Information and Computation 162, 8095 (2000) doi:10.1006Âinco.2000.2858, available online at http:ÂÂwww.idealibrary.com on Structuring Metatheory on Inductive Definitions View metadata, citation and similar papers at core.ac.uk brought to you by CORE David Basin provided by Elsevier - Publisher Connector Institut fur Informatik, Universitat Freiburg, Am Flughafen 17, D-79110 Freiburg, Germany and Sea n Matthews IBM Unternehmensberatung GmbH, Lyoner Street 13, D-60528 Frankfurt, Germany We examine a problem for machine supported metatheory. There are true statements about a theory that are true of some (but only some) extensions; however, standard theory-structuring facilities do not support selective inheritance. We use the example of the deduction theorem for modal logic and show how a statement about a theory can explicitly for- malize the closure conditions extensions should satisfy for it to remain true. We show how metatheories based on inductive definitions allow theories and general metatheorems to be organized this way and report on a case study using the theory FS0 . ] 2000 Academic Press 1. INTRODUCTION Hierarchical theory structuring plays an important role in the application of theorem provers to nontrivial problems and many systems provide support for it. For example, HOL [6], Isabelle [13], and their predecessor LCF [7] support simple theory hierarchies. In these systems a theory is a specification of a language, using types and typed constants, and a collection of rules and axioms which are used to prove theorems; then a theory inherits the types, constants, axioms, rules, and theorems from its ancestors. The drawback to this is that types associated with the language and proof system must be considered open, and this limits the sort of proofs that can be constructed. In particular, it rules out arguments requiring induction on the structure of the language or proofs of a theory. We can close the language or proof system by explicitly adding induction over the structure of the language or proof system, but then it is unsound later to add new constructors, axioms, or rules; i.e., extensions to the theory are impossible. We investigate this problem and show that the simple hierarchical approach described above, which in effect offers an all or nothing approach to inheriting results, does not allow a fine enough control over the scope of theorems and is 0890-5401Â00 35.00 80 Copyright 2000 by Academic Press All rights of reproduction in any form reserved. METATHEORY ON INDUCTIVE DEFINITIONS 81 more inflexible than need be. Our solution uses a theory of parameterized inductive definitions as a metatheory in which we can organize collections of object theories and logics. This allows the same sort of hierarchical structuring as we have described above, but also allows us to state and prove more general metatheoretic results in a way such that they can be inherited by extensions, or supertheories,in the hierarchy: instead of closing the theory for which we prove a result, we for- malize, as part of the metatheorem itself, the closure properties we need. This means that a theory for which we prove metatheorems can still be extended, and metatheorems can be imported into the supertheory simply by checking that the closure conditions are satisfied. Our approach makes few special demands of the metatheory: it requires only that we are able to build families of sets using parameterized inductive definitions and can reason about their elements by induction. We report on an implementation of our ideas in FS0 , a framework theory for formal metatheory due to Feferman [5], which satisfies these requirements. We have used FS0 because it was designed to provide a simple, minimal theory of inductive definitions specifically for the pur- poses of syntactic metatheory; if we can use inductive definitions to structure theory development in FS0 , then similar results should be possible with stronger metatheories such as type theory or formalizations of induction definitions in higher-order logic or set-theory (see Section 4.2 for more on this). The definitions and proofs presented here have all been machine checked in our implementation of FS0 . 1.1. Motivation The example we consider from formal metatheory is fundamental for hierarchies of Hilbert systems. Hilbert systems are interesting because they are commonly acknowledged to be the easiest kind of proof system about which to prove theorems, but also the hardest in which to prove theorems. In practice, to prove theorems with them we need a metatheorem, the deduction theorem, which allows, essentially, natural deduction style proof under assumption. To prove the deduction theorem we need induction over the structure of derivations in a theory. However, as noted, if this theorem is to be used in theory extensions then we need a new approach to structuring hierarchies of theories. We start by informally developing a hierarchy of theories and considering the facilities needed. At the root of our hierarchy is what we call arrow logic (minimal implicative propositional logic), the formulae of which correspond to members of the set LA of formulae built from the binary connective Ä (written infix, associating to the right) and sentential constants. Theorems correspond to members of a second set, TA, and are instances of the standard Hilbert axiom schemata A Ä B Ä A (K) and (A Ä B) Ä (A Ä B Ä C) Ä (A Ä C)(S) 82 BASIN AND MATTHEWS or are generated by applying the rule modus ponens: AAÄ B . B We write |&A to indicate that A # TA. Then, assuming our (not yet formally specified) metatheory contains at least the implies connective O ,twometa- theorems we can prove are: Ä |&A A A (I) Ä O Ä Ä (|&A A C) (|&A A B C). (Thin) The first of these asserts the provability of a formula in the object logic and the second represents a derived proof rule. Given universal quantification over LA in the metatheory, we could make both of the above formulae schematic by taking their universal closures. (In the future we will assume this reading, leaving the quantifiers implicit.) Now consider the deduction theorem. For this we need to extend our meta- language: we define A |&A B as metanotation meaning that if the Hilbert system TA is extended with the additional axiom A, then B belongs to the resulting set of proofs.1 The deduction theorem is, then, O Ä A |&A B |&A A B ,(DT) which is proven by induction on the structure of derivations. Notice that just to state this metatheorem, which is schematic in A (and B), we refer to infinitely many axiomatic extensions of the original Hilbert system. An obvious candidate for a supertheory of arrow logic is full propositional logic (we consider here only conjunction, other operators are similar): we extend LA to LP by adding the new binary connective 7 , and extend TA to TP by adding the three new axiom schemata: A Ä B Ä A 7 B A 7 B Ä A (Conj) A 7 B Ä B What is the status of the theorems and metatheorems of arrow logic in proposi- tional logic? We expect that all theorems, e.g., (I), are still theorems of proposi- tional logic, provided that the original axioms (S)and(K) and inference rule (modus ponens) are interpreted over the new language. The rule (Thin) clearly also holds. The status of the deduction theorem is less obvious. In fact it does hold for propositional logic, but since the proof suggested above is by induction on the structure of arrow logic proofs, it is not valid in this new context; we must check the new cases corresponding to the new axioms. If we used a metatheory based on a logic like higher-order logic and formulated these two proof systems as standard 1 Note that this is metanotation, since LA is a language of formulae, not sequents. METATHEORY ON INDUCTIVE DEFINITIONS 83 inductive definitions, we would need to prove the deduction theorem individually for each system. Now consider a second extension to a fragment of the normal propositional g modal logic K. Extend the language LA to LM by adding the unary modality g Ä and extend TA to TM by adding an axiom stating the distributivity of over , g(A Ä B) Ä (gA ÄgB), (Norm) and a rule of inference necessitation: A .(Nec) gA Again we can ask, what is the status of the theorems and metatheorems of arrow logic in TM? Both (I)and(Thin) hold in any extension of TA with new axioms. They even hold when TA is extended with new rules and also when the language of LA is extended to LM , provided the old axioms and inference rule modus ponens are interpreted over the new language. The deduction theorem (DT) also holds under extensions of TA with new axioms. But it does not hold under extensions with arbitrary new rules; in particular, it fails for TM with the additional rule (Nec). We will later see, however, that instances of it hold in some extensions, provided that certain conditions are satisfied. To structure theories so that we can use metatheorems in appropriate extensions we have to be able to formalize the above kinds of provisos and prove metatheorems under them. We show that this is possible using parameterized inductive definitions. Informally, an inductive definition of a set is presented as the closure of some base set under a collection of rules that generate new elements from members of the set. Formally, we will explain and use notation for inductive defini- tions based on their presentation in FS0 . However, ignoring minor differences, other formalizations are fairly similar (an example is provided in Section 4.2).