\dots,\alpha_N$ in strictly positive positions only.

For instance, $\mu \alpha (\alpha, \alpha \to \alpha)$ is the type of
natural numbers; here the list $(\alpha, \alpha \to \alpha)$ stands
for two generation principles: $\alpha$ for \inquotes{there is a
  natural number} (the $0$), and $\alpha \to \alpha$ for \inquotes{for
  every natural number there is another one} (its successor).

Let an infinite supply of \emph{type variables} $\alpha, \beta$ be
given.

\begin{definition*}
Let $\vec{\alpha} = (\alpha_j)_{j=1,\dots,N}$ be a list of distinct
type variables.  \emph{Types} $\rho, \sigma, \tau, \mu \in
\types$ and \emph{constructor types} $\kappa \in
\constrtypes(\vec{\alpha})$ are defined inductively as follows.
\begin{align*}
&\frac{\vec{\rho}, \vec{\sigma}_1, \dots, \vec{\sigma}_n \in \types}
{\vec{\rho} \to (\vec{\sigma}_1 \to \alpha_{j_1}) \to \dots
\to (\vec{\sigma}_n \to \alpha_{j_n}) \to \alpha_j \in 
\constrtypes(\vec{\alpha})} \quad\hbox{($n \ge 0$)}
\\
&\frac{\kappa_1, \dots, \kappa_n \in \constrtypes(\vec{\alpha})}
{(\mu \vec{\alpha} \,(\kappa_1, \dots, \kappa_n))_j \in \types} 
\quad\hbox{($n \ge 1$)}
\qquad
\frac{\rho, \sigma \in \types}{\rho \to \sigma \in \types}
\qquad
\frac{\rho, \sigma \in \types}{\rho \typeProd \sigma \in \types}
\end{align*}
\end{definition*}

Here $\vec{\rho}$ is short for a list $\rho_1,\dots,\rho_m$
($m\ge 0$) of types and $\vec{\rho} \to \sigma$ means $\rho_1 \to
\dots \to \rho_m \to \sigma$, associated to the right.  We shall use
$\mu$ for types of the form $(\mu \vec{\alpha} \,(\kappa_1, \dots,
\kappa_k))_j$ only, and for types $\vec{\tau}$ and a constructor type
$\kappa = \vec{\rho} \to (\vec{\sigma}_1 \to \alpha_{j_1}) \to \dots \to
(\vec{\sigma}_n \to \alpha_{j_n}) \to \alpha_j \in
\constrtypes(\vec{\alpha})$ let 
\[
\kappa[\vec{\tau}] :=
\vec{\rho} \to (\vec{\sigma}_1 \to \tau_{j_1}) \to \dots \to
(\vec{\sigma}_n \to \tau_{j_n}) \to \tau_j.
\]

\begin{examples*}
\begin{alignat*}{2}
&\typeUnit &&:= \mu \alpha\,\alpha,
\\
&\typeBool &&:= \mu \alpha\,(\alpha,\alpha),
\\
&\typeN &&:= \mu \alpha\,(\alpha,\alpha \to \alpha),
\\
&\typeL{\rho} &&:= \mu \alpha\,(\alpha,\rho \to \alpha \to \alpha),
\\
&\rho_1 + \rho_2 &&:= \mu \alpha\,(\rho_1 \to \alpha, \rho_2 \to \alpha),
\\
&(\tree, \tlist) &&:= \mu (\alpha, \beta)\,
(\typeN \to \alpha, \beta \to \alpha, \beta, \alpha \to \beta \to \beta),
\\
&\typeBin &&:= \mu \alpha\,(\alpha, \alpha \to \alpha \to \alpha),
\\
&\C{O} &&:= \mu \alpha\,
(\alpha, \alpha \to \alpha, (\typeN \to \alpha) \to \alpha),
\\
&\C{T}_0 &&:= \typeN,
\\
&\C{T}_{n+1} &&:= \mu \alpha\,(\alpha, (\C{T}_n \to \alpha) \to \alpha).
\end{alignat*}

Notice that there are many equivalent ways to define these types.  For
instance, we could take $\typeUnit \typeSum \typeUnit$ to be the type
of booleans, and $\typeL{\typeUnit}$ to be the type of natural
numbers.

Notice also that we have added the pair type $\rho \typeProd \sigma$
for simplicity only.  Products could have been defined in two forms,
as tensor products and as cartesian products, by
\begin{alignat*}{2}
&\rho_1 \typeTensor \rho_2 &&:= \mu \alpha. \rho_1 \to \rho_2 \to \alpha,
\\
&\rho_1 \times_\sigma \rho_2 &&:= 
\mu \alpha.  (\sigma \to \rho_1) \to (\sigma \to \rho_2) \to \sigma \to \alpha,
\end{alignat*}
If we would allow ourselves to quantify over types, the
cartesian product could be defined as
\[
\rho_1 \times \rho_2 := \mu \alpha \forall \sigma.
(\sigma \to \rho_1) \to (\sigma \to \rho_2) \to \sigma \to \alpha.
\]
\end{examples*}

\subsection{Terms}
\mylabel{SS:Terms}
The inductive structure of the types $\vec{\mu} =
\mu \vec{\alpha}\,\vec{\kappa}$ corresponds to two sorts of constants.
With the \emph{constructors} $\constr_i^{\vec{\mu}} \colon
\kappa_i[\vec{\mu}]$ we can construct elements of a type $\mu_j$, and
with the \emph{recursion operators} $\rec_{\mu_j}^{\vec{\mu}, \vec{\tau}}$
we can construct mappings from $\mu_j$ to $\tau_j$ by recursion on the
structure of $\vec{\mu}$.  In order to define the type of the
recursion operators w.r.t.\ $\vec{\mu} = \mu\vec{\alpha} \,
\vec{\kappa}$ and result types $\vec{\tau}$, we first define for
\[
\kappa_i = \vec{\rho} \to (\vec{\sigma}_1 \to \alpha_{j_1}) \to \dots \to
(\vec{\sigma}_n \to \alpha_{j_n}) \to \alpha_j \in
\constrtypes(\vec{\alpha})
\]
the \emph{step type}
\begin{align*}
\ST_i^{\vec{\mu}, \vec{\tau}} := \vec{\rho} \to {}
&(\vec{\sigma}_1 \to \mu_{j_1}) \to \dots \to
(\vec{\sigma}_n \to \mu_{j_n}) \to 
\\
&(\vec{\sigma}_1 \to \tau_{j_1}) \to \dots \to
(\vec{\sigma}_n \to \tau_{j_n}) \to \tau_j.
\end{align*}
Here $\vec{\rho}, (\vec{\sigma}_1 \to \mu_{j_1}), \dots,
(\vec{\sigma}_n \to \mu_{j_n})$ correspond to the \emph{components}
% (or \emph{parameters}) 
of the object of type $\mu_j$ under consideration, and
$(\vec{\sigma}_1 \to \tau_{j_1}), \dots, (\vec{\sigma}_n \to
\tau_{j_n})$ to the previously defined values.  The recursion operator
$\rec_{\mu_j}^{\vec{\mu}, \vec{\tau}}$ has type
\[
\rec_{\mu_j}^{\vec{\mu}, \vec{\tau}} \colon
\ST_1^{\vec{\mu}, \vec{\tau}} \to \dots \to \ST_k^{\vec{\mu}, \vec{\tau}}
\to \mu_j \to \tau_j
\]
(recall that $k$ is the total number of constructors for all types
$\mu_1, \dots, \mu_N$).

We will often write $\rec_j^{\vec{\mu}, \vec{\tau}}$ for
$\rec_{\mu_j}^{\vec{\mu}, \vec{\tau}}$, and omit the upper indices
$\vec{\mu}, \vec{\tau}$ when they are clear from the context.  In case
of a non-simultaneous free algebra, i.e.\ of type $\mu
\alpha\,\kappa$, for $\rec_\mu^{\mu, \tau}$ we normally write
$\rec_\mu^\tau$.

\begin{definition*}
  \emph{Terms}\index{term} are inductively defined from typed
  variables and the constants $\constr_i^{\vec{\mu}}$ and
  $\rec_{\mu_j}^{\vec{\mu}, \vec{\tau}}$ by means of
\begin{itemize}
\item \indexentry{abstraction} $(\lambda x^\rho M^\sigma)^{\rho \to
    \sigma}$,
\item \indexentry{application} $(M^{\rho \to \sigma}N^\rho)^\sigma$,
\item \indexentry{pairing} 
$\pair{M^{\rho}}{N^{\sigma}}^{\rho \typeProd \sigma}$ and
\item \indexentry{projections} $(M^{\rho \typeProd \sigma}0)^\rho$,
  $(M^{\rho \typeProd \sigma}1)^\sigma$.
\end{itemize}
\end{definition*}

\begin{examples*}
\begin{alignat*}{2}
&\true^{\typeBool} := \constr_1^{\typeBool},\quad 
\false^{\typeBool} := \constr_2^{\typeBool},
\\
&\rec_{\typeBool}^\tau \colon \tau \to \tau \to \typeBool \to \tau,
\\[6pt]
&0^{\typeN} := \constr_1^{\typeN},\quad
\suc^{\typeN \to \typeN} := \constr_2^{\typeN},
\\
&\rec_{\typeN}^\tau \colon 
\tau \to (\typeN \to \tau \to \tau) \to \typeN \to \tau,
\\[6pt]
&\nil^{\typeL{\alpha}} := \constr_1^{\typeL{\alpha}},\quad
\cons^{\alpha \to \typeL{\alpha} \to \typeL{\alpha}} := 
\constr_2^{\typeL{\alpha}},
\\
&\rec_{\typeL{\alpha}}^\tau \colon \tau \to 
(\alpha \to \typeL{\alpha} \to \tau \to \tau) \to \typeL{\alpha} \to \tau,
\\[6pt]
&\bigl(\termSumIntroLeft_{{\rho_1}{\rho_2}} \bigr)^
{\rho_1 \to \rho_1 \typeSum \rho_2} := 
\constr_1^{\rho_1 \typeSum \rho_2},
\\
&\bigl(\termSumIntroRight_{{\rho_1}{\rho_2}} \bigr)^
{\rho_2 \to \rho_1 \typeSum \rho_2} := 
\constr_2^{\rho_1 \typeSum \rho_2},
\\
&\rec_{\rho_1 \typeSum \rho_2}^\tau \colon 
(\rho_1 \to \tau) \to (\rho_2 \to \tau) \to \rho_1 \typeSum \rho_2 \to \tau.
\end{alignat*}
\end{examples*}

\begin{remark*}
Notice that for the defined products the constructors and recursion
operators are
\begin{alignat*}{2}
&\bigl(\termTensorIntro_{\rho_1 \rho_2} \bigr)^
{\rho_1 \to \rho_2 \to \rho_1 \typeTensor \rho_2} :=
\constr_1^{\rho_1 \typeTensor \rho_2},
\\
&\rec_{\rho_1 {\typeTensor} \rho_2}^{\tau} \colon (\rho_1 \to \rho_2 \to
\tau) \to \rho_1 {\typeTensor} \rho_2 \to \tau,
\\[6pt]
&\bigl(\termProdIntro_{{\rho_1}{\rho_2}{\sigma}} \bigr)^
{(\sigma \to \rho_1) \to 
(\sigma \to \rho_2) \to 
\sigma \to \rho_1 \typeProd_\sigma \rho_2} := 
\constr_1^{\rho_1 \typeProd_\sigma \rho_2},
\\
&\rec_{\rho_1 \typeProd_\sigma \rho_2}^{\tau} \colon ((\sigma \to \rho_1) \to 
(\sigma \to \rho_2) \to \sigma \to \tau) \to
\rho_1 \typeProd_\sigma \rho_2 \to \tau,
\end{alignat*}
\end{remark*}

\begin{examples*}
The \indexentry{append}-function
$\listappend$ for lists is defined recursively by
\begin{align*}
\nil \listappend l_2 &:= l_2,
\\
(\cons\, x\, l_1) \listappend l_2 &:= \cons\, x (l_1 \listappend l_2).
\end{align*}
It can be defined as the term
\[
M_{\listappend} := \rec_{\typeL{\alpha}}^{\typeL{\alpha} \to \typeL{\alpha}}
(\lambda l_2 l_2)
(\lambda x \lambda l_1 \lambda p \lambda l_2. \cons\, x (p l_2).
\]

Using the append function $\listappend$ we can define \indexentry{list
reversal} $\listrev$ by
\begin{align*}
\listrev\;\nil &:= \nil,
\\
\listrev (\cons\, x\, l) &= (\listrev\; l) \listappend (\cons\, x \nil).
\end{align*}
It can be defined as the term
\[
\rec_{\typeL{\alpha}}^{\typeL{\alpha}}
\nil
(\lambda x \lambda l \lambda p. M_{\listappend}\,p\,(\cons\, x \nil)).
\]

Assume we want to define by simultaneous recursion two functions on
$\typeN$, say $\Even, \odd \colon \typeN \to \typeBool$.  We want
\begin{align*}
\Even(0) &:= \true
&
\odd(0) &:= \false
\\
\Even(\suc\, n) &:= \odd(n)
&
\odd(\suc\, n) &:= \Even(n)
\end{align*}
This can be achieved by using pair types: we recursively
define the single function $\Evenodd \colon \typeN \to \typeBool
\typeProd \typeBool$.  The step types are
\begin{align*}
\ST_1 &= \typeBool \typeProd \typeBool,
\\
\ST_2 &= \typeN \to \typeBool \typeProd \typeBool \to 
\typeBool \typeProd \typeBool,
\end{align*}
and we can define $\Evenodd := \rec_{\typeN}^{\typeBool \typeProd
\typeBool} \pair{\false}{\true}(\lambda n \lambda p. \pair{p 1}{p 0})$.

Our final example concerns the simultaneously defined free algebras
$\tree$ and $\tlist$, whose constructors $\constr_i^{(\tree, \tlist)}$
for $i \in \{1,\dots, 4\}$ are
\[
\leaf^{\typeN \to \tree},
\branch^{\tlist \to \tree},
\emp^{\tlist},
\tcons^{\tree \to \tlist \to \tlist}.
\]
Observe that the elements of the algebra $\tree$ are just the finitely
branching trees, which carry natural numbers on their leaves.

Let us compute the types of the recursion operators w.r.t.\ the result
types $\tau_1, \tau_2$, i.e.\ of $\rec_{\tree}^{(\tree,\tlist),
(\tau_1,\tau_2)}$ and $\rec_{\tlist}^{(\tree,\tlist),
(\tau_1,\tau_2)}$, or shortly $\rec_{\tree}$ and $\rec_{\tlist}$.  The
step types are
\begin{align*}
\ST_1 &:= \typeN \to \tau_1,
\\
\ST_2 &:= \tlist \to \tau_2 \to \tau_1,
\\
\ST_3 &:= \tau_2,
\\
\ST_4 &:= \tree \to \tlist \to \tau_1 \to \tau_2 \to \tau_2.
\end{align*}
Hence the types of the recursion operators are
\begin{align*}
\rec_{\tree} &\colon
\ST_1 \to \ST_2 \to \ST_3 \to \ST_4 \to \tree \to \tau_1,
\\
\rec_{\tlist} &\colon
\ST_1 \to \ST_2 \to \ST_3 \to \ST_4 \to \tlist \to \tau_2.
\end{align*}

To see a concrete example, let us recursively define addition $+
\colon \tree \to \tree \to \tree$ and $\oplus \colon \tlist \to \tree
\to \tlist$.  The recursion equations to be satisfied are
\begin{alignat*}{2}
&+(\leaf\, n) &&= \lambda a a,
\\
&+(\branch\,\bs) &&= \lambda a. \branch(\oplus\,\bs\,a),
\\[6pt]
&\oplus\,\emp &&= \lambda a\,\emp,
\\
&\oplus(\tcons\,b\,\bs) &&= \lambda a. \tcons(+\,b\,a)(\oplus\,\bs\,a).
\end{alignat*}
We define $+$ and $\oplus$ by means of the recursion operators
$\rec_{\tree}$ and $\rec_{\tlist}$ with result types
\begin{align*}
\tau_1 &:= \tree \to \tree,
\\
\tau_2 &:= \tree \to \tlist.
\end{align*}
The step terms are
\begin{align*}
M_1 &:= \lambda n \lambda a a,
\\
M_2 &:= \lambda \bs \lambda g^{\tau_2} \lambda a. \branch(g\,a),
\\
M_3 &:= \lambda a\,\emp,
\\
M_4 &:= \lambda b \lambda \bs \lambda f^{\tau_1} \lambda g^{\tau_2} \lambda a.
\tcons(f\,a)(g\,a).
\end{align*}
Then
\begin{align*}
+ &:= \rec_{\tree} \vec{M} \colon 
\tree \to \tree \to \tree,
\\
\oplus &:= \rec_{\tlist} \vec{M} \colon 
\tlist \to \tree \to \tlist.
\end{align*}
\end{examples*}

\begin{remark}\mylabel{R:simpRec} 
It may happen that in a recursion on simultaneously defined algebras
one only needs to recur on some of those algebras.  Then we can
simplify the type of the recursion operator accordingly, by
\begin{itemize}
\item omitting all step types $\ST_i^{\vec{\mu}, \vec{\tau}}$ with
irrelevant value type $\tau_j$, and
\item simplifying the remaining step types by omitting from the types
$(\vec{\sigma}_1 \to \tau_{j_1}), \dots, (\vec{\sigma}_n \to
\tau_{j_n})$ of previously defined values all those with irrelevant
$\tau_{j_{\nu}}$.
\end{itemize}
In the $\tree,\tlist$-example, if we only want to recur on $\tlist$,
then the step types are
\begin{align*}
\ST_3 &:= \tau_2,
\\
\ST_4 &:= \tree \to \tlist \to \tau_2 \to \tau_2.
\end{align*}
Hence the type of the simplified recursion operator is
\begin{align*}
\rec_{\tlist} &\colon
\ST_3 \to \ST_4 \to \tlist \to \tau_2.
\end{align*}
An example is the recursive definition of the length of a $\tlist$.  The
recursion equations are
\begin{alignat*}{2}
&\len{\emp} &&= 0,
\\
&\len{\tcons\,b\,\bs} &&= \len{\bs} + 1.
\end{alignat*}
The step terms are
\begin{align*}
M_3 &:= \emp,
\\
M_4 &:= \lambda b \lambda \bs \lambda p. p+1.
\end{align*}
\end{remark}

\begin{remark}\mylabel{R:Cases}
There is an important variant of recursion, where no recursive calls
occur.  This variant is called the \indexentry{cases
operator}\index{cases-operator@$\Cases$-operator}; it distinguishes
cases according to the outer constructor form.  Here all step types
have the form
\[
\ST_i^{\vec{\mu}, \vec{\tau}} := \vec{\rho} \to 
(\vec{\sigma}_1 \to \mu_{j_1}) \to \dots \to
(\vec{\sigma}_n \to \mu_{j_n}) \to \tau_j.
\]
The intended meaning of the cases operator is given by the conversion
rule (cf.\ \eqref{recconv} below)
\[
(\Cases_j \vec{M})^{\mu_j \to \tau_j}
(\constr_i^{\vec{\mu}} \vec{N}) \cnv M_i \vec{N}.
\]
Notice that only those step terms are used whose value type is the
present $\tau_j$; this is due to the fact that there are no recursive
calls.  Therefore the type of the cases operator is
\[
\Cases_{\mu_j \to \tau_j}^{\vec{\mu}} \colon 
\ST_{i_1} \to \dots \to \ST_{i_q} \to \mu_j \to \tau_j, 
\]
where $\ST_{i_1}, \dots, \ST_{i_q}$ consists of all $\ST_i$ with value
type $\tau_j$.  We write $\Cases_{\mu_j \to \tau_j}$ or even
$\Cases_{j}$ for $\Cases_{\mu_j \to \tau_j}^{\vec{\mu}}$.

The simplest example (for the type $\typeBool$) is
\indexentry{if-then-else}.  Another example is the predecessor
function on $\typeN$, i.e.\ $\pred(0) := 0$, $\pred(\suc(n)) := n$.
It can formally be defined by the term
\[
\Cases_{\typeN \to \typeN}0 (\lambda n n).
\]

In the $\tree, \tlist$-example we have
\begin{align*}
\Cases_{\tlist \to \tau_2} \colon 
\tau_2 \to (\tree \to \tlist \to \tau_2) \to \tlist \to \tau_2.
\end{align*}
\end{remark}

\begin{remark}\mylabel{R:If}
When computing the value of a cases operator, we may not want to
(eagerly) evaluate all arguments, but rather evaluate the test
argument first and depending on the result (lazily) evaluate at most
one of the other arguments.  This phenomenon is well known in
functional languages; e.g.\ in \textsc{Scheme} the
\texttt{if}-construct is called a \indexentry{special form} (as
opposed to an operator).  Therefore we also provide an
\texttt{if}-construct\index{if-construct@\texttt{if}-construct} to
build terms, which differs from the cases operator only in
that it employs lazy evaluation.  The predecessor function could then
be written in the form $\lambda m [\texttt{if} \ m\ 0\ \lambda n n]$.
\end{remark}


\subsection{Conversion Relation}
\mylabel{SS:Conv3}
It will be useful to employ the following notation.  Let
$\vec{\mu} = \mu \vec{\alpha} \,\vec{\kappa}$ and
\[
\kappa_i = \rho_1 \to \dots \to \rho_m \to 
(\vec{\sigma}_1 \to \alpha_{j_1}) \to \dots \to
(\vec{\sigma}_n \to \alpha_{j_n}) \to \alpha_j \in
\constrtypes(\vec{\alpha}),
\]
and consider $\constr_i^{\vec{\mu}} \vec{N}$.  Then we write
$\vec{N}^P = N_1^P, \dots, N_m^P$ for the \emph{parameter arguments}
$N_1^{\rho_1}, \dots, N_m^{\rho_m}$ and $\vec{N}^R = N_1^R, \dots,
N_n^R$ for the \emph{recursive arguments} $N_{m+1}^{\vec{\sigma}_1 \to
\mu_{j_1}}, \dots, N_{m+n}^{\vec{\sigma}_n \to \mu_{j_n}}$, and
$n^R$ for the number $n$ of recursive arguments.

We define a \indexentry{conversion relation} $\cnv_\rho$ between terms
of type $\rho$ by
\begin{align}
(\lambda xM)N &\cnv \subst{M}{x}{N}\label{betaconv}
\\
\pair{M_0}{M_1}i &\cnv Mi \quad \hbox{($i=0,1$)}\label{pairbetaconv}
\\
\lambda x.Mx &\cnv M \quad\hbox{if $x \notin \FV(M)$
($M$ not an abstraction)}\label{etaconv}
\\
\pair{M 0}{M 1}&\cnv M \quad\hbox{($M$ not a pair)}\label{pairetaconv}
\\
(\rec_j \vec{M})^{\mu_j \to \tau_j}
(\constr_i^{\vec{\mu}} \vec{N}) &\cnv
M_i \vec{N}
\bigl( (\rec_{j_1} \vec{M}) \circ N_1^R\bigr) \dots
\bigl( (\rec_{j_n} \vec{M}) \circ N_n^R\bigr)
\label{recconv}
\end{align}
Here we have written $\rec_j$ for
$\rec_{\mu_j}^{\vec{\mu}, \vec{\tau}}$.

The \emph{one step reduction relation} $\red$ can now be defined as
follows.  $M \red N$ if $N$ is obtained from $M$ by replacing a
subterm $M'$ in $M$ by $N'$, where $M' \cnv N'$.  The reduction
relations $\redplus$ and $\redstar$ are the transitive and the reflexive
transitive closure of $\red$, respectively.  For $\vec{M} =
M_1,\dots,M_n$ we write $\vec{M} \red \vec{M'}$ if $M_i \red M'_i$
for some $i \in \{1,\dots,n\}$ and $M_j = M'_j$ for all $i \ne j \in
\{1,\dots,n\}$.  A term $M$ is \emph{normal} (or in \emph{normal form}) 
if there is no term $N$ such that $M \red N$.

Clearly normal closed terms are of the form $\constr_i^{\vec{\mu}}
\vec{N}$.

\begin{example*}
Let us check the conversion rules for the defined $+$ and $\oplus$
of our example above.  We have
\begin{align*}
&+(\leaf\, n) = \rec_{\tree} \vec{M}(\leaf\, n) \cnv M_1 n \cnv 
\lambda a a,
\\
&\oplus\,\emp = \rec_{\tlist} \vec{M} \,\emp \cnv M_3 = 
\lambda a\,\emp
\end{align*}
and
\begin{align*}
+(\branch\,\bs) &= \rec_{\tree} \vec{M}(\branch\,\bs)
\\
&\cnv M_2 \,\bs\,\bigl( (\rec_{\tlist} \vec{M}) \circ \bs\bigr)
\\
&= M_2 \,\bs\,( \oplus\,\bs)
\\
&\red \lambda a. \branch(\oplus\,\bs\,a),\\[6pt]
\oplus(\tcons\,b\,\bs) &= \rec_{\tlist} \vec{M}(\tcons\,b\,\bs)
\\
&\cnv M_4\,b\,\bs\,\bigl( (\rec_{\tree} \vec{M}) \circ b\bigr)
\bigl( (\rec_{\tlist} \vec{M}) \circ \bs\bigr)
\\
&= M_4\,b\,\bs\,(+\,b)(\oplus\,\bs)
\\
&\red \lambda a. \tcons(+\,b\,a)(\oplus\,\bs\,a).
\end{align*}
\end{example*}


\subsection{Strong Computability Predicates}
\mylabel{SS:SC}
\begin{definition*}
The set $\SN$ of \emph{strongly normalizable} terms
is inductively defined by
\begin{equation}
\label{sndef}
(\forall N. M \red N \imp N \in \SN) \imp M \in \SN
\end{equation}
\end{definition*}
Note that with $M$ clearly every subterm of $M$ is strongly normalizable.

\begin{definition*}
We define \emph{strong computability predicates}\index{strong
computability} $\SC^\rho$\index{SC@$\SC$} by induction on $\rho$.

\emph{Case} $\mu_j = (\mu \vec{\alpha}\,\vec{\kappa})_j$.  Then $M
\in \SC^{\mu_j}$ if
\begin{align}
&\forall N.M \red N \imp N \in \SC,\ \hbox{and}\label{sc1}
\\
&M = \constr_i^{\vec{\mu}} \vec{N} \imp \vec{N}^P \in \SC \land
\bigland_{p=1}^{n^R}(\forall \vec{K} {\in} \SC)\, N_p^R \vec{K} \in
\SC^{\mu_{j_p}}.
\label{sc2}
\end{align}

\emph{Case} $\rho \to \sigma$.
\[
M \in \SC^{\rho \to \sigma} \defiff 
(\forall N{\in} \SC^\rho)\, MN \in \SC^\sigma.
\]

\emph{Case} $\rho \typeProd \sigma$.
\[
M \in \SC^{\rho \typeProd \sigma} \defiff 
\hbox{$M0 \in \SC^\rho$ and $M1 \in \SC^\sigma$.}
\]
\end{definition*}
Notice that the reference to $\vec{N}^P \in \SC$ and $\vec{K} {\in}
\SC$ in \eqref{sc2} is legal, because the types $\vec{\rho},
\vec{\sigma}_i$ of $\vec{N}, \vec{K}$ must have been generated
\emph{before} $\mu_j$.  Note also that by \eqref{sc2}
$\constr_i^{\vec{\mu}} \vec{N} \in \SC$ implies $\vec{N} \in \SC$.

We now set up a sequence of lemmas leading to a proof that every term
is strongly normalizing.  In the proofs we disregard the product case,
since it can be treated routinely.

\begin{lemma}
\mylabel{L:onestep}
If $M \in \SC^\rho$ and $M \red M'$, then $M' \in \SC$.
\end{lemma}

\begin{proof}
Induction on $\rho$.  \emph{Case} $\mu$.  By \eqref{sc1}.  \emph{Case}
$\rho \to \sigma$.  Assume $M \in \SC^{\rho \to \sigma}$ and $M \red
M'$; we must show $M' \in \SC$.  So let $N \in \SC^\rho$; we must show
$M'N \in \SC^\sigma$.  But this follows from $MN \red M'N$ and $MN
\in \SC^\rho$ by induction hypothesis (IH) on $\sigma$.
\end{proof}

\begin{lemma}
\mylabel{L:var}
$(\forall \vec{M}{\in} \SN). \vec{M} \in \SC \imp (x \vec{M})^\mu \in \SC$.
\end{lemma}

\begin{proof}
Induction on $\vec{M} \in \SN$.  Assume $\vec{M} \in \SN$ and $\vec{M}
\in \SC$; we must show $(x \vec{M})^\mu \in \SC$.  So assume $x\vec{M}
\red N$; we must show $N \in \SC$.  Now by the form of the
conversion rules $N$ must be of the form $x\vec{M'}$ with $\vec{M}
\red \vec{M'}$.  But $\vec{M'} \in \SC$ by Lemma~\ref{L:onestep},
hence $x\vec{M'} \in \SC$ by IH for $\vec{M'}$.
\end{proof}

\begin{lemma}\mylabel{L:sc}
\begin{enumeratea}
\item $\SC^\rho \subseteq \SN$, \label{L:sc:a}
\item $x \in \SC^\rho$. \label{L:sc:b}
\end{enumeratea}
\end{lemma}

\begin{proof}
By simultaneous induction on $\rho$.  \emph{Case} $\mu_j = (\mu
\vec{\alpha}\,\vec{\kappa})_j$.  \eqref{L:sc:a}.  We show $M \in
\SC^{\mu_j} \imp M \in \SN$ by (side) induction on $M \in
\SC^{\mu_j}$.  So assume $M \in \SC^{\mu_j}$; we must show $M \in
\SN$.  But for every $N$ with $M \red N$ we have $N \in \SC$ by
\eqref{sc1}, hence $N \in \SN$ by the side induction hypothesis SIH.
\eqref{L:sc:b}.  $x \in \SC^{\mu_j}$ holds trivially.

\emph{Case} $\rho \to \sigma$.  \eqref{L:sc:a}.  Assume $M \in
\SC^{\rho \to \sigma}$; we must show $M \in \SN$.  By IH\eqref{L:sc:b}
for $\rho$ we have $x \in \SC^\rho$, hence $Mx \in \SC^\sigma$, hence
$Mx \in \SN$ by IH\eqref{L:sc:a} for $\sigma$.  But $Mx \in \SN$
clearly implies $M \in \SN$.  \eqref{L:sc:b}.  Let $\vec{M} \in
\SC^{\vec{\rho}}$ with $\rho_1 = \rho$; we must show $x \vec{M} \in
\SC^\mu$.  But this follows from Lemma~\ref{L:var}, using
IH\eqref{L:sc:a} for $\vec{\rho}$.
\end{proof}

\begin{corollary}
\mylabel{C:scconstr}
$\vec{N} \in \SC \imp \constr_i^{\vec{\mu}} \vec{N} \in \SC$,
i.e.\ $\constr_i^{\vec{\mu}} \in \SC$.
\end{corollary}

\begin{proof}
First show $(\forall \vec{N} {\in} \SN). \vec{N} \in \SC \imp
\constr_i^{\vec{\mu}} \vec{N} \in \SC$ by induction on $\vec{N} \in
\SN$ as in Lemma~\ref{L:var}, and then use Lemma~\ref{L:sc}\eqref{L:sc:a}.
\end{proof}

\begin{lemma}
\mylabel{L:scheadmu}
\begin{align*}
&(\forall M,N,\vec{N} {\in} \SN). \subst{M}{x}{N} \vec{N} \in \SC^\mu
\imp (\lambda x M)N \vec{N} \in \SC^\mu.
\\
&(\forall M_0,M_1,\vec{N} {\in} \SN). M_0 \vec{N}, M_1 \vec{N} \in \SC^\mu
\imp \pair{M_0}{M_1}i \vec{N} \in \SC^\mu.
\end{align*}
\end{lemma}

\begin{proof}
By induction on $M,N,\vec{N} \in \SN$.  Let $M,N,\vec{N} \in \SN$ and
assume $\subst{M}{x}{N} \vec{N} \in \SC$; we must show $(\lambda x
M)N \vec{N} \in \SC$.  Assume $(\lambda x M)N \vec{N} \red K$; we must
show $K \in \SC$.  \emph{Case} $K = (\lambda x M')N'\vec{N'}$ with $M,
N, \vec{N} \red M', N', \vec{N'}$.  Then $\subst{M}{x}{N} \vec{N}
\redstar \subst{M'}{x}{N'} \vec{N'}$, hence by \eqref{sc1} from our
assumption $\subst{M}{x}{N} \vec{N} \in \SC$ we can infer
$\subst{M'}{x}{N'} \vec{N'} \in \SC$, therefore $(\lambda x
M')N'\vec{N'} \in \SC$ by IH.  \emph{Case} $K=\subst{M}{x}{N} \vec{N}$.
Then $K \in \SC$ by assumption.
\end{proof}

\begin{corollary}
\mylabel{C:schead} 
\begin{align*}
&(\forall M,N,\vec{N} {\in} \SN). \subst{M}{x}{N} \vec{N} \in \SC^\rho
\imp (\lambda x M)N \vec{N} \in \SC^\rho.
\\
&(\forall M_0,M_1,\vec{N} {\in} \SN). M_0 \vec{N}, M_1 \vec{N} \in \SC^\rho
\imp \pair{M_0}{M_1}i \vec{N} \in \SC^\rho.
\end{align*}
\end{corollary}

\begin{proof}
By induction on $\rho$, using Lemma~\ref{L:sc}\eqref{L:sc:a}.
\end{proof}

\begin{lemma}
\mylabel{L:screc} $(\forall N {\in} \SC^{\mu_j}) (\forall
\vec{M},\vec{L} {\in} \SN). \vec{M},\vec{L} \in \SC \imp
\rec_{j} \vec{M}N \vec{L} \in \SC^\mu$.
\end{lemma}

\begin{proof}
By main induction on $N \in \SC^{\mu_j}$, and side induction on
$\vec{M},\vec{L} \in \SN$.  Assume
\[
\rec_{j} \vec{M}N \vec{L} \red L.
\]
We must show $L \in \SC$.

\emph{Case} 1.  $\rec_{j} \vec{M'}N \vec{L'} \in
\SC$ by the SIH.

\emph{Case} 2.  $\rec_{j} \vec{M}N'\vec{L} \in
\SC$ by the main induction hypothesis (IH).

\emph{Case} 3.  $N = \constr_i^{\vec{\mu}} \vec{N}$ and
\[
L = M_i \vec{N}
\bigl( (\rec_{j} \vec{M}) \circ N_1^R\bigr) \dots
\bigl( (\rec_{j} \vec{M}) \circ N_n^R\bigr) \vec{L}.
\]
$\vec{M},\vec{L} \in \SC$ by assumption.  $\vec{N} \in \SC$ follows
from $N = \constr_i^{\vec{\mu}} \vec{N} \in \SC$ by \eqref{sc2}.  Note
that for all recursive arguments $N_p^R$ of $N$ and all strongly
computable $\vec{K}$ by \eqref{sc2} we have the IH for $N_p^R
\vec{K}$ available.  It remains to show $(\rec_{j} \vec{M}) \circ
N_p^R = \lambda \vec{x}_p. \rec_{j} \vec{M} (N_p^R \vec{x}_p) \in
\SC$.  So let $\vec{K}, \vec{Q} \in \SC$ be given.  We must show
$(\lambda \vec{x}_p. \rec_{j} \vec{M} (N_p^R \vec{x}_p))
\vec{K} \vec{Q} \in \SC$.  By IH for $N_p^R \vec{K}$ we have
$\rec_{j} \vec{M}(N_p^R \vec{K}) \vec{Q} \in \SC$, since by
Lemma~\ref{L:sc}\eqref{L:sc:a} $\vec{K}, \vec{Q} \in \SN$.  Now Corollary~\ref{C:schead}
yields the claim.
\end{proof}

\begin{corollary}
\mylabel{C:screccor}
$\rec_{j} \in \SC$.\qed
\end{corollary}

\begin{definition*}
A substitution $\xi$ is \emph{strongly computable}, if $\xi(x) \in
\SC$ for all variables $x$.  A term $M$ is \emph{strongly computable under
substitution}, if $M \xi \in \SC$ for all strongly computable
substitutions $\xi$.
\end{definition*}

\begin{theorem}
Every term is strongly computable under substitution.
\end{theorem}

\begin{proof}
Induction on the term $M$.  \emph{Case} $x$.  $x\xi \in \SC$, since
$\xi$ is strongly computable.  \emph{Case} $\constr_i^{\vec{\mu}}$.
By Corollary~\ref{C:scconstr}.  \emph{Case} $\rec_{j}$.  By
Corollary~\ref{C:screccor}.  \emph{Case} $MN$.  By IH $M \xi, N \xi \in
\SC$, hence $(MN) \xi = (M \xi)(N \xi) \in \SC$.  \emph{Case} $\lambda
xM$.  Let $\xi$ be a strongly computable substitution; we must show
$(\lambda xM) \xi = \lambda xM \xi_x^x \in \SC$.  So let $N \in \SC$; we
must show $(\lambda xM \xi_x^x)N \in \SC$.  By IH $M \xi_x^N \in \SC$,
hence $(\lambda xM \xi_x^x)N \in \SC$ by Corollary~\ref{C:schead}.
\end{proof}

\begin{corollary}
\mylabel{C:sn}
Every term is strongly normalizable.  \fini
\end{corollary}


\section{Rewrite Rules}\mylabel{S:Rew}
The elimination constants corresponding to the constructors are called
primitive recursion operators $\rec$.  They have been described in
detail in Section~\ref{S:Rec}.  In this setup, every closed term
reduces to a numeral.

For convenience, we shall also use constants for rather arbitrary computable
functionals, and axiomatize them according to their intended meaning
by means of rewrite rules.  An example is the general fixed point
operator $\fix$, which is axiomatized by $\fix F = F(\fix F)$.
Clearly then it cannot be true any more that every closed term reduces
to a numeral.  We may have non-terminating terms, but this just means
that not always it is a good idea to try to normalize a term.

An important consequence of admitting non-terminating terms is that
our notion of proof is not decidable: when checking e.g.\ whether two
terms are equal we may run into a non-terminating computation.  To
avoid this somewhat unpleasant undecidability phenomenon, we may view
our proofs as abbreviated forms of full proofs, with certain equality
arguments left implicit.  If some information sufficient to recover
the full proof (e.g.\ for each node a bound on the number of rewrite
steps needed to verify it) is stored as part of the proof, then we
retain decidability of proofs.

However, even without such additional information we still have
semi-decidability of proofs, i.e., an algorithm to check the
correctness of a proof that can only give correct results, but may not
terminate.  In practice this is sufficient.

We now describe in some detail our concept of rewrite rules.  For
every program constant $c^\rho$ we assume that some rewrite rules of
the form $c\vec{K} \cnv N$ are given, where $\FV(N) \subseteq
\FV(\vec{K})$ and $c\vec{K}$, $N$ have the same type (not necessarily
a ground type).  Moreover, for any two rules $c\vec{K} \cnv N$ and
$c\vec{K}' \cnv N'$ we require that $\vec{K}$ and $\vec{K}'$ are of
the same length, called the \emph{arity}\index{arity!of a program
  constant} of $c$.

Given a set of rewrite rules, we want to treat some rules - which we
call \indexentry{computation rules} - in a different, more efficient
way (cf.\ \cite{BergerEberlSchwichtenberg03}).  The idea is that a
computation rule can be understood as a description of a computation
in a suitable \indexentry{semantical model}, provided the syntactic
constructors correspond to semantic ones in the model, whereas the
other rules describe \emph{syntactic} transformations.

In order to define what we mean by computation rules, we need the
notion of a \indexentry{constructor pattern}.  These are special terms
defined inductively as follows.
\begin{itemize}
\item  Every variable is a constructor pattern.
\item If $c$ is a constructor and $P_1,\dots,P_n$ are constructor
patterns (or projection markers 0 or 1) such that $c \vec{P}$ is of
ground type, then $c\vec{P}$ is a constructor pattern.
\end{itemize}
From the given set of rewrite rules we choose a subset $\Comp$
with the following properties.
\begin{itemize}
\item If $c\vec{P} \cnv Q \in \Comp$, then $P_1,\dots,P_n$ are constructor 
patterns or projection markers.
\item The rules are left-linear, i.e.\ if $c\vec{P} \cnv Q \in \Comp$,
then every variable in $c\vec{P}$ occurs only once in $c\vec{P}$.
\item The rules are non-overlapping, i.e.~for different rules 
$c\vec{K} \cnv M$ and $c\vec{L} \cnv N$ in $\Comp$ the left hand sides
$c\vec{K}$ and $c\vec{L}$ are non-unifiable.
\end{itemize}
We write $c\vec{M} \cnv_{\comp} Q$ to indicate that the rule is in
$\Comp$.  All other rules will be called (proper) rewrite rules,
written $c\vec{M} \cnv_{\rew} K$.

In our reduction strategy computation rules will always be applied
first, and since they are non-overlapping, this part of the reduction
is unique.  However, since we allowed almost arbitrary rewrite rules,
it may happen that in case no computation rule applies a term may be
rewritten by different rules $\notin \Comp$.  In order to obtain a
deterministic procedure we then select the first applicable rewrite rule
(This is a slight simplification of \cite{BergerEberlSchwichtenberg03},
where special functions $\select_c$ were used for this purpose).


% \subsection{Logic with Non-Denoting Terms}\mylabel{SS:E-logic}
% % The fact that in our arithmetic not every term normalizes (or better:
% that normalization will not terminate for some terms) can be viewed
% logically in such a way that we allow non-denoting terms.


\section{Axioms}\mylabel{S:Axioms}
The intended model of our theory is a many-sorted structure, with one
sort for every type.  We assume that the model consists of
\emph{domains}\index{domain}, in the sense of domain theory (cf.\ 
\cite{Stoltenberg94}).  The reason for the setting is that we want to
deal with \emph{computable functionals}.  Since their (mathematically
correct) domains are the Scott-Ershov partial continuous functionals,
this is the intended range of the quantifiers.


\subsection{Languages for Algebras}\mylabel{SS:LangAlg}
We now define the specific logical language we use for our algebras.
It should be thought of as a form of arithmetical language, since it
is supposed to describe our particular intended model.

A \indexentry{variable} of a given type is interpreted by a continuous
functional (object) of that type.  We use the word \inquotes{variable}
and not \inquotes{program variable}, since continuous functionals are
not necessarily computable.  So for each type $\rho$ we have
\emph{general variables} \index{variable!general} $\hat{x}^{\rho},
\hat{y}^{\rho}, \dots$ of type $\rho$.  

In most cases we need to argue about existing (i.e.\ total) objects
only.  For the notion of totality we have to refer to \cite[Chapter
8.3]{Stoltenberg94}; particularly relevant here is exercise 8.5.7.  To
make formal arguments with quantifiers relativized to total objects
more managable, we use a special sort of variables intended to range
over such objects only.  So for each type $\rho$ we have \emph{total
  variables} \index{variable!total} $x^{\rho}, y^{\rho}, \dots$ of
type $\rho$.  

For readable in- and output, and also for ease in parsing, we may
reserve certain strings as names for variables of a given type, e.g.\
$n,m$ for variables of type $\typeN$.  Then also $n_0, n_1, n_2,
\dots, m_0, \dots$ can be used for the same purpose.  For example,
$n_0, n_1, n_2, \dots, m_0, \dots$ range over total natural numbers,
and $\hat{n}_0, \hat{n}_1, \hat{n}_2, \dots$ are general variables.
We say that the \emph{degree of totality}\index{degree of totality}
for the former is $1$, and for the latter $0$.

A \indexentry{predicate variable} $\hat{P}$ of arity\index{arity!of a
  predicate variable} $\rho_1, \dots, \rho_n$ is a placeholder for a
formula $A$ with distinguished (different) variables $\hat{x}_1,
\dots, \hat{x}_n$ of types $\rho_1, \dots, \rho_n$.  Such an entity is
called a \indexentry{comprehension term}, written $\set{\hat{x}_1,
  \dots, \hat{x}_n}{A}$.  By default we have the predicate variable
$\falsum$\index{bottom} (of empty arity), called (logical)
\indexentry{falsity}.  It is viewed as a predicate variable rather than a
predicate constant, since (when translating a classical proof into a
constructive one) we want to substitute for $\falsum$.

Often we will argue about \emph{Harrop formulas}\index{Harrop formula}
only, i.e.\ formulas without computational content.  For convenience
we use a special sort of predicate variables intended to range over
comprehension terms with Harrop formulas only.  For example, $P_0,
P_1, P_2, \dots, Q_0, \dots$ range over comprehension terms with
Harrop formulas, and $\hat{P}_0, \hat{P}_1, \hat{P}_2, \dots$ are
general predicate variables.  We say that \emph{Harrop
degree}\index{Harrop degree} for the former is $1$, and for the latter
$0$.

We also allow predicate constants with a fixed intended meaning.
Predicate variables and constants are both called predicate symbols.
The need for predicate constants comes up when e.g.\ an inductively
defined set is expressed via a formula stating the existence of a
generation tree; the kernel of this formula is to be axiomatized,
using the tree constructors.  Prime formulas built from predicate
constants do not give rise to extracted terms, and cannot be
substituted for.

Specific predicate constants are 
\begin{itemize}
\item $\atom$ of arity $(\typeBool)$,
\item for every type $\rho$ \indexentry{equality} $\approx_{\rho}$ of arity
$(\rho, \rho)$, and
\item for every type $\rho$ % \indexentry{existence} $E_{\rho}$ and
  \indexentry{totality} $\Total_{\rho}$ of arity $(\rho)$.
\end{itemize}
Notice that for finitary algebras, e.g. $\typeN$, we have continuous
boolean valued functions equality $=_{nat} \colon \typeN \to \typeN
\to \typeBool$ and existence (definedness, totality) $e_{nat} \colon
\typeN \to \typeBool$.  Then we can express equality $r=s$ by
$\atom(\eqrel{r}{s})$ and existence $E(r)$ by $\atom(e(r))$.

A prime formula\index{formula!prime} has the form $P(r_1, \dots, r_n)$
with a predicate variable or constant $P$ and terms $r_1, \dots, r_n$.
Write 
\begin{itemize}
\item  $T$, $F$ for $\atom(\true)$, $\atom(\false)$,
\item  $r=s$ for $\atom(\eqrel{r}{s})$,
\item  $E(r)$ for $\atom(e(r))$, and
\item  $r \approx s$ for $\approx(r,s)$.
\end{itemize}
\emph{Formulas}\index{formula} are built from prime formulas by
\begin{itemize}
\item  implication $A \to B$,
\item  conjunction $A \land B$,
\item  tensor $A \ltensor B$,
\item  all quantification  $\forall \hat{x}^{\rho} A$ and
\item  existential quantification $\ex \hat{x}^{\rho} A$.
\end{itemize}
Moreover we have classical existential quantification in an arithmetical
and a logical form:
\begin{alignat*}{2}
  &\exca \hat{x}_1 \dots \hat{x}_n.
  A_1 \ltensor \dots \ltensor A_m\index{exca@\texttt{exca}}
&\quad& \text{arithmetical version} 
\\
&\excl \hat{x}_1 \dots \hat{x}_n.
A_1 \ltensor \dots \ltensor A_m\index{excl@\texttt{excl}}
&& \text{logical version.}
\end{alignat*}
For all quantifiers we allow that the quantified variable is formed
without \verb#^#, i.e.\ ranges over total objects only.

\begin{remark*}
When dealing with the classical existential quantifier, it is -- for
obvious reasons -- useful to be able to unfold and fold it as it seems
appropriate.  In \textsc{Minlog} the commands are
\texttt{fold-formula} and \texttt{unfold-formula}.  However, notice that
there are some slight difficulties in this context.  To see the problems,
consider
\[
\excl x,y A
\]
If we read this as $\excl x \excl y A$, then the unfolded form would be
\[
\neg \forall x \neg \neg \forall y \neg A
\]
However, it would be simpler if we could unfold this formula into the
equivalent
\[
\neg \forall x \forall y \neg A
\]
To achive this effect, we allow lists of variables after a classical
existential quantifier, and unfold $\excl x,y A$ into the latter
(shorter) formula, but $\excl x \excl y A$ into the former.

Another (small) problem arises when we want to fold
\begin{equation}\label{Eq:classex}
\neg \forall x. A \to B \to \falsum
\end{equation}
The result should be $\excl x. A \land B$, but this is not quite
correct, since the latter formula unfolds into $\neg \forall x. A
\land B \to \falsum$.  Therefore in \textsc{Minlog} there is a connective
called \indexentry{tensor} (written $\ltensor$) with the property
that \eqref{Eq:classex}
folds into 
\[
\excl x. A \ltensor B
\] 
and unfolds again into \eqref{Eq:classex}.
\end{remark*}

Formulas can be \emph{unfolded}\index{formula!unfolded} in the sense
that all classical existential quantifiers are replaced according
to their definiton
\begin{align*}
  \exca \hat{x}_1 \dots \hat{x}_n. A_1 \ltensor \dots \ltensor A_m &:=
  (\forall \hat{x}_1 \dots \hat{x}_n. A_1 \to \dots \to A_m \to F) \to F
\\
  \excl \hat{x}_1 \dots \hat{x}_n. A_1 \ltensor \dots \ltensor A_m &:=
  (\forall \hat{x}_1 \dots \hat{x}_n. A_1 \to \dots \to A_m \to \falsum) \to
  \falsum
\end{align*}
Inversely a formula can be
\emph{folded}\index{formula!folded} in the sense that classical
existential quantifiers are introduced wherever possible.

\emph{Comprehension terms}\index{comprehension term} have the form
$\set{\vec{x}}{A}$; note that the formula $A$ may contain further free
variables.


\subsection{Algebras and Totality}\mylabel{SS:AlgTot}
We use the natural numbers as a prototypical finitary algebra; recall
Figure~\ref{F:nat}.  Assume that $n$, $p$ are variables of type
$\typeN$, $\typeBool$.  Let $\approx$ denote the equality relation in the
model.  Recall the domain of type $\typeBool$, consisting of $\true$,
$\false$ and the bottom element $\bottom$.  The boolean valued
functions equality $=_{nat} \colon \typeN \to \typeN \to \typeBool$ and
existence (definedness, totality) $e_{nat} \colon \typeN \to \typeBool$
need to be continuous.  So we have
\begin{align*}
\eqrel{0}{0} &\approx \true          
\\
\eqrel{0}{S \hat{n}} \approx \eqrel{S \hat{n}}{0} &\approx \false 
&e(0) &\approx \true
\\
\eqrel{S \hat{n}_1}{S \hat{n}_2} &\approx \eqrel{\hat{n}_1}{\hat{n}_2}
&e(S \hat{n}) &\approx e(\hat{n})
\\
\eqrel{\bottom_{nat}}{\hat{n}} \approx \eqrel{\hat{n}}{\bottom_{nat}} 
&\approx \bottom
&e(\bottom_{\typeN}) &\approx \bottom
\\
\eqrel{\infty_{nat}}{\hat{n}} \approx \eqrel{\hat{n}}{\infty_{nat}} 
&\approx \bottom
&e(\infty_{\typeN}) &\approx \bottom
\end{align*}
% Write $T$, $F$ for $\atom(\true)$, $\atom(\false)$, $r=s$ for
% $\atom(\eqrel{r}{s})$ and $E(r)$ for $\atom(e(r))$.  
We stipulate as axioms
\begin{alignat*}{2}
&T
&\quad&\texttt{Truth-Axiom}\index{Truth-Axiom@\texttt{Truth-Axiom}}
\\[1ex]
&\hat{x} \approx \hat{x}
&\quad&\text{\texttt{Eq-Refl}\index{Eq-Refl@\texttt{Eq-Refl}}}
\\
&\hat{x}_1 \approx \hat{x}_2 \to \hat{x}_2 \approx \hat{x}_1
&\quad&\text{\texttt{Eq-Symm}\index{Eq-Symm@\texttt{Eq-Symm}}}
\\
&\hat{x}_1 \approx \hat{x}_2 \to \hat{x}_2 \approx \hat{x}_3 \to 
\hat{x}_1 \approx \hat{x}_3
&\quad&\text{\texttt{Eq-Trans}\index{Eq-Trans@\texttt{Eq-Trans}}}
\\[1ex]
&\forall \hat{x} \hat{f}_1 \hat{x} \approx \hat{f}_2 \hat{x} \to
\hat{f}_1 \approx \hat{f}_2
&&\text{\texttt{Eq-Ext}\index{Extensionality@\texttt{Extensionality}}}
\\
&\hat{x}_1 \approx \hat{x}_2 \to \hat{P}(\hat{x}_1) \to \hat{P}(\hat{x}_2)
&\quad&\text{\texttt{Eq-Compat}\index{Compatibility@\texttt{Compatibility}}}
\\[1ex]
&\forall \hat{x}_1, \hat{x}_2 \hat{P}(\pair{\hat{x}_1}{\hat{x}_2}) \to 
\forall \hat{p} \hat{P}(\hat{p})
&\quad&\text{\texttt{Pair-Elim}\index{Pair-Elim@\texttt{Pair-Elim}}}
% \\[1ex]
% &\hat{n}_1 \approx \hat{n}_2 \to E(\hat{n}_1) \to E(\hat{n}_2) \to
% \hat{n}_1 = \hat{n}_2
% &&\text{\texttt{Eq-to-=}}\index{Eq-to-=@\texttt{Eq-to-=}}
% \\
% &\hat{n}_1 = \hat{n}_2 \to \hat{n}_1 \approx \hat{n}_2
% &&\text{\texttt{=-to-Eq}}\index{equals-to-Eq@\texttt{=-to-Eq}}
% \\[1ex]
% &\Total(\hat{n}) \to E(\hat{n})
% &&\text{\texttt{Total-to-E}}\index{Total-to-E@\texttt{Total-to-E}}
% \\
% &E(\hat{n}) \to \Total(\hat{n})
% &&\text{\texttt{E-to-Total}}\index{E-to-Total@\texttt{E-to-Total}}
% \\[1ex]
% &c_1 \vec{\hat{x}}_1 \approx c_2 \vec{\hat{x}}_2 \to F
% &&\text{\texttt{Constr-Disjoint}}% \index{Constr-Disjoint@\texttt{Constr-Disjoint@}}
% \\
% &c \vec{\hat{x}}_1 \approx c \vec{\hat{x}}_2 \to \hat{x}_{1i} \approx \hat{x}_{2i}
% &&\text{\texttt{Constr-Inj}}% \index{Constr-Inj@\texttt{Constr-Inj@}}
\\[1ex]
&\Total_{\rho \to \sigma}(\hat{f}) \leftrightarrow
\forall \hat{x}. \Total_{\rho}(\hat{x}) \to \Total_{\sigma}(\hat{f} \hat{x})
&&\text{\texttt{Total}}\index{Total@\texttt{Total}}
\\
&\Total_{\rho}(c)
&&\text{\texttt{Constr-Total}}\index{Constr-Total@\texttt{Constr-Total}}
\\
&\Total(c \vec{\hat{x}}) \to \Total(\hat{x}_i)
&&\text{\texttt{Constr-Total-Args}}\index{Constr-Total-Args@\texttt{Constr-Total-Args}}
% \\
% &\Total_{\rho}(\bottom) \to F
% &&\text{\texttt{Bottom-not-Total}}% \index{Bottom-Not-Total@\texttt{Bottom-Not-Total}}
\\
\intertext{and for every finitary algebra, e.g.\ \texttt{nat}}
&\hat{n}_1 \approx \hat{n}_2 \to E(\hat{n}_1) \to
\hat{n}_1 = \hat{n}_2
&&\text{\texttt{Eq-to-=-1-nat}\index{Eq-to-=-1-nat@\texttt{Eq-to-=-1-nat}}}
\\
&\hat{n}_1 \approx \hat{n}_2 \to E(\hat{n}_2) \to
\hat{n}_1 = \hat{n}_2
&&\text{\texttt{Eq-to-=-2-nat}\index{Eq-to-=-2-nat@\texttt{Eq-to-=-2-nat}}}
\\
&\hat{n}_1 = \hat{n}_2 \to \hat{n}_1 \approx \hat{n}_2
&&\text{\texttt{=-to-Eq-nat}\index{equals-to-Eq-nat@\texttt{=-to-Eq-nat}}}
\\
&\hat{n}_1 = \hat{n}_2 \to E(\hat{n}_1)
&&\text{\texttt{=-to-E-1-nat}\index{equals-to-E-1-nat@\texttt{=-to-E-1-nat}}}
\\
&\hat{n}_1 = \hat{n}_2 \to E(\hat{n}_2)
&&\text{\texttt{=-to-E-2-nat}\index{equals-to-E-2-nat@\texttt{=-to-E-2-nat}}}
\\
&\Total(\hat{n}) \to E(\hat{n})
&&\text{\texttt{Total-to-E-nat}\index{Total-to-E-nat@\texttt{Total-to-E-nat}}}
\\
&E(\hat{n}) \to \Total(\hat{n})
&&\text{\texttt{E-to-Total-nat}\index{E-to-Total-nat@\texttt{E-to-Total-nat}}}
\end{alignat*}
Here $c$ is a constructor.  Notice that in $\Total(c \vec{\hat{x}})
\to \Total(\hat{x}_i)$, the type of $c \vec{\hat{x}}$ need not be a
finitary algebra, and hence $\hat{x}_i$ may have a function type.
% Further notice that $\Total_{\rho}(\bottom) \to F$ is also necessary
% for $\rho$ an infinitary ground type.

\begin{remark*}
  $(E(\hat{n}_1) \to \hat{n}_1 = \hat{n}_2) \to (E(\hat{n}_2) \to
  \hat{n}_1 = \hat{n}_2) \to \hat{n}_1 \approx \hat{n}_2$ is \emph{not}
  valid in our intended model (see Figure~\ref{F:nat}), since we have
  \emph{two} distinct undefined objects $\bottom_{nat}$ and
  $\infty_{nat}$.
\end{remark*}

We abbreviate
\begin{alignat*}{2}
&\forall \hat{x}. \Total_{\rho}(\hat{x}) \to A &\quad\hbox{by} \quad& 
\forall x A,
\\
&\exists \hat{x}. \Total_{\rho}(\hat{x}) \land A &\quad\hbox{by} \quad& 
\exists x A.
\end{alignat*}
Formally, these abbreviations appear as axioms
\begin{alignat*}{2}
&\forall x \hat{P}(x) \to
\forall \hat{x}. \Total(\hat{x}) \to \hat{P}(\hat{x})
&\quad&\texttt{All-AllPartial}\index{All-AllPartial@\texttt{All-AllPartial}}
\\
&(\forall \hat{x}. \Total(\hat{x}) \to \hat{P}(\hat{x})) \to
\forall x \hat{P}(x)
&\quad&\texttt{AllPartial-All}\index{AllPartial-All@\texttt{AllPartial-All}}
\\
&\exists x \hat{P}(x) \to
\exists \hat{x}. \Total(\hat{x}) \land \hat{P}(\hat{x})
&\quad&\texttt{Ex-ExPartial}\index{Ex-ExPartial@\texttt{Ex-ExPartial}}
\\
&(\exists \hat{x}. \Total(\hat{x}) \land \hat{P}(\hat{x})) \to
\exists x \hat{P}(x)
&\quad&\texttt{ExPartial-Ex}\index{ExPartial-Ex@\texttt{ExPartial-Ex}}
\\
\intertext{and for every finitary algebra, e.g.\ \texttt{nat}}
&\forall n \hat{P}(n) \to
\forall \hat{n}. E(\hat{n}) \to \hat{P}(\hat{n})
&\quad&\texttt{All-AllPartial-nat}\index{All-AllPartial-nat@\texttt{All-AllPartial-nat}}
\\
&(\exists \hat{n}. E(\hat{n}) \land \hat{P}(\hat{n})) \to
\exists n \hat{P}(n)
&\quad&\texttt{ExPartial-Ex-nat}\index{ExPartial-Ex-nat@\texttt{ExPartial-Ex-nat}}
\end{alignat*}
Notice that \texttt{AllPartial-All-nat}\index{AllPartial-All-nat@\texttt{AllPartial-All-nat},} i.e.\ $(\forall
\hat{n}. E(\hat{n}) \to \hat{P}(\hat{n})) \to \forall n
\hat{P}(n)$ is provable (since $E(n) \cnv T$).  Similarly,
\texttt{Ex-ExPartial-nat}\index{Ex-ExPartial-nat@\texttt{Ex-ExPartial-nat}}, i.e.\
$\exists n \hat{P}(n) \to
\exists \hat{n}. E(\hat{n}) \land \hat{P}(\hat{n})$ is provable.

Finally we have axioms for the existential quantifier
\begin{alignat*}{2}
&\forall \hat{x}^\alpha. \hat{P}(\hat{x}) \to 
\exists \hat{x}^\alpha \hat{P}(\hat{x})
&\quad&\text{\texttt{Ex-Intro}\index{Ex-Intro@\texttt{Ex-Intro}}}
\\
&\exists \hat{x}^\alpha \hat{P}(\hat{x}) \to 
(\forall \hat{x}^\alpha. \hat{P}(\hat{x})
\to \hat{Q}) \to \hat{Q}
&\quad&\text{\texttt{Ex-Elim}\index{Ex-Elim@\texttt{Ex-Elim}}}
\end{alignat*}


\subsection{Induction}\mylabel{SS:Ind}
We now spell out what we mean by induction\index{induction}
over simultaneous free algebras $\vec{\mu} =
\mu\vec{\alpha} \,\vec{\kappa}$, with goal formulas $\forall
x_j^{\mu_j}\,\hat{P}_j(x_j)$.  For the constructor type
\[
\kappa_i = \vec{\rho} \to (\vec{\sigma}_1 \to \alpha_{j_1}) \to \dots \to
(\vec{\sigma}_n \to \alpha_{j_n}) \to \alpha_j \in
\constrtypes(\vec{\alpha})
\]
we have the \emph{step formula}
\begin{align*}
D_i := \forall y_1^{\rho_1},\dots,y_m^{\rho_m},
y_{m+1}^{\vec{\sigma}_1 \to \mu_{j_1}},\dots,
y_{m+n}^{\vec{\sigma}_n \to \mu_{j_n}}.
&\forall \vec{x}^{\vec{\sigma}_1} \,
\hat{P}_{j_1}(y_{m+1} \vec{x}) \to \dots \to 
\\
&\forall \vec{x}^{\vec{\sigma}_n} \,
\hat{P}_{j_n}(y_{m+n} \vec{x}) \to 
\\
&\hat{P}_j(\constr_i^{\vec{\mu}}(\vec{y})).
\end{align*}
Here $\vec{y} = y_1^{\rho_1},\dots,y_m^{\rho_m},
y_{m+1}^{\vec{\sigma}_1 \to \mu_{j_1}},\dots,
y_{m+n}^{\vec{\sigma}_n \to \mu_{j_n}}$ are the
\emph{components} of the object $\constr_i^{\vec{\mu}}(\vec{y})$
of type $\mu_j$ under consideration, and
\[
\forall \vec{x}^{\vec{\sigma}_1} \,
\hat{P}_{j_1}(y_{m+1} \vec{x}), \dots,
\forall \vec{x}^{\vec{\sigma}_n} \,
\hat{P}_{j_n}(y_{m+n} \vec{x})
\]
are the hypotheses available when proving the induction step.  The
induction axiom $\ind_{\mu_j}^{\vec{x},
\vec{A}}$\index{Ind@\texttt{Ind}} with $\vec{x} = (x_j^{\mu_j})_{j=1,
\dots, N}$ and $\vec{A} = (A_j)_{j=1, \dots, N} =
(\hat{P}_j(x_j^{\mu_j}))_{j=1, \dots, N}$ then proves the formula
\[
D_1 \to \dots \to D_k \to \forall x_j^{\mu_j}\,\hat{P}_j(x_j).
\]
We will often write $\ind_j^{\vec{x}, \vec{A}}$ for
$\ind_{\mu_j}^{\vec{x}, \vec{A}}$, and omit the upper indices
$\vec{x}, \vec{A}$ when they are clear from the context.  In case
of a non-simultaneous free algebra, i.e.\ of type $\mu
\alpha\,\kappa$, for $\ind_\mu^{x, A}$ we normally write
$\ind_{x,A}$.

\begin{examples*}
\begin{alignat*}{2}
&\ind_{p, A} \colon \subst{A}{p}{\true} \to
\subst{A}{p}{\false} \to
\forall p^{\typeBool} A,
\\
&\ind_{n, A} \colon \subst{A}{n}{0} \to
(\forall n. A \to \subst{A}{n}{\suc n}) \to \
\forall n^{\typeN} A,
\\
&\ind_{l, A} \colon \subst{A}{l}{\nil} \to
(\forall x,l. A \to \subst{A}{l}{\cons(x,l)}) \to
\forall l^{\typeL{\alpha}} A
\\
&\ind_{x, A} \colon 
\forall y_1 \subst{A}{x}{\termSumIntroLeft(y_1)} \to
\forall y_2 \subst{A}{x}{\termSumIntroRight(y_2)} \to
\forall x^{\rho_1 \typeSum \rho_2} A.
\end{alignat*}

For the simultaneously defined algebras $\tree$ and $\tlist$ the
induction axiom $\ind_{\tree}^{b,\bs,\hat{P}_1(b), \hat{P}_2(\bs)}$ is
\begin{alignat*}{2}
&D_1 \to D_2 \to D_3 \to D_4 \to \forall b^\tree \hat{P}_1(b)
\\
\intertext{with}
&D_1 := \forall n \hat{P}_1(\leaf(n)),
\\
&D_2 := \forall \bs^{\tlist}. \hat{P}_2(\bs) \to \hat{P}_1(\branch(\bs)),
\\
&D_3 := \hat{P}_2(\emp),
\\
&D_4 := \forall b^{\tree},\bs^{\tlist}. \hat{P}_1(b) \to 
\hat{P}_2(\bs) \to \hat{P}_2(\tcons(b,\bs)).
\end{alignat*}
\end{examples*}

\begin{remark}\mylabel{R:simpInd} 
It may happen that in an induction on simultaneously defined algebras
one only needs to induct on some of those algebras.  Then we can
simplify the induction formula accordingly, by
\begin{itemize}
\item omitting all step formulas $D_i$ corresponding to constructor
types with irrelevant value type $\tau_j$, and
\item simplifying the remaining step formulas by omitting from the
induction hypotheses $\forall \vec{x}^{\vec{\sigma}_1} \,
\hat{P}_{j_1}(y_{m+1} \vec{x})$, \dots, $\forall
\vec{x}^{\vec{\sigma}_n}\,\hat{P}_{j_n}(y_{m+n} \vec{x})$ all those
corresponding to constructor types with irrelevant value type
$\tau_{j_{\nu}}$.
\end{itemize}
In the $\tree,\tlist$-example, if we only want to induct on $\tlist$,
then the step formulas are
\begin{align*}
&D_3 := \hat{P}_2(\emp),
\\
&D_4 := \forall b^{\tree},\bs^{\tlist}.
\hat{P}_2(\bs) \to \hat{P}_2(\tcons(b,\bs)).
\end{align*}
Hence the simplified induction axiom is
\begin{align*}
\ind_{\bs,\hat{P}_2(\bs)} &\colon
D_3 \to D_4 \to \forall \bs^{\tlist} \hat{P}_2(\bs).
\end{align*}
\end{remark}

\subsection{Cases}\mylabel{SS:Cases}
% \begin{remark}\mylabel{R:CasesAxiom}
There is an important variant of the induction axiom, where no
induction hypotheses are used, i.e.\ all step formulas have the form
\[
D_i := \forall y_1^{\rho_1},\dots,y_m^{\rho_m},
y_{m+1}^{\vec{\sigma}_1 \to \mu_{j_1}},\dots,
y_{m+n}^{\vec{\sigma}_n \to \mu_{j_n}}.
\hat{P}_j(\constr_i^{\vec{\mu}}(\vec{y})).
\]
This variant is called the \emph{cases axiom}\index{cases
axiom}\index{cases-axiom@$\CasesAxiom$-axiom}; it distinguishes cases
according to the outer constructor form.  The formula of the cases
axiom is
\[
\CasesAxiom_{x_j, \hat{P}_j(x_j)} \colon 
D_{i_1}, \dots, D_{i_q} \to \forall x_j^{\mu_j} \hat{P}_j(x_j), 
\]
where $D_{i_1}, \dots, D_{i_q}$ consists of all $D_i$ concerning
constructors for $\mu_j$.

Examples are
\begin{alignat*}{2}
&\CasesAxiom_{n, A} \colon \subst{A}{n}{0} \to
\forall n \subst{A}{n}{\suc n} \to \
\forall n^{\typeN} A,
\\
&\CasesAxiom_{l, A} \colon \subst{A}{l}{\nil} \to
\forall x,l \subst{A}{l}{\cons(x,l)} \to
\forall l^{\typeL{\alpha}} A.
\end{alignat*}

% Again it may happen that in an argument by cases on simultaneously
% defined algebras one only needs to consider some of those algebras.
% Then we can simplify the cases axiom accordingly, by
% \begin{itemize}
% % \item omitting all step formulas $D_i$ corresponding to constructor
% types with irrelevant value type $\tau_{j_{\nu}}$.
% % \end{itemize}
In the $\tree,\tlist$-example, if we want to distinguish cases on
$\tlist$, then the step formulas are
\begin{align*}
D_3 &:= \hat{P}(\emp),
\\
D_4 &:= \forall b^{\tree} \forall \bs^{\tlist} \hat{P}(\tcons(b,\bs)).
\end{align*}
Hence the cases axiom is
\begin{align*}
\CasesAxiom_{\bs,\hat{P}(\bs)} &\colon
\hat{P}(\emp) \to 
\forall b^{\tree} \forall \bs^{\tlist} \hat{P}(\tcons(b,\bs)) \to
\forall \bs^{\tlist} \hat{P}(\bs).
\end{align*}
% \end{remark}

\begin{comment}
\begin{example*}
Consider the two formulas
\begin{align*}
&\forall b^{\tree} \ex \bs_0^{\tlist}. \mathsf{FlatTlist\,\bs_0 \land
\mathsf{LeavesTree\,b = \mathsf{LeavesTlist\,bs_0
\\
&\forall \bs^{\tlist} \ex \bs_0^{\tlist}. \mathsf{FlatTlist\,\bs_0 \land
\mathsf{LeavesTlist\,\bs = \mathsf{LeavesTlist\,bs_0
\end{align*}
Here are the recursive definitions of the predicates involved.
\begin{align*}
\mathsf{FlatTlist\,\emp &:= \true
\\
\mathsf{FlatTlist}(\tcons\, b\, \bs) &:= \mathsf{And}(\mathsf{LeafPred\,b)
(\mathsf{FlatTlist\,\bs)
\\[6pt]
\mathsf{LeafPred}(\leaf\, n) &:= \true
\\
\mathsf{LeafPred}(\branch\, \bs) &:= \false
\\[6pt]
\mathsf{LeavesTree}(\leaf\, n) &:= 1
\\
\mathsf{LeavesTree}(\branch\, \bs) &:= \mathsf{LeavesTlist\,\bs
\\[6pt]
\mathsf{LeavesTlist\,\emp &:= 0
\\
\mathsf{LeavesTlist}(\tcons\, b\, \bs) &:= (\mathsf{LeavesTree\,b) +
(\mathsf{LeavesTlist\,\bs)
\end{align*}
\end{example*}
\end{comment}


\section{Notes}\mylabel{S:AlgNotes}
Section~\ref{S:Rec} is based on an extension of Tait's\index{Tait}
method of strong computability predicates.  The definition of these
predicates and also the proof are related to Zucker's\index{Zucker}
proof of strong normalization of his term system for recursion on the
first three number or tree classes.  However, Zucker uses a
combinatory term system and defines strong computability for closed
terms only.  Following some ideas in an unpublished note of
Berger\index{Berger}, Benl\index{Benl} (in his diploma thesis
\cite{Benl98}) adapted this proof to terms in the simply typed
$\lambda$-calculus, possibly involving free variables.  Here this
proof is extended to the case of simultaneously defined free algebras.

In a recent paper of Abel\index{Abel} and Altenkirch
\index{Altenkirch} \cite{AbelAltenkirch00}, a similar result is proved
with a different method, involving Aczel's\index{Aczel} notion of a
set-based relation.  It seems worthwile to verify that an appropriate
variant of the standard Tait proof also yields this result.  However,
an additional merit of the method of Abel and Altenkirch is that they
are also able to treat co-inductive types.  We have not tried to
extend our's in this direction as well.


\chapter{Unification and Proof Search}
% Sources: search00/s.tex and proofth/ss01/PT01/logic.tex
% Modification here: Huet's unification algorithm
\mylabel{C:SearchHO} We describe a proof search method suitable for
minimal logic with higher order functionals.  It is based on Huet's
\cite{Huet75} unification algorithm for the simply typed lambda
calculus, which is treated first.

Huet's unification algorithm does not terminate in general;
this cannot be avoided, since it is well known that higher order
unification is undecidable.  This non-termination can be avoided if we
restrict ourselves to a certain fragment of higher order (simply
typed) minimal logic. This fragment is determined by requiring that
every higher order variable $Y$ can only occur in a context $Y
\vec{x}$, where $\vec{x}$ are distinct bound variables in the scope of
the operator binding $Y$, and of opposite polarity.  Note that for
first order logic this restriction does not mean anything, since there
are no higher order variables.  However, when designing a proof search
algorithm for first order logic only, one is naturally led into this
fragment of higher order logic, where the algorithm works as well.


\section{Huet's Unification Algorithm}
\mylabel{S:Huet} 
We work in the simply typed $\lambda$-calculus, with the usual
conventions.  For instance, whenever we write a term we assume that it
is correctly typed.  \emph{Substitutions}\index{substitution} are
denoted by $\varphi, \psi, \rho$.  The result of applying a
substitution $\varphi$ to a term $r$ or a formula $A$ is written as $r
\varphi$ or $A \varphi$, with the understanding that after the
substitution all terms are brought into long normal form.

$Q$ always denotes a $\forall \exists \forall$-prefix, say $\forall
\vec{x} \exists \vec{y} \forall \vec{z}$, with distinct variables.  We
call $\vec{x}$ the \emph{signature
variables}\index{variable!signature}, $\vec{y}$ the \emph{flexible
variables}\index{variable!flexible} and $\vec{z}$ the \emph{forbidden
variables}\index{variable!forbidden} of $Q$, and write $Q_\exists$ for
the existential part $\exists \vec{y}$ of $Q$.

A \emph{$Q$-term}\index{Q-term@$Q$-term} is a term with all its free
variables in $Q$, and similarly a
\emph{$Q$-formula}\index{Q-formula@$Q$-formula} is a formula with all
its free variables in $Q$.  A
\emph{$Q$-substitution}\index{Q-substitution@$Q$-substitution} is a
substitution of $Q$-terms.

A \indexentry{unification problem} $\C{U}$ consists of a $\forall
\exists \forall$-prefix $Q$ and a conjunction $C$ of equations between
$Q$-terms of the same type, i.e.\ $\bigland_{i=1}^n r_i = s_i$.  We
may assume that each such equation is of the form $\lambda \vec{x} r =
\lambda \vec{x} s$ with the same $\vec{x}$ (which may be empty) and
$r, s$ of ground type.

A \indexentry{solution} to such a unification problem $\C{U}$ is a
$Q$-substitution $\varphi$ such that for every $i$, $r_i \varphi = s_i
\varphi$ holds (i.e.\ $r_i \varphi$ and $s_i \varphi$ have the same
normal form).  We sometimes write $C$ as $\vec{r} = \vec{s}$, and (for
obvious reasons) call it a list of unification pairs.  

We now define the unification algorithm.  It takes a unification
problem $\C{U} = QC$ and produces a not necessarily well-founded tree
(called \indexentry{matching tree} by Huet \cite{Huet75})
with nodes labelled by unification problems and vertices labelled by
substitutions.

\begin{definition*}[Unification algorithm] We distinguish cases according to
the form of the unification problem, and either give the transition
done by the algorithm, or else state that it fails.

\emph{Case} identity, i.e.\ $Q.r=r \land C$.  Then
\[
(Q.r=r \land C) \unifalg{\eps} QC.
\]

\emph{Case} $\xi$, i.e.\ $Q.\lambda \vec{x}\,r = \lambda \vec{x}\,s
\land C$.  We may assume here that the bound variables $\vec{x}$ are
the same on both sides.
\[
(Q.\lambda \vec{x}\,r = \lambda \vec{x}\,s \land C)
\unifalg{\eps} Q\forall \vec{x}.r = s \land C.
\]

\emph{Case} rigid-rigid, i.e.\ $Q.f \vec{r} = g \vec{s} \land C$ with
both $f$ and $g$ rigid, that is either a signature variable or else a
forbidden variable.  If $f$ is different from $g$ then fail.   If
$f$ equals $g$,
\[
(Q.f \vec{r} = f \vec{s} \land C) \unifalg{\eps} Q. \vec{r} = \vec{s} \land C.
\]

\emph{Case} flex-rigid, i.e.\ $Q.u \vec{r} = f \vec{s} \land C$ with
$f$ rigid.  Then the algorithm branches into one
\indexentry{imitation} branch and $m$ \indexentry{projection}
branches, where $r = r_1, \dots, r_m$.  Imitation replaces the
flexible head $u$, using the substitution $\rho = \subst{}{u}{\lambda
  \vec{x}.f (h_1 \vec{x}) \dots (h_n \vec{x})}$ with new variables
$\vec{h}$ and $\vec{x}$.  For $r_i$ we have a projection if and only
if the final value type of $r_i$ is the (ground) type of $f \vec{s}$.
Then the $i$-th projections pulls $r_i$ in front, by $\rho =
\subst{}{u}{\lambda \vec{x}.x_i (h_1 \vec{x}) \dots (h_{n_i}
  \vec{x})}$.  In each of these branches we have
\[
(Q.u \vec{r} = f \vec{s} \land C) \unifalg{\rho} 
Q'.(u \vec{r} = f \vec{s} \land C) \rho,
\]
where $Q'$ is obtained from $Q$ by removing $\exists u$ and adding
$\exists \vec{h}$.

\emph{Case} flex-flex, i.e.\ $Q.u \vec{r} = v \vec{s} \land C$.  If
there is a first flex-rigid or rigid-flex equation in $C$, pull this
equation (possibly swapped) to the front and apply case flex-rigid.
Otherwise, i.e.\ if all equations are between terms with flexible
heads, pick a new variable $z$ of ground type and let $\rho$ be the
substitution mapping each of these flexible heads $u$ to $\lambda
\vec{x} z$.
\[
(Q.u \vec{r} = v \vec{s} \land C) \unifalg{\rho} Q. \emptyset.
\]

This concludes the definition of the unification algorithm.
\end{definition*}

Clearly $\rho$ is defined on flexible variables of $Q$ only, and its
value terms have no free occurrences of forbidden variables from $Q$.
Our next task is to prove correctness and completeness of this
algorithm.

\begin{theorem}[Huet] \mylabel{T:Huet}
Let a unification problem $\C{U}$ consisting of a $\forall \exists
\forall$-prefix $Q$ and a list $\vec{r} = \vec{s}$ of unification pairs
be given.  Then either 
\begin{itemize}
\item the unification algorithm can make a transition, and
\begin{itemize}
\item (correctness) for every transition $\C{U} \unifalg{\rho} \C{U}'$ and
$\C{U}'$-solution $\varphi'$ the substitution $(\rho \circ \varphi')
{\restriction} Q_\exists$ is a $\C{U}$-solution, and
\item (completeness) for every $\C{U}$-solution $\varphi$ there is a
transition $\C{U} \unifalg{\rho} \C{U}'$ and $\C{U}'$-solution
$\varphi'$ such that $\varphi = (\rho \circ \varphi') {\restriction}
Q_\exists$, and moreover $\mu(\varphi') \le \mu(\varphi)$ with $<$ in
case flex-rigid, or else
\end{itemize}
\item the unification algorithm fails, and there is no
$\C{U}$-solution,
or else
\item the unification algorithm succeeds, and $\vec{r} = \vec{s}$ is
empty.
\end{itemize}
Here $\mu(\varphi)$ denotes the number of applications in the value
terms of $\varphi$.
\end{theorem}

\begin{proof}
\emph{Case} identity, i.e.\ $Q.r=r \land C \unifalg{\eps} QC$.  Then
correctness and completeness are obvious.

\emph{Case} $\xi$, i.e.\ $Q.\lambda \vec{x}\,r = \lambda \vec{x}\,s
\land C \unifalg{\eps} Q \forall \vec{x}.r=s \land C$.  Again
correctness and completeness are obvious.

\emph{Case} rigid-rigid, i.e.\ $Q.f \vec{r} = g \vec{s} \land C
\unifalg{\eps} Q. \vec{r} = \vec{s} \land C$.  If $f \ne g$, then the
unification algorithm fails and there is no $\C{U}$-solution.  If $f =
g$, again correctness and completeness are obvious.

\emph{Case} flex-rigid, i.e.\ $\C{U}$ is $Q.u \vec{r} = f \vec{s}
\land C$.

Correctness.  Assume $\C{U} \unifalg{\rho} \C{U'}$, which is to say
$(Q.u \vec{r} = f \vec{s} \land C) \unifalg{\rho} Q'.(u \vec{r} = f
\vec{s} \land C) \rho$.  Let $\varphi'$ be a $\C{U'}$-solution, i.e.\
$(u \vec{r} = f \vec{s} \land C)\rho \varphi'$.  Then clearly $(\rho
\circ \varphi') {\restriction} Q_\exists$ is a $\C{U}$-solution.

Completeness.  Assume $\varphi$ is a $\C{U}$-solution, i.e.\ $(u
\vec{r} = f \vec{s} \land C)\varphi$.  We have to find a transition
$\C{U} \unifalg{\rho} \C{U}'$ and a $\C{U}'$-solution $\varphi'$ such
that $\varphi = (\rho \circ \varphi') {\restriction} Q_\exists$, and
moreover $\mu(\varphi') < \mu(\varphi)$.  Now $u \varphi$ must be of
the form $\lambda \vec{x}.a \vec{t}$ with $a$ either $f$ or $x_i$.

\emph{Subcase} $a$ is $f$.  Then take the imitation branch, i.e.\
replace the flexible head $u$ using the substitution $\rho =
\subst{}{u}{\lambda \vec{x}.f (h_1 \vec{x}) \dots (h_n \vec{x})}$ with
new variables $\vec{h}$ and $\vec{x}$.  Recall $(Q.u \vec{r} = f
\vec{s} \land C) \unifalg{\rho} Q'.(u \vec{r} = f \vec{s} \land C)
\rho$, where $Q'$ is obtained from $Q$ by removing $\exists u$ and
adding $\exists \vec{h}$.  Define $\varphi'$ on the new variables
$\vec{h}$ by $h_j \varphi' := \lambda \vec{x} t_j$, and as $\varphi$
on all other variables.  Then $\varphi = (\rho \circ \varphi')
{\restriction} Q_\exists$ because of
\[
u \rho \varphi' =
\lambda \vec{x}.f\bigl( (\vec{h} \varphi') \vec{x} \bigr) =
\lambda \vec{x}.f \vec{t} =
u \varphi,
\]
and our assumption says that
\[
f \subst{\vec{t}}{\vec{x}}{\vec{r} \varphi} =
f (\vec{s} \varphi)
\]
Now $\varphi'$ is a $\C{U'}$-solution because of
\[
(u \vec{r}) \rho \varphi' =
f\bigl( \subst{\vec{t}}{\vec{x}}{\vec{r} \rho \varphi'} \bigr) =
f\bigl( \subst{\vec{t}}{\vec{x}}{\vec{r} \varphi} \bigr) =
f (\vec{s} \varphi) =
f (\vec{s} \rho \varphi').
\]

\emph{Subcase} $a$ is $x_i$.  Then take the $i$-th projections branch,
i.e.\ replace the flexible head $u$ using the substitution $\rho =
\subst{}{u}{\lambda \vec{x}.x_i (h_1 \vec{x}) \dots (h_{n_i}
\vec{x})}$ with new variables $\vec{h}$ and $\vec{x}$.  Recall $(Q.u
\vec{r} = f \vec{s} \land C) \unifalg{\rho} Q'.(u \vec{r} = f \vec{s}
\land C) \rho$, where $Q'$ is obtained from $Q$ by removing $\exists
u$ and adding $\exists \vec{h}$.  Define $\varphi'$ on the new
variables $\vec{h}$ by $h_j \varphi' := \lambda \vec{x} t_j$, and as
$\varphi$ on all other variables.  Then $\varphi = (\rho \circ
\varphi') {\restriction} Q_\exists$ because of
\[
u \rho \varphi' =
\lambda \vec{x}.x_i\bigl( (\vec{h} \varphi') \vec{x} \bigr) =
\lambda \vec{x}.x_i \vec{t} =
u \varphi,
\]
and our assumption says that
\[
(r_i \varphi)\subst{\vec{t}}{\vec{x}}{\vec{r} \varphi} =
f (\vec{s} \varphi)
\]
Now $\varphi'$ is a $\C{U'}$-solution because of
\[
(u \vec{r}) \rho \varphi' =
(r_i \rho \varphi')
\bigl( \subst{\vec{t}}{\vec{x}}{\vec{r} \rho \varphi'} \bigr) =
(r_i \varphi)
\bigl( \subst{\vec{t}}{\vec{x}}{\vec{r} \varphi} \bigr) =
f (\vec{s} \varphi) =
f (\vec{s} \rho \varphi').
\]

\emph{Case} flex-flex, i.e.\ $Q.C$ where all equations in
$C$ are between terms with flexible heads.  Then for a new variable
$z$ of ground type we have taken $\rho$ to be the substitution mapping
each of these flexible heads to $\lambda \vec{x} z$, and
\[
(QC) \unifalg{\rho} Q. \emptyset.
\]

Correctness.  $(\rho \circ \varphi') {\restriction} Q_\exists$ clearly
is a $\C{U}$-solution for every $\varphi'$.

Completeness.  To simplify the notation let $C = (u r = v s)$.  Assume
that $\varphi$ is a $\C{U}$-solution, i.e.\ $(u r = v s)\varphi$.
Then $u\varphi = \lambda x.f_1 t_1$ and $v\varphi = \lambda x.f_2
t_2$, and by assumption $f_1 \subst{t_1}{x}{r} = f_2
\subst{t_2}{x}{s}$.  Define $\varphi'$ to be $\varphi$ with the
assignments to $u,v$ removed and $z \mapsto f_1 \subst{t_1}{x}{r}$
($=f_2 \subst{t_2}{x}{s}$) added.  Then clearly $(\rho \circ \varphi')
{\restriction} Q_\exists = \varphi$, and $\mu(\varphi') \le
\mu(\varphi)$.
\end{proof}

\begin{corollary} \mylabel{C:unif}
Given a unification problem $\C{U} = QC$, and a success node in the
matching tree, labelled with a prefix $Q'$ (i.e.\ a unification
problem $\C{U}'$ with no unification pairs).  Then by composing the
substitution labels on the branch leading to this node we obtain a
pair $(Q', \rho)$ with a \inquotes{transition} substitution $\rho$ and
such that for any $Q'$-substitution $\varphi'$, $(\rho \circ \varphi')
{\restriction} Q_\exists$ is an $\C{U}$-solution.  Moreover, every
$\C{U}$-solution can be obtained in this way, for an appropriate
success node.  Since the empty substitution is a $Q'$-substitution,
$\rho {\restriction} Q_\exists$ is a $\C{U}$-solution, which is most
general in the sense stated. \fini
\end{corollary}


\section{The Pattern Unification Algorithm}
\mylabel{S:PatternUnif}
We modify restrict the notion of $Q$-term as follows.
\emph{$Q$-terms}\index{Q-term@$Q$-term} are inductively defined by the
following clauses.
\begin{itemize}
\item If $u$ is a universally quantified variable in $Q$ or a
constant, and $\vec{r}$ are $Q$-terms, then $u \vec{r}$ is a $Q$-term.
\item For any flexible variable $y$ and distinct forbidden variables
$\vec{z}$ from $Q$, $y \vec{z}$  is a $Q$-term.
%$
\item If $r$ is a $Q \forall z$-term, then $\lambda z r$ is a
$Q$-term.
\end{itemize}
Explicitely, $r$ is a $Q$-term iff all its free variables are in $Q$,
and for every subterm $y \vec{r}$ of $r$ with $y$ free in $r$ and
flexible in $Q$, the $\vec{r}$ are distinct variables either
$\lambda$-bound in $r$ (such that $y \vec{r}$ is in the scope of this
$\lambda$) or else forbidden in $Q$.

\emph{$Q$-goals}\index{Q-goal@$Q$-goal} and
\emph{$Q$-clauses}\index{Q-clause@$Q$-clause} are simultaneously
defined by
\begin{itemize}
\item If $\vec{r}$ are $Q$-terms, then $P \vec{r}$ is a $Q$-goal as
well as a $Q$-clause.
\item If $D$ is a $Q$-clause and $G$ is a $Q$-goal, then $D \to G$
is a $Q$-goal.
\item If $G$ is a $Q$-goal and $D$ is a $Q$-clause, then $G \to D$
is a $Q$-clause.
\item If $G$ is a $Q\forall x$-goal, then $\forall x G$ is a $Q$-goal.
\item If $\subst{D}{y}{Y \vec{z}}$ is a $\forall \vec{x} \exists
\vec{y}, Y \forall \vec{z}$-clause, then $\forall y D$ is a $\forall
\vec{x} \exists \vec{y} \forall \vec{z}$-clause.
\end{itemize}
Explicitely, a formula $A$ is a \emph{$Q$-goal}\index{Q-goal@$Q$-goal}
iff all its free variables are in $Q$, and for every subterm $y
\vec{r}$ of $A$ with $y$ either existentially bound in $A$ (with $y
\vec{r}$ in the scope) or else free in $A$ and flexible in $Q$, the
$\vec{r}$ are distinct variables either $\lambda$- or universally
bound in $A$ (such that $y \vec{r}$ is in the scope) or else free in
$A$ and forbidden in $Q$.

A \emph{$Q$-substitution}\index{Q-substitution@$Q$-substitution} is a
substitution of $Q$-terms.

A \indexentry{pattern unification problem} $\C{U}$ consists of a
$\forall \exists \forall$-prefix $Q$ and a conjunction $C$ of
equations between $Q$-terms of the same type, i.e.\ $\bigland_{i=1}^n
r_i = s_i$.  We may assume that each such equation is of the form
$\lambda \vec{x} r = \lambda \vec{x} s$ with the same $\vec{x}$ (which
may be empty) and $r, s$ of ground type.

A \indexentry{solution} to such a unification problem $\C{U}$ is a
$Q$-substitution $\varphi$ such that for every $i$, $r_i \varphi = s_i
\varphi$ holds (i.e.\ $r_i \varphi$ and $s_i \varphi$ have the same
normal form).  We sometimes write $C$ as $\vec{r} = \vec{s}$, and (for
obvious reasons) call it a list of unification pairs.

We now define the pattern unification algorithm.  It takes a
unification problem $\C{U} = QC$ and returns a substitution $\rho$ and
another unification problem $\C{U}' = Q'C'$.  Note that $\rho$ will be
neither a $Q$-substitution nor a $Q'$-substitution, but will have the
property that
\begin{itemize}
\item $\rho$ is defined on flexible variables of $Q$ only, and its
value terms have no free occurrences of forbidden variables from $Q$,
\item if $G$ is a $Q$-goal, then $G \rho$ is a $Q'$-goal, and
\item whenever $\varphi'$ is a $\C{U}'$-solution, then $(\rho \circ
\varphi') {\restriction} Q_\exists$ is a $\C{U}$-solution.
\end{itemize}

\begin{definition*}[Pattern Unification Algorithm]
We distinguish cases according to the form of the unification problem,
and either give the transition done by the algorithm, or else state
that it fails.

\emph{Case} identity, i.e.\ $Q.r=r \land C$.  Then
\[
(Q.r=r \land C) \unifalg{\eps} QC.
\]

\emph{Case} $\xi$, i.e.\ $Q.\lambda \vec{x}\,r = \lambda \vec{x}\,s
\land C$.  We may assume here that the bound variables $\vec{x}$ are
the same on both sides.
\[
(Q.\lambda \vec{x}\,r = \lambda \vec{x}\,s \land C)
\unifalg{\eps} Q\forall \vec{x}.r = s \land C.
\]

\emph{Case} rigid-rigid, i.e.\ $Q.f \vec{r} = f \vec{s} \land C$
with $f$ either a signature variable or else a forbidden variable.
\[
(Q.f \vec{r} = f \vec{s} \land C) \unifalg{\eps} Q. \vec{r} = \vec{s} \land C.
\]

\emph{Case} flex-flex with equal heads, i.e.\ $Q.u \vec{y} = u \vec{z}
\land C$.
\[
(Q.u \vec{y} = u \vec{z} \land C) \unifalg{\rho} Q'.C \rho
\]
with $\rho = \subst{}{u}{\lambda \vec{y}.u' \vec{w}}$, $Q'$ is $Q$
with $\exists u$ replaced by $\exists u'$, and $\vec{w}$ an
enumeration of those $y_i$ which are identical to $z_i$ (i.e.\ the
variable at the same position in $\vec{z}$).  Notice that $\lambda
\vec{y}.u' \vec{w} = \lambda \vec{z}.u' \vec{w}$.

\emph{Case} flex-flex with different heads, i.e.\ $Q.u \vec{y} =
v \vec{z} \land C$.
\[
(Q.u \vec{y} = v \vec{z} \land C) \unifalg{\rho} Q' C \rho,
\]
where $\rho$ and $Q'$ are defined as follows.  Let $\vec{w}$ be an
enumeration of the variables both in $\vec{y}$ and in $\vec{z}$.  Then
$\rho = \subst{}{u,v}{\lambda \vec{y}.u' \vec{w}, \lambda \vec{z}.u'
\vec{w}}$, and $Q'$ is $Q$ with $\exists u, \exists v$ removed and
$\exists u'$ inserted.

\emph{Case} flex-rigid, i.e.\ $Q.u \vec{y} = t \land C$ with $t$ rigid,
i.e.\ not of the form $v \vec{z}$ with flexible $v$.

\emph{Subcase} occurrence check: $t$ contains (a critical
subterm with head) $u$.  Fail.

\emph{Subcase} pruning: $t$ contains a subterm $v \vec{w}_1 z \vec{w}_2$
with $\exists v$ in $Q$, and $z$ free in $t$ but not in $\vec{y}$.
\[
(Q.u \vec{y} = t \land C) \unifalg{\rho} Q'.u \vec{y} = t \rho
\land C \rho
\]
where $\rho = \subst{}{v}{\lambda \vec{w}_1 \lambda z \lambda
\vec{w}_2.v' \vec{w}_1 \vec{w}_2}$, $Q'$ is $Q$ with $\exists v$ 
replaced by $\exists v'$.

\emph{Subcase} pruning impossible: $\lambda \vec{y} t$ (after all pruning
steps are done still) has a free occurrence of a forbidden variable
$z$.  Fail.

\emph{Subcase} explicit definition: otherwise.
\[
(Q.u \vec{y} = t \land C) \unifalg{\rho} Q' C \rho
\]
where $\rho = \subst{}{u}{\lambda \vec{y} t}$, and $Q'$ is obtained
from $Q$ by removing $\exists u$.
This concludes the definition of the pattern unification algorithm.
\end{definition*}

Our next task is to prove that this algorithm indeed has the three
properties stated above.  The first one ($\rho$ is defined on flexible
variables of $Q$ only, and its value terms have no free occurrences of
forbidden variables from $Q$) is obvious from the definition.  We now
prove the second one; the third one will be proved next.

\begin{lemma} \mylabel{L:qprime}
If $Q \unifalg{\rho} Q'$ and $G$ is a $Q$-goal, then $G \rho$ is a
$Q'$-goal.
\end{lemma}

\begin{proof}
We distinguish cases according to the definition of the unification
algorithm.  All cases are straightforward:

\emph{Cases} identity, $\xi$ and rigid-rigid.  Then $\rho = \eps$
and the claim is trivial.

\emph{Case} flex-flex with equal heads.  Then $\rho =
\subst{}{u}{\lambda \vec{y}.u' \vec{w}}$ with $\vec{w}$ a sublist of
$\vec{y}$, and $Q'$ is $Q$ with $\exists u$ replaced by $\exists u'$.
Then clearly $\subst{G}{u}{\lambda \vec{y}.u' \vec{w}}$ is a $Q'$-goal
(recall that after a substitution we always normalize).

\emph{Case} flex-flex with different heads.  Then $\rho =
\subst{}{u,v}{\lambda \vec{y}.u' \vec{w}, \lambda \vec{z}.u' \vec{w}}$
with $\vec{w}$ an enumeration of the variables both in $\vec{y}$ and
in $\vec{z}$, and $Q'$ is $Q$ with $\exists u, \exists v$ removed and
$\exists u'$ inserted.  Again clearly $\subst{G}{u,v}{\lambda
\vec{y}.u' \vec{w}, \lambda \vec{z}.u' \vec{w}}$ is a $Q'$-goal.

\emph{Case} flex-rigid, \emph{Subcase} pruning: Then $\rho =
\subst{}{v}{\lambda \vec{w}_1, z, \vec{w}_2.v' \vec{w}_1 \vec{w}_2}$,
and $Q'$ is $Q$ with $\exists v$ replaced by $\exists v'$.  Suppose
$G$ is a $Q$-goal.  Then clearly $\subst{G}{v}{\lambda \vec{w}_1, z,
\vec{w}_2.v' \vec{w}_1 \vec{w}_2}$ is a $Q'$-goal.

\emph{Case} flex-rigid, \emph{Subcase} explicit definition: Then $\rho
= \subst{}{u}{\lambda \vec{y} t}$ with a $Q$-term $\lambda \vec{y} t$
without free occurrences of forbidden variables, and $Q'$ is obtained
from $Q$ by removing $\exists u$.  Suppose $G$ is a $Q$-goal.  Then
clearly $\subst{G}{u}{\lambda \vec{y} t}$ form) is a $Q'$-goal.
\end{proof}

Let $Q \unifprefixalg{\rho} Q'$ mean that for some $C, C'$ we have $QC
\unifalg{\rho} Q'C'$.  Write $Q \unifprefixalg{\rho}^* Q'$ if there
are $\rho_1, \dots, \rho_n$ and $Q_1, \dots, Q_{n-1}$ such that
\[
Q \unifprefixalg{\rho_1} Q_1 \unifprefixalg{\rho_2} \dots
\unifprefixalg{\rho_{n-1}} Q_{n-1} \unifprefixalg{\rho_n} Q',
\]
and $\rho = \rho_1 \circ \dots \circ \rho_n$.

\begin{corollary} \mylabel{C:qprimeit}
If $Q \unifprefixalg{\rho}^* Q'$ and $G$ is a $Q$-goal, then $G \rho$
is a $Q'$-goal. \fini
\end{corollary}

\begin{lemma} \mylabel{L:onestepunif}
Let a unification problem $\C{U}$ consisting of a $\forall \exists
\forall$-prefix $Q$ and a list $\vec{r} = \vec{s}$ of unification pairs
be given.  Then either 
\begin{itemize}
\item the unification algorithm makes a transition $\C{U}
\unifalg{\rho} \C{U}'$, and
\begin{align*}
\Phi' \colon &\C{U}'\hbox{-solutions} \to \C{U}\hbox{-solutions}\\
&\varphi' \mapsto (\rho \circ \varphi') {\restriction} Q_\exists
\end{align*}
is well-defined and we have $\Phi \colon \C{U}\hbox{-solutions} \to
\C{U}'\hbox{-solutions}$ such that $\Phi'$ is inverse to $\Phi$, i.e.\
$\Phi'(\Phi \varphi) = \varphi$, or else 
\item the unification algorithm fails, and there is no
$\C{U}$-solution.
\end{itemize}
\end{lemma}

\begin{proof}
\emph{Case} identity, i.e.\ $Q.r=r \land C \unifalg{\eps} QC$.  Let
$\Phi$ be the identity.

\emph{Case} $\xi$, i.e.\ $Q.\lambda \vec{x}\,r = \lambda \vec{x}\,s
\land C \unifalg{\eps} Q \forall \vec{x}.r=s \land C$.  Let again
$\Phi$ be the identity.

\emph{Case} rigid-rigid, i.e.\ $Q.f \vec{r} = f \vec{s} \land C
\unifalg{\eps} Q. \vec{r} = \vec{s} \land C$.  Let again $\Phi$ be the
identity.

\emph{Case} flex-flex with equal heads, i.e.\ $Q.u \vec{y} = u \vec{z}
\land C \unifalg{\rho} Q'.C \rho$ with $\rho = \subst{}{u}{\lambda
\vec{y}.u' \vec{w}}$, $Q'$ is $Q$ with $\exists u$ replaced by
$\exists u'$, and $\vec{w}$ an enumeration of those $y_i$ which are
identical to $z_i$ (i.e.\ the variable at the same position in
$\vec{z}$).  Notice that $\lambda \vec{y}.u' \vec{w} = \lambda
\vec{z}.u' \vec{w}$.

1.  $\Phi'$ is well-defined: Let $\varphi'$ be a $\C{U}'$-solution,
i.e.\ assume that $C \rho \varphi'$ holds.  We must show that $\varphi
:= (\rho \circ \varphi') {\restriction} Q_\exists$ is a
$\C{U}$-solution.

For $u \vec{y} = u \vec{z}$: We need to show $(u \varphi)\vec{y} = (u
\varphi)\vec{z}$.  But $u \varphi = u \rho \varphi' = (\lambda
\vec{y}.u' \vec{w})\varphi'$.  Hence $(u \varphi)\vec{y} = (u
\varphi)\vec{z}$ by the construction of $\vec{w}$.

For $(r = s) \in C$: We need to show $(r = s)\varphi$.  But by
assumption $(r = s)\rho \varphi'$ holds, and $r = s$ has all its
flexible variables from $Q_\exists$.

2.  Definition of $\Phi\colon \C{U}\hbox{-solutions} \to
\C{U}'\hbox{-solutions}$.  Let a $Q$-substitution $\varphi$ be given
such that $(u \vec{y} = u \vec{z})\varphi$ and $C \varphi$.  Define
$u'(\Phi \varphi) := \lambda \vec{w}.(u \varphi)\vec{w} \vec{0}$
(w.l.o.g), and $v(\Phi \varphi) := v$ for every other variable $v$ in
$Q_\exists$.

$\Phi \varphi =: \varphi'$ is a $\C{U}'$-solution: Let $(r = s) \in
C$.  Then $(r = s)\varphi$ by assumption, for $\varphi$ is a
$Q$-substitution such that $C \varphi$ holds.  We must show
\[
(r = s)\rho \varphi'.
\]
Notice that our assumption $(u \varphi) \vec{y} = (u \varphi) \vec{z}$
implies that the normal form of both sides can only contain the
variables in $\vec{w}$.  Therefore
\begin{alignat*}{2}
u \rho \varphi' &= (\lambda \vec{y}.u' \vec{w})\varphi' \\
&= \lambda \vec{y}.(\lambda \vec{w}.(u \varphi)\vec{w} \vec{0})\vec{w}\\
&= \lambda \vec{y}.(u \varphi)\vec{w} \vec{0}\\
&= \lambda \vec{y}.(u \varphi)\vec{y} \\
&= u \varphi
\end{alignat*}
and hence $(r = s)\rho \varphi'$.

3.  $\Phi' (\Phi \varphi) = \varphi$: So let $\varphi$ be an
$\C{U}$-solution, and $\varphi' := \Phi \varphi$.  Then
\begin{alignat*}{2}
u \bigl(\Phi'\varphi' \bigr) &= 
u \bigl((\rho \circ \varphi') {\restriction} Q_\exists \bigr)\\
&= u \rho \varphi'\\
&= u\varphi, &\quad& \hbox{as proved in 2.}
\end{alignat*}
For every other variable $v$ in $Q_\exists$ we obtain
\begin{align*}
v \bigl(\Phi'\varphi' \bigr) &= 
v \bigl((\rho \circ \varphi') {\restriction} Q_\exists \bigr)\\
&= v \rho \varphi'\\
&= v \varphi'\\
&= v \varphi.
\end{align*}

\emph{Case} flex-flex with different heads, i.e.\ $\C{U}$ is $Q.  u
\vec{y} = v \vec{z} \land C$.  Let $\vec{w}$ be an enumeration of the
variables both in $\vec{y}$ and in $\vec{z}$.  Then $\rho =
\subst{}{u,v}{\lambda \vec{y}.u' \vec{w}, \lambda \vec{z}.u'
\vec{w}}$, $Q'$ is $Q$ with $\exists u, \exists v$ removed and
$\exists u'$ inserted, and $\C{U}' = Q' C \rho$.

1.  $\Phi'$ is well-defined: Let $\varphi'$ be a $\C{U}'$-solution,
i.e.\ assume that $C \rho \varphi'$ holds.  We must show that $\varphi
:= (\rho \circ \varphi') {\restriction} Q_\exists$ is a $\C{U}$-solution.

For $u \vec{y} = v \vec{z}$: We need to show $(u \varphi)\vec{y} = (v
\varphi)\vec{z}$.  But $(u \varphi)\vec{y} = (u \rho \varphi')\vec{y}
= (\lambda \vec{y}.(u' \varphi')\vec{w})\vec{y} = (u'
\varphi')\vec{w}$, and similarly $(v \varphi)\vec{z} = (u'
\varphi')\vec{w}$.

For $(r = s) \in C$: We need to show $(r = s)\varphi$.  But since $u'$
is a new variable, $\varphi$ and $\rho \circ \varphi'$ coincide on all
variables free in $r = s$, and we have $(r = s)\rho \varphi'$ by
assumption.

2.  Definition of $\Phi\colon \C{U}\hbox{-solutions} \to
\C{U}'\hbox{-solutions}$.  Let a $Q$-substitution $\varphi$ be given
such that $(u \vec{y} = v \vec{z})\varphi$ and $C \varphi$.  Define
\begin{alignat*}{2}
u'(\Phi \varphi) &:= \lambda \vec{w}.(u \varphi)\vec{w} \vec{0}
&\quad& \hbox{w.l.o.g.; $\vec{0}$ arbitrary}\\
v'(\Phi \varphi) &:= \lambda \vec{w}.(v \varphi)\vec{0} \vec{w}\\
w(\Phi \varphi) &:= w \varphi
&& \hbox{otherwise, i.e.\ $w \ne u', v', u$ flexible.}
\end{alignat*}
Since by assumption $(u \varphi)\vec{y} = (v \varphi)\vec{z}$, the
normal forms of both $(u \varphi)\vec{y}$ and $(v \varphi)\vec{z}$ can
only contain the common variables $\vec{w}$ from $\vec{y}, \vec{z}$
free.  Hence, for $\varphi' := \Phi \varphi$, $u \rho \varphi' = u
\varphi$ by the argument in the previous case, and similarly $v \rho
\varphi' = v \varphi$.  Since $r \varphi = s \varphi$ ($(r = s) \in C$
arbitrary) by assumption, and $\rho$ only affects $u$ and $v$, we
obtain $r \rho \varphi' = s \rho \varphi'$, as required.  $\Phi' (\Phi
\varphi) = \varphi$ can now be proved as in the previous case.

\emph{Case} flex-rigid, $\C{U}$ is $Q.u \vec{y} = t \land C$.

\emph{Subcase} occurrence check: $t$ contains (a critical subterm with
head) $u$.  Then clearly there is no $Q$-substitution $\varphi$ such
that $(u \varphi)\vec{y} = t \varphi$.

\emph{Subcase} pruning: Here $t$ contains a subterm $v \vec{w}_1 z
\vec{w}_2$ with $\exists v$ in $Q$, and $z$ free in $t$.  Then $\rho =
\subst{}{v}{\lambda \vec{w}_1, z, \vec{w}_2.v' \vec{w}_1 \vec{w}_2}$,
$Q'$ is $Q$ with $\exists v$ replaced by $\exists v'$, and $\C{U}' =
Q'.u \vec{y} = t \rho \land C \rho$.

1.  $\Phi'$ is well-defined: Let $\varphi'$ be a $\C{U}'$-solution,
i.e.\ $(u \varphi')\vec{y} = t \rho \varphi'$, and $r \rho \varphi' =
s \rho \varphi'$ for $(r = s) \in C$.  We must show that $\varphi :=
(\rho \circ \varphi') {\restriction} Q_\exists$ is a $\C{U}$-solution.

For $u \vec{y} = t$: We need to show $(u \varphi)\vec{y} = t \rho
\varphi'$.  But 
\begin{alignat*}{2}
(u \varphi)\vec{y} &= (u \rho \varphi')\vec{y}\\
&= (u \varphi')\vec{y} &\quad& \hbox{since $\rho$ does not touch $u$}\\
&= t \rho \varphi' &&\hbox{by assumption.}
\end{alignat*}

For $(r = s) \in C$: We need to show $(r = s)\varphi$.  But since $v'$
is a new variable, $\varphi = (\rho \circ \varphi') {\restriction}
Q_\exists$ and $\rho \circ \varphi'$ coincide on all variables free in
$r = s$, and the claim follows from $(r = s)\rho \varphi'$.

2.  Definition of $\Phi\colon \C{U}\hbox{-solutions} \to
\C{U}'\hbox{-solutions}$.  For a $\C{U}$-solution $\varphi$ define
\begin{alignat*}{2}
v'(\Phi \varphi) &:= \lambda \vec{w}_1, \vec{w}_2.(v \varphi)\vec{w}_1
0 \vec{w}_2\\
w(\Phi \varphi) &:= w \varphi
&\quad& \hbox{otherwise, i.e.\ $w \ne v', v$ flexible.}
\end{alignat*}
Since by assumption $(u \varphi)\vec{y} = t \varphi$, the normal
form of $t \varphi$ cannot contain $z$ free.  Therefore, for $\varphi'
:= \Phi \varphi$, 
\begin{align*}
v \rho \varphi' &= (\lambda \vec{w}_1, z, \vec{w}_2.v' \vec{w}_1
\vec{w}_2)\varphi'\\
&= \lambda \vec{w}_1, z, \vec{w}_2.  (\lambda \vec{w}_1, \vec{w}_2.(v
\varphi)\vec{w}_1 0 \vec{w}_2) \vec{w}_1 \vec{w}_2\\
&= \lambda \vec{w}_1, z, \vec{w}_2.(v \varphi)\vec{w}_1 0 \vec{w}_2\\
&= \lambda \vec{w}_1, z, \vec{w}_2.(v \varphi)\vec{w}_1 z \vec{w}_2\\
&= v \varphi.
\end{align*}
Hence $\varphi' = \Phi \varphi$ satisfies $(u \varphi')\vec{y} = t
\rho \varphi'$.  For $r = s$ this follows by the same argument.
$\Phi' (\Phi \varphi) = \varphi$ can again be proved as in the
previous case.

\emph{Subcase} pruning impossible: Then $\lambda \vec{y} t$ has an
occurrence of a universally quantified (i.e.\ forbidden) variable $z$.
Therefore clearly there is no $Q$-substitution $\varphi$ such that $(u
\varphi)\vec{y} = t \varphi$.

\emph{Subcase} explicit definition.  Then $\rho = \subst{}{u}{\lambda
\vec{y} t}$, $Q'$ is obtained from $Q$ by removing $\exists u$, and
$\C{U}' = Q'C \rho$.  Note that $\rho$ is a $Q'$-substitution, for we
have performed the pruning steps.

1.  $\Phi'$ is well-defined: Let $\varphi'$ be a $\C{U}'$-solution,
i.e.\ $r \rho \varphi' = s \rho \varphi'$ for $(r = s) \in C$.  We
must show that $\varphi := (\rho \circ \varphi') {\restriction}
Q_\exists$ is an $\C{U}$-solution.

For $u \vec{y} = t$: We need to show $(u \rho \varphi')\vec{y} = t
\rho \varphi'$.  But
\begin{alignat*}{2}
(u \rho \varphi')\vec{y} &= ((\lambda \vec{y} t) \varphi')\vec{y}\\
&= t \varphi' \\
&= t \rho \varphi' &\quad& \hbox{since $u$ does not appear in $t$.}
\end{alignat*}

For $(r = s) \in C$: We need to show $(r = s)\varphi$.  But this
clearly follows from $(r = s)\rho \varphi'$.

2.  Definition of $\Phi\colon \C{U}\hbox{-solutions} \to
\C{U}'\hbox{-solutions}$, and proof of $\Phi'( \Phi \varphi) =
\varphi$.  For a $\C{U}$-solution $\varphi$ define $\Phi \varphi =
\varphi {\restriction} Q_\exists$.  Then
\[
u \rho \varphi' = \lambda \vec{y} t \varphi' = 
\lambda \vec{y} t \varphi = u \varphi,
\]
and clearly $ v \rho \varphi' = v \varphi$ for all other flexible
$\varphi$.  For $(r = s) \in C$, from $r \varphi = s \varphi$ we
easily obtain $r \varphi' = s \varphi'$.
\end{proof}

It is not hard to see that the unification algorithm terminates, by
defining a measure that decreases with each transition.  

\begin{corollary} \mylabel{C:patternunif}
Given a unification problem $\C{U} = QC$, the unification algorithm
either fails, and there is no $\C{U}$-solution, or else returns a pair
$(Q', \rho)$ with a \inquotes{transition} substitution $\rho$ and a
prefix $Q'$ (i.e.\ a unification problem $\C{U}'$ with no unification
pairs) such that for any $Q'$-substitution $\varphi'$, $(\rho \circ
\varphi') {\restriction} Q_\exists$ is an $\C{U}$-solution, and every
$\C{U}$-solution can be obtained in this way.  Since the empty
substitution is a $Q'$-substitution, $\rho {\restriction} Q_\exists$
is a $\C{U}$-solution, which is most general in the sense
stated. \fini
\end{corollary}


\section{Proof Search}
\mylabel{S:Search}
A \emph{$Q$-sequent}\index{Q-sequent@$Q$-sequent} has the form $\C{P}
\seqarrow G$, where $\C{P}$ is a list of $Q$-clauses and $G$ is a
$Q$-goal.

We write $M[\C{P}]$ to indicate that all assumption variables in the
derivation $M$ are assumptions of clauses in $\C{P}$.

Write $\vdash^n S$ for a set $S$ of sequents if there are derivations
$M_i^{G_i}[\C{P}_i]$ in long normal form for all $(\C{P}_i \seqarrow
G_i) \in S$ such that $\sum \dep{M_i} \le n$.  Let $\vdash^{<n} S$ mean
$\exists m{<}n\, \vdash^m S$.

We now prove correctness and completeness of the proof search
procedure: correctness is the if-part of the two lemmata to follow,
and completeness the only-if-part.

\begin{lemma} \mylabel{L:strip}
Let $Q$ be a $\forall \exists \forall$-prefix, $\{\C{P} \seqarrow
\forall \vec{x}.\vec{D} \to A\} \cup S$ $Q$-sequents with $\vec{x},
\vec{D}$ not both empty.  Then we have for every substitution
$\varphi$:
\[
\hbox{$\varphi$ is a $Q$-substitution such that $\vdash^n
\bigl(\{\C{P} \seqarrow \forall \vec{x}.\vec{D} \to A\} \cup S\bigr)
\varphi$}
\]
if and only if 
\[
\hbox{$\varphi$ is a $Q \forall \vec{x}$-substitution such that $\vdash^{<n}
\bigl(\{\C{P} \cup \vec{D} \seqarrow A\} \cup S\bigr) \varphi$.}
\]
\end{lemma}

\begin{proof}
\emph{\inquotes{If}}.  Let $\varphi$ be a $Q \forall
\vec{x}$-substitution and $\vdash^{<n} \bigl(\{\C{P} \cup \vec{D}
\seqarrow A\} \cup S\bigr) \varphi$.  So we have
\[
N^{A \varphi}[\vec{D} \varphi \cup \C{P} \varphi].
\]
Since $\varphi$ is a $Q \forall \vec{x}$-substitution, no variable in
$\vec{x}$ can be free in $\C{P} \varphi$, or free in $y \varphi$ for
some $y \in \dom(\varphi)$.  Hence
\[
M^{(\forall \vec{x}.\vec{D} \to A)\varphi}[\C{P} \varphi] :=
\lambda \vec{x} \lambda \vec{u}^{\vec{D} \varphi} N
\]
is a correct derivation.

\emph{\inquotes{Only if}}.  Let $\varphi$ be a $Q$-substitution and
$\vdash^n \bigl(\{\C{P} \seqarrow \forall \vec{x}.\vec{D} \to A\} \cup
S\bigr) \varphi$.  This means we have a derivation (in long normal
form)
\[
M^{(\forall \vec{x}.\vec{D} \to A)\varphi}[\C{P} \varphi] =
\lambda \vec{x} \lambda \vec{u}^{\vec{D} \varphi}.N^{A \varphi}
[\vec{D} \varphi \cup \C{P} \varphi].
\]
Now $\dep{N} < \dep{M}$, hence $\vdash^{<n} \bigl(\{\C{P} \cup \vec{D}
\seqarrow A\} \cup S\bigr) \varphi$, and $\varphi$ clearly is a $Q
\forall \vec{x}$-substitution.
\end{proof}

\begin{lemma} \mylabel{L:resolution}
Let $Q$ be a $\forall \exists \forall$-prefix, $\{\C{P} \seqarrow P
\vec{r}\} \cup S$ $Q$-sequents and $\varphi$ a substitution.  Then
\[
\hbox{$\varphi$ is a $Q$-substitution such that 
$\vdash^n \bigl(\{\C{P} \seqarrow P \vec{r}\} \cup S\bigr) \varphi$}
\]
if and only if there is a clause $\forall \vec{x}. \vec{G} \to P
\vec{s}$ in $\C{P}$ such that the following holds.  Let $\vec{z}$ be
the final universal variables in $Q$, $\vec{X}$ be new
(\inquotes{raised}) variables such that $X_i \vec{z}$ has the same
type as $x_i$, let $Q^*$ be $Q$ with the existential variables
extended by $\vec{X}$, and let $*$ indicate the substitution
$\subst{}{x_1, \dots, x_n}{X_1 \vec{z}, \dots, X_n \vec{z}}$.  Then
there is a result $(Q', \rho)$ of either Huet's or the
pattern unification algorithm applied to $Q^*. \vec{r}=\vec{s}^*$ and
a $Q'$-substitution $\varphi'$ such that $\vdash^{<n} \bigl(\{\C{P}
\seqarrow \vec{G}^*\} \cup S\bigr) \rho \varphi'$, and $\varphi =
(\rho \circ \varphi'){\restriction} Q_\exists$.
\end{lemma}

\begin{proof}
\emph{\inquotes{If}}.  Let $(Q', \rho)$ be such a result, and assume
that $\varphi'$ is a $Q'$-substitution such that $N_i \vdash
\bigl(\C{P} \seqarrow \vec{G}^*\bigr) \rho \varphi'$.  Let $\varphi :=
(\rho \circ \varphi') {\restriction} Q_\exists$.  From
$\unif{Q^*}{\vec{r}}{\vec{s}^*} = (Q', \rho)$ we know $\vec{r} \rho =
\vec{s}^* \rho$, hence $\vec{r} \varphi = \vec{s}^* \rho \varphi'$.
Then
\[
u^{(\forall \vec{x}. \vec{G} \to P \vec{s}) \varphi} 
\bigl( (\vec{X} \rho \varphi') \vec{z} \bigr)
\vec{N}^{\vec{G}^* \rho \varphi'}
\]
derives $P \vec{s}^* \rho \varphi'$ (i.e.\ $P \vec{r} \varphi$) from
$\C{P} \varphi$.

\emph{\inquotes{Only if}}.  Assume $\varphi$ is a $Q$-substitution
such that $\vdash (\C{P} \seqarrow P \vec{r}) \varphi$, say by
$u^{(\forall \vec{x}. \vec{G} \to P \vec{s})\varphi} \vec{t}
\vec{N}^{\subst{(\vec{G} \varphi)}{\vec{x}}{\vec{t}}}$, with $\forall
\vec{x}. \vec{G} \to P \vec{s}$ a clause in $\C{P}$, and with
additional assumptions from $\C{P} \varphi$ in $\vec{N}$.  Then
$\vec{r} \varphi = \subst{(\vec{s} \varphi)}{\vec{x}}{\vec{t}}$.
Since we can assume that the variables $\vec{x}$ are new and in
particular not range variables of $\varphi$, with
\[
\vartheta := \varphi \cup \subst{}{\vec{x}}{\vec{t}}
\]
we have $\vec{r} \varphi = \vec{s} \vartheta$.  Let $\vec{z}$ be the
final universal variables in $Q$, $\vec{X}$ be new (\inquotes{raised})
variables such that $X_i \vec{z}$ has the same type as $x_i$, let
$Q^*$ be $Q$ with the existential variables extended by $\vec{X}$, and
for terms and formulas let $*$ indicate the substitution
$\subst{}{x_1, \dots, x_n}{X_1 \vec{z}, \dots, X_n \vec{z}}$.
Moreover, let
\[
\vartheta^* := \varphi \cup \subst{}{X_1, \dots, X_n}{\lambda \vec{z}.t_1,
\dots, \lambda \vec{z}.t_n}.
\]
Then $\vec{r} \vartheta^* = \vec{r} \varphi = \vec{s} \vartheta =
\vec{s}^* \vartheta^*$, i.e.\ $\vartheta^*$ is a solution to the
unification problem given by $Q^*$ and $\vec{r} = \vec{s}$.  Hence by
Corollary~\ref{C:unif} $\unif{Q^*}{\vec{r}}{\vec{s}^*} = (Q', \rho)$
and there is a $Q'$-substitution $\varphi'$ such that $\vartheta^* =
(\rho \circ \varphi'){\restriction} Q^*_\exists$, hence $\varphi =
(\rho \circ \varphi'){\restriction} Q_\exists$.  Also,
$\subst{(\vec{G} \varphi)}{\vec{x}}{\vec{t}} = \vec{G} \vartheta =
\vec{G}^* \vartheta^* = \vec{G}^* \rho \varphi'$.
\end{proof} 

A \indexentry{state} is a pair $(Q,S)$ with $Q$ a prefix and $S$ a
finite set of $Q$-sequents.  By the two lemmas just proved we have
\emph{state transitions}\index{state transition}
\begin{align*}
(Q,\{\C{P} \seqarrow \forall \vec{x}.\vec{D} \to A\} \cup S) &\mapsto^\eps
(Q \forall \vec{x}, \{\C{P} \cup \vec{D} \seqarrow A\} \cup S)\\
(Q,\{\C{P} \seqarrow P \vec{r}\} \cup S) &\mapsto^\rho
(Q',(\{\C{P} \seqarrow \vec{G}^*\} \cup S) \rho),
\end{align*}
where in the latter case there is a clause $\forall \vec{x}. \vec{G}
\to P \vec{s}$ in $\C{P}$ such that the following holds.  Let
$\vec{z}$ be the final universal variables in $Q$, $\vec{X}$ be new
(\inquotes{raised}) variables such that $X_i \vec{z}$ has the same
type as $x_i$, let $Q^*$ be $Q$ with the existential variables
extended by $\vec{X}$, and let $*$ indicate the substitution
$\subst{}{x_1, \dots, x_n}{X_1 \vec{z}, \dots, X_n \vec{z}}$, and
$\unif{Q^*}{\vec{r}}{\vec{s}^*} = (Q', \rho)$.

Notice that by Lemma~\ref{L:qprime}, if $\C{P} \seqarrow P \vec{r}$ is
a \emph{$Q$-sequent}\index{Q-sequent@$Q$-sequent} (which means that
$\bigland \C{P} \to P \vec{r}$ is a $Q$-goal), then $(\C{P} \seqarrow
\vec{G}^*) \rho$ is a $Q'$-sequent.

\begin{theorem}
Let $Q$ be a prefix, and $S$ be a set of $Q$-sequents.  For every
substitution $\varphi$ we have: $\varphi$ is a $Q$-substitution
satisfying $\vdash S\varphi$ iff there is a prefix $Q'$, a
substitution $\rho$ and a $Q'$-substitution $\varphi'$ such that
\begin{align*}
&(Q,S) \mapsto^{\rho *} (Q', \emptyset),\\
&\varphi = (\rho \circ \varphi'){\restriction} Q_\exists.
\end{align*}
\end{theorem}

\begin{examples*}
\begin{enumeratei}
\item The sequent $\forall y.\forall z Ryz \to Q, \forall y_1,y_2
Ry_1y_2 \seqarrow Q$ leads first to $\forall y_1,y_2 Ry_1y_2 \seqarrow
Ryz$ under $\exists y\forall z$, then to $y_1 = y \land y_2 = z$ under
$\exists y\forall z \exists y_1,y_2$, and finally to $Y_1 z = y \land
Y_2 z = z$ under $\exists y,Y_1, Y_2\forall z$, which has the solution
$Y_1 = \lambda z y$, $Y_2 = \lambda z z$.
\item $\forall y.\forall z Ryz \to Q, \forall y_1 Ry_1y_1 \seqarrow Q$
leads first to $\forall y_1 Ry_1y_1 \seqarrow Ryz$ under $\exists
y\forall z$, then to $y_1 = y \land y_1 = z$ under $\exists y\forall z
\exists y_1$, and finally to $Y_1 z = y \land Y_1 z = z$ under
$\exists y, Y_1\forall z$, which has no solution.
\item Here is a more complex example (derived from proofs of the
Orevkov-formulas), for which we only give the derivation tree.
\def\defaultHypSeparation{\hskip.1in}
\def\ScoreOverhang{1pt} 
\[
\AxiomC{$\forall y.(\forall z Ryz {\to} \bot) {\to} \bot$}
\UnaryInfC{$(\forall z R0z {\to} \bot) {\to} \bot$}
\AxiomC{$\forall y.(\forall z_1 Ryz_1 {\to} \bot) {\to} \bot$}
\UnaryInfC{$(\forall z_1 Rzz_1 {\to} \bot) {\to} \bot$}
\AxiomC{$\forall z S0z {\to}\bot$}
\UnaryInfC{$S0z_1 {\to}\bot$}
\AxiomC{$(*)$}
\AxiomC{$R0z$}
\AxiomC{$Rzz_1$}
\TrinaryInfC{$S0z_1$}
\BinaryInfC{$\bot$}
\UnaryInfC{$Rzz_1 {\to} \bot$}
\UnaryInfC{$\forall z_1 Rzz_1 {\to} \bot$}
\BinaryInfC{$\bot$}
\UnaryInfC{$R0z {\to} \bot$}
\UnaryInfC{$\forall z R0z {\to} \bot$}
\BinaryInfC{$\bot$}
\DisplayProof
\]
where $(*)$ is a derivation from Hyp$_1 \colon \forall z,z_1. R0z \to
Rz z_1 \to S0z_1$.
\end{enumeratei}
\end{examples*}

\section{Extension by $\land$ and $\exists$}
\mylabel{S:Ext}
The extension by conjunction is rather easy; it is even superfluous in
principle, since conjunctions can always be avoided at the expense of
having lists of formulas instead of single formulas.

However, having conjunctions available is clearly useful at times, so
let's add it.  This requires the notion of an \indexentry{elaboration
path} for a formula (cf.\ \cite{Miller91b}).  The reason is that the
property of a formula to have a unique atom as its \indexentry{head}
is lost when conjunctions are present.  An elaboration path is meant
to give the directions (left or right) to go when we encounter a
conjunction as a strictly positive subformula.  For example, the
elaboration paths of $\forall x A \land (B \land C \to D \land \forall
y E)$ are $(\texttt{left})$, $(\texttt{right}, \texttt{left})$ and
$(\texttt{right}, \texttt{right})$.  Clearly, a formula is equivalent
to the conjunction (over all elaboration paths) of all formulas
obtained from it by following an elaboration path (i.e.\ always
throwing away the other part of the conjunction).  In our example,
\[
\forall x A \land (B \land C \to D \land \forall y E) \leftrightarrow
\forall x A \land (B \land C \to D) \land (B \land C \to \forall y E).
\]
In this way we regain the property of a formula to have a unique head,
and our previous search procedure continues to work.

For the existential quantifier $\exists$ the problem is of a
different nature.  We chose to introduce $\exists$ by means of axiom
schemata.  Then the problem is which of such schemes to use in 
proof search, given a goal $G$ and a set $\C{P}$ of clauses.  We
might proceed as follows.

List all prime, positive and negative existential subformulas of
$\C{P} \seqarrow G$, and remove any formula from those lists which is
of the form of another one\footnote{To do this, for patterns the dual
of the theory of \inquotes{most general unifiers}, i.e.\ a theory of
\inquotes{most special generalizations}, needs to be developed.}.  For
every positive existential formula -- say $\exists x B$ -- add (the
generalization of) the existence introduction scheme
\[
\excI_{x,B} \colon \forall x.B \to \exists x B
\]
to $\C{P}$.  Moreover, for every negative existential formula -- say
$\exists x A$ -- and every (prime or existential) formula $C$ in any
of those two lists, exept the formula $\exists x A$ itself, add (the
generalization of) the existence elimination scheme
\[
\excE_{x,A,B} \colon \exists x A \to (\forall x.A \to B) \to B
\]
to $\C{P}$.  Then start the search algorithm as described in
Section~\ref{S:Search}.  The normal form theorem for the natural
deduction system of minimal logic with $\exists$ then guarantees 
completeness.

However, experience has shown that this complete search procedure
tends to be trapped in too large a search space.  Therefore in our
actual implementation we decided to only take instances of the
existence elimination scheme with \emph{existential} conclusions.

Moreover, it seems appropriate that -- before the search is started --
one eliminates in a preprocessing step as many existential quantifiers
as possible.  We shall discuss in the following to what extent this
might be done.  As a preparation, we first prove a lemma.

Call a formula \emph{decidable}\index{formula!decidable}, if it is
built from atoms $\atom(t)$ and contains boolean quantifiers only
(i.e., only quantifiers $\forall b$ or $\ex b$ with variables $b$ of
type $\typeBool$).

\begin{remark*}
  Notice that this is a rather crude syntactical notion of
  decidability for formulas; a more elaborate version would also allow
  bounded quantification over e.g.\ the natural numbers.  The lemma to
  follow says that it implies the derivability of $D \lorc \neg D$,
  for the usual second order definition of $\lorc$.
\end{remark*}

\begin{lemma*}[Case distinction on decidable formulas]
  For decidable formulas $D$ we have
  \[
  \vdash_i (D \to A) \to (\neg D \to A) \to A.
  \]
\end{lemma*}

\begin{proof}
  By induction on $D$.  \emph{Case} $\atom(t)$.  To prove
  \[
  \vdash (\atom(p) \to A) \to (\neg \atom(p) \to A) \to A,
  \]
  use boolean induction, and the truth axiom $\atom(\true)$.

  \emph{Case} $D \to E$.  We have to show
  \[
  \vdash_i ((D \to E) \to A) \to (\neg (D \to E) \to A) \to A.
  \]
  By IH it suffices to argue by cases on $D$ and $E$.  We proceed
  informally.  If $E$ holds, then we have $D \to E$ and hence $A$.  If
  $\neg E$ holds, then distinguish cases on $D$.  If $D$ holds, then
  $\neg(D \to E)$, hence $A$.  If $\neg D$ holds, then $D \to E$ by
  ex-falso, hence $A$.

  \emph{Case} $D \land E$.  Easy, again using the IH, and cases on $D$
  and $E$.

  \emph{Case} $\ex p D$.  We must show
  \[
  \vdash_i (\ex p D \to A) \to (\neg \ex p D \to A) \to A.
  \]
  By IH it suffices to argue by cases on $\subst{D}{p}{\true}$ and
  $\subst{D}{p}{\false}$.  If either $\subst{D}{p}{\true}$ or
  $\subst{D}{p}{\false}$ hold, then we clearly have $A$, by the
  assumption $\ex p D \to A$.  If both $\neg \subst{D}{p}{\true}$ and
  $\neg \subst{D}{p}{\false}$ hold, then $\forall p \neg D$ (by boolean
  induction), hence $\neg \ex p D$, hence $A$ by the assumption $\neg
  \ex p D \to A$.

  \emph{Case} $\forall p D$.  We must show
  \[
  \vdash_i (\forall p D \to A) \to (\neg \forall p D \to A) \to A.
  \]
  Use $\forall p D \leftrightarrow \subst{D}{p}{\true} \land
  \subst{D}{p}{\false}$ (provable by boolean induction), and the IH 
  for $\subst{D}{p}{\true}$ and $\subst{D}{p}{\false}$.
\end{proof}

\begin{lemma*}[Independence of premise for decidable formulas]
  For decidable formulas $D$ we have
  \[
  \vdash_i (D \to \ex x A) \to \ex x.D \to A.
  \]
\end{lemma*}

\begin{proof}
  One can see easily that
  \begin{align*}
    &\vdash (D \to \ex x A) \to D \to \ex x. D \to A,
    \\
    &\vdash_i \neg D \to \ex x. D \to A.
  \end{align*}
  Now use case distinction on decidable formulas (i.e., the lemma above).
\end{proof}

We now assign to every formula $A$ an \inquotes{existentially reduced}
formula $A^*$ equivalent to $A$.  It is obtained by first moving
existential quantifiers to the front (as much as possible), and then
-- if they appear to the left of an implication -- changing them into
universal quantifiers (again as much as possible).  Both processes are
done simultaneously in the following definition.

\begin{definition*}[$A^*$]
  In the recursive cases below, assume $A^* = \ex \vec{x} A_0$
  with $A_0$ not an existential formula, and similarly for $B$.
  \begin{align*}
    \atom(t)^* &:= \atom(t),
    \\
    (A \land B)^* &:= \ex \vec{x} \ex \vec{y}. A_0 \land B_0,
    \\
    (A \to B)^* &:= \begin{cases}
      \ex \vec{y}. A^* \to B_0 &\text{if $A$ is decidable,}\\
      \forall \vec{x}. A_0 \to B^* &\text{else, and $\vec{x}$ not empty,}\\
      A^* \to B^* &\text{otherwise,}\end{cases}
    \\
    (\forall x A)^* &:= \forall x A^*,
    \\
    (\ex x A)^* &:= \ex x A^*.
  \end{align*}
\end{definition*}

\begin{theorem*}
  $\vdash_i A \leftrightarrow A^*$.
\end{theorem*}

\begin{proof}
  Use independence of premise for decidable formulas.
\end{proof}


\section{Notes}\mylabel{N:Search}
I have benefitted from a presentation of Miller's \cite{Miller91b}
given by Ulrich Berger, in a logic seminar in M\"unchen in June 1991.
The type of restriction to higher order terms described in the text
has been introduced in \cite{Miller91b}; it has been called
\indexentry{patterns} by Nipkow \cite{Nipkow91}.  Miller also noted
its relevance for extensions of logic programming, and showed that the
unification problem for patterns is solvable and admits most general
unifiers.  The present treatment was motivated by the desire to use
Miller's approach as a basis for an implementation of a simple proof
search engine for (first and higher order) minimal logic.  This goal
prompted us into several simplifications, optimizations and
extensions, in particular the following.
\begin{itemize}
\item Instead of arbitrarily mixed prefixes we only use those of the
  form $\forall \exists \forall$.  Nipkow in \cite{Nipkow91} already
  had presented a version of Miller's pattern unification algorithm
  for such prefixes, and Miller in \cite[Section~9.2]{Miller91b} notes
  that in such a situation any two unifiers can be transformed into
  each other by a variable renaming substitution.  Here we restrict
  ourselves to $\forall \exists \forall$-prefixes throughout, i.e.\ in
  the proof search algorithm as well.
\item The order of events in the pattern unification algorithm is
  changed slightly, by postponing the raising step until it is really
  needed.  This avoids unnecessary creation of new higher type
  variables.  -- Already Miller noted in \cite[p.515]{Miller91b} that
  such optimizations are possible.
\item The extensions concern the (strong) existential quantifier,
  which has been left out in Miller's treatment, and also conjunction.
  The latter can be avoided in principle, but of course is a useful
  thing to have.
\end{itemize}
Moreover, since part of the motivation to write this exposition was
the necessity to have a guide for our implementation, we have paid
particular attention to write at least the parts of the proofs with
algorithmic content as clear and complete as possible.


\chapter{Program Extraction from Constructive Proofs}\mylabel{C:Extr}

\section{Quantifiers Without Computational Content}
\mylabel{S:NC} For program extraction it is useful to distinguish
between quantifiers with and without computational content.  

\subsection{Rules for $\allnc$ and $\exnc$}
\mylabel{SS:RulesAllnc} We introduce $\allnc$ and $\exnc$ to indicate
that there should be \textbf{n}o computational \textbf{c}ontent.  The
logical meaning of these quantifiers is unchanged.  However, we have
to observe a special \emph{variable condition for
  $\allnc$-introduction}\index{variable condition!for
  allnc-introduction@for $\allnc$-introduction}: the variable to be
abstracted should not be a \indexentry{computational variable} in the
given proof, i.e.\ the extracted program of this proof should not
depend on $x$.  So the rules for $\allnc$ are
\[
\AxiomC{$\phantom{M} \mid M$}
\noLine
\UnaryInfC{$A$}
\RightLabel{$\allncI x$
\quad\hbox{($\dots$ \emph{and} $x \notin \FV(\extrTer{M})$)}}
\UnaryInfC{$\allnc x A$}
\DisplayProof
\qquad
\AxiomC{$\phantom{M} \mid M$}
\noLine
\UnaryInfC{$\allnc x A$}
\AxiomC{$t$}
\RightLabel{$\allncE$}
\BinaryInfC{$\subst{A}{x}{t}$}
\DisplayProof
\]
Here $\extrTer{M}$ is the extracted term (or program) of $M$, defined
below.  The derivation term for the rule $\allncI x$ is written
$\lamnc x M$.

The existence introduction and elimination schemes
\[\begin{split}
\excI_{x,B} \colon &\forall x.B \to \ex x B
\\
\excE_{x,A,B} \colon &\ex x A \to (\forall x.A \to B) \to B
\quad \hbox{with $x \notin \FV(B)$.}\end{split} \]
need to be modified for the $\mathsf{nc}$-versions, to
\[\begin{split}
\exncI_{x,B} \colon &\allnc x.B \to \exnc x B
\\
\exncE_{x,A,B} \colon &\exnc x A \to (\allnc x.A \to B) \to B
\quad \hbox{with $x \notin \FV(B)$.}
\end{split} \]

\subsection{Properties of $\allnc$ and $\exnc$}
\mylabel{SS:PropAllnc}

\begin{lemma*}[$\allnc$ implies $\forall$]
$\vdash \allnc x A \to \forall x A$.
\end{lemma*}

\begin{proof}
\[
\AxiomC{$u \colon \allnc x A$}
\AxiomC{$x$}
\BinaryInfC{$A$}
\RightLabel{$\allI \, x$}
\UnaryInfC{$\forall x A$}
\DisplayProof
\]
Here only the usual variable condition needs to be observed, which
clearly is satisfied.
\end{proof}

\begin{lemma*}[$\forall$ implies $\allnc$]
  $\vdash \forall x A \to \allnc x A$, provided $\tau(A)=\nulltype$.
\end{lemma*}

\begin{proof}
  \[
  \AxiomC{$u \colon \forall x A$}
  \AxiomC{$x$}
  \BinaryInfC{$A$}
  \RightLabel{$\allncI \, x$\quad\hbox{(with var.cond.)}}
  \UnaryInfC{$\allnc x A$}
  \DisplayProof
  \]
  For the final inference to be correct we need $\tau(A)=\nulltype$.
\end{proof}

We show that $\ex x A$ implies $\exnc x A$.  The converse cannot be
expected, since there is no way to provide the $x$ necessary to prove
$\ex x A$ when we only know $\exnc x A$.

\begin{lemma*}[$\ex$ implies $\exnc$]
  $\vdash \ex x A \to \exnc x A$.
\end{lemma*}

\begin{proof}
  \[
  \AxiomC{$\exncE_{x,A,B}$}
  \AxiomC{$\ex x A$}
  \AxiomC{L.($\allnc$ imp.\ $\forall$)}
  \AxiomC{$\exncI_{x,A} \colon \allnc x. A \to \exnc x A$}
  \BinaryInfC{$\forall x. A \to \exnc x A$}
  \TrinaryInfC{$\exnc x A$}
  \DisplayProof
  \]
\end{proof}

\begin{lemma*}[$\exnc$ implies $\exca$]
  $\vdash \exnc x A \to \exca x A$.
\end{lemma*}

\begin{proof}
  By definition, $\exca x A$ is $(\forall x.A \to F) \to F$.  Assume
  $\forall x.A \to F$.  Since this formula has no computational
  content (i.e., $\tau(\forall x.A \to F)=\nulltype$), we obtain
  $\allnc x.A \to F$.  Now from the assumption $\exnc x A$ the claim
  $F$ follows by the axiom $\exncE_{x,A.F}$.
\end{proof}

\subsection{Refining Axioms Using $\allnc$ and $\exnc$}
\mylabel{SS:RefineAx} This distinction between quantifiers with and
without computational content allows us to refine our axioms.
Generally, the universal closure of such an axiom should now be done
with $\allnc$-quantifiers.  For instance, the compatibility axiom is
taken to be
\[
\EqCompat_{x_1, A} \colon \allnc \vec{p}, x_1, x_2. x_1 \approx x_2 \to A \to
\subst{A}{x_1}{x_2}.
\]
The induction axioms can be refined; in case of the natural numbers we
obtain a version corresponding to iteration.  

\section{Computational Content of Proofs}
\mylabel{S:Cont} 

\subsection{The Type of a Formula}
\mylabel{SS:TypeFor} We assign to every formula $A$ an object
$\tau(A)$ (a type or the symbol $\nulltype$).  $\tau(A)$ is intended
to be the type of the program to be extracted from a proof of $A$.  In
case $\tau(A) = \nulltype$ proofs of $A$ have no computational
content; such formulas $A$ are called \emph{Harrop
  formulas}\index{Harrop formula}.

Recall that we allow free predicate variables, to be viewed as
placeholders for formulas (or more precisely, comprehension terms).
Since we do not know in advance which formula will be substituted for
a predicate variable, we use a type variable as the type of the
program to be extracted from a proof of an atom involving a predicate
variable.  Therefore our definition of $\tau(A)$ is relative to a
given assignment of type variables to some (see below) predicate
variables.
% of Harrop degree $0$.
\begin{align*}
\tau(P(\vec{s})) &:= \begin{cases}
\alpha_{P}
&\hbox{if $P$ is a predicate variable with assigned $\alpha_{P}$}\\
\nulltype &\hbox{otherwise}
\end{cases}
\\
\tau(\ex x^\rho A) &:= \begin{cases}
\rho &\hbox{if $\tau(A) = \nulltype$}\\
\rho \times \tau(A) &\hbox{otherwise}\end{cases}
\\
\tau(\forall x^\rho A) &:= \begin{cases}
\nulltype &\hbox{if $\tau(A) = \nulltype$}\\
\rho \to \tau(A) &\hbox{otherwise}\end{cases}
\\
\tau(\exnc x^\rho A) &:= \tau(A)
\\
\tau(\allnc x^\rho A) &:= \tau(A)
\\
\tau(A_0 \land A_1) &:= \begin{cases}
\tau(A_i) &\hbox{if $\tau(A_{1-i}) = \nulltype$}\\
\tau(A_0) \times \tau(A_1) &\hbox{otherwise}\end{cases}
\\
\tau(A \to B) &:= \begin{cases}
\tau(B) &\hbox{if $\tau(A) = \nulltype$}\\
\nulltype &\hbox{if $\tau(B) = \nulltype$}\\
\tau(A) \to \tau(B) &\hbox{otherwise}\end{cases}
\end{align*}

\subsection{The Program Extracted from a Derivation}
\mylabel{SS:ExtrTer} We now define, for a given derivation $M$ of a
formula $A$ with $\tau(A) \ne \nulltype$, its \emph{extracted
  program}\index{extracted program} $\extrTer{M}$ of type $\tau(A)$.
\begin{align*}
\extrTer{u^A} &:= x_u^{\tau(A)} \quad\hbox{
($x_u^{\tau(A)}$ uniquely associated with $u^A$)}
\\
\extrTer{\lambda u^A M} &:= \begin{cases}
\extrTer{M} &\hbox{if $\tau(A) = \nulltype$}\\
\lambda x_u^{\tau(A)}\extrTer{M} &\hbox{otherwise}\end{cases}
\\
\extrTer{M^{A \to B}N} &:= \begin{cases}
\extrTer{M} &\hbox{if $\tau(A) = \nulltype$}\\
\extrTer{M}\extrTer{N} &\hbox{otherwise}\end{cases}
\\
\extrTer{\langle M_0^{A_0},M_1^{A_1} \rangle} &:= \begin{cases}
\extrTer{M_i} &\hbox{if $\tau(A_{1-i}) = \nulltype$}\\
\langle \extrTer{M_0},\extrTer{M_1} \rangle &\hbox{otherwise}\end{cases}
\\
\extrTer{M^{A_0\land A_1} i} &:= \begin{cases}
\extrTer{M} &\hbox{if $\tau(A_{1-i}) = \nulltype$}\\
\extrTer{M} i&\hbox{otherwise}\end{cases}
\\
\extrTer{(\lambda x^\rho M)^{\forall x A}} &:= \lambda x^\rho \extrTer{M}
\\
\extrTer{M^{\forall x A}t} &:= \extrTer{M}t
\\
\extrTer{(\lambda x^\rho M)^{\allnc x A}} &:= \extrTer{M}
\\
\extrTer{M^{\allnc x A}t} &:= \extrTer{M}
\end{align*}
We also need extracted programs for induction, cases and
$\ex$-axioms; these will be defined below.  For derivations $M^A$
where $\tau(A) = \nulltype$ (i.e.\ $A$ is a Harrop formula) we define
$\extrTer{M} := \eps$ ($\eps$ some new symbol).  This applies in
particular if $A$ is $\ex$-free and contains no predicate variables.


\subsection{Extracted Program of an Induction Axiom}
\mylabel{SS:EtInd}
Recall the ge\-neral form of induction\index{induction} over
simultaneous free algebras $\vec{\mu} =
\mu\vec{\alpha} \,\vec{\kappa}$, with goal formulas $\forall
x_j^{\mu_j}\,A_j$, from Section~\ref{SS:Ind}.
For the constructor type
\[
\kappa_i = \vec{\rho} \to (\vec{\sigma}_1 \to \alpha_{j_1}) \to \dots \to
(\vec{\sigma}_n \to \alpha_{j_n}) \to \alpha_j \in
\constrtypes(\vec{\alpha})
\]
we have the \emph{step formula}
\begin{equation}\label{E:step}
\begin{split}
D_i :={} &\forall y_1^{\rho_1},\dots,y_m^{\rho_m},
y_{m+1}^{\vec{\sigma}_1 \to \mu_{j_1}},\dots,
y_{m+n}^{\vec{\sigma}_n \to \mu_{j_n}}.
\\
&\forall \vec{x}^{\vec{\sigma}_1} \,
\subst{A_{j_1}}{x_{j_1}}{y_{m+1} \vec{x}} \to \dots \to 
\\
&\forall \vec{x}^{\vec{\sigma}_n} \,
\subst{A_{j_n}}{x_{j_n}}{y_{m+n} \vec{x}} \to 
\\
&\subst{A_j}{x_j}{\constr_i^{\vec{\mu}}(\vec{y})}.
\end{split}
\end{equation}
Here $\vec{y} = y_1^{\rho_1},\dots,y_m^{\rho_m},
y_{m+1}^{\vec{\sigma}_1 \to \mu_{j_1}},\dots,
y_{m+n}^{\vec{\sigma}_n \to \mu_{j_n}}$ are the
\emph{components} of the object $\constr_i^{\vec{\mu}}(\vec{y})$
of type $\mu_j$ under consideration, and
\[
\forall \vec{x}^{\vec{\sigma}_1} \,
\subst{A_{j_1}}{x_{j_1}}{y_{m+1} \vec{x}}, \dots,
\forall \vec{x}^{\vec{\sigma}_n} \,
\subst{A_{j_n}}{x_{j_n}}{y_{m+n} \vec{x}}
\]
are the hypotheses available when proving the induction step.  The
induction axiom $\ind_{\mu_j}^{\vec{x},
\vec{A}}$\index{Ind@\texttt{Ind}} or shortly $\ind_{j}$ then proves
the universal closure (w.r.t.\ $\allnc$) of the formula
\[
D_1 \to \dots \to D_k \to \forall x_j^{\mu_j}\,A_j.
\]

$\extrTer{\ind_{j}}$ is defined to be the recursion operator
$\rec_{\mu_j}^{\vec{\mu}, \vec{\tau}}$.  Here $\vec{\mu}, \vec{\tau}$
list only the types $\mu_j,\tau_j$ with $\tau_j := \tau(A_j) \ne
\nulltype$, i.e.\ the recursion operator is simplified accordingly, as
indicated in Remark~\ref{R:simpRec}.  

% Moreover, $\rec_{\mu_j}^{\vec{\mu}, \vec{\tau}}$ is supposed to
% accomodate the parameters $\vec{p}$, which however do not influence
% its operational behaviour.

\begin{remark*}
  It is possible to use variants of the induction scheme, were some or
  all of the universal quantifiers in the step formula \eqref{E:step}
  have no computational content.
\end{remark*}

\begin{example*}
  For the induction scheme
\[
\ind_{n, A} \colon \subst{A}{n}{0} \to
(\forall n.  A \to \subst{A}{n}{n+1}) \to \forall n A
\]
we have
\[
\extrTer{\ind_{n,A}} := 
\rec_{\typeN}^{\tau} \colon \tau \to (\typeN \to \tau \to \tau) \to
\typeN \to \tau,
\]
where $\tau := \tau(A) \ne \nulltype$.  The variant
\[
\subst{A}{n}{0} \to
(\allnc n.  A \to \subst{A}{n}{n+1}) \to \forall n A
\]
has as extracted term the \indexentry{iteration operator} of type
$\tau \to (\tau \to \tau) \to \typeN \to \tau$.
% (or $\lambda \vec{p} \rec_{\typeN}^{\tau}$ if there are parameters
% $\vec{p}$, i.e.\ free variables in $\forall n A$).
\end{example*}

\subsection{Extracted Program of a Cases Axiom}
\mylabel{SS:EtCases}
Recall the cases axioms\index{cases
axiom}\index{cases-axiom@$\CasesAxiom$-axiom} from 
Section~\ref{SS:Cases}.  They again refer to simultaneous free
algebras $\vec{\mu} = \mu\vec{\alpha} \,\vec{\kappa}$, and goal
formulas $\forall x_j^{\mu_j}\,A_j$.  For the constructor type
\[
\kappa_i = \vec{\rho} \to (\vec{\sigma}_1 \to \alpha_{j_1}) \to \dots \to
(\vec{\sigma}_n \to \alpha_{j_n}) \to \alpha_j \in
\constrtypes(\vec{\alpha})
\]
we have the \emph{step formula}
\[
D_i := \forall y_1^{\rho_1},\dots,y_m^{\rho_m},
y_{m+1}^{\vec{\sigma}_1 \to \mu_{j_1}},\dots,
y_{m+n}^{\vec{\sigma}_n \to \mu_{j_n}}.
\subst{A_j}{x_j}{\constr_i^{\vec{\mu}}(\vec{y})}.
\]
Here $\vec{y} = y_1^{\rho_1},\dots,y_m^{\rho_m},
y_{m+1}^{\vec{\sigma}_1 \to \mu_{j_1}},\dots, y_{m+n}^{\vec{\sigma}_n
\to \mu_{j_n}}$ are the \emph{components} of the object
$\constr_i^{\vec{\mu}}(\vec{y})$ of type $\mu_j$ under consideration;
notice that no induction hypotheses are available.  The cases axiom
$\CasesAxiom_{x_j, A_j}$or shortly $\CasesAxiom_{j}$ then proves the
universal closure of the formula
\[
D_{i_1}, \dots, D_{i_q} \to \forall x_j^{\mu_j}\,A_j.
\]
where $D_{i_1}, \dots, D_{i_q}$ consists of all $D_i$ concerning
constructors for $\mu_j$.

$\extrTer{\CasesAxiom_{j}}$ is defined by means of the
\texttt{if}-construct\index{if-construct@\texttt{if}-construct} -- for
the reasons given in Remark~\ref{R:If} -- to be
\[
\extrTer{\CasesAxiom_{j}} := \lambda f_1 \dots \lambda f_q \lambda x
[\texttt{if} \ x\ f_1 \ \dots\ f_q],
\]
provided $\tau(A_j) \ne \nulltype$.

\begin{example*}
For the cases axioms
\begin{alignat*}{2}
&\CasesAxiom_{n, A} \colon \subst{A}{n}{0} \to
\forall n \subst{A}{n}{\suc n} \to \
\forall n^{\typeN} A,
\\
&\CasesAxiom_{l, A} \colon \subst{A}{l}{\nil} \to
\forall x,l \subst{A}{l}{\cons(x,l)} \to
\forall l^{\typeL{\alpha}} A.
\\
\intertext{we have}
&\extrTer{\CasesAxiom_{n, A}} := 
\lambda f_1 \lambda f_2 \lambda n
[\texttt{if} \ n\ f_1 \ f_2],
\\
&\extrTer{\CasesAxiom_{l, A}} := 
\lambda f_1 \lambda f_2 \lambda l
[\texttt{if} \ l\ f_1 \ f],
\end{alignat*}
where we assume $\tau(A) \ne \nulltype$.
\end{example*}


\subsection{Extracted Programs of Existence Axioms}
\mylabel{SS:EtEx}
For the axioms
\begin{alignat*}{2}
\excI_{x,B} \colon &\forall x^\rho.A \to \ex x^\rho A
&\quad&\text{\texttt{Ex-Intro}\index{Ex-Intro@\texttt{Ex-Intro}}}
\\
\excE_{x,A,B} \colon &\ex x^\rho A \to 
(\forall x^\rho.  A \to B) \to B
&\quad&\text{\texttt{Ex-Elim}\index{Ex-Elim@\texttt{Ex-Elim}}}
\end{alignat*}
we set
\begin{align*}
\extrTer{\excI_{x^\rho,A}} &:= \begin{cases}
\lambda x^\rho x &\hbox{if $\tau(A) = \nulltype$}\\
\lambda x^\rho \lambda y^{\tau(A)} \langle x, y\rangle &\hbox{otherwise}
\end{cases}
\\
\extrTer{\excE_{x^\rho,A,B}} &:= \begin{cases}
\lambda x^\rho \lambda f^{\rho \to \tau(B)}. fx 
&\hbox{if $\tau(A) = \nulltype$}\\
\lambda z^{\rho \times \tau(A)} \lambda f^{\rho \to \tau(A) \to \tau(B)}.
f(z 0)(z 1) &\hbox{otherwise}\end{cases}
\end{align*}
and for the axioms
\begin{alignat*}{2}
\exncI_{x,B} \colon &\allnc x^\rho.A \to \exnc x^\rho A
&\quad&\text{\texttt{Exnc-Intro}\index{Exnc-Intro@\texttt{Exnc-Intro}}}
\\
\exncE_{x,A,B} \colon &\exnc x^\rho A \to 
(\allnc x^\rho.  A \to B) \to B
&\quad&\text{\texttt{Exnc-Elim}\index{Exnc-Elim@\texttt{Exnc-Elim}}}
\end{alignat*}
we set
\begin{align*}
\extrTer{\exncI_{x^\rho,A}} &:= \lambda y^{\tau(A)} y
\\
\extrTer{\exncE_{x^\rho,A,B}} &:= \begin{cases}
\lambda z^{\tau(B)}. z
&\hbox{if $\tau(A) = \nulltype$}\\
\lambda y^{\tau(A)} \lambda f^{\tau(A) \to \tau(B)}.
f y&\hbox{otherwise}\end{cases}
\end{align*}


\subsection{Extracted Program of a Compatibility Axiom}
\mylabel{SS:EtCompat}
For the compatibility axiom 
\[
\EqCompat_{x_1, A} \colon \allnc \vec{p}, x_1, x_2. 
x_1 \approx x_2 \to A \to \subst{A}{x_1}{x_2}
\]
we set
\[
\extrTer{\EqCompat_{x_1, A}} := \lambda y^{\tau(A)} y.
\]


\section{Realizability}
\mylabel{S:Real} Finally we define the notion of \emph{(modified)
  realizability}\index{realizability}.  The term \inquotes{modified}
is used sometimes for historical reasons, to distinguish this form of
realizability from the (earlier) Kleene-style realizability.  More
precisely, we define formulas $r \mr A$, where $A$ is a formula and
$r$ is either a term of type $\tau(A)$ if the latter is a type, or the
symbol $\eps$ if $\tau(A) = \nulltype$.

\subsection{Definition of Realizability}
\mylabel{SS:DefReal} In order to define realizability for atoms built
with predicate variables, we have to provide for every predicate
variable $P$ of arity $\vec{\rho}$ with assigned $\alpha_{P}$ a new
predicate variable $P^{\mrind}$ of arity $\alpha_{P}, \vec{\rho}$.
\begin{align*}
r \mr P(\vec{s}) &\;=\;  \begin{cases}
P^{\mrind}(r, \vec{s})
&\hbox{if $P$ is a predicate variable with assigned $\alpha_{P}$}\\
P(\vec{s}) &\hbox{if $P$ is a predicate constant}
\end{cases}
\\
r \mr (\ex x A) &\;=\;  \begin{cases}
\eps \mr \subst{A}{x}{r} &\hbox{if $\tau(A) = \nulltype$}\\
r 1 \mr \subst{A}{x}{r 0} &\hbox{otherwise}\end{cases}
\\
r \mr (\forall x A) &\;=\;  \begin{cases}
\forall x. \eps \mr A &\hbox{if $\tau(A) = \nulltype$}\\
\forall x.r x \mr A &\hbox{otherwise}\end{cases}
\\
r \mr (\exnc x A) &\;=\;  \begin{cases}
\exnc x.\eps \mr A &\hbox{if $\tau(A) = \nulltype$}\\
\exnc x.r \mr A &\hbox{otherwise}\end{cases}
\\
r \mr (\allnc x A) &\;=\;  \begin{cases}
\allnc x. \eps \mr A &\hbox{if $\tau(A) = \nulltype$}\\
\allnc x.r \mr A &\hbox{otherwise}\end{cases}
\\
r \mr (A \to B) &\;=\;  \begin{cases}
\eps \mr A \;\to \; r \mr B &\hbox{if $\tau(A) = \nulltype$}\\
\forall x.x \mr A \;\to \; \eps \mr B 
&\hbox{if $\tau(A) \ne \nulltype = \tau(B)$}\\
\forall x.x \mr A \;\to \; rx \mr B &\hbox{otherwise}\end{cases}
\\
r \mr (A_0\land A_1) &\;=\;  \begin{cases}
\eps \mr A_0\;\land\; r \mr A_1 &\hbox{if $\tau(A_0) = \nulltype$}\\
r \mr A_0\;\land\;\eps \mr A_1 &\hbox{if $\tau(A_1) = \nulltype$}\\
r 0 \mr A_0\;\land\;r 1  \mr A_1 &\hbox{otherwise}\end{cases}
\end{align*}
Formulas which do not contain the existence quantifier $\ex$ play a
special role in this context; we call them
\emph{$\ex$-free}\index{formula!$\ex$-free} (or
\emph{invariant}\index{formula!invariant}) formulas; in the literature
such formulas are also called
\inquotes{negative}\index{formula!negative}.  Their crucial property is
that for an $\ex$-free formula $A$ without predicate variables $P$
with assigned $\alpha_{P}$ we have $\tau(A) = \nulltype$ and $\eps \mr
A = A$.  In particular, we have to assign an $\alpha_{P}$ to every
predicate variable $P$ of \inquotes{existence degree} $\ne 0$, which
means that it can be substituted by a formula containing $\ex$ or
other predicate variables $Q$ with assigned $\alpha_Q$.

For the formulation of the soundness theorem below it will be useful
to let $x_u := \eps$ if $u^A$ is an assumption variable with a Harrop
formula $A$.  The soundness theorem says that for every derivation $M$
of a formula $B$ there is a derivation $\mu(M)$ of $\extrTer{M} \mr B$
from assumptions $\set{x_u \mr C}{u^C\in \FA(M)}$.  We first tackle
this for the axioms.


\subsection{Realizing an Induction Axiom}\mylabel{SS:RealInd}
The induction axiom $\ind_{\mu_j}^{\vec{x},
\vec{A}}$\index{Ind@\texttt{Ind}} or shortly $\ind_{j}$ proves the
universal closure (w.r.t.\ $\allnc$) of the formula
\[
D_1 \to \dots \to D_k \to \forall x_j^{\mu_j}\,A_j,
\]
with step formulas $D_i$ from \eqref{E:step}.  We may assume
$\tau(A_j) \ne \nulltype$ for at least one $j$, for otherwise
$\extrTer{\ind_{j}} = \eps$ and we can easily find a
derivation $\mu(\ind_{j})$ of
\begin{align*}
&\eps \mr \bigl(\allnc \vec{p}. 
D_1 \to \dots \to D_k \to \forall x_j^{\mu_j}\,A_j \bigr)
\\
&= \allnc \vec{p}. \eps \mr 
\bigl(D_1 \to \dots \to D_k \to \forall x_j^{\mu_j}\,A_j\bigr)
\\
&= \allnc \vec{p}. \eps \mr D_1 \to \dots \to
\eps \mr D_k \to \forall x_j^{\mu_j} \eps \mr A_j.
\end{align*}
Indeed, $\mu(\ind_{j})$ is just $\ind_{\mu_j}^{x_1, \dots, x_N, \eps
\mr A_1, \dots, \eps \mr A_N}$.

Recall $\extrTer{\ind_{j}} = \rec_{j}$.  Hence we must find a
derivation $\mu(\ind_{j})$ of
\begin{align*}
&\rec_{j} \mr \bigl(\allnc \vec{p}. 
D_1 \to \dots \to D_k \to \forall x_j^{\mu_j}\,A_j \bigr)
\\
&= \allnc \vec{p}. \rec_{j} \vec{p} \mr 
\bigl(D_1 \to \dots \to D_k \to \forall x_j^{\mu_j}\,A_j\bigr)
\\
&= \allnc \vec{p}, f_1. f_1 \mr D_1 \to \dots \to
\forall f_k. f_k \mr D_k \to \forall x_j^{\mu_j}
\rec_{j} \vec{f} x_j^{\mu_j} \mr A_j.
\end{align*}
Notice that for the step formula $D_i$ spelled out in \eqref{E:step}
the formula $f_i \mr D_i$ is defined to be (we assume for simplicity
$\tau(A_j) \ne \nulltype$)
\begin{align*}
f_i \mr D_i := &\forall y_1^{\rho_1},\dots,y_m^{\rho_m},
y_{m+1}^{\vec{\sigma}_1 \to \mu_{j_1}},\dots,
y_{m+n}^{\vec{\sigma}_n \to \mu_{j_n}}
\\
&\forall z_1. \bigl(
\forall \vec{x}^{\vec{\sigma}_1} \,
z_1 \vec{x} \mr \subst{A_{j_1}}{x_{j_1}}{y_{m+1} \vec{x}} \bigr) \to \dots \to 
\\
&\forall z_n. \bigl(
\forall \vec{x}^{\vec{\sigma}_n} \,
z_n \vec{x} \mr \subst{A_{j_n}}{x_{j_n}}{y_{m+n} \vec{x}} \bigr) \to 
\\
&f_i \vec{y} z_1 \dots z_n \mr
\subst{A_j}{x_j}{\constr_i^{\vec{\mu}}(\vec{y})}.
\end{align*}
We proceed informally.  Assume $\vec{p}$, $f_1$, $u_1 \colon f_1 \mr
D_1$, $\dots$, $f_k$, $u_k \colon f_k \mr D_k$; our goal is $\forall
x_j^{\mu_j} \rec_{j} \vec{f} x_j^{\mu_j} \mr A_j$.  For the proof we
use simultaneous induction w.r.t.\ all $\forall x_j^{\mu_j} \rec_{j}
\vec{f} x_j^{\mu_j} \mr A_j$.  Hence it suffices to prove the step
formulas w.r.t.\ the latter induction, i.e.\ all formulas
\begin{align*}
D_i^{\mrind} := &\forall y_1^{\rho_1},\dots,y_m^{\rho_m},
y_{m+1}^{\vec{\sigma}_1 \to \mu_{j_1}},\dots,
y_{m+n}^{\vec{\sigma}_n \to \mu_{j_n}}.
\\
&\forall \vec{x}^{\vec{\sigma}_1} \,
\rec_{j_1} \vec{f}(y_{m+1} \vec{x}) \mr
\subst{A_{j_1}}{x_{j_1}}{y_{m+1} \vec{x}} \to \dots \to 
\\
&\forall \vec{x}^{\vec{\sigma}_n} \,
\rec_{j_n} \vec{f}(y_{m+n} \vec{x}) \mr
\subst{A_{j_n}}{x_{j_n}}{y_{m+n} \vec{x}} \to 
\\
&\rec_{j} \vec{f}(\constr_i^{\vec{\mu}}(\vec{y})) \mr
\subst{A_j}{x_j}{\constr_i^{\vec{\mu}}(\vec{y})}.
\end{align*}
So assume $y_1^{\rho_1},\dots,y_m^{\rho_m},
y_{m+1}^{\vec{\sigma}_1 \to \mu_{j_1}},\dots,
y_{m+n}^{\vec{\sigma}_n \to \mu_{j_n}}$ and
\begin{align*}
v_1 &\colon \forall \vec{x}^{\vec{\sigma}_1} \,
\rec_{j_1} \vec{f}(y_{m+1} \vec{x}) \mr
\subst{A_{j_1}}{x_{j_1}}{y_{m+1} \vec{x}}, \dots,
\\
v_n &\colon \forall \vec{x}^{\vec{\sigma}_n} \,
\rec_{j_n} \vec{f}(y_{m+n} \vec{x}) \mr
\subst{A_{j_n}}{x_{j_n}}{y_{m+n} \vec{x}}.
\end{align*}
We must show $\rec_{j} \vec{f}(\constr_i^{\vec{\mu}}(\vec{y})) \mr
\subst{A_j}{x_j}{\constr_i^{\vec{\mu}}(\vec{y})}$.  For the proof use
$u_i^{f_i \mr D_i}$ with
\[
\vec{y},
(\rec_{j_1} \vec{f}) \circ y_{m+1}, v_1,
\dots,
(\rec_{j_n} \vec{f}) \circ y_{m+n}, v_n
\]
and recall that
\[
\rec_{j} \vec{f}(\constr_i^{\vec{\mu}}(\vec{y})) =
f_i \vec{y}
\bigl((\rec_{j_1} \vec{f}) \circ y_{m+1} \bigr)
\dots,
\bigl((\rec_{j_n} \vec{f}) \circ y_{m+n} \bigr).
\]

\begin{examples*}
Consider a particular induction axiom, say on the natural numbers
$\typeN$:
\[
\ind_{n, A} \colon \allnc \vec{p}. \subst{A}{n}{0} \to 
(\forall n.A \to \subst{A}{n}{n+1}) \to
\forall n A.
\]
We must find a derivation $\mu(\ind_{n,A})$ of
\[
\extrTer{\ind_{n,A}} \mr \bigl(\allnc \vec{p}. \subst{A}{n}{0} \to 
(\forall n.A \to \subst{A}{n}{n+1}) \to
\forall n A \bigr).
\]

\emph{Case} $\tau(A) \ne \nulltype$.  Then $\extrTer{\ind_{n,A}} =
\rec_{\typeN}^{\tau}$ and we obtain
\begin{align*}
&\rec_{\typeN}^{\tau} \mr 
\allnc \vec{p}. \subst{A}{n}{0} \to 
(\forall n.A \to \subst{A}{n}{n+1}) \to
\forall n A
\\
&= \allnc \vec{p}\,\forall f_1. f_1 \mr \subst{A}{n}{0} \to 
\forall f_2. f_2 \mr (\forall n.A \to \subst{A}{n}{n+1}) \to
\\
&\qquad \forall n (\rec_{\typeN}^{\tau}f_1 f_2 n \mr A)
\\
&= \allnc \vec{p}\,\forall f_1. f_1 \mr \subst{A}{n}{0} \to 
\forall f_2. (\forall n,y. y \mr A \to f_2 n y \mr \subst{A}{n}{n+1}) \to
\\
&\qquad \forall n (\rec_{\typeN}^{\tau}f_1 f_2 n \mr A)
\end{align*}
Hence we can define $\mu(\ind_{n,A})$ to be the obvious inductive
proof of this formula, which uses the induction axiom
\begin{align*}
&\ind_{n,(\rec_{\typeN}^{\tau}f_1 f_2 n \mr A)} \colon \allnc \vec{p}.
\\
&\qquad \subst{(\rec_{\typeN}^{\tau}f_1 f_2 n \mr A)}{n}{0} \to
\\
&\qquad (\forall n. \rec_{\typeN}^{\tau}f_1 f_2 n \mr A \to
\subst{(\rec_{\typeN}^{\tau}f_1 f_2 n \mr A)}{n}{n+1}) \to
\\
&\qquad \forall n (\rec_{\typeN}^{\tau}f_1 f_2 n \mr A).
\end{align*}
Notice that because of our identification of $\beta \eta \rec$-equivalent
terms this is the same as
\begin{align*}
&\ind_{n,(\rec_{\typeN}^{\tau}f_1 f_2 n \mr A)} \colon \allnc \vec{p}.
\\
&\qquad f_1 \mr \subst{A}{n}{0} \to
\\
&\qquad (\forall n. \rec_{\typeN}^{\tau}f_1 f_2 n \mr A \to
f_2 n(\rec_{\typeN}^{\tau}f_1 f_2 n) \mr \subst{A}{n}{n+1}) \to
\\
&\qquad \forall n (\rec_{\typeN}^{\tau}f_1 f_2 n \mr A).
\end{align*}
Let
\begin{align*}
u_1 &\colon f_1 \mr \subst{A}{n}{0}
\\
u_2 &\colon \forall n,y. y \mr A \to f_2 n y \mr \subst{A}{n}{n+1}
\\
v &\colon \rec_{\typeN}^{\tau}f_1 f_2 n \mr A
\end{align*}
be assumption variables.  Then the proof term is
\[
\lambda \vec{p} \lambda f_1 \lambda u_1 \lambda f_2 \lambda u_2.
\ind_{n,(\rec_{\typeN}^{\tau}f_1 f_2 n \mr A)} \vec{p} u_1
(\lambda n \lambda v . u_2 n(\rec_{\typeN}^{\tau}f_1 f_2 n)v)
\]

\emph{Case} $\tau(A) = \nulltype$.  Then $\extrTer{\ind_{n,A}} = \eps$
and we obtain
\begin{align*}
&\eps \mr \allnc \vec{p}. \subst{A}{n}{0} \to 
(\forall n.A \to \subst{A}{n}{n+1}) \to
\forall n A
\\
&= \allnc \vec{p}. \eps \mr \subst{A}{n}{0} \to 
(\forall n. \eps \mr A \to \eps \mr \subst{A}{n}{n+1}) \to
\\
&\qquad \forall n (\eps \mr A)
\\
&= \allnc \vec{p}. \subst{(\eps \mr A)}{n}{0} \to 
(\forall n. \eps \mr A \to \subst{(\eps \mr A)}{n}{n+1}) \to
\\
&\qquad \forall n (\eps \mr A).
\end{align*}
Hence we can define $\mu(\ind_{n,A}) = \ind_{n,(\eps \mr A)}$.

Let us also treat an example of simultaneous induction.  Consider an
induction axiom for the simultaneously generated free algebras $\tree$
and $\tlist$:
\begin{align*}
\allnc \vec{p}. &\forall n \subst{A}{b}{\leaf\, n} \to
\\
&(\forall \bs. B \to \subst{A}{b}{\branch\, \bs}) \to
\\
&\subst{B}{\bs}{\emp} \to
\\
&(\forall b, \bs. A \to B \to \subst{B}{\bs}{\tcons \, b \, \bs}) \to
\\
&\forall b A
\end{align*}

\emph{Case} $\tau(A) \ne \nulltype \ne \tau(B)$.  Then 
$\extrTer{\ind_{b,\bs,A,B}} = \lambda \vec{p} \rec_{\tree}$ and we obtain
(writing $\vec{f}$ for $f_1 f_2 f_3 f_4$)
\begin{align*}
\lambda \vec{p} \rec_{\tree} \mr \allnc \vec{p}. 
&\forall n \subst{A}{b}{\leaf\, n} \to
\\
&(\forall \bs. B \to \subst{A}{b}{\branch\, \bs}) \to
\\
&\subst{B}{\bs}{\emp} \to
\\
&(\forall b, \bs. A \to B \to \subst{B}{\bs}{\tcons \, b \, \bs}) \to
\\
&\forall b A
\\
= \allnc \vec{p}. 
&\forall f_1. f_1 \mr \forall n \subst{A}{b}{\leaf\, n} \to
\\
&\forall f_2. f_2 \mr (\forall \bs. B \to \subst{A}{b}{\branch\, \bs}) \to
\\
&\forall f_3. f_3 \mr \subst{B}{\bs}{\emp} \to
\\
&\forall f_4. f_4 \mr 
(\forall b, \bs. A \to B \to \subst{B}{\bs}{\tcons \, b \, \bs}) \to
\\
&\forall b(\rec_{\tree} \vec{f} b \mr A)
\\
= \allnc \vec{p}. 
&\forall f_1. \forall n (f_1 n \mr \subst{A}{b}{\leaf\, n}) \to
\\
&\forall f_2. (\forall \bs,y. y \mr B \to 
f_2 \, \bs \,y \mr \subst{A}{b}{\branch\, \bs}) \to
\\
&\forall f_3. f_3 \mr \subst{B}{\bs}{\emp} \to
\\
&\forall f_4. (\forall b, \bs, y_1.
y_1 \mr A \to \forall y_2. y_2 \mr B \to
\\
&\qquad f_4\, b\, \bs \, y_1 \, y_2 \mr \subst{B}{\bs}{\tcons \, b \, \bs}) \to
\\
&\forall b(\rec_{\tree} \vec{f} b \mr A)
\end{align*}
Hence we can define $\mu(\ind_{b,\bs,A,B})$ to be the expected
inductive proof of this formula, which uses the induction axiom
\begin{align*}
&\ind_{b,\bs,(\rec_{\tree} \vec{f} b \mr A),
(\rec_{\tlist} \vec{f} \bs \mr B)} \colon \allnc \vec{p}\,\forall \vec{f}.
\\
&\quad 
\forall n \subst{(\rec_{\tree} \vec{f} b \mr A)}{b}{\leaf\, n} \to
\\
&\quad
(\forall \bs. \rec_{\tlist} \vec{f} \bs \mr B \to
\subst{(\rec_{\tree} \vec{f} b \mr A)}{b}{\branch\, \bs}) \to
\\
&\quad
\subst{(\rec_{\tlist} \vec{f} \bs \mr B)}{\bs}{\emp} \to
\\
&\quad
(\forall b, \bs. \rec_{\tree} \vec{f} b \mr A \to
\rec_{\tlist} \vec{f} \bs \mr B \to
\\
&\quad \qquad
\subst{(\rec_{\tlist} \vec{f} \bs \mr B)}{\bs}{\tcons \, b\, \bs}) \to
\\
&\quad
\forall b(\rec_{\tree} \vec{f} b \mr A)
\end{align*}
Because of the recursion equations
\begin{alignat*}{2}
&\rec_{\tree} \vec{f} (\leaf\, n) &&= f_1 n
\\
&\rec_{\tree} \vec{f} (\branch\, \bs) &&= 
f_2 \, \bs(\rec_{\tlist} \vec{f} \bs)
\\
&\rec_{\tlist} \vec{f} \emp &&= f_3
\\
&\rec_{\tlist} \vec{f} (\tcons \, b\, \bs) &&=
f_4\, b\, \bs(\rec_{\tree} \vec{f} b)(\rec_{\tlist} \vec{f} \bs)
\end{alignat*}
and our identification of $\beta \eta \rec$-equivalent terms this is
the same as
\begin{align*}
&\ind_{b,\bs,(\rec_{\tree} \vec{f} b \mr A),
(\rec_{\tlist} \vec{f} \bs \mr B)} \colon \allnc \vec{p}\,\forall \vec{f}.
\\
&\quad 
\forall n (f_1 n \mr \subst{A}{b}{\leaf\, n}) \to
\\
&\quad
(\forall \bs. \rec_{\tlist} \vec{f} \bs \mr B \to
f_2 \, \bs(\rec_{\tlist} \vec{f} \bs) \mr 
\subst{A}{b}{\branch\, \bs}) \to
\\
&\quad
f_3 \mr \subst{B}{\bs}{\emp} \to
\\
&\quad
(\forall b, \bs. \rec_{\tree} \vec{f} b \mr A \to
\rec_{\tlist} \vec{f} \bs \mr B \to
\\
&\quad \qquad
f_4\, b\, \bs(\rec_{\tree} \vec{f} b)(\rec_{\tlist} \vec{f} \bs)
\mr \subst{B}{\bs}{\tcons \, b\, \bs}) \to
\\
&\quad
\forall b(\rec_{\tree} \vec{f} b \mr A)
\end{align*}
Let
\begin{align*}
u_1 &\colon \forall n(f_1 n \mr \subst{A}{b}{\leaf\, n})
\\
u_2 &\colon \forall \bs,y. y \mr B \to 
f_2 \, \bs \, y \mr \subst{A}{b}{\branch\, \bs}
\\
u_3 &\colon f_3 \mr \subst{B}{\bs}{\emp}
\\
u_4 &\colon \forall b, \bs, y_1. y_1 \mr A \to \forall y_2. y_2 \mr B \to 
f_4\, b\, \bs \, y_1 \, y_2 \mr \subst{B}{\bs}{\tcons \, b\, \bs}
\end{align*}
be assumption variables.  Then the proof term is
\begin{align*}
\lambda \vec{p}
&\lambda f_1 \lambda u_1 
\lambda f_2 \lambda u_2
\lambda f_3 \lambda u_3
\lambda f_4 \lambda u_4.
\ind_{b,\bs,(\rec_{\tree} \vec{f} b \mr A),
(\rec_{\tlist} \vec{f} \bs \mr B)} \vec{p} \vec{f}
\\
&u_1
(\lambda \bs. u_2 \, \bs(\rec_{\tlist} \vec{f} \bs))
u_3
(\lambda b \lambda \bs. u_4\, b \, \bs 
(\rec_{\tree} \vec{f} b)v(\rec_{\tlist} \vec{f} \bs))
\end{align*}

\emph{Case} $\tau(A) = \nulltype \ne \tau(B)$.  Then
$\extrTer{\ind_{b,\bs,A,B}} = \eps$ and we obtain
\begin{align*}
\eps \mr \allnc \vec{p}. 
&\forall n \subst{A}{b}{\leaf\, n} \to
\\
&(\forall \bs. B \to \subst{A}{b}{\branch\, \bs}) \to
\\
&\subst{B}{\bs}{\emp} \to
\\
&(\forall b, \bs. A \to B \to \subst{B}{\bs}{\tcons \, b \, \bs}) \to
\\
&\forall b A
\\
= \allnc \vec{p}. 
&\eps \mr \forall n \subst{A}{b}{\leaf\, n} \to
\\
&\eps \mr (\forall \bs. B \to \subst{A}{b}{\branch\, \bs}) \to
\\
&\forall f_3. f_3 \mr \subst{B}{\bs}{\emp} \to
\\
&\forall f_4. f_4 \mr 
(\forall b, \bs. A \to B \to \subst{B}{\bs}{\tcons \, b \, \bs}) \to
\\
&\forall b(\eps \mr A)
\\
= \allnc \vec{p}. 
&\forall n (\eps \mr \subst{A}{b}{\leaf\, n}) \to
\\
&(\forall \bs,y. y \mr B \to 
\eps \mr \subst{A}{b}{\branch\, \bs}) \to
\\
&\forall f_3. f_3 \mr \subst{B}{\bs}{\emp} \to
\\
&\forall f_4. (\forall b, \bs.
\eps \mr A \to \forall y_2. y_2 \mr B \to
\\
&\qquad 
f_4\, b\, \bs \, y_2 \mr \subst{B}{\bs}{\tcons \, b \, \bs}) \to
\\
&\forall b(\eps \mr A)
\end{align*}
Hence we can define $\mu(\ind_{b,\bs,A,B})$ to be the expected
inductive proof of this formula, which uses the induction axiom
\begin{align*}
&\ind_{b,\bs,(\eps \mr A),
(F f_3 f_4 \bs \mr B)} \colon \allnc \vec{p}\,\forall f_3, f_4.
\\
&\quad 
\forall n \subst{(\eps \mr A)}{b}{\leaf\, n} \to
\\
&\quad
(\forall \bs. F f_3 f_4 \bs \mr B \to
\subst{(\eps \mr A)}{b}{\branch\, \bs}) \to
\\
&\quad
\subst{(F f_3 f_4 \bs \mr B)}{\bs}{\emp} \to
\\
&\quad
(\forall b, \bs. \eps \mr A \to
F f_3 f_4 \bs \mr B \to
\\
&\quad \qquad
\subst{(F f_3 f_4 \bs \mr B)}{\bs}{\tcons \, b\, \bs}) \to
\\
&\quad
\forall b(\eps \mr A)
\end{align*}
with $f$ defined by the recursion equations
\begin{alignat*}{2}
&F f_3 f_4 \emp &&= f_3,
\\
&F f_3 f_4 (\tcons \, b\, \bs) &&=
f_4\, b\, \bs(F f_3 f_4 \bs).
\end{alignat*}
By our identification of $\beta \eta \rec$-equivalent terms this is
the same as
\begin{align*}
&\ind_{b,\bs,(\eps \mr A),
(F f_3 f_4 \bs \mr B)} \colon \allnc \vec{p}\,\forall f_3, f_4.
\\
&\quad 
\forall n (\eps \mr \subst{A}{b}{\leaf\, n}) \to
\\
&\quad
(\forall \bs. F f_3 f_4 \bs \mr B \to
\eps \mr \subst{A}{b}{\branch\, \bs}) \to
\\
&\quad
f_3 \mr \subst{B}{\bs}{\emp} \to
\\
&\quad
(\forall b, \bs. \eps \mr A \to
F f_3 f_4 \bs \mr B \to
\\
&\quad \qquad
f_4\, b\, \bs(F f_3 f_4 \bs)
\mr \subst{B}{\bs}{\tcons \, b\, \bs}) \to
\\
&\quad
\forall b(\eps \mr A)
\end{align*}
Let
\begin{align*}
u_1 &\colon \forall n(\eps \mr \subst{A}{b}{\leaf\, n})
\\
u_2 &\colon \forall \bs,y. y \mr B \to 
\eps \mr \subst{A}{b}{\branch\, \bs}
\\
u_3 &\colon f_3 \mr \subst{B}{\bs}{\emp}
\\
u_4 &\colon \forall b, \bs. \eps \mr A \to \forall y_2. y_2 \mr B \to 
f_4\, b\, \bs \, y_2 \mr \subst{B}{\bs}{\tcons \, b\, \bs}
\\
v_1 &\colon \eps \mr A
\\
v_2 &\colon F f_3 f_4 \bs \mr B
\end{align*}
be assumption variables.  Then the proof term is
\begin{align*}
\lambda \vec{p}
&\lambda u_1 \lambda u_2
\lambda f_3 \lambda u_3
\lambda f_4 \lambda u_4.
\ind_{b,\bs,(\eps \mr A),(F f_3 f_4 \bs \mr B)} \vec{p} f_3 f_4
\\
&u_1
(\lambda \bs. u_2 \, \bs(F f_3 f_4 \bs))
u_3
(\lambda b \lambda \bs \lambda v_1. u_4\, b\, \bs \,
v_1(F f_3 f_4 \bs)v_2).
\end{align*}

\emph{Case} $\tau(A) \ne \nulltype = \tau(B)$.  Then
$\extrTer{\ind_{b,\bs,A,B}} = F$ and we obtain
\begin{align*}
F \mr \allnc \vec{p}. 
&\forall n \subst{A}{b}{\leaf\, n} \to
\\
&(\forall \bs. B \to \subst{A}{b}{\branch\, \bs}) \to
\\
&\subst{B}{\bs}{\emp} \to
\\
&(\forall b, \bs. A \to B \to \subst{B}{\bs}{\tcons \, b \, \bs}) \to
\\
&\forall b A
\\
= \allnc \vec{p}. 
&\forall f_1. f_1 \mr \forall n \subst{A}{b}{\leaf\, n} \to
\\
&\forall f_2. f_2 \mr (\forall \bs. B \to \subst{A}{b}{\branch\, \bs}) \to
\\
&\eps \mr \subst{B}{\bs}{\emp} \to
\\
&\eps \mr 
(\forall b, \bs. A \to B \to \subst{B}{\bs}{\tcons \, b \, \bs}) \to
\\
&\forall b(F f_1 f_2 b \mr A)
\\
= \allnc \vec{p}. 
&\forall f_1. \forall n (f_1 n \mr \subst{A}{b}{\leaf\, n}) \to
\\
&\forall f_2. (\forall \bs. \eps \mr B \to 
f_2 \mr \subst{A}{b}{\branch\, \bs}) \to
\\
&\eps \mr \subst{B}{\bs}{\emp} \to
\\
&(\forall b, \bs, y_1.
y_1 \mr A \to \eps \mr B \to \eps \mr \subst{B}{\bs}{\tcons \, b \, \bs}) \to
\\
&\forall b(F f_1 f_2 b \mr A).
\end{align*}
Hence we can define $\mu(\ind_{b,\bs,A,B})$ to be the expected
inductive proof of this formula, which uses the induction axiom
\begin{align*}
&\ind_{b,\bs,(F f_1 f_2 b \mr A),
(\eps \mr B)} \colon \allnc \vec{p}\,\forall f_1, f_2.
\\
&\quad 
\forall n \subst{(F f_1 f_2 b \mr A)}{b}{\leaf\, n} \to
\\
&\quad
(\forall \bs. \eps \mr B \to
\subst{(F f_1 f_2 b \mr A)}{b}{\branch\, \bs}) \to
\\
&\quad
\subst{(\eps \mr B)}{\bs}{\emp} \to
\\
&\quad
(\forall b, \bs. F f_1 f_2 b \mr A \to \eps \mr B \to
\subst{(\eps \mr B)}{\bs}{\tcons \, b\, \bs}) \to
\\
&\quad
\forall b(F f_1 f_2 b \mr A)
\end{align*}
with $F$ defined by the recursion equations
\begin{alignat*}{2}
&F f_1 f_2(\leaf\, n) &&= f_1 n,
\\
&F f_1 f_2(\branch\, \bs) &&= f_2 \, \bs.
\end{alignat*}
By our identification of $\beta \eta \rec$-equivalent terms this is
the same as
\begin{align*}
&\ind_{b,\bs,(\eps \mr A),
(\eps \mr B)} \colon \allnc \vec{p}\,\forall f_1, f_2.
\\
&\quad 
\forall n (f_1 n \mr \subst{A}{b}{\leaf\, n}) \to
\\
&\quad
(\forall \bs. \eps \mr B \to
f_2 \, \bs \mr \subst{A}{b}{\branch\, \bs}) \to
\\
&\quad
\eps \mr \subst{B}{\bs}{\emp} \to
\\
&\quad
(\forall b, \bs. F f_1 f_2 b \mr A \to
\eps \mr B \to 
\eps \mr \subst{B}{\bs}{\tcons \, b\, \bs}) \to
\\
&\quad
\forall b(F f_1 f_2 b \mr A)
\end{align*}
Let
\begin{align*}
u_1 &\colon \forall n(f_1 n \mr \subst{A}{b}{\leaf\, n})
\\
u_2 &\colon \forall \bs. \eps \mr B \to 
f_2 \bs \mr \subst{A}{b}{\branch\, \bs}
\\
u_3 &\colon \eps \mr \subst{B}{\bs}{\emp}
\\
u_4 &\colon \forall b, \bs, y_1. y_1 \mr A \to \eps \mr B \to 
\eps \mr \subst{B}{\bs}{\tcons \, b\, \bs}
% \\
% v &\colon \eps \mr A
% \\
% w &\colon \eps \mr B
\end{align*}
be assumption variables.  Then the proof term is
\begin{align*}
&\lambda \vec{p} \lambda f_1 \lambda u_1 \lambda f_2 \lambda u_2
\lambda u_3 \lambda u_4 \lambda b.
\ind_{b,\bs,(F f_1 f_2 b \mr A),(\eps \mr B)} \vec{p} f_1 f_2
\\
&(\lambda n. u_1 n)
(\lambda \bs, v_1. u_2 \, \bs \, v_1)
u_3
(\lambda b, \bs, v_1^{F f_1 f_2 b \mr A}, v_2^{\eps \mr B}. 
u_4\, b \, \bs(F f_1 f_2 b)v_1 v_2)
b
\end{align*}
\end{examples*}


\subsection{Realizing a Cases Axiom}\mylabel{SS:RealCases}
The cases axiom $\CasesAxiom_{x_j, A_j}$ or shortly $\CasesAxiom_{j}$
proves the universal closure (w.r.t.\ $\allnc$) of the formula
\[
D_{i_1} \to \dots \to D_{i_q} \to \forall x_j^{\mu_j}\,A_j.
\]
where $D_{i_1} \to \dots \to D_{i_q}$ consists of all $D_i$ concerning
constructors for $\mu_j$.  We may assume $\tau(A_j) \ne \nulltype$,
for otherwise $\extrTer{\CasesAxiom_{j}} = \eps$ and we can easily
find a derivation $\mu(\CasesAxiom_{j})$ of
\begin{align*}
&\eps \mr \bigl(\allnc \vec{p}. 
D_{i_1} \to \dots \to D_{i_q} \to \forall x_j^{\mu_j}\,A_j \bigr)
\\
&= \allnc \vec{p}. \eps \mr 
\bigl(D_{i_1} \to \dots \to D_{i_q} \to \forall x_j^{\mu_j}\,A_j\bigr)
\\
&= \allnc \vec{p}. \eps \mr D_{i_1} \to \dots \to
\eps \mr D_{i_q} \to \forall x_j^{\mu_j} \eps \mr A_j.
\end{align*}
Indeed, $\mu(\CasesAxiom_{j})$ is just $\CasesAxiom_{x_j, \eps \mr
A_j}$.

Recall 
\[
\extrTer{\CasesAxiom_{j}} = \lambda f_1 \dots \lambda f_q \lambda x
[\texttt{if} \ x\ f_1 \ \dots\ f_q].
\]
Hence we must find a derivation $\mu(\CasesAxiom_{j})$ of
\begin{align*}
&\lambda f_1 \dots \lambda f_q \lambda x 
[\texttt{if} \ x\ f_1 \ \dots\ f_q] \mr \bigl(\allnc \vec{p}. 
D{i_1} \to \dots \to D{i_q} \to \forall x_j^{\mu_j}\,A_j \bigr)
\\
&= \allnc \vec{p}. \lambda f_1 \dots \lambda f_q \lambda x 
[\texttt{if} \ x\ f_1 \ \dots\ f_q] \mr 
\bigl(D{i_1} \to \dots \to D{i_q} \to \forall x_j^{\mu_j}\,A_j\bigr)
\\
&= \allnc \vec{p}\,\forall f_1. f_1 \mr D{i_1} \to \dots \to
\forall f_q. f_q \mr D{i_q} \to \forall x_j^{\mu_j}
[\texttt{if} \ x_j\ f_1 \ \dots\ f_q] \mr A_j.
\end{align*}
Notice that for the step formula $D_{i_p}$ the formula $f_p \mr
D_{i_p}$ is defined to be
\[
\forall y_1^{\rho_1},\dots,y_m^{\rho_m},
y_{m+1}^{\vec{\sigma}_1 \to \mu_{j_1}},\dots,
y_{m+n}^{\vec{\sigma}_n \to \mu_{j_n}}
f_p \vec{y} \mr
\subst{A_j}{x_j}{\constr_{i_p}^{\vec{\mu}}(\vec{y})}.
\]
We proceed informally.  Assume $\vec{p}$, $f_1$, $u_1 \colon f_1 \mr
D{i_1}$, $\dots$, $f_q$, $u_q \colon f_q \mr D_{i_q}$; our goal is
$\forall x_j^{\mu_j} [\texttt{if} \ x_j\ f_1 \ \dots\ f_q] \mr A_j$.
For the proof we use the cases axiom w.r.t.\ $\forall x_j^{\mu_j}
[\texttt{if} \ x_j\ f_1 \ \dots\ f_q] \mr A_j$.  Hence it suffices to
prove the step formulas w.r.t.\ the latter cases axiom, i.e.\ all
formulas
\begin{align*}
D_{i_p}^{\mrind} := &\forall y_1^{\rho_1},\dots,y_m^{\rho_m},
y_{m+1}^{\vec{\sigma}_1 \to \mu_{j_1}},\dots,
y_{m+n}^{\vec{\sigma}_n \to \mu_{j_n}}.
\\
&[\texttt{if} \ (\constr_{i_p}^{\vec{\mu}}(\vec{y}))\ f_1 \ \dots\ f_q] \mr
\subst{A_j}{x_j}{\constr_{i_p}^{\vec{\mu}}(\vec{y})}.
\end{align*}
But this follows from $[\texttt{if} \ (\constr_{i_p}^{\vec{\mu}}(\vec{y}))\
f_1 \ \dots\ f_q] \cnv f_p \vec{y}$.  Hence the proof term is
\[
\lambda \vec{p} \lambda f_1 \lambda u_1 \dots \lambda f_q \lambda u_q
\CasesAxiom_{x_j, [\texttt{if} \ x_j\ f_1 \ \dots\ f_q] \mr A_j} 
\vec{q} u_1 \dots u_q.
\]
with $\vec{q}$ the parameters of $\CasesAxiom_{x_j, [\texttt{if} \
  x_j\ f_1 \ \dots\ f_q] \mr A_j}$.
% \[
% \lambda \vec{p} \lambda f_1 \lambda u_1 \dots \lambda f_q \lambda u_q
% \CasesAxiom_{x_j, [\texttt{if} \ x_j\ f_1 \ \dots\ f_q] \mr A_j} 
% f_1 \dots f_q \vec{p} u_1 \dots u_q.
% \]


\subsection{Existence Introduction and Elimination}\mylabel{SS:RealExIE}
Consider an existence introduction axiom\index{existence introduction
axiom}
\[
\excI_{x,A} \colon \allnc \vec{p}\,\forall x. A \to \ex x^\rho A.  
\]
We must find a derivation $\mu(\excI_{x,A})$ of $\extrTer{\excI_{x,A}}
\mr \allnc \vec{p}\,\forall x.  A \to \ex x^\rho A$.

\emph{Case} $\tau(A) = \nulltype$.  Then $\extrTer{\excI_{x,A}} =
\lambda x x$ and we obtain
\begin{align*}
(\lambda x x) \mr
\allnc \vec{p}\,\forall x. A \to \ex x A
&= \allnc \vec{p}\,\forall x.x \mr (A \to \ex x A)
\\
&= \allnc \vec{p}\,\forall x. \eps \mr A \to x \mr \ex x A
\\
&= \allnc \vec{p}\,\forall x. \eps \mr A \to \eps \mr A.
\end{align*}
Hence we can define $\mu(\excI_{x,A})=
\lambda \vec{p} \lambda x \lambda u u$.  

\emph{Case} $\tau(A) \ne \nulltype$.  Then
$\extrTer{\excI_{x,A}} = \lambda x \lambda f \langle
x,f \rangle$ and we obtain
\begin{align*}
&\lambda x \lambda f\langle x,f\rangle \mr
\allnc \vec{p}\,\forall x.A \to \ex x A
\\
&= \allnc \vec{p}\,\forall x, f. f \mr A \to
\langle x,f\rangle \mr \ex x A
\\
&= \allnc \vec{p}\,\forall x, f. f \mr A \to
f \mr A
\end{align*}
Hence we can define $\mu(\excI_{x,A})=
\lambda \vec{p} \lambda x \lambda f\lambda u u$.


% \subsection{Realizing an Existence Elimination Axiom}\mylabel{SS:RealExE}
Consider now the existence elimination axioms\index{existence elimination
axiom}
\[
\excE_{x,A,B} \colon
\allnc \vec{p}. \ex x A \to (\forall x.A \to B) \to B
\quad \hbox{with $x \notin \FV(B)$.}
\]
We must find a derivation $\mu(\excE_{x,A,B})$ of
\[
\extrTer{\excE_{x,A,B}} \mr 
\allnc \vec{p}. \ex x A \to (\forall x.A \to B) \to B.
\]

\emph{Case} $\tau(A) = \nulltype = \tau(B)$.  Then
$\extrTer{\excE_{x,A,B}} = \eps$ and we obtain
\begin{align*}
&\eps \mr \allnc \vec{p}. \ex x A \to (\forall x.A \to B) \to B
\\
& = \allnc \vec{p}\,\forall x.x \mr \ex x A \to
\eps \mr ((\forall x.A \to B) \to B)
\\
& = \allnc \vec{p}\,\forall x. \eps \mr A \to
\eps \mr (\forall x.A \to B) \to \eps \mr B
\\
& = \allnc \vec{p}\,\forall x. \eps \mr A \to
\forall x\,\eps \mr (A \to B) \to \eps \mr B
\\
& = \allnc \vec{p}\,\forall x. \eps \mr A \to
(\forall x. \eps \mr A \to \eps \mr B) \to \eps \mr B.
\end{align*}
Hence we can define $\mu(\excE_{x,A,B})=
\lambda \vec{p} \lambda x \lambda u \lambda v.vxu$.

\emph{Case} $\tau(A) \ne \nulltype = \tau(B)$.  Then we again have
$\extrTer{\excE_{x,A,B}} = \eps$ and we obtain
\begin{align*}
&\eps \mr \allnc \vec{p}. \ex x A \to(\forall x.A \to B) \to B
\\
& = \allnc \vec{p}\,\forall f.f \mr \ex x A \to
\eps \mr ((\forall x.A \to B) \to B)
\\
& = \allnc \vec{p}\,\forall f.
(f 1)  \mr \subst{A}{x}{f 0} \to
\eps \mr (\forall x.A \to B) \to \eps \mr B
\\
& = \allnc \vec{p}\,\forall f.
(f 1) \mr \subst{A}{x}{f 0} \to
\forall x\,\eps \mr (A \to B) \to \eps \mr B
\\
& = \allnc \vec{p}\,\forall f.
(f 1) \mr \subst{A}{x}{f 0} \to
(\forall x\forall g. g \mr A \to \eps \mr B) \to 
\eps \mr B.
\end{align*}
Hence we can define $\mu(\excE_{x,A,B})=
\lambda \vec{p} \lambda f \lambda u \lambda v.v(f 0) (f 1)u$.

\emph{Case} $\tau(A) = \nulltype \ne \tau(B)$.  Then
$\extrTer{\excE_{x,A,B}} = \lambda x \lambda z(zx)$ and we obtain
\begin{align*}
&\lambda x \lambda z(zx) \mr
\allnc \vec{p}. \ex x A \to(\forall x.A \to B) \to B
\\
& = \allnc \vec{p}\,\forall x.x \mr \ex x A \to
\lambda z(zx) \mr ((\forall x.A \to B) \to B)
\\
& = \allnc \vec{p}\,\forall x. \eps \mr A \to
\forall z.z \mr (\forall x.A \to B) \to zx \mr B
\\
& = \allnc \vec{p}\,\forall x. \eps \mr A \to
\forall z. \forall x\,zx \mr (A \to B) \to zx \mr B
\\
& = \allnc \vec{p}\,\forall x. \eps \mr A \to
\forall z.(\forall x. \eps \mr A \to zx \mr B) \to zx \mr B.
\end{align*}
Hence we can define $\mu(\excE_{x,A,B})=
\lambda \vec{p} \lambda x \lambda u \lambda z \lambda v.vxu$.  

\emph{Case} $\tau(A) \ne \nulltype \ne \tau(B)$.  Then
$\extrTer{\excE_{x,A,B}} = \lambda f \lambda z(z(f 0) (f 1))$ and we
obtain
\begin{align*}
&\lambda f \lambda z(z(f 0) (f 1)) \mr
\allnc \vec{p}. \ex x A \to(\forall x.A \to B) \to B
\\
& = \allnc \vec{p}\,\forall f.f \mr \ex x A \to
\lambda z(z(f 0) (f 1)) \mr ((\forall x.A \to B) \to B)
\\
& = \allnc \vec{p}\,\forall f.
(f 1) \mr \subst{A}{x}{f 0} \to
\\
&\qquad \forall z.z \mr (\forall x.A \to B) \to  z(f 0) (f 1) \mr B
\\
&= \allnc \vec{p}\,\forall f. (f 1) \mr \subst{A}{x}{f 0} \to
\\
&\qquad \forall z. (\forall x, g. g \mr A \to 
zxg \mr B) \to
z(f 0) (f 1) \mr B.
\end{align*}
Hence we can define $\mu(\excE_{x,A,B})=
\lambda \vec{p} \lambda f \lambda u \lambda z\lambda v.v(f 0) (f 1)u$.

The treatment of the introduction and elimination axioms for the
quantifiers $\allnc, \exnc$ is somewhat different: we will need other
instances of these axioms in our derivations.  Consider an existence
introduction axiom\index{existence introduction axiom}
\[
\exncI_{x,A} \colon \allnc \vec{p}, x. A \to \exnc x^\rho A.  
\]
We must find a derivation $\mu(\exncI_{x,A})$ of $\extrTer{\exncI_{x,A}}
\mr \allnc \vec{p}, x.  A \to \exnc x^\rho A$.

\emph{Case} $\tau(A) = \nulltype$.  Then $\extrTer{\exncI_{x,A}} =
\eps$ and we obtain
\begin{align*}
\eps \mr \allnc \vec{p},x. A \to \exnc x A
&= \allnc \vec{p},x.\eps \mr (A \to \exnc x A)
\\
&= \allnc \vec{p},x. \eps \mr A \to \eps \mr \exnc x A
\\
&= \allnc \vec{p},x. \eps \mr A \to \exnc x. \eps \mr A.
\end{align*}
Hence we can define $\mu(\exncI_{x,A})= \exncI_{x, \eps \mr A}$.

\emph{Case} $\tau(A) \ne \nulltype$.  Then $\extrTer{\exncI_{x,A}} =
\lambda y y$ and we obtain
\begin{align*}
&\lambda y y \mr \allnc \vec{p},x.A \to \exnc x A
\\
&= \allnc \vec{p},x. \lambda y y \mr (A \to \exnc x A)
\\
&= \allnc \vec{p},x \forall y. y \mr A \to y \mr \exnc x A
\\
&= \allnc \vec{p},x \forall y. y \mr A \to \exnc x. y \mr A
\end{align*}
Now observe that $\tau(y \mr A)=\nulltype$, hence we can equivalently
replace $\forall y$ by $\allnc y$.  Therefore we can define
$\mu(\exncI_{x,A})= \lamnc \vec{p},x,y. \exncI_{x,y \mr A} \vec{q}x$
with $\vec{q}$ the free variables of $y \mr A$.

Consider now the existence elimination axioms\index{existence elimination
axiom}
\[
\exncE_{x,A,B} \colon
\allnc \vec{p}. \exnc x A \to (\allnc x.A \to B) \to B
\quad \hbox{with $x \notin \FV(B)$.}
\]
We must find a derivation $\mu(\exncE_{x,A,B})$ of
\[
\extrTer{\exncE_{x,A,B}} \mr 
\allnc \vec{p}. \exnc x A \to (\allnc x.A \to B) \to B.
\]

\emph{Case} $\tau(A) = \nulltype = \tau(B)$.  Then
$\extrTer{\exncE_{x,A,B}} = \eps$ and we obtain
\begin{align*}
&\eps \mr \allnc \vec{p}. \exnc x A \to (\allnc x.A \to B) \to B
\\
& = \allnc \vec{p}.\eps \mr \exnc x A \to
\eps \mr ((\allnc x.A \to B) \to B)
\\
& = \allnc \vec{p}. \exnc x \; \eps \mr A \to
\eps \mr (\allnc x.A \to B) \to \eps \mr B
\\
& = \allnc \vec{p}. \exnc x \; \eps \mr A \to
\allnc x\;\eps \mr (A \to B) \to \eps \mr B
\\
& = \allnc \vec{p}. \exnc x \; \eps \mr A \to
(\allnc x. \eps \mr A \to \eps \mr B) \to \eps \mr B.
\end{align*}
Hence we can define $\mu(\exncE_{x,A,B})=\exncE_{x, \eps \mr A, \eps
  \mr B}$.  [Todo: check the next three cases]

\emph{Case} $\tau(A) \ne \nulltype = \tau(B)$.  Then again
$\extrTer{\exncE_{x,A,B}} = \eps$ and we obtain
\begin{align*}
&\eps \mr \allnc \vec{p}. \exnc x A \to(\allnc x.A \to B) \to B
\\
& = \allnc \vec{p}\,\forall y.y \mr \exnc x A \to
\eps \mr ((\allnc x.A \to B) \to B)
\\
& = \allnc \vec{p}\,\forall y.
\exnc x \; y \mr A \to
\eps \mr (\allnc x.A \to B) \to \eps \mr B
\\
& = \allnc \vec{p}\,\forall y.
\exnc x \; y \mr A \to
\allnc x \; \eps \mr (A \to B) \to \eps \mr B
\\
& = \allnc \vec{p}\,\forall y.
\exnc x \; y \mr A \to
(\allnc x\forall y. y \mr A \to \eps \mr B) \to 
\eps \mr B.
\end{align*}
Here again we can equivalently replace $\forall y$ by $\allnc y$, and
then use the general fact that $\vdash (\allnc x.A \to B) \leftrightarrow
(\exnc x A \to B)$.  So our claim is equivalent to
\[
\allnc \vec{p}.
\exnc x \exnc y\; y \mr A \to
(\allnc x. \exnc y\;y \mr A \to \eps \mr B) \to 
\eps \mr B,
\]
which is the axiom $\exncE_{x,\exnc y\,y \mr A,\eps \mr B}$.  To spell
out the derivation term, let $\vec{p}=\vec{q_1},\vec{q_2}$ with
$\vec{q_1}$ the variables free in $B$, $\vec{q_2}$ those free in $A$,
and $\vec{q_3}$ those free in $A$ with $x$ removed.  The derivation
term is
\[\begin{split}
&\lamnc \vec{p} \lambda y \lambda u^{\exnc x \; y \mr A} 
\lambda v^{\allnc x\forall y. y \mr A \to \eps \mr B}.
\exncE_{x,\exnc y\;y \mr A,\eps \mr B} M_1
M_2 \quad \hbox{with}
\\
&M_1^{\exnc x \exnc y\;y \mr A} := 
\exncE_{x,y \mr A,\exnc x,y\;y\mr A} \vec{q_3} y u
\\
&\qquad (\lamnc x \lambda y \lambda u_1^{y \mr A}.
\exncI_{x.\exnc y\;y\mr A}\vec{q_2}(\exncI_{y,y\mr A}\vec{q_2}y u_1))
\\
&M_2^{\allnc x.\exnc y\;y\mr A \to \eps \mr B} := 
\lamnc x \lambda u_2^{\exnc y\;y\mr A}.
\exncE_{y,y\mr A,\eps\mr B}\vec{p} u_2(\lamnc y.vxy)
\end{split}\]

\emph{Case} $\tau(A) = \nulltype \ne \tau(B)$.  Then
$\extrTer{\exncE_{x,A,B}} = \lambda z z$ and we obtain
\begin{align*}
&\lambda z z \mr \allnc \vec{p}. \exnc x A \to(\allnc x.A \to B) \to B
\\
& = \allnc \vec{p}.\eps \mr \exnc x A \to
\lambda z z \mr ((\allnc x.A \to B) \to B)
\\
& = \allnc \vec{p}. \exnc x\; \eps \mr A \to
\forall z.z \mr (\allnc x.A \to B) \to z \mr B
\\
& = \allnc \vec{p}. \exnc x \;\eps \mr A \to
\forall z. \allnc x\,z \mr (A \to B) \to z \mr B
\\
& = \allnc \vec{p}. \exnc x\; \eps \mr A \to
\forall z.(\allnc x. \eps \mr A \to z \mr B) \to z \mr B.
\end{align*}
This is equivalent to
\[
\allnc \vec{p},z. \exnc x\; \eps \mr A \to
(\allnc x. \eps \mr A \to z \mr B) \to z \mr B,
\]
which is the axiom $\exncE_{x,\eps \mr A,z \mr B}$.

\emph{Case} $\tau(A) \ne \nulltype \ne \tau(B)$.  Then
$\extrTer{\exncE_{x,A,B}} = \lambda y\lambda z.zy$ and we
obtain
\begin{align*}
&(\lambda y\lambda z.zy) \mr
\allnc \vec{p}. \exnc x A \to(\allnc x.A \to B) \to B
\\
& = \allnc \vec{p}\,\forall y.y \mr \exnc x A \to
\lambda z.zy \mr ((\allnc x.A \to B) \to B)
\\
& = \allnc \vec{p}\,\forall y. \exnc x\;y \mr A \to
\forall z.z \mr (\allnc x.A \to B) \to  zy \mr B
\\
& = \allnc \vec{p}\,\forall y. \exnc x\;y \mr A \to
\forall z. (\allnc x \forall y_1. y_1 \mr A \to zy_1 \mr B) \to zy \mr B.
\end{align*}
This follows from
\[
\allnc \vec{p},z,y. \exnc x\;y \mr A \to
(\forall y.\exnc x\;y \mr A \to zy \mr B) \to zy \mr B,
\]
which is the axiom $\exncE_{y,\exnc x\;y \mr A,zy \mr B}$.


\subsection{Compatibility}\mylabel{SS:RealCompat}
Consider a compatibility axiom
\[
\EqCompat_{x_1, A} \colon 
\allnc \vec{p}\,\forall x_1, x_2. x_1 \approx x_2 \to A \to 
\subst{A}{x_1}{x_2}.
\]
We must find a derivation $\mu(\EqCompat_{x_1, A})$ of
\[
\extrTer{\EqCompat_{x_1, A}} \mr \bigl(\allnc \vec{p}\,\forall x_1, x_2. x_1
\approx x_2 \to A \to \subst{A}{x_1}{x_2} \bigr).
\]

\emph{Case} $\tau(A) = \nulltype$.  Then $\extrTer{\EqCompat_{x_1, A}} =
\eps$ and we clearly can define $\mu(\EqCompat_{x_1, A}) :=
\EqCompat_{x_1, \eps \mr A}$.

\emph{Case} $\tau(A) \ne \nulltype$.  Then $\extrTer{\EqCompat_{x_1, A}} =
\lambda x_1 \lambda x_2 \lambda f\, f$ and we obtain
\begin{align*}
&\lambda x_1 \lambda x_2 \lambda f\, f \mr
\allnc \vec{p}\,\forall x_1, x_2. x_1
\approx x_2 \to A \to \subst{A}{x_1}{x_2}
\\
& = \allnc \vec{p}\,\forall x_1, x_2. x_1 \approx x_2 \to 
\forall f. f \mr A \to f \mr \subst{A}{x_1}{x_2}.
\end{align*}
Hence we can define
\[
\mu(\EqCompat_{x_1, A}) :=
\lambda \vec{p} \lambda x_1 \lambda x_2 \lambda u^{x_1 \approx x_2} \lambda f.
\EqCompat_{x_1, (f \mr A)} f \vec{p} x_1 x_2 u. 
\]


\subsection{The Soundness Theorem}\mylabel{SS:Soundness}
Recall that $x_u := \eps$ if $u^A$ is an assumption variable with a
Harrop-formula $A$.

\begin{theorem*}[Soundness]
  If $M$ is a derivation of a formula $B$, then there is a derivation
  $\mu(M)$ of $\extrTer{M} \mr B$ from $\set{x_u \mr C}{u^C\in
    \FA(M)}$.
\end{theorem*}
 
\begin{proof}
Induction on $M$.

\emph{\textbf{Case}} $u \colon A$.  Then $\bar u \colon x_{u} \mr A$.
Let $\mu(u) := \bar{u}$.

\emph{\textbf{Case}} $c\colon A$, $c$ an axiom.  These cases have been
treated above.

\emph{\textbf{Case}} $\lambda u^AM^B$.  We must find a derivation
$\mu(\lambda uM)$ of
\[
\extrTer{\lambda uM} \mr (A \to B).
\]

\emph{Subcase} $\tau(A) = \nulltype$.  Then $\extrTer{\lambda
uM} = \extrTer{M}$, hence
\[
\extrTer{\lambda uM} \mr (A \to B) \;\;=\;\;
\eps \mr A \;\to \;\extrTer{M} \mr B.
\]
By IH we can define $\mu(\lambda uM) := \lambda
\bar{u} \mu(M)$ with $\bar{u} \colon \eps \mr A$.  

\emph{Subcase} $\tau(A) \ne \nulltype = \tau(B)$.  Then
$\extrTer{\lambda uM} = \eps$ and
\[
\extrTer{\lambda uM} \mr (A \to B) \;\;=\;\;
\forall x.x \mr A \;\to \; \eps \mr B,
\]
and by IH we can define $\mu(\lambda uM):= \lambda
x_u \lambda \bar{u} \mu(M)$ with $\bar{u} \colon x_u \mr A$.

\emph{Subcase} $\tau(A) \ne \nulltype \ne \tau(B)$.  Then
\[
\extrTer{\lambda uM} \mr (A \to B) \;\;=\;\;\forall x.x \mr A \;\to \; 
\extrTer{\lambda uM}x \mr B
\]
Because of $\extrTer{\lambda uM} = \lambda x_u \extrTer{M}$ and since
we identify terms with the same $\beta$-normal form, again by IH we
can define $\mu(\lambda uM) := \lambda x_u \lambda \bar{u} \mu(M)$.

\emph{\textbf{Case}} $M^{A \to B}N^A$.  We must find a derivation
$\mu(MN)$ of $\extrTer{MN} \mr B$.

\emph{Subcase} $\tau(A) = \nulltype$.  Then
$\extrTer{MN} = \extrTer{M}$.  By IH we have derivations
$\mu(M)$ of
\[
\extrTer{M} \mr (A \to B) \;\;=\;\;\eps \mr A \;\to \;\extrTer{M} \mr B 
\]
and $\mu(N)$ of $\eps \mr A$; hence we can define $\mu(MN) := \mu(M)
\mu(N)$.

\emph{Subcase} $\tau(A) \ne \nulltype = \tau(B)$.  Then
$\extrTer{MN} = \eps$.  By IH we have derivations $\mu(M)$ of
\[
\extrTer{M} \mr (A \to B) \;\;=\;\;
\forall x.x \mr A \;\to \;\eps \mr B
\]
and $\mu(N)$ of $\extrTer{N} \mr A$; hence we can define $\mu(MN) :=
\mu(M) \extrTer{N} \mu(N)$.

\emph{Subcase} $\tau(A) \ne \nulltype \ne \tau(B)$.  Then
$\extrTer{MN} = \extrTer{M} \extrTer{N}$.  By induction hypothesis we
have derivations $\mu(M)$ of
\[
\extrTer{M} \mr (A \to B) \;\;=\;\;
\forall x.x \mr A \;\to \;\extrTer{M}x \mr B
\]
and $\mu(N)$ of $\extrTer{N} \mr A$; hence we can define $\mu(MN):=
\mu(M) \extrTer{N} \mu(N)$.

\emph{\textbf{Case}} $\langle M_0^{A_0},M_1^{A_1} \rangle$.  We must
find a derivation $\mu(\langle M_0,M_1 \rangle)$ of
\[
\extrTer{\langle M_0,M_1 \rangle} \mr (A_0\land A_1).
\]

\emph{Subcase} $\tau(A_0) = \nulltype = \tau(A_1)$.  Then
$\extrTer{\langle M_0,M_1 \rangle} = \eps$, hence
\[
\extrTer{\langle M_0,M_1 \rangle} \mr (A_0\land A_1) \;\;=\;\;
\eps \mr A_0\;\land\;\eps \mr A_1
\]
and by IH we can define $\mu(\langle
M_0,M_1 \rangle) := \langle \mu(M_0),\mu(M_1) \rangle$.  

\emph{Subcase} $\tau(A_0) = \nulltype \ne \tau(A_1)$.  Then
$\extrTer{\langle M_0,M_1 \rangle} = \extrTer{M_1}$, hence
\[
\extrTer{\langle M_0,M_1 \rangle} \mr (A_0\land A_1) \;\;=\;\;
\eps \mr A_0\;\land\;\extrTer{M_1} \mr A_1
\]
and by IH we can define $\mu(\langle
M_0,M_1 \rangle) := \langle \mu(M_0),\mu(M_1) \rangle$.  

\emph{Subcase} $\tau(A_0) \ne \nulltype= \tau(A_1)$.  Similar.  

\emph{Subcase} $\tau(A_0) \ne \nulltype \ne \tau(A_1)$.  Then
$\extrTer{\langle M_0,M_1 \rangle} = \langle \extrTer{M_0},
\extrTer{M_1} \rangle$, hence
\[
\extrTer{\langle M_0,M_1 \rangle} \mr (A_0\land A_1) \;\;=\;\;
\extrTer{M_0} \mr A_0\;\land\;\extrTer{M_1} \mr A_1
\]
and by IH we can define $\mu(\langle M_0,M_1 \rangle):= \langle
\mu(M_0),\mu(M_1) \rangle$.

\emph{\textbf{Case}} $(M^{A_0\land A_1} 0)$.  We must find a derivation
$\mu(M 0)$ of 
\[
\extrTer{M 0} \mr A_0.
\]

\emph{Subcase} $\tau(A_1) = \nulltype$.  Then
$\extrTer{M 0} = \extrTer{M}$.  By IH we have a derivation
$\mu(M)$ of
\[
\extrTer{M} \mr (A_0\land A_1) \;\;=\;\;
\extrTer{M} \mr A_0\;\land\;\eps \mr A_1.
\]
hence we can define $\mu(M 0) := \mu(M) 0$.  

\emph{Subcase} $\tau(A_0) = \nulltype \ne \tau(A_1)$.  Then
$\extrTer{M 0} = \eps$.  By IH we have a derivation $\mu(M)$ of
\[
\extrTer{M} \mr (A_0\land A_1) \;\;=\;\;
\eps \mr A_0\;\land\;\extrTer{M} \mr A_1.
\]
hence we can define $\mu(M 0) := \mu(M) 0)$.  

\emph{Subcase} $\tau(A_0) \ne \nulltype \ne \tau(A_1)$.  Similar; we
can define $\mu(\langle M_0,M_1 \rangle) := \langle \mu(M_0),\mu(M_1)
\rangle$.

\emph{\textbf{Case}} $M^{A_0\land A_1} 1$.  Similar.

\emph{\textbf{Case}} $\lambda z M^A$.  We must find a derivation
$\mu(\lambda z M)$ of $\extrTer{\lambda z M} \mr \forall z A$.
By definition $\extrTer{\lambda z M} = \lambda z\extrTer{M}$.

\emph{Subcase} $\tau(A) = \nulltype$.  Then
\[
\lambda z\extrTer{M} \mr \forall z A \;\;=\;\;\forall z. \eps \mr A
\]
and by IH we can define $\mu(\lambda z M) := \lambda
z\mu(M)$.  The variable condition is satisfied, since $\lambda z M^A$
is a derivation term, and hence $z$ does not occur free in any
assumption variable $u \colon B$ free in $M^A$, hence also does not
occur free in the free assumption $\bar{u} \colon x_u \mr B$.

\emph{Subcase} $\tau(A) \ne \nulltype$.  Then
\[
\lambda z\extrTer{M} \mr \forall z A \;\;=\;\;
\forall z.(\lambda z\extrTer{M})z \mr A.
\]
Since we identify terms with the same $\beta$-normal form, by
IH we again can define $\mu(\lambda z M) := \lambda
z\mu(M)$.  As before one can see that the variable condition is
satisfied.

\emph{\textbf{Case}} $M^{\forall z A}t$.  We must find a derivation
$\mu(Mt)$ of $\extrTer{Mt} \mr \subst{A}{z}{t}$.  By definition we
have $\extrTer{Mt} = \extrTer{M}t$.

\emph{Subcase} $\tau(A) = \nulltype$.  By IH we have a derivation of
\[
\extrTer{M} \mr \forall z A \;\;=\;\;\forall z. \eps \mr A
\]
hence we can define $\mu(Mt) := \mu(M)t$.  

\emph{Subcase} $\tau(A) \ne \nulltype$.  By IH we have a derivation of
\[
\extrTer{M} \mr \forall z A \;\;=\;\;\forall z. \extrTer{M}z \mr A,
\]
hence we again can define $\mu(Mt) := \mu(M)t$. 

\emph{\textbf{Case}} $(\lambda z M)^{\allnc z A}$.  We must find a
derivation $\mu(\lambda z M)$ of $\extrTer{\lambda z M} \mr \allnc
z A$.  By definition $\extrTer{(\lambda z M)^{\allnc z A}} = \extrTer{M}$.

\emph{Subcase} $\tau(A) = \nulltype$.  Then
\[
\extrTer{M} \mr \allnc z A \;\;=\;\;\forall z. \eps \mr A
\]
and by IH we can define $\mu((\lambda z M)^{\allnc z A}) := \lambda
z\mu(M)$.  The variable condition is satisfied, since $(\lambda z M)^{\allnc z A}$
is a derivation term, and hence $z$ does not occur free in any
assumption variable $u \colon B$ free in $M^A$, hence also does not
occur free in the free assumption $\bar{u} \colon x_u \mr B$.

\emph{Subcase} $\tau(A) \ne \nulltype$.  Then
\[
\extrTer{M} \mr \allnc z A \;\;=\;\; \forall z. \extrTer{M} \mr A.
\]
By IH we again can define $\mu((\lambda z M)^{\allnc z A}) := \lambda
z\mu(M)$.  As before one can see that the variable condition is
satisfied.

\emph{\textbf{Case}} $M^{\allnc z A}t$.  We must find a derivation
$\mu(Mt)$ of $\extrTer{Mt} \mr \subst{A}{z}{t}$.  By definition we
have $\extrTer{Mt} = \extrTer{M}$.

\emph{Subcase} $\tau(A) = \nulltype$.  By IH we have a derivation 
$\mu(M)$ of
\[
\extrTer{M} \mr \allnc z A \;\;=\;\;\forall z. \eps \mr A
\]
hence we can define $\mu(Mt) := \mu(M)t$.  

\emph{Subcase} $\tau(A) \ne \nulltype$.  By IH we have a derivation
$\mu(M)$ of
\[
\extrTer{M} \mr \allnc z A \;\;=\;\;\forall z. \extrTer{M} \mr A.
\]
Define $\mu(Mt) := \mu(M)t$, since we can assume that $z \notin
\FV(\extrTer{M})$.
\end{proof}

If $B$ is $\ex$-free, then $\eps \mr B = B$.  Hence for $\forall
x^\rho \ex y^\sigma B$ with $\ex$-free $B$ we have $\tau(\forall x
\ex y B) = \rho \to \sigma$ and
\[
t \mr \forall x\ex y B = \forall x \subst{B}{y}{tx}.
\]
Then as a corollary to the soundness theorem we obtain the extraction 
theorem\index{extraction theorem}

\begin{corollary*}[Extraction]
  From a derivation $M\colon \forall x^\rho \ex y^\sigma B$ with $B$
  $\ex$-free from $\ex$-free assumptions $\Gamma$ one can extract a
  closed term $\extrTer{M}^{\rho \to \sigma}$ such that the formula
  $\forall x \subst{B}{y}{\extrTer{M}x}$ is provable from $\Gamma$.
  \qedsymbol
\end{corollary*}

Here $\Gamma$ should be viewed as lemmata, i.e.\ true formulas (proved
separately, to keep $M$ short).  The theorem says that the extracted
program is independent of how this shortcut is achieved.


\section{Case Studies}\mylabel{S:CaseStudies}

\subsection{Fibonacci Numbers}
Let $\alpha_n$ be the $n$-th Fibonacci number, i.e.\
\begin{align*}
\alpha_0 &:= 0
\\
\alpha_1 &:= 1
\\
\alpha_n &:= \alpha_{n-2} + \alpha_{n-1} \quad\hbox{for $n \ge 2$}
\end{align*}
Here is a naive \textsc{Scheme}-program to compute them
\begin{verbatim}
(define (f n)
  (if (= n 0)
      0
      (if (= 1 n)
          1
          (+ (f (- n 2)) (f (- n 1))))))
\end{verbatim}
Clearly this program is very inefficient, since it leads to many
recomputations.  Our goal here is to demonstrate that deriving a
program from a constructive proof of the existence of Fibonacci
numbers avoids the immediate source of the inefficiency.

We first build a constructive existence proof for the Fibonacci
numbers.
\begin{verbatim}
(set-goal 
  (pf "G 0 0 -> G 1 1 ->
       (all n,k,l.G n k -> G(n+1)l -> G(n+2)(k+l)) ->
       all n ex k,l. G n k & G(n+1)l"))
(assume "Init-Zero" "Init-One" "Step")
(ind)

; Base
(ex-intro (pt "0"))
(ex-intro (pt "1"))
(prop)

; Step
(assume "n" "IH")
(by-assume-with "IH" "k" "IH-k")
(by-assume-with "IH-k" "l" "IH-l")
(ex-intro (pt "l"))
(ex-intro (pt "k+l"))
(search)
\end{verbatim}

The extracted program can now be obtained as follows.
\begin{verbatim}
(define Fib-neterm
  (nt (proof-to-extracted-term 
    (theorem-name-to-proof "Fib"))))
\end{verbatim}
The extracted term is obtained by
\begin{verbatim}
(term-to-string Fib-neterm)
\end{verbatim}
which yields
\begin{verbatim}
(Rec nat=>nat@@nat)(0@1)([n1,p2]right p2@left p2+right p2)
\end{verbatim}
This clearly is a linear algorithm.  To run it, type
\begin{verbatim}
(pp (nt (make-term-in-app-form Fib-neterm (pt "13"))))
\end{verbatim}
which yields
\begin{verbatim}
233@377
\end{verbatim}

We can also use an \inquotes{external} extraction, yielding Scheme code:
\begin{verbatim}
(term-to-expr Fib-neterm)
\end{verbatim}
produces
\begin{verbatim}
((natrec (cons 0 1))
 (lambda (n1)
   (lambda (p2) (cons (cdr p2) (+ (car p2) (cdr p2))))))
\end{verbatim}
To run this code, we need to give a Scheme-definition of
\texttt{natrec}, that is recursion on the natural numbers:
\begin{verbatim}
(define (natrec init) 
  (lambda (step)
    (lambda (n)
      (if (= 0 n)
          init
          ((step n) (((natrec init) step) (- n 1)))))))
\end{verbatim}
This again is a linear algorithm.  We will see later that a classical
proof yields a linear algorithm as well, which however uses functions
instead of pairs.

\begin{remark*}
  There are other algorithms to compute the Fibonacci numbers
  $\alpha_n$, which run in logarithmic time.  By definition we have
\[
\begin{pmatrix}0 & 1 \\ 1 & 1 \end{pmatrix}
\begin{pmatrix} \alpha_{n-2} \\ \alpha_{n-1} \end{pmatrix}
=\begin{pmatrix} \alpha_{n-1} \\ \alpha_{n-2}+\alpha_{n-1} \end{pmatrix}
=\begin{pmatrix} \alpha_{n-1} \\ \alpha_n \end{pmatrix},
\]
hence with $A = \bigl(\begin{smallmatrix}
0 & 1 \\ 1 & 1 \end{smallmatrix} \bigr) \in \D{R}^{2 \times 2}$
\[
A^n \begin{pmatrix}0\\ 1 \end{pmatrix} =
\begin{pmatrix} \alpha_n \\ \alpha_{n+1} \end{pmatrix}.
\]
So an easy way to compute the Fibonacci numbers is by computing
the powers of $A$.  This can be done in time $O(\log(n))$, since
\begin{align*}
A^{2n} &= (A^n)^2
\\
A^{2n+1} &= A^{2n} \cdot A
\end{align*}
It is possible to obtain this algorithm as computational content
of a proof: Use $u,v$ to denote vectors in $\D{Z}^2$ and $X,Y$ to
denote matrices in $\D{Z}^{2 \times 2}$.  Let $G(n,u)$ mean that
$u$ is the vector of the $n$-th and $(n+1)$-th Fibonacci number.
$G$ can be axiomatized by
\[
G(1,\begin{pmatrix} 1 \\ 1 \end{pmatrix}),\quad
G(n,\begin{pmatrix} \alpha \\ \beta \end{pmatrix}) \to
G(n+1,\begin{pmatrix} \beta \\ \alpha+\beta \end{pmatrix}).
\]
Then prove by induction on the positive (binary) numbers $n$
\[
\forall n \ex X \forall m,u. G(m,u) \to G(m+n,Xu).
\]
Clearly this $X$ must be $A^n$.

Using some linear algebra, one can even give an explicit formula for
$\alpha_n$.  To this end we first diagonalize the matrix $A$.  The
general recipe runs as follows.  Form $B := A^t$, hence $B=A$ in our
case.  The eigenvalues can be computed as the zeros of the
characteristic polynomial $p_A= |A-tE| = -t(1-t)-1= t^2-t-1$.  So the
eigenvalues are $\lambda_{1,2} = \frac{1 \pm\sqrt{5}}{2}$.  We now
compute eigenvectors for these eigenvalues.

For $\lambda_1=\frac{1+\sqrt{5}}{2}$.  Let 
$x=\bigl(\begin{smallmatrix} \xi_1 \\\xi_2 \end{smallmatrix} \bigr)$, 
and solve the linear equation system
\[
\begin{pmatrix} -\lambda_1 & 1 \\ 1 & 1-\lambda_1 \\ \end{pmatrix}
\begin{pmatrix} \xi_1 \\ \xi_2 \end{pmatrix} =
\begin{pmatrix}0\\ 0\end{pmatrix}.
\]
So $-\lambda_1 \xi_1+\xi_2$=0.  For $\xi_1=1$ we obtain
$\xi_2=\lambda_1$, so $x_1=\bigl(\begin{smallmatrix}
1 \\\lambda_1 \end{smallmatrix} \bigr)$ is an eigenvector.  For
$\lambda_2 = \frac{1-\sqrt{5}}{2}$ we similarly obtain
$x_2=\bigl(\begin{smallmatrix} 1 \\\lambda_2 \end{smallmatrix} \bigr)$ as
an eigenvector.

For the dimensions of the eigenspaces and the multiplicities of the
eigenvalues we obtain
\begin{align*}
&\dim(\Eig(f_B,\lambda_1)) = 1 = \mu(p_B,\lambda_1)
\\
&\dim(\Eig(f_B,\lambda_2)) = 1 = \mu(p_B,\lambda_2),
\end{align*}
so the matrix $B$ is diagonalizable, and 
$\bigl(\begin{smallmatrix} 1 \\\lambda_1 \end{smallmatrix} \bigr),
\bigl(\begin{smallmatrix} 1 \\\lambda_2 \end{smallmatrix} \bigr)$
is a basis of $\D{R}^2$ consisting of eigenvectors of $f_B$.  Let
\[
T := \begin{pmatrix}1 & 1 \\ \lambda_1 & \lambda_2 \end{pmatrix},
\qquad
S := T^t = \begin{pmatrix}1 & \lambda_1 \\ 1 & \lambda_2 \end{pmatrix}.
\]
Then the general theory yields
\[
SAS^{-1} = D := \begin{pmatrix} \lambda_1 & 0\\ 0 &\lambda_2 \end{pmatrix},
\qquad 
S^{-1} = \frac{1}{\lambda_2 - \lambda_1}
\begin{pmatrix} \lambda_2 & -\lambda_1 \\ -1 & 1 \end{pmatrix}.
\]
We can now give an explicit formula for $A^n$ and hence also for the
Fibonacci numbers.
\begin{alignat*}{2}
A^n &= (S^{-1}DS)^n 
\\
&= \underbrace{(S^{-1}DS)\cdot\ldots\cdot(S^{-1}DS)}_{n\ \mathrm{times}} 
\\
&= S^{-1}D^nS 
\\
&= S^{-1} \begin{pmatrix} \lambda_1^n & 0\\0 & \lambda_2^n \end{pmatrix}S 
\\
&= S^{-1} \begin{pmatrix} \lambda_1^n & 0\\0 & \lambda_2^n \end{pmatrix}
\begin{pmatrix}1 & \lambda_1 \\ 1 & \lambda_2 \end{pmatrix}
\\
&= S^{-1} \begin{pmatrix} \lambda_1^n & \lambda_1^{n+1} \\ \lambda_2^n &
  \lambda_2^{n+1} \end{pmatrix}
\\
&= \frac{1}{\lambda_2-\lambda_1} 
\begin{pmatrix} \lambda_2 & -\lambda_1 \\ -1 & 1 \end{pmatrix}
\begin{pmatrix} \lambda_1^n & \lambda_1^{n+1} \\ \lambda_2^n &
\lambda_2^{n+1} \end{pmatrix}
\\
&= -\frac{1}{\sqrt{5}} \begin{pmatrix}
\lambda_1^n \lambda_2 - \lambda_2^n \lambda_1 &
\lambda_2 \lambda_1^{n+1} - \lambda_1 \lambda_2^{n+1}\\
-\lambda_1^n+\lambda_2^n & -\lambda_1^{n+1}+\lambda_2^{n+1} \\
\end{pmatrix} 
\\
&= -\frac{1}{\sqrt{5}} \begin{pmatrix}
-\lambda_1^{n-1} + \lambda_2^{n-1} &
-\lambda_1^n + \lambda_2^n \\
-\lambda_1^n+\lambda_2^n & -\lambda_1^{n+1}+\lambda_2^{n+1} \\
\end{pmatrix} &\quad&\hbox{since $\lambda_1 \lambda_2=-1$}
\\
&= \frac{1}{\sqrt{5}} \begin{pmatrix} \beta_{n-1} & \beta_n \\
   \beta_n & \beta_{n+1} \\ \end{pmatrix}
&&\hbox{with $\beta_n:=\lambda_1^n-\lambda_2^n$.}
\end{alignat*}
Hence by the above
\[
\begin{pmatrix} \alpha_n \\\alpha_{n+1} \end{pmatrix}=
\frac{1}{\sqrt{5}} \begin{pmatrix} \beta_{n-1} & \beta_n \\
\beta_n & \beta_{n+1} \\ \end{pmatrix} \begin{pmatrix} 0\\1 \end{pmatrix}.
\]
In particular we then have for $\alpha_n$
\[
\alpha_n = \frac{1}{\sqrt{5}} \beta_n=
\frac{1}{\sqrt{5}} \left[\left(\frac{1+\sqrt{5}}{2} \right)^n
-\left(\frac{1-\sqrt{5}}{2} \right)^n \right].
\]
\end{remark*}

Other examples for program extraction from constructive proofs are
abundant in the literature.  Major case studies done in our group
include the development of the Warshall algorithm\index{Warshall
algorithm} in \cite{BergerSchwichtenbergSeisenberger01}, and of the
Dijkstra algorithm\index{Dijkstra algorithm} in
\cite{BenlSchwichtenberg99}.


\subsection{The Warshall Algorithm}
Our language consists of the following relation and function symbols.
We deal with a binary relation $R$ on $\{0,1,\dots,n{-}1 \}$, whose
transitive closure is to be determined.
\begin{alignat*}{2}
&\elem{k}{x} &\quad&\hbox{$k$ occurs in the path $x$,}
\\
&\Rf{x} && \hbox{$x$ is a repitition free path,}
\\
&P_i(x,j,k)
&&\hbox{$x$ is an $R$-path from $j$ to $k$ whose inner elements are $<i$,}
\\
&\concat{x}{y} &&\hbox{concatenation,}
\end{alignat*}
where the concatenation function $\concat{x}{y}$ is defined as
follows.  If $x$ and $y$ are paths with the same end and initial
point, then $\concat{x}{y}$ is the path obtained by concatenating the
two, where the same end and initial point is used only once.  If end
and initial points are different, the result is the empty list
$\emptyls$.

We list the used properties (\inquotes{Lemmata}) without computational
content.
\begin{align}
&P_i(x,j,k) \to P_{i+1}(x,j,k)\label{pfadlift}
\\
&P_0(x,j,k) \to j\ne k \to R(j,k)\label{wf0pfad}
\\
&P_i(x,j,i) \to P_i(y,i,k) \to P_{i+1}(\concat{x}{y},j,k)\label{pfaddot}
\\
&P_i(x,j,i) \to \Rf{x} \to P_i(y,i,k) \to \Rf{y} \to
\forall z \neg P_i(z,j,k) \to \Rf{\concat{x}{y}}\label{wfdot}
\\
&P_{i+1}(x,j,k) \to \neg P_i(x,j,k) \to \excl y\; P_i(y,j,i)
\label{pfadzerl1}
\\
&P_{i+1}(x,j,k) \to \neg P_i(x,j,k) \to \excl z\; P_i(z,i,k)
\label{pfadzerl2}
\end{align}
The last two propositions contain the main idea of the proof: if there
is a path from $j$ to $k$ whose inner elements are smaller than
$i{+}1$, but not smaller than $i$, then there exist (classical
existence!)  paths from $j$ to $i$ and from $i$ to $k$ with inner
elements smaller than $i$.  Proposition~(\ref{wfdot}) can be seen as
follows: under the given hypothesises $\concat{x}{y}$ could only contain a
repetition if $x$ and $y$ have a common inner element.  But this would
contradict $\forall z \neg P_i(z,j,k)$.

We now give a constructive proof of the present $\forall
\ex$-Proposition.  We first formulate the claim, that for our
relation $R$ (suppressed in the notation) and given $i,j,k$ there is a
path $x$ with the following properties.
\begin{itemize}
\item If $x$ is the empty list $\emptyls$, then there is no
$R$-path from $j$ to $k$ with inner elements $<i$, and
\item if $x$ is not the empty list $\emptyls$, then $x$ connects the
  nodes $j$ and $k$, has inner elements $<i$ and is repitition free.
\end{itemize}

\begin{proposition*}[Warshall]
\[
\forall i,j,k \ex x. \bigl(x=\emptyls \to \forall y \neg P_i(y,j,k)\bigr)
\land \bigl(x \ne \emptyls \to P_i(x,j,k) \land \Rf{x} \bigr).
\]
\end{proposition*}

\begin{proof}
Induction on $i$.  \emph{Base} $i=0$.  Given $j,k$.  

\emph{Case} $j=k$.  Choose $x:= \consnil{j}$.  Then
$P_0(\consnil{j},j,k)$ because of $j=k$ and $\Rf{\consnil{j}}$ by
definition.

\emph{Case} $j\ne k$.  

\emph{UCase} $R(j,k)$.  Choose $x:=\con{j}{\consnil{k}}$.  Then we have
$P_0(\con{j}{\consnil{k}},j,k)$ because of $R(j,k)$ and
$\Rf{\con{j}{\consnil{k}}}$ because of $j\ne k$.

\emph{UCase} $\neg R(j,k)$.  Choose $x:=\emptyls$.  We must show
$\forall y\neg P_0(y,j,k)$.  Let $y$ be given, and assume $P_0(y,j,k)$.
Then $R(j,k)$ by \eqref{wf0pfad}, a contradiction.

\emph{Step} $i+1$.  Given $j,k$.  By IH we have $x_i$.
Tp find: $x_{i+1}$.  

\emph{Case} $x_i=\emptyls$.  Then $\forall y\neg P_i(y,j,k)$.  
By IH we have $x_{i,j,i}$ and $x_{i,i,k}$.

\emph{SubCase} $x_{i,j,i}=\emptyls$.  Then $\forall y \neg P_i(y,j,i)$.  
Let $x_{i+1}=\emptyls$.  Given $y$.  Assume $P_{i+1}(y,j,k)$.
by \eqref{pfadzerl1} (because of $\neg P_i(y,j,k)$) we have $\excl y\;
P_i(y,j,i)$.  Contradiction.

\emph{SubCase} $x_{i,j,i} \ne \emptyls$.  

\emph{SubSubCase} $x_{i,i,k}= \emptyls$.  Then $\forall y\neg
P_i(y,i,k)$.  Let $x_{i+1}=\emptyls$.  Given $y$.  Assume
$P_{i+1}(y,j,k)$.  By \eqref{pfadzerl2} (because of $\neg P_i(y,j,k)$)
we have $\excl z\; P_i(z,i,k)$.  Contradiction.

\emph{SubSubCase} $x_{i,i,k} \ne \emptyls$.  Let $x_{i+1}:=
\concat{x_{i,j,i}}{x_{i,i,k}}$.  Then $P_{i+1}(x_{i+1},j,k)$ by
\eqref{pfaddot} and $\Rf{x_{i+1}}$ by \eqref{wfdot}, since $\forall
y\neg P_i(y,j,k)$ follows from $x_i=\emptyls$.

\emph{Case} $x_i \ne \emptyls$.  Choose $x_{i+1}:=x_i$.  Then
$\Rf{x_{i+1}}$ and $P_i(x_{i+1},j,k)$, hence $P_{i+1}(x_{i+1},j,k)$ by
\eqref{pfadlift}.
\end{proof}

From a formal proof of this proposition we can extract the following
program: (original output of \textsc{Minlog}, with renaming of bound
variables, and indentation added)
\begin{verbatim}
[r](Rec 1 nat=>nat=>boole nat=>nat=>nat=>list nat)r
([j,k][if (j=k) ([x6,x7]x6) ([x6,x7]x7)]j:
 ([if (r j k) ([x6,x7]x6) ([x6,x7]x7)](j::k:)(Nil nat)))
([i,f,j,k]
 [if (f j k=(Nil nat)) ([x8,x9]x8) ([x8,x9]x9)]
 ([if (f j i=(Nil nat)) ([x8,x9]x8) ([x8,x9]x9)]
  (Nil nat)
  ([if (f i k=(Nil nat)) ([x8,x9]x8) ([x8,x9]x9)]
   (Nil nat)(f j i|f i k)))
 (f j k))
\end{verbatim}
To make this program more readable, we give the (primitive) recursion
equations for the defined function $f$.  For given $i,j,k$ they either
yield a path from $j$ to $k$ with innee elements $<i$ or else the
empty path $\emptyls$.
\begin{eqnarray*}
f(0,j,k) 
&:=& \hbox{\bf if} \quad j=k\quad\hbox{\bf then} \quad j\colon \quad
\hbox{\bf else}
\\
&&\qquad\hbox{\bf if} \quad Rjk\quad\hbox{\bf then} \quad j :: k\colon
\quad\hbox{\bf else} \quad\emptyls\quad\hbox{\bf fi fi}
\\
f(i+1,j,k) 
&:=& \hbox{\bf if} \quad f(i,j,k)=\emptyls\quad\hbox{\bf then}
\\
&&\qquad\hbox{\bf if} \quad f(i,j,i)=\emptyls\quad\hbox{\bf then}
\\
&&\qquad\qquad\emptyls\quad\hbox{\bf else}
\\
&&\qquad\qquad\hbox{\bf if} \quad f(i,i,k)=\emptyls\quad\hbox{\bf then}
\\
&&\qquad\qquad\qquad\emptyls\quad\hbox{\bf else}
\\
&&\qquad\qquad\qquad \concat{f(i,j,i)}{f(i,i,k)}
\quad\hbox{\bf fi fi} \quad\hbox{\bf else}
\\
&&\qquad f(i,j,k)\quad\hbox{\bf fi}
\end{eqnarray*}
Note that the algorithm in exactly this form is exponential, since in
the step case $f(i+1,j,k)$ it contains the three recursive calls
$f(i,j,k)$, $f(i,j,i)$ und $f(i,i,k)$.  With a well known technique we
can transform it into a polynomial algorithm: consider $f$ as a unary
function computing a $n \times n$-matrix (i.e. \emph{not} as a
function of three arguments).


\subsection{An Informal Proof for the Dijkstra Algorithm}
\mylabel{SS:DijkstraInformal} 
We want to show how the Dijkstra algorithm can be obtained from a
proof of an appropriate existence theorem.  To this end we enrich the
Dijkstra algorithm such that it not only yields shortest distances,
but also corresponding paths.  This seems to be an useful information
anyway.

Notice that a common proof for the correctness of the Dijkstra
algorithm cannot be used for this purpose, since it uses the minimum
principle (it starts with choosing a shortest path
$u_1=v_0,v_1,\dots,v_m,u_{i+1}$ from $v_0$ to $u_{i+1}$) and hence is
not constructive.

So let a weighted graph $\Gamma=(V,E,W)$ be given, where $W \colon E
\to \D{N}$.  For simplicity we assume $V=\{0,1,\dots,N-1 \}$, where $0$
is the distinguished node.  Assume $W(0,0)=0$ and -- if $u,v$ are not
both $0$ -- $W(u,v):=\infty$ if $\{u,v\} \notin E$.

We show: for every node $a$ there is a \inquotes{shortest distance} $s
\in \D{N}$ from the distinguished node $v_0$ to $a$.  Writing
\[
S_f(m) := \sum_{i<m} W(f(i),f(i+1)) \quad\hbox{(distance sum)},
\]
this means
\begin{enumeratea}
\item \label{DijkPropEx} There is a sequence $g$ of $n+1$ nodes
  starting with the distinguished node $0$ and ending with the node
  $a$, whose distance sum $S_g(n)$ is $s$.
\item \label{DijkPropMin} For every sequence $f$ of $m$ nodes, which
  also starts with the distinguished node $0$ and ends with $a$, the
  distance sum $S_f(m)$ is at least as big as $s$.
\end{enumeratea}
In other words:

\begin{theorem*}
  For every $a \in V$ there is an $s \in \D{N}$ such that
  \begin{enumeratea}
  \item \label{Eq:DijkstraSpec:Ex}
    $(\ex g,n{<}N).g(0)=0 \land g(n)=a \land s=S_g(n)$
  \item \label{Eq:DijkstraSpec:Min} $\forall f,m.f(0)=0 \to f(m)=a \to s
    \le S_f(m)$
  \end{enumeratea}
\end{theorem*}

For the proof we shall construct functions $\next \colon V \to V$ and
$d \colon V \to \D{N} \cup \{\infty\}$ with the following intended
meaning:
\begin{alignat*}{2}
&\next(a) &\quad&\text{successor on a shortest path to $0$, or $0$,}
\\
&d(a) &&\text{length of this path.}
\end{alignat*}
For these we will show the following properties, for all $a,b
\in V$:
\begin{align}
&d(0) = 0 \label{Eq:Dijk1}
\\
&a \ne 0 \to \next(a) \ne a \label{Eq:Dijk2}
\\
&d(\next(a)) < \infty \label{Eq:Dijk3}
\\
&d(a) = d(\next(a)) + W(\next(a),a) \label{Eq:Dijk4}
\\
&d(a) \le d(b) + W(b,a)  \label{Eq:Dijk5}
\end{align}
We first show that from \eqref{Eq:Dijk1}--\eqref{Eq:Dijk5} the above
theorem follows.

\begin{proof}
Fix $s := d(a)$.

\eqref{Eq:DijkstraSpec:Ex}.  Let
\[
h(0) := a,\quad h(i+1) := \begin{cases}
\next(h(i)) &\text{if $h(i) \ne 0$}\\
0 &\text{sonst.}
\end{cases}
\]
In case $h(i) \ne 0$ we have
\begin{alignat*}{2}
d(h(i+1)) &= d(\next(h(i))) 
\\
&< d(\next(h(i))) + W(\next(h(i)),h(i)) 
&\quad&\text{because of \eqref{Eq:Dijk2} and \eqref{Eq:Dijk3}}
\\
&= d(h(i)).
&&\text{because of \eqref{Eq:Dijk4}.}
\end{alignat*}
Hence there is a least $n < N$ such that $h(n)=0$.  Let $g(i) :=
h(n-i)$, so $g(0) = h(n) = 0$ and $g(n) = h(0) = a$.  We show
\[
\sum_{k<j} W(g(k),g(k+1)) = d(g(j)),
\]
by induction on $j$.  Basis $j=0$.  Clear from $g(0)=0$.
Step $j \mapsto j+1$.  Because of $j<n$ we have $i := n-j-1 <n$, hence
\begin{alignat*}{2}
h(i+1) &= \next(h(i))
\\
h(n-(n-i-1)) &= \next(h(n-(n-i)))
\\
g(n-i-1) &= \next(g(n-i))
\\
g(j) &= \next(g(j+1)).
\end{alignat*}
Therefore
\begin{alignat*}{2}
&\sum_{k<j+1} W(g(k),g(k+1)) 
\\
&= \sum_{k<j} W(g(k),g(k+1)) + W(g(j),g(j+1))
\\
&= d(g(j)) + W(g(j),g(j+1))
&\quad&\text{by IH}
\\
&= d(\next(g(j+1))) + W(\next(g(j+1)),g(j+1))
&&\text{see above}
\\
&= d(g(j+1))
&&\text{by \eqref{Eq:Dijk4}.}
\end{alignat*}

\eqref{Eq:DijkstraSpec:Min}.  Let $f \colon \D{N} \to V$ be given with
$f(0)=0$.  We show $f(m)=a \to d(a) \le S_f(m)$ by induction on $m$.
Basis $m=0$.  Then $a=f(0)=0$, hence $d(a)=0$ by
\eqref{Eq:Dijk1}.  Step $m \mapsto m+1$.  Assume $a=f(m+1)$.  Then
$s=d(a)=d(f(m+1))$ and
\begin{alignat*}{2}
d(f(m+1)) &\le d(f(m)) + W(f(m),f(m+1)) &\quad&\text{by
\eqref{Eq:Dijk5}}
\\
&\le \sum_{i<m} W(f(i),f(i+1)) + W(f(m),f(m+1))
&&\text{by IH}
\\
&= \sum_{i<m+1} W(f(i),f(i+1))
\\
&= S_f(m+1).
\end{alignat*}
This completes the proof.
\end{proof}

To construct the functions $\next \colon V \to V$ and $d
\colon V \to \D{N} \cup\{\infty\}$ we define, for every $n<N$
\begin{itemize}
\item a set $C_n \subseteq V$, the set of \emph{computed} nodes of
  level $n$,
\item a function $\next_n \colon V \to V$ assigning to every node the
  \emph{next} node on a shortest path from $a$ to $0$, as far as this
  is known at level $n$,
\item a function $d_n \colon V \to \D{N} \cup \{\infty\}$ assigning to
  every node its \emph{distance} from $0$ along the path to $0$
  determined by the $\next$-function, again as far as this is known at
  level $n$,
\item $p_n$, the node \inquotes{picked} at level $n$.
\end{itemize}

Let
\[
C_0 := \{0\},\qquad
\next_0(a) := 0,\qquad
d_0(a) := W(a,0).
\]
Assume that at level $n$ we have picked $p_n$ such that
\begin{equation}
\label{pickprop}
p_n<N \land p_n \notin C_n \land 
\forall a. d_n(a)<d_n(p_n) \to a\in C_n.
\end{equation}
Let
\begin{align*}
C_{n+1} &:= C_n \cup\{p_n \},
\\
\next_{n+1}(a) &:= \begin{cases}
p_n &\hbox{if $d_n(p_n)+W(p_n,a)<d_n(a)$,}\\
\next_n(a) &\hbox{otherwise,}\end{cases}
\\
d_{n+1}(a) &:= \min \{d_n(p_n)+W(p_n,a), d_n(a)\}.
\end{align*}
Observe that the algorithm is relative to another simple search
algorithm $\pick$, which assigns to a given set $C \subsetneq V$ and
distance function $d \colon V\to \D{N} \cup \{\infty\}$ a $\pick(C,d)
\in V\setminus C$ that among all $a \in V\setminus C$ has minimal
distance $d(a)$.

We will prove for every $n<N$:
\begin{align}
&\card{C_n}=n+1,
\label{countCn}
\\
&d_n(0)=0,
\label{dist0}
\\
&a{\ne}0\to \next_n(a)\ne a,
\label{nxtneq}
\\
&\next_n(a)\in C_n,
\label{compnxt}
\\
&d_n(\next_n(a)) < \infty,
\label{finnxt}
\\
&d_n(a)=d_n(\next_n(a))+W(\next_n(a),a),
\label{distnxt}
\\
&b\in C_n \to d_n(a)\le d_n(b)+W(b,a),
\label{cparedist1}
\\
&b\in C_n \to d_n(a)<d_n(b)\to a\in C_n.
\label{cparedist2}
\end{align}
From \eqref{countCn} it follows that $C_{N-1} = V$, and
\eqref{dist0}--\eqref{cparedist1} then express that $d := d_{N-1}$ and
$\next := \next_{N-1}$ satisfy the conditions
\eqref{Eq:Dijk1}--\eqref{Eq:Dijk5}.

It remains to show that \eqref{countCn}--\eqref{cparedist2} hold.
We prove this by induction on $n$.  The base case
$n=0$ is clear.  For the step assume that
\eqref{countCn}--\eqref{cparedist2} hold for $n$, and that $p_n$
is chosen according to \eqref{pickprop}, hence
\[
p_n<N,\quad p_n \notin C_n,\quad 
\forall a. d_n(a)<d_n(p_n) \to a\in C_n.
\]
\eqref{countCn} for $n+1$ follows from $p_n<N$ and $p_n \notin C_n$.
\eqref{dist0} for $n+1$ is clear, and \eqref{nxtneq} for $n+1$ follows
from the definition with IH\eqref{nxtneq}.  Also \eqref{compnxt}
follows immediately from the definitions. -- We now first show
\begin{align}\label{L:Dijkstra}
d_{n+1}(a)=d_n(a)\quad \hbox{for all $a \in C_n$}.
\end{align}
Let $a \in C_n$.  Because of $p_n \notin C_n$ we have $d_n(a) \le
d_n(p_n)$ by IH\eqref{cparedist2}, hence $d_{n+1}(a)=d_n(a)$ by
definition.

\emph{Proof of $d_{n+1}(\next_{n+1}(a)) < \infty$}.  In case 
$d_n(p_n)+W(p_n,a)<d_n(a)$ we have $d_{n+1}(a) = d_n(p_n)+W(p_n,a) <
\infty$, hence
\[
d_{n+1}(\next_{n+1}(a)) = d_{n+1}(p_n) = d_n(p_n) < \infty.  
\]
On the other hand $\next_{n+1}(a) = \next_n(a)$, hence by $\next_n(a)
\in C_n$ (because of \eqref{L:Dijkstra}) also $d_{n+1}(\next_{n+1}(a))
= d_n(\next_n(a)) <\infty$.

\emph{Proof of $\forall a\, d_{n+1}(a)=
  d_{n+1}(\next_{n+1}(a))+W(\next_{n+1}(a),a))$}.  \emph{Case}~1:
$d_n(p_n)+W(p_n,a)<d_n(a)$.  Observe that $d_{n+1}(p_n) = d_n(p_n)$,
for $d_{n+1}(p_n) = \min \{d_n(p_n)+W(p_n,p_n), d_n(p_n)\}$.  Hence
\begin{alignat*}{2}
&d_{n+1}(a)\\
&= d_{n+1}(p_n)+W(p_n,a) 
&\quad&\hbox{by definition and remark}
\\
&= d_{n+1}(\next_{n+1}(a))+W(\next_{n+1}(a),a)
&&\hbox{by definition of $\next_{n+1}(a)$}.
\end{alignat*}
\emph{Case} 2: Otherwise.  Then by definition $d_{n+1}(a)=d_n(a)$ and
$\next_{n+1}(a)=\next_n(a)$.  The claim follows from the IH and
\eqref{L:Dijkstra} because of $\next_n(a) \in C_n$.

\emph{Proof of $\forall a,b. b\in C_{n+1} \to 
d_{n+1}(a)\le d_{n+1}(b)+W(b,a)$}.
Let $b\in C_{n+1}$.  \emph{Case} $b\in C_n$.  Then
\begin{alignat*}{2}
d_{n+1}(a) &\le d_n(a) &\quad&\hbox{by definition}
\\
&\le d_n(b)+W(b,a) &&\hbox{by IH}
\\
&= d_{n+1}(b)+W(b,a) &&\hbox{by \eqref{L:Dijkstra}}.
\end{alignat*}
\emph{Case} 2: $b=p_n$.  Observe again that $d_{n+1}(p_n)=d_n(p_n)$, 
since $d_{n+1}(p_n)=\min \{d_n(p_n)+W(p_n,p_n),d_n(p_n)\}$.  Then
\begin{alignat*}{2}
d_{n+1}(a) &\le d_n(p_n)+W(p_n,a) &\quad&\hbox{by definition}
\\
&= d_{n+1}(p_n)+W(p_n,a) &&\hbox{by the remark}
\\
&= d_{n+1}(b)+W(b,a).
\end{alignat*}

\emph{Proof of $\forall a,b. b\in C_{n+1} \to 
d_{n+1}(a)<d_{n+1}(b) \to a\in C_{n+1}$}.  Assume $b\in C_{n+1}$ and
$d_{n+1}(a)<d_{n+1}(b)$.  \emph{Case} $d_n(p_n)+W(p_n,a)<d_n(a)$,
i.e.\ $d_{n+1}(a)=d_n(p_n)+W(p_n,a)$, hence
\begin{alignat*}{2}
d_n(p_n) &\le d_n(p_n)+W(p_n,a)
\\
&= d_{n+1}(a) &\quad&\hbox{by definition}
\\
&< d_{n+1}(b) &&\hbox{by assumption}
\\
&\le d_n(b) &&\hbox{by definition}.
\end{alignat*}
\emph{Subcase} $b \in C_n$.  Then from the IH and the inequality above
we obtain $p_n \in C_n$, hence a contradiction.  \emph{Subcase}
$b=p_n$.  The above inequality immediately entails the contradiction
$d_n(p_n)<d_n(p_n)$.

\emph{Case} otherwise, i.e.\ $d_{n+1}(a)=d_n(a)$, hence
\begin{alignat*}{2}
d_n(a) &= d_{n+1}(a) &\quad&\hbox{by definition}
\\
&< d_{n+1}(b) &&\hbox{by assumption}
\\
&\le d_n(b) &&\hbox{by definition}.
\end{alignat*}
\emph{Subcase} $b \in C_n$.  From the IH we obtain $a \in C_n$.
\emph{Subcase} $b=p_n$.  The above inequality yields $a \in C_n$, by
the choice of $p_n$.


\section{Notes}\mylabel{S:NotesExtr}
We have made extensive use of
\cite{BergerSchwichtenbergSeisenberger01}.  The idea of using
universal quantifiers without computational content is taken from
Berger's \cite{Berger93a}.  Dan Hernest pointed out an oversight in my
original definition of realizability for $\exnc$.



\chapter{Inductive Definitions}\mylabel{C:ID}
As we have seen, type variables allow for a general treatment of
inductively generated types $\mu \vec{\alpha} \,\vec{\kappa}$.
Similarly, we can use predicate variables to inductively generate
predicates $\mu \vec{X} \,\vec{K}$.  

More precisely, we allow the formation of inductively generated
predicates $\mu \vec{X} \,\vec{K}$, where $\vec{X} =
(X_j)_{j=1,\dots,N}$ is a list of distinct predicate variables, and
$\vec{K} = (K_i)_{i=1,\dots,k}$ is a list of constructor formulas (or
\inquotes{clauses}\index{clause}) containing $X_1,\dots,X_N$ in
strictly positive positions only.

In this chapter, totality plays no role.  For the sake of readability
we therefore use object variables $x, y, \dots$ without a hat $\hat{}$
to range over arbitrary objects of the underlying domain.  


\section{Axioms}
\subsection{Introduction and Elimination Axioms}
\mylabel{SS:ClosElim}
\begin{definition*}
Let $\vec{X} = (X_j)_{j=1,\dots,N}$ be a list of distinct predicate
variables.  \emph{Formulas} $A, B, C, D \in \formulas$,
\emph{predicates} $P, Q, I \in \preds$ and \emph{constructor formulas}
$K \in \clauses(\vec{X})$ are defined inductively as follows.
\begin{align*}
&\frac{\vec{A}, \vec{B}_1, \dots, \vec{B}_n \in \formulas
\quad\hbox{($n \ge 0$)}}
{\allnc \vec{x'} \forall \vec{x}. \vec{A} \to
\bigl(\allnc \vec{y'}_\nu \forall \vec{y}_\nu. 
\vec{B}_\nu \to X_{j_\nu}(\vec{s}_\nu) \bigr)_{\nu = 1,\dots,n}
\to X_j(\vec{t}) \in 
\clauses(\vec{X})}
\\
&\frac{K_1, \dots, K_n \in \clauses(\vec{X}) \quad\hbox{($n \ge 1$)}}
{(\mu \vec{X} \,(K_1, \dots, K_n))_j \in \preds} 
\qquad
\frac{P \in \preds}{P(\vec{r}) \in \formulas}
\qquad
\frac{C \in \formulas}{\set{\vec{x}}{C} \in \preds}
\\
&\frac{A, B \in \formulas}{A \to B \in \formulas}
\qquad
\frac{A, B \in \formulas}{A \land B \in \formulas}
\qquad
\frac{A \in \formulas}{\forall x^{\rho} A \in \formulas}
\qquad
\frac{A \in \formulas}{\allnc x^{\rho} A \in \formulas}
\end{align*}
A predicate of the form $\set{\vec{x}}{C}$ is called a
\indexentry{comprehension term}.  We identify $\set{\vec{x}}{C}(\vec{r})$
with $\subst{C}{\vec{x}}{\vec{r}}$.
\end{definition*}

We shall use $I$ for predicates of the form $(\mu \vec{X} \,(K_1,
\dots, K_k))_j$ only, and for predicates $\vec{P}$ and a constructor
formula
\[
K_i = \allnc \vec{x'}_i \forall \vec{x}_i. \vec{A}_i \to 
\bigl(\allnc \vec{y'}_{i \nu} \forall \vec{y}_{i \nu}. 
\vec{B}_{i \nu} \to X_{j_{i \nu}}(\vec{s}_{i \nu})\bigr)_{\nu = 1,\dots,n_i}
\to X_{j_i}(\vec{t}_i)
\]
with $1 \le i \le k$ we shall write
\[
K_i[\vec{P}] = \allnc \vec{x'}_i \forall \vec{x}_i. \vec{A}_i \to 
\bigl(\allnc \vec{y'}_{i \nu} \forall \vec{y}_{i \nu}.
\vec{B}_{i \nu} \to P_{j_{i \nu}}(\vec{s}_{i \nu})\bigr)_{\nu = 1,\dots,n_i}
\to P_{j_i}(\vec{t}_i).
\]

Now let $\vec{I} := \mu \vec{X}\,\vec{K}$ be inductively defined
predicates.  According to their intended meaning, we postulate the
\emph{introduction axioms} $\vec{K}[\vec{I}]$, i.e.\ all axioms
\begin{equation}
\label{E:intro}
K_i[\vec{I}] = \allnc \vec{x'}_i \forall \vec{x}_i. \vec{A}_i \to 
\bigl(\allnc \vec{y'}_{i \nu} \forall \vec{y}_{i \nu}.
\vec{B}_{i \nu} \to I_{j_{i \nu}}(\vec{s}_{i \nu})\bigr)_{\nu = 1,\dots,n_i}
\to I_{j_i}(\vec{t}_i)
\end{equation}
for $i=1,\dots,k$, and for $j=1,\dots,N$ the \emph{elimination
axioms}\index{elimination axiom}
\[
\allnc \vec{x}_j. K_1[\vec{P}] \to \dots \to K_k[\vec{P}] \to 
I_j(\vec{x}_j) \to P_j(\vec{x}_j).
\]

\subsection{Introduction and Elimination Axioms}
\mylabel{SS:StrengthElim} However, in applications one often wants to
use a strengthened form of the elimination axioms.  For their
formulation it is useful to introduce the notation
$K[\vec{Q},\vec{P}]$ for
\begin{align*}
% K[\vec{Q},\vec{P}] :=
\allnc \vec{x'}_j \forall \vec{x}_j. \vec{A} \to
&\bigl(\allnc \vec{y'}_\nu \forall \vec{y}_\nu. 
\vec{B}_\nu \to Q_{j_\nu}(\vec{s}_\nu) \bigr)_{\nu = 1,\dots,n} \to
\\
&\bigl(\allnc \vec{y'}_\nu \forall \vec{y}_\nu.
\vec{B}_\nu \to P_{j_\nu}(\vec{s}_\nu) \bigr)_{\nu = 1,\dots,n} \to
P_j(\vec{t}).
\end{align*}
Then the \emph{strengthened
  elimination axioms}\index{elimination axiom!strengthened} are
\begin{equation}
\label{E:elim}
\allnc \vec{x}_j. K_1[\vec{I}, \vec{P}] \to \dots \to K_k[\vec{I}, \vec{P}] \to 
I_j(\vec{x}_j) \to P_j(\vec{x}_j).
\end{equation}
They are indeed stronger (or better: easier to use), because each
premise $K_i[\vec{I}, \vec{P}]$ is weaker than $K_i[\vec{P}]$ (because
$K_i[\vec{I}, \vec{P}]$ has more premises than $K_i[\vec{P}]$).
However, there is no essential difference, because from the (ordinary)
elimination axiom
\[
\allnc \vec{x}_j. K_1[\vec{I} \land \vec{P}] \to \dots \to 
K_k[\vec{I} \land \vec{P}] \to I_j(\vec{x}_j) \to I_j(\vec{x}_j)
\land P_j(\vec{x}_j)
\]
(with $\vec{I} \land \vec{P}$ denoting the list of predicates
$\set{\vec{x}_j}{I_j(\vec{x}_j) \land P_j(\vec{x}_j)}$) we can derive the
strengthened one \eqref{E:elim}.
%% \[
%% \allnc \vec{x}_j. K_1[\vec{I}, \vec{P}] \to \dots \to K_k[\vec{I}, \vec{P}] \to 
%% I_j(\vec{x}_j) \to P_j(\vec{x}_j).
%% \]
To see this, assume $\vec{x}_j$, $K_1[\vec{I}, \vec{P}]$ $\dots$
$K_k[\vec{I}, \vec{P}]$ and $I_j(\vec{x}_j)$.  We must show
$P_j(\vec{x}_j)$.  To this end we use the ordinary elimination axiom
above.  Hence it suffices to prove each $K_i[\vec{I} \land \vec{P}]$.
So assume $\vec{x'}$, $\vec{x}$, $\vec{A}$ and $\allnc \vec{y'}_\nu
\forall \vec{y}_\nu. \vec{B}_\nu \to I_{j_\nu}(\vec{s}_\nu) \land
P_{j_\nu}(\vec{s}_\nu)$ for $\nu = 1, \dots, n$.  We must show
$I_j(\vec{t}) \land P_j(\vec{t})$.  Now $I_j(\vec{t})$ follows from
the introduction axioms, and $P_j(\vec{t})$ follows from $K_i[\vec{I},
\vec{P}]$.  \fini

We shall from now on normally use the strengthened elimination axioms,
for they are more useful in practice.

As is to be expected from the terminology, we have conversion rules,
converting a (strengthened) elimination immediately following an
introduction:
\[ \begin{split}
&\Elim_j \vec{p} \vec{q} \subst{\vec{t}_i}{\vec{x}_i}{\vec{r}_i}
(M_\kappa^{K_\kappa[\vec{I}[\vec{p}], \vec{P}[\vec{p},\vec{q}]]}
)_{\kappa = 1, \dots, k} 
(\Intro_i \vec{p} \vec{r'}_i \vec{r}_i \vec{N}_i^P\vec{N}_i^R)
% ^{I_j[\vec{p}](\substnarrow{\vec{t}}{\vec{x}}{\vec{r}})}
\cnv
\\
&\; M_i%^{K_i[\vec{I}[\vec{p}], \vec{P}[\vec{p},\vec{q}]]} 
\vec{r'}_i \vec{r}_i \vec{N}_i^P \vec{N}_i^R
\\
&\; \phantom{M_i}\bigl( \lambda \vec{y}_{i \nu} \lambda \vec{u}_{i \nu}.
\Elim_{j_{i \nu}} \vec{p} \vec{q} 
\substnarrow{\vec{s}_{i \nu}}{\vec{x}_i}{\vec{r}_i} 
(M_\kappa)_{\kappa = 1,\dots,k} 
(N_{i \nu}^R \vec{y}_{i \nu} \vec{u}_{i \nu}) \bigr)_{\nu = 1, \dots, n_i},
\end{split} \]
for $j=1,\dots,N$.  Here $\vec{p}$ are to be substituted for the free
variables of $\vec{I}$, and $\vec{q}$ for those of $\vec{P}$ which are
not in $\vec{I}$.  Moreover, the $\vec{N}_i^P$ are the parameter
arguments for the $i$-th introduction axiom $K_i[\vec{I}]$ (i.e.,
proofs of its premises $\vec{A}_i$), and $\vec{N}_i^R$ are the
recursive arguments (i.e., proofs of its further premises $\allnc
\vec{y'}_{i \nu} \forall \vec{y}_{i \nu}. \vec{B}_{i \nu} \to I_{j_{i
\nu}}(\vec{s}_{i \nu})$).

\subsection{Examples}
\subsubsection{The Even Numbers}
We begin with a very simple example, an inductive definition of the
set $\Even$ of the even numbers.  As underlying algebra we take the
one generated from $0$ by one unary constructor $\suc$, i.e.\ the
natural numbers.  The introduction axioms are
\[\begin{split}
&\Even(0)
\\
&\allnc n. \Even(n) \to \Even(\suc(\suc(n)))
\end{split}\]
and the (strengthened) elimination axiom is
\[\begin{split}
&\allnc n. P(0) \to (\allnc n. \Even(n) \to P(n) \to P(\suc(\suc(n)))) \to
\Even(n) \to P(n).
\end{split}\]

As an example of the use of the elimination axiom we prove
\[
\allnc n.\Even(\suc(\suc(n))) \to \Even(n).
\]
Let $P$ be the comprehension term $\set {n} {\allnc m.n=\suc(\suc(m))
  \to \Even(m)}$.  Then $P(0)$ holds (by ex-falso), and for an
arbitrary $n$ with $\Even(n)$ we have $P(\suc(\suc(n)))$.  Then
$\allnc n.\Even(n) \to P(n)$ by the elimination axiom.  Specializing
this to $\suc(\suc(n))$ and unfolding $P$ gives
\[
\Even(\suc(\suc(n))) \to \allnc m.\suc(\suc(n))=\suc(\suc(m)) \to
\Even(m),
\]
hence the claim.

\subsubsection{The Even and the Odd Numbers}
As an easy example of a simultaneous inductive definition we take the
sets $\Ev$ and $\Od$ of the even and odd numbers.  Again we choose the
natural numbers as the underlying algebra.  The introduction axioms are
\[\begin{split}
&\Ev(0)
\\
&\allnc n. \Od(n) \to \Ev(\suc(n))
\end{split}
\qquad
\begin{split}
&\Od(1)
\\
&\allnc n. \Ev(n) \to \Od(\suc(n))
\end{split}\]
and the (strengthened) elimination axioms are
\[\begin{split}
\allnc n. &P_0(0) \to (\allnc n. \Od(n) \to P_1(n) \to P_0(\suc(n))) \to
\\
&P_1(1) \to (\allnc n. \Ev(n) \to P_0(n) \to P_1(\suc(n))) \to
\Ev(n) \to P_0(n),
\\[6pt]
\allnc n. &P_0(0) \to (\allnc n. \Od(n) \to P_1(n) \to P_0(\suc(n))) \to
\\
&P_1(1) \to (\allnc n. \Ev(n) \to P_0(n) \to P_1(\suc(n))) \to
\Od(n) \to P_1(n).
\end{split}\]

\subsubsection{Trees and Tree Lists}
As another example of a simultaneous inductive definition we consider
trees and tree lists.  In Section~\ref{S:ExAlg}
we viewed trees and tree lists as an example of simultaneously defined
algebras.  Alternatively, we can choose as a somewhat more general
underlying algebra the one generated from $0$ and $\nil$ by one binary
constructor $\cons$, and then single out trees and tree lists by a
simultaneous inductive definition.  Let $a,b$ range over elements of
the underlying algebra.  The introduction axioms are
\[\begin{split}
&\Tree(0)
\\
&\allnc a. \Tlist(a) \to \Tree(a)
\end{split} \qquad \begin{split}
&\Tlist(\nil)
\\
&\allnc a,b. \Tree(a) \to \Tlist(b) \to \Tlist(\cons(a,b))
\end{split}\]
and the (strengthened) elimination axioms are
\[\begin{split}
\allnc a. 
&P_0(0) \to \bigl(\allnc a. \Tlist(a) \to P_1(a) \to P_0(a) \bigr) \to
\\
&P_1(\nil) {\to} \bigl(\allnc a,b. \Tree(a) {\to} \Tlist(b) 
{\to} P_0(a) {\to} P_1(b) {\to} P_1(\cons(a,b))\bigr) {\to} 
\\
&\quad \Tree(a) \to P_0(a),
\\[6pt]
\allnc a. 
&P_0(0) \to \bigl(\allnc a. \Tlist(a) \to P_1(a) \to P_0(a) \bigr) \to
\\
&P_1(\nil) {\to} \bigl(\allnc a,b. \Tree(a) {\to} \Tlist(b) 
{\to} P_0(a) {\to} P_1(b) {\to} P_1(\cons(a,b))\bigr) {\to} 
\\
&\quad \Tlist(a) \to P_1(a).
\end{split}\]


\subsubsection{The Accessible Part of an Ordering}
We assume that we have a binary relation $\prec$.  Its
\indexentry{accessible part} is inductively defined as follows.  The
introduction axiom is
\begin{align*}
\Acc_1^{+} \colon 
&\allnc x. (\forall y.  y \prec x \to  \Acc(y)) \to \Acc(x),
\end{align*}
and the (strengthened) elimination axiom $\Acc^{-}$ is
\begin{align*}
\allnc x. &\bigl( \allnc x. (\forall y. y \prec x \to  \Acc(y)) \to
(\forall y. y \prec x \to  P(y)) \to P(x) \bigr) \to
\\
&\quad \Acc(x) \to P(x).
\end{align*}
Notice that the ordinary elimination axiom in this case is
\[
\allnc x. \bigl( \allnc x. (\forall y. y \prec x \to  P(y)) \to P(x) \bigr) \to
\Acc(x) \to P(x).
\]
Conversion:
\begin{align*}
&\Acc^{-} \vec{q} r M_1^{\allnc x. (\forall y. y \prec x \to \Acc(y)) \to 
(\forall y. y \prec x \to P(y)) \to P(x)}
\bigl( \Acc_1^{+} r N^{R} \bigr) \cnv
\\
&\quad M_1 r N^{R} \lambda y \lambda u^{y \prec r}. 
\Acc^{-} \vec{q} y M_1 (N^{R} y u).
\end{align*}


\subsubsection{The Bar predicate}
Call a sequence $w_0, \dots, w_{n-1}$ of words \emph{good} if there
are indices $i<j<n$ and an embedding $f$ of $w_i$ into $w_j$.  The
introduction axioms are
\begin{align*}
&\allnc \ws. \Good(\ws) \to \Barid(\ws),
\\
&\allnc \ws. \forall w \Barid(\ws * w) \to \Barid(\ws).
\end{align*}
and the (strengthened) elimination axiom is
\begin{align*}
\allnc \ws. &\bigl( \allnc \ws. \Good(\ws) \to P(\ws) \bigr) \to
\\
&\bigl( \allnc \ws. \forall w \Barid(\ws * w) \to 
\forall w P(\ws * w) \to P(\ws) \bigr) \to
\\
&\quad \Barid(\ws) \to P(\ws).
\end{align*}

\subsubsection{The Transitive Closure of a Relation $\prec$}
The introduction axioms are
\begin{align*}
&\allnc x,y. x \prec y \to \TrCl(x,y),
\\
&\allnc x,y,z. x \prec y \to \TrCl(y,z) \to \TrCl(x,z).
\end{align*}
and the (strengthened) elimination axiom is
\begin{align*}
\allnc x,y. &\bigl( \allnc x,y. x \prec y \to P(x,y) \bigr) \to
\\
&\bigl( \allnc x,y,z. x \prec y \to \TrCl(y,z) \to 
P(y,z) \to P(x,z) \bigr) \to
\\
&\quad \TrCl(x,y) \to P(x,y).
\end{align*}

\subsubsection{The Strongly Normalizable $\lambda$-Terms}
Introduction axioms:
\begin{align*}
&\SN(\Var(0))
\\
&\allnc M. \bigl( \forall N. (M \rightsquigarrow N) \to \SN(N) \bigr) \to 
\SN(M),
\end{align*}
Here $\Var(n)$ denotes the $n$-th (untyped) variable, and $M
\rightsquigarrow N$ expresses that $M$ reduces to $N$ in one step.

\subsubsection{The Strongly Computable $\lambda$-Terms}
The set $\SC^{\mu_j}$ of strongly computable\index{strong
computability} $\lambda$-terms of type $\mu_j$ (cf.\
Subsection~\ref{SS:SC}).  Here $\SC_1$ are
previously defined $\SC$-predicates, for previous types.  Introduction
axioms:
\begin{align*}
&\SC(\Var(0))
\\[6pt]
\allnc M. &\bigl( \forall N^P,N^R. M=c(N^P,N^R) \to \SC_1(N^P) \bigr) \to
\\
&\bigl( \forall N^P,N^R,K.M=c(N^P,N^R) \to \SC_1(K) \to
 \SC(N^R K) \bigr) \to
\\
&\bigl( \forall N. (M \rightsquigarrow N) \to \SC(N) \bigr) \to
\\
&\quad \SC(M).
\end{align*}

As an example of predicates defined by simultaneous induction we
consider $\SC^{\tree}$ and $\SC^{\tlist}$, defining the strongly
computable terms of these types.  The algebras $\tree$ and $\tlist$
have been simultaneously defined in with
constructors
\[
\leaf^{\typeN \to \tree},
\branch^{\tlist \to \tree},
\emp^{\tlist},
\tcons^{\tree \to \tlist \to \tlist}.
\]
Following the general pattern above, the clauses for $\SC^{\tree}$ and
 $\SC^{\tlist}$ are
\begin{align*}
&\SC^{\tree}(\leaf(0)),
\\[6pt]
\allnc M. &\bigl( \forall N^{\typeN}. M=\leaf(N) \to \SC^{\typeN}(N) \bigr) \to
\\
&\bigl( \forall N^{\tlist}. M=\branch(N) \to \SC^{\tlist}(N) \bigr) \to
\\
&\bigl( \forall N^{\tree}. (M \rightsquigarrow N) \to \SC^{\tree}(N) \bigr) \to
\\
&\quad \SC^{\tree}(M),
\\[6pt]
&\SC^{\tlist}(\emp),
\\[6pt]
\allnc M. &\bigl( \forall N_1^{\tree}, N_2^{\tlist}. 
M=\tcons(N_1, N_2) \to \SC^{\tree}(N_1) \bigr) \to
\\
&\bigl( \forall N_1^{\tree}, N_2^{\tlist}. 
M=\tcons(N_1, N_2) \to \SC^{\tlist}(N_2) \bigr) \to
\\
&\bigl( \forall N^{\tlist}. (M \rightsquigarrow N) \to \SC^{\tlist}(N) \bigr) \to
\\
&\quad \SC^{\tlist}(M).
\end{align*}

The following inductive definitions of disjunction, equality, the
tensor, the existential quantifier and falsity have already been
considered by Martin-L\"of \cite{MartinLoef71} and are used in the
proof systems \textsc{Coq} \cite{PaulinMohringWerner93} and ALF
\cite{CoquandC92}; see also Berger's draft \cite{Berger95b}.

\subsubsection{Disjunction\index{disjunction}}
$A_1 \lorc A_2 := \mu X(A_1 \to X, A_2
\to X)$.  The introduction axioms are
\begin{align*}
&\orcIzero \colon A_1 \to A_1 \lorc A_2 
\\ 
&\orcIone \colon A_2 \to A_1 \lorc A_2
% 
\end{align*}
and the elimination axiom is
\[
\orcE \colon (A_1 \to C) \to (A_2 \to C) \to A_1 \lorc A_2 \to C.
\]
Conversion rules:
\[\begin{split}
\orcE M_i^{A_1 \to C} M_2^{A_2 \to C} 
\bigl( \orcIzero N^{A_1} \bigr) \cnv M_1 N,
\\
\orcE M_i^{A_1 \to C} M_2^{A_2 \to C} 
\bigl( \orcIone N^{A_2} \bigr) \cnv M_2 N,
\end{split}\]
and in case $A_1 \lorc A_2$ has free variables to be substituted by
$\vec{p}$ and the remaining free variables of $C$ are to be
substituted by $\vec{q}$
\[\begin{split}
\orcE \vec{p} \vec{q} M_i^{A_1[\vec{p}] \to C[\vec{p}, \vec{q}]} 
M_2^{A_2[\vec{p}] \to C[\vec{p}, \vec{q}]} 
\bigl( \orcIzero \vec{p} N^{A_1[\vec{p}]} \bigr) \cnv M_1 N,
\\
\orcE \vec{p} \vec{q} M_i^{A_1[\vec{p}] \to C[\vec{p}, \vec{q}]} 
M_2^{A_2[\vec{p}] \to C[\vec{p}, \vec{q}]} 
\bigl( \orcIone \vec{p} N^{A_2[\vec{p}]} \bigr) \cnv M_2 N.
\end{split}\]

\subsubsection{Equality\index{equality}}
$\Eq := \mu X \allnc x. X(x,x)$.
The introduction axiom is
\[
\EqI \colon \allnc x \Eq(x,x)
\]
and the elimination axiom
\[
\EqE \colon \allnc x,y. \allnc x R(x,x) \to \Eq(x,y) \to R(x,y).
\]
The conversion rule is
\[
\Eq^- \vec{q} r r M^{\allnc x R[\vec{q}](x,x)} (\Eq^+ r) \cnv M r.
\]


\subsubsection{Tensor\index{tensor}}
$A_1 \ltensor A_2 := \mu X(A_1 \to
A_2 \to X)$.  The introduction axiom is
\[
\ltensorI \colon A_1 \to A_2 \to A_1 \ltensor A_2
\]
and the elimination axiom is
\[
\ltensorE \colon (A_1 \to A_2 \to C) \to A_1 \ltensor A_2 \to C.
\]
Conversion  (assuming that there are no free variables in $A_1$,
$A_2$ and $C$):
\[
\ltensorE M^{A_1 \to A_2 \to C}(\ltensorI N_1^{A_1} N_2^{A_2}) \cnv
M N_1 N_2.
\]

\subsubsection{Existential Quantifier\index{existential quantifier}}
\mylabel{SS:ExQuant} $\ex Q^{(\alpha)} := \mu X \forall
x^\alpha. Q(x) \to X$.  The introduction axiom is
\[
\excI \colon \forall y^\rho. A \to \ex y^\rho A
\]
where $\ex y^\rho A$ abbreviates $\ex \set{y^\rho}{A}$, and the
elimination axiom is
\[
\excE \colon (\forall y^\rho. A \to C) \to \ex y^\rho A \to C.
\]
Conversion:
\[
\excE \vec{p} \vec{q} M^{\allnc y^\rho. A[\vec{p}] \to C[\vec{p}, \vec{q}]}
\bigl( \excI \vec{p} t^\rho N^{\subst{A[\vec{p}]}{y}{t}} \bigr)
\cnv MtN.
\]

\subsubsection{Falsity\index{falsity}}
This example is somewhat extreme, since the list $\vec{K}$ in the
general form $\mu \vec{X} \,\vec{K}$ is empty here.  There is no
introduction axiom, and hence no conversion as well; the elimination
axiom is
\[
\falsumE \colon \falsum \to A.
\]

\subsection{Cases}
\mylabel{SS:Casesid}
As in Section~\ref{SS:Cases} there is an
important variant of the elimination axiom, where for a certain $P_j$
no induction hypotheses are used.  To understand what this means,
consider a $P_j$-clause
\[
\allnc \vec{x'} \forall \vec{x}. \vec{A} \to
\bigl(\allnc \vec{y'}_\nu \forall \vec{y}_\nu. 
\vec{B}_\nu \to X_{j_\nu}(\vec{s}_\nu)\bigr)_{\nu = 1, \dots, n}
\to X_j(\vec{t}).
\]
In the (strengthened) elimination axiom it gives rise to a premise
$K[\vec{I}, \vec{P}]$
\begin{align*}
\allnc \vec{x'} \forall \vec{x}. \vec{A} \to
&\bigl(\allnc \vec{y'}_\nu \forall \vec{y}_\nu. 
\vec{B}_\nu \to I_{j_\nu}(\vec{s}_\nu) \bigr)_{\nu = 1, \dots, n} \to
\\
&\bigl(\allnc \vec{y'}_\nu \forall \vec{y}_\nu. 
\vec{B}_\nu \to P_{j_\nu}(\vec{s}_\nu) \bigr)_{\nu = 1, \dots, n} \to
P_j(\vec{t}).
\end{align*}
For the cases axiom we instead take $K^{\Cases}[\vec{I}, \vec{P}]$:
\[
\allnc \vec{x'} \forall \vec{x}. \vec{A} \to
\bigl(\allnc \vec{y'}_\nu \forall \vec{y}_\nu. 
\vec{B}_\nu \to I_{j_\nu}(\vec{s}_\nu) \bigr)_{\nu = 1, \dots, n} \to
P_j(\vec{t}).
\]
The \emph{cases axiom}\index{cases
axiom}\index{cases-axiom@$\CasesAxiom$-axiom} then is
\[
\CasesAxiom_{I_j(\vec{x}) \to P_j(\vec{x})} \colon 
\allnc \vec{x}. K^{\Cases}_{i_1}[\vec{I}, \vec{P}] \to \dots \to 
K^{\Cases}_{i_k}[\vec{I}, \vec{P}] \to 
I_j(\vec{x}) \to P_j(\vec{x}),
\]
where $K^{\Cases}_{i_1}[\vec{I}, \vec{P}], \dots,
K^{\Cases}_{i_k}[\vec{I}, \vec{P}]$ consists of all clauses
$K^{\Cases}_i[\vec{I}, \vec{P}]$ concerning $P_j$.  So this axiom
amounts to distinguish cases on all clauses generating $I_j$.

Examples are
\[
\CasesAxiom_{\Even(n) \to A} \colon \allnc n. \subst{A}{n}{0} \to
\allnc n. \subst{A}{n}{\suc(\suc(n))} \to
\Even(n) \to A
\]
and for the simultaneous inductive definition of trees and tree lists
above
\[\begin{split}
\CasesAxiom_{\Tlist(b) \to A} \colon &\allnc b. \subst{A}{b}{\nil} \to
\\
& \bigl(\allnc a,b. \Tree(a) \to \Tlist(b) \to 
\subst{A}{b}{\cons(a,b)}\bigr) \to
\\
&\quad \Tlist(b) \to A.
\end{split}\]


\section{Computational Content}
\mylabel{S:CompCont} The intended meaning of an inductively defined
predicate constant $I$ is quite clear.  However, we first have to make
up our mind as to whether it is to have computational content.  We can
decide that we do not want computational content, but only when all
clauses $K$ are \inquotes{invariant} (i.e.\ have the property that $r
\mr K$ is the same as $K$).  Then we can only apply the elimination
axiom to invariant formulas as well.  Both conditions are needed for
the Soundness Theorem.

Suppose $I$ is to have computational content.  Then the new predicate
$I^{\mrind}$ to be used in the definition of realizability should have
an arity $(\mu, \vec{\rho})$, where the first argument of type $\mu$
represents a generation tree, witnessing how the other arguments were
put into the inductively defined predicate.

Clearly this type $\mu$ is an algebra type in the sense of
Chapter~\ref{C:Alg}: it is one component of the types $\vec{\mu} = \mu
\vec{\alpha}\,\vec{\kappa}$ generated from constructor types
$\kappa_i := \tau(K_i)$ for all constructor formulas $K_1, \dots K_k$
from $\vec{I} = \mu \vec{X} \,(K_1, \dots, K_k)$.  In case there is
no nullary constructor type for $\mu$, we add one with the name
\textsf{Dummy}$\mu$.

Notice that for $k$ predicate variables in the clauses of $I$, we have
$2^k$ possibilities for the type $\mu$, depending on which of these
predicate variables are to have Harrop degree $0$.  For example, the
inductive definition of the existential quantifier in \ref{SS:ExQuant}
needs two versions, depending on whether we use a predicate variable
$\hat{Q}$ of Harrop degree $0$ or $Q$ of Harrop degree $1$.

So we extend for inductively defined predicate constants the
definition of the computational content from 
Section~\ref{S:Cont} by
\begin{align*}
\tau(I(\vec{s})) &:= \begin{cases} \mu
&\hbox{if $I$ has computational content}\\
\nulltype &\hbox{otherwise}
\end{cases}
\end{align*}
and the definition of realizability from 
Section~\ref{S:Real} by
\begin{align*}
r \mr I(\vec{s}) &\;=\;  \begin{cases}
I^{\mrind}(r, \vec{s})
&\hbox{if $I$ has computational content}\\
I(\vec{s}) &\hbox{otherwise.}
\end{cases}
\end{align*}

From the intended meaning of $\vec{I}^{\mrind}$ it is rather obvious
how these predicates should de defined inductively.  For every
constructor formula
\[
K = \allnc \vec{x'} \forall \vec{x}. \vec{A} \to 
\bigl( \allnc \vec{y'}_\nu \forall \vec{y}_\nu. 
\vec{B}_\nu \to X_{j_\nu}(\vec{s}_\nu) \bigr)_{\nu = 1, \dots, n} \to
X_j(\vec{t})
\]
of the original inductive definition of $\vec{I}$ we build the new
constructor formula $K^{\mrind}$ as
\begin{align*}
\allnc \vec{x'} \forall \vec{x}, \vec{u}, \vec{f}. 
\vec{u} \mr \vec{A} \to {}
&\bigl(\allnc \vec{y'}_\nu \forall \vec{y}_\nu, \vec{v}_\nu. 
\vec{v}_\nu \mr \vec{B}_\nu \to Y_{j_\nu}
(f_\nu \vec{y}_\nu \vec{v}_\nu, \vec{s}_\nu)\bigr)_{\nu = 1, \dots, n} \to
\\
&Y_j(c \vec{x} \vec{u} \vec{f}, \vec{t}).
\end{align*}
Here $c$ is the constructor of the algebra $\vec{\mu} = \mu
\vec{\alpha}\,\vec{\kappa}$ generated from our constructor types
$\kappa_i := \tau(K_i)$ (i.e.\ for $K_i$ we have $c := \constr_i$).
Recall that
\[
\tau(K) = \vec{\rho} \to \tau(\vec{A}) \to
\bigl( \vec{\sigma}_\nu \to \tau(\vec{B}_\nu) \to \alpha_{j_\nu} 
\bigr)_{\nu = 1, \dots, n} \to \alpha_j \in \constrtypes(\vec{\alpha}),
\]
and $c$ is the corresponding constructor.  Then $\vec{I}^{\mrind} :=
\mu \vec{Y}\,(\vec{K}^{\mrind})$, an inductive definition with no
computational content.  The \emph{introduction axioms} for
$I_j^{\mrind}$ are $K^{\mrind}[\vec{I}^{\mrind}]$:
\begin{align*}
\allnc \vec{x'} \forall \vec{x} \forall \vec{u}, \vec{f}. 
\vec{u} \mr \vec{A} \to {}
&\bigl(\allnc \vec{y'}_\nu \forall \vec{y}_\nu, \vec{v}_\nu. 
\vec{v}_\nu \mr \vec{B}_\nu \to
I^{\mrind}_{j_\nu}(f_\nu \vec{y}_\nu \vec{v}_\nu, \vec{s}_\nu)
\bigr)_{\nu = 1, \dots, n} \to
\\
&I^{\mrind}_j(c \vec{x} \vec{u} \vec{f}, \vec{t})
\end{align*}
and the (strengthened) \emph{elimination axioms} for $I_j^{\mrind}$ are
\[
\allnc \vec{x}, w. K^{\mrind}_1[\vec{I}^{\mrind}, \vec{Q}] \to \dots \to 
K^{\mrind}_k[\vec{I}^{\mrind}, \vec{Q}] \to 
I^{\mrind}_j(w, \vec{x}) \to 
Q_j(w, \vec{x})
\]
where $K^{\mrind}[\vec{I}^{\mrind},\vec{Q}]$ is
\begin{align*}
\allnc \vec{x'} \forall \vec{x}, \vec{u}, \vec{f}. 
\vec{u} \mr \vec{A} \to {}
&\bigl(\allnc \vec{y'}_\nu \forall \vec{y}_\nu, \vec{v}_\nu. 
\vec{v}_\nu \mr \vec{B}_\nu \to
I^{\mrind}_{j_\nu}(f_\nu \vec{y}_\nu \vec{v}_\nu, \vec{s}_\nu)
\bigr)_{\nu = 1, \dots, n} \to
\\
&\bigl(\allnc \vec{y'}_\nu \forall \vec{y}_\nu, \vec{v}_\nu. 
\vec{v}_\nu \mr \vec{B}_\nu \to
Q_{j_\nu}(f_\nu \vec{y}_\nu \vec{v}_\nu, \vec{s}_\nu)
\bigr)_{\nu = 1, \dots, n} \to
\\
&I^{\mrind}_j(c \vec{x} \vec{u} \vec{f}, \vec{t}).
\end{align*}

\begin{examples*}
The accessible part of an ordering $\prec$.  Recall the introduction
axiom
\[
K_1[\Acc] := \allnc x. (\forall y.  y \prec x \to  \Acc(y)) \to \Acc(x).
\]
The corresponding constructor type is
\[
\kappa_1 := \tau(K_1) = (\rho \to \alpha) \to \alpha.
\]
Then the algebra $\algAcc := \mu \alpha \, (\alpha, \kappa_1)$ has two
constructors
\begin{align*}
\textsf{Dummy}\algAcc &\colon \algAcc,
\\
\textsf{Sup} &\colon (\rho \to \algAcc) \to \algAcc.
\end{align*}
Here $\textsf{Dummy}\algAcc$ had to be added, because there is no
nullary constructor type $\kappa_i$ for $\Acc$.  We obtain
\[
K_1^{\mrind}[\Acc^{\mrind}] := 
\allnc x \forall f. (\forall y.  y \prec x \to  \Acc^{\mrind}(f(y),y)) \to
\Acc^{\mrind}(\textsf{Sup}(f),x).
\]
\end{examples*}


\section{Soundness}\mylabel{S:Sound}
Let $\vec{I} := \mu \vec{X} \,(K_1, \dots, K_k)$ be inductively
defined.  We define the extracted programs for the introduction axioms
\eqref{E:intro} and (strengthened) elimination axioms \eqref{E:elim} by
\begin{align*}
\extrTer{\Intro_K} &:= c,
\\
\extrTer{\Elim_j} &:= \rec_j.
\end{align*}

By $K^{\mrind}[\vec{I}^{\mrind}]$ we clearly have $c \mr \Intro_K$.
For to prove
\[
\rec_j \mr 
\bigl( \allnc \vec{x}. 
K_1[\vec{I}, \vec{P}] \to \dots \to K_k[\vec{I}, \vec{P}] \to
I_j(\vec{x}) \to P_j(\vec{x}) \bigr)
\]
let $\vec{x}, w_1, \dots, w_k$ be given such that $w_i \mr K_i[\vec{I},
\vec{P}]$, i.e.
\begin{equation}\label{E:Irwiprop}
\begin{split}
\allnc \vec{x'} \forall \vec{x}, \vec{u}, \vec{f}, \vec{g}. 
\vec{u} \mr \vec{A} \to {}
&\bigl(\allnc \vec{y'}_\nu \forall \vec{y}_\nu, \vec{v}_\nu. 
\vec{v}_\nu \mr \vec{B}_\nu \to
f_\nu \vec{y}_\nu \vec{v}_\nu \mr I_{j_\nu}(\vec{s}_\nu)
\bigr)_{\nu = 1, \dots, n} \to
\\
&\bigl(\allnc \vec{y'}_\nu \forall \vec{y}_\nu, \vec{v}_\nu. \vec{v}_\nu \mr \vec{B}_\nu \to
g_\nu \vec{y}_\nu \vec{v}_\nu \mr P_{j_\nu}(\vec{s}_\nu)
\bigr)_{\nu = 1, \dots, n} \to
\\
&w_i \vec{x} \vec{u} \vec{f} \vec{g} \mr P_j(\vec{t}).
\end{split}
\end{equation}
Let further $w$ be given and assume $w \mr I_j(\vec{x})$,
i.e.  $I^{\mrind}_j(w, \vec{x})$.  Our goal is
\[
\rec_j \vec{w} w \mr P_j(\vec{x}) =: Q_j(w, \vec{x}).
\]
We use the (strengthened) elimination axiom for $I^{\mrind}_j$ with
$Q_j(w, \vec{x})$, i.e.
\[
\allnc \vec{x}, w. K^{\mrind}_1[\vec{I}^{\mrind}, \vec{Q}] \to \dots \to
K^{\mrind}_k[\vec{I}^{\mrind}, \vec{Q}] \to 
I_j^{\mrind}(w, \vec{x}) \to Q_j(w, \vec{x}).
\]
Hence it suffices to prove $K^{\mrind}[\vec{I}^{\mrind}, \vec{Q}]$ for
every constructor formula $K$, i.e.
\begin{equation}\label{E:Irgoal}
\begin{split}
\allnc \vec{x'} \forall \vec{x}, \vec{u}, \vec{f}. \vec{u} \mr \vec{A} \to {}
&\bigl(\allnc \vec{y'}_\nu \forall \vec{y}_\nu, \vec{v}_\nu. 
\vec{v}_\nu \mr \vec{B}_\nu \to
I^{\mrind}_{j_\nu}(f_\nu \vec{y}_\nu \vec{v}_\nu, \vec{s}_\nu)
\bigr)_{\nu = 1, \dots, n} \to
\\
&\bigl(\allnc \vec{y'}_\nu \forall \vec{y}_\nu, \vec{v}_\nu.
\vec{v}_\nu \mr \vec{B}_\nu \to
Q_{j_\nu}(f_\nu \vec{y}_\nu \vec{v}_\nu, \vec{s}_\nu)
\bigr)_{\nu = 1, \dots, n} \to
\\
&Q_j(c \vec{x} \vec{u} \vec{f}, \vec{t}).
\end{split}
\end{equation}
So assume $\vec{x'}, \vec{x}, \vec{u}, \vec{f}$ and the premises of
\eqref{E:Irgoal}.  We must show $Q_j(c \vec{x} \vec{u} \vec{f},
\vec{t})$, i.e.,
\[
\rec_j \vec{w} (c \vec{x} \vec{u} \vec{f}) \mr P_j(\vec{t}).
\]
Since $c = \constr_i$, by the conversion rules for $\rec$ this is the
same as
\[
w_i \vec{x} \vec{u} \vec{f} 
\bigl( (\rec_{j_1} \vec{w}) \circ f_1 \bigr) \dots 
\bigl( (\rec_{j_n} \vec{w}) \circ f_n \bigr) \mr P_j(\vec{t}).
\]
To this end we use \eqref{E:Irwiprop} with $\vec{x'}, \vec{x},
\vec{u}, \vec{f}, (\rec_{j_1} \vec{w}) \circ f_1 ,\dots , (\rec_{j_n}
\vec{w}) \circ f_n$.  Its conclusion is what we want, and its premises
follow from the premises of \eqref{E:Irgoal}.

\begin{comment}
For the ordinary elimination axioms
\[
\Elim_j \colon K_1[\vec{P}] \to \dots \to K_k[\vec{P}] \to 
\allnc \vec{x}. I_j(\vec{x}) \to P_j(\vec{x}).
\]
we can define the extracted programs by
\begin{align*}
\extrTer{\Elim_j} &:= F_j \quad \hbox{(to be determined below).}
\end{align*}
We now prove
\[
F_j \mr \bigl( K_1[\vec{P}] \to \dots \to K_k[\vec{P}]
\to \allnc \vec{x}. I_j(\vec{x}) \to P_j(\vec{x}) \bigr).
\]
So let $w_1, \dots, w_k$ be given such that $w_i \mr
K_i[\vec{P}]$, i.e.
\begin{align*}
\allnc \vec{x} \forall \vec{u}, \vec{f}. 
\vec{u} \mr \vec{A} \to {}
&\bigl(\forall \vec{y}_1, \vec{v}_1. 
\vec{v}_1 \mr \vec{B}_1 \to
f_1 \vec{y}_1 \vec{v}_1 \mr P_{j_1}(\vec{s}_1)\bigr) 
\to \dots \to
\\ 
&\bigl(\forall \vec{y}_n, \vec{v}_n. 
\vec{v}_n \mr \vec{B}_n \to
f_n \vec{y}_n \vec{v}_n \mr P_{j_n}(\vec{s}_n)\bigr) \to
\\
&w_i \vec{u} \vec{f} \mr P_j(\vec{t}).
\end{align*}
Let further $\vec{x}, w$ be given and assume $w \mr
I_j(\vec{x})$, i.e.  $I^{\mrind}_j(w, \vec{x})$.
Our goal is
\[
F_j \vec{w} w \mr P_j(\vec{x}).
\]
We use the elimination axiom for $I^{\mrind}_j$ with $Q_j(w,
\vec{x}) := F_j \vec{w} w \mr P_j(\vec{x})$,
i.e.
\[
K^{\mrind}_1[\vec{Q}] \to \dots \to K^{\mrind}_k[\vec{Q}] \to 
\allnc \vec{x}, w. 
I_j^{\mrind}(w, \vec{x}) \to Q_j(w, \vec{x}).
\]
Hence it suffices to prove $K^{\mrind}[\vec{Q}]$ for every
constructor formula $K$, i.e.
\begin{align*}
\allnc \vec{x} \forall \vec{u}, \vec{f}. 
\vec{u} \mr \vec{A} \to {}
&\bigl(\forall \vec{y}_1, \vec{v}_1. 
\vec{v}_1 \mr \vec{B}_1 \to
F_{j_1} \vec{w} (f_1 \vec{y}_1 \vec{v}_1) 
\mr P_{j_1}(\vec{s}_1)\bigr) \to \dots \to
\\ 
&\bigl(\forall \vec{y}_n, \vec{v}_n. 
\vec{v}_n \mr \vec{B}_n \to
F_{j_n} \vec{w} (f_n \vec{y}_n \vec{v}_n) 
\mr P_{j_n}(\vec{s}_n)\bigr) \to
\\
&F_j \vec{w} (c \vec{x} \vec{u} \vec{f}) 
\mr P_j(\vec{t}).
\end{align*}
So let $\vec{x}, \vec{u}, \vec{f}$ be given such
that $\vec{u} \mr \vec{A}$.  Assume further that for $i=1,
\dots, n$ we have $\forall \vec{y}_i,
\vec{v}_i. \vec{v}_i \mr \vec{B}_i \to F_j \vec{w}
(f_i \vec{y}_i \vec{v}_i) \mr P_{j_i}(\vec{s}_i)$.
Let
\[
g_i := \lambda \vec{y}_i \lambda \vec{v}_i. 
F_{j_i} \vec{w} (f_i \vec{y}_i \vec{v}_i)
\]
and apply $w_i \mr K_i[\vec{P}]$ with $\vec{x},
\vec{u}$ and $\vec{g}$.  Then $w_i \vec{u}
\vec{g} \mr P_j(\vec{t})$.  So $F_j$ should satisfy
\[
F_j \vec{w} (c \vec{x} \vec{u} \vec{f}) \cnv 
w_i  \vec{u}
\bigl(\lambda \vec{y}_1 \lambda \vec{v}_1. 
F_{j_1} \vec{w} (f_1 \vec{y}_1 \vec{v}_1)\bigr) {\dots}
\bigl(\lambda \vec{y}_n \lambda \vec{v}_n. 
F_{j_n} \vec{w} (f_n \vec{y}_n \vec{v}_n)\bigr).
\]
This can be viewed as a simultaneous definition of the $F_j
\vec{w} w$ by recursion on $w$.  Formally, define
\[
F_j \vec{w} w := \rec_j \vec{w}' w
\ \hbox{with} \
w_i' \vec{x} \vec{u} \vec{f} := 
w_i \vec{u}.
\]
Then
\begin{align*}
&F_j \vec{w} (c \vec{x} \vec{u} \vec{f}) 
\\
&= \rec_j \vec{w}' (c \vec{x} \vec{u} \vec{f})
\\
&= w_i' \vec{x} \vec{u} \vec{f} 
\bigl( (\rec_{j_1} \vec{w}') \circ f_1 \bigr) \dots
\bigl( (\rec_{j_n} \vec{w}') \circ f_n \bigr) 
\\
&= w_i' \vec{x} \vec{u} \vec{f} 
\bigl( \lambda \vec{y}_1 \lambda \vec{v}_1. 
\rec_{j_1} \vec{w}'(f_1 \vec{y}_1 \vec{v}_1) \bigr) \dots
\bigl( \lambda \vec{y}_n \lambda \vec{v}_n. 
\rec_{j_n} \vec{w}'(f_n \vec{y}_n \vec{v}_n) \bigr)
\\
&= w_i \vec{u}
\bigl(\lambda \vec{y}_1 \lambda \vec{v}_1. 
F_{j_1} \vec{w} (f_1 \vec{y}_1 \vec{v}_1)\bigr) \dots
\bigl(\lambda \vec{y}_n \lambda \vec{v}_n. 
F_{j_n} \vec{w} (f_n \vec{y}_n \vec{v}_n)\bigr).
\end{align*}
\end{comment}


\section{Notes}\mylabel{S:NotesID}
Part of the the material in the present Chapter~\ref{C:ID} is based on
Monika Seisenberger's Thesis \cite{Seisenberger03}.


\chapter{Program Extraction from Classical Proofs}
\mylabel{C:Class}

In this chapter we will concentrate on the question of classical
versus constructive proofs.  It is known that any classical proof of a
specification of the form $\forall x\excl y B$ with $B$
quantifier-free can be transformed into a constructive proof of the
same formula.  However, when it comes to extraction of a program from
a proof obtained in this way, one easily ends up with a mess.
Therefore, some refinements of the standard transformation are
necessary.

We develop a refined method of extracting reasonable and sometimes
unexpected programs from classical proofs.  We also generalize
previously known results since $B$ in $\forall x\excl y B$ no longer
needs to be quantifier-free, but only has to belong to the strictly
larger class of \emph{goal formulas} defined in
Section~\ref{S:Definite}.  Furthermore we allow unproven lemmas $D$ in
the proof of $\forall x\excl y B$, where $D$ is a \emph{definite}
formula (also defined in Section~\ref{S:Definite}).

Other interesting examples of program extraction from classical proofs
have been studied by Murthy \cite{Murthy90}, Coquand's group (see
e.g.\ \cite{CoquandPersson99}) in a type theoretic context and by
Kohlenbach \cite{Kohlenbach96a} using a Dialectica
inter\-pre\-ta\-tion.

There is also a different line of research aimed at giving an
algorithmic interpretation to (specific instances of) the classical
double negation rule.  It essentially started with
Griffin's\index{Griffin} observation \cite{Griffin90} that
Felleisen's\index{Felleisen} control operator $\C{C}$
\cite{FelleisenFriedmanKohlbeckerDuba87,FelleisenHieb92} can be given
the type of the stability\index{stability} scheme $\neg \neg A \to A$.
This initiated quite a bit of work aimed at extending the Curry-Howard
correspondence\index{Curry-Howard correspondence} to classical logic,
e.g.\ by Barbanera and Berardi \cite{BarbaneraBerardi93}, Constable
and Murthy \cite{ConstableMurthy91}, Krivine \cite{Krivine94} and
Parigot \cite{Parigot92}.

We now describe in more detail what the chapter is about.  In Section
\ref{S:IntArith} we fix our version of intuitionistic arithmetic for
functionals, and recall how classical arithmetic can be seen as a
subsystem.  Then our argument goes as follows.  It is well known that
from a derivation of a classical existential formula $\excl y A :=
(\forall y.A \to \falsum) \to \falsum$ one generally cannot read off an
instance.  A simple example has been given by Kreisel: Let
$R$ be a primitive recursive relation such that $\excl z R(x,z)$ is
undecidable.  Clearly we have -- even logically --
\[
\vdash\forall x \excl y \forall z.R(x,z) \to R(x,y).
\]
But there is no computable $f$ satisfying
\[
\forall x \forall z.R(x,z) \to R(x,f(x)),
\]
for then $\excl z R(x,z)$ would be decidable: it would be true if
and only if $R(x,f(x))$ holds.\footnote{Notice our slightly unusual
formula notation: the scope of a quantifier followed by a dot extends
as far as the surrounding parentheses allow.  Otherwise we follow the
standard convention that quantifiers bind stronger than $\land$, which
binds stronger than $\to$.}

However, it is well known that in case $\excl y G$ with $G$
quantifier-free one \emph{can} read off an instance.  Here is a simple
idea of how to prove this: replace $\falsum$ anywhere in the proof by
$\ex y G$ (we use $\ex$ for the constructive existential
quantifier).  Then the end formula $(\forall y.G \to \falsum) \to \falsum$
is turned into $(\forall y.G \to \ex y G) \to \ex y G$,
and since the premise is trivially provable, we have the claim.

Unfortunately, this simple argument is not quite correct.  First, $G$
may contain $\falsum$, and hence is changed under the substitution $\falsum
\mapsto \ex y G$.  Second, we may have used axioms or lemmata
involving $\falsum$ (e.g.\ $\falsum \to P$), which need not be derivable
after the substitution.  But in spite of this, the simple idea can be
turned into something useful.

To take care of lemmata we normally want to use in a derivation of
$\excl y G$, let us first slightly generalize the situation we are
looking at.  Let a derivation (in minimal logic) of $\excl y G$ from
$\vec{D}$ and axioms
\begin{align*}
\ind_{n, A} \colon \quad & 
\subst{A}{n}{0} \to (\forall n.A\to \subst{A}{n}{n+1}) \to \forall n A
\\
\ind_{p, A} \colon \quad & \subst{A}{p}{\true} \to
\subst{A}{p}{\false} \to \forall p A
\\
\Truthax \colon \quad &
\atom(\true)
\\
\Efq_{A} \colon \quad &
\atom(\false) \to A
\end{align*}
be given.  Here $\atom$ is a unary predicate symbol taking one
argument of the type $\typeBool$ of booleans.  The intended
interpretation of $\atom$ is the set $\{\true\}$; hence ``$\atom(r)$''
means ``$r = \true$''.  Assume that the lemmata $\vec{D}$ and the goal
formula $G$ are such that
\begin{align}
&\vdashi \vec{D} \to \subst{D_i}{\falsum}{\ex y G}, \label{lem1}
\\
&\vdashi \subst{G}{\falsum}{\ex y G} \to \ex y G; \label{lem2}
\end{align}
here $\vdashi$ means derivability in intuitionistic arithmetic, i.e.\
with the additional axioms $\EfqLog_A \colon \falsum \to A$.  The
substitution $\falsum \mapsto \ex y G$ turns the axioms above
(except $\EfqLog_A$) into instances of the same scheme with different
formulas, and hence from our given derivation (in minimal logic) of
$\vec{D} \to (\forall y.G \to \falsum) \to \falsum$ we obtain
\[
\vdashi \subst{\vec{D}}{\falsum}{\ex y G} \to
(\forall y. \subst{G}{\falsum}{\ex y G} \to \ex y G) \to
\ex y G.
\]
Now \eqref{lem1} allows to drop the substitution in $\vec{D}$, and by
\eqref{lem2} the second premise is derivable.  Hence we obtain as
desired
\[
\vdashi \vec{D} \to \ex y G.
\]
We shall identify classes of formulas -- to be called \emph{definite}
and \emph{goal} formulas -- such that slight generalizations of
\eqref{lem1} and \eqref{lem2} hold.  This will be done in
Section~\ref{S:Definite}.

We will also give (in Section~\ref{S:CompContentSec}) an explicit and
useful representation of the program term extracted (by the well-known
modified realizability interpretation, cf.\
\cite{TroelstravanDalen88}) from the derivation $M$ of $\vec{D} \to
\ex y G$ just constructed.  The program term has the form $p t_1
\dots t_n s$, where $p$ is extracted from $M$ and $t_1, \dots, t_n, s$
are determined by the formulas $\vec{D}$ and $G$ only.

Since the constructive existential quantifier $\ex$ only enters our
derivation in the context $\ex y G$, it is easiest to replace this
formula everywhere by a new propositional symbol $X$ and stipulate
that a term $r$ realizes $X$ iff $\subst{G}{y}{r}$.  This allows for a
short and self-contained exposition -- in Section~\ref{S:Extract} -- of
all we need about modified realizability, including the soundness
theorem.  In Section~\ref{S:CompContentSec} we then prove our main
theorem about program extraction from classical proofs.

The final Section~\ref{S:Examples} then contains some examples of our
general machi\-ne\-ry.  From a classical proof of the existence of the
Fibonacci numbers we extract in \ref{Fibo} a short and surprisingly
efficient program, where $\lambda$-expressions rather than pairs are
passed.  In \ref{SS:Wf} we treat as a further example a classical
proof of the wellfoundedness of $<$ on $\D{N}$.  Finally in
\ref{SS:MoreExamples} we take up a suggestion of Veldman and Bezem
\cite{Bezem92} and present a short classical proof of (the general
form of) Dickson's Lemma, as an interesting candidate for further
study.


\section{Arithmetic for Functionals}
\mylabel{S:IntArith} We restrict the formal system introduced in
Section~\ref{S:Axioms} to the predicate constant $\atom$ and the
predicate variables $\falsum$ and moreover a special nullary predicate
variable $X$.  So \emph{formulas}\index{formulas} are
\[
\falsum,\; X,\: \atom(r^\typeBool),\; A\to B,\; \forall x^\rho A;\quad
\hbox{abbreviation:} \quad \neg A := A \to \falsum.
\]
As \emph{axioms} we take the induction schemes $\ind_{n,A}$ and
$\ind_{p,A}$ for the ground types $\typeN $ and $\typeBool$; for
simplicity we only consider these two algebras in the present
chapter.  In
addition we have the axioms
\begin{alignat*}{2}
\Truthax &\colon \atom(\true)
&\quad&\text{truth axiom\index{truth axiom}}
\\
\Efq_{A} &\colon \atom(\false) \to A
&&\text{ex-falso-quodlibet\index{ex-falso-quodlibet} for $\atom(\false)$}
\\
\EfqLog_A &\colon \falsum \to A
&&\text{ex-falso-quodlibet\index{ex-falso-quodlibet} for $\falsum$}
\end{alignat*}

\begin{comment}
% Old text, based on the APAL paper.  Shortened in the present context.
The system we consider is essentially (the negative fragment of)
{Hey\-ting's intuitionistic 
arithmetic\index{arithmetic!Heyting's} in finite types as described
e.g.\ in \cite{Troelstra73}.  It is based on G\"odel's system
$T$ and just adds the corresponding logical and arithmetical apparatus
to it.  Equations are treated on the meta level by identifying terms
with the same normal form.

\emph{Types}\index{type} are built from ground types $\typeN$ for the
natural numbers and $\typeBool$ for the boolean objects (and possibly
other ground types) by $\rho\to \sigma$.  The
\emph{constants}\index{constant} are
\[
\true^{\typeBool},\; \false^{\typeBool},\; 0^\typeN,\;
\suc^{\typeN \to \typeN},\; \rec_{\typeBool,\rho},\; \rec_{\typeN,\rho}.
\]
$\rec_{\typeN,\rho}$ is the \emph{primitive recursion
operator}\index{recursion operator!primitive} of type $\rho \to
(\typeN \to \rho\to \rho) \to \typeN \to \rho$ and $\rec_{\typeBool,\rho}$ is the
recursion operator for the type $\typeBool$ of booleans, i.e.\ is of type
$\rho \to \rho\to \typeBool \to \rho$ and represents definition by
cases\index{cases!definition by}.  \emph{Terms}\index{term} are
\[
x^\rho,\; c^\rho\ \hbox{($c^\rho$ a constant)},\; 
% \langle r,s\rangle,\;\pi_0(r),\;\pi_1(r),\; 
\lambda x^\rho r,\; rs
\]
with the usual typing rules.  The \emph{conversions}\index{conversion}
are those for the simply typed lambda calculus, plus some new ones for
the recursion operators.  We write $r+1$ for $\suc^{\typeN \to \typeN} r$.
\begin{align*}
\rec_{\typeBool,\rho}rs\,\true  &\quad\mapsto_{\rec} \quad r 
\\
\rec_{\typeBool,\rho}rs\,\false &\quad\mapsto_{\rec} \quad s 
\\
\rec_{\typeN,\rho}rs0 &\quad\mapsto_{\rec} \quad r 
\\
\rec_{\typeN,\rho}rs(t+1) &\quad\mapsto_{\rec} \quad 
st(\rec_{\typeN,\rho}rst)
\end{align*}
It is well known that for this system of terms every term strongly
normalizes, and that the normal form is uniquely determined; hence the
relation $r =_{\beta\rec} s$ is decidable (by normalizing $r$ and
$s$).  By identifying $=_{\beta\rec}$-equal terms (i.e.\ treating
equations on the meta level) we can greatly simplify many formal
derivations.

Let $\atom$ be a unary predicate symbol taking one argument of type
$\typeBool$.  The intended interpretation of $\atom$ is the set
$\{\true\}$; hence \inquotes{$\atom(r)$} means \inquotes{$r=\true$}.
We also allow the propositional symbols $\falsum$ and $X$ (i.e.\ $0$-ary
predicate symbols).  So \emph{formulas}\index{formulas} are
\[
\falsum,\; X,\: \atom(r^\typeBool),\; A\to B,\; \forall x^\rho A;\quad
\hbox{abbreviation:} \quad \neg A := A \to \falsum.
\]
As \emph{axioms} we take the induction schemes $\ind_{n,A}$ and
$\ind_{p,A}$ for the ground types $\typeN $ and $\typeBool$, and in
addition 
\begin{alignat*}{2}
\Truthax &\colon \atom(\true)
&\quad&\text{truth axiom\index{truth axiom}}
\\
\Efq_{A} &\colon \atom(\false) \to A
&&\text{ex-falso-quodlibet\index{ex-falso-quodlibet} for $\atom(\false)$}
\\
\EfqLog_A &\colon \falsum \to A
&&\text{ex-falso-quodlibet\index{ex-falso-quodlibet} for $\falsum$}
\end{alignat*}
% the \inquotes{truth axiom}\index{truth axiom} $\Truthax$ and
% two schemes $\Efq_{A}$ and $\EfqLog_A$ for
% \inquotes{ex-falso-quodlibet}\index{ex-falso-quodlibet}, one for each
% of the two possibilities $\atom(\false)$ and $\falsum$ to express falsity
% (see introduction).  
Note that every instance $\falsum \to A$ of ex-falso-quodlibet is
derivable from $\falsum \to X$ and $\falsum \to \atom(\false)$; this will be
useful in Section~\ref{S:Extract} (when we define the extracted
program $\extrTer{M}$ of a derivation $M$).

\emph{Derivations}\index{derivation} are within minimal
logic\index{logic!minimal}.  They are written in natural deduction
style, i.e.\ as typed $\lambda$-terms via the well-known Curry-Howard
correspondence\index{Curry-Howard correspondence}:
\begin{align*}
& u^B\quad\hbox{(assumptions)},\quad\hbox{axioms},\quad
\\
& (\lambda u^AM^B)^{A\to B},\quad (M^{A\to B} N^A)^B,\quad
\\
& (\lambda x^\rho M^A)^{\forall x^\rho A},\quad 
(M^{\forall x^\rho A}t^\rho)^{\subst{A}{x^\rho}{t^\rho}}
\end{align*}
where in the $\forall$-introduction $\lambda x M^A$, $x$ must not be
free in any $B$ with $u^B \in \FA(M)$; here $\FA(M)$ is the set of
free assumption variables of $M$.
\end{comment}

Let $\Zth^X$ denote this system of intuitionistic arithmetic; $\Zth$
is obtained from $\Zth^X$ by omitting $X$.  $\Zth_0$ ($\Zth_0^X$,
resp.)  is $\Zth$ ($\Zth^X$, resp.) without the axioms $\EfqLog_A$.  For
every $\Zth_0$-derivation $M$ let $M^X$ denote the
$\Zth_0^X$-derivation resulting from $M$ by substituting $X$ for
$\falsum$.  Write $C^X := \subst{C}{\falsum}{X}$.  -- $\C{L}[X]$ ($\C{L}$,
resp.) denotes the language of $\Zth^X$ ($\Zth$, resp.).  We use $P$
for atomic $\C{L}$-formulas and $A,B,C,D,G$ for $\C{L}[X]$-formulas.
$\vdash$ denotes derivability in minimal logic.

Note that in our setting derivability in $\Zth^X$ is essentially the
same as in $\Zth_0^X$:

\begin{lemma}\mylabel{intmin}
Let $F := \atom(\false)$ and $A^F := \subst{A}{\falsum}{F}$.  Then
\[
\Zth^X \vdash A \;\;\iff\;\; \Zth_0^X \vdash A^F.
\]
\end{lemma}

\begin{proof}  $\Rightarrow$ holds since $(\EfqLog_A)^F$ is 
$\Efq_{A^F}$.

$\Leftarrow$.  We have $\Zth^X \vdash \falsum \leftrightarrow F$ by
$\EfqLog_F \colon \falsum \to F$ and $\Efq_{\falsum} \colon F \to \falsum$.
This implies the claim.
\end{proof}

Since our formulas do not contain the constructive existential
quantifier $\ex$, we can derive stability for all
$\C{L}$-formulas.  Hence classical
arithmetic\index{arithmetic!classical} (in all finite types) is a
subsystem of our present system $\Zth$:

\begin{lemma}[Stability]\mylabel{estab}
$\Zth \vdash \neg \neg A \to A$ for every $\C{L}$-formula $A$.
\end{lemma}

\begin{proof}
Induction on $A$.  

\emph{Case} $\atom(r)$.  We have $\Zth \vdash \forall
p. \neg \neg\atom(p) \to \atom(p)$ by boolean induction, again using
$\Zth \vdash \falsum \leftrightarrow F$ and the truth axiom $\Truthax \colon
\atom(\true)$.  

\emph{Case} $\falsum$.  Obviously $\Zth \vdash \neg \neg \falsum \to \falsum$. 

\emph{Case} $A \to B$.  By induction hypothesis for $B$:
% \def\defaultHypSeparation{\hskip.1in}
% \def\ScoreOverhang{1pt}       
\[
\AxiomC{$u \colon \neg \neg B\to B$}
\AxiomC{$v \colon \neg \neg(A\to B)$}
\AxiomC{$u_1 \colon \neg B$}
\AxiomC{$u_2 \colon A\to B$}
\AxiomC{$w\colon A$}
\BinaryInfC{$B$}
\BinaryInfC{$F$}
\RightLabel{$\impI u_2$}
\UnaryInfC{$\neg(A\to B)$} 
\BinaryInfC{$F$}
\RightLabel{$\impI u_1$}
\UnaryInfC{$\neg \neg B$}
\BinaryInfC{$B$}
\DisplayProof
\]
% \def\defaultHypSeparation{\hskip.2in}% \def\ScoreOverhang{4pt}
\emph{Case} $\forall x A$.  Clearly it suffices to show
$\Zth \vdash(\neg \neg A\to A)\to \neg \neg\forall x A\to A$:
\[
\AxiomC{$u \colon \neg \neg A\to A$}
\AxiomC{$v \colon \neg \neg\forall x A$}
\AxiomC{$u_1 \colon \neg A$}
\AxiomC{$u_2 \colon \forall x A$}
\AxiomC{$x$}
\BinaryInfC{$A$}
\BinaryInfC{$F$}
\RightLabel{$\impI u_2$}
\UnaryInfC{$\neg \forall x A$}
\BinaryInfC{$F$}
\RightLabel{$\impI u_1$}
\UnaryInfC{$\neg \neg A$}
\BinaryInfC{$A$}
\DisplayProof
\]
This concludes the proof.
\end{proof}

\begin{lemma}[Cases]\mylabel{cases}
$\Zth^X \vdash (\neg C \to A) \to (C \to A) \to A$ for every
quantifier-free $\C{L}$-formula $C$.
\end{lemma}

\begin{proof}
We may assume that $\falsum$ does not occur in $C$, since $\Zth \vdash \falsum
\leftrightarrow \atom(\false)$.  Note that for every such quantifier-free 
formula $C$ we can easily construct a boolean term $t_C$ such that
$\Zth_0 \vdash \atom(t_C) \leftrightarrow C$.  Hence it suffices to derive
\[
\forall p.((\atom(p) \to \atom(\false)) \to A) \to (\atom(p) \to A) \to A.
\]
This is done by induction on $p$, using the truth axiom $\Truthax
\colon \atom(\true)$.
\end{proof}


\section{Definite and Goal Formulas}
\mylabel{S:Definite}
A formula is \emph{relevant}\index{formula!relevant} if it ``ends''
with $\falsum$.  More precisely, relevant formulas are defined
inductively by the clauses
\begin{itemize}
\item $\falsum$ is relevant,
\item if $C$ is relevant and $B$ is arbitrary, then $B\to C$ is relevant, 
and
\item if $C$ is relevant, then $\forall x C$ is relevant.
\end{itemize}
A formula which is not relevant is called
\emph{irrelevant}\index{formula!irrelevant}.

We define \emph{goal formulas}\index{goal formula} $G$ and
\emph{definite formulas}\index{definite formula} $D$ inductively.
These notions are related to similar ones common under the same name
in the context of extensions of logic programming.  Recall that $P$
ranges over atomic $\C{L}$-formulas (including $\falsum$).
\begin{alignat*}{2}
G\;\;:=\;\; P &\mid D\to G 
&\quad&\hbox{provided $D$ irrelevant $\Rightarrow$ $D$ quantifier-free}
\\
&\mid\forall x G &\quad&\hbox{provided $G$ irrelevant,} \\
\noalign{\medskip}
D\;\;:=\;\; P &\mid G\to D &\quad&\hbox{provided $D$ irrelevant $\Rightarrow$
$G$ irrelevant}
\\
&\mid\forall x D.
\end{alignat*}

\begin{lemma}\mylabel{lemma1}
For definite formulas $D$ and goal formulas $G$ we have
\begin{alignat}{2}
&\Zth^X \vdash (\neg D \to X) \to D^X &\quad&\hbox{for $D$ relevant,}
\label{relD} 
\\
&\Zth^X \vdash D\to D^X, \label{arbD}
\\
&\Zth^X \vdash G^X \to G &&\hbox{for $G$ irrelevant,}\label{irrelG}
\\
&\Zth^X \vdash G^X \to (G \to X) \to X. \label{arbG}
\end{alignat}
\end{lemma}

\begin{proof}  We prove all four claims \eqref{relD} -- \eqref{arbG}
simultaneously, by induction on formulas.

\eqref{relD}.  Let $D$ be relevant.  \emph{Case} $\falsum$.  Clearly
$((\falsum \to \falsum) \to X) \to X$ is derivable.  

\emph{Case} $G \to D$.  
\def\defaultHypSeparation{\hskip.1in}
\def\ScoreOverhang{1pt} 
\[
\AxiomC{$\mid$}
\noLine
\UnaryInfC{$(\neg D {\to} X) {\to} D^X$}
\AxiomC{$\mid$}
\noLine
\UnaryInfC{$G^X {\to} (G {\to} X) {\to} X$}
\AxiomC{$G^X$}
\BinaryInfC{$(G \to X) \to X$}
\AxiomC{$\neg(G {\to} D) {\to} X$}
\AxiomC{$\neg D$}
\AxiomC{$G {\to} D$}
\AxiomC{$G$}
\BinaryInfC{$D$}
\BinaryInfC{$\falsum$}
\UnaryInfC{$\neg(G \to D)$}
\BinaryInfC{$X$}
\UnaryInfC{$G \to X$}
\BinaryInfC{$X$}
\UnaryInfC{$\neg D \to X$}
\BinaryInfC{$D^X$}
\UnaryInfC{$(\neg(G \to D) \to X) \to G^X \to D^X$}
\DisplayProof
\]
\def\defaultHypSeparation{\hskip.2in}\def\ScoreOverhang{4pt}Here we have used the induction hypotheses \eqref{relD} for $D$ and
\eqref{arbG} for $G$.  

\emph{Case} $\forall xD$.
\[
\AxiomC{$\mid$}
\noLine
\UnaryInfC{$(\neg D \to X) \to D^X$}
\AxiomC{$\neg \forall x D \to X$}
\AxiomC{$\neg D$}
\AxiomC{$\forall x D$}
\UnaryInfC{$D$}
\BinaryInfC{$\falsum$}
\UnaryInfC{$\neg \forall x D$}
\BinaryInfC{$X$}
\UnaryInfC{$\neg D \to X$}
\BinaryInfC{$D^X$}
\UnaryInfC{$\forall x D^X$}
\UnaryInfC{$(\neg \forall x D \to X) \to \forall x D^X$}
\DisplayProof
\]
Here we have used the induction hypothesis \eqref{relD} for $D$.

\eqref{arbD}.  \emph{Case} $D$ relevant.
\[
\AxiomC{$\mid$}
\noLine
\UnaryInfC{$(\neg D \to X) \to D^X$}
\AxiomC{$\falsum \to X$}
\AxiomC{$\neg D$}
\AxiomC{$D$}
\BinaryInfC{$\falsum$}
\BinaryInfC{$X$}
\UnaryInfC{$\neg D \to X$}
\BinaryInfC{$D^X$}
\UnaryInfC{$D \to D^X$}
\DisplayProof
\]
Here we have used \eqref{relD} and $\falsum \to X$.

\emph{Case} $D$ irrelevant.  \emph{Subcase} $P$.  Then $P^X = P$
and the claim is obvious.  \emph{Subcase} $G \to D$.  Then $D$ is
irrelevant, hence also $G$ is irrelevant.
\[
\AxiomC{$\mid$}
\noLine
\UnaryInfC{$D \to D^X$}
\AxiomC{$G \to D$}
\AxiomC{$\mid$}
\noLine
\UnaryInfC{$G^X \to G$}
\AxiomC{$G^X$}
\BinaryInfC{$G$}
\BinaryInfC{$D$}
\BinaryInfC{$D^X$}
\UnaryInfC{$(G \to D) \to G^X \to D^X$}
\DisplayProof
\]
Here we have used the induction hypotheses \eqref{irrelG} for $G$ and
\eqref{arbD} for $D$.  

\emph{Subcase} $\forall xD$.
By the induction hypothesis \eqref{arbD} for $D$ we have $D \to D^X$,
which clearly implies $\forall x D \to \forall x D^X$.


\eqref{irrelG}.  Let $G$ be irrelevant.  \emph{Case} $P$.  Then $P^X = P$
and the claim is obvious.  

\emph{Case} $D \to G$.
\[
\AxiomC{$\mid$}
\noLine
\UnaryInfC{$G^X \to G$}
\AxiomC{$D^X \to G^X$}
\AxiomC{$\mid$}
\noLine
\UnaryInfC{$D \to D^X$}
\AxiomC{$D$}
\BinaryInfC{$D^X$}
\BinaryInfC{$G^X$}
\BinaryInfC{$G$}
\UnaryInfC{$(D^X \to G^X) \to D \to G$}
\DisplayProof
\]
Here we have used the induction hypotheses \eqref{irrelG} for $G$ and
\eqref{arbD} for $D$.  

\emph{Case} $\forall x G$.
\[
\AxiomC{$\mid$}
\noLine
\UnaryInfC{$G^X \to G$}
\AxiomC{$\forall x G^X$}
\UnaryInfC{$G^X$}
\BinaryInfC{$G$}
\UnaryInfC{$\forall x G$}
\UnaryInfC{$\forall x G^X \to \forall x G$}
\DisplayProof
\]
Here we have used the induction hypothesis \eqref{irrelG} for $G$.


\eqref{arbG}.  We may assume that $G$ is relevant, for otherwise the
claim clearly follows from \eqref{irrelG}.  \emph{Case} $\falsum$.  Obvious,
since $\falsum^X = X$.

\emph{Case} $D \to G$.  Our goal is $(D^X \to G^X) \to ((D \to G) \to X) 
\to X$.  Let $\C{D}_1[D^X \to G^X, (D \to G) \to X]$ be
\def\defaultHypSeparation{\hskip.1in}
\def\ScoreOverhang{1pt} 
\[
\AxiomC{$\mid$}
\noLine
\UnaryInfC{$G^X \to (G \to X) \to X$}
\AxiomC{$D^X \to G^X$}
\AxiomC{$D^X$}
\BinaryInfC{$G^X$}
\BinaryInfC{$(G \to X) \to X$}
\AxiomC{$(D \to G) \to X$}
\AxiomC{$G$}
\UnaryInfC{$D \to G$}
\BinaryInfC{$X$}
\UnaryInfC{$G \to X$}
\BinaryInfC{$X$}
\UnaryInfC{$D^X \to X$}
\DisplayProof
\]
\def\defaultHypSeparation{\hskip.2in}\def\ScoreOverhang{4pt}(using the induction hypothesis \eqref{arbG} for $G$) and $\C{D}_2[(D \to
G) \to X]$ be
\[
\AxiomC{$(D \to G) \to X$}
\AxiomC{$\neg D$}
\AxiomC{$D$}
\BinaryInfC{$\falsum$}
\UnaryInfC{$G$}
\UnaryInfC{$D \to G$}
\BinaryInfC{$X$}
\UnaryInfC{$\neg D \to X$}
\DisplayProof
\]
Note that the passage from $\falsum$ to $G$ can be done by means of
introduction rules, since $G$ is relevant.

\emph{Subcase} $D$ relevant.  
\[
\AxiomC{$\C{D}_1[D^X {\to} G^X, (D {\to} G) {\to} X]$}
\noLine
\UnaryInfC{$\mid$}
\noLine
\UnaryInfC{$D^X \to X$}
\AxiomC{$\mid$}
\noLine
\UnaryInfC{$(\neg D \to X) \to D^X$}
\AxiomC{$\C{D}_2[(D {\to} G) {\to} X]$}
\noLine
\UnaryInfC{$\mid$}
\noLine
\UnaryInfC{$\neg D \to X$}
\BinaryInfC{$D^X$}
\BinaryInfC{$X$}
\UnaryInfC{$(D^X \to G^X) \to ((D \to G) \to X) \to X$}
\DisplayProof
\]
Here we have used the induction hypothesis \eqref{relD} for $D$. 

\emph{Subcase} $D$ irrelevant.  Then $D$ is quantifier-free.  We use
case distinction on $D$ from Lemma~\ref{cases}, in the form $(D \to X)
\to (\neg D \to X) \to X$.  So it suffices to derive from $D^X \to
G^X$ and $(D \to G) \to X$ both premises; recall that our goal was
$(D^X \to G^X) \to ((D \to G) \to X) \to X$.  The negative case is
provided by $\C{D}_2[(D \to G) \to X]$, and the positive case by
\[
\AxiomC{$\C{D}_1[D^X \to G^X, (D \to G) \to X]$}
\noLine
\UnaryInfC{$\mid$}
\noLine
\UnaryInfC{$D^X \to X$}
\AxiomC{$\mid$}
\noLine
\UnaryInfC{$D \to D^X$}
\AxiomC{$D$}
\BinaryInfC{$D^X$}
\BinaryInfC{$X$}
\UnaryInfC{$D \to X$}
\DisplayProof
\]
Here we have used the induction hypothesis \eqref{arbD} for $D$. 
\end{proof}

\begin{lemma}\mylabel{lemma2} For goal formulas $\vec G = G_1,\ldots,G_n$
we have
\[
\Zth^X \vdash (\vec{G} \to X) \to \vec{G}^X \to X.
\]
\end{lemma}

\begin{proof}
By Lemma~\ref{lemma1}\eqref{arbG} we have 
\[
\Zth^X \vdash G_i^X \to (G_i \to X) \to X
\]
for all $i=1, \dots, n$.  Now the assertion follows by minimal logic:
Assume $\vec{G} \to X$ and $\vec{G}^X$; we must show $X$.

By $G_1^X \to (G_1 \to X) \to X$ it suffices to prove $G_1 \to
X$.  Assume $G_1$.

By $G_2^X \to (G_2 \to X) \to X$ it suffices to prove $G_2 \to
X$.  Assume $G_2$.

Repeating this pattern, we finally have assumptions $G_1, \dots, G_n$
available, and obtain $X$ from $\vec{G} \to X$.
\end{proof}

% as follows. From $G_1^X \to (G_1 \to X) \to X$, $G_1^X$ and
% $G_1 \to \ldots\to G_n \to X$ we get $G_2 \to \ldots\to G_n \to X$.  From
% the latter we get, together with $G_2^X \to (G_2 \to X) \to X$ and
% $G_2^X$, the formula $G_3\to \ldots\to G_n \to X$, and so on until we
% have $X$.
% \end{proof}

\begin{theorem}\label{ex-to-ex-star}
Assume that for definite formulas $\vec{D}$ and goal formulas
$\vec{G}$ we have
\[
\Zth_0\vdash\vec{D} \to (\forall \vec{y}. \vec{G} \to \falsum) \to \falsum.
\]
Then we also have
\[
\Zth^X\vdash\vec{D} \to (\forall \vec{y}. \vec{G} \to X) \to X.
\]
In particular, substitution of the formula 
\[
\ex\vec{y}. \vec G := \ex\vec{y}.G_1 \land\ldots\land G_n
\]
for $X$ yields
\[
\Zth\vdash\vec{D} \to \ex\vec{y}. \vec G.
\]
\end{theorem}

\begin{proof}
Substitution of $X$ for $\falsum$ in the given derivation yields
\[
\Zth^X_0\vdash\vec{D}^X \to (\forall \vec{y}. \vec{G}^X \to X) \to X.
\]
Now by Lemma~\ref{lemma1}\eqref{arbD} we can drop $X$ in $\vec{D}^X$,
and by Lemma~\ref{lemma2} also in $\vec{G}^X$.

The second assertion follows from the first one since $\forall
\vec{y}. \vec{G} \to \ex\vec{y}. \vec{G}$ clearly is derivable.
\end{proof}

The theorem can be viewed in the standard way to yield a method for
program extraction from classical proofs.  However, in
Section~\ref{S:CompContentSec} we give a finer analysis of the extracted
programs, and an explanation of the role of definite and goal formulas.

\begin{example}  Let us check the mechanism of working with definite
and goal formulas for Kreisel's \inquotes{non-example} given
in the introduction.  There we gave a trivial proof in classical logic
of a $\forall\excl$-formula that cannot be realized by a computable
function, and we better make sure that our general result also does
not provide such a function.  The example amounts to a proof in
minimal logic of
\[
(\forall z. \neg \neg R(x,z) \to R(x,z)) \to \bigl(\forall y.(R(x,y) \to
\forall z R(x,z)) \to \falsum \bigr) \to \falsum.
\]
Here $R(x,y) \to \forall z R(x,z)$ is a goal formula, but the premise
$\forall z. \neg \neg R(x,z) \to R(x,z)$ is \emph{not} definite.
Replacing $R$ by $\neg S$ (to get rid of the stability assumption)
does not help, for then $\neg S(x,y) \to \forall z \neg S(x,z)$ is
\emph{not} a goal formula.  A third possibility would be to use the
fact that $R$ is primitive recursive and write $\atom(rxy)$ instead of
$R(x,y)$.  However, then $\bigl(\forall y.(\atom(rxy) \to \forall z\,
\atom(rxz)) \to \falsum \bigr) \to \falsum$ could only be proved in $\Zth$,
\emph{not} in $\Zth_0$ as required in Theorem~\ref{ex-to-ex-star}.
\end{example}


\subsection*{How to obtain definite and goal formulas}
To apply these results we have to know that our assumptions are
definite formulas and our goal is given by goal formulas.  For
quantifier-free formulas this clearly can always be achieved by
inserting double negations in front of every atom (cf.\ the
definitions of definite and goal formulas).  This corresponds to the
original (unrefined) so-called $A$-translation of Friedman
\cite{Friedman78} (or Leivant \cite{Leivant85}).  However, in
order to obtain reasonable programs which do not unneccessarily use
higher types or case analysis we want to insert double negations only
at as few places as possible.

%\subsubsection{Critical Atoms}
We describe a more economical general way to obtain definite and goal
formulas, following \cite{Berger95,BergerSchwichtenberg95b}.  It
consists in singling out some predicate symbols as being ``critical'',
and then double negating only the atoms formed with critical predicate
symbols; call these \emph{critical} atoms\index{atom!critical}.

%We have to be a little bit careful since strictly speaking in our setting
%there are only the predicate symbols $\atom$ and $\falsum$. However we may
%represent further predicate symbols of some arity $(\rho_1,\ldots,\rho_n)$ 
%by free variables $R$ of type $\rho_1 \to \ldots\to \rho_n \to \typeBool$.
%By a slight abuse of terminology we will below refer to these function 
%symbols as predicate symbols as well.
%and  will write $R(\vec s)$ instead of $\atom(R(\vec s))$ to ease readability.

Assume we have a proof in minimal arithmetic $\Zth_0$ of
\[
\forall \vec{x}_1 C_1 \to \dots \to \forall \vec{x}_n C_n \to
 (\forall\vec{y}. \vec{B} \to \falsum) \to \falsum
\]
with $\vec{C},\vec{B}$ quantifier-free (among the premises $\forall
 \vec{x}_i C_i$ we may have efq-axioms for quantifier-free formulas,
 hence in fact the situation described applies to intuitionistic
 logic).  Let
\[
L := \{\,C_1, \dots, C_n, \vec{B} \to \falsum\,\}
\]

The set of $L$-\emph{critical} predicate symbols is defined to be the
smallest set satisfying
\begin{enumerate}
\item[(i)] $\falsum$ is critical.
\item[(ii)] If $(\vec{C}_1 \to R_1(\vec s_1)) \to \dots \to (\vec{C}_m
\to R_m(\vec s_m)) \to R(\vec s)$ is a positive subformula of $L$, and
if some $R_i$ is $L$-critical, then $R$ is $L$-critical.
\end{enumerate}
Now if we double negate every $L$-critical atom different from $\falsum$
we clearly obtain definite assumptions $\vec{C}'$ and goal formulas
$\vec{B}'$.  Furthermore the proof term of the given derivation can
easily be transformed into a correct derivation of the translated
formula from the translated assumptions (by inserting the obvious
proofs of the translated axioms).

However, in particular cases we might be able to obtain definite and
goal formulas with still fewer double negations: it may not be
necessary to double negate \emph{every} critical atom.

Of course this method will be really useful only if besides $\atom$
and $\falsum$ there are other predicate symbols available.  Our results
could be easily adapted to a language with free predicate symbols.


\section{Program Extraction}
\mylabel{S:Extract}
We assign to every formula $A$ an object $\tau(A)$ (a type or the
symbol $\nulltype$).  $\tau(A)$ is intended to be the type of the
program to be extracted from a proof of $A$, assuming that a proof of
$X$ carries computational content of some given type $\nu$.
\begin{align*}
\tau(X) &:= \nu
\\
\tau(P) &:= \nulltype\quad\hbox{(in particular $\tau(\falsum) = \nulltype$)}
\\
\tau(\forall x^\rho A) &:= \begin{cases}
\nulltype &\hbox{if $\tau(A)=\nulltype$}\\
\rho\to \tau(A) &\hbox{otherwise}\end{cases}
\\
\tau(A\to B) &:= \begin{cases}
\tau(B) &\hbox{if $\tau(A)=\nulltype$}\\
\nulltype &\hbox{if $\tau(B)=\nulltype$}\\
\tau(A)\to \tau(B) &\hbox{otherwise}\end{cases}
\end{align*}
We now define, for a given derivation $M$ of a formula $A$ with
$\tau(A) \ne \nulltype$, its \emph{extracted program}\index{extracted
program} $\extrTer{M}$ of type $\tau(A)$.
\begin{align*}
\extrTer{u^A} &:= x_u^{\tau(A)}
\\
\extrTer{\lambda u^A M} &:= \begin{cases}
\extrTer{M} &\hbox{if $\tau(A)=\nulltype$}\\
\lambda x_u^{\tau(A)}\extrTer{M} &\hbox{otherwise}\end{cases}
\\
\extrTer{M^{A\to B}N} &:= \begin{cases}
\extrTer{M} &\hbox{if $\tau(A)=\nulltype$}\\
\extrTer{M}\extrTer{N} &\hbox{otherwise}\end{cases}
\\
\extrTer{\lambda x^\rho M} &:= \lambda x^\rho \extrTer{M}
\\
\extrTer{Mt} &:= \extrTer{M}t
\end{align*}
We also need extracted programs for the axioms.  
\begin{alignat*}{2}
\extrTer{\ind_{p,A}} &:= 
\rec_{\typeBool}^{\tau} \colon \tau \to \tau\to \typeBool \to \tau
&\quad& \hbox{with $\tau := \tau(A) \ne \nulltype$},
\\
\extrTer{\ind_{n,A}} &:= 
\rec_{\typeN}^{\tau} \colon \tau \to (\typeN \to \tau \to \tau) \to
\typeN \to \tau
&&\hbox{with $\tau := \tau(A) \ne \nulltype$},
\\
\extrTer{\EfqLog_X} &:= \Efqdummy^\nu
\end{alignat*}
where $\Efqdummy^\nu$ is an arbitrary closed term of type $\nu$.  For
derivations $M$ of $A$ with $\tau(A) = \nulltype$ we define
$\extrTer{M}:=\eps$ ($\eps$ some new symbol).  This applies in particular
if $A$ is an $\C{L}$-formula.

Finally we define \emph{modified
realizability}\index{realizability!modified} for formulas in
$\C{L}[X]$.  For the propositional symbol $X$ we need a comprehension
term $\C{A} := \set{y^\nu}{A_0}$ with an $\C{L}$-formula $A_0$; write
$\C{A}(r)$ for $\subst{A_0}{y^\nu}{r}$.  More precisely, we define formulas
$r \mrAAA A$, where $r$ is either a term of type $\tau(A)$ if the
latter is a type, or the symbol $\eps$ if $\tau(A)=\nulltype$.
\begin{align*}
r \mrAAA X &\;=\;  \C{A}(r)
\\
r \mrAAA P &\;=\;  P
\\
r\mrAAA \forall x A &\;=\;  \begin{cases}
\forall x. \eps\mrAAA A &\hbox{if $\tau(A)=\nulltype$}\\
\forall x.rx\mrAAA A &\hbox{otherwise}\end{cases}
\\
r\mrAAA(A\to B) &\;=\;  \begin{cases}
\eps\mrAAA A\;\to \; r\mrAAA B &\hbox{if $\tau(A)=\nulltype$}\\
\forall x.x\mrAAA A\;\to \; \eps\mrAAA B 
&\hbox{if $\tau(A)\ne\nulltype=\tau(B)$}\\
\forall x.x\mrAAA A\;\to \; rx\mrAAA B &\hbox{otherwise}\end{cases}
\end{align*}
Note that for $\C{L}$-formulas $A$ we have $\tau(A)=\nulltype$ and
$\eps \mrAAA A = A$.  For the formulation of the soundness theorem it
will be useful to let $x_u^{\tau(A)}:=\eps$ if $u^A$ is an assumption
variable with $\tau(A) = \nulltype$.

\begin{theorem}[Soundness]\mylabel{soundness} 
  Assume that $M$ is a $\Zth^X$-derivation of $B$.  Then there is a
  $\Zth$-derivation of $\extrTer{M} \mrAAA B$ from the assumptions
\[
\set{x_u^{\tau(C)} \mrAAA C}{u^C \in \FA(M)}.
\]
\end{theorem}
 
\begin{proof}
Induction on $M$.  \emph{Case} $\ind_{n,A}$.  Take $\rec_{\typeN}^{\tau}$.
\emph{Case} $\ind_{p,A}$.  Take $\rec_{\typeBool}^{\tau}$.
\emph{Case} $\EfqLog_A \colon \falsum \to A$.  Then 
\[
\extrTer{\EfqLog_A} \mrAAA (\falsum \to A) = 
\falsum \to \extrTer{\EfqLog_A} \mrAAA A,
\]
which is an instance of the same axiom scheme.  The inductive steps
are straightforward.
\end{proof}


\section{Computational Content of Classical Proofs}
\mylabel{S:CompContentSec}
For a smooth formulation of the following theorem when writing an
application $ts$ where $s$ is of type $\nulltype$, we mean simply $t$.
Similarly abstractions of the form $\lambda w^\nulltype t$ stand for
$t$.

\begin{theorem} 
\mylabel{classextract}
Let $\vec{D}=D_1, \dots, D_n$ 
and $\vec{G}=G_1, \dots, G_m$ be arbitrary $\C{L}$-formulas.  Assume
that we have terms $t_1, \dots, t_n, s_1, \dots, s_m, r$ such that 
\begin{alignat}{2}
&\Zth \vdash \vec{D} \to t_j \mrAAA D_j^X &\quad&\hbox{for $1 \le j \le n$,}
\label{reldef}
\\
&\Zth \vdash \vec{D} \to w_i \mrAAA G_i^X \to (G_i\to \C{A}(v_i)) \to 
\C{A}(s_iw_iv_i)
&&\hbox{for $1 \le i \le m$,}
\label{relgoal}
\\
&\Zth \vdash \vec{D} \to \forall \vec{y}. \vec{G} \to \C{A}(r\vec{y}).
\label{propAAA}
\\
\intertext{Let $M$ be a $\Zth_0$-derivation of $\vec{D} \to 
(\forall \vec{y}. \vec{G} \to \falsum) \to \falsum$, and}
&s := \lambda \vec{y} \lambda \vec{w}.  
s_1 w_1(\dots (s_m w_m(r\vec{y}))\dots). \notag 
\\
\intertext{Then}
&\Zth \vdash \vec{D} \to \C{A}(\extrTer{M^X} t_1 \dots t_n s). \notag
\end{alignat}
\end{theorem}

\begin{proof}  From the $\Zth_0$-derivation $M$ we obtain 
by the substitution $\falsum \mapsto X$ a $\Zth_0^X$-derivation $M^X \colon
\vec{D}^X \to (\forall \vec{y}. \vec{G}^X \to X) \to X$.  The Soundness 
Theorem~\ref{soundness} yields
\begin{align}
&\extrTer{M^X} \mrAAA \bigl(\vec{D}^X \to (\forall \vec{y}. \vec{G}^X \to X)
\to X\bigr) \notag
\\
&= \forall \vec{u} \forall v. \vec{u} \mrAAA \vec{D}^X \to 
(v \mrAAA \forall \vec{y}. \vec{G}^X \to X) \to \C{A}(\extrTer{M^X} \vec{u} v)
\notag
\\
&= \forall \vec{u} \forall v. \vec{u} \mrAAA \vec{D}^X \to 
\forall \vec{y} \forall \vec{w} \bigl(\vec{w} \mrAAA \vec{G}^X \to 
\C{A}(v \vec{y} \vec{w})\bigr) \to 
\C{A}(\extrTer{M^X} \vec{u} v). \label{eq1}
\end{align}
Instantiate \eqref{eq1} with $\vec{t}$ for $\vec{u}$ and $s$ for $v$.
Clearly $\vec{t} \mrAAA \vec{D}^X$ is derivable from $\vec{D}$ by
\eqref{reldef}, so it remains to show $\vec{D}
\to \vec{w} \mrAAA \vec{G}^X \to \C{A}(s \vec{y} \vec{w})$.

Let $a_{m+1} := r\vec{y}$ and $a_i :=
s_iw_ia_{i+1}$, hence $s = \lambda \vec{y}
\lambda \vec{w} \,a_1$.  We show by induction on $j := m-i$
\begin{align}
&\vec{D} \to G_1 \to \dots \to G_i \to 
w_{i+1} \mrAAA G_{i+1}^X \to \dots \to w_m \mrAAA G_m^X \to 
\C{A}(a_{i+1}). \label{claimA}
\end{align}
\emph{Basis}.  For $j=0$ we have $i=m$ and \eqref{claimA}
holds by \eqref{propAAA}.  \emph{Step}.  From the IH \eqref{claimA}
and the assumption \eqref{relgoal} we obtain
\begin{align}
&\vec{D} \to G_1 \to \dots \to G_{i-1} \to 
w_i \mrAAA G_i^X \to \dots \to w_m \mrAAA G_m^X \to
\C{A}(s_iw_ia_{i+1}). \notag
\end{align}
For $j = m$ we have $i = 0$ and hence we obtain from \eqref{claimA}
\begin{align*}
&\vec{D} \to w_1 \mrAAA G_1^X \to \dots \to w_m \mrAAA G_m^X \to \C{A}(a_1),
\end{align*}
which was to be shown.
\end{proof}

In order to apply Theorem~\ref{classextract}, we need $\C{A} =
\set{y}{A_0}$ and terms $t_j, s_i, r$ such that
\eqref{reldef}--\eqref{propAAA} hold.  The choice of $\C{A}$ and $r$
of course depends on the application at hand and should be done such
that \eqref{propAAA} holds.  The rest follows from Lemma~\ref{lemma1}
by the Soundness Theorem~\ref{soundness}:

\begin{theorem}\mylabel{lemma1cc}
  For every definite formula $D$ and goal formula $G$ we have terms
  $t,s$ such that for an arbitrary $\C{A} = \set{y}{A_0}$ with an
  $\C{L}$-formula $A_0$:
\begin{alignat}{2}
&\Zth \vdash D \to t \mrAAA D^X, \label{dDcc}
\\
&\Zth \vdash w \mrAAA G^X \to (G\to \C{A}(v)) \to \C{A}(swv)\label{gGcc}
\end{alignat}
\end{theorem}

\begin{proof}  \eqref{dDcc}.  Let $N_D$ be the $\Zth^X$-derivation of 
  $D \to D^X$ provided by Lemma~\ref{lemma1}\eqref{arbD}.  The
  Soundness Theorem yields
\[
\Zth \vdash \extrTer{N_D} \mrAAA (D \to D^X),\quad\hbox{i.e.} \quad
\Zth \vdash D \to \extrTer{N_D} \mrAAA D^X.
\]

\eqref{gGcc}.  Let $H_G$ be the $\Zth^X$-derivation of $G^X \to (G\to
X) \to X$ from Lemma~\ref{lemma1}\eqref{arbG}.  By the Soundness
Theorem
\begin{align*}
&\Zth \vdash \extrTer{H_G} \mrAAA (G^X \to (G\to X) \to X),\quad\hbox{i.e.} 
\\
&\Zth \vdash w\mrAAA G^X \to (G\to \C{A}(v)) \to \C{A}(\extrTer{H_G}wv).
\end{align*}
\end{proof}

For the next corollary we use the notation $\langle \vec{r} \rangle$
for pairing of a non-empty list $\vec{r}$ of terms, and $r0$, $r1$,
\dots, $r(k-1)$ for the projections.

\begin{corollary} 
  \mylabel{classextractcor} Let $\vec{D}=D_1, \dots, D_n$ be definite
  formulas and $\vec{G}=G_1, \dots, G_m$ be goal formulas.  Let $M
  \colon \vec{D} \to (\forall \vec{y}. \vec{G} \to \falsum) \to \falsum$ be a
  $\Zth_0$-derivation.  Then
\[
\Zth \vdash \vec{D} \to \subst{G_i}{y_1, \dots, y_k}
{\extrTer{M^X} t_1 \dots t_n s 0, \dots,
\extrTer{M^X} t_1 \dots t_n s (k-1)},
\]
with
\begin{align*}
&s := \lambda \vec{y} \lambda \vec{w}.  
s_1 w_1(\dots (s_m w_m \langle \vec{y} \rangle)\dots)
\end{align*}
and $t_1, \dots, t_n, s_1, \dots s_m$ determined by the formulas
$\vec{D}, \vec{G}$ only, according to Theorem~\ref{lemma1cc}.
\end{corollary}

\begin{proof}
  Let $\nu$ be the product of the types of $\vec{y} = y_1, \dots,
  y_k$, and $y$ a variable of type $\nu$.  We use
  Theorem~\ref{classextract} with
\[
\C{A} := \set{y^\nu}
{\bigland_i \subst{G_i}{y_1, \dots, y_k}{y0, \dots, y(k-1)}}.
\]
Then \eqref{propAAA} holds with $r := \lambda \vec{y} \langle
\vec{y} \rangle$.  Moreover, the conclusion 
\[
\Zth \vdash \vec{D} \to \C{A}(\extrTer{M^X} t_1 \dots t_n s)
\]
clearly yields the claim.
\end{proof}


\section{Examples}
\mylabel{S:Examples}
We now want to give some simple examples of how to apply
Theorems~\ref{classextract} and \ref{lemma1cc}.  Here we will always
have a single goal formula $G$ and $\C{A}$ will always be chosen as
$\set{y}{G}$.  Hence $\eqref{propAAA}$ trivially holds with $r :=
\lambda yy$.

\subsection{Fibonacci Numbers}
\mylabel{Fibo}
Let $\alpha_n$ be the $n$-th Fibonacci number, i.e.\
\[
\alpha_0 := 0,\quad
\alpha_1 := 1,\quad
\alpha_n := \alpha_{n-2} + \alpha_{n-1} \quad\hbox{for $n \ge 2$}.
\]
We want to give a (classical) existence proof for the Fibonacci
numbers.  So we need to prove
\[
\forall n \excl k\,\Fib(n,k),\quad\hbox{i.e.} \quad
(\forall k. \Fib(n,k) \to \falsum) \to \falsum
\]
from assumptions expressing that $\Fib$ is the graph of the Fibonacci
function, i.e.\ 
\[
\Fib(0,0),\quad
\Fib(1,1),\quad
\forall n \forall k \forall l. \Fib(n,k) \to \Fib(n+1,l) \to \Fib(n+2,k+l).
\]
Clearly the assumption formulas are definite and $\Fib(n,k)$ is a goal
formula.  So Theorems~\ref{classextract} and \ref{lemma1cc} can be
applied without inserting double negations.

To construct a derivation, assume
\begin{align*}
v_0&\colon \Fib(0,0),
\\
v_1&\colon \Fib(1,1),
\\
v_2&\colon \forall n \forall k \forall l. \Fib(n,k) \to \Fib(n+1,l) 
\to \Fib(n+2,k+l)
\\
u &\colon \forall k. \Fib(n,k) \to \falsum.
\end{align*}
Our goal is $\falsum$.  To this end we first prove a strengthened claim
in order to get the induction through:
\[
\forall n B\quad\hbox{with 
$B := (\forall k \forall l. \Fib(n,k) \to \Fib(n+1,l) \to \falsum) \to \falsum$.}
\]
This is proved by induction on $n$.  The base case follows from $v_0$
and $v_1$.  In the step case we can assume that we have $k,l$
satisfying $\Fib(n,k)$ and $\Fib(n+1,l)$.  We need $k',l'$ such
that $\Fib(n+1,k')$ and $\Fib(n+2,l')$.  Using $v_2$ simply take
$k' := l$ and $l' := k+l$. -- To obtain our goal $\falsum$ from
$\forall n B$, it clearly suffices to prove its premise $\forall k
\forall l. \Fib(n,k) \to \Fib(n+1,l) \to \falsum$.  So let $k,l$ be
given and assume $u_1 \colon \Fib(n,k)$ and $u_2 \colon \Fib(n+1,l)$.
Then $u$ applied to $k$ and $u_1$ gives our goal $\falsum$.

The derivation term is
\begin{align*}
M = &\lambda v_0^{\Fib(0,0)} 
\lambda v_1^{\Fib(1,1)}
\lambda v_2^{\forall n \forall k \forall l. \Fib(n,k) \to \Fib(n+1,l) \to 
\Fib(n+2,k+l)}
\lambda u^{\forall k. \Fib(n,k) \to \falsum}
\\
&\ind_{n,B} M_\mathrm{base} M_\mathrm{step} n 
(\lambda k \lambda l \lambda u_1^{\Fib(n,k)} \lambda u_2^{\Fib(n+1,l)}.
uku_1)
\end{align*}
where
\begin{align*}
M_\mathrm{base} =&
\lambda w_0^{\forall k \forall l. \Fib(0,k) \to \Fib(1,l) \to \falsum}.
w_0 01v_0v_1
\\
M_\mathrm{step} =& \lambda n \lambda w^B 
\lambda w_1^{\forall k \forall l. \Fib(n+1,k) \to \Fib(n+2,l) \to \falsum}.
\\
&w(\lambda k \lambda l \lambda u_3^{\Fib(n,k)} \lambda u_4^{\Fib(n+1,l)}.
w_1 l (k+l) u_4 (v_2 k l u_3 u_4)).
\end{align*}
Now let $\C{A} := \set{k}{\Fib(n,k)}$, and $M^X$ be obtained from $M$ by
replacing every occurrence of $\falsum$ by $X$.  Therefore
\begin{align*}
\extrTer{M^X} &= \lambda x_u^{\typeN \to \typeN}.
\rec_{\typeN}^{(\typeN \to \typeN \to \typeN) \to \typeN}
\extrTer{M_\mathrm{base}^X}
\extrTer{M_\mathrm{step}^X}
n (\lambda k \lambda l.x_u k)
\end{align*}
where
\begin{align*}
\extrTer{M_\mathrm{base}^X} &=
\lambda w_0^{\typeN \to \typeN \to \typeN}.w_001
\\
\extrTer{M_\mathrm{step}^X} &=
\lambda n \lambda w^{(\typeN \to \typeN \to \typeN) \to \typeN}
\lambda w_1^{\typeN \to \typeN \to \typeN}.
w(\lambda k \lambda l.w_1 l (k+l))
\end{align*}
Since there are no relevant formulas involved, the extracted term
according to Theorem~\ref{classextract} is
\[
\extrTer{M^X}(\lambda xx) = 
\rec_{\typeN}^{(\typeN \to \typeN \to \typeN) \to \typeN}
\extrTer{M_\mathrm{base}^X}
\extrTer{M_\mathrm{step}^X}
n (\lambda k \lambda l.k)
\]
This algorithm might be easier to understand if we write it as a
\textsc{Scheme} program:
\begin{verbatim}
(define (fibo n) (fibo1 n (lambda (k l) k)))

(define (fibo1 n1 f)
  (if (= n1 0)
      (f 0 1)
      (fibo1 (- n1 1) (lambda (k l) (f l (+ k l)))))) 
\end{verbatim}
This is a linear algorithm in tail recursive form.  It is somewhat
unexpected since it passes $\lambda$-expressions (rather than pairs,
as one would ordinarily do), and hence uses functional programming in
a proper way.  This clearly is related to the use of classical logic,
which by its use of double negations has a functional flavour.

To remove some of the tedium of doing all that by hand, we certainly
want machine help\index{machine help}.  We have done such an
implementation within our system
\textsc{Minlog}\index{Minlog@\textsc{Minlog}}; here is the original
printout of the normalized extracted term, with only some indentation
added.
\begin{verbatim}
[n0](Rec nat=>(nat=>nat=>nat)=>nat)
    ([f1]f1 0 1)
    ([n1,H2,f3]
     H2([n4,n5]f3 n5(n4+n5)))
\end{verbatim}
It is rather obvious that this can be translated into the
\textsc{Scheme} program above.


\subsection{Wellfoundedness of $\D{N}$}
\mylabel{SS:Wf}
An interesting phenomenon can occur when we extract a program from a
classical proof which uses the minimum principle.  Consider as a
simple example the wellfoundedness\index{wellfoundedness} of $<$ on
$\D{N}$, i.e.
\[
\forall f^{\typeN \to \typeN} \excl k.f(k+1)<f(k)\to \falsum.
\]
If one formalizes the classical proof \inquotes{choose $k$ such that
  $f(k)$ is minimal} and extracts a program one might expect that it
computes a $k$ such that $f(k)$ is minimal.  But this is impossible!
In fact the program computes the least $k$ such that $f(k+1)<f(k) \to
\falsum$ instead.  This discrepancy between the classical proof and the
extracted program can of course only show up if the solution is not
uniquely determined.

We begin with a rather detailed exposition of the classical proof,
since we need a complete formalization.  Our goal is $\excl k\,f(k)
\le f(k+1)$, and the classical proof consists in using the minimum
principle to choose a minimal element in $\ran(f) := \set{y}{\excl
x\, f(x) = y}$, the range of $f$.  This suffices, for if we have such
a minimal element, say $y_0$, then it must be of the form $f(x_0)$,
and by the choice of $y_0$ we have $f(x_0) \le f(x)$ for every $x$, so
in particular $f(x_0) \le f(x_0 +1)$.

Next we need to prove the minimum principle from ordinary
zero-succes\-sor-induction.  The minimum principle
\begin{equation}
\excl k\,R(k) \to 
\excl k. R(k) \land \forall l.l<k \to R(l) \to \falsum \label{minpr}
\end{equation}
is to be applied with $R(k) := k \in \ran(f)$.  Now \eqref{minpr} is
logically equivalent to
\begin{equation}
\forall k\bigl(R(k) \to (\forall l.l<k \to R(l) \to \falsum) \to \falsum
\bigr) \to \forall k.R(k) \to \falsum.  \label{minpr1}
\end{equation}
The premise of \eqref{minpr1} expresses the
\inquotes{progressiveness}\index{progressive} of $R(k) \to \falsum$
w.r.t.\ $<$; we abbreviate it to
\[
\Prog := \forall k.(\forall l.l<k \to R(l) \to \falsum) \to R(k) \to \falsum.
\]
We prove \eqref{minpr1} by zero-successor-induction on $n$ w.r.t.\ 
the
formula
\[
B := \forall k.k<n \to R(k) \to \falsum.
\]
\emph{Base}.  $\subst{B}{n}{0}$ follows easily from the lemma
\[
v_1 \colon \forall m.m<0 \to \falsum.
\]
\emph{Step}.  Let $n$ be given and assume $w_2 \colon B$.  To show
$\subst{B}{n}{n+1}$ let $k$ be given and assume $w_3\colon
k<n+1$.  We will derive $R(k) \to \falsum$ by using
$w_1 \colon \Prog$ at $k$.  Hence we have to prove
\[
\forall l.l<k \to R(l) \to \falsum.
\]
So, let $l$ be given and assume further $w_4\colon
l<k$.  From $w_4$ and $w_3\colon
k<n+1$ we infer $l<n$ (using an arithmetical
lemma).  Hence, by induction hypothesis $w_2\colon B$ at $l$
we get $R(l) \to \falsum$.

Now a complete formalization is easy.  We express $m \le k$ by $k<m
\to \falsum$ and take $\forall m\,f(m) \ne k$ instead of $R(k) \to \falsum$.
The derivation term is
\begin{align*}
M :=&\lambda v_1^{\forall m.m<0 \to \falsum}
\\
&\lambda u^{\forall k.(f(k+1)<f(k) \to \falsum) \to \falsum}.
\\
&M_{\cvind}^{\Prog \to \forall k \forall m.f(m)\ne k}
M_\mathrm{prog}(f 0)0 L^{f0=f0}
\end{align*}
where
\begin{align*}
M_{\cvind} &= 
\lambda w_1^{\Prog} \lambda k.
\ind_{n,B}M_\mathrm{base}M_\mathrm{step}(k+1)kL^{k<k+1},
\\
M_\mathrm{base} &=
\lambda k  \lambda w_0^{k<0} \lambda m\lambda \tilde{w}_0^{f(m)=k}.
v_1kw_0,
\\
M_\mathrm{step} &=
\lambda n \lambda w_2^{B} \lambda k \lambda w_3^{k<n+1}.
w_1k(\lambda l \lambda w_4^{l<k}.w_2 l 
(L^{l<n}[w_4,w_3])),\\[6pt]
M_\mathrm{prog} &=
\lambda k \lambda u_1^{\forall l.l<k \to \forall m f(m)\ne l} 
\lambda m \lambda u_2^{f(m)=k}.u m \lambda w_5^{f(m+1)<f(m)}.
\\
&\qquad u_1(f(m{+}1))L^{f(m+1)<k}[w_5,u_2](m{+}1)
L^{f(m+1)=f(m+1)}
\end{align*}
Here we have used the abbreviations
\begin{align*}
\Prog &= \bigl(\forall k. \forall l.l<k \to \forall m\,f(m)\ne l\bigr) \to 
\forall m\,f(m) \ne k
\\
B &= \forall k.k<n \to \forall m\,f(m) \ne k
\end{align*}

For program extraction let
\[
\C{A} := \set{k}{f(k+1)<f(k) \to F},
\]
and let $M^X$ denote the result of replacing every formula $C$ in the
derivation $M$ by $C^X$.  Then
\[
\extrTer{M^X} =\lambda v_1^{\typeN \to \typeN} 
\lambda u^{\typeN \to \typeN \to \typeN}.
\extrTer{M_{\cvind}^X} \extrTer{M_\mathrm{prog}^X}(f 0)0
\]
where 
\begin{align*}
\extrTer{M_{\cvind}^X} &= 
\lambda w_1^{\typeN \to (\typeN \to \typeN \to \typeN) \to \typeN \to \typeN} 
\lambda  k. \rec_{\typeN}^{\typeN \to \typeN \to \typeN} 
\extrTer{M_\mathrm{base}^X} \extrTer{M_\mathrm{step}^X} 
(k +1) k
\\
\extrTer{M_\mathrm{base}^X} &= \lambda k \lambda m.v_1 k
\\
\extrTer{M_\mathrm{step}^X} &= \lambda n 
\lambda w_2^{\typeN \to \typeN \to \typeN}
\lambda k.w_1k(\lambda l.w_2l),\\[12pt]
\extrTer{M_\mathrm{prog}^X} &= 
\lambda k \lambda u_1^{\typeN \to \typeN \to \typeN} \lambda m.
u m (u_1(f(m+1))(m+1)).
\end{align*}
Note that $k$ is not used in $\extrTer{M_\mathrm{prog}^X}$; this is the
reason why the optimization below is possible.

Now by \eqref{dDcc} we generally have $D \to \extrTer{N_D} \mrAAA D^X$
for every relevant definite formula $D$.  In our case for $D = \forall
k.k<0 \to \falsum$ we clearly can derive directly
\[
(\forall k.k<0 \to \falsum) \to (\lambda n0) \mrAAA \forall k.k<0 \to X,
\]
since we can use $\Efq_{X}$.  So we may assume $\extrTer{N_D} =
\lambda n0$.  Also, by \eqref{gGcc} we generally have
\[
w \mrAAA G^X \to (G\to \C{A}(v)) \to \C{A}(\extrTer{H_G}wv).
\]
In our case, with $G = f(k+1)<f(k) \to \falsum$, we can derive directly
\begin{align*}
&(f(k+1)<f(k) \to \C{A}(w)) \to 
((f(k+1)<f(k) \to \falsum) \to \C{A}(v)) \to \\
&\qquad \C{A}(\ifthenelse{f(k+1)<f(k)}{w}{v}).
\end{align*}
So we may assume $\extrTer{H_G} = \lambda w \lambda v.
\ifthenelse{f(k+1)<f(k)}{w}{v}$.  Now let
\[
s := \lambda k \lambda w. \extrTer{H_G}wk = \lambda k \lambda w.
\ifthenelse{f(k+1)<f(k)}{w}{k}.
\]
Then the extracted term according to Theorem~\ref{classextract} is
\[
\extrTer{M^X} \extrTer{N_D}s =_\beta
\extrTer{M_{\cvind}^X}'
\extrTer{M_\mathrm{prog}^X}'(f0)0
\]
where $'$ indicates substitution of $\extrTer{N_D}$, $s$ for $v_1$, $u$, so
\begin{align*}
\extrTer{M_{\cvind}^X}' &=_{\beta\eta}
\lambda w_1
\lambda k'.(\lambda k \lambda m 0)
(\lambda n \lambda w_2 \lambda k.w_1kw_2)
(k'+1)k',
\\
\extrTer{M_\mathrm{prog}^X}'  &=_\beta
\lambda k \lambda u_1 \lambda m.
\ifthenelse{f(m{+}1){<}f(m)}{u_1(f(m{+}1))(m{+}1)}{m}
\end{align*}
Therefore we obtain as extracted program
\begin{align*}
\extrTer{M^X} \extrTer{N_D}s &=_\beta 
\rec r_{\textrm{base}} r_{\textrm{step}} ((f0)+1) (f0) 0
\\
\intertext{with}
r_{\textrm{base}} &:= \lambda k \lambda m.0,
\\
r_{\textrm{step}} &:= \lambda n \lambda w_2^{\typeN \to \typeN \to \typeN}
\lambda k \lambda m.
\\
&\qquad \ifthenelse{f(m{+}1){<}fm}{w_2(f(m{+}1))(m{+}1)}{m}.
\end{align*}
Since the recursion argument $(f0)+1$ is a successor, we can convert
this term into
\[
\ifthenelse{f 1<f 0}{\rec r_{\textrm{base}} r_{\textrm{step}} (f0) (f1) 1}{0}.
\]

To make this algorithm more readable we may define
\begin{align*}
h(0,k,m) &= 0
\\
h(n+1,k,m) &= \ifthenelse{f(m+1)<fm}{h(n,f(m+1),m+1)}{m}
\end{align*}
and then write the result as $h(f(0)+1,f(0),0)$, or (unfolded) as
\[
\ifthenelse{f(1)<f(0)}{h(f(0), f(1), 1)}{0}.
\]

The machine extracted program is (original output of \textsc{Minlog},
with renaming of variables and indentation done manually)
\begin{verbatim}
[f][if (f 1<f 0)
       ((Rec 2 nat=>nat nat=>nat nat=>nat=>nat=>nat)([n]n)f
        ([k,m]0)
        ([n,g,k,m]
         [if (f(Succ m)<f m)
             (g(f(Succ m))(Succ m))
             m])
        (f 0)
        (f 1)
        1)
       0]
\end{verbatim}
We can rewrite this as a \textsc{Scheme} program as follows.
\begin{verbatim}
(define (wf f) (wf-aux f (+ (f 0) 1) (f 0) 0))

(define (wf-aux f n k m)
  (if (= 0 n)
      0
      (if (< (f (+ m 1)) (f m))
          (wf-aux f (- n 1) (f (+ m 1)) (+ m 1))
          m))) 
\end{verbatim}
Note that $k$ is not used here (this will always happen if the
induction principle is used in the form of the minimum principle
only), and hence we may optimize our program to
\begin{verbatim}
(define (wf1 f) (wf1-aux f (+ (f 0) 1) 0))

(define (wf1-aux f n m)
  (if (= 0 n)
      0
      (if (< (f (+ m 1)) (f m))
          (wf-aux f (- n 1) (+ m 1))
          m))) 
\end{verbatim}
Now it is immediate to see that the program computes the least $k$
such that $f(k+1)<f(k) \to \falsum$, where $f(0)+1$ only serves as an
upper bound for the search.

\begin{remark}
  The assumption $v_1 \colon \forall m.m<0 \to \falsum$ used in the proof
  above is only there for \inquotes{didactical resons}: it serves as
  an example of how to treat definite formulas.  We can of course omit
  it and use $\Efq_{\falsum}$ instead.
\end{remark}

\begin{remark}
  There is an alternative proof of the wellfoundedness of $\typeN$,
  which uses the minimum principle with a \indexentry{measure
    function} instead.  Here we can take the function $f$ itself as a
  measure function.  We refrain from analyzing this proof in the same
  detail as before, but rather present the machine extracted program,
  which in fact is slightly simpler.
\begin{verbatim}
[f][if (f 1<f 0)
       ((Rec 1 nat=>nat nat=>nat=>nat)f
        ([m]0)
        ([n,f1,m][if (f(Succ m)<f m) (f1(Succ m)) m])
        (f 0)
        1)
       0]
\end{verbatim}
\end{remark}


\subsection{The $hsh$-Theorem}
\mylabel{SS:hsh} Let $f,g,h,s$ denote unary functions on the natural
numbers.  We show $\excl n\; h(s(h n)) \ne n$ and extract an
(unexpected) program from it (this example is due to Ulrich
Berger).

\begin{lemma}[Surjectivity]
$g \circ f$ surjective implies $g$ surjective.  \qedsymbol
\end{lemma}

\begin{lemma}[Injectivity]
$g \circ f$ injective implies $f$ injective.  \qedsymbol
\end{lemma}

\begin{lemma}[Surjectivity-Injectivity]
$g \circ f$ surjective and $g$ injective implies $f$ surjective.
\end{lemma}

\begin{proof}
  Assume $y$ is not in the range of $f$.  Consider $g(y)$.  Since $g
  \circ f$ is surjective, there is an $x$ with $g(y) = g(f(x))$.  The
  injectivity of $g$ implies $y = f(x)$, a contradiction.
\end{proof}

\begin{theorem}[$hsh$-Theorem]
$\forall n\;s(n) \ne 0 \to \neg \forall n\;h(s(h(n)))=n$.
\end{theorem}

\begin{proof}
  Assume $h \circ s \circ h$ is the identity.  Then by the Injectivity
  Lemma $h$ is injective.  Hence by the Surjectivity-Injectivity Lemma
  $s \circ h$ is surjective, and therefore by the Surjectivity Lemma
  $s$ is surjective, a contradiction.
\end{proof}

From the G\"odel-Gentzen translation and the fact that we can
systematically replace triple negations by single negations (cf.\ 
\ref{SS:Spreading}) we obtain a derivation of
\[
\forall n\;s(n)\ne 0 \to \excl n\; h(s(h n)) \ne n.
\]
Now since $\forall n\;s(n) \ne 0$ is a definite formula, this is in the
form where our general theory applies.  The extracted program is,
somewhat unexpectedly,
\begin{verbatim}
 [s,h][if (h(s(h(h 0)))=h 0)
           [if (h(s(h(s(h(h 0)))))=s(h(h 0)))
               0
               (s(h(h 0)))]
           (h 0)]
\end{verbatim}
Let us see why this program indeed provides a counterexample against
the assumption that $h \circ s \circ h$ is the identity.

If $h(s(h(h 0))) \ne h 0$, take $h 0$.  So assume $h(s(h(h 0))) = h
0$.  If
\[
h(s(h(s(h(h 0))))) = s(h(h 0)),
\]
then also $h(s(h 0)) = s(h(h 0))$, so $0$ is a counterexample, because
the right hand side cannot be $0$ (this was our assumption on $s$).
So assume
\[
h(s(h(s(h(h 0))))) \ne s(h(h 0)).
\]
Then $s(h(h 0))$ is a counterexample.


\subsection{Towards More Interesting Examples}
\mylabel{SS:MoreExamples} Veldman and Bezem \cite{Bezem92} suggested
Dickson's Lemma \cite{Dickson13} as an interesting case study for
program extraction from classical proofs.  It states that for $k$
given infinite sequences $f_1,\dots,f_k$ of natural numbers and a
given number $l$ there are indices $i_1,\dots,i_l$ such that
\emph{every} sequence $f_\kappa$ increases on $i_1,\dots,i_l$, i.e.\ 
$f_\kappa(i_1)\le \dots \le f_\kappa(i_l)$ for $\kappa = 1,\dots,k$.
Here is a short classical proof, using the minimum principle for
undecidable sets.

Call a unary predicate (or set) $Q\subseteq \D{N}$
\emph{unbounded}\index{set!unbounded} if $\forall x \excl y.Q(y)
\land x<y$.

\begin{lemma}\mylabel{dickson1}
Let $Q$ be unbounded and $f$ a function from a superset of $Q$ to
$\D{N}$.  Then the set $Q_f$ of left $f$-minima\index{left $f$-minimum}
w.r.t.\ $Q$ is unbounded; here
\[
Q_f(x) := Q(x) \land \forall y.Q(y) \to x<y \to f(x) \le f(y).
\]
\end{lemma}

\begin{proof}
Let $x$ be given.  We must find $y$ with $Q_f(y)$ and $x<y$.  The
minimum principle for $\set{y}{Q(y) \land x<y}$ with measure $f$
yields 
\begin{equation}\label{dicksongen}
(\excl y.Q(y) \land x<y) \to \excl y.Q(y) \land x<y \land
\forall z.Q(z) \to x<z \to f(y) \le f(z).
\end{equation}
Since $Q$ is assumed to be unbounded, the premise is true.  We show
that the $y$ provided by the conclusion satisfies $Q_f(y)$, i.e.\
\[
Q(y) \land \forall z.Q(z) \to y<z \to f(y) \le f(z).
\]
So let $z$ with $Q(z)$ and $y<z$ be given.  From $x<y$ we obtain
$x<z$, hence $f(y) \le f(z)$ by the conclusion of \eqref{dicksongen}.
\end{proof}

\begin{lemma}\mylabel{dickson2}
Let $Q$ be unbounded and $f_1,\dots,f_k$ be functions from a superset of
$Q$ to $\D{N}$.  Then there is an unbounded subset $Q_1$ of $Q$ such that
$f_1,\dots,f_k$ increase on $Q_1$, i.e.
\[
Q_1(x) \land Q_1(y) \land x<y \to \bigland_{\kappa = 1}^k
f_\kappa(x) \le f_\kappa(y).
\]
\end{lemma}

\begin{proof}
By induction on $k$.  Let $Q_2$ be $Q$ if $k=1$, and in case $k\ge 2$
be an unbounded subset of $Q$ where $f_2,\dots,f_k$ increase (i.e.\
given by the induction hypothesis for $f_2,\dots,f_k$).  Let $Q_1$ be
the set of left $f_1$-minima w.r.t.\ $Q_2$, i.e.
\[
Q_1(x) := Q_2(x) \land \forall y.Q_2(y) \to x<y \to f_1(x) \le f_1(y).
\]
By Lemma~\ref{dickson1} $Q_1$ is an unbounded subset of $Q_2$.  Now on
$Q_1$ $f_1$ increases, and because of $Q_1 \subseteq Q_2$ also
$f_2,\dots,f_k$ increase.
\end{proof}

\begin{corollary}
For every $k,l$  we have
\[
\forall f_1,\dots,f_k \excl i_0,\dots,i_l
\bigland_{\lambda <l}.
i_\lambda < i_{\lambda + 1} \land  \bigland_{\kappa = 1}^k
f_\kappa(i_\lambda) \le f_\kappa(i_{\lambda + 1}). \qed
\]
\end{corollary}

For $k=2$ (i.e.\ two sequences) this example has been treated in
\cite{BergerSchwichtenbergSeisenberger01}.  However, it is interesting
to look at the general case, since then the brute force search takes
time $O(n^k)$, and we can hope that the program extracted from the
classical proof is better.


\section{Notes}\mylabel{S:NotesClass}
This chapter is based on \cite{BergerBuchholzSchwichtenberg02}.  Klaus
Weich originally proposed the functional algorithm computing the
Fibonacci numbers.  Monika Seisenberger -- apart from being a coauthor
of \cite{BergerSchwichtenbergSeisenberger01} -- and Felix Joachimski
have contributed a lot to the \textsc{Minlog} system, particularly to
the implementation of the translation of classical proofs into
constructive ones.  We also benefitted from helpful comments by Peter
Selinger and Matteo Slanina, who presented this material in a seminar
in Stanford, in the fall of 2000.



\backmatter
% \include{references}

\bibliographystyle{amsplain}
\bibliography{minlog}

\printindex
\end{document}

%%% Local Variables: 
%%% mode: latex-math
%%% TeX-master: t
%%% End: 
