New Foundations for Fixpoint Computations

Roy L. Crole* Andrew M. Pittst Computer Laboratory, University of Cambridge CB2 3QG, England

Abstract computations using monads introduced by Moggi [SI, where there is a distinction between the ele- This paper introduces a new higher-order typed ments of a type a and computations of elements constructive predicate logic for fixpoint compu- of that type-the latter being grouped into a tations, which exploits the categorical semantics new type T(a). Moggi’s computational meta- of computations introduced by Moggi [8] and language XMLT [lo], contains the following for- contains a strong version of Martin-Lof’s ‘iter- mation rules: ation type’ [ll].The type system enforces a sep- a type aration of computations from values. The logic contains a novel form of fixpoint induction and can express partial and total correctness state- MEa ments about evaluation of computations to val- Val(M) E T(a) ues. The constructive nature of the logic is wit- nessed by strong metalogical properties which are proved using a category-theoretic version of the ‘logical relations’ method. Let x+-E.F(x) E T(P)

1 Computation types Note These rules, and the others which appear in this paper, are presented in natural deduc- It is well known that primitive recursion at tion style, with discharged hypotheses enclosed higher types can be given a categorical character- in square brackets. Since there are several unfa- isation in terms of Lawvere’s concept of natural miliar variable binding operations in the syntax, number object [6]. We show that a similar char- we will also adopt Martin-Lof’s theory of expres- acterisation can be given for general recursion via sions and arities-a Pq-lambda calculus over a fixpoint operators of higher types, in terms of a single ground type of expressions with abstrac- new concept-that of a fixpoint object in a suit- tion denoted (x)e,application denoted f(e) and ably structured category. This notion was partly a multiple application such as (f(e))(e’)abbre- inspired by contemplation of Martin-Lof’s non- viated to f(e,e’); see [la], for example. Finally, standard ‘iteration type’ in his domain theoretic it should be noted that our syntax is a slight interpretation of type theory [ll].However, the variant of Moggi’s. key ingredient which allows the formulation of the concept of fixpoint object is the treatment of Intuitively, Val(M) is the value M regarded as a trivial computation which immediately eval- *Research supported by a SERC Research Let Studentship. uates to itself; and xeE.F(x) denotes the ‘Research supported by the CLICS project (EEC ES- computation which firstly tries to evaluate E to PRIT BR nr 3003). some value x E a and then proceeds to evaluate

CH2897-7/90/0000/0489$01.OO 0 1990 IEEE 4H9 F(x). These intended meanings are captured by 0 Lift(Snd; 77) = Snd : a x T(P)-i T(P). three equational axioms: 0 If F : a x ,B -+ T(y) and G : a x y --+ T(S), then Lift((Fst,F); Lift(G)) = Let x+Val(M).F(x) = F(M) (Fst, Lift(F)); Lift(G) : a x T(P)-+ T(S). Letx+E.Val(x) = E Let y+(Let x+E.F(x)).G(y) = Proposition 1.1 There are mutually inverse Let x-e E.Let yeF(z).G( y) translations between the above combinators, F : a ---t P, and XMLpterms, G, satisfying G(z) E In addition, XMLT extends the simply typed lambda calculus: there are function types a-+@ P [x E al. with lambda abstractions Xz E a.F(x)and ap- Combining this proposition with the fact that plications (MN) satisfying the usual ,8 and 77 equational XMLT theories correspond to let-ccc’s equalities. The system also contains product [lo], one concludes that the categorical combina- types a x /? with (surjective) pairing (M,N) and tors give a simple presentation of this variety of projections Fst(M), Snd(M); and it contains a category; in particular, the action of T on mor- type unit with unique element () E unit. phisms, the monad multiplication and the monad The categorical counterpart of this basic meta- strength are all definable from the combinators. language is the notion of a ‘Cartesian closed cat- In terms of the XMLT language, the action of T egory equipped with a strong monad T’ [8, sec- on a morphism F : a -+ /3 yields tion 21. We shall refer to such structures as let Cartesian closed categories, or just let-ccc ’s. Such T(F) %f Xe E T(a).Letz-ee.Val(Fz) categories can be presented very simply using a : T(a)-+ T(P). language of categorical combinators for XMLT, extending Curien’s ccc combinators for the sim- Similarly, the monad multiplication is defined by ply typed lambda calculus [2]. dzf pff - Xe’ E T(Ta).Let e+e’.e Definition 1.1 The let-categorical combinators are defined by the following grammar: : Tya)+ T(a) and the monad strength is defined by

dzf tff$ - A typing statement for these combinators takes Xz E a x TP.Let ycSnd(z).Val((Fst(z),y)) the form F : a + P; an equality statement takes : cr x T(P) -+ T(a x P). the form F = F‘ : a + P. The rules for deduc- ing these statements are those for ccc’s (see [6]) A concept which is intimately bound up with augmented by the following rules (where F x G the correspondence between the metalanguage abbreviates (Fst; F, Snd; G)): XMLT and let-ccc’s is functional completeness, as used by Lambek and Scott [6] in the con-

0 q:a+T(a). text of ordinary Cartesian closed categories. Here one must consider polynomial categories over let- 0 If F : a x P -+ T(y), then ccc’s and show that they are functionally com- Lift(F) : a x T(P)+ T(y) (and plete in a suitable sense. Lift(F) = Lift($’’) if F = F’). Definition 1.2 Let C be a let-ccc and let a be 0 If F : a i P and G : /3 x y -+ T(S),then (F x Id); Lift(G) = Lift((F x Id); G) : an object of C. The polynomial category C[X]is specified by the following data: a x T(7)-i T(S).

0 If F : a x p 3 T(y), then 0 The objects of C[X]are just the objects of (Id x 7); Lift(F) = F : a x /3 + T(y). C.

490 0 The morphisms of C[X] are equivalence The usual category-theoretic considerations classes of the let-categorical combinators imply that the structure fix,U, w is determined generated by the morphisms of C, together uniquely up to isomorphism, within the given with an indeterminate global element X : let-ccc, by the above properties. One should unit + a. The equivalence relation is that also note that U, being the structure morphism generated by the equality rules in defini- for the intial algebra of an endofunctor, is it- tion 1.1 and the existing identities in C- self an isomorphism. (This fact will be used so that there is a canonical inclusion of let- later in Proposition 3.1.) Using the relation be- categories i : C - C[X]. tween syntax and category theory discussed in section 1, one can translate the definition of a Theorem 1.1 (Functional Completeness) fixpoint object into a corresponding extension of Let C[X] be as above. For every morphism the metalanguage XMLT. This entails adding a U : ,8 + y in C[X] there is a unique mor- new type fix, together with the term-forming and phism A(U) : a x ,B --+ y in C such that equality rules shown in Figure 1. The last rule ((();X),ld);A(U) = U. (In particular, each in this figure, which expresses the uniqueness of global element of y in C[X] is of the form X;F It,(F), will be redundant in the full FIX logic of for some unique morphism F : a ---f y in C.) section 3: it is derivable from the induction rule for fix introduced in that section. It is possible to prove the functional complete- Fixpoint objects are so called because they en- ness result simply by calculation with the cat- able one to define fixpoint combinators at all egorical combinators. Then one may derive types of the form a+T(P).' the correspondence between the metalanguage and the category theory using the recipe de- Proposition 2.1 (Definability of fixpoint scribed for Cartesian closed categories by Lam- combinators) In the presence of a fixpoint ob- bek and Scott [6]. We make the comment that ject, one may define a combinator when specifying the metalanguage terms generated by a given category, terms Letx+E.U in the metalanguage are instances of morphisms which satisfies (Ya,p F) = (F (Y,,p F))for all (Id, E);Lift((Snd, Fst); A(U)). When construct- F E (a+TP)+a+TP. Indeed, defining ing the category from the metalanguage, all morphisms in the category are formed in the way one ya,p = (F)lta+Tp(F, u(w)) would expect. where F is (e)(XxE cr.Let f-+e.F(s,f)), then 2 The fixpoint type [f E a+TP,x E a] F(f,z) E TP Definition 2.1 In a let-ccc, a fixpoint object is specified by the following data: and An initial algebra 0 : T(fix) + fix for the functor T(-). Thus for any F : T(a) + Q there is a unique It,(F) : fix + a with

(0;It@)) = (T(lta(F));F) : T(fi2)-+ a.

A global element w : unit -+ T(fix) which is the equalizer of a;7 and the identity on T(fiz). In other words w is the unique fixed 'In Moggi's computational semantics, a program of

point of 0;~: T(fix) -+ T(fix): for any F : type p with a parameter of type (Y has a term of type a+T(,B) for its denotation; thus to interpret recursively a + T(fix),F = F;(a; 71) if and only if F = defined programs, fixpoint combinators are only needed 0;w. at such types.

49 I [x E T(Q:>l E = Val(a(E)) F(z)E Q: E E T(fi~) w = Val(a(w)) E=w It,(F, .(E)) = F(Let neE.Val(lt,(F, n)))

[x E T(4I [. E fix1 [e E T(fifiz)l F(x)E a G(n)E cr G(a(e))= F(Let nee.Val(G(n))) N E fix G(N)= It,(F, N)

Figure 1: Rules for fix.

In order to extend the correspondence between (with either a call-by-value or a call-by-name op- category theory and metalanguage, discussed in erational semantics [9, section 51). A domain- the previous section, to include fixpoint objects theoretic model of this system is provided by the and types, one needs the following result about following category. fixpoint objects in polynomial categories. Definition 2.2 Let Cpo denote the ccc whose Proposition 2.2 Let C be a let-ccc with a fix- objects are posets possessing joins of countably point object. Then C[X]also has a fixpoint ob- infinite chains, and whose morphisms are Scott- ject, given by i@~),where i : C - C[X]is the continuous functions, i.e. monotonic functions canonical inclusion functor. preserving joins of countably infinite chains. The objects of Cpo are not required to possess a least Proof The main idea for the proof is sketched. element; we will refer to them as bottomless cpos Suppose that F : T(P) + /3 is a morphism in in this paper. the polynomial category. By the functional com- The operation of adjoining a least element to pleteness result, the theorem will be true if we D E Cpo to give the lifted cpo DI = {[d] I d E can find a unique morphism It(F), which sat- D}U {I}gives a strong monad on Cpo. In this isfies R(a;It($‘)) = A(Lift(lt(F); q);F), which case Cpo possesses a fixpoint object, namely the on expansion of the definitions yields (Id x CPO U);A(lt(F)) = (Fst, J;Lift(1; A(lt(F)); 7)); A(F), R = (0 C 1 C ... T}, where 1 and J are certain canonical isomor- phisms. This equality holds in C; using Cartesian with a : Rl -+ R the continuous function send- closedness and the fixpoint object, we obtain the ing I to 0, [n]to n + 1 and [TI to T; and with result. w = [TI E RI. In this case, the combinators Y,,p 0 defined above are indeed the usual least fixed point operators.

Adding a fixpoint type, coproduct types Q: + p and a natural number type nut to the metalang- 3 The FIX logical system uage XMLT, we arrive at a system which extends

Godel’s system T [4,Chapter 71 but which also The definition of an initial algebra a : T(R) -+ R admits sound translations of Plotliin’s PCF [14] for a functor T(-) contains both an existence and

492 a uniqueness part. The uniqueness part amounts istic predicate calculus [3] with equality, con- to a form of induction principle, namely: junction and universal quantification (over elements of a given type), together with the follow- Initial 7’-algebra Induction Principle. ing predicate constructors which implicitly con- (Plotkin, Lehmann-Smyth [7, section 5.21.) To tain forms of implication, disjunction and exis- show that a subobject i : S 4 R is the whole tential quantification.2 of R, it suffices to show that the composition T(i);U : T(S)+ R factors through i : S 40. Given a proposition @(z) about z E a and a term E E T(a),there is a proposi- When the functor is (-) + 1 on the category tion Vx-+E.@(x) whose intended meaning of sets, the initial algebra is the natural num- is ‘Vz E o.(Val(x) = E 3 @(x))’, together bers and the above statement is equivalent to with natural deduction rules which capture the usual principle of mathematical induction. this intended meaning. What about when the functor is lifting on Cpo? Restricting attention to subobjects of domains Given a proposition @(z) about z E Q which are specified by inclusive subsets (those and a term E E T(a),there is a proposi- subsets of a cpo which are closed under taking tion 3z+E.@(2) whose intended meaning joins of countable chains), we can use the fact is ‘3% E a.(Val(z) = E & @(z))’, together that whenever i : S 4R is an inclusive subset with natural deduction rules which capture of the cpo R = (0 C 1 C . . . C T}, then (i)~: this intended meaning. SI + RI is just the inclusive subset of RI given Given propositions @(z) and Q(y) about by {e E RI 1 Vd E R.[d] = e 3 d E S}. Then the E a and y E and a term E there initiality property of R yields the following form x 0, E a+p, is a proposition (@ whose intended of the induction principle, with S R inclusive: + @)(E) meaning is ‘32 E a.(lnl(z) = E & a(.)) v Ve E Rl.(Vn E R.[n] = e 3 d E S) 3 .(e) E S 3y E P.(lnr(y) = E & @(y))’, together with natural deduction rules which capture this Vn E R.n E S intended meaning. (In1 and Inr are the co- Just as least fixed points are definable using the product insertions.) universal property of the initial (-)*-algebra R, There are two further rules for the ‘bounded’ so is Scott’s induction principle for least fixed quantifiers which make them (first-order) exam- points [16] derivable from the above rule. ples of Moggi’s concept of a T-modal operator In order to formulate this induction principle [lo, Definition 4.81: for a fixpoint object within the metalanguage, we introduce a constructive logic, called FIX, of @(MI properties of terms over the metalanguage. Thus Vz +Val( M).@( z) there are strong connections between FIX and the traditional ‘axiomatic domain theory’ of LCF and [13] and to Plotkin’s approach to denotational se- vz -+E .Vy+F(z). Q [ y) mantics using partial continuous functions [15]. Vy+ ( Let z +E .F( 2 )) .@ ( y ) * However, our logic is inherently more constructive, since it is based on the notion of evaluation In fact, modulo the other rules, the first of the of a (possibly non-terminating) computation to above rules is equivalent to imposing Moggi’s a value, rather than on non-termination and on ‘mono condition’ on the monad, i.e. information ordering between (possibly partial) Val(M) = Val(M’) computations. M = M‘ 7

Definition of the FIX logic: The FIX propo- ’The necessity of restricting implication, disjunction sitions form a fragment of first-order intuition- and existential quantification is discussed in Remark 3.1.

49 3 [nE nut, @(.)I [e E T(fix),Vn+e.@(n)] @(O) @(Suc(n)) N E nut @(a(e>> N E fix @(NI @(NI

Figure 2: Rules for nut and fix induction.

and the second rule is equivalent to negation (l@ G (@ 2 false)). So consider the proposition @(n) ~(a(w)= n) about n E fix. (Let xeE.F(x))= Val(N) (In the cpo model, the denotation of this proposition would have to be the largest inclusive subset of R not containing T-but no such subset The definition of the FIX logic is completed exists.) by induction rules for the natural number type Now this @(n)satisfies the hypotheses of the nut and for the fixpoint type fix, as shown in induction principle for fiz in Figure 2. For if Figure 2. Vn+e.l(a(w) = n) holds then l(w = e), since otherwise we could deduce Vn+.w.i(a(w) = n), Theorem 3.1 (Consistency) which is false because Val(n)= w holds for n = Bottomless cpos, Scott-continuous functions and a(w). However, as was noted after Definition 2.1, inclusive predicates form a model of the FIX log- (T is provably a bijection: so from i(w = e) we ical system. deduce l(a(w)= a(e)),i.e. @(a(e)),as required. So the induction principle for fix entails that Remark 3.1 The induction rule for nut is just @(n)holds of all n E fix, and in particular of the usual principle of mathematical induction. (~(w),which is a contradiction. The induction rule for fix can be rendered in- 0 formally as: to prove that a property @(.) holds of all elements n in fix, it is suficient to prove The above proof gives weight to the feel- for all computations e of an element of fix that ing that the FIX logic resembles a calculus of @(o(e))holds if whenever e evaluates to a vahe, ‘formally inclusive’ predicates. We next state that value satisfies @. This principle is consis- metatheorems about our logic of fixpoint com- tent (by Theorem 3.1), but only because the putations which witness its constructive nature FIX propositions have limited forms. In fact, ex- and suggest its potential as a programming logic. tending the FIX logic with unrestricted intuitionistic negation, implication or existential quantifi- Theorem 3.2 (‘Existence Property’) If E cation renders it inconsistent. A proof of this can is a closed term of type T(cy), then 3xeE.@(x) be obtained by mimicking within our framework is provable in FIX if and only if there is a the proof that inclusive subsets of cpos are not closed term M of type cy for which @(M)and in general closed under these operations. Here is E = Val(M) are provable. (In other words, a for- the proof for the case of intuitionistic implication mal proof that E evaluates to a value satisfying (and negation): @ necessitates the existence of a term denoting that value.) Proposition 3.1 Extending the FIX logic with intuitionistic implication renders the system in- Theorem 3.3 (‘Disjunction Property’) If consistent. E is a closed term of coproduct type cy + p, @ and @ are properties of cy and ,D and (@ + Q)(E) Proof Since FIX contains falsity (false),adding is provable in FIX, then either E = Inl(M) and implication (a 3 q) means that one also has @(M)are provable for some closed term M of

494 type a, or E = Inr(N) and @(N)are provable Corollary 4.1 Let C be a category, and FC the for some closed term N of type p. freely generated let-ccc. Then the canonical functor C --+ FC is full and faithful. Thus a closed The Existence Property enables one to produce term of ground type in the XMLT metalanguage closed terms of type nut from a computation of (over some ground signature) always converts to a number (i.e. a closed term of type T(nut)) to- a ground term. gether with a proof that the computation con- verges. There remains the possibility that a Our original aim was to consider proofs of Theo- closed term of type nut is not a value, i.e. a stan- rems 3.2, 3.3 and 3.4 in the manner that, for ex- dard numeral. In other words, the strong univer- ample, glueing may be used to prove disjunction sal property of fix looks as though it might create and explicit definability for intuitionistic pred- ‘non-standard’ natural numbers and hence mix icate logic. It soon became clear that such a the ‘total’ world of primitive recursive functions naive approach will not work in the presence of with the ‘partial’ world of unrestricted fixpoint a fixpoint type, and so the following method was computations at T-types. However, this is not developed. We exploit the fact that FIX theories so: correspond to the following categorical structure:

Theorem 3.4 (Standardness of nut) a A Cartesian closed category C, which has fi- Every closed term of type nat in the logic FIX is nite coproducts and a natural number ob- provably equal to a standard numeral Sucn(0). ject. (The objects and morphisms of C are The method of proving these theorems is de- used to model the FIX types and terms.) scribed in the next section. 0 A strong monad T on C whose unit com-

ponents 7, : CY --f T(a)are all monomor- 4 Glueizg and Logical Rela- phisms, and for which a fixpoint object ex- t ions ists. 0 A C-indexed poset, ’Pc, which is used to Before further discussion of the main issues of model the FIX propositions, and hence this section, we shall describe briefly two results which is closed under a certain number which form a bridge between previous work and of completeness and adjointness conditions new ideas involving logical relations. corresponding to the FIX logical rules for

Lemma 4.1 Let r : 2) 4 C be a functor pre- the propositional connectives and quantifier serving finite products from a let-ccc to a ccc with forms. (For lack of space, these conditions finite limits. Then the arrow category (C 1 r), will not be given here; however, they are which is called the glued category and denoted fairly standard ones from categorical logic, Gl(I’), is also a let-ccc. Additionally, the second adapted to the particular forms of proposi- projection functor Pz : Gl(r) --+ D preserves the tion occurring in the FIX logic.) let-ccc structure. Call such a structure a FIX-hyperdoctrine;a mor- The objects of Gl(r) are morphisms in C of the phism of FIX-hyperdoctrines is specified by a

form F : CY i I’(6); the strong monad struc- functor and an indexed monotone function, pre- ture on Gl(r) is given on objects by sending serving the structure mentioned above. The F : CY + I’(6) to F;r(7) : CY -+ T(6).Indeed, the pure FIX logic (regarded as the empty the- strong monad acts on the ‘second object coordi- ory, with no extra-logical axioms) corresponds nate’ throughout the proof; details of the calcu- to such a FIX-hyperdoctrine (.F,’PF),which is lation are omitted. Using this lemma a.nd a suit- initial amongst all such. The category Cpo to- able version of Freyd’s glueing argument (see [6, gether with the Cpo-indexed poset assigning to p 2501 and [5]),one obtains the following corol- each cpo its poset of inclusive subsets, forms lary: a FIX-hyperdoctrine (Cpo,PT). Hence there is

495 a (unique) FIX-hyperdoctrine morphism 1-1 : coproducts and to predicates formed using the (F,P7)+ (Cpo’Pz), which assigns cpo mean- bounded existential quantifier. ings to the FIX types, cpo morphisms to the Note that the functor I’ preserves almost FIX terms and inclusive predicate meanings to none of the structure of a FIX-hyperdoctrine the FIX propositions. and yet magically (,Cr(I’))PL-(r))is a FIX- Let I’ : F + Cpo denote the functor which as- hyperdoctrine, allowing us to exploit the initial- signs to each object a E F its set r(a)of global ity property of (F,P,). This is similar magic elements equipped with the discrete partial or- to Freyd’s categorical glueing argument. Our der. We construct a new category Lr(r),by the category-theoretic method is related to logical following ‘logical relations’ construction: relations in the same way that Freyd’s glueing construction is related to realizability. 0 An object of Lr(I‘) is a triple (D,d,a), where D E Cpo, a E 3 and _a is an inclusive subset of D x r(a). 5 Concluding remarks and further directions e A morphism (D,g,cx) -+ (D’,g’,a‘) in

Lcr(I’) is a pair (4,F),where 4 : D --f D’ (i) The Existence Property expresses a formal in Cpo, F : Q +. a’ in 3)satisfying the fol- adequacy of the FIX logic for the metalang- lowing condition: uage. A corollary of the above proof is the model-theoretic adequacy of Cpo for the Vd E D,M E rcu.(d a M 3 4(d) a’(M;F)). metalanguage: given a closed term E of type T(a),it is provably equal to a value Val(M) There is a strong monad on Lr(r)which sends (M a closed term of type a) if and only if an object (D,g,a) to the object (Dl,g’,Tcu), its Cpo interpretation [E]E [T(a)]= [all where for all e E Dl and E E r(Tcr),e _a’ E if is not 1. and only if Vd E D.[d] = e 3 3M E I‘(a).(d I? (ii) The predicate zee [z E a,e E T(a)]of M & M;qa = E).The rest of the strong monad evaluation is implicit in FIX, but is treated structure is specified ‘componentwise’ from F in a very ‘extensional’ way as equivalent to and Cpo. There is also a Lr(I’)-indexed poset Val(z) = e. It is possible to envisage a whose fibre over an object (D, a ,a) consists of weaker logic than FIX (and a correspond- triples (S,a‘, Q!), with S an inclusive subset of ing kind of categorical structure) in which D,Q! E PF(~)and _a‘ an inclusive subset of z+e [x E a,e E T(a)]is an atomic predi- S x {M E r(a) 1 @(M) is provable}. These cate satisfying triples are ordered componentwise. The above construction produces a new MeE N-+F(M) FIX-hyperdoctrine (Lr(I’), It is P,r-(r)). M-+Val(M) N-+(Let z-+E.F(z)) easy to see that there are FIX-hyperdoctrine morphisms PI : (Lr(I’),Pqr))-+ (Cpo,Pz) and and in which there are modified rules for the PZ : (Lr(I’),PL~(~)) -+ (3, PF) given by first and bounded quantifiers. second projections. Then the initiality of (F,PF) implies there is a FIX-hyperdoctrine (iii) FIX is not an ‘integrated’ logic-proofs of

morphism 1 : (3,p~)---f (Lr(I’),PLr(rl)whose propositions are external to the system. Un- composition with P2 is the identity and whose doubtedly something to aim for is a sys- composition with Pl is the morphism [-I : tem combining features of FIX with those (F,PF)+ (Cpo,Pz) mentioned above. Theo- of the Calculus of Constructions [l],obtain- rems 3.2, 3.3 and 3.4 follow by examining the ing both the ‘terms-as-computations’ and particular form of the relations obtained when ‘terms-as-proofs’ paradigms in a single (con- I is applied to the natural number object, to sistent!) system.

496 (iv) FIX establishes a novel approach to fixed 111 P.Martin-Lof, Notes on the domain point equations at the level of functions. heo ore tic interpretation of type theory, We plan to investigate whether this ap- Proc. Workshop on Semantics of proach extends to the practically important Programming Languages, Chalmers Univ. level (for the semantics of programming lan- (1983). guages) of fixed point equations for types. 121 B.Nordstrom, Mwtin-Lof 's Type Theory as a Programming Logic, PMG Report 27, References Chalmers University, 1986.

[l] T.Coquand and G.Huet, The Calculus of [13] L.C.Paulson, Logic and Computation Constructions, Information and (Cambridge University Press, 1987). Computation 76 (1988) 95-120. [14] G.D.Plotkin, LCF considered as a [a] P.-L.Curien, Categorical Combinators, programming language, Theoretical Sequential Algorithms and Functional Computer Science 5( 1977) 223-255. Programming (Pitman, London, 1986). [15] G.D.Plotkin, Denotational semantics with [3] M.Dummett, Elements of Intuitionism partial functions, unpublished lecture notes (Oxford University Press, 1977). from CSLI Summer School (1985).

[4] J.-Y.Girard, Proofs and Types (Cambridge [16] D.S.Scott, A type-theoretic alternative to University Press, 1989) (translated and CUCH, ISWIM, 0 WHY, unpublished with appendices by P.Taylor and manuscript, University of Oxford, 1969. Y.Lafont).

[5] Y .Lafont, Logiques, Cate'gories et Machines, Ph.D. thesis, Univ. Paris VII, 1988. [6] J.Lambek and P.J.Scott, Introduction to Higher Order Categorical Logic, Cambridge Studies in Advanced Mathematics 7 (Cambridge University Press, 1986).

[7] D.J.Lehmann and M.B.Smyth, Algebraic Specification of Data Types: A Synthetic Approach, Math. Systems Theory 14( 1981) 97-139.

[81 E. Moggi , Comput at ional la in bda- calcul us and monads, Proc. 4th Annual Symposium on Logic in Computer Science, Asilomar CA (IEEE Computer Society Press, Washington, 1989), pp 14-23. [9] E.Moggi, Computational lanibda-calculus and monads, LFCS Technical Report 88-66, University of Edinburgh, 1988.

[lo] E.Moggi, Notions of Computations and Monads. memint. 1989.

497