Hybrid Realizability for Intuitionistic and Classical Choice Valentin Blot

Hybrid realizability for intuitionistic and classical choice Valentin Blot

To cite this version:

Valentin Blot. Hybrid realizability for intuitionistic and classical choice. 31st Annual ACM/IEEE Symposium on Logic in Computer Science, LICS ’16, Jul 2016, New York, United States. 10.1145/2933575.2934511. hal-01766881

HAL Id: hal-01766881 https://hal.archives-ouvertes.fr/hal-01766881 Submitted on 14 Apr 2018

HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Hybrid realizability for intuitionistic and classical choice

Valentin Blot University of Bath [email protected]

Abstract pretations of intuitionistic logic the axiom of choice is trivially re- In intuitionistic realizability like Kleene’s or Kreisel’s, the axiom of alized, interpreting even its countable version in a classical setting choice is trivially realized. It is even provable in Martin-Löf’s intu- requires the use of strong recursion schemes, like the bar recursion itionistic type theory. In classical logic, however, even the weaker operator defined in [23] in the framework of Gödel’s Dialectica in- axiom of countable choice proves the existence of non-computable terpretation. The requirement for such a strong recursion principle functions. This logical strength comes at the price of a compli- can be explained by the much stronger provability strength of clas- cated computational interpretation which involves strong recursion sical choice. For instance, since any formula can be reflected by a schemes like bar recursion. We take the best from both worlds and boolean in classical logic, the axiom of countable choice can build define a realizability model for arithmetic and the axiom of choice the characteristic function of any formula with integer parame- which encompasses both intuitionistic and classical reasoning. In ters. In particular, one can choose formulas encoding non-decidable this model two versions of the axiom of choice can co-exist in a predicates and prove the existence of non-computable functions. single proof: intuitionistic choice and classical countable choice. Variants of bar recursion were used in [2, 3] to interpret the We interpret intuitionistic choice efficiently, however its premise negative translation of the axiom of choice in an intuitionistic cannot come from classical reasoning. Conversely, our version of setting, and therefore classical arithmetic with countable choice classical choice is valid in full classical logic, but it is restricted through Gödel’s negative translation. In [8], it was shown that to the countable case and its realizer involves bar recursion. Hav- bar recursion can be used in a language with control operators ing both versions allows us to obtain efficient extracted programs to interpret directly the axiom of countable choice in a classical while keeping the provability strength of classical logic. setting. In the present work we extend this approach, adding strong existentials to the realizability interpretation. While these strong Categories and Subject Descriptors F.3.2 [Semantics of Pro- existentials are known to raise issues in the presence of control gramming Languages]: Denotational semantics; F.4.1 [Mathe- operators [12], our proof system allows for a simple criterion which matical Logic] forbids classical reasoning on these, ensuring the correctness of our computational interpretation in λµ-calculus. Conversely, weak existentials (which, in our setting, are double negations of the 1. Introduction strong ones) work well with control operators, but are less efficient Realizability appeared in [16] as a formal account of the Brouwer- from the computational perspective because their interpretations Heyting-Kolmogorov interpretation of logic, leading to the Curry- can hide some backtracks. Howard isomorphism between intuitionistic proofs and purely Rather than having to choose between an efficient system which functional programs. In [11], Griffin used control operators to ex- is restricted to intuitionistic logic or a full classical system with a tend the isomorphism to classical logic. While the first realizability complex computational interpretation, we take the best from both interpretations of classical logic relied on a negative translation fol- worlds and work within classical logic with strong existential quan- lowed by an intuitionistic realizability interpretation, Griffin’s dis- tifications, using their weak counterparts when classical reasoning covery can be exploited to give a direct realizability interpretation is needed. In a proof where the excluded middle is never used on of classical logic. This allowed Krivine to interpret second-order some existential formula, this existential can be strong and benefit Peano arithmetic and the axiom of dependent choice in an un- from an efficient interpretation (in particular, the axiom of choice typed λ-calculus extended with the call/cc operator [17]. In the is trivially realized in that case). If in the same proof some classi- work presented here, we interpret first-order classical arithmetic cal reasoning is performed on another existential formula, then that and the axiom of countable choice in a model of the simply-typed existential must be weak, and while we can still use the axiom of λµ-calculus [20], an extension of λ-calculus with control features. countable choice on it, its computational interpretation is given by The axiom of choice is ubiquitous in mathematics and is often bar recursion and can involve a costly recursion. used without even noticing. Therefore, having a computational in- We validate our model with an extraction result from proofs of 0 terpretation of this axiom is essential to the extraction of programs Π2 formulas with either a strong or a weak existential. The case of a from a wide range of mathematical proofs. While in usual inter- strong existential is immediate by definition of its semantics, while the case of a weak existential relies on Friedman’s trick which, in direct interpretations of classical logic, amounts to a non-empty realizability interpretation of the false formula. Our system allows for extraction of more efficient programs than with the usual direct or indirect interpretations of classical logic, provided some care is taken to choose strong existentials whenever possible. c 2016 by Valentin Blot. This work is licensed under the Creative Commons Attribution 4.0 International License. The combination of strong existentials and classical logic was To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/. LICS ’16, July 05-08, 2016, New York, NY, USA also investigated in [13], where strong existentials were weakened ACM 978-1-4503-4391-6/16/07. enough to make them compatible with classical logic while keeping http://dx.doi.org/10.1145/2933575.2934511 the validity of countable and dependent choices. The goal of [13] Given this fixed implementation of lists in System µT , we can now was to find the minimal restriction of strong existentials which extend it to System µTbr by adding the bar recursion operator: makes them compatible with control operators. This was achieved brec :(I × (T → 0) → I → T ) → ((I → T ) → 0) → T → 0 by an insightful analysis of proofs leading to the definition of the negative-elimination-free ones, but came at the expense of a together with its defining equation: complex computational interpretation, similarly to what happens brec MNP = N (P @ M h|P | , λx.brec MN (P ∗ x)i) with bar recursion. In the present work, we have a different goal and achieve it by following a different path: we keep the full power We choose to present System µTbr as an equational theory for of strong existentials (and therefore their simple computational simplicity, but one can define an abstract machine (as was done interpretation) and use bar recursion to computationally interpret in [8]) for which computational adequacy holds: for any term M : I the classical axiom of countable choice with weak existentials. of System µTbr and any n ∈ N, M = n in the equational theory if In our goal of extraction of efficient programs, the presence of and only if M reduces to n in the abstract machine. strong existentials with their full power and simple interpretation provides more efficient computational interpretations of classical 2.2 Categories of continuations proofs than [13]. As stated in the introduction, the axiom of countable choice to- In section 2 we define the programming language System µTbr gether with classical logic proves the existence of non-computable in which proofs of our system are interpreted, and present the cat- functions. Therefore, our language of realizers needs to contain egorical models of this language. In section 3 we present our de- such functions. While in [2] this was achieved by extending the duction system, which is a hybrid system allowing both intuition- language with infinite terms, we work as in [3] in a model of our istic and classical reasoning. We discuss the provability strength of programming language. Just like cartesian closed categories are the this system and in particular how it can interpret both intuitionis- universal models of λ-calculus, categories of continuations [14] are tic arithmetic with choice and classical arithmetic with countable the universal models of λµ-calculus. A category of continuations is choice. Then we prove that the terms interpreting our proofs are a full subcategory of a distributive category with exponentials of a well-typed in System µTbr. Finally, we present our realizability in- fixed object: terpretation in section 4, we prove its adequacy for our deduction Definition 1 (Category of continuations). Let C be a distributive system, and we validate our computational interpretation with two A extraction results: for strong and weak existentials. category and let R be an object of C such that all exponentials R exist. Then the full subcategory RC consisting of the objects RA is called a category of continuations. 2. λµ-calculus and categories of continuations We now fix a category of continuations RC together with an In this section we define the programming language in which the object I ∈ Ob (C) and describe the semantics of System µTbr proofs will be interpreted. This language is an extension of Gödel’s in RC.J TheK object I is the negative interpretation of the type system T with the control features of λµ-calculus [20] and bar I, and from that parameterJ K every type of System µTbr is given recursion. We call this language System µTbr. In order to have both a negative interpretation T ∈ Ob (C) and a positive one adequacy of the bar recursion operator for our variant of double- ∆ T C J K [T ] = R ∈ Ob R by: negation shift, we do not work directly in System µTbr but in J K a model of it. We therefore recall the definition of categories of ∆ ∆ ∆ λµ 0 = 1 T × U = T + U T → U = [T ] × U continuations [14], which are the universal models of -calculus. J K J K J K J KJ K J K where 1, + and × correspond to the distributive structure of C. 2.1 System µTbr We suppose a given interpretation [c] ∈ RC (1, [T ]) for each λµ-calculus has been introduced in [20] to provide a Curry-Howard c : T ∈ Cst, from which we can define the interpretation of any correspondence for classical natural deduction. We use here a par- term of System µTbr: ticular λµ-theory with natural numbers and recursion that we call

System µT . The types of System µT are built from a single base [x1 : T1, . . . , xn : Tn ` M : U | α1 : V1, . . . , αm : Vm]

& & C &

type for natural numbers, the empty type, product and arrow types: ∈ R ([T1] × ... × [Tn], [U] ([V1] ... [Vm])) T,U ::= I | 0 | T × U | T → U & ∆ where RA RB = RA×B is a binoidal functor on RC (see [22] The terms are given along with the typing rules in figure 1, and the for details). set Cst of constants for System µT are: We make some further assumptions on RC. First, the equations for the constants are verified in RC, and therefore the model is n : I succ : I → I rec : T → (I → T → T ) → I → T C sound: if M = N in System µTbr, then [M] = [N] in R . Second, The equational theory of System µT is given in figure 2, where the model is complete at type I: if [M] = [N] ∈ RC (1, [I]), then both sides of the equations must be well-typed. M = N in System µTbr. The model will further be required to In order to define the bar recursion operator, we need to be satisfy sequence internalization (definition 2) and continuity (def- able to manipulate finite lists of elements. There are several ways inition 3), but these requirements will be discussed in section 4.2, to implement these in System µT . The particular implementation along with adequacy of bar recursion for classical choice. chosen is irrelevant to our interpretation, so we fix one particular We now briefly give two running examples of models of System encoding and write T for the type of lists of elements of type T . µTbr satisfying soundness and adequacy at type I. We also define some notations for the operations on finite lists: we • The first one is a category of Scott domains. If we choose C to be write : T for the empty list, M ∗ N : T for the list obtained the category of unpointed Scott domains (i.e. algebraic directed by appending N : T to M : T , |M| : I for the size of M : T complete partial orders in which any two compatible elements and M @ N : I → T for the infinite extension of M : T with the have a lowest upper bound, see e.g. [1] for the definitions) values from N : I → T , i.e.: and continuous functions, R = ∪ {⊥} with the ordering N Mm if m < n a ≤ b ⇔ a = b or a = ⊥, which is the usual domain of ( ∗ M0 ∗ ... ∗ Mn−1 @ N) m = C N m otherwise natural numbers, and I = {⊥}, then R is a category of J K (c:V ∈ Cst) ~x : T~ , y : V ` y : V | ~α : U~ ~x : T~ ` c : V | ~α : U~

~x : T~ ` M : V → W | ~α : U~ ~x : T~ ` N : V | ~α : U~ ~x : T~ ` M : V1 × V2 | ~α : U~ ~x : T~ ` M : 0 | β : V, ~α : U~

~x : T~ ` MN : W | ~α : U~ ~x : T~ ` πi M : Vi | ~α : U~ ~x : T~ ` µβ.M : V | ~α : U~

Figure 1. Typing rules for simply-typed λµ-calculus

(λx.M) N = M {N/x} λx.M x = M (x∈ / FV (M)) (µα.M) N = µα.M {[α] N/ [α] }

πi hM1,M2i = Mi hπ1 M, π2 Mi = M πi (µα.M) = µα.M {[α] πi / [α] } [α] µβ.M = M {α/β} µα. [α] M = M (α∈ / FV (M)) µα.M = M { / [α] } (α : 0)

succ n = n + 1 succ (µα.M) = µα.M {[α] succ ( ) / [α] } rec MN 0 = M rec MN n + 1 = Nn (rec MN n) rec MN (µα.P ) = µα.P {[α] rec MN ( ) / [α] }

Figure 2. Equational theory of System µT

Scott domains and a category of continuations. The objects of constants: C C R being pointed, we can interpret general fixpoints in R , so tσ, uτ ::= xσ | tσ→τ uσ | cσ in particular we can interpret bar recursion. Since we are in a multi-sorted setting, we can have constants for • The second example is the category of Hyland-Ong games [15] combinators, natural numbers constructors, and recursor: in its unbracketed version [18], which is known to interpret control operators. If C is the category of finite families of arenas cσ ::= s(σ→τ→ν)→(σ→τ)→σ→ν | kσ→τ→σ and strategies, R is the singleton family of the one-move arena and I is the singleton family of the arena with countably | 0ι | Sι→ι | recσ→(ι→σ→σ)→ι→σ manyJ movesK then RC is a category of continuations which We can write every term of Gödel’s system T with these. In the is isomorphic to the category of unbracketed games (see [6], following, we will often omit the sorting information of the first- sections 3.2.2 and 4.4.1). This category is cpo-enriched and can order terms. therefore also interpret bar recursion. Since our logic encompasses both intuitionistic and classical From now on we will drop the interpretation brackets for terms proofs, we define both positive and negative formulas, by mutual and use the syntax of λµ-calculus to manipulate morphisms of induction. Full classical logic can be used on negative formulas,

RC. We will allow weakening without mentioning it, that is, while the positive ones will be restricted to intuitionistic reasoning.

C & the injection from the homset R ([T ], [U] [V ]) to the homset Because we will perform a direct interpretation in System µTbr &

RC ([T ] × [T 0], [U] & ([V ] [V 0])) obtained by precomposition which has control features, the atomic formulas (inequalities be- & l tween ﬁrst-order terms of the same sort, and falsity) will be neg- with the left projection and postcomposition with [U] w[V ],[V 0]

(with the notations of [22]) will be viewed as an inclusion: ative. Conjunctions of negative formulas, universal quantiﬁcations

& & & on negative formulas and implications with a negative conclusion C C 0 0 R ([T ], [U] [V ]) ⊆ R [T ] × T , [U] [V ] V are negative, while existentials of any formula are positive, as well as conjunctions with a positive component, implications with a pos- 3. Classical logic and the axiom of choice itive conclusion and universal quantifications of positive formulas: − − σ σ − − − σ − In this section, we define our logical framework, which is based A ,B ::= t 6=σ u | ⊥ | A ⇒ B | A ∧ B | ∀x A on classical logic with both strong and weak existentials (the latter + + + + + σ + σ being the double negations of the former). Formulas are divided A ,B ::= A ⇒ B | A ∧ B | A ∧ B | ∀x A | ∃x A into positive and negative, with classical reasoning being restricted Taking into account formulas on which classical reasoning is al- to the negative ones. This is achieved by considering two-sided lowed as well as formulas which are restricted to intuitionistic rea- sequents in which at most one positive formula can appear on the soning relies on a distinction between positive and negative formu- right hand side, in principal position. las introduced in [7] and related to proof systems LU [10], PCL [19] and LC [9] (see section 5.2). 3.1 The proof system Negation of a formula A is encoded as ¬A =∆ A ⇒ ⊥ (hence Our logic is multi-sorted, with one base sort ι for natural numbers ∆ it is always negative) and equality is encoded as tσ = uσ = together with higher-order sorts built on it with the arrow construc- σ ¬ (tσ 6= uσ). We will define our interpretation of proofs in Sys- tor: σ tem µTbr by directly annotating them with terms of System µTbr. σ, τ ::= ι | σ → τ In order to annotate the elimination rule of universal quantification There is an infinite set of first-order variables for each sort, and and the introduction rule of existential quantification, we need to first-order terms are either variables, well-sorted applications or embed first-order terms into System µTbr. First, we interpret the The following principle of extensionality: ` λp.p : x = x | β : S 0 = 0, α : ∃x (x = 0) σ σ→τ σ σ→τ σ σ→τ σ→τ ∀z (x z =τ y z ) ⇒ x =σ→τ y ` λxp.p : ∀x (x = x) | β : S 0 = 0, α : ∃x (x = 0) doesn’t hold in general, since it is refuted in intensional models of ` (λxp.p) 0 : 0 = 0 | β : S 0 = 0, α : ∃x (x = 0) system T, like game semantics. However, there exist extensional ` 0, (λxp.p) 0 : ∃x (x = 0) | β : S 0 = 0, α : ∃x (x = 0) models of system T, like the category of Scott domains. ` [α] 0, (λxp.p) 0 : ⊥ | β : S 0 = 0, α : ∃x (x = 0) Primitive inequality We chose a primitive inequality rather than equality in order to be able to realize Leibniz’s axiom schema. ` µβ. [α] 0, (λxp.p) 0 : S 0 = 0 | α : ∃x (x = 0) This technique introduced by Krivine is now common in classical ` 1, µβ. [α] 0, (λxp.p) 0 : ∃x (x = 0) | α : ∃x (x = 0) realizability [17]. For the restriction of our system to negative formulas this does not change provability: a negative formula with ` [α] 1, µβ. [α] 0, (λxp.p) 0 : ⊥ | α : ∃x (x = 0) equalities and/or inequalities is provable in our system (through ` µα. [α] 1, µβ. [α] 0, (λxp.p) 0 : ∃x (x = 0) | the encoding t = u ≡ ¬t 6= u) if and only it is provable in the same system with negative equalities (through the encoding Figure 3. An incorrect proof t 6= u ≡ ¬t = u). In particular, since in the classical fragment of our system (see the end of this section) every formula is negative, provability isn’t changed for that fragment. However, for the full sorts of the logic as types of System µTbr: system and the intuitionistic subsystem, things are less clear and we leave this to future work. ι∗ =∆ I (σ → τ) ∗ =∆ σ∗ → τ ∗ Ex falso quodlibet The formula ⊥ ⇒ A is provable in our system Then, assuming that each first-order variable is a variable of System for any formula A. For negative formulas, we have the simple proof µTbr, we map each first-order term to a term of System µTbr: ` λp.µα.p : ⊥ ⇒ A− |. For positive formulas, this proof is not + x∗ =∆ x (t u) ∗ =∆ t∗u∗ s∗ =∆ λxyz.x z (y z) correct because α : A is forbidden in our system. Nevertheless, there is still a proof of ⊥ ⇒ A+, by induction on A: if we have k∗ =∆ λxy.x 0∗ =∆ 0 S∗ =∆ succ rec∗ =∆ rec ` M : ⊥ ⇒ A | and ` N : ⊥ ⇒ B+ |, then: Using this mapping, we define our proof system in which every ` λpq.N p : ⊥ ⇒ A ⇒ B+ | ` λp. hx, M pi : ⊥ ⇒ ∃xA | derivation is annotated with a term of System µTbr. The sequents ` λp. hN p, M pi : ⊥ ⇒ B+ ∧ A | ` λpx.N p : ⊥ ⇒ ∀xB+ | can have several formulas on the right, one of which is principal: + − − ` λp. hM p, N pi : ⊥ ⇒ A ∧ B | p1 : A1, . . . , pm : Am ` M : C | α1 : B1 , . . . , αn : Bn Intuitionistic arithmetic with choice The connection with intu- The deduction rules are given in figure 4, and the set Ax of ax- ι ι ι itionistic logic is rather direct, since taking the set of rules of fig- ioms is given in figure 5. The axiom (∃x ¬A ⇒ ∀x A)⇒¬¬∀x A ~ (which is a variant of the usual double-negation shift) will allow us ure 4 with sequents restricted to the form ~p : A ` M : B | to derive the classical axiom of countable choice from its intuition- gives precisely intuitionistic logic. In particular, with that form of istic version in the next section. The meaning of the µ-variable κ sequents, the rules for ⊥ are removed, forbidding right contraction. of type I will be explained in section 4. Remark that in that case, ⊥ ⇒ A is no longer provable so we have The handling of positive and negative formulas is simplified by in fact only minimal logic. To get back full intuitionistic logic, we our use of multi-conclusioned sequents with a principal formula could have added ⊥ ⇒ x 6= y as an axiom (which is realized in the on the right of each sequent. All formulas on the right-hand side model of section 4 by λp.p), so ⊥⇒A would have an intuitionistic of a sequent except the principal one must be negative, while proof for any A, by induction on A. Considering its restriction to the principal formula and the formulas on the left-hand side of the intuitionistic fragment of the system, our realizability interpre- a sequent can be either positive or negative. In particular, right tation is similar to Kreisel’s modified realizability such as presented contraction is forbidden on positive formulas, which corresponds in [5] for minimal logic, the main difference being that our inter- to allowing only intuitionistic reasoning on these. This should be pretation is performed in the meta-theory rather than presented in put in parallel with our use of λµ-calculus, in which there is a the form of a logical translation. When it comes to arithmetic, the set of axioms of figure 5 minus principal type on the right-hand side of a typing judgment, which is ι ι ι the type of the current term (the other types on the right-hand side (∃x ¬A ⇒ ∀x A) ⇒ ¬¬∀x A is almost the set of axioms of in- are the types of the continuations variables). We give in figure 3 the tuitionistic arithmetic in higher types with choice. The only differ- implementation of the counter-example of [12] in our setting. An ence is that we have a primitive inequality, and our Leibniz’s axiom existential formula appears on the right-hand side in a non-principal schema concerns inequality. As stated above, the exact connection position, and therefore this proof is invalid in our system. We will with intuitionistic arithmetic with a primitive equality is still to be see at the end of section 4.2 that accepting such a proof in our investigated. system would lead to a degenerated realizability model. Classical arithmetic with countable choice Proofs of classical logic can be embedded in our system through a simple transforma- 3.2 Proof-theoretic strength tion of formulas: we transform every existential ∃xA of classical In this section, we discuss some properties of our hybrid proof logic into a weak existential ∃cxA =∆ ¬¬∃xA in our system and system and relate it to more usual theories. work in the following restricted syntax of formulas: Non-extensional equality The equality in our system being de- Ac,Bc ::= t 6= u | ⊥ | Ac ⇒ Bc | Ac ∧ Bc | ∀xAc | ∃cxAc fined by Leibniz’s axiom schema, we easily have the following facts: The negativity constraints on the right-hand side of our sequents c σ→τ σ→τ σ σ→τ σ σ→τ σ are then automatically satisfied since A is always negative. Since x =σ→τ y ⇒ ∀z (x z =τ y z ) only existential quantifications are modified by this transformation, σ σ σ→τ σ→τ σ σ→τ σ x =σ y ⇒ ∀z (z x =τ z y ) classical logic can be embedded in our system if we prove that (M:C ∈ Ax) ~p : A,~ q : C ` q : C | ~α : B~ − ~p : A~ ` M : C | ~α : B~ −

~p : A~ ` M : C | ~α : B~ − ~p : A~ ` M : ∀x C | ~α : B~ − (x∈ /FV(A,~ B~ −)) ~p : A~ ` λx.M : ∀x C | ~α : B~ − ~p : A~ ` M t∗ : C {t/x} | ~α : B~ −

~p : A~ ` M : A {t/x} | ~α : B~ − ~p : A,~ q : A ` N : C | ~α : B~ − ~p : A~ ` M : ∃x A | ~α : B~ − (M/∈FV(A,C,~ B~ −)) ∗ − − ~p : A~ ` ht ,Mi : ∃x A | ~α : B~ ~p : A~ ` (λxq.N)(π1 M)(π2 M): C | ~α : B~

Figure 4. Deduction rules of our proof system

λp.p : x = x λp.p : ¬A ⇒ A {y/x} ⇒ x 6= y λp.p : s x y z = x z (y z)[κ] 0 : S x 6= 0 λp.p : k x y = x rec : A {0/x} ⇒ ∀xι (A ⇒ A {S x/x}) ⇒ ∀xι A σ τ σ→τ σ λp.p : rec x y 0 = x λp. hλx.π1 (p x) , λx.π2 (p x)i : ∀x ∃y A ⇒ ∃v ∀x A {v x/y} λp.p : rec x y (S z) = y z (rec x y z) λpq.brec p q :(∃xι¬A ⇒ ∀xιA) ⇒ ¬¬∀xιA

Figure 5. Axioms of our proof system the usual rules of existential quantification are admissible for weak so we get ∀xι¬¬B ⇒ ¬¬∀xιB, which is usually called double- existentials ∃c. For the introduction rule: negation shift. Next, we instantiate B with ∃yσA to get: c c c if ~p : A~ `M : C {t/x} | ~α : B~ ∀xι¬¬∃yσA ⇒ ¬¬∀xι∃yσA ~c ∗ c c ~ c then ~p : A `λq.q ht ,Mi : ∃ xC | ~α : B Finally, the second axiom entails: and for the elimination rule: ¬¬∀xι∃yσA ⇒ ¬¬∃vι→σ∀xιA {v x/y} if ~p : A~c, q : Cc `M : Dc | ~α : B~ c so we get ∀xι¬¬∃yσA⇒¬¬∃vι→σ∀xιA {v x/y}, which was our and ~p : A~c `N : ∃cxCc | ~α : B~ c goal. then c c c Remark that the axiom (∃xι¬B ⇒ ∀xιB) ⇒ ¬¬∀xιB with ~p : A~ ` µβ.N (λr. [β](λxq.M)(π1 r)(π2 r)) : D | ~α : B~ B negative is actually derivable in our system, as is the double- which is valid since Dc is negative. negation shift for negative formulas. In the lemma, however, we in- The usual axioms of classical arithmetic are all satisfied (in stantiate it with B ≡ ∃yσA, which is a positive formula. Therefore particular, since every Ac is negative, provability is not changed we cannot use the classical proof, since control operators cannot be by our use of a primitive inequality, see above). The last require- used on strong existentials, as was demonstrated in [12]. ment is then that the axiom of countable choice ∀xι∃cyσA ⇒ For simplicity reasons, we did not consider here the axiom ∃cvι→σ∀xιA {v x/y} is provable in our system: of dependent choice. Realizing classical dependent choice in the current setting would be possible with the slightly different bar Lemma 1. The following formula: recursion operator of [7], but the version of the double-negation ∀xι¬¬∃yσA ⇒ ¬¬∃vι→σ∀xιA {v x/y} shift that we use here is not sufficient to derive classical dependent choice from intuitionistic choice because it allows shifting double is provable in our system. negations over first-order quantifications of type ι only. The embedding of classical proofs in our system that we just Proof. We will derive it from the two axioms: described is rough and doesn’t exploit the existence of strong ex- ι ι ι istentials. The purpose of our hybrid system being to mix strong (∃x ¬B ⇒ ∀x B) ⇒ ¬¬∀x B and weak existentials in a single proof, we now explain how this is ∀xι∃yσA ⇒ ∃vι→σ∀xιA {v x/y} possible. For example, one lemma could state: As stated above ⊥ ⇒ ∀xιB is provable, therefore we can derive  y = (u x y) × x + (v x y) ι ι  ¬∃x ¬B ⇒ ¬¬∀x B from the first axiom. We also have: ∃uι→ι→ι∃vι→ι→ι∀xι∀yι ∧ ι ι  ` λpq.p (π1 q)(π2 q): ∀x ¬¬B ⇒ ¬∃x ¬B |  v x y < x with appropriate encodings of multiplication, addition and ordering by induction on t. Then the proof is by induction on the derivation. using equality and System T. This lemma is clearly provable con- structively, hence the strong existentials obtained using intuitionistic choice. Another lemma could be: c ι→ι ι ∃ u ∀x (u x = 0 ⇔ ∃y1 . . . ykP (y1, . . . , yk) = x) This result is typical of typed realizability, in which a realizer of a formula is a typed program, its type being inferred from the for some polynomial P with coefficients in N and such that formula. Working in typed realizability allows in particular the use {P (n1, . . . , nk)| n1, . . . , nk ∈ N} is undecidable (such polyno- of models with strong properties, like categories of continuations mial exists by Matiyasevich’s negative answer to Hilbert’s tenth in our case. problem). This lemma is provable using classical logic and the axiom of countable choice, which is why we only have a weak existential. Nevertheless, these two lemmas can be used in a single 4. Realizability proof. When using the first lemma, the efficient realizer of intuitionistic choice will perform the computations, while when using We define here our realizability interpretation and prove that the the second, bar recursion will be used and unbounded search may System µTbr term annotating a proof of a formula is a realizer of be performed. In order to make weak and strong existentials inter- that formula. Finally, we give two extraction results, for strong and act, it may be necessary to turn a strong existential into a weak one, weak existentials. which is possible since we have ` λpq.q p : ∃xA ⇒ ∃cxA |. By doing that the computational efficiency is not lost, since we only 4.1 Realizability values encapsulate the strong existential into a weak one with possibilities In this section, each formula gets an associated realizability value, of backtrack which are not used. which is a set of morphisms in RC. First, we set the range of the We now explain briefly why the interpretation of a strong ex- quantifiers by defining a set |σ| ⊆ RC (1, [σ∗]) for each sort σ: istential is more efficient that the interpretation of a weak one. The first difference is on the types of the interpretation: while ∆ ∆ |ι| = {n| n ∈ N} |σ → τ| = {φ| ∀ψ ∈ |σ| , φ ψ ∈ |τ|} (∃xσA) ∗ = σ∗ × A∗, the type interpretation of the corresponding weak existential is: For the sake of extraction, the realizability model is parameterized c σ ∗ σ ∗ ∗ ∗ with a set ⊥⊥⊆ |ι|, as in [7, 8] and similarly to [17]. This set is (∃ x A) = ((∃x A ⇒ ⊥) ⇒ ⊥) = (σ × A → 0) → 0 used to define a non-empty realizability value for the formula ⊥, The second difference concerns the computational behavior of the as usual in classical realizability. The realizability values are de- respective interpretations. On one hand, the interpretation of a fined for closed formulas with parameters in RC, that is, formulas strong existential consists of a witness (of type σ∗) and a proof in which every free variable xσ has been replaced with some ele- (of type A∗) which are independent because of RC’s cartesianness. ment of |σ|. Again for the sake of extraction, the realizability value

On the other hand, the interpretation of a weak existential takes an of a formula A will not be a subset of RC (1, [A∗]), but a subset ∗ ∗ & argument φ of type σ × A → 0 and can call it several times (this of RC (1, [A∗] [I]). Reasons for this choice are discussed before is called backtracking). In the general case, the arguments supplied proving adequacy for the logical rules, and details can be found to φ in a given call can even depend on the outcome of the previous in [7]. Morphisms in this homset should be thought of as having a calls. Therefore, using strong existentials whenever possible gives free µ-variable of type I, for which we use the reserved name κ. In- an interpretation that may be more efﬁcient than the usual double- tuitively, a realizer of A has two output channels: one is of type A∗, negation interpretation. while the other is of type I. This corresponds to Krivine’s distinction between realizers and proof-like realizers [17]. A realizer may 3.3 Soundness output an element of ⊥⊥ on the channel κ of type I, while a proof- ∗ We prove in this section that the System µTbr terms annotating the like realizer must output on the principal channel of type A . Apart proofs are well-typed. We ﬁrst map every formula A to a type A∗ from the interpretation of the atomic formulas which takes into ac- of System µTbr: count the parameter ⊥⊥, the interpretation of the other connectives ∗ ∆ ∗ ∆ is the same as in usual intuitionistic realizability like Kleene’s or (t 6= u) = 0 ⊥ = 0 Kreisel’s: ∗ ∆ ∗ ∗ ∗ ∆ ∗ ∗ (A ⇒ B) = A → B (A ∧ B) = A × B |⊥| =∆ {φ| µκ.φ ∈ ⊥⊥} ∆ ∆

(∀xσA) ∗ = σ∗ → A∗ (∃xσA) ∗ = σ∗ × A∗ ( ∗ ∗

∆ |⊥| if t = u |t 6= u| = & Then we prove that the term associated to a derivation has the type RC (1, [0] [I]) otherwise associated to the conclusion of the derivation. Note the presence of a µ-variable κ, which is there for extraction purposes. Its meaning |A ⇒ B| =∆ {φ| ∀ψ ∈ |A| , φ ψ ∈ |B|} will be explained in section 4. ∆ |A ∧ B| = {φ| π1 φ ∈ |A| ∧ π2 φ ∈ |B|} Proposition 1 (Soundness). If a derivation has conclusion: |∀xσA| =∆ {φ| ∀ψ ∈ |σ| , φ ψ ∈ |B {ψ/x}|} ~p : A~ ` M : C | ~α : B~ − σ ∆ |∃x A| = {φ| π1 φ ∈ |σ| ∧ π2 φ ∈ |B {π1 φ/x}|} and if FV A,~ C, B~ − = ~x~σ, then there is a corresponding typing derivation of M: Remember that we use implicit weakening, as stated at the end of

section 2.2. This means that in the deﬁnition of |∀xσA|, ψ ∈ |σ| ⊆ ∗ ∗ ∗ −∗ & ~x : ~σ , ~p : A~ ` M : C | ~α : B~ , κ : I RC (1, [σ∗]) is considered as a morphism in RC (1, [σ∗] [I])

when we apply φ to it, and in the deﬁnition of |∃x A|, while π1 φ τ & Proof. First, we prove that for any ﬁrst-order term t with FV (t) = C ∗ ~σ is a morphism in R (1, [σ ] [I]), π1 φ ∈ |σ| means that π1 φ is ~x there is a typing derivation: equal to some ζ ∈ |σ| ⊆ RC (1, [σ∗]), when ζ is considered as a

~x : ~σ∗ ` t∗ : τ ∗ | morphism in RC (1, [σ∗] & [I]). 4.2 Adequacy In particular, all functions on natural numbers must exist in the In this section, we prove the adequacy of our realizability inter- model, even the uncomputable ones. This is consistent with the fact C that the combination of the axiom of choice with classical logic pretation, that is, the interpretation in R of a System µTbr term annotating a proof of a formula is a realizer of that formula. First, proves the existence of such functions. Sequence internalization is we prove adequacy for the axioms, and then for the rules. verified in the two examples given in section 2.2, Scott domains and game semantics, but it is of course not satisfied by the term model Adequacy for the axioms of System µTbr, and this is the main motivation for working in a model rather than directly with the syntactic language. • The equalities which are verified in RC are realized by the identity: The second requirement is continuity:

Deﬁnition 3 (Continuity). If φ ∈ RC (1, [(I → T ) → 0] & [I]), Lemma 2. If φ ∈ |σ| then λp.p ∈ |φ = φ|. &

ψ ∈ RC (1, [I → T ] [I]) and µκ.φ ψ ∈ |ι|, then there exists C & m ∈ N such that for any ζ ∈ R (1, [I → T ] [I]): Proof. Since |φ = φ| = |(φ 6= φ) ⇒ ⊥| and |φ 6= φ| = |⊥|. ∀m0 < m, ζ m0 = ψ m0 ⇒ φ ζ = φ ψ Since RC satisfies the equations of figure 2 and because of the inter- m is called the modulus of continuity of φ at ψ. pretation of first-order terms in System µTbr given in section 3.1, the lemma above proves adequacy of the axiom of reflexivity and Continuity of the higher-order functional φ (which takes infinite the definitional axioms of s, k and rec. objects as input) means that if the output of φ on input ψ is a natural number, then it only depends on a finite amount of ψ: • Leibniz scheme is realized by the identity as well: the finite sequence ψ 0, . . . , ψ m − 1 (where m is the modulus of Lemma 3. If φ, ψ ∈ |σ| then: continuity of φ at ψ). This requirement is also satisfied in Scott domains (it is an immediate consequence of Scott continuity) and in λp.p ∈ |¬A {φ/x} ⇒ A {ψ/x} ⇒ φ 6= ψ| game semantics since in that case RC is a cpo-enriched category in which the base types I and 0 are interpreted as flat domains. Note,

Proof. If φ 6= ψ then |φ 6= ψ| = RC (1, [0] & [I]) and the result however, that the full set-theoretic model doesn’t satisfy continuity, is trivial, and if φ = ψ then |φ 6= ψ| = |⊥| and |A {φ/x}| = since we can for example consider a function which gives 0 if the |A {ψ/x}| so |¬A {φ/x}| = |A {ψ/x} ⇒ φ 6= ψ| input sequence is the constant 0 sequence, and 1 otherwise. Using these two assumptions on RC, we can now prove adequacy of bar recursion for our version of the double-negation shift: • Anything realizes that 0 is no successor: Lemma 7. λpq.brec p q ∈ |(∃xι¬A ⇒ ∀xιA) ⇒ ¬¬∀xιA|. Lemma 4. If n ∈ |ι| then [κ] 0 ∈ |S n 6= 0|. Proof. Let φ ∈ |∃xι¬A ⇒ ∀xιA| and ψ ∈ |¬∀xιA|. The follow- C Proof. n + 1 6= 0 by adequacy of R for System µTbr at type I, ing fact is easily provable, using the equation deﬁning brec:

therefore we have |S n 6= 0| = RC (1, [0] & [I]) and the result is trivial. Let ∀i < n, ζi ∈ A i/x and write ξ = ∗ ζ0 ∗ ... ∗ ζn−1. If λx.brec φ ψ (ξ ∗ x) ∈ |¬A {n/x}| then brec φ ψ ξ ∈ |⊥| • Recursion realizes induction: Now suppose for the sake of contradiction that brec φ ψ ∈ / |⊥|. Lemma 5. rec ∈ |A {0/x} ⇒ ∀xι (A ⇒ A {S x/x}) ⇒ ∀xι A|. Then by the above fact we have: λx.brec φ ψ (ξ ∗ x) ∈/ ¬A 0/x Proof. If φ ∈ |A {0/x}| and ψ ∈ |∀xι (A ⇒ A {S x/x})|, then so there exists ζ0 ∈ A 0/x such that brec φ ψ ( ∗ ζ0) ∈/ |⊥|. rec φ ψ n ∈ |A {n/x}| by induction on n ∈ N. Iterating this argument gives us an inﬁnite sequence (ζn) such n∈N that for every n ∈ N, ζn ∈ |A {n/x}| and: • The intuitionistic version of countable choice is trivially real-

ized: brec φ ψ ( ∗ ζ0 ∗ ... ∗ ζn−1) ∈/ |⊥| C ∗ & Lemma 6. We now internalize this sequence as ϕ ∈ R (1, [I → A ] [I]) using our assumption on RC. But then ϕ ∈ |∀xιA|, so ψ ϕ ∈ |⊥|. C λp. hλx.π1 (p x) , λx.π2 (p x)i Finally, using continuity of R (since µκ.ψ ϕ ∈ ⊥⊥⊆ |ι|), let n be σ τ σ→τ σ ψ ϕ ξ = ∗ζ ∗...∗ζ ∈ |∀x ∃y A ⇒ ∃v ∀x A {v x/y}| the modulus of continuity of at and write 0 n−1. We have:

Proof. Immediate. ψ (ξ @ φ hn, λx.brec φ ψ (ξ ∗ x)i) = ψ ϕ ∈ |⊥| but this morphism is brec φ ψ ξ, which by construction is not in • Adequacy of bar recursion for our version of the double- |⊥|, hence the contradiction. negation shift requires two assumptions on RC: sequence internalization and continuity. Sequence internalization means that any The proof above together with lemma 1 and adequacy for the sequence of morphisms can be turned into a morphism of sequence logical rules (see next paragraph) proves that the computational type: interpretation of the axiom of countable choice for classical logic with bar recursion is adequate with respect to our realizability

Deﬁnition 2 (Sequence internalization). If (φn)n∈ is a sequence & N semantics. In [13], Herbelin deﬁnes a logic with strong existentials

of morphisms in RC ([T ], [U] [V ]), then there exists a morphism which are weakened to make them compatible with classical logic C & φ ∈ R ([T ], [I → U] [V ]) such that for any n ∈ N, φ n = φn. but which still allow the derivation of the axioms of countable and dependent choices. While the classical axiom of dependent choice Deﬁnition 4 (Orthogonality). For any type T we deﬁne an orthog-

could be realized in our framework as well, Herbelin’s approach onality relation between RC (1, [T ] & [I]) and C ( I , T ) by: in [13] seems rather different from ours. Herbelin restricts the J K J K elimination of strong existentials and uses an elaborate operational φ ⊥ ж ⇐⇒ µκ. [ж] φ ∈ ⊥⊥

semantics with coinductive formulas to keep these compatible with with φ ∈ RC (1, [T ] & [I]) and ж ∈ C ( I , T ). classical logic. We choose to have both strong existentials (with J K J K an unrestricted elimination rule) on which no classical reasoning is That is the reason why in section 4.1 we chose to deﬁne

the realizability value of a formula A as a set of morphisms in allowed but which have a very easy computational interpretation, & RC (1, [A∗] [I]) and we choose now to define the falsity value and weak existentials on which full classical logic can be used, but ∗ for which the axiom of countable choice requires the use of bar of A as a set of morphisms in C ( I , A ). More details can be recursion. We believe that a detailed proof of normalization for the found in [7], J K J K calculus of [13] would shed some lights on its connections with bar Until now there has been no semantic distinction between pos- recursion, which would in turn clarify the relationship between his itive and negative formulas in our realizability interpretation be- logic and the present work. cause the distinction relates to the possibility of using classical reasoning or not and axioms are indifferent to the kind of logic used. Adequacy for the logical rules Classical computations often rely The classical aspects of our proof system are entirely taken care on a duality between a program and its environment. In Krivine’s of by the rules, which we now prove adequate. The distinction be- classical realizability [17], a program is an element in a set Λ of tween positive and negative formulas is reflected in the realizability terms, while an environment is an element in a set Π of stacks. semantics by the fact that only the realizability value of a negative Each formula gets both a realizability value which is a subset of formula need to be the orthogonal of some falsity value. This is Λ and a falsity value which is a subset of Π. Krivine’s model is not necessary for positive formulas: orthogonality is only needed parameterized by an orthogonality relation ⊥⊥⊆ Λ × Π and each for classical logic. Therefore, only negative formulas A− have a − ∗ formula gets first a falsity value in P (Π) and then a realizability falsity value A ⊆ C ( I , A ): value in P (Λ) which is the orthogonal of its falsity value. J K J K ∗ ∗ C k⊥k if t = u In our setting, programs are morphisms of the category R , k⊥k =∆ C ( I , 0 ) kt 6= uk =∆ and environments are morphisms of the category C. Since our J K J K ∅ otherwise realizability is typed, we do not have a set Λ of programs as − ∆ n −1 o C A ⇒ B = pair Λ φ, ж φ ∈ |A| ∧ ж ∈ kBk in Krivine’s untyped setting, but we have a set R (1, [T ]) of I J K programs of type T for each type T . The idea is then to define a ∆ A− ∧ B− = {inj ◦ ж| ж ∈ kAk} ∪ {inj ◦ ж| ж ∈ kBk} typed orthogonality relation between RC (1, [T ]) and C (1, T ). 1 2 J K σ − ∆ n −1 o In order to do that, we can simply perform evaluation (since [T ] = ∀x A = pair Λ φ, ж φ ∈ |σ| ∧ ж ∈ kA {φ/x}k T I RJ K) to get a morphism from 1 to R. This duality is similar to the J K

R −1 one encountered in vector spaces, where the dual of some -vector where Λ I , pair (_, _), inji and ◦ are respectively partial un- ∗ & space E is the vector space E of linear forms from E to R. In this curryingJ (fromK RC (1, [T ] [I]) to C ( I , [T ])), pairing, injection setting, an orthogonality relation is usually defined between E and J K ∗ ∗ and composition in C. E by stating that x ∈ E and ϕ ∈ E are orthogonal to each other It is now a property (rather than a definition as in Krivine’s if and only if ϕ (x) = 0 in R. C setting) that realizability values are the orthogonals of falsity values In order to define an orthogonality relation between R and C, for negative formulas: there should be at least two morphisms from 1 to R, but there is − no reason for this to hold. For example, if RC is the category of Lemma 8. For any negative formula A with parameters: unbracketed Hyland-Ong games described in section 2.2, then R is − − φ ∈ A ⇐⇒ ∀ж ∈ A , φ ⊥ ж the one-move arena and there is only one morphism from 1 to R. In order to extract programs computing natural numbers, we even h −1 i need to have at least countably many such morphisms. To circum- Proof. Follows from pair Λ I (ψ) , ж φ = [ж] φ ψ and

vent this issue, we will not deﬁne an orthogonality relation between J K & [inji ◦ ж] φ = [ж] πi φ RC (1, [T ]) and C (1, T ) but rather between RC (1, [T ] [I]) and C ( I , T ), basedJ onK our parameter ⊥⊥⊆ |ι|. In a general Since |∃xσA| = S {hφ, ψi| ψ ∈ |A {φ/x}|}, the fact J K J K φ∈|σ| way, we can combine morphisms: that |∃xσA| is not the orthogonal of some falsity value is also

φ ∈ RC ([U], [T ] & [V ]) and ж ∈ C ([U] × V , T ) reminiscent of what happens in vector spaces: a union of linear subspaces is in general not a linear subspace, and therefore it is −1 J K J K by, ﬁrst, partially uncurrying φ into Λ V φ ∈ C ([U] × V , [T ]), strictly included in its double orthogonal (which is the sum of σ −

pairing it with ж, evaluating, and thenJ curryingK the resultJ toK get: the subspaces). Conversely, since we can also write ∀x A = & T − C ψ ψ φ ∈ A {φ/x} , this realizability value is stable [ж] φ ∈ R ([U], [0] [V ]) φ∈|σ| by double orthogonality and has a corresponding falsity value, just The notation [ж] φ corresponds to the idea that ж is an environment like any intersection of linear subspaces is still a linear subspace. that is substituted for the µ-variable α : T in [α] φ. In the particular We can now state the adequacy lemma: case of [U] = 1 and [V ] = [I] we therefore get:

Proposition 2 (Adequacy). If a derivation has conclusion: C &

If φ ∈ R (1, [T ] [I]) and ж ∈ C ( I , T ) ~p : A~ ` M : C | ~α : B~ − & J K J K then [ж] φ ∈ RC (1, [0] [I]) and µκ. [ж] φ ∈ RC (1, [I]) and if FV A,~ C, B~ − ⊆ ~x~σ, then for any φ~ ∈ |~σ|, and for any

where κ is a reserved name for the free µ-variable of type I & &

~ ~ n~ o ~ − n~ o in RC (1, [T ] [I]) and RC (1, [0] [I]) (see section 4.1). The ψ ∈ A φ/~x and ж~ ∈ B φ/~x , we have: & C orthogonality relation between R (1, [T ] [I]) and C ( I , T ) n o n o J K J K ~ ~ can now be defined from our parameter ⊥⊥⊆ |ι|: M ψ/~p,~ж/~α ∈ C φ/~x Proof. First, we prove that for any first-order term tτ with FV (t) ⊆ and we prove that: ~σ ~ ~ ∗ n~ o ~x and for any φ ∈ |σ|, we have t φ/~x ∈ |τ| by induction on λx.π2 x ([κ] π1 x) ∈ |¬∃y (t {φ/x} = u {φ/x})| t. Then the proof is by induction on the derivation and relies on Let ψ ∈ |∃y (t {φ/x} = u {φ/x})|. Then π ψ ∈ |ι| and π ψ ∈ the fact that the falsity values are only necessary for the negative 1 2 |¬ (t {φ/x, π1 ψ/y} 6= u {φ/x, π1 ψ/y})|, so it suffices to prove formulas B~ −. that [κ] π1 ψ ∈ |t {φ/x, π1 ψ/y} 6= u {φ/x, π1 ψ/y}|. For that, we distinguish two cases: We end this section by showing that if the proof of figure 3 was correct in our system, then the realizability model would be • π1 ψ ∈ ⊥⊥: in that case µκ. [κ] π1 ψ = π1 ψ ∈ ⊥⊥, therefore degenerated. This proves that the issue identified in [12] arises [κ] π1 ψ ∈ |⊥| ⊆ |t {φ/x, π1 ψ/y}= 6 u {φ/x, π1 ψ/y}| in our system as well. Suppose for the sake of contradiction that • π1 ψ∈ / ⊥⊥: then by our choice of the parameter ⊥⊥ we have ∗ ∗

adequacy holds for the proof of ﬁgure 3. This means that M ∈ t {φ/x, π1 ψ/y}= 6 u {φ/x, π1 ψ/y}, and therefore we get C & |∃x (x = 0)|, where: |t {φ/x, π1 ψ/y}= 6 u {φ/x, π1 ψ/y}| = R (1, [0] [I])

M = µα. [α] 1, µβ. [α] 0, (λxp.p) 0 Finally we get M φ (λx.π2 x ([κ] π1 x)) ∈ |⊥|, and therefore µκ.M φ (λx.π2 x ([κ] π1 x)) ∈ ⊥⊥, which achieves the proof.

Calculation shows that π1 M = 1 and π2 M = λp.p, so we get C &

λp.p ∈ 1 = 0 , and since 1 6= 0 = R (1, [0] [I]), we obtain & Again, if we choose σ = τ = ι, then for any n ∈ N,

|⊥| = RC (1, [0] [I]) (remember that 1 = 0 is 1 6= 0 ⇒ ⊥). & µκ.M n (λx.π2 x ([κ] π1 x)) reduces in the abstract machine to This implies that |t 6= u| = RC (1, [0] [I]) regardless of wether some m such that t∗ {n/x, m/y} and u∗ {n/x, m/y} are equal in t∗ = u∗ or not, and therefore the realizability model is degenerated. RC. A variant of proposition 3 in the case τ = ι can also be obtained 4.3 Extraction from proposition 4 since weak existentials are derivable from the Finally, we validate our model with two extraction results. Recall strong ones: if M is as in proposition 3 with τ = ι, then for any that =σ is the non-extensional equality defined in section 3.1 and φ ∈ |σ|, µκ.π2 (M φ) ([κ] π1 (M φ)) is some n ∈ |ι| such that discussed in section 3.2. The first extraction result is immediate and t∗ {φ/x, n/y} = u∗ {φ/x, n/y} holds in RC. relies on strong existentials: 0 5. Conclusion Proposition 3. Suppose we have a derivation of some closed Π2 formula: We defined a realizability framework allowing the use of both σ τ ν ν ` M : ∀x ∃y (t =ν u ) | strong and weak existential quantifications. Any proof in classical arithmetic with the axiom of countable choice can be interpreted then for any φ ∈ |σ|, we have π1 (M φ) ∈ |τ| and moreover ∗ ∗ C as a program and a concrete value can be extracted from a proof t {φ/x, π1 (M φ) /y} = u {φ/x, π1 (M φ) /y} holds in R . 0 of a Π2 formula in this theory. Moreover, if some care is taken to use strong existentials whenever possible, the extracted program is Proof. We choose ⊥⊥ = ∅, therefore: more efficient that the ones obtained with the usual interpretations. ∗ ∗ |t {φ/x, π1 (M φ) /y} = u {φ/x, π1 (M φ) /y}|= 6 ∅ 5.1 Future works ⇐⇒ In the current setting, it is up to the person writing the proof to de- ∗ ∗ C t {φ/x, π1 (M φ) /y} = u {φ/x, π1 (M φ) /y} in R termine whether at some point the use of a strong existential is possible. However, no theoretic reason forbids this to be checked auto- And then the result is immediate by definition of the realizability matically. With an automatic procedure for this, one could work in values of strong existentials. We could also conclude by applying the general setting of classical logic with countable choice and still the intuitionistic axiom of choice to M. obtain extracted programs which are as efficient as possible. A concrete implementation of our framework would lead to a In particular, if we choose σ = τ = ι and if we have a computa- quantitative analysis of the efficiency of the extracted programs. In tionally adequate abstract machine to execute System µTbr (which particular, we could do some efficiency comparison while staying is possible, as explained at the end of section 2.1), then for any ∗ in our framework, since the usual interpretation (with weak sums n ∈ N, π1 (M n) reduces to some m such that t {n/x, m/y} and ∗ C everywhere) is implementable directly in our system. u {n/x, m/y} are equal in R . Proposition 3 also holds for for- The impact of choosing a primitive inequality rather than an mulas of arbitrary complexity if we replace the concluding equality equality in our system is still to be investigated. Indeed, while prov- by the existence of a uniform realizer (a realizer with ⊥⊥ = ∅), but ability is unchanged for the subsystem with only negative formulas the goal here is to compare it to extraction from weak existentials, 0 as well as for its fragment with only weak existential quantifica- which holds only for Π2 formulas. tions (that fragment being equivalent to classical arithmetic with The second extraction result concerns weak existentials: countable choice from the point of view of provability), this is still Proposition 4. Suppose we have a derivation of some closed for- unclear for the full system or its intuitionistic restriction (without mula of the form: the right-hand context). σ ι τ τ ` M : ∀x ¬¬∃y (t =τ u ) | 5.2 Related works then for any φ ∈ |σ|, µκ.M φ (λx.π2 x ([κ] π1 x)) is some n ∈ |ι| Our polarities are the ones defined in [7], where we mentioned such that t∗ {φ/x, n/y} = u∗ {φ/x, n/y} holds in RC. a possible connection with Girard’s LU proof system [10]. We recently became aware of the work of Liang and Miller [19] and Proof. If φ ∈ |σ| then M φ ∈ |¬¬∃y (t {φ/x} = u {φ/x})|. We believe that there is a strong connection between our polarities and now fix ⊥⊥⊆ |ι| to be: the ones of their PCL system, despite their claim that the polarities n o of PCL are different from the ones of LU. In particular our system ∗ ∗ C ⊥⊥ = m t {φ/x, m/y} = u {φ/x, m/y} holds in R seems to be related to an extension of LC [9] with an intuitionistic implication. However, any universal quantification is negative in Summer Meeting of the Association for Symbolic Logic, volume 20 of LC, while in our system it is negative if and only if the formula Lecture Notes in Logic, pages 89–107. A K Peters, Ltd., 2005. quantified on is negative. [4] U. Berger, H. Schwichtenberg, and M. Seisenberger. The Warshall Al- On the computational side, Herbelin managed to define in [13] gorithm and Dickson’s Lemma: Two Examples of Realistic Program a logic in which strong existentials are weakened just enough to Extraction. Journal of Automated Reasoning, 26(2):205–221, 2001. be compatible with both classical logic and the axiom of countable [5] U. Berger, W. Buchholz, and H. Schwichtenberg. Refined program choice, at the cost of a complicated computational interpretation extraction from classical proofs. Annals of Pure and Applied Logic, involving corecursion and a lazy call-by-name evaluation strategy. 114(1-3):3–25, 2002. We believe that there are strong connections between the opera- [6] V. Blot. Game semantics and realizability for classical logic. PhD tional semantics of Herbelin’s calculus and bar recursion. This pos- thesis, École Normale Supérieure de Lyon, 2014. sible connection could appear from a careful analysis of a detailed [7] V. Blot. Typed realizability for first-order classical analysis. Logical proof of termination of Herbelin’s calculus. Methods in Computer Science, 11(4), 2015. Refinements of program extraction were also investigated in [5] [8] V. Blot and C. Riba. On Bar Recursion and Choice in a Classical (with an application in [4]) in the context of negative translations. Setting. In 11th Asian Symposium on Programming Languages and In [5], the authors identify definite and goal formulas, which allows Systems, volume 8301 of Lecture Notes in Computer Science, pages them to double-negate only what they call the critical atoms. Since 349–364. Springer, 2013. we work directly with classical proofs interpreted using control op- [9] J. Girard. A New Constructive Logic: Classical Logic. Mathematical erators, we do not have to take care of double-negations in front of Structures in Computer Science, 1(3):255–296, 1991. atomic formulas expicitly. On the other hand, the existentials of [5] [10] J. Girard. On the Unity of Logic. Annals of Pure and Applied Logic, are defined as “¬∀¬” and are therefore equivalent to our weak ex- 59(3):201–217, 1993. istentials. They also consider a contructive existential (equivalent ∗ [11] T. Griffin. A Formulae-as-Types Notion of Control. In 17th Sympo- to our strong existential) that they write ∃ and which serves as a sium on Principles of Programming Languages, pages 47–58. ACM formal account of Friedman’s trick. For that reason, its only legal Press, 1990. use is as ∃∗yG in a proof of ∀x¬∀y¬G. This is very different from [12] H. Herbelin. On the Degeneracy of Sigma-Types in Presence of our setting where strong existentials are part of the syntax of for- Computational Classical Logic. In 7th International Conference on mulas and can be manipulated as any other formula, provided the Typed Lambda Calculi and Applications, Lecture Notes in Mathemat- negativity condition is verified. ics, pages 209–220. Springer, 2005. Raffalli described in [21] an extraction technique relying on an [13] H. Herbelin. A Constructive Proof of Dependent Choice, Compatible interaction between a classical proof of a forall-exists formula and with Classical Logic. In 27th IEEE Symposium on Logic in Computer an intuitionistic proof of decidability for the corresponding subfor- Science, pages 365–374. IEEE Computer Society, 2012. mula. Despite the use of second-order logic, untyped calculus and [14] M. Hofmann and T. Streicher. Completeness of Continuation Models the absence of strong existentials, his work has some similarities for λµ-Calculus. Information and Computation, 179(2):332–355, with ours. In order to take into account the intuitionistic nature of 2002. the proof of decidability, formulas of second-order logic are built [15] M. Hyland and L. Ong. On Full Abstraction for PCF: I, II, and III. from both intuitionistic and classical second-order variables, and Information and Computation, 163(2):285–408, 2000. double-negation elimination is restricted to classical variables. A [16] S. C. Kleene. On the Interpretation of Intuitionistic Number Theory. formula is then said classical if it ends with a classical proposi- Journal of Symbolic Logic, 10(4):109–124, 1945. tional variable. This distinction between intuitionistic and classical Panoramas et synthèses formulas is similar to our distinction between negative and positive [17] J.-L. Krivine. Realizability in classical logic. , 27:197–229, 2009. formulas. This similarity can also be observed in the semantic interpretation of [21] where classical variables get an interpretation [18] J. Laird. Full Abstraction for Functional Languages with Control. In 12th Annual IEEE Symposium on Logic in Computer Science which is the orthogonal of some set of stacks, while intuitionistic , pages 58–67. IEEE Computer Society, 1997. variables have a primitive interpretation as a set of terms. This is very similar to our framework, where negative formulas have both a [19] C. Liang and D. Miller. Unifying Classical and Intuitionistic Logics 28th ACM/IEEE Symposium on Logic realizability and a falsity value which are orthogonal to each other, for Computational Control. In in Computer Science, pages 283–292. IEEE Computer Society, 2013. while positive formulas only have a primitive realizability value. [20] M. Parigot. λµ-Calculus: An Algorithmic Interpretation of Classical Natural Deduction. In 3rd International Conference on Logic Pro- Acknowledgments gramming and Automated Reasoning, volume 624 of Lecture Notes in Computer Science, pages 190–201. Springer, 1992. I would like to thank the anonymous reviewers for their help- ful comments and suggestions. I also thank Camille Paoletti for [21] C. Raffalli. Getting results from programs extracted from classical her preliminary comments leading to significant improvements in proofs. Theoretical Computer Science, 323(1-3):49–70, 2004. the paper’s readability. This research has been supported by the [22] P. Selinger. Control categories and duality: on the categorical seman- UK Engineering and Physical Sciences Research Council grant tics of the λµ calculus. Mathematical Structures in Computer Science, EP/K037633/1. No new data were created during this study. 11(2):207–260, 2001. [23] C. Spector. Provably recursive functionals of analysis: a consistency proof of analysis by an extension of principles in current intuitionistic References mathematics. In Recursive Function Theory: Proceedings of Symposia [1] R. Amadio and P.-L. Curien. Domains and Lambda-Calculi, vol- in Pure Mathematics, volume 5, pages 1–27. American Mathematical ume 46 of Cambridge Tracts in Theoretical Computer Science. Cam- Society, 1962. bridge University Press, 1998. [2] S. Berardi, M. Bezem, and T. Coquand. On the Computational Content of the Axiom of Choice. Journal of Symbolic Logic, 63(2):600–622, 1998. [3] U. Berger and P. Oliva. Modified bar recursion and classical dependent choice. In Logic Colloquium ’01, Proceedings of the Annual European