---
abstract: 'We present an illative system ${\ensuremath{{\cal I}}}_s$ of classical higher-order logic with subtyping and basic inductive types. The system ${\ensuremath{{\cal I}}}_s$ allows for direct definitions of partial and general recursive functions, and provides means for handling functions whose termination has not been proven. We give examples of how properties of some recursive functions may be established in our system. In a technical appendix to the paper we prove consistency of ${\ensuremath{{\cal I}}}_s$. The proof is by model construction. We then use this construction to show conservativity of ${\ensuremath{{\cal I}}}_s$ over classical first-order logic. Conservativity over higher-order logic is conjectured, but not proven.'
author:
- Łukasz Czajka
bibliography:
- 'biblio.bib'
title: 'Partiality and Recursion in Higher-Order Logic'
---

[**Note:**]{} This paper is an extended technical report based on a conference paper with the same title published by Springer-Verlag in the proceedings of FoSSaCS 2013. The final publication is available at .

Table of Contents {#table-of-contents .unnumbered}
=================

starttoc[toc]{}

Introduction
============

We present an illative $\lambda$-calculus system ${\ensuremath{{\cal I}}}_s$ of classical higher-order logic with subtyping and basic inductive types. Being illative means that the system is a combination of higher-order logic with the *untyped* $\lambda$-calculus. It therefore allows for unrestricted recursive definitions directly, including definitions of possibly non-terminating partial functions. We believe that this feature of ${\ensuremath{{\cal I}}}_s$ makes it potentially interesting as a logic for an interactive theorem prover intended to be used for program verification.

Most popular proof assistants allow only total functions, and totality must be ensured by the user, either by very precise specifications of function domains, restricting recursion in a way that guarantees termination, explicit well-foundedness proofs, or other means.

Obviously, there is a reason why most proof assistants do not handle partial functions directly. This is to ensure consistency of the system. Combining an expressive higher-order logic with unrestricted recursion is a non-trivial problem.

There are various indirect ways of dealing with general recursion in popular theorem provers based on total logics. There are also many non-standard logics allowing partial functions directly. We discuss some related work in Sect. \[sec\_related\].

In Sect. \[sec\_I\_s\] we introduce the system ${\ensuremath{{\cal I}}}_s$. Our approach builds on the old tradition of illative combinatory logic [@illat01; @Seldin2009; @Czajka2013Accepted; @Czajka2011]. This tradition dates back to early inconsistent systems of Shönfinkel, Church and Curry proposed in the 1920s and the 1930s [@Seldin2009]. However, after the discovery of paradoxes most logicians abandoned this approach. A notable exception was Haskell Curry and his school, but not much progress was made in establishing consistency of illative systems strong enough to interpret traditional logic. Only in the 1990s some first-order illative systems were shown consistent and complete for traditional first-order logic [@illat01; @illat02]. The system ${\ensuremath{{\cal I}}}_s$, in terms of the features it provides, may be considered an extension of the illative system ${\ensuremath{{\cal I}}}_\omega$ from [@Czajka2013Accepted]. We briefly discuss the relationship between ${\ensuremath{{\cal I}}}_s$ and ${\ensuremath{{\cal I}}}_\omega$ in Sect. \[sec\_related\].

Because ${\ensuremath{{\cal I}}}_s$ is based on the untyped $\lambda$-calculus, its consistency is obviously open to doubt. In an appendix we give a proof by model construction of consistency of ${\ensuremath{{\cal I}}}_s$. Unfortunately, the proof is too long to fit within the page limits of a conference paper. In Sect. \[sec\_consistent\] we give a general overview of the proof. The model construction is similar to the one from [@Czajka2013Accepted] for the traditional illative system ${\ensuremath{{\cal I}}}_\omega$. It is extended and adapted in a non-trivial way to account for additional features of ${\ensuremath{{\cal I}}}_s$. To our knowlege ${\ensuremath{{\cal I}}}_s$ is the first higher-order illative system featuring subtypes and some form of induction, for which there is a consistency proof.

In Sect. \[sec\_partiality\] we provide examples of proofs in ${\ensuremath{{\cal I}}}_s$ indicating possible applications of our approach to the problem of dealing with partiality, non-termination and general recursion in higher-order logic. We are mainly interested in partiality arising from non-termination of non-well-founded recursive definitions.

For lack of space we omit proofs of most of the lemmas and theorems we state. The proofs of non-trivial results may be found in technical appendices to this paper.

The Illative System {#sec_I_s}
===================

In this section we present the system ${\ensuremath{{\cal I}}}_s$ of illative classical higher-order logic with subtyping and derive some of its basic properties.

\[def\_I\_s\]

The system ${\ensuremath{{\cal I}}}_s$ consists of the following.

-   A countably infinite set of variables $V_s = \{x, y, z, \ldots
        \}$ and a set of constants $\Sigma_{s}$.

-   The set of sorts ${\ensuremath{{\cal S}}}= \{{\ensuremath{\mathrm{Type}}}, {\ensuremath{\mathrm{Prop}}}\}$.

-   The set of *basic inductive types* ${\ensuremath{{\cal T}}}_I$ is defined inductively by the rule: if $\iota_{1,1},\ldots,\iota_{1,n_1},\ldots,\iota_{m,1},\ldots,\iota_{m,n_m}
        \in {\ensuremath{{\cal T}}}_I \cup \{\star\}$ then $$\mu(\langle \iota_{1,1},\ldots,\iota_{1,n_1} \rangle, \ldots,
        \langle \iota_{m,1},\ldots,\iota_{m,n_m} \rangle) \in {\ensuremath{{\cal T}}}_I$$ where $m \in {\ensuremath{\mathbb{N}}}_+$ and $n_1,\ldots,n_m \in {\ensuremath{\mathbb{N}}}$.

-   We define the sets of *constructors* ${\ensuremath{{\cal C}}}$, *destructors* ${\ensuremath{{\cal D}}}$, and *tests* ${\ensuremath{{\cal O}}}$ as follows. For each $\iota \in {\ensuremath{{\cal T}}}_I$ of the form $$\iota = \mu(\langle \iota_{1,1},\ldots,\iota_{1,n_1} \rangle,
          \ldots, \langle \iota_{m,1},\ldots,\iota_{m,n_m} \rangle) \in
          {\ensuremath{{\cal T}}}_I$$ where $\iota_{i,j} \in {\ensuremath{{\cal T}}}_I \cup \{\star\}$, the set ${\ensuremath{{\cal C}}}$ contains $m$ distinct constants $c_1^\iota,\ldots,c_m^\iota$. The number $n_i$ is called the *arity* of $c_i^\iota$, and $\langle \iota_{i,1},\ldots,\iota_{i,n_i} \rangle$ is its *signature*. With each $c_i^\iota \in {\ensuremath{{\cal C}}}$ of arity $n_i$ we associate $n_i$ distinct destructors $d_{i,1}^\iota,\ldots,d_{i,n_i}^\iota \in {\ensuremath{{\cal D}}}$ and one test $o_i^\iota \in {\ensuremath{{\cal O}}}$. When we use the symbols $c_i^\iota$, $o_i^\iota$ and $d_{i,j}^\iota$ we implicitly assume that they denote the constructors, tests and destructors associated with $\iota$. When it is clear from the context which type $\iota$ is meant, we use the notation $\iota_{i,j}^*$ for $\iota_{i,j}$ if $\iota_{i,j} \ne \star$, or for $\iota$ if $\iota_{i,j} = \star$.

-   The set of *${\ensuremath{{\cal I}}}_s$-terms* ${\ensuremath{\mathbb T}}$ is defined by the following grammar. $$\begin{aligned}
          {\ensuremath{\mathbb T}}&::=& V_s \;|\; \Sigma_{s} \;|\; {\ensuremath{{\cal S}}}\;|\; {\ensuremath{{\cal C}}}\;|\; {\ensuremath{{\cal D}}}\;|\; {\ensuremath{{\cal O}}}\;|\; {\ensuremath{{\cal T}}}_I \;|\; \lambda V_s \,.\, {\ensuremath{\mathbb T}}\;|\; ({\ensuremath{\mathbb T}}{\ensuremath{\mathbb T}})
          \;|\; \mathrm{Is} \;|\; \mathrm{Subtype} \;|\; \mathrm{Fun}
          \;|\; \\ && \forall \;|\; \vee \;|\; \bot \;|\; \epsilon \;|\;
          \mathrm{Eq} \;|\; \mathrm{Cond}
        \end{aligned}$$ We assume application associates to the left and omit spurious brackets.

-   We identify $\alpha$-equivalent terms, i.e. terms differing only in the names of bound variables are considered identical. We use the symbol $\equiv$ for identity of terms up to $\alpha$-equivalence. We also assume without loss of generality that all bound variables in a term are distinct from the free variables, unless indicated otherwise.[^1]

-   In what follows we use the abbreviations: $$\begin{aligned}
          t_1 : t_2 &\equiv& \mathrm{Is}\, t_1\, t_2 \\
          {\ensuremath{\{ x : \alpha \;|\; \varphi \}}} &\equiv& \mathrm{Subtype}\, \alpha\,
          \lambda x \,.\, \varphi \\
          \alpha \to \beta &\equiv& \mathrm{Fun}\, \alpha\, \beta \\
          \forall x : \alpha \,.\, \varphi &\equiv& \forall\, \alpha\, \lambda x
          \,.\, \varphi \\
          \forall x_1,\ldots,x_n : \alpha \,.\, \varphi &\equiv& \forall x_1 :
          \alpha \,.\, \ldots \forall x_n : \alpha \,.\, \varphi \\
          \varphi \supset \psi &\equiv& \forall x : {\ensuremath{\{ y : {\ensuremath{\mathrm{Prop}}}\;|\; \varphi \}}}
          \,.\, \psi \;\; \mathrm{where\ } x, y \notin FV(\varphi, \psi)
          \\
          \neg \varphi &\equiv& \varphi \supset \bot \\
          \top &\equiv& \bot \supset \bot \\
          \varphi \vee \psi &\equiv& \vee \varphi \psi \\
          \varphi \wedge \psi &\equiv& \neg (\neg \varphi \vee \neg \psi) \\
          \exists x : \alpha \,.\, \varphi &\equiv& \neg \forall x : \alpha
          \,.\, \neg \varphi
        \end{aligned}$$ We assume that $\neg$ has the highest precedence.

-   The system ${\ensuremath{{\cal I}}}_s$ is given by the following rules and axioms, where $\Gamma$ is a finite set of terms, $t, \varphi, \psi,
        \alpha, \beta$, etc. are arbitrary terms. The notation $\Gamma,
        \varphi$ is a shorthand for $\Gamma \cup \{\varphi\}$. We use Greek letters $\varphi$, $\psi$, etc. to highlight that a term is to be intuitively interpreted as a proposition, and we use $\alpha$, $\beta$, etc. when it is to be interpreted as a type, but there is no a priori syntactic distinction. All judgements have the form $\Gamma {\ensuremath{\vdash}}t$ where $\Gamma$ is a set of terms and $t$ a term. In particular, $\Gamma {\ensuremath{\vdash}}t : \alpha$ is a shorthand for $\Gamma {\ensuremath{\vdash}}\mathrm{Is}\, t\, \alpha$, according to the convention from the previous point.

    [**Axioms**]{}

    -   $\Gamma, \varphi {\ensuremath{\vdash}}\varphi$

    -   $\Gamma {\ensuremath{\vdash}}{\ensuremath{\mathrm{Eq}\,t\,t\,}}$

    -   $\Gamma {\ensuremath{\vdash}}{\ensuremath{\mathrm{Prop}}}: {\ensuremath{\mathrm{Type}}}$

    -   $\Gamma {\ensuremath{\vdash}}\iota : {\ensuremath{\mathrm{Type}}}$ for $\iota \in {\ensuremath{{\cal T}}}_I$

    -   $\Gamma {\ensuremath{\vdash}}o_i^\iota (c_i^\iota t_1 \ldots
              t_{n_i})$ if $c_i^\iota \in {\ensuremath{{\cal C}}}$ has arity $n_i$

    -   $\Gamma {\ensuremath{\vdash}}\neg (o_i^\iota (c_j^\iota t_1 \ldots
              t_{n_j}))$ if $i \ne j$ and $c_j^\iota \in {\ensuremath{{\cal C}}}$ has arity $n_j$

    -   $\Gamma {\ensuremath{\vdash}}{\ensuremath{\mathrm{Eq}\,(d_{i,k}^\iota (c_i^\iota t_1 \ldots
              t_{n_i}))\,t_k\,}}$ for $k=1,\ldots,n_i$, if $c_i^\iota \in {\ensuremath{{\cal C}}}$ has arity $n_i$

    -   $\Gamma {\ensuremath{\vdash}}\bot : {\ensuremath{\mathrm{Prop}}}$

    -   $\Gamma {\ensuremath{\vdash}}\forall p : {\ensuremath{\mathrm{Prop}}}\,.\, p \lor \neg p$

    -   $\Gamma {\ensuremath{\vdash}}{\ensuremath{\mathrm{Eq}\,((\lambda x \,.\, t_1)
              t_2)\,(t_1[x/t_2])\,}}$

    [**Rules**]{}

    [cc]{}\
    &\
    \
    &\
    \
    &\
    \
    &\
    \
    &\
    $
          {\vee_{i1}:}\; \inferrule{\Gamma {\ensuremath{\vdash}}\varphi}
          {\Gamma {\ensuremath{\vdash}}\varphi \vee \psi}
          $ & $
          {\vee_{i2}:}\; \inferrule{\Gamma {\ensuremath{\vdash}}\psi}
          {\Gamma {\ensuremath{\vdash}}\varphi \vee \psi}
          $\
    &\
    \
    &\
    \
    &\
    $
            {\wedge_{e1}:}\;
            \inferrule{
              \Gamma {\ensuremath{\vdash}}\varphi \wedge \psi
            }{
              \Gamma {\ensuremath{\vdash}}\varphi
            }
          $ & $
            {\wedge_{e2}:}\;
            \inferrule{
              \Gamma {\ensuremath{\vdash}}\varphi \wedge \psi
            }{
              \Gamma {\ensuremath{\vdash}}\psi
            }
          $\
    &\
    $
            {\supset_{t2}:}\;
            \inferrule{
              \Gamma {\ensuremath{\vdash}}(\varphi \supset \psi) : {\ensuremath{\mathrm{Prop}}}}{
              \Gamma {\ensuremath{\vdash}}\varphi : {\ensuremath{\mathrm{Prop}}}}
          $ & $
            {\bot_{e}:}\;
            \inferrule{
              \Gamma {\ensuremath{\vdash}}\bot
            }{
              \Gamma {\ensuremath{\vdash}}\varphi
            }
          $\
    &\
    \
    &\
    $
          {\to_e:}\; \inferrule{\Gamma {\ensuremath{\vdash}}t_1 : \alpha \to \beta \\ \Gamma {\ensuremath{\vdash}}t_2 : \alpha}{\Gamma {\ensuremath{\vdash}}t_1
            t_2 : \beta}
          $ & $
            {\to_t:}\; \inferrule{\Gamma {\ensuremath{\vdash}}\alpha : {\ensuremath{\mathrm{Type}}}\\ \Gamma
              {\ensuremath{\vdash}}\beta : {\ensuremath{\mathrm{Type}}}}
            {\Gamma {\ensuremath{\vdash}}(\alpha \to \beta) : {\ensuremath{\mathrm{Type}}}}
          $\
    &\
    \
    &\
    $
            {s_e:}\; \inferrule{\Gamma {\ensuremath{\vdash}}t : \{ x :
              \alpha \;|\; \varphi \}}{\Gamma {\ensuremath{\vdash}}\varphi[x/t]}
          $ & $
            {s_{et}:}\; \inferrule{\Gamma {\ensuremath{\vdash}}t : \{ x :
              \alpha \;|\; \varphi\}}{\Gamma {\ensuremath{\vdash}}t : \alpha}
          $\
    &\
    \
    &\
    $
            {\epsilon_i:}\; \inferrule{\Gamma {\ensuremath{\vdash}}\exists x : \alpha \,.\, \top}
            {\Gamma {\ensuremath{\vdash}}(\epsilon \alpha) : \alpha}
          $ & $
            {p_i:}\; \inferrule{\Gamma {\ensuremath{\vdash}}\varphi}
            {\Gamma {\ensuremath{\vdash}}\varphi : {\ensuremath{\mathrm{Prop}}}}
          $\
    &\
    $
          {c_1:}\; \inferrule{
            \Gamma {\ensuremath{\vdash}}\varphi
          }{
            \Gamma {\ensuremath{\vdash}}{\ensuremath{\mathrm{Eq}\,({\ensuremath{\mathrm{Cond}\,\varphi\,t_1\,t_2\,}})\,t_1\,}}
          }
          $ & $
          {c_2:}\; \inferrule{
            \Gamma {\ensuremath{\vdash}}\neg\varphi
          }{
            \Gamma {\ensuremath{\vdash}}{\ensuremath{\mathrm{Eq}\,({\ensuremath{\mathrm{Cond}\,\varphi\,t_1\,t_2\,}})\,t_2\,}}
          }
          $\
    &\
    \
    &\
    \
    &\
    \
    &\
    $
            {\mbox{eq}:}\; \inferrule{\Gamma {\ensuremath{\vdash}}\varphi \\ \Gamma {\ensuremath{\vdash}}{\ensuremath{\mathrm{Eq}\,\varphi\,\varphi'\,}}}{\Gamma {\ensuremath{\vdash}}\varphi'}
          $ & $
          {\mbox{eq-sym}:}\; \inferrule{\Gamma {\ensuremath{\vdash}}{\ensuremath{\mathrm{Eq}\,t_1\,t_2\,}}}{\Gamma {\ensuremath{\vdash}}{\ensuremath{\mathrm{Eq}\,t_2\,t_1\,}}}
          $\
    &\
    \
    &\
    \
    &\

    $${i_i^\iota:}\; \inferrule{\Gamma, x_1 : \iota_{i,1}^*, \ldots, x_{n_i} : \iota_{i,n_i}^*, t
              x_{j_{i,1}}, \ldots, t x_{j_{i,k_i}} {\ensuremath{\vdash}}t (c_i^\iota x_1 \ldots
              x_{n_i}) \\ \mathrm{for\ } i=1,\ldots,m
            }{
              \Gamma {\ensuremath{\vdash}}\forall x : \iota \,.\, t x
            }$$ where $x,x_1,\ldots,x_{n_i} \notin FV(\Gamma, t)$, $c_1^\iota,\ldots,c_m^\iota \in {\ensuremath{{\cal C}}}$ are all constructors associated with $\iota \in {\ensuremath{{\cal T}}}_I$, and $j_{i,1},\ldots,j_{i,k_i}$ is an increasing sequence of all indices $1 \le j \le n_i$ such that $\iota_{i,j} = \star$ $${i_t^{\iota,k}:}\; \inferrule{
              \Gamma {\ensuremath{\vdash}}t_j : \iota_{k,j}^* \mathrm{\ for\ } j=1,\ldots,n_k
            }{
              \Gamma {\ensuremath{\vdash}}(c_k^\iota t_1 \ldots t_{n_k}) : \iota
            }$$

For an arbitrary set of terms $\Gamma$, we write $\Gamma
  {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} \varphi$ if there exists a finite subset $\Gamma'
  \subseteq \Gamma$ such that $\Gamma' {\ensuremath{\vdash}}\varphi$ is derivable in the system ${\ensuremath{{\cal I}}}_s$. We drop the subscript when irrelevant or obvious from the context.

If $\Gamma {\ensuremath{\vdash}}\varphi$ then $\Gamma, \psi {\ensuremath{\vdash}}\varphi$.

\[lem\_I\_s\_subst\] If $\Gamma {\ensuremath{\vdash}}\varphi$ then $\Gamma[x/t] {\ensuremath{\vdash}}\varphi[x/t]$, where $\Gamma[x/t] = \{ \psi[x/t] \;|\; \psi \in \Gamma \}$.

Representing Logic
------------------

The inference rules of ${\ensuremath{{\cal I}}}_s$ may be intuitively justified by appealing to an informal many-valued semantics. A term $t$ may be true, false, or something entirely different (“undefined”, a program, a natural number, a type, …). By way of an example, we explain an informal meaning of some terms:

-   $t : {\ensuremath{\mathrm{Prop}}}$ is true iff $t$ is true or false,

-   $\alpha : {\ensuremath{\mathrm{Type}}}$ is true iff $\alpha$ is a type,

-   $t : \alpha$ is true iff $t$ has type $\alpha$, assuming $\alpha$ is a type,

-   $\forall x : \alpha . \varphi$ is true iff $\alpha$ is a type and for all $t$ of type $\alpha$, $\varphi[x/t]$ is true,

-   $\forall x : \alpha . \varphi$ is false iff $\alpha$ is a type and there exists $t$ of type $\alpha$ such that $\varphi[x/t]$ is false,

-   $t_1 \vee t_2$ is true iff $t_1$ is true or $t_2$ is true,

-   $t_1 \vee t_2$ is false iff $t_1$ is false and $t_2$ is false,

-   $t_1 \supset t_2$ is true iff $t_1$ is false or both $t_1$ and $t_2$ are true,

-   $t_1 \supset t_2$ is false iff $t_1$ is true and $t_2$ is false,

-   $\neg t$ is true iff $t$ is false,

-   $\neg t$ is false iff $t$ is true.

Obviously, $\Gamma {\ensuremath{\vdash}}t$ is then (informally) interpreted as: for all possible substitution instances $\Gamma^*,t^*$ of $\Gamma,t$, [^2] if all terms in $\Gamma^*$ are true, then the term $t^*$ is also true.

Note that the logical connectives are “lazy”, e.g. for $t_1 \vee
t_2$ to be true it suffices that $t_1$ is true, but $t_2$ need not have a truth value at all – it may be something else: a program, a type, “undefined”, etc. This laziness allows us to omit many restrictions which would otherwise be needed in inference rules, and would thus make the system less similar to ordinary logic.

The following rules may be derived in ${\ensuremath{{\cal I}}}_s$.

  ------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------
                                                                             $                                                                                                                          $
                                                                        \supset_i:\;                                                                                                               \supset_e:\;
                                                                         \inferrule{                                                                                                                \inferrule{
                        \Gamma {\ensuremath{\vdash}}\varphi : {\ensuremath{\mathrm{Prop}}}\\ \Gamma, \varphi {\ensuremath{\vdash}}\psi                         \Gamma {\ensuremath{\vdash}}\varphi \supset \psi \\ \Gamma {\ensuremath{\vdash}}\varphi
                                                                             }{                                                                                                                         }{
                                                       \Gamma {\ensuremath{\vdash}}\varphi \supset \psi                                                                                   \Gamma {\ensuremath{\vdash}}\psi
                                                                              }                                                                                                                          }
                                                                              $                                                                                                                          $

                                                                                                                                                          

                                                                             $                                                                                                                          $
                                                                         \supset_t:\;                                                                                                              {\wedge_{i}:}\;
                                                                          \inferrule{                                                                                                                \inferrule{
         \Gamma {\ensuremath{\vdash}}\varphi : {\ensuremath{\mathrm{Prop}}}\\ \Gamma, \varphi {\ensuremath{\vdash}}\psi : {\ensuremath{\mathrm{Prop}}}}{                \Gamma {\ensuremath{\vdash}}\varphi \\ \Gamma {\ensuremath{\vdash}}\psi
                                       \Gamma {\ensuremath{\vdash}}(\varphi \supset \psi) : {\ensuremath{\mathrm{Prop}}}}                                                                                }{
                                                                               $                                                                                                    \Gamma {\ensuremath{\vdash}}\varphi \wedge \psi
                                                                                                                                                                                                          }
                                                                                                                                                                                                         $
  ------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------

Note that in general the elimination rules for $\wedge$ and the rules for $\exists$ cannot be derived from the rules for $\vee$ and $\forall$, because we would not be able to prove the premise $\varphi : {\ensuremath{\mathrm{Prop}}}$ when trying to apply the rule $\supset_i$. It is instructive to try to derive these rules and see where the proof breaks down.

In ${\ensuremath{{\cal I}}}_s$ the only non-standard restriction in the usual inference rules for logical connectives is the additional premise $\Gamma
{\ensuremath{\vdash}}\varphi : {\ensuremath{\mathrm{Prop}}}$ in the rule $\supset_i$. It is certainly unavoidable, as otherwise Curry’s paradox may be derived (see e.g. [@illat01; @Seldin2009]). However, we have standard classical higher-order logic if we restrict to terms of type ${\ensuremath{\mathrm{Prop}}}$, in the sense that the natural deduction rules then become identical to the rules of ordinary logic. This is made more precise in Sect. \[sec\_consistent\] where a sound translation from a traditional system of higher-order logic into ${\ensuremath{{\cal I}}}_s$ is described.

Note that we have the law of excluded middle only in the form $\forall
p : {\ensuremath{\mathrm{Prop}}}\,.\, p \lor \neg p$. Adding $\Gamma {\ensuremath{\vdash}}\varphi \vee
\neg\varphi$ as an axiom for an arbitrary term $\varphi$ gives an inconsistent system.[^3]

It is well-known (see e.g. [@SorensenUrzyczyn2006 Chapter 11]) that in higher-order logic all logical connectives may be defined from $\forall$ and $\supset$ as follows. $$\begin{aligned}
  \bot &\equiv& \forall p : {\ensuremath{\mathrm{Prop}}}\,.\, p \\
  \neg \varphi &\equiv& \varphi \supset \bot \\
  \varphi \wedge \psi &\equiv& \forall p : {\ensuremath{\mathrm{Prop}}}\,.\, (\varphi \supset \psi \supset p) \supset p \\
  \varphi \vee \psi &\equiv& \forall p : {\ensuremath{\mathrm{Prop}}}\,.\, (\varphi \supset p) \supset (\psi \supset p) \supset p \\
  \exists x : \alpha \,.\, \varphi &\equiv& \forall p : {\ensuremath{\mathrm{Prop}}}\,.\, (\forall x : \alpha \,.\, \varphi \supset p) \supset p\end{aligned}$$ One may therefore wonder why we take $\vee$ and $\bot$ as primitive. The answer is that if we defined the connectives by the above equations, then the inference rules that could be derived for them would need to contain additional restrictions. For instance, we would be able to derive only the following variants of $\vee$-introduction.

  ------------------------------------------------------------------------------ ----------------------------------------------------------------------------------------------------------------------------------------
  $                                                                                                                                                                                                                     $
      {\vee_{i1}':}\; \inferrule{\Gamma {\ensuremath{\vdash}}\varphi \\ \Gamma         {\vee_{i2}':}\; \inferrule{\Gamma {\ensuremath{\vdash}}\psi \\ \Gamma {\ensuremath{\vdash}}\varphi : {\ensuremath{\mathrm{Prop}}}}
        {\ensuremath{\vdash}}\psi : {\ensuremath{\mathrm{Prop}}}}                                                                                                         {\Gamma {\ensuremath{\vdash}}\varphi \vee \psi}
      {\Gamma {\ensuremath{\vdash}}\varphi \vee \psi}                                                                                                                                                                   $
    $                                                                            
  ------------------------------------------------------------------------------ ----------------------------------------------------------------------------------------------------------------------------------------

Equality, Recursive Definitions and Extensionality
--------------------------------------------------

It is well-known (see e.g. [@Barendregt1984 Chapters 2, 6]) that since untyped $\lambda$-terms are available together with the axiom $\beta$ and usual rules for equality, any set of equations of the following form has a solution for $z_1,\ldots,z_n$, where the expressions $\Phi_i(z_1, \ldots, z_n, x_1, \ldots, x_m)$ are arbitrary terms with the free variables listed. $$\begin{aligned}
  z_1 x_1 \ldots x_m &=& \Phi_1(z_1, \ldots, z_n, x_1, \ldots, x_m) \\
  &\vdots& \\
  z_n x_1 \ldots x_m &=& \Phi_n(z_1, \ldots, z_n, x_1, \ldots, x_m)\end{aligned}$$ In other words, for any such set of equations, there exist terms $t_1,
\ldots, t_n$ such that for any terms $s_1, \ldots, s_m$ we have ${\ensuremath{\vdash}}{\ensuremath{\mathrm{Eq}\,\left(t_i s_1 \ldots s_m\right)\,\left(\Phi_i(t_1,
  \ldots, t_n, s_1, \ldots, s_m)\right)\,}}$ for each $i=1,\ldots,n$.

We will often define terms by such equations. In what follows we freely use the notation $t_1 = t_2$ for ${\ensuremath{\vdash}}{\ensuremath{\mathrm{Eq}\,t_1\,t_2\,}}$, or for $\Gamma {\ensuremath{\vdash}}{\ensuremath{\mathrm{Eq}\,t_1\,t_2\,}}$ when it is clear which context $\Gamma$ is meant. We use $t_1 = t_2 = \ldots = t_n$ to indicate that ${\ensuremath{\mathrm{Eq}\,t_i\,t_{i+1}\,}}$ may be derived for $i=1,\ldots,n-1$. We also sometimes write a term of the form ${\ensuremath{\mathrm{Eq}\,t_1\,t_2\,}}$ as $t_1 = t_2$.

It is worth stressing once again that there is no a priori syntactic distinction between terms, formulas, types, type assertions, etc. Formally, there are only terms, but some terms are intuitively interpreted as formulas, types, etc. In particular, the aforementioned method of defining terms by arbitrary recursive equations may be applied to define terms which could be intuitively considered to be formulas, e.g. we may define a term $\varphi$ such that $\varphi =
\neg \varphi$. Inconsistency is avoided, because it will not be actually possible to prove ${\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} \varphi : {\ensuremath{\mathrm{Prop}}}$, hence $\varphi$ will not really be a formula. In ${\ensuremath{{\cal I}}}_s$ the inference rules serve the purpose of classifying terms into different categories. This classification is not enforced a priori, but instead it is a part of derivations in the logic.

In ${\ensuremath{{\cal I}}}_s$ there is no rule for typing the equality $\mathrm{Eq}$. One consequence is that ${\ensuremath{\vdash}}\neg({\ensuremath{\mathrm{Eq}\,t_1\,t_2\,}})$ cannot be derived for any terms $t_1,t_2$.[^4] For this reason $\mathrm{Eq}$ is more like a meta-level notion of equality.

Leibniz equality $\mathrm{Eql}$ is defined as: $$\mathrm{Eql} \equiv \lambda \alpha \lambda x \lambda y . \forall p :
  \alpha \to {\ensuremath{\mathrm{Prop}}}\,.\, p x \supset p y$$

As with $=$, we will often write $t_1 =_\alpha t_2$ to denote ${\ensuremath{\vdash}}{\ensuremath{\mathrm{Eql}\,\alpha\,t_1\,t_2\,}}$ or $\Gamma {\ensuremath{\vdash}}{\ensuremath{\mathrm{Eql}\,\alpha\,t_1\,t_2\,}}$, or write $t_1 =_\alpha t_2$ instead of ${\ensuremath{\mathrm{Eql}\,\alpha\,t_1\,t_2\,}}$.

\[lem\_leibniz\] If $\Gamma {\ensuremath{\vdash}}\alpha : {\ensuremath{\mathrm{Type}}}$ then

-   $\Gamma {\ensuremath{\vdash}}\forall x, y : \alpha \,.\, (x =_\alpha y) : {\ensuremath{\mathrm{Prop}}}$,

-   $\Gamma {\ensuremath{\vdash}}\forall x : \alpha \,.\, (x =_\alpha x)$,

-   $\Gamma {\ensuremath{\vdash}}\forall x, y : \alpha \,.\, (x =_\alpha y) \supset
        (y =_\alpha x)$,

-   $\Gamma {\ensuremath{\vdash}}\forall x, y, z : \alpha \,.\, (x =_\alpha y)
        \wedge (y =_\alpha z) \supset (x =_\alpha z)$.

The system ${\ensuremath{{\cal I}}}_s$, as it is stated, is intensional with respect to Leibniz equality. We could add the rules $$e_f:\;
\inferrule{
  \Gamma {\ensuremath{\vdash}}\alpha : {\ensuremath{\mathrm{Type}}}\\ \Gamma {\ensuremath{\vdash}}\beta : {\ensuremath{\mathrm{Type}}}}{
  \forall f_1, f_2 : \alpha \to \beta \,.\, (\forall x
  : \alpha \,.\, f_1 x =_\beta f_2 x) \supset (f_1 =_{\alpha\to\beta} f_2)
}$$ $$e_b:\;
\inferrule{
  \Gamma {\ensuremath{\vdash}}\varphi_1 \supset \varphi_2 \\
  \Gamma {\ensuremath{\vdash}}\varphi_2 \supset \varphi_1
}{
  \Gamma {\ensuremath{\vdash}}\varphi_1 = \varphi_2
}$$ to obtain an extensional variant $e{\ensuremath{{\cal I}}}_s$ of ${\ensuremath{{\cal I}}}_s$. The system $e{\ensuremath{{\cal I}}}_s$ is still consistent – the model we construct for ${\ensuremath{{\cal I}}}_s$ validates the above rules.

${\ensuremath{\vdash}}_{e{\ensuremath{{\cal I}}}_s} \forall x, y : {\ensuremath{\mathrm{Prop}}}\,.\, (x =_{\ensuremath{\mathrm{Prop}}}y) \supset (x
  = y)$

Induction and Natural Numbers {#sec_induction}
-----------------------------

The system ${\ensuremath{{\cal I}}}_s$ incorporates basic inductive types. In accordance with the terminology from [@BlanquiJounnaudOkada2002], an inductive type is basic if its constructors have no functional arguments. This class of inductive types includes most simple commonly used inductive types, e.g. natural numbers, lists, finite trees.

In our approach the types of constructors are encoded in the syntactic form of the inductive type. For instance, if $\iota_0, \iota_1 \in
{\ensuremath{{\cal T}}}_I$, then $\iota = \mu(\langle \rangle, \langle \iota_0, \iota_1,
\star, \star \rangle)$ is an inductive type with constructors: $c_1^\iota : \iota$ and $c_2^\iota : \iota_0 \to \iota_1 \to \iota \to
\iota \to \iota$.

If $c_i^\iota \in {\ensuremath{{\cal C}}}$ of arity $n_i$ has signature $\langle
  \iota_1,\ldots,\iota_{n_i} \rangle$ then ${\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} c_i^\iota :
  \iota_1^* \to \ldots \to \iota_{n_i}^* \to \iota$.

${\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} o_i^\iota : \iota \to {\ensuremath{\mathrm{Prop}}}$ and ${\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s}
  \forall x : \iota \,.\, o_i^\iota x \supset (d_{i,j}^\iota x :
  \iota_{i,j}^*)$

\[lem\_ind\_leibniz\_implies\_eq\] If $\iota \in {\ensuremath{{\cal T}}}_I$ then ${\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} \forall x, y : \iota \,.\,
  x =_\iota y \supset x = y$.

We may define the type of natural numbers by ${\ensuremath{\mathrm{Nat}}}\equiv \mu(\langle
\rangle, \langle \star \rangle)$. We use the abbreviations: $0 \equiv
c_1^{\ensuremath{\mathrm{Nat}}}$ (zero), ${\ensuremath{\mathfrak{0}}}\equiv o_1^{\ensuremath{\mathrm{Nat}}}$ (test for zero), ${\ensuremath{\mathfrak{s}}}\equiv c_2^{\ensuremath{\mathrm{Nat}}}$ (successor) and ${\ensuremath{\mathfrak{p}}}\equiv \lambda x \,.\,
{\ensuremath{\mathrm{Cond}\,({\ensuremath{\mathfrak{0}}}x)\,0\,(d_{2,1}^{\ensuremath{\mathrm{Nat}}}x)\,}}$ (predecessor). The rules $i_i^{\ensuremath{\mathrm{Nat}}}$ and $i_t^{{\ensuremath{\mathrm{Nat}}},k}$ become:

[lr]{}\
$
  {n_t^1:}\; \inferrule{
  }{
    \Gamma {\ensuremath{\vdash}}0 : {\ensuremath{\mathrm{Nat}}}}
$ & $
  {n_t^2:}\; \inferrule{
    \Gamma {\ensuremath{\vdash}}t : {\ensuremath{\mathrm{Nat}}}}{
    \Gamma {\ensuremath{\vdash}}({\ensuremath{\mathfrak{s}}}t) : {\ensuremath{\mathrm{Nat}}}}
$

To simplify the exposition, we discuss some properties of our formulation of inductive types using the example of natural numbers. Much of what we say applies to other basic inductive types, with appropriate modifications.

The rule $n_i$ is an induction principle for natural numbers. An important property of this induction principle is that it places no restrictions on $t$. This allows us to prove by induction on natural numbers properties of terms about which nothing is known beforehand. In particular, we do not need to know whether $t$ has a $\beta$-normal form in order to apply the rule $n_i$ to it. In contrast, an induction principle of the form e.g. $$n_i':\;\; \forall f : {\ensuremath{\mathrm{Nat}}}\to {\ensuremath{\mathrm{Prop}}}\,.\, \left(\left(f 0 \wedge (\forall
x : {\ensuremath{\mathrm{Nat}}}\,.\, f x \supset f ({\ensuremath{\mathfrak{s}}}x))\right) \supset \forall x : {\ensuremath{\mathrm{Nat}}}\,.\, f
x\right)$$ would be much less useful, because to apply it to a term $t$ we would have to prove $t : {\ensuremath{\mathrm{Nat}}}\to {\ensuremath{\mathrm{Prop}}}$ *beforehand*. Examples of the use of the rule $n_i$ for reasoning about possibly nonterminating general recursive programs are given in Sect. \[sec\_partiality\].

We may define a recursor $R$ for natural numbers in the following way: $$\begin{aligned}
  R &=& \lambda g h x y \,.\, {\ensuremath{\mathrm{Cond}\,({\ensuremath{\mathfrak{0}}}y)\,(g x)\,(h\, x\, ({\ensuremath{\mathfrak{p}}}y)\,
    (R\, g\, h\, x\, ({\ensuremath{\mathfrak{p}}}y)))\,}}.\end{aligned}$$ Note that we need the predecessor as a primitive, because otherwise a recursor would not be definable.

Now $+$, $-$, ${\ensuremath{\cdot}}$, $<$ and $\le$, usually used in infix notation, are defined as follows. $$\begin{aligned}
  x + y &=& R (\lambda x \,.\, x) (\lambda x y z \,.\, {\ensuremath{\mathfrak{s}}}z) x y \\
  x - y &=& R (\lambda x \,.\, x) (\lambda x y z \,.\, {\ensuremath{\mathfrak{p}}}z) x y \\
  x {\ensuremath{\cdot}}y &=& R (\lambda x \,.\, 0) (\lambda x y z \,.\, x + z) x y \\
  x \le y &=& {\ensuremath{\mathfrak{0}}}(x - y) \\
  x < y &=& ({\ensuremath{\mathfrak{s}}}x) \le y\end{aligned}$$

\[lem\_nat\_op\_well\_defined\] The following terms are derivable in the system ${\ensuremath{{\cal I}}}_s$:

-   $\forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, (x + y) : {\ensuremath{\mathrm{Nat}}}$, $\forall x, y :
        {\ensuremath{\mathrm{Nat}}}\,.\, (x - y) : {\ensuremath{\mathrm{Nat}}}$, $\forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, (x {\ensuremath{\cdot}}y)
        : {\ensuremath{\mathrm{Nat}}}$,

-   $\forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, (x \le y) : {\ensuremath{\mathrm{Prop}}}$, $\forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, (x < y) : {\ensuremath{\mathrm{Prop}}}$.

\[lem\_le\_eq\] ${\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} \forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, (x \ge y) \wedge (x \le y)
  \supset (x =_{\ensuremath{\mathrm{Nat}}}y)$.

It is possible to derive Peano axioms for $+$ and ${\ensuremath{\cdot}}$ defined as above.

\[thm\_peano\] The following terms are derivable in the system ${\ensuremath{{\cal I}}}_s$:

-   $\forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, \left({\ensuremath{\mathfrak{s}}}x =_{\ensuremath{\mathrm{Nat}}}{\ensuremath{\mathfrak{s}}}y\right)
        \supset \left(x =_{\ensuremath{\mathrm{Nat}}}y\right)$,

-   $\forall x : {\ensuremath{\mathrm{Nat}}}\,.\, \neg ({\ensuremath{\mathfrak{s}}}x =_{\ensuremath{\mathrm{Nat}}}0)$,

-   $\forall x : {\ensuremath{\mathrm{Nat}}}\,.\, (x + 0 =_{\ensuremath{\mathrm{Nat}}}x)$,

-   $\forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, (x + {\ensuremath{\mathfrak{s}}}y =_{\ensuremath{\mathrm{Nat}}}{\ensuremath{\mathfrak{s}}}(x + y))$,

-   $\forall x : {\ensuremath{\mathrm{Nat}}}\,.\, (x {\ensuremath{\cdot}}0 =_{\ensuremath{\mathrm{Nat}}}0)$,

-   $\forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, (x {\ensuremath{\cdot}}({\ensuremath{\mathfrak{s}}}y) =_{\ensuremath{\mathrm{Nat}}}(x {\ensuremath{\cdot}}y)
        + x)$.

The following theorem shows that any function for which there exists a measure on its arguments, which may be shown to decrease with every recursive call in each of a finite number of exhaustive cases, is typable in our system.

Suppose $\Gamma {\ensuremath{\vdash}}\forall x_1 : \alpha_1 \ldots \forall x_n :
  \alpha_n \,.\, \varphi_1 \lor \ldots \lor \varphi_m$, $\Gamma
  {\ensuremath{\vdash}}\alpha_j : {\ensuremath{\mathrm{Type}}}$ for $j = 1,\ldots,n$, and for $i=1,\ldots,m$: $\Gamma {\ensuremath{\vdash}}\forall x_1 : \alpha_1 \ldots
  \forall x_n : \alpha_n \,.\, t_i : \beta \to \ldots \to \beta$ where $\beta$ occurs $k_i + 1$ times, $\Gamma {\ensuremath{\vdash}}\forall x_1 :
  \alpha_1 \ldots \forall x_n : \alpha_n \,.\, t_{i,j,k} : \alpha_k$ for $j=1,\ldots,k_i$, $k=1,\ldots,n$, $x_1,\ldots,x_n \notin
  FV(f,\alpha_1,\ldots,\alpha_n,\beta)$ and $$\begin{aligned}
  \Gamma {\ensuremath{\vdash}}\forall x_1 : \alpha_1 \ldots \forall x_n :
  \alpha_n \,.\, \varphi_i &\supset& (f x_1 \ldots x_n = \\ && \;t_i (f t_{i,1,1}
  \ldots t_{i,1,n}) \ldots (f t_{i,k_i,1} \ldots t_{i,k_i,n})).
  \end{aligned}$$ If there is a term $g$ such that $\Gamma {\ensuremath{\vdash}}g : \alpha_1 \to
  \ldots \to \alpha_n \to {\ensuremath{\mathrm{Nat}}}$ and for $i=1,\ldots,m$ $$\begin{aligned}
  \Gamma {\ensuremath{\vdash}}\forall x_1 : \alpha_1 \ldots \forall x_n : \alpha_n
  \,.\, \varphi_i &\supset& (\left((f x_1 \ldots x_n) :
  \beta\right) \lor \\ && \;((g t_{i,1,1} \ldots t_{i,1,n}) < (g x_1 \ldots
  x_n) \land \ldots \land \\ && \;\;(g t_{i,k_i,1} \ldots t_{i,k_i,n}) < (g x_1
  \ldots x_n)))
  \end{aligned}$$ where $x_1,\ldots,x_n \notin FV(g)$, then $$\Gamma {\ensuremath{\vdash}}f : \alpha_1 \to \ldots \to \alpha_n \to \beta.$$

Conservativity and Consistency {#sec_consistent}
==============================

In this section we show a sound embedding of ordinary classical higher-order logic into ${\ensuremath{{\cal I}}}_s$, which we also conjecture to be complete. We have a completeness proof only for a restriction of this embedding to first-order logic. We also give a brief overview of the model construction used to establish consistency of ${\ensuremath{{\cal I}}}_s$.

First, let us define the system CPRED$\omega$ of classical higher-order logic.

-   The *types* of CPRED$\omega$ are given by $${\ensuremath{{\cal T}}}\;\; ::= \;\; o \;|\; {\ensuremath{{\cal B}}}\;|\; {\ensuremath{{\cal T}}}\rightarrow {\ensuremath{{\cal T}}}$$ where ${\ensuremath{{\cal B}}}$ is a specific finite set of base types. The type $o$ is the type of propositions.

-   The set of terms of CPRED$\omega$ of type $\tau$, denoted $T_\tau$, is defined as follows:

    -   $V_\tau, \Sigma_\tau \subseteq T_\tau$,

    -   if $t_1 \in T_{\sigma\to\tau}$ and $t_2 \in T_\sigma$ then $t_1 t_2 \in T_\tau$,

    -   if $x \in V_{\tau_1}$ and $t \in T_{\tau_2}$ then $\lambda x :
            \tau_1 \,.\, t \in T_{\tau_1\to\tau_2}$,

    -   if $\varphi, \psi \in T_o$ then $\varphi \supset \psi \in
            T_o$,

    -   if $x \in V_{\tau}$ and $\varphi \in T_o$ then $\forall x :
            \tau \,.\, \varphi \in T_o$,

    where for each type $\tau$ the set $V_\tau$ is a countable set of variables and $\Sigma_\tau$ is a countable set of constants. We assume that the sets $V_\tau$ and $\Sigma_\sigma$ are all pairwise disjoint. Terms of type $o$ are *formulas*. As usual, we omit spurious brackets and assume that application associates to the left. We identify $\alpha$-equivalent terms, i.e. terms differing only in the names of bound variables are considered identical.

-   The system CPRED$\omega$ is given by the following rules and axioms, where $\Delta$ is a finite set of formulas, $\varphi, \psi$ are formulas. The notation $\Delta, \varphi$ is a shorthand for $\Delta \cup \{\varphi\}$.

    [**Axioms**]{}

    -   $\Delta, \varphi {\ensuremath{\vdash}}\varphi$

    -   $\Delta {\ensuremath{\vdash}}\forall p : o \,.\, ((p \supset \bot) \supset
            \bot) \supset p$ where $\bot \equiv \forall p : o \,.\, p$

    [**Rules**]{}

    [lr]{} $
          {\supset_i^P:}\; \inferrule{\Delta, \varphi {\ensuremath{\vdash}}\psi}{\Delta {\ensuremath{\vdash}}\varphi \supset \psi}
        $ & $
          {\supset_e^P:}\; \inferrule{\Delta {\ensuremath{\vdash}}\varphi \supset
            \psi \;\;\; \Delta {\ensuremath{\vdash}}\varphi}{\Delta {\ensuremath{\vdash}}\psi}
        $\
    &\
    $
          {\forall_i^P:}\; \inferrule{\Delta {\ensuremath{\vdash}}\varphi}{\Delta {\ensuremath{\vdash}}\forall x : \tau \,.\, \varphi} \; x
          \notin FV(\Delta), x \in V_\tau
        $ & $
          {\forall_e^P:}\; \inferrule{\Delta {\ensuremath{\vdash}}\forall x : \tau \,.\, \varphi}{\Delta
            {\ensuremath{\vdash}}\varphi[x/t]}\; t \in T_\tau
        $\
    &\

In CPRED$\omega$, we define Leibniz equality in type $\tau \in {\ensuremath{{\cal T}}}$ by $$t_1 =_\tau t_2 \equiv \forall p : \tau \to o \,.\, p t_1 \supset p t_2$$ The system CPRED$\omega$ is intensional. An extensional variant E-CPRED$\omega$ may be obtained by adding the following axioms for all $\tau, \sigma \in {\ensuremath{{\cal T}}}$: $$e_f^P: \forall f_1, f_2 : \tau \to \sigma \,.\, \left(\forall x : \tau
\,.\, f_1 x =_\sigma f_2 x \right) \supset (f_1 =_{\tau\to\sigma} f_2)$$ $$e_b^P: \forall \varphi_1, \varphi_2 : o \,.\, \left((\varphi_1 \supset
\varphi_2) \wedge (\varphi_2 \supset \varphi_1)\right) \supset
(\varphi_1 =_{o} \varphi_2)$$

For an arbitrary set of formulas $\Delta$ we write $\Delta {\ensuremath{\vdash}}_S
\varphi$ if $\varphi$ is derivable from a subset of $\Delta$ in system $S$.

We now define a mapping ${\ensuremath{\lceil-\rceil}}$ from types and terms of CPRED$\omega$ to terms of ${\ensuremath{{\cal I}}}_s$, and a mapping $\Gamma(-)$ from sets of terms of CPRED$\omega$ to sets of terms of ${\ensuremath{{\cal I}}}_s$ providing necessary context. We assume that ${\ensuremath{{\cal B}}}\subseteq \Sigma_s$ and $\Sigma_\tau \subseteq \Sigma_s$ for $\tau \in {\ensuremath{{\cal T}}}$, i.e. that all base types and all constants of CPRED$\omega$ occur as constants in ${\ensuremath{{\cal I}}}_s$, and also $V_\tau \subseteq V_s$ for $\tau \in {\ensuremath{{\cal T}}}$. The definition of ${\ensuremath{\lceil-\rceil}}$ is inductive:

-   ${\ensuremath{\lceil\tau\rceil}} = \tau$ for $\tau \in {\ensuremath{{\cal B}}}$,

-   ${\ensuremath{\lceilo\rceil}} = {\ensuremath{\mathrm{Prop}}}$,

-   ${\ensuremath{\lceil\tau_1\to\tau_2\rceil}} = {\ensuremath{\lceil\tau_1\rceil}} \to {\ensuremath{\lceil\tau_2\rceil}}$ for $\tau_1,\tau_2 \in {\ensuremath{{\cal T}}}$,

-   ${\ensuremath{\lceilc\rceil}} = c$ if $c \in \Sigma_\tau$ for some $\tau \in {\ensuremath{{\cal T}}}$,

-   ${\ensuremath{\lceilx\rceil}} = x$ if $x \in V_\tau$ for some $\tau \in {\ensuremath{{\cal T}}}$,

-   ${\ensuremath{\lceilt_1 t_2\rceil}} = {\ensuremath{\lceilt_1\rceil}} {\ensuremath{\lceilt_2\rceil}}$,

-   ${\ensuremath{\lceil\lambda x : \tau \,.\, t\rceil}} = \lambda x \,.\,
      {\ensuremath{\lceilt\rceil}}$,

-   ${\ensuremath{\lceil\varphi \supset \psi\rceil}} = {\ensuremath{\lceil\varphi\rceil}} \supset
      {\ensuremath{\lceil\psi\rceil}}$,

-   ${\ensuremath{\lceil\forall x : \tau \,.\, \varphi\rceil}} = \forall x :
      {\ensuremath{\lceil\tau\rceil}} \,.\, {\ensuremath{\lceil\varphi\rceil}}$.

If $\Delta$ is a set of formulas, then ${\ensuremath{\lceil\Delta\rceil}}$ denotes the image of ${\ensuremath{\lceil-\rceil}}$ on $\Delta$. The set $\Gamma(\Delta)$ is defined to contain the following:

-   $x : {\ensuremath{\lceil\tau\rceil}}$ for all $\tau \in {\ensuremath{{\cal T}}}$ and all $x \in
      FV(\Delta)$ such that $x \in V_\tau$,

-   $c : {\ensuremath{\lceil\tau\rceil}}$ for all $\tau \in {\ensuremath{{\cal T}}}$ and all $c \in
      \Sigma_\tau$,

-   $\tau : {\ensuremath{\mathrm{Type}}}$ for all $\tau \in {\ensuremath{{\cal B}}}$,

-   $y : \tau$ for all $\tau \in {\ensuremath{{\cal B}}}$ and some $y \in V_\tau$ such that $y \notin FV(\Delta)$.

The last point is needed because in ordinary logic one always assumes that the domains are non-empty.

\[thm\_sound\_hol\] If $\Delta {\ensuremath{\vdash}}_{\mathrm{CPRED}\omega} \varphi$ then $\Gamma(\Delta, \varphi), {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s}
  {\ensuremath{\lceil\varphi\rceil}}$. The same holds if we change CPRED$\omega$ to and ${\ensuremath{{\cal I}}}_s$ to $e{\ensuremath{{\cal I}}}_s$.

The above theorem shows that ${\ensuremath{{\cal I}}}_s$ may be considered an extension of ordinary higher-order logic. This extension is essentially obtained by relaxing typing requirements on allowable $\lambda$-terms. Type-checking is obviously undecidable in ${\ensuremath{{\cal I}}}_s$, but the purpose of types in illative systems is not to have a decidable method for syntactic correctness checks, but to provide general means for classifying terms into various categories. In practice, one might still want to have a decidable (and necessarily incomplete) method for checking correctness of some designated type assertions. Such a method may be obtained by employing any type-checking algorithm sound w.r.t. ${\ensuremath{{\cal I}}}_s$.[^5] However, the difference would be that a priori type-checks would not be enforced in every situation. Occasionally, with some more complex recursive functions, it might be convenient to forgo these checks and reason about the types of such functions explicitly, using the rules of ${\ensuremath{{\cal I}}}_s$.

\[conj\_conservative\_hol\] If $\Gamma(\Delta, \varphi), {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s}
  {\ensuremath{\lceil\varphi\rceil}}$ then $\Delta {\ensuremath{\vdash}}_{\mathrm{CPRED}\omega}
  \varphi$. The same holds if we change CPRED$\omega$ to and ${\ensuremath{{\cal I}}}_s$ to $e{\ensuremath{{\cal I}}}_s$.

We were able to prove this conjecture only for first-order logic. The system of classical first-order logic (FOL) is obtained by restricting CPRED$\omega$ in obvious ways (leaving only one base type $\iota$, disallowing $\lambda$-abstraction, allowing quantification only over $\iota$, and constants only of types $\iota$, $\iota \to \ldots \to \iota \to \iota$ or $\iota \to \ldots \to \iota
\to o$).

\[thm\_embedding\_01\] If ${\ensuremath{{\cal I}}}= {\ensuremath{{\cal I}}}_s$ or ${\ensuremath{{\cal I}}}= e{\ensuremath{{\cal I}}}_s$ then $$\Delta {\ensuremath{\vdash}}_{\mathrm{FOL}} \varphi \mathrm{\ \ \ iff\ \ \ }
  \Gamma(\Delta, \varphi), {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}}
  {\ensuremath{\lceil\varphi\rceil}}$$

\[thm\_consistent\_01\] The systems ${\ensuremath{{\cal I}}}_s$ and $e{\ensuremath{{\cal I}}}_s$ are consistent, i.e. $\not{\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} \bot$ and $\not{\ensuremath{\vdash}}_{e{\ensuremath{{\cal I}}}_s} \bot$.

This follows from Theorem \[thm\_embedding\_01\], but we actually prove Theorem \[thm\_consistent\_01\] first by constructing a model, and then use this construction to show Theorem \[thm\_embedding\_01\].

We now give an informal overview of the model construction. To simplify the exposition we pretend ${\ensuremath{{\cal I}}}_s$ allows only function types. Inductive types and subtypes add some technicalities, but the general idea of the construction remains the same. This overview is necessarily very brief. An interested reader is advised to consult a technical appendix for more details.

An ${\ensuremath{{\cal I}}}_s$-model is defined essentially as a $\lambda$-model (see e.g. [@Barendregt1984 Chapter 5]) with designated elements interpreting the constants of ${\ensuremath{{\cal I}}}_s$, satisfying certain requirements. By ${\ensuremath{\llbrackett\rrbracket_{}^{{\ensuremath{{\cal M}}}}}}$ we denote the interpretation of the ${\ensuremath{{\cal I}}}_s$-term $t$ in a model ${\ensuremath{{\cal M}}}$. The conditions imposed on an ${\ensuremath{{\cal I}}}_s$-model express the meaning of each rule of ${\ensuremath{{\cal I}}}_s$ according to the intuitive semantics. For instance, we have the conditions:

-   for $a \in {\ensuremath{{\cal M}}}$, if ${\ensuremath{\llbracket\mathrm{Is}\rrbracket_{}^{{\ensuremath{{\cal M}}}}}} \cdot a \cdot
      {\ensuremath{\llbracket{\ensuremath{\mathrm{Type}}}\rrbracket_{}^{{\ensuremath{{\cal M}}}}}} = {\ensuremath{\llbracket\top\rrbracket_{}^{{\ensuremath{{\cal M}}}}}}$ and for all $c
      \in {\ensuremath{{\cal M}}}$ such that ${\ensuremath{\llbracket\mathrm{Is}\rrbracket_{}^{{\ensuremath{{\cal M}}}}}} \cdot c \cdot a =
      {\ensuremath{\llbracket\top\rrbracket_{}^{{\ensuremath{{\cal M}}}}}}$ we have $b \cdot c =
      {\ensuremath{\llbracket\top\rrbracket_{}^{{\ensuremath{{\cal M}}}}}}$ then ${\ensuremath{\llbracket\forall\rrbracket_{}^{{\ensuremath{{\cal M}}}}}} \cdot a
      \cdot b = {\ensuremath{\llbracket\top\rrbracket_{}^{{\ensuremath{{\cal M}}}}}}$,

-   for $a,b \in {\ensuremath{{\cal M}}}$, if ${\ensuremath{\llbracket\forall\rrbracket_{}^{{\ensuremath{{\cal M}}}}}}
      \cdot a \cdot b = {\ensuremath{\llbracket\top\rrbracket_{}^{{\ensuremath{{\cal M}}}}}}$ then for all $c \in A$ such that ${\ensuremath{\llbracket\mathrm{Is}\rrbracket_{}^{{\ensuremath{{\cal M}}}}}} \cdot c \cdot a =
      {\ensuremath{\llbracket\top\rrbracket_{}^{{\ensuremath{{\cal M}}}}}}$ we have $b \cdot c =
      {\ensuremath{\llbracket\top\rrbracket_{}^{{\ensuremath{{\cal M}}}}}}$.

Here $\cdot$ is the application operation in the model.

We show that the semantics based on ${\ensuremath{{\cal I}}}_s$-models is sound for ${\ensuremath{{\cal I}}}_s$. Then it suffices to construct a non-trivial (i.e. such that ${\ensuremath{\llbracket\top\rrbracket_{}^{}}} \ne {\ensuremath{\llbracket\bot\rrbracket_{}^{}}}$) ${\ensuremath{{\cal I}}}_s$-model to establish consistency of ${\ensuremath{{\cal I}}}_s$. The model will in fact satisfy additional conditions corresponding to the rules $e_f$ and $e_b$, so we obtain consistency of $e{\ensuremath{{\cal I}}}_s$ as well.

The model is constructed as the set of equivalence classes of a certain relation ${\ensuremath{\stackrel{*}{\Leftrightarrow}}}$ on the set of so called semantic terms. A semantic term is a well-founded tree whose leaves are labelled with variables or constants, and whose internal nodes are labelled with $\cdot$, $\lambda x$ or ${\ensuremath{\mathrm{A}}}\tau$. The intuitive interpretation of nodes labelled with $\cdot$ or $\lambda x$ is obvious. For semantic terms with the roots labelled with $\cdot$ and $\lambda x$ we use the abbreviations $t_1 t_2$ and $\lambda x . t$, respectively. A node labelled with ${\ensuremath{\mathrm{A}}}\tau$ represents universal quantification over a set of constants $\tau$, i.e. it “represents” the statement: for all $c \in \tau$, $t c$ is true. Such a node has one child for each $c \in
\tau$. The relation ${\ensuremath{\stackrel{*}{\Leftrightarrow}}}$ will be defined as the equivalence relation generated by a certain reduction relation ${\ensuremath{\Rightarrow}}$ on semantic terms. The relation ${\ensuremath{\Rightarrow}}$ will satisfy[^6]: $(\lambda x . t_1) t_2
{\ensuremath{\Rightarrow}}t_1[x/t_2]$, $\lor \top t {\ensuremath{\Rightarrow}}\top$, $\lor \bot \bot
{\ensuremath{\Rightarrow}}\bot$, etc. The question is how to define ${\ensuremath{\Rightarrow}}$ for $\forall t_1 t_2$ so that the resulting structure satisfies ($\forall_\top$). One could try closing ${\ensuremath{\Rightarrow}}$ under the rule:

-   if $\mathrm{Is}\, t_1\, {\ensuremath{\mathrm{Type}}}{\ensuremath{\stackrel{*}{\Rightarrow}}}\top$ and for all semantic terms $t$ such that $\mathrm{Is}\, t\, t_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}\top$ we have $t_2 t {\ensuremath{\stackrel{*}{\Rightarrow}}}\top$, then $\forall t_1 t_2 {\ensuremath{\Rightarrow}}\top$.

However, there is a negative reference to ${\ensuremath{\Rightarrow}}$ here, so the definition would not be monotone, and we would not necessarily reach a fixpoint. This is a major problem. We somehow need to know the range of all quantifiers beforehand. However, the range (i.e. the set of all semantic terms $t$ such that $t_1 t {\ensuremath{\stackrel{*}{\Rightarrow}}}\top$) depends on the definition of ${\ensuremath{\Rightarrow}}$, so it is not at all clear how to achieve this.

Fortunately, it is not so difficult to analyze a priori the form of types of ${\ensuremath{{\cal I}}}_s$. Informally, if $t : {\ensuremath{\mathrm{Type}}}$ is true, then $t$ corresponds to a set in ${\ensuremath{{\cal T}}}$, where ${\ensuremath{{\cal T}}}$ is defined as follows, ignoring subtypes and inductive types, but instead introducing a base type $\delta$ of individuals.

-   $\delta, {\ensuremath{\mathrm{Bool}}}\in {\ensuremath{{\cal T}}}$ where ${\ensuremath{\mathrm{Bool}}}= \{\top,\bot\}$ and $\delta$ is an arbitrary set of fresh constants.

-   If $\tau_1,\tau_2 \in {\ensuremath{{\cal T}}}$ then $\tau_2^{\tau_1} \in {\ensuremath{{\cal T}}}$, where $\tau_2^{\tau_1}$ is the set of all set-theoretic functions from $\tau_1$ to $\tau_2$.

We take the elements of ${\ensuremath{{\cal T}}}$ and $\bigcup {\ensuremath{{\cal T}}}\setminus {\ensuremath{\mathrm{Bool}}}$ as fresh constants, i.e. they may occur as constants in semantic terms. The elements of $\bigcup {\ensuremath{{\cal T}}}$ are *canonical constants*. If $c \in \tau_2^{\tau_1}$ and $c_1 \in \tau_1$ then we write ${\ensuremath{{\cal F}}}(c)(c_1)$ instead of $c(c_1)$ to avoid confusion with the semantic term $c c_1$. We then define a relation $\succ$ satisfying:

-   $c \succ c$ for a canonical constant $c$,

-   if $c \in \tau_2^{\tau_1}$ and for all $c_1 \in \tau_1$ there exists a semantic term $t'$ such that $t c_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}t' \succ
      {\ensuremath{{\cal F}}}(c)(c_1)$, then $t \succ c$.

Intuitively, $t \succ c \in \tau$ holds if $c$ “simulates” $t$ in type $\tau$, i.e. $t$ behaves exactly like $c$ in every context where a term of type $\tau$ is “expected”.

The relation ${\ensuremath{\Rightarrow}}$ is then defined by transfinite induction in a monotone way. It will satisfy e.g.:

-   if $t \succ c \in \tau \in {\ensuremath{{\cal T}}}$ then $\mathrm{Is}\,t\,\tau
      {\ensuremath{\Rightarrow}}\top$,

-   if $t \succ c_1 \in \tau_1$ and $c \in \tau_2^{\tau_1}$ then $c
      t {\ensuremath{\Rightarrow}}{\ensuremath{{\cal F}}}(c)(c_1)$,

-   $\mathrm{Fun}\,\tau_1\,\tau_2 {\ensuremath{\Rightarrow}}\tau_2^{\tau_1}$,

-   $\forall \tau t {\ensuremath{\Rightarrow}}t'$ where the label at the root of $t'$ is ${\ensuremath{\mathrm{A}}}\tau$, and for each $c \in \tau$, $t'$ has a child $t c$,

-   $t {\ensuremath{\Rightarrow}}\top$ if the label of the root of $t$ is ${\ensuremath{\mathrm{A}}}\tau$, and all children of $t$ are labelled with $\top$,

-   if $t_c {\ensuremath{\stackrel{*}{\Rightarrow}}}t_c'$ for all $c \in \tau \in {\ensuremath{{\cal T}}}$, the label of the root of $t$ is ${\ensuremath{\mathrm{A}}}\tau$, and $\{ t_c \;|\; c \in \tau \}$ is the set of children of $t$, then $t {\ensuremath{\Rightarrow}}t'$, where the label of the root of $t'$ is ${\ensuremath{\mathrm{A}}}\tau$ and $\{t_c' \;|\; c \in \tau\}$ is the set of children of $t'$.

We removed negative references to ${\ensuremath{\Rightarrow}}$, but it is not easy to show that the resulting model will satisfy the required conditions. Two key properties established in the correctness proof are:

1.  ${\ensuremath{\Rightarrow}}$ has the Church-Rosser property,

2.  if $t_2 \succ c$ and $t_1 c {\ensuremath{\stackrel{*}{\Rightarrow}}}d \in \{\top,\bot\}$ then $t_1 t_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}d$.

The second property shows that quantifying over only canonical constants of type $\tau$ is in a sense equivalent to quantifying over all terms of type $\tau$. This is essential for establishing e.g. the condition ($\forall_\top$).

Both of these properties have rather intricate proofs. Essentially, the proofs show certain commutation and postponement properties for ${\ensuremath{\Rightarrow}}$, $\succ$ and other auxiliary relations. The proofs proceed by induction on lexicographic products of various ordinals and other parameters associated with the relations and terms involved.

Partiality and General Recursion {#sec_partiality}
================================

In this section we give some examples of proofs in ${\ensuremath{{\cal I}}}_s$ of properties of functions defined by recursion. For lack of space, we give only informal indications of how formal proofs may be obtained, assuming certain basic properties of operations on natural numbers. The transformation of the given informal arguments into formal proofs in ${\ensuremath{{\cal I}}}_s$ is not difficult. Mostly complete formal proofs may be found in a technical appendix.

Consider a term ${\ensuremath{\mathrm{subp}}}$ satisfying the following recursive equation: $${\ensuremath{\mathrm{subp}}}= \lambda i j \,.\, {\ensuremath{\mathrm{Cond}\,(i =_{\ensuremath{\mathrm{Nat}}}j)\,0\,\left(\left({\ensuremath{\mathrm{subp}}}\, i \, \left(j + 1\right)\right) + 1\right)\,}}.$$ If $i \ge j$ then ${\ensuremath{\mathrm{subp}}}\,i\,j = i - j$. If $i < j$ then ${\ensuremath{\mathrm{subp}}}\,i\,j$ does not terminate. An appropriate specification for ${\ensuremath{\mathrm{subp}}}$ is $\forall i, j : {\ensuremath{\mathrm{Nat}}}\,.\, (i \ge j) \supset ({\ensuremath{\mathrm{subp}}}\, i\,
  j = i - j)$.

Let $\varphi(y) = \forall i : {\ensuremath{\mathrm{Nat}}}\,.\, \forall j : {\ensuremath{\mathrm{Nat}}}\,.\,
  \left(i \ge j \supset y =_{\ensuremath{\mathrm{Nat}}}i - j \supset
  {\ensuremath{\mathrm{subp}}}\,i\,j\,=\,i-j\right)$. We show by induction on $y$ that $\forall y : {\ensuremath{\mathrm{Nat}}}\,.\, \varphi(y)$.

First note that under the assumptions $y : {\ensuremath{\mathrm{Nat}}}$, $i : {\ensuremath{\mathrm{Nat}}}$, $j :
  {\ensuremath{\mathrm{Nat}}}$ it follows from Lemma \[lem\_nat\_op\_well\_defined\] that $(i
  \ge j) : {\ensuremath{\mathrm{Prop}}}$ and $(y =_{\ensuremath{\mathrm{Nat}}}i - j) : {\ensuremath{\mathrm{Prop}}}$. Hence, whenever $y :
  {\ensuremath{\mathrm{Nat}}}$, to show $i \ge j \supset y =_{\ensuremath{\mathrm{Nat}}}i - j \supset
  {\ensuremath{\mathrm{subp}}}\,i\,j\,=\,i-j$ it suffices to derive ${\ensuremath{\mathrm{subp}}}\,i\,j\,=\,i-j$ under the assumptions $i \ge j$ and $y =_{\ensuremath{\mathrm{Nat}}}i - j$. By Lemma \[lem\_ind\_leibniz\_implies\_eq\] the assumption $y =_{\ensuremath{\mathrm{Nat}}}i -
  j$ may be weakened to $y = i - j$.

In the base step it thus suffices to show ${\ensuremath{\mathrm{subp}}}\,i\,j\,=\,i-j$ under the assumptions $i : {\ensuremath{\mathrm{Nat}}}$, $j : {\ensuremath{\mathrm{Nat}}}$, $i \ge j$, $i - j =
  0$. From $i - j = 0$ we obtain ${\ensuremath{\mathfrak{0}}}(i - j)$, so $j \ge i$. From $i \ge j$ and $i \le j$ we derive $i =_{\ensuremath{\mathrm{Nat}}}j$ by Lemma \[lem\_le\_eq\]. Then ${\ensuremath{\mathrm{subp}}}\,i\,j\,=\,i-j$ follows by simple computation (i.e. by applying rules for  and appropriate rules for the conditional).

In the inductive step we have $\varphi(y)$ for $y : {\ensuremath{\mathrm{Nat}}}$ and we need to obtain $\varphi({\ensuremath{\mathfrak{s}}}y)$. It suffices to show ${\ensuremath{\mathrm{subp}}}\,i\,j = i
  - j$ under the assumptions $i : {\ensuremath{\mathrm{Nat}}}$, $j : {\ensuremath{\mathrm{Nat}}}$ and ${\ensuremath{\mathfrak{s}}}y = i -
  j$. Because ${\ensuremath{\mathfrak{s}}}y \ne_{\ensuremath{\mathrm{Nat}}}0$ we have $i \ne_{\ensuremath{\mathrm{Nat}}}j$, hence ${\ensuremath{\mathrm{subp}}}\,i\,j = {\ensuremath{\mathfrak{s}}}({\ensuremath{\mathrm{subp}}}\,i\,({\ensuremath{\mathfrak{s}}}j))$ follows by computation. Using the inductive hypothesis we now conclude ${\ensuremath{\mathrm{subp}}}\,i\,({\ensuremath{\mathfrak{s}}}j) = i - ({\ensuremath{\mathfrak{s}}}j)$, and thus ${\ensuremath{\mathrm{subp}}}\,i\,({\ensuremath{\mathfrak{s}}}j) =_{\ensuremath{\mathrm{Nat}}}i - ({\ensuremath{\mathfrak{s}}}j)$ by reflexivity of $=_{\ensuremath{\mathrm{Nat}}}$ on natural numbers. Then it follows by properties of operations on natural numbers that ${\ensuremath{\mathfrak{s}}}({\ensuremath{\mathrm{subp}}}\,i\,({\ensuremath{\mathfrak{s}}}j)) =_{\ensuremath{\mathrm{Nat}}}i -
  j$. By Lemma \[lem\_ind\_leibniz\_implies\_eq\] we obtain the thesis.

We have thus completed an inductive proof of $\forall y : {\ensuremath{\mathrm{Nat}}}\,.\,
  \varphi(y)$. Now we use this formula to derive ${\ensuremath{\mathrm{subp}}}\,i\,j\,=\,i-j$ under the assumptions $i : {\ensuremath{\mathrm{Nat}}}$, $j : {\ensuremath{\mathrm{Nat}}}$, $i \ge j$. Then it remains to apply implication introduction and $\forall$-introduction twice.

In the logic of PVS [@RushbyOwreShankar1998] one may define ${\ensuremath{\mathrm{subp}}}$ by specifying its domain precisely using predicate subtypes and dependent types, somewhat similarly to what is done here. However, an important distinction is that we do not require a domain specification to be a part of the definition. In an interactive theorem prover based on our formalism no proof obligations would need to be generated to establish termination of ${\ensuremath{\mathrm{subp}}}$ on its domain.

Note that because domain specification is not part of the definition of ${\ensuremath{\mathrm{subp}}}$, we may easily derive $\varphi \equiv \forall i, j : {\ensuremath{\mathrm{Nat}}}\,.\, \left(\left({\ensuremath{\mathrm{subp}}}\, i\, j = i - j\right) \vee
  \,\left({\ensuremath{\mathrm{subp}}}\,j\, i = j - i\right)\right)$. This is not possible in PVS because the formula $\varphi$ translated to PVS generates false proof obligations [@RushbyOwreShankar1998].

The next example is a well-known “challenge” posed by McCarthy: $$f(n) = {\ensuremath{\mathrm{Cond}\,(n > 100)\,(n - 10)\,(f(f(n + 11)))\,}}$$ For $n \le 101$ we have $f(n) = 91$, which fact may be proven by induction on $101 - n$. This function is interesting because of its use of nested recursion. Termination behavior of a nested recursive function may depend on its functional behavior, which makes reasoning about termination and function value interdependent. This creates problems for systems with definitional restrictions of possible forms of recursion. Below we give an indication of how a formal proof of $\forall n : {\ensuremath{\mathrm{Nat}}}\,.\, n \le 101 \supset f(n) = 91$ may be derived in ${\ensuremath{{\cal I}}}_s$. Lemma \[lem\_nat\_op\_well\_defined\] is used implicitly with implication introduction.

Let $\varphi(y) \equiv \forall n : {\ensuremath{\mathrm{Nat}}}\,.\, n \le 101 \supset 101 - n
  \le y \supset f(n) = 91$. We prove $\forall y : {\ensuremath{\mathrm{Nat}}}\,.\, \varphi(y)$ by induction on $y$.

In the base step we need to prove $f(n) = 91$ under the assumptions $n : {\ensuremath{\mathrm{Nat}}}$, $n \le 101$ and $101 - n \le y = 0$. We have $n =_{\ensuremath{\mathrm{Nat}}}101$, hence $n = 101$, and the thesis follows by simple computation.

In the inductive step we distinguish three cases:

1.  $n + 11 > 101$ and $n < 101$,

2.  $n + 11 > 101$ and $n \ge 101$,

3.  $n + 11 \le 101$.

We need to prove $f(n) = 91$ under the assumptions of the inductive hypothesis $y : {\ensuremath{\mathrm{Nat}}}, \forall m : {\ensuremath{\mathrm{Nat}}}\,.\, m \le 101 \supset 101 -
  m \le y \supset f(m) = 91$, and of $n : {\ensuremath{\mathrm{Nat}}}$, $n \le 101$ and $101
  - n \le ({\ensuremath{\mathfrak{s}}}y)$.

In the first case we have $f(n + 11) = n + 1$ and $n + 1 \le
  101$. Hence by the inductive hypothesis we conclude $100 - n \le y
  \supset f(n + 1) = 91$. From $101 - n \le {\ensuremath{\mathfrak{s}}}y$ we infer $100 - n
  \le y$, and hence $f(n + 1) = 91$. Since $n \le 100$ it follows by computation that $f(n) = f(f(n + 11)) = f(n + 1) = 91$.

In the second case $n = 101$ and the thesis follows by simple computation.

In the third case, from $101 - n \le {\ensuremath{\mathfrak{s}}}y$ we infer $101 - (n + 11)
  \le y$. Since $n + 11 \le 101$ we conclude by the inductive hypothesis that $f(n + 11) = 91$. Because $n + 11 \le 101$, so $n
  \le 100$, and by definition we infer $f(n) = f(f(n + 11)) =
  f(91)$. Now we simply compute $f(91) = f(f(102)) = f(92) = f(f(103))
  = \ldots = f(100) = f(f(111)) = f(101) = 91$ (i.e. we apply rules for $\mbox{Eq}$ and rules for the conditional an appropriate number of times).

This concludes the inductive proof of $\forall y : {\ensuremath{\mathrm{Nat}}}\,.\, \forall n
  : {\ensuremath{\mathrm{Nat}}}\,.\, n \le 101 \supset 101 - n \le y \supset f(n) = 91$. Having this it is not difficult to show $\forall n : {\ensuremath{\mathrm{Nat}}}\,.\, n \le 101
  \supset f(n) = 91$.

Note that the computation of $f(91)$ in the inductive step relies on the fact that in our logic values of functions may always be computed for specific arguments, regardless of what we know about the function, regardless of whether it terminates in general.

Related Work {#sec_related}
============

In this section we discuss the relationship between ${\ensuremath{{\cal I}}}_s$ and the traditional illative system ${\ensuremath{{\cal I}}}_\omega$. We also briefly survey some approaches to dealing with partiality and general recursion in proof assistants. A general overview of the literature relevant to this problem may be found in [@BoveKraussSozeau2012].

Relationship with Systems of Illative Combinatory Logic
-------------------------------------------------------

In terms of the features provided, the system ${\ensuremath{{\cal I}}}_s$ may be considered an extension of ${\ensuremath{{\cal I}}}_\omega$ from [@Czajka2013Accepted]. However, there are some technical differences between ${\ensuremath{{\cal I}}}_s$ and traditional systems of illative combinatory logic. For one thing, traditional systems strive to use as few constants and rules as possible. For instance, ${\ensuremath{{\cal I}}}_\omega$ has only two primitive constants, disregarding constants representing base types. Because of this in ${\ensuremath{{\cal I}}}_\omega$ e.g. ${\ensuremath{\mathrm{Is}\,=\,\lambda\,}} xy \,.\, y x$ and ${\ensuremath{\mathrm{Prop}}}= \lambda x \,.\, {\ensuremath{\mathrm{Type}}}(\lambda y . x)$, using the notation of the present paper. Moreover, the names of the primitive constants and the notations employed when discussing traditional illative systems are not in common use today. We will not explain these technicalities in any more detail. The reader may consult [@Seldin2009; @illat01; @Czajka2013Accepted] for more information on illative combinatory logic.

The system ${\ensuremath{{\cal I}}}_\omega$ from [@Czajka2013Accepted] is a direct extension of ${\ensuremath{{\cal I}}}\Xi$ from [@illat01] to higher-order logic. The ideas behind ${\ensuremath{{\cal I}}}_\omega$ date back to [@Bunder1983], or even earlier as far as the general form of restrictions in inference rules is concerned.

Below we briefly describe a system ${\ensuremath{{\cal I}}}_\omega'$ which is a variant of ${\ensuremath{{\cal I}}}_\omega$ adapted to our notation. It differs somewhat from ${\ensuremath{{\cal I}}}_\omega$, mostly by taking more constants as primitive, and thus having more rules and axioms. However, we believe that despite these differences it is reasonably close to ${\ensuremath{{\cal I}}}_\omega$ and shares its essential properties.

The terms of ${\ensuremath{{\cal I}}}_\omega'$ are those of ${\ensuremath{{\cal I}}}_s$, except that we do not allow subtypes, inductive types, Eq, Cond, $\vee$, $\bot$ and $\epsilon$. There are also additional primitive constants: $\omega$ (the type of all terms), $\varepsilon$ (the empty type) and $\supset$. The axioms are: $\Gamma, \varphi {\ensuremath{\vdash}}\varphi$, $\Gamma {\ensuremath{\vdash}}{\ensuremath{\mathrm{Prop}}}: {\ensuremath{\mathrm{Type}}}$, $\Gamma {\ensuremath{\vdash}}\varepsilon : {\ensuremath{\mathrm{Type}}}$, $\Gamma {\ensuremath{\vdash}}\omega : {\ensuremath{\mathrm{Type}}}$, $\Gamma {\ensuremath{\vdash}}t : \omega$. The rules are: $\forall_i$, $\forall_e$, $\forall_t$, $\supset_i$, $\supset_e$, $\supset_t$, $\to_i$, $\to_e$, $\to_t$, $p_i$, and the rules:

[lr]{} $
\mathrm{conv}: \inferrule{
  \Gamma {\ensuremath{\vdash}}\varphi \\ \varphi =_\beta \psi
}{
  \Gamma {\ensuremath{\vdash}}\psi
}
$ & $
\varepsilon_\bot: \inferrule{
  \Gamma {\ensuremath{\vdash}}t : \varepsilon
}{
  \Gamma {\ensuremath{\vdash}}\bot
}
$\
&\

Here $\varphi =_\beta \psi$ is a meta-level side-condition expressing $\beta$-equivalence of the terms $\varphi$ and $\psi$.

Partiality and Recursion in Proof Assistants
--------------------------------------------

Perhaps the most common way of dealing with recursion in interactive theorem provers is to impose certain syntactic restrictions on the form of recursive definitions so as to guarantee well-foundedness. For instance, the [**fix**]{} construct in Coq allows for structurally recursive definitions whose well-foundedness must be checked by a built-in automatic syntactic termination checker. Some systems, e.g. ACL2 or PVS, pass the task of proving termination to the user. Such systems require that a well-founded relation or a measure be given with each recursive function definition. Then the system generates so called proof obligations, or termination conditions, which state that the recursive calls are made on smaller arguments. The user must solve, i.e. prove, these obligations.

The method of restricting possible forms of recursive definitions obviously works only for total functions. If a function does not in fact terminate on some elements of its specified domain, then it cannot be introduced by a well-founded definition. One solution is to use a rich type system, e.g. dependent types combined with predicate subtyping, to precisely specify function domains so as to rule out the arguments on which the function does not terminate. This approach is adopted by PVS [@RushbyOwreShankar1998]. A related method of introducing general recursive functions in constructive type theory is to first define a special inductive accessibility predicate which precisely characterises the domain [@BoveCapretta2005]. The function is then defined by structural recursion on the proof that the argument satisfies the accessibility predicate.

A different approach to dealing with partiality and general recursion is to use a special logic which allows partial functions directly. Systems adopting this approach are often based on variants of the logic of partial terms of Beeson [@Feferman1995], [@Beeson1986b]. For instance, the IMPS interactive theorem prover [@FarmerGuttmanThayer1993] uses Farmer’s logic PF of partial functions [@Farmer1990], which is essentially a variant of the logic of partial terms adapted to higher-order logic. In these logics there is an additional definedness predicate which enables direct reasoning about definedness of terms.

The above gives only a very brief overview. There are many approaches to the problem of partiality and general recursion in interactive theorem provers, most of which we didn’t mention. We do not attempt here to provide a detailed comparison with a multitude of existing approaches or give in-depth arguments in favor of our system. For such arguments to be entirely convincing, they would need to be backed up by extensive experimentation in proving properties of sizable programs using a proof assistant based on our logic. No such proof assistants yet exist and no such experimentation has been undertaken. In contrast, our interest is theoretical.

Conclusion
==========

We have presented a system ${\ensuremath{{\cal I}}}_s$ of classical higher-order illative $\lambda$-calculus with subtyping and basic inductive types. A distinguishing characteristic of ${\ensuremath{{\cal I}}}_s$ is that it is based on the untyped $\lambda$-calculus. Therefore, it allows recursive definitions of potentially non-terminating functions directly. The inference rules of ${\ensuremath{{\cal I}}}_s$ are formulated in a way that makes it possible to apply them even when some of the terms used in the premises have not been proven to belong to any type. Additionally, our system may be considered an extension of ordinary higher-order logic, obtained by relaxing the typing restrictions on allowable $\lambda$-terms. We believe these facts alone make it relevant to the problem of partiality and recursion in proof assistants, and the system at least deserves some attention.

Some open problems related to ${\ensuremath{{\cal I}}}_s$ are as follows.

1.  Is ${\ensuremath{{\cal I}}}_s$ conservative over higher-order logic (Conjecture \[conj\_conservative\_hol\])?

2.  How to best incorporate a broader class of inductive types than just basic inductive types, e.g. all strictly positive inductive types?

3.  How far is it possible to broaden the class of allowed types and still have a consistency proof in ZFC? For instance, in our model construction we could try naively interpreting dependent types by set-theoretic cartesian products when constructing the set ${\ensuremath{{\cal T}}}$ (see the overview of the consistency proof in Sect. \[sec\_consistent\]), but we would run out of sets. We conjecture that our construction may be modified to incorporate dependent types in the way indicated if we work in ZFC with one strongly inaccessible cardinal. This modification should not pose any fundamental difficulties. Is it possible prove consistency of ${\ensuremath{{\cal I}}}_s$ with dependent types in plain ZFC?

4.  Can the premises $\Gamma {\ensuremath{\vdash}}\varphi : {\ensuremath{\mathrm{Prop}}}$ in the rules $c_3$ and $c_4$ be removed?

5.  Can the premise $\Gamma {\ensuremath{\vdash}}\varphi : {\ensuremath{\mathrm{Prop}}}$ in the rule $c_5$ be removed?

Note that the premises $\Gamma {\ensuremath{\vdash}}\varphi : {\ensuremath{\mathrm{Prop}}}$ cannot be removed in $c_3$, $c_4$ and $c_5$ simultaneously. Let $\varphi$ be such that $\varphi = \neg \varphi$. Since $\varphi {\ensuremath{\vdash}}\bot$ and $\neg\varphi {\ensuremath{\vdash}}\bot$, it is easy to see that we would have both ${\ensuremath{\vdash}}{\ensuremath{\mathrm{Cond}\,\varphi\,\top\,\bot\,}} = \top$ and ${\ensuremath{\vdash}}{\ensuremath{\mathrm{Cond}\,\varphi\,\top\,\bot\,}} = \bot$.

Derived Rules for Implication {#app_logic}
=============================

In all derivations in this and subsequent sections we omit certain steps and rule assumptions, simplify inferences, and generally only give sketches of completely formal proofs, omitting the parts which may be easily reconstructed by the reader.

\[lem\_01\] If $\Gamma, \varphi {\ensuremath{\vdash}}\psi$, where $x \notin FV(\Gamma,
 \varphi, \psi)$ and $y \notin FV(\varphi)$, then $\Gamma, x : {\ensuremath{\{ y
   : {\ensuremath{\mathrm{Prop}}}\;|\; \varphi \}}} {\ensuremath{\vdash}}\psi$.

Straightforward induction on the length of derivation, using rule $s_e$ to show that $\Gamma {\ensuremath{\vdash}}x : {\ensuremath{\{ y :
    {\ensuremath{\mathrm{Prop}}}\;|\; \varphi \}}}$ implies $\Gamma {\ensuremath{\vdash}}\varphi$, if $x \notin
  FV(\Gamma, \varphi)$ and $y \notin FV(\varphi)$.

Now the rules for $\supset$ are derived as follows.

The rule $$\supset_i:\;
\inferrule{
  \Gamma {\ensuremath{\vdash}}\varphi : {\ensuremath{\mathrm{Prop}}}\\ \Gamma, \varphi {\ensuremath{\vdash}}\psi
}{
  \Gamma {\ensuremath{\vdash}}\varphi \supset \psi
}$$ follows by $$\inferrule*{
  \inferrule*{
  }{\Gamma {\ensuremath{\vdash}}{\ensuremath{\mathrm{Prop}}}: {\ensuremath{\mathrm{Type}}}} \\
  \inferrule*{
    \Gamma {\ensuremath{\vdash}}\varphi : {\ensuremath{\mathrm{Prop}}}\\
    y \notin FV(\Gamma, \varphi)
  }{
    \Gamma, y : {\ensuremath{\mathrm{Prop}}}{\ensuremath{\vdash}}\varphi : {\ensuremath{\mathrm{Prop}}}}
}{
  \Gamma {\ensuremath{\vdash}}{\ensuremath{\{ y : {\ensuremath{\mathrm{Prop}}}\;|\; \varphi \}}} : {\ensuremath{\mathrm{Type}}}} (a)$$ $$\inferrule*{
 (a) \\
  \inferrule*{
    \Gamma, \varphi {\ensuremath{\vdash}}\psi
  }{
    \Gamma, x : {\ensuremath{\{ y : {\ensuremath{\mathrm{Prop}}}\;|\; \varphi \}}} {\ensuremath{\vdash}}\psi
  }
}{
  \Gamma {\ensuremath{\vdash}}\forall x : {\ensuremath{\{ y : {\ensuremath{\mathrm{Prop}}}\;|\; \varphi \}}} \,.\, \psi
}$$

The rule $$\supset_e:\;
\inferrule{
  \Gamma {\ensuremath{\vdash}}\varphi \supset \psi \\ \Gamma {\ensuremath{\vdash}}\varphi
}{
  \Gamma {\ensuremath{\vdash}}\psi
}$$ follows by $$\inferrule*{
  \inferrule*{
    \inferrule*{
      \inferrule*{
        \Gamma {\ensuremath{\vdash}}\varphi
      }{
        \Gamma {\ensuremath{\vdash}}\varphi : {\ensuremath{\mathrm{Prop}}}}
    }{
      \ldots
    }
  }{\Gamma {\ensuremath{\vdash}}{\ensuremath{\{ y : {\ensuremath{\mathrm{Prop}}}\;|\; \varphi \}}} : {\ensuremath{\mathrm{Type}}}} \\
  \inferrule*{
    \ldots   }{
    \Gamma {\ensuremath{\vdash}}\bot : {\ensuremath{\mathrm{Prop}}}} \\
  \Gamma {\ensuremath{\vdash}}\varphi \\
  y \notin FV(\Gamma, \varphi)
}{
  \Gamma {\ensuremath{\vdash}}\bot : {\ensuremath{\{ y : {\ensuremath{\mathrm{Prop}}}\;|\; \varphi \}}}
} (b)$$ $$\inferrule*{
  \Gamma {\ensuremath{\vdash}}\forall x : {\ensuremath{\{ y : {\ensuremath{\mathrm{Prop}}}\;|\; \varphi \}}} \,.\, \psi \\ (b)
}{
  \Gamma {\ensuremath{\vdash}}\psi[x / \bot] \;\; (\equiv \psi)
}$$

Finally, the rule $$\supset_t:\;
\inferrule{
  \Gamma {\ensuremath{\vdash}}\varphi : {\ensuremath{\mathrm{Prop}}}\\ \Gamma, \varphi {\ensuremath{\vdash}}\psi : {\ensuremath{\mathrm{Prop}}}}{
  \Gamma {\ensuremath{\vdash}}(\varphi \supset \psi) : {\ensuremath{\mathrm{Prop}}}}$$ follows by $$\inferrule*{
  \inferrule*{
  }{\Gamma {\ensuremath{\vdash}}{\ensuremath{\mathrm{Prop}}}: {\ensuremath{\mathrm{Type}}}} \\
  \inferrule*{
    \Gamma {\ensuremath{\vdash}}\varphi : {\ensuremath{\mathrm{Prop}}}\\
    y \notin FV(\Gamma, \varphi)
  }{
    \Gamma, y : {\ensuremath{\mathrm{Prop}}}{\ensuremath{\vdash}}\varphi : {\ensuremath{\mathrm{Prop}}}}
}{
  \Gamma {\ensuremath{\vdash}}{\ensuremath{\{ y : {\ensuremath{\mathrm{Prop}}}\;|\; \varphi \}}} : {\ensuremath{\mathrm{Type}}}} (c)$$ $$\inferrule*{
  (c) \\
  \inferrule*{
    \Gamma, \varphi {\ensuremath{\vdash}}\psi : {\ensuremath{\mathrm{Prop}}}}{
    \Gamma, x : {\ensuremath{\{ y : {\ensuremath{\mathrm{Prop}}}\;|\; \varphi \}}} {\ensuremath{\vdash}}\psi : {\ensuremath{\mathrm{Prop}}}}\;\raisebox{0.7em}{($\star$)}
}{
  \Gamma {\ensuremath{\vdash}}(\forall x : {\ensuremath{\{ y : {\ensuremath{\mathrm{Prop}}}\;|\; \varphi \}}} \,.\, \psi) : {\ensuremath{\mathrm{Prop}}}}$$ where we use Lemma \[lem\_01\] to perform the inference ($\star$).

Proofs for Section \[sec\_induction\] {#sec_proofs_induction}
=====================================

\[lem\_constr\_type\] If $c_i^\iota \in {\ensuremath{{\cal C}}}$ of arity $n_i$ has signature $\langle
  \iota_1,\ldots,\iota_{n_i} \rangle$ then ${\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} c_i^\iota :
  \iota_1^* \to \ldots \to \iota_{n_i}^* \to \iota$.

Follows directly from rules $i_t^{\iota,i}$ and $\to_i$, and from axiom 4 ($\Gamma {\ensuremath{\vdash}}\iota : {\ensuremath{\mathrm{Type}}}$ for $\iota \in {\ensuremath{{\cal T}}}_I$).

\[lem\_destr\_test\_type\] ${\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} o_i^\iota : \iota \to {\ensuremath{\mathrm{Prop}}}$ and ${\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s}
  \forall x : \iota \,.\, o_i^\iota x \supset (d_{i,j}^\iota x :
  \iota_{i,j}^*)$

We first show $\forall x : \iota \,.\, o_i^\iota x : {\ensuremath{\mathrm{Prop}}}$ by induction. Once we have this, to derive ${\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} o_i^\iota :
  \iota \to {\ensuremath{\mathrm{Prop}}}$ it suffices to apply $\forall_e$ and $\to_i$. Because ${\ensuremath{\vdash}}o_i^\iota (c_i^\iota x_1 \ldots
  x_{n_i})$ by axiom 5 and ${\ensuremath{\vdash}}\neg (o_i^\iota (c_j^\iota x_1
  \ldots x_{n_j}))$ for $i \ne j$ by axiom 6, we have ${\ensuremath{\vdash}}(o_i^\iota (c_i^\iota x_1 \ldots x_{n_i})) : {\ensuremath{\mathrm{Prop}}}$ using rule $p_i$, and ${\ensuremath{\vdash}}(o_i^\iota (c_j^\iota x_1 \ldots x_{n_j}))
  : {\ensuremath{\mathrm{Prop}}}$ for $i \ne j$, using rules $p_i$ and $\supset_{t2}$. It is then easy to see that the premises of the rule $i_i^\iota$ are derivable for $t \equiv \lambda x \,.\, o_i^\iota x : {\ensuremath{\mathrm{Prop}}}$.

We show the second claim also by induction. Let $
  \Gamma_i \equiv x_1 : \iota_{i,1}^*, \ldots, x_{n_i} :
  \iota_{i,n_i}^*.
  $ Let $1 \le k \le m$, where $m$ is the number of constructors of $\iota$. If $i \ne k$ then $\Gamma_k {\ensuremath{\vdash}}\neg (o_i^\iota
  (c_k^\iota x_1 \ldots x_{n_k}))$. Hence, $\Gamma_k, o_i^\iota
  (c_k^\iota x_1 \ldots x_{n_k}) {\ensuremath{\vdash}}d_{i,j}^\iota (c_k^\iota x_1
  \ldots x_{n_k}) : \iota_{i,j}^*$ by applying rules $\supset_e$ and $\bot_e$. Since ${\ensuremath{\vdash}}o_i^\iota : \iota \to {\ensuremath{\mathrm{Prop}}}$ has already been proven in the previous paragraph, and $\Gamma_k {\ensuremath{\vdash}}(c_k^\iota x_1 \ldots x_{n_k}) : \iota$ by Lemma \[lem\_constr\_type\], we obtain $\Gamma_j {\ensuremath{\vdash}}(o_i^\iota
  (c_j^\iota x_1 \ldots x_{n_j})) : {\ensuremath{\mathrm{Prop}}}$. Thus $\Gamma_k {\ensuremath{\vdash}}o_i^\iota (c_k^\iota x_1 \ldots x_{n_k}) \supset (d_{i,j}^\iota
  (c_k^\iota x_1 \ldots x_{n_k}) : \iota_{i,j}^*)$ by rule $\supset_i$. If $i = k$ then $d_{i,j} (c_k^\iota x_1 \ldots
  x_{n_k}) = x_j$ and thus $\Gamma_k, o_i^\iota (c_k^\iota x_1 \ldots
  x_{n_k}) {\ensuremath{\vdash}}(d_{i,j} (c_k^\iota x_1 \ldots x_{n_k})) :
  \iota_{i,j}^*$ by axiom 1 and rule eq. We then have ${\ensuremath{\vdash}}o_i^\iota (c_k^\iota x_1 \ldots x_{n_k})$, hence ${\ensuremath{\vdash}}(o_i^\iota
  (c_k^\iota x_1 \ldots x_{n_k})) : {\ensuremath{\mathrm{Prop}}}$ by $p_i$, and thus we may use $\supset_i$ to derive $\Gamma_k {\ensuremath{\vdash}}o_i^\iota (c_k^\iota x_1
  \ldots x_{n_k}) \supset (d_{i,j} (c_k^\iota x_1 \ldots x_{n_k})) :
  \iota_{i,j}^*$. Therefore, by applying weakening we derive the premises of rule $i_i^\iota$. Hence, we obtain our thesis by $i_i^\iota$.

\[lem\_ind\_eq\] If $\iota \in {\ensuremath{{\cal T}}}_I$ then ${\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} \forall x, y : \iota \,.\,
  x =_\iota y \supset x = y$.

We prove this lemma by induction in the meta-theory on the structure of $\iota \in {\ensuremath{{\cal T}}}_I$.

Let $\varphi(x) \equiv \forall y : \iota \,.\, x =_\iota y \supset x
  = y$ and $$\Gamma_i^x \equiv x_1 : \iota_{i,1}^*, \ldots, x_{n_i} :
  \iota_{i,n_i}^*, \varphi(x_{j_{i,1}}), \ldots, \varphi(x_{j_{i,k_i}})$$ where $j_{i,1},\ldots,j_{i,k_i}$ are all indices $j$ such that $\iota_{i,j} = \star$, as in the conditions for rule $i_i^\iota$. It suffices to show $\Gamma_i^x {\ensuremath{\vdash}}\varphi(c_i^\iota x_1 \ldots
  x_{n_i})$ for $i=1,\ldots,m$. Then ${\ensuremath{\vdash}}\forall x, y : \iota
  \,.\, x =_\iota y \supset x = y$ is obtained by applying rule $i_i^\iota$.

For $i=1,\ldots,m$, we prove $\Gamma_i^x {\ensuremath{\vdash}}\varphi(c_i^\iota
  x_1 \ldots x_{n_i})$, i.e. $$\Gamma_i^x {\ensuremath{\vdash}}\forall y : \iota
  \,.\, (c_i^\iota x_1 \ldots x_{n_i}) =_\iota y \supset (c_i^\iota
  x_1 \ldots x_{n_i}) = y$$ by induction on $y$ (in the theory, i.e. applying rule $i_i^\iota$). Let $$\Gamma_{i,j}^y \equiv y_1 : \iota_{i,1}^*, \ldots, y_{n_i} :
  \iota_{i,n_i}^*, \psi_i(y_{j_{i,1}}), \ldots, \psi_i(y_{j_{i,k_i}})$$ where $$\psi_i(y) \equiv (c_i^\iota x_1 \ldots x_{n_i}) =_\iota y \supset
  (c_i^\iota x_1 \ldots x_{n_i}) = y.$$ It therefore suffices to show $$(\star)\;\;\;\;\;\Gamma_i^x, \Gamma_{i,j}^y {\ensuremath{\vdash}}(c_i^\iota x_1 \ldots x_{n_i})
  =_\iota (c_j^\iota y_1 \ldots y_{n_j}) \supset (c_i^\iota x_1 \ldots
  x_{n_i}) = (c_j^\iota y_1 \ldots y_{n_j})$$ for all $i=1,\ldots,m$, $j=1,\ldots,m$.

Thus assume $1 \le i \le m$ and $1 \le j \le m$. By Lemma \[lem\_constr\_type\] we have $
  \Gamma_i^x {\ensuremath{\vdash}}(c_i^\iota x_1 \ldots x_{n_i}) : \iota
  $ and $
  \Gamma_i^x, \Gamma_{i,j}^y {\ensuremath{\vdash}}(c_j^\iota y_1 \ldots y_{n_j}) : \iota.
  $ Thus by Lemma \[lem\_leibniz\] we obtain $$\begin{array}{lr}
  (\star\star)\;\;\;\;\; & \Gamma_i^x, \Gamma_{i,j}^y {\ensuremath{\vdash}}((c_i^\iota x_1 \ldots
    x_{n_i}) =_\iota (c_j^\iota y_1 \ldots y_{n_j})) : {\ensuremath{\mathrm{Prop}}}.
  \end{array}$$ For $k=1,\ldots,n_i$ take $$f_k = \lambda x \,.\, {\ensuremath{\mathrm{Cond}\,(o_i^\iota x)\,(d_{i,k}^\iota x
    =_{\iota_{i,k}^*} x_k)\,\bot\,}}.$$

Assume $1 \le k \le n_i$. Since $o_i^\iota : \iota \to {\ensuremath{\mathrm{Prop}}}$ by Lemma \[lem\_destr\_test\_type\], we obtain $x : \iota {\ensuremath{\vdash}}(o_i^\iota x) \lor \neg (o_i^\iota x)$ by $\to_e$ and the law of excluded middle. It is easy to derive $x : \iota, \neg (o_i^\iota x)
  {\ensuremath{\vdash}}f_k x : {\ensuremath{\mathrm{Prop}}}$ using the rules for  and . By Lemma \[lem\_destr\_test\_type\] we also have $x
  : \iota, o_i^\iota x {\ensuremath{\vdash}}d_{i,k}^\iota x : \iota_{i,k}^*$. We have $\Gamma_i^x {\ensuremath{\vdash}}x_k : \iota_{i,k}^*$ by definition of $\Gamma_i^x$. Then $\Gamma_i^x, x : \iota, o_i^\iota x {\ensuremath{\vdash}}(d_{i,k}^\iota x =_{\iota_{i,k}^*} x_k) : {\ensuremath{\mathrm{Prop}}}$ follows from Lemma \[lem\_leibniz\]. Using rule $\vee_e$ it is now easy to derive $\Gamma_i^x, x : \iota {\ensuremath{\vdash}}f_k x : {\ensuremath{\mathrm{Prop}}}$. Since ${\ensuremath{\vdash}}\iota : {\ensuremath{\mathrm{Type}}}$, we obtain $\Gamma_i^x {\ensuremath{\vdash}}f_k : \iota \to {\ensuremath{\mathrm{Prop}}}$ by rule $\to_i$.

Suppose $i = j$. Assume $1 \le k \le n_i$. Because $\Gamma_i^x
  {\ensuremath{\vdash}}f_k : \iota \to {\ensuremath{\mathrm{Prop}}}$, by definition of $=_\iota$ we have $$\Gamma_i^x,\Gamma_{i,i}^y,(c_i^\iota x_1 \ldots x_{n_i})
  =_\iota (c_i^\iota y_1 \ldots y_{n_i}) {\ensuremath{\vdash}}(f_k (c_i^\iota x_1
  \ldots x_{n_i})) \supset (f_k (c_i^\iota y_1 \ldots y_{n_i}))$$ We have $
  \Gamma_i^x {\ensuremath{\vdash}}(f_k (c_i^\iota x_1
  \ldots x_{n_i})) = (x_k =_\iota x_k)
  $. Hence $ \Gamma_i^x {\ensuremath{\vdash}}f_k (c_i^\iota x_1 \ldots x_{n_i})
  $. Because $$\Gamma_i^x, \Gamma_{i,i}^y {\ensuremath{\vdash}}(f_k (c_i^\iota y_1 \ldots
  y_{n_i})) = (y_k =_{\iota_{i,k}^*} x_k)$$ we thus obtain $$\Gamma_i^x,\Gamma_{i,i}^y,(c_i^\iota x_1 \ldots x_{n_i}) =_\iota
  (c_i^\iota y_1 \ldots y_{n_i}) {\ensuremath{\vdash}}y_k =_{\iota_{i,k}^*} x_k.$$ If $\iota_{i,k}^* = \iota$ then $\Gamma_i^x {\ensuremath{\vdash}}\forall y :
  \iota \,.\, x_k =_\iota y \supset x_k = y$ and $\Gamma_i^x,
  \Gamma_{i,i}^y {\ensuremath{\vdash}}y_k : \iota$. Hence $\Gamma_i^x,\Gamma_{i,i}^y {\ensuremath{\vdash}}x_k = y_k$. If $\iota_{i,k}^* =
  \iota_{i,k}$ then by the inductive hypothesis in the meta-theory we obtain ${\ensuremath{\vdash}}\forall x, y : \iota_{i,k} \,.\, x =_{\iota_{i,k}} y
  \supset x = y$, which again implies $\Gamma_i^x,\Gamma_{i,i}^y
  {\ensuremath{\vdash}}x_k = y_k$, because $\Gamma_i^x {\ensuremath{\vdash}}x_k : \iota_{i,k}$ and $\Gamma_{i,i}^y {\ensuremath{\vdash}}y_k : \iota_{i,k}$. Since $1 \le k \le
  n_i$ was arbitrary, we obtain $$\Gamma_i^x,\Gamma_{i,i}^y,(c_i^\iota x_1 \ldots x_{n_i}) =_\iota
  (c_i^\iota y_1 \ldots y_{n_i}) {\ensuremath{\vdash}}(c_i^\iota x_1 \ldots x_{n_i}) =
  (c_i^\iota y_1 \ldots y_{n_i}).$$ By $(\star\star)$ and $\supset_i$ we obtain $(\star)$ for $i=j$.

Suppose $i \ne j$. Assume $1 \le k \le n_i$. Because $\Gamma_i^x
  {\ensuremath{\vdash}}f_k : \iota \to {\ensuremath{\mathrm{Prop}}}$, by definition of $=_\iota$ we have $$\Gamma_i^x,\Gamma_{i,j}^y,(c_i^\iota x_1 \ldots x_{n_i})
  =_\iota (c_j^\iota y_1 \ldots y_{n_i}) {\ensuremath{\vdash}}(f_k (c_i^\iota x_1
  \ldots x_{n_i})) \supset (f_k (c_j^\iota y_1 \ldots y_{n_j}))$$ As in the case $i = j$ we have $\Gamma_i^x {\ensuremath{\vdash}}(f_k (c_i^\iota x_1
  \ldots x_{n_i}))$. Because $i \ne j$ we have $$\Gamma_i^x,\Gamma_{i,j}^\iota {\ensuremath{\vdash}}(f_k (c_j^\iota y_1 \ldots
  y_{n_j})) = \bot.$$ Therefore $$\Gamma_i^x,\Gamma_{i,j}^y,(c_i^\iota x_1 \ldots x_{n_i})
  =_\iota (c_j^\iota y_1 \ldots y_{n_i}) {\ensuremath{\vdash}}\bot.$$ By rule $\bot_e$ we conclude $$\Gamma_i^x,\Gamma_{i,j}^y,(c_i^\iota x_1 \ldots x_{n_i})
  =_\iota (c_j^\iota y_1 \ldots y_{n_i}) {\ensuremath{\vdash}}(c_i^\iota x_1 \ldots x_{n_i}) =
  (c_j^\iota y_1 \ldots y_{n_j})$$ By $(\star\star)$ and $\supset_i$ we obtain $(\star)$ for $i \ne
  j$. This finishes the proof.

\[lem\_nat\_peano\_3\] ${\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} \forall x : {\ensuremath{\mathrm{Nat}}}\,.\, \left(({\ensuremath{\mathfrak{0}}}x) \vee \exists y
  : {\ensuremath{\mathrm{Nat}}}\,.\, x = ({\ensuremath{\mathfrak{s}}}y)\right)$.

Recall that $x = {\ensuremath{\mathfrak{s}}}y$ stands for ${\ensuremath{\mathrm{Eq}\,x\,({\ensuremath{\mathfrak{s}}}y)\,}}$. Let $\varphi(x)
  \equiv ({\ensuremath{\mathfrak{0}}}x) \vee \exists y : {\ensuremath{\mathrm{Nat}}}\,.\, x = {\ensuremath{\mathfrak{s}}}y$. We have the following derivation. $$\inferrule*{
    \inferrule*{
      {\ensuremath{\vdash}}{\ensuremath{\mathfrak{0}}}0
    }{
      {\ensuremath{\vdash}}\varphi(0)
    } \\
    \inferrule*{
      \inferrule*{
        x : {\ensuremath{\mathrm{Nat}}}, \varphi(x) {\ensuremath{\vdash}}{\ensuremath{\mathfrak{s}}}x = {\ensuremath{\mathfrak{s}}}x
        \\ x : {\ensuremath{\mathrm{Nat}}}, \varphi(x) {\ensuremath{\vdash}}x : {\ensuremath{\mathrm{Nat}}}}{
        x : {\ensuremath{\mathrm{Nat}}}, \varphi(x) {\ensuremath{\vdash}}\exists y : {\ensuremath{\mathrm{Nat}}}\,.\, {\ensuremath{\mathfrak{s}}}x = {\ensuremath{\mathfrak{s}}}y
      }
    }{
      x : {\ensuremath{\mathrm{Nat}}}, \varphi(x) {\ensuremath{\vdash}}\varphi({\ensuremath{\mathfrak{s}}}x)
    }
  }{
    {\ensuremath{\vdash}}\forall x : {\ensuremath{\mathrm{Nat}}}\,.\, \left(({\ensuremath{\mathfrak{0}}}x) \vee \exists y : {\ensuremath{\mathrm{Nat}}}\,.\, x = {\ensuremath{\mathfrak{s}}}y\right)
  }\;\raisebox{0.7em}{by $n_i$}$$

\[lem\_iszero\_eq\] ${\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} \forall x : {\ensuremath{\mathrm{Nat}}}\,.\, ({\ensuremath{\mathfrak{0}}}x) \supset (x = 0)$.

Let $\varphi(x) \equiv ({\ensuremath{\mathfrak{0}}}x) \supset (x = 0)$. $$\inferrule*{
    \inferrule*{
      {\ensuremath{\vdash}}{\ensuremath{\mathfrak{0}}}0
    }{
      {\ensuremath{\vdash}}({\ensuremath{\mathfrak{0}}}0) : {\ensuremath{\mathrm{Prop}}}} \\
    {\ensuremath{\mathfrak{0}}}0 {\ensuremath{\vdash}}0 = 0
  }{
    {\ensuremath{\vdash}}\varphi(0)
  }(a)$$ $$\inferrule*{
    \inferrule*{
      \inferrule*{
        x : {\ensuremath{\mathrm{Nat}}}, \varphi(x) {\ensuremath{\vdash}}\neg ({\ensuremath{\mathfrak{0}}}({\ensuremath{\mathfrak{s}}}x))
      }{
        x : {\ensuremath{\mathrm{Nat}}}, \varphi(x) {\ensuremath{\vdash}}\neg ({\ensuremath{\mathfrak{0}}}({\ensuremath{\mathfrak{s}}}x)) : {\ensuremath{\mathrm{Prop}}}}
    }{
      x : {\ensuremath{\mathrm{Nat}}}, \varphi(x) {\ensuremath{\vdash}}{\ensuremath{\mathfrak{0}}}({\ensuremath{\mathfrak{s}}}x) : {\ensuremath{\mathrm{Prop}}}}
    \\
    \inferrule*{
      x : {\ensuremath{\mathrm{Nat}}}, \varphi(x), {\ensuremath{\mathfrak{0}}}({\ensuremath{\mathfrak{s}}}x) {\ensuremath{\vdash}}\bot
    }{
      x : {\ensuremath{\mathrm{Nat}}}, \varphi(x), {\ensuremath{\mathfrak{0}}}({\ensuremath{\mathfrak{s}}}x) {\ensuremath{\vdash}}{\ensuremath{\mathfrak{s}}}x = 0
    }
  }{
    x : {\ensuremath{\mathrm{Nat}}}, \varphi(x) {\ensuremath{\vdash}}\varphi({\ensuremath{\mathfrak{s}}}x)
  } (b)$$ $$\inferrule*{
    (a)
    \\
    (b)
  }{
    {\ensuremath{\vdash}}\forall x : {\ensuremath{\mathrm{Nat}}}\,.\, ({\ensuremath{\mathfrak{0}}}x) \supset (x = 0)
  }$$

The following terms are derivable in the system ${\ensuremath{{\cal I}}}_s$:

-   $\forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, (x + y) : {\ensuremath{\mathrm{Nat}}}$,

-   $\forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, (x - y) : {\ensuremath{\mathrm{Nat}}}$,

-   $\forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, (x {\ensuremath{\cdot}}y) : {\ensuremath{\mathrm{Nat}}}$,

-   $\forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, (x \le y) : {\ensuremath{\mathrm{Prop}}}$,

-   $\forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, (x < y) : {\ensuremath{\mathrm{Prop}}}$.

We give a sample proof for the first term. $$\inferrule*{
    \inferrule*{
      x : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}(x + 0) = ((\lambda x \,.\, x) x)
    }{
      x : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}(x + 0) = x
    } \\ x : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}x : {\ensuremath{\mathrm{Nat}}}}{
    x : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}(x + 0) : {\ensuremath{\mathrm{Nat}}}} \; (a)$$ $$\inferrule*{
      x : {\ensuremath{\mathrm{Nat}}}, y : {\ensuremath{\mathrm{Nat}}}, (x + y) : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}(x + y) : {\ensuremath{\mathrm{Nat}}}}{
      x : {\ensuremath{\mathrm{Nat}}}, y : {\ensuremath{\mathrm{Nat}}}, (x + y) : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}({\ensuremath{\mathfrak{s}}}(x + y)) : {\ensuremath{\mathrm{Nat}}}} \; (b)$$ $$\inferrule*{
    x : {\ensuremath{\mathrm{Nat}}}, y : {\ensuremath{\mathrm{Nat}}}, (x + y) : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}x + ({\ensuremath{\mathfrak{s}}}y) = {\ensuremath{\mathfrak{s}}}(x + y)
    \\
    (b)
  }{
    x : {\ensuremath{\mathrm{Nat}}}, y : {\ensuremath{\mathrm{Nat}}}, (x + y) : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}(x + ({\ensuremath{\mathfrak{s}}}y)) : {\ensuremath{\mathrm{Nat}}}} \; (c)$$ $$\inferrule*{
    \inferrule*{
      (a)
      \\ (c)
    }{
      x : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}\forall y : {\ensuremath{\mathrm{Nat}}}\,.\, (x + y) : {\ensuremath{\mathrm{Nat}}}} \\ {\ensuremath{\vdash}}{\ensuremath{\mathrm{Nat}}}: {\ensuremath{\mathrm{Type}}}}{
    {\ensuremath{\vdash}}\forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, (x + y) : {\ensuremath{\mathrm{Nat}}}}$$ The second and third terms are derived in a similar way. The fourth and fifth terms are derived from the second using Lemma \[lem\_constr\_type\].

\[lem\_s\_minus\] ${\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} \forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, \left({\ensuremath{\mathfrak{s}}}x - {\ensuremath{\mathfrak{s}}}y = x -
  y\right)$

We assume $x : {\ensuremath{\mathrm{Nat}}}$ and show $\forall y : {\ensuremath{\mathrm{Nat}}}\,.\, \left({\ensuremath{\mathfrak{s}}}x -
  {\ensuremath{\mathfrak{s}}}y = x - y\right)$ by induction on $y$. For $y = 0$ we have ${\ensuremath{\mathfrak{s}}}x
  - {\ensuremath{\mathfrak{s}}}0 = {\ensuremath{\mathfrak{p}}}({\ensuremath{\mathfrak{s}}}x - 0) = {\ensuremath{\mathfrak{p}}}({\ensuremath{\mathfrak{s}}}x) = x = x - 0$, and under the assumptions $x :{\ensuremath{\mathrm{Nat}}}, y : {\ensuremath{\mathrm{Nat}}}, \left({\ensuremath{\mathfrak{s}}}x - {\ensuremath{\mathfrak{s}}}y\right) = x - y$ we may derive ${\ensuremath{\mathfrak{s}}}x - {\ensuremath{\mathfrak{s}}}({\ensuremath{\mathfrak{s}}}y) = {\ensuremath{\mathfrak{p}}}({\ensuremath{\mathfrak{s}}}x - {\ensuremath{\mathfrak{s}}}y) = {\ensuremath{\mathfrak{p}}}(x - y) = x -
  {\ensuremath{\mathfrak{s}}}y$. By rule $n_i$ we obtain the thesis.

\[lem\_le\_ge\_then\_eq\] ${\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} \forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, (x \ge y) \wedge (x \le y)
  \supset (x =_{\ensuremath{\mathrm{Nat}}}y)$.

Let $\varphi(x) \equiv \forall y : {\ensuremath{\mathrm{Nat}}}\,.\, (x \ge y) \wedge (x
  \le y) \supset (x =_{\ensuremath{\mathrm{Nat}}}y)$. We proceed by induction on $x$.

In the base step we need to show $\varphi(0)$. We assume $y : {\ensuremath{\mathrm{Nat}}}$ and $(0 \ge y) \wedge (0 \le y)$. From $y \le 0$ we have ${\ensuremath{\mathfrak{0}}}(y
  - 0)$, i.e. ${\ensuremath{\mathfrak{0}}}y$, and thus $y = 0$ by Lemma \[lem\_iszero\_eq\]. By rule $p_i$ we have $((0 \ge y) \wedge
  (0 \le y)) : {\ensuremath{\mathrm{Prop}}}$. Hence, we may use implication introduction and then universal quantifier introduction to obtain $\varphi(0)$.

In the inductive step we need to prove $\varphi({\ensuremath{\mathfrak{s}}}x)$ under the assumptions $x : {\ensuremath{\mathrm{Nat}}}$ and $\varphi(x)$. We assume further $y :
  {\ensuremath{\mathrm{Nat}}}$ and $({\ensuremath{\mathfrak{s}}}x \ge y) \wedge ({\ensuremath{\mathfrak{s}}}x \le y)$. By Lemma \[lem\_nat\_peano\_3\] there are two possibilities: $y = 0$ or $\exists z : {\ensuremath{\mathrm{Nat}}}\,.\, y = {\ensuremath{\mathfrak{s}}}z$. If $y = 0$ then we easily obtain ${\ensuremath{\mathfrak{s}}}x = 0$, which leads to a contradiction, from which we may derive $x = y$. If $y = {\ensuremath{\mathfrak{s}}}z$ then we have ${\ensuremath{\mathfrak{s}}}x - {\ensuremath{\mathfrak{s}}}z = 0$ and ${\ensuremath{\mathfrak{s}}}z - {\ensuremath{\mathfrak{s}}}x = 0$. By Lemma \[lem\_s\_minus\] we obtain $x - z = 0$ and $z - x
  = 0$. From the inductive hypothesis we have $x =_{\ensuremath{\mathrm{Nat}}}z$, and hence $x = z$ by Lemma \[lem\_ind\_eq\]. Thus ${\ensuremath{\mathfrak{s}}}x = {\ensuremath{\mathfrak{s}}}z = y$. Since $x
  : {\ensuremath{\mathrm{Nat}}}$ and $y : {\ensuremath{\mathrm{Nat}}}$, it is not difficult to show that $(({\ensuremath{\mathfrak{s}}}x \ge
  y) \wedge ({\ensuremath{\mathfrak{s}}}x \le y)) : {\ensuremath{\mathrm{Prop}}}$. We may therefore use implication introduction and then universal quantifier introduction to obtain $\varphi({\ensuremath{\mathfrak{s}}}x)$.

The following terms are derivable in the system ${\ensuremath{{\cal I}}}_s$:

-   $\forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, \left({\ensuremath{\mathfrak{s}}}x =_{\ensuremath{\mathrm{Nat}}}{\ensuremath{\mathfrak{s}}}y\right)
        \supset \left(x =_{\ensuremath{\mathrm{Nat}}}y\right)$,

-   $\forall x : {\ensuremath{\mathrm{Nat}}}\,.\, \neg ({\ensuremath{\mathfrak{s}}}x =_{\ensuremath{\mathrm{Nat}}}0)$,

-   $\forall x : {\ensuremath{\mathrm{Nat}}}\,.\, (x + 0 =_{\ensuremath{\mathrm{Nat}}}x)$,

-   $\forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, (x + {\ensuremath{\mathfrak{s}}}y =_{\ensuremath{\mathrm{Nat}}}{\ensuremath{\mathfrak{s}}}(x + y))$,

-   $\forall x : {\ensuremath{\mathrm{Nat}}}\,.\, (x {\ensuremath{\cdot}}0 =_{\ensuremath{\mathrm{Nat}}}0)$,

-   $\forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, (x {\ensuremath{\cdot}}({\ensuremath{\mathfrak{s}}}y) =_{\ensuremath{\mathrm{Nat}}}(x {\ensuremath{\cdot}}y)
        + x)$.

All proofs are easy. As an example we give an indication of how the first term may be derived. We assume $x : {\ensuremath{\mathrm{Nat}}}$, $y : {\ensuremath{\mathrm{Nat}}}$ and ${\ensuremath{\mathfrak{s}}}x =_{\ensuremath{\mathrm{Nat}}}{\ensuremath{\mathfrak{s}}}y$. From ${\ensuremath{\mathfrak{s}}}x =_{\ensuremath{\mathrm{Nat}}}{\ensuremath{\mathfrak{s}}}y$ we obtain ${\ensuremath{\mathfrak{s}}}x = {\ensuremath{\mathfrak{s}}}y$ by Lemma \[lem\_ind\_eq\]. We thus obtain $x = {\ensuremath{\mathfrak{p}}}({\ensuremath{\mathfrak{s}}}x) = {\ensuremath{\mathfrak{p}}}({\ensuremath{\mathfrak{s}}}y) =
  y$. Since $x : {\ensuremath{\mathrm{Nat}}}$ and $y : {\ensuremath{\mathrm{Nat}}}$ we have $x =_{\ensuremath{\mathrm{Nat}}}y$ by Lemma \[lem\_leibniz\]. We also have $({\ensuremath{\mathfrak{s}}}x =_{\ensuremath{\mathrm{Nat}}}{\ensuremath{\mathfrak{s}}}y) : {\ensuremath{\mathrm{Prop}}}$ by Lemma \[lem\_constr\_type\] and Lemma \[lem\_nat\_op\_well\_defined\]. Therefore, we may use implication introduction, and then universal quantifier introduction twice, to show $\forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, \left({\ensuremath{\mathfrak{s}}}x =_{\ensuremath{\mathrm{Nat}}}{\ensuremath{\mathfrak{s}}}y\right) \supset \left(x =_{\ensuremath{\mathrm{Nat}}}y\right)$.

\[lem\_nat\_less\] $\Gamma {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} \forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, x < {\ensuremath{\mathfrak{s}}}y \supset (x
  < y \lor x = y)$

Easy induction on $x$, recalling that $x < y \equiv {\ensuremath{\mathfrak{0}}}(x -
  y)$, using Lemma \[lem\_nat\_peano\_3\] for the basis, and Lemma \[lem\_s\_minus\] in the inductive step.

\[lem\_nat\_ind\_2\] The following rule is admissible in ${\ensuremath{{\cal I}}}_s$. $${n_i':}\;\;\;\inferrule{
    \Gamma {\ensuremath{\vdash}}t 0 \\ \Gamma, y : {\ensuremath{\mathrm{Nat}}}, \forall x : {\ensuremath{\mathrm{Nat}}}\,.\, x <
    y \supset t x {\ensuremath{\vdash}}t y \\ x,y \notin FV(\Gamma, t)
  }{
    \Gamma {\ensuremath{\vdash}}\forall x : {\ensuremath{\mathrm{Nat}}}\,.\, t x
  }$$

We show that if the premises are derivable, then so is $\Gamma
  {\ensuremath{\vdash}}\forall y, x : {\ensuremath{\mathrm{Nat}}}\,.\, x < y \supset t x$. We achieve this by deriving the premises of the rule $n_i$ for $\psi(y) \equiv
  \forall x : {\ensuremath{\mathrm{Nat}}}\,.\, x < y \supset t x$. Since $x : {\ensuremath{\mathrm{Nat}}}, x < 0
  {\ensuremath{\vdash}}\bot$ and $x : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}(x < 0) : {\ensuremath{\mathrm{Prop}}}$, we have $\Gamma {\ensuremath{\vdash}}\psi(0)$. By our assumption that the second premise of $n_i'$ is derivable, we have $\Gamma, y : {\ensuremath{\mathrm{Nat}}}, \psi(y) {\ensuremath{\vdash}}t
  y$. Let $\Gamma_1 \equiv \Gamma, y : {\ensuremath{\mathrm{Nat}}}, \psi(y), x : {\ensuremath{\mathrm{Nat}}}, x < {\ensuremath{\mathfrak{s}}}y$. We show $\Gamma_1 {\ensuremath{\vdash}}t x$. By Lemma \[lem\_nat\_less\] we obtain $\Gamma_1 {\ensuremath{\vdash}}x < y \lor x = y$. Since $\Gamma_1 {\ensuremath{\vdash}}\forall x : {\ensuremath{\mathrm{Nat}}}\,.\, x < y \supset t x$ we have $\Gamma_1, x < y
  {\ensuremath{\vdash}}t x$. Since $\Gamma_1 {\ensuremath{\vdash}}t y$ we have $\Gamma_1, x = y
  {\ensuremath{\vdash}}t x$. Using rule $\lor_e$ we obtain $\Gamma_1 {\ensuremath{\vdash}}t
  x$. Since $\Gamma, y : {\ensuremath{\mathrm{Nat}}}, \psi(y), x : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}(x < {\ensuremath{\mathfrak{s}}}y) :
  {\ensuremath{\mathrm{Prop}}}$ we have $\Gamma, y : {\ensuremath{\mathrm{Nat}}}, \psi(y) {\ensuremath{\vdash}}\forall x : {\ensuremath{\mathrm{Nat}}}\,.\, x < {\ensuremath{\mathfrak{s}}}y \supset t x$, i.e. $\Gamma, y : {\ensuremath{\mathrm{Nat}}}, \psi(y) {\ensuremath{\vdash}}\psi({\ensuremath{\mathfrak{s}}}y)$. By applying rule $n_i$ we thus obtain $\Gamma {\ensuremath{\vdash}}\forall y,x : {\ensuremath{\mathrm{Nat}}}\,.\, x < y \supset t x$. Now $\Gamma, x : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}{\ensuremath{\mathfrak{s}}}x : {\ensuremath{\mathrm{Nat}}}$ and $\Gamma, x : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}x < {\ensuremath{\mathfrak{s}}}x$, hence $\Gamma, x : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}t x$. Therefore $\Gamma {\ensuremath{\vdash}}\forall x
  : {\ensuremath{\mathrm{Nat}}}\,.\, t x$.

Suppose $\Gamma {\ensuremath{\vdash}}\forall x_1 : \alpha_1 \ldots \forall x_n :
  \alpha_n \,.\, \varphi_1 \lor \ldots \lor \varphi_m$, $\Gamma
  {\ensuremath{\vdash}}\alpha_j : {\ensuremath{\mathrm{Type}}}$ for $j = 1,\ldots,n$, and for $i=1,\ldots,m$: $\Gamma {\ensuremath{\vdash}}\forall x_1 : \alpha_1 \ldots
  \forall x_n : \alpha_n \,.\, t_i : \beta \to \ldots \to \beta$ where $\beta$ occurs $k_i + 1$ times, $\Gamma {\ensuremath{\vdash}}\forall x_1 :
  \alpha_1 \ldots \forall x_n : \alpha_n \,.\, t_{i,j,k} : \alpha_k$ for $j=1,\ldots,k_i$, $k=1,\ldots,n$, $x_1,\ldots,x_n \notin
  FV(f,\alpha_1,\ldots,\alpha_n,\beta)$ and $$\begin{aligned}
  \Gamma {\ensuremath{\vdash}}\forall x_1 : \alpha_1 \ldots \forall x_n :
  \alpha_n \,.\, \varphi_i &\supset& (f x_1 \ldots x_n = \\ && \;t_i (f t_{i,1,1}
  \ldots t_{i,1,n}) \ldots (f t_{i,k_i,1} \ldots t_{i,k_i,n})).
  \end{aligned}$$ If there is a term $g$ such that $\Gamma {\ensuremath{\vdash}}g : \alpha_1 \to
  \ldots \to \alpha_n \to {\ensuremath{\mathrm{Nat}}}$ and for $i=1,\ldots,m$ $$\begin{aligned}
  \Gamma {\ensuremath{\vdash}}\forall x_1 : \alpha_1 \ldots \forall x_n : \alpha_n
  \,.\, \varphi_i &\supset& (\left((f x_1 \ldots x_n) :
  \beta\right) \lor \\ && \;((g t_{i,1,1} \ldots t_{i,1,n}) < (g x_1 \ldots
  x_n) \land \ldots \land \\ && \;\;(g t_{i,k_i,1} \ldots t_{i,k_i,n}) < (g x_1
  \ldots x_n)))
  \end{aligned}$$ where $x_1,\ldots,x_n \notin FV(g)$, then $$\Gamma {\ensuremath{\vdash}}f : \alpha_1 \to \ldots \to \alpha_n \to \beta.$$

We derive the premises of the rule $n_i'$ for $$\psi(x) \equiv \forall x_1 : \alpha_1 \ldots \forall x_n : \alpha_n
  \,.\, x =_{\ensuremath{\mathrm{Nat}}}(g x_1 \ldots x_n) \supset f x_1 \ldots x_n : \beta.$$ We have $\Gamma, x_1 : \alpha_1,\ldots,x_n : \alpha_n {\ensuremath{\vdash}}\varphi_1 \lor \ldots \lor \varphi_m$. Let $\Gamma_i \equiv \Gamma,
  x_1 : \alpha_1,\ldots,x_n : \alpha_n,\varphi_i$ for $i=1,\ldots,m$. We first prove $\Gamma_i, 0 =_{\ensuremath{\mathrm{Nat}}}(g x_1 \ldots
  x_n) {\ensuremath{\vdash}}f x_1 \ldots x_n : \beta$. It suffices to show $$\begin{aligned}
  \Gamma_i, 0 =_{\ensuremath{\mathrm{Nat}}}(g x_1 \ldots x_n), && ((g t_{i,1,1} \ldots
  t_{i,1,n}) < (g x_1 \ldots x_n) \land \ldots \land \\ && \;(g
  t_{i,k_i,1} \ldots t_{i,k_i,n}) < (g x_1 \ldots x_n)) {\ensuremath{\vdash}}f x_1
  \ldots x_n : \beta.
  \end{aligned}$$ Since ${\ensuremath{\vdash}}g : \alpha_1 \to \ldots \to \alpha_n \to {\ensuremath{\mathrm{Nat}}}$, by Lemma \[lem\_ind\_eq\] and ${\ensuremath{\vdash}}\neg ({\ensuremath{\mathfrak{0}}}({\ensuremath{\mathfrak{s}}}(g
  t_{i,1,1} \ldots t_{i,1,n})))$ we have $$\begin{aligned}
  \Gamma_i, 0 =_{\ensuremath{\mathrm{Nat}}}(g x_1 \ldots x_n), && ((g t_{i,1,1} \ldots
  t_{i,1,n}) < (g x_1 \ldots x_n) \land \ldots \land \\ && \;(g t_{i,k_i,1}
  \ldots t_{i,k_i,n}) < (g x_1 \ldots x_n)) {\ensuremath{\vdash}}\bot.
  \end{aligned}$$ so our claim follows by $\bot_e$. Therefore $\Gamma_i {\ensuremath{\vdash}}0
  =_{\ensuremath{\mathrm{Nat}}}(g x_1 \ldots x_n) \supset (f x_1 \ldots x_n : \beta)$ by ${\ensuremath{\vdash}}g : \alpha_1 \to \ldots \to \alpha_n \to {\ensuremath{\mathrm{Nat}}}$, Lemma \[lem\_nat\_op\_well\_defined\] and $\supset_i$. Since $$\Gamma, x_1 : \alpha_1, \ldots, x_n : \alpha_n {\ensuremath{\vdash}}\varphi_1
  \lor \ldots \lor \varphi_m$$ by $m-1$ applications of $\lor_e$ we obtain $$\Gamma, x_1 : \alpha_1, \ldots, x_n : \alpha_n {\ensuremath{\vdash}}0 =_{\ensuremath{\mathrm{Nat}}}(g
  x_1 \ldots x_n) \supset (f x_1 \ldots x_n : \beta).$$ Because $\Gamma {\ensuremath{\vdash}}\alpha_i : {\ensuremath{\mathrm{Type}}}$ for $i=1,\ldots,n$, we may apply $\forall$-introduction $n$ times to obtain $\Gamma {\ensuremath{\vdash}}\psi(0)$.

Let $$\Gamma' \equiv \Gamma, y : {\ensuremath{\mathrm{Nat}}}, \forall x : {\ensuremath{\mathrm{Nat}}}\,.\, x < y
  \supset \psi(x)$$ and $$\Gamma_i' \equiv \Gamma', x_1 : \alpha_1, \ldots, x_n : \alpha_n,
  \varphi_i.$$ Because $\Gamma', x_1 : \alpha, \ldots, x_n : \alpha_n {\ensuremath{\vdash}}\varphi_1 \lor \ldots \lor \varphi_m$ and $\Gamma' {\ensuremath{\vdash}}\alpha_i
  : {\ensuremath{\mathrm{Type}}}$ for $i=1,\ldots,n$, to derive the second premise of $n_i'$ for $\psi$, it suffices to show $$\Gamma_i' {\ensuremath{\vdash}}y =_{\ensuremath{\mathrm{Nat}}}(g x_1 \ldots x_n) \supset f x_1 \ldots
  x_n : \beta$$ for $i=1,\ldots,m$, apply $\lor$-elimination $m-1$ times, and then $\forall$-introduction $n$ times. Let $\Gamma_i'' \equiv \Gamma_i',
  y =_{\ensuremath{\mathrm{Nat}}}(g x_1 \ldots x_n)$. Since $$\Gamma_i' {\ensuremath{\vdash}}(y =_{\ensuremath{\mathrm{Nat}}}(g x_1 \ldots x_n)) : {\ensuremath{\mathrm{Prop}}}$$ it actually suffices to prove $ \Gamma_i'' {\ensuremath{\vdash}}f x_1 \ldots x_n
  : \beta $ and apply $\supset_i$. By the assumption on $g$ in the lemma, we have $$\begin{aligned}
  \Gamma_i'' {\ensuremath{\vdash}}\left((f x_1 \ldots x_n) : \beta\right) &\lor& ((g
  t_{i,1,1} \ldots t_{i,1,n}) < (g x_1 \ldots x_n) \land \ldots \land
  \\ && \;(g t_{i,k_i,1} \ldots t_{i,k_i,n}) < (g x_1 \ldots x_n))
  \end{aligned}$$ Let $$\Gamma_i^+ \equiv \Gamma_i'', (g t_{i,1,1} \ldots t_{i,1,n}) < (g
  x_1 \ldots x_n) \land \ldots \land (g t_{i,k_i,1} \ldots
  t_{i,k_i,n}) < (g x_1 \ldots x_n)$$ It thus suffices to show $\Gamma_i^+ {\ensuremath{\vdash}}f x_1 \ldots x_n :
  \beta$ and apply rule $\lor_e$. Let $1 \le j \le k_i$. Since $\Gamma_i^+ {\ensuremath{\vdash}}t_{i,j,k} : \alpha_k$ for $k=1,\ldots,n$ and $\Gamma_i^+ {\ensuremath{\vdash}}g : \alpha_1 \to \ldots \to \alpha_n \to {\ensuremath{\mathrm{Nat}}}$, we have $\Gamma_i^+ {\ensuremath{\vdash}}(g t_{i,j,1} \ldots t_{i,j,n}) :
  {\ensuremath{\mathrm{Nat}}}$. Thus $$\Gamma_i^+ {\ensuremath{\vdash}}(g t_{i,j,1} \ldots t_{i,j,n}) < y \supset \psi(g
  t_{i,j,1} \ldots t_{i,j,n}).$$ But $\Gamma_i^+ {\ensuremath{\vdash}}y =_{\ensuremath{\mathrm{Nat}}}(g x_1 \ldots x_n)$, $\Gamma_i^+
  {\ensuremath{\vdash}}y : {\ensuremath{\mathrm{Nat}}}$ and $\Gamma_i^+ {\ensuremath{\vdash}}(g x_1 \ldots x_n) :
  {\ensuremath{\mathrm{Nat}}}$, so by Lemma \[lem\_ind\_eq\] we obtain $\Gamma_i^+ {\ensuremath{\vdash}}y
  = (g x_1 \ldots x_n)$ and thus $$\Gamma_i^+ {\ensuremath{\vdash}}(g t_{i,j,1} \ldots t_{i,j,n}) < (g x_1 \ldots
  x_n) \supset \psi(g t_{i,j,1} \ldots t_{i,j,n}).$$ By the rule $\supset_e$ we have $\Gamma_i^+ {\ensuremath{\vdash}}\psi(g t_{i,j,1}
  \ldots t_{i,j,n})$, i.e. $$\Gamma_i^+ {\ensuremath{\vdash}}\forall x_1 : \alpha_1 \ldots \forall x_n : \alpha_n \,.\, (g t_{i,j,1}
  \ldots t_{i,j,n}) =_{\ensuremath{\mathrm{Nat}}}(g x_1 \ldots x_n) \supset f x_1 \ldots x_n
  : \beta.$$ Thus $
  \Gamma_i^+ {\ensuremath{\vdash}}(f t_{i,j,1} \ldots t_{i,j,n}) : \beta
  $ for $j=1,\ldots,k_i$. Because $\Gamma_i^+ {\ensuremath{\vdash}}t_i : \beta \to
  \ldots \to \beta$ where $\beta$ occurs $k_i+1$ times, we have $$\Gamma_i^+ {\ensuremath{\vdash}}(t_i (f t_{i,1,1} \ldots
  t_{i,1,n}) \ldots (f t_{i,k_i,1} \ldots t_{i,k_i,n})) : \beta.$$ But $$\Gamma_i^+ {\ensuremath{\vdash}}f x_1 \ldots x_n = t_i (f t_{i,1,1} \ldots
  t_{i,1,n}) \ldots (f t_{i,k_i,1} \ldots t_{i,k_i,n})$$ so $\Gamma_i^+ {\ensuremath{\vdash}}(f x_1 \ldots x_n) : \beta$.

Therefore, we have derived the premises of $n_i'$ for $\psi$, hence by Lemma \[lem\_nat\_ind\_2\] we obtain $\Gamma {\ensuremath{\vdash}}\forall x :
  {\ensuremath{\mathrm{Nat}}}\,.\, \psi(x)$, i.e. $$\Gamma {\ensuremath{\vdash}}\forall x : {\ensuremath{\mathrm{Nat}}}\forall x_1 : \alpha_1 \ldots
  \forall x_n : \alpha_n \,.\, x =_{\ensuremath{\mathrm{Nat}}}(g x_1 \ldots x_n) \supset f
  x_1 \ldots x_n : \beta.$$ Hence $$\Gamma, x_1 : \alpha_1, \ldots, x_n : \alpha_n, x : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}x
  =_{\ensuremath{\mathrm{Nat}}}(g x_1 \ldots x_n) \supset f x_1 \ldots x_n : \beta$$ so $$\Gamma, x_1 : \alpha_1, \ldots, x_n : \alpha_n {\ensuremath{\vdash}}\forall x :
  {\ensuremath{\mathrm{Nat}}}\,.\, x =_{\ensuremath{\mathrm{Nat}}}(g x_1 \ldots x_n) \supset f x_1 \ldots x_n :
  \beta.$$ Because $\Gamma, x_1 : \alpha_1, \ldots, x_n : \alpha_n {\ensuremath{\vdash}}(g
  x_1 \ldots x_n) : {\ensuremath{\mathrm{Nat}}}$, we easily obtain $$\Gamma, x_1 : \alpha_1, \ldots, x_n : \alpha_n {\ensuremath{\vdash}}f x_1 \ldots
  x_n : \beta$$ and thus $\Gamma {\ensuremath{\vdash}}f : \alpha_1 \to \ldots \to \alpha_n \to
  \beta$.

Soundness of the Translation of CPRED$\omega$ {#sec_cpred_soundness}
=============================================

In this section by $\tau$, $\tau_1$, $\tau_2$, $\sigma$, $\sigma_1$, etc. we denote types of , by $t$, $t_1$, $t_2$, etc. terms of , by $\varphi$, $\psi$, etc. formulas of , and by $s$, $s_1$, $s_2$, etc. terms of ${\ensuremath{{\cal I}}}_s$. By ${\ensuremath{{\cal T}}}$ we denote the set of types of . Below by $\Delta$ we denote an arbitrary set of formulas of .

If $t$ is a term of  then we use the notation $\Gamma(t)$ for $\Gamma(\{t\})$. By $\Gamma(\Delta,\varphi)$ we denote $\Gamma(\Delta \cup \{\varphi\})$. Below $\Delta$ denotes an arbitrary set of formulas of .

Note that if $\Delta \subseteq \Delta'$ then $\Gamma(\Delta) \subseteq
\Gamma(\Delta')$, after possibly renaming some variables $y \in
FV(\Gamma(\Delta))$ such that $y \notin FV(\Delta)$. Because of Lemma \[lem\_I\_s\_subst\], we may assume without loss of generality that this implication always holds verbatim, and also that $\Gamma(t_1
t_2) = \Gamma(t_1,t_2)$, $\Gamma(\varphi \supset \psi) =
\Gamma(\varphi,\psi)$, etc.

\[lem\_transl\_is\_type\] $\Gamma(\Delta) {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} {\ensuremath{\lceil\tau\rceil}} : {\ensuremath{\mathrm{Type}}}$

Straightforward induction on the structure of $\tau$, using rule $\to_t$.

\[lem\_transl\_typed\] If $t \in T_\tau$ then $\Gamma(t) {\ensuremath{\vdash}}{\ensuremath{\lceilt\rceil}} :
  {\ensuremath{\lceil\tau\rceil}}$.

Induction on the structure of $t$, using rules $\to_i$, $\to_e$, $\supset_t$ and $\forall_t$, and Lemma \[lem\_transl\_is\_type\] and weakening.

\[lem\_transl\_subst\] ${\ensuremath{\lceilt_1[x/t_2]\rceil}} = {\ensuremath{\lceilt_1\rceil}}[x/{\ensuremath{\lceilt_2\rceil}}]$

Straightforward induction on the structure of $t_1$.

\[lem\_transl\_eq\] If $t_1 \to_\beta t_2$ then $\Gamma(t_1,t_2) {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s}
  {\ensuremath{\lceilt_1\rceil}} = {\ensuremath{\lceilt_2\rceil}}$.

Induction on the structure of $t_1$, using the axiom $\beta$, the rules for Eq and Lemma \[lem\_transl\_subst\].

\[lem\_inhabited\] For every $\tau \in {\ensuremath{{\cal T}}}$ there is an ${\ensuremath{{\cal I}}}_s$-term $s$ such that $\Gamma(\Delta) {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} s : {\ensuremath{\lceil\tau\rceil}}$.

Induction on the structure of $\tau$. If $\tau \in {\ensuremath{{\cal B}}}$ then ${\ensuremath{\lceil\tau\rceil}} = \tau$ and there exists $y \in V_\tau$ such that $y
  \notin FV(\Delta)$ and $(y : \tau) \in \Gamma(\Delta)$. Thus $\Gamma(\Delta) {\ensuremath{\vdash}}y : {\ensuremath{\lceil\tau\rceil}}$. If $\tau = o$ then ${\ensuremath{\lceil\tau\rceil}} = {\ensuremath{\mathrm{Prop}}}$ and e.g. $\Gamma(\Delta) {\ensuremath{\vdash}}\bot :
  {\ensuremath{\lceil\tau\rceil}}$. If $\tau \notin {\ensuremath{{\cal B}}}\cup \{o\}$ then $\tau =
  \tau_1\to\tau_2$ for some $\tau_1,\tau_2\in {\ensuremath{{\cal T}}}$. By the inductive hypothesis there exists an ${\ensuremath{{\cal I}}}_s$-term $s_2$ such that $\Gamma(\Delta) {\ensuremath{\vdash}}s_2 : {\ensuremath{\lceil\tau_2\rceil}}$. Suppose $x \notin
  FV(s_2, \Gamma(\Delta))$. Then $\Gamma(\Delta), x : {\ensuremath{\lceil\tau_1\rceil}}
  {\ensuremath{\vdash}}s_2 : {\ensuremath{\lceil\tau_2\rceil}}$. Since ${\ensuremath{\lceil\tau\rceil}} =
  {\ensuremath{\lceil\tau_1\rceil}} \to {\ensuremath{\lceil\tau_2\rceil}}$ and $\Gamma(\Delta) {\ensuremath{\vdash}}{\ensuremath{\lceil\tau_1\rceil}} : {\ensuremath{\mathrm{Type}}}$ we obtain $\Gamma(\Delta) {\ensuremath{\vdash}}(\lambda
  x \,.\, s_2) : {\ensuremath{\lceil\tau\rceil}}$ by Lemma \[lem\_transl\_is\_type\].

If $\Delta {\ensuremath{\vdash}}_{\mathrm{CPRED}\omega} \varphi$ then $\Gamma(\Delta, \varphi), {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s}
  {\ensuremath{\lceil\varphi\rceil}}$. The same holds if we change CPRED$\omega$ to and ${\ensuremath{{\cal I}}}_s$ to $e{\ensuremath{{\cal I}}}_s$.

Induction on the length of the derivation of $\Delta {\ensuremath{\vdash}}_{{{\ensuremath{{\mathrm{CPRED}\omega}}}}}
  \varphi$.

If $\Delta {\ensuremath{\vdash}}_{{{\ensuremath{{\mathrm{CPRED}\omega}}}}} \varphi$ is an instance of the axiom $\Delta', \varphi {\ensuremath{\vdash}}_{{{\ensuremath{{\mathrm{CPRED}\omega}}}}} \varphi$, then obviously $\Gamma(\Delta, \varphi), {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s}
  {\ensuremath{\lceil\varphi\rceil}}$ by axiom 1 of ${\ensuremath{{\cal I}}}_s$. It is also easy to see that $$\Gamma(\Delta,\forall p : {\ensuremath{\mathrm{Prop}}}\,.\, ((p \supset \bot) \supset
  \bot) \supset p), {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} {\ensuremath{\lceil\forall p :
    {\ensuremath{\mathrm{Prop}}}\,.\, ((p \supset \bot) \supset \bot) \supset p\rceil}}.$$

Suppose $\Delta {\ensuremath{\vdash}}_{{{\ensuremath{{\mathrm{CPRED}\omega}}}}} \varphi_1 \supset \varphi_2$ is obtained from $\Delta, \varphi_1 {\ensuremath{\vdash}}_{{{\ensuremath{{\mathrm{CPRED}\omega}}}}} \varphi_2$ by the rule $\supset_i^P$. Then by the inductive hypothesis $\Gamma(\Delta,
  \varphi_1, \varphi_2), {\ensuremath{\lceil\Delta\rceil}}, {\ensuremath{\lceil\varphi_1\rceil}} {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s}
  {\ensuremath{\lceil\varphi_2\rceil}}$. By Lemma \[lem\_transl\_typed\] we have $\Gamma(\varphi_1) {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} {\ensuremath{\lceil\varphi_1\rceil}} : {\ensuremath{\mathrm{Prop}}}$. Hence by weakening and $\supset_i$ we obtain $\Gamma(\Delta, \varphi_1,
  \varphi_2), {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} {\ensuremath{\lceil\varphi_1\rceil}} \supset
  {\ensuremath{\lceil\varphi_2\rceil}}$, i.e. $\Gamma(\Delta, \varphi_1 \supset
  \varphi_2), {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} {\ensuremath{\lceil\varphi_1 \supset
    \varphi_2\rceil}}$.

Suppose $\Delta {\ensuremath{\vdash}}_{{{\ensuremath{{\mathrm{CPRED}\omega}}}}} \varphi$ is a direct consequence of $\Delta {\ensuremath{\vdash}}_{{{\ensuremath{{\mathrm{CPRED}\omega}}}}} \psi \supset \varphi$ and $\Delta
  {\ensuremath{\vdash}}_{{{\ensuremath{{\mathrm{CPRED}\omega}}}}} \psi$ by the rule $\supset_e^P$. By the IH and $\supset_e$ we have $\Gamma(\Delta,\psi,\varphi),
  {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} {\ensuremath{\lceil\varphi\rceil}}$. Note that $\Gamma(\Delta,\psi,\varphi) = \Gamma(\Delta,\varphi), x_1 :
  {\ensuremath{\lceil\tau_1\rceil}}, \ldots, x_n : {\ensuremath{\lceil\tau_n\rceil}}$ where $\{x_1,\ldots,x_n\} = FV(\psi) \setminus FV(\Delta, \varphi)$, $x_i
  \in V_{\tau_i}$, and without loss of generality $x_i \notin
  \Gamma(\Delta,\varphi)$. Since $x_i \notin FV(\Delta, \varphi)$ we have $x_i \notin FV({\ensuremath{\lceil\Delta\rceil}}, {\ensuremath{\lceil\varphi\rceil}})$. By Lemma \[lem\_inhabited\] there exist ${\ensuremath{{\cal I}}}_s$-terms $s_1, \ldots,
  s_n$ such that $\Gamma(\Delta, \varphi) {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} s_i :
  {\ensuremath{\lceil\tau_i\rceil}}$. By Lemma \[lem\_I\_s\_subst\] we have $$\Gamma(\Delta,\varphi), {\ensuremath{\lceil\Delta\rceil}}, s_1 : {\ensuremath{\lceil\tau_1\rceil}},
  \ldots, s_n : {\ensuremath{\lceil\tau_n\rceil}} {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} {\ensuremath{\lceil\varphi\rceil}}.$$ By applying $p_i$, $\supset_i$ and $\supset_e$ successively we obtain $\Gamma(\Delta, \varphi), {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s}
  {\ensuremath{\lceil\varphi\rceil}}$.

Suppose $\Delta {\ensuremath{\vdash}}_{{{\ensuremath{{\mathrm{CPRED}\omega}}}}} \forall x : \tau \,.\, \varphi$ is obtained from $\Delta {\ensuremath{\vdash}}_{{{\ensuremath{{\mathrm{CPRED}\omega}}}}} \varphi$ by rule $\forall_i^P$. By the IH we have $\Gamma(\Delta,\varphi),
  {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} {\ensuremath{\lceil\varphi\rceil}}$. Since $x \notin
  FV(\Delta)$, we have $\Gamma(\Delta, \varphi) = \Gamma(\Delta,
  \forall x : \tau \,.\, \varphi), x : {\ensuremath{\lceil\tau\rceil}}$. By Lemma \[lem\_transl\_is\_type\] and weakening we have $$\Gamma(\Delta, \forall x : \tau \,.\, \varphi), {\ensuremath{\lceil\Delta\rceil}}
  {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} {\ensuremath{\lceil\tau\rceil}} : {\ensuremath{\mathrm{Type}}}.$$ Hence $\Gamma(\Delta, \forall x : \tau \,.\, \varphi),
  {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} {\ensuremath{\lceil\forall x : \tau \,.\,
    \varphi\rceil}}$ by $\forall_i$ and ${\ensuremath{\lceil\forall x : \tau \,.\,
    \varphi\rceil}} = \forall x : {\ensuremath{\lceil\tau\rceil}} \,.\, {\ensuremath{\lceil\varphi\rceil}}$.

Suppose $\Delta {\ensuremath{\vdash}}_{{{\ensuremath{{\mathrm{CPRED}\omega}}}}} \varphi[x/t]$ is obtained from $\Delta
  {\ensuremath{\vdash}}_{{{\ensuremath{{\mathrm{CPRED}\omega}}}}} \forall x : \tau \,.\, \varphi$ by rule $\forall_i^P$. We then have $x \notin FV(\Delta)$ and $t \in
  T_\tau$. By the IH we have $$\Gamma(\Delta, \forall x : \tau \,.\, \varphi), {\ensuremath{\lceil\Delta\rceil}}
  {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} \forall x : {\ensuremath{\lceil\tau\rceil}} \,.\, {\ensuremath{\lceil\varphi\rceil}}.$$ If $x \notin FV(\varphi)$ then $\varphi \equiv \varphi[x/t]$ and $\Gamma(\Delta, \forall x : \tau \,.\, \varphi) = \Gamma(\Delta,
  \varphi[x/t])$. By Lemma \[lem\_inhabited\] there exists an ${\ensuremath{{\cal I}}}_s$-term $s$ such that $\Gamma(\Delta, \varphi[x/t])
  {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} s : {\ensuremath{\lceil\tau\rceil}}$. By $\forall_e$ we obtain $\Gamma(\Delta, \varphi[x/t]), {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s}
  {\ensuremath{\lceil\varphi[x/t]\rceil}}$. If $x \in FV(\varphi)$ then $\Gamma(\Delta,\varphi[x/t]) = \Gamma(\Delta, \forall x : \tau \,.\,
  \varphi, t)$. By Lemma \[lem\_transl\_typed\] we have $\Gamma(\Delta,\varphi[x/t]) {\ensuremath{\vdash}}{\ensuremath{\lceilt\rceil}} : {\ensuremath{\lceil\tau\rceil}}$, so by $\forall_e$ and Lemma \[lem\_transl\_subst\] we obtain $\Gamma(\Delta,\varphi[x/t]), {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}{\ensuremath{\lceil\varphi[x/t]\rceil}}$.

Suppose $\Delta {\ensuremath{\vdash}}_{{{\ensuremath{{\mathrm{CPRED}\omega}}}}} \psi$ is obtained from $\Delta
  {\ensuremath{\vdash}}_{{{\ensuremath{{\mathrm{CPRED}\omega}}}}} \varphi$ by rule $\mathrm{conv}^P$. Then $\varphi
  =_\beta \psi$. By the IH we have $\Gamma(\Delta, \varphi),
  {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} {\ensuremath{\lceil\varphi\rceil}}$. It suffices to show that if $\varphi \to_\beta \psi$ or $\psi \to_\beta \varphi$ then $\Gamma(\Delta, \psi), {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s}
  {\ensuremath{\lceil\psi\rceil}}$. If $\varphi \to_\beta \psi$ then $\Gamma(\psi)
  \subset \Gamma(\varphi)$ and by Lemma \[lem\_transl\_eq\], rule eq and weakening we obtain $\Gamma(\Delta, \varphi), {\ensuremath{\lceil\Delta\rceil}}
  {\ensuremath{\vdash}}{\ensuremath{\lceil\psi\rceil}}$. Note that $\Gamma(\Delta,\varphi) =
  \Gamma(\Delta,\psi), x_1 : {\ensuremath{\lceil\tau_1\rceil}}, \ldots, x_n :
  {\ensuremath{\lceil\tau_n\rceil}}$ where $\{x_1,\ldots,x_n\} = FV(\varphi) \setminus
  FV(\Delta, \psi)$, $x_i \in V_{\tau_i}$. Hence, we may use the same argument as in the proof for the rule $\supset_e^P$ to obtain $\Gamma(\Delta,\psi), {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s}
  {\ensuremath{\lceil\psi\rceil}}$. If $\psi \to_\beta \varphi$ then $\Gamma(\varphi)
  \subseteq \Gamma(\psi)$, and by Lemma \[lem\_transl\_eq\], rule eq and weakening we obtain $\Gamma(\Delta,\psi), {\ensuremath{\lceil\Delta\rceil}}
  {\ensuremath{\vdash}}{\ensuremath{\lceil\psi\rceil}}$.

To show that if $\Delta {\ensuremath{\vdash}}_{\mathrm{E{-}CPRED}\omega} \varphi$ then $\Gamma(\Delta, \varphi), {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{e{\ensuremath{{\cal I}}}_s}
  {\ensuremath{\lceil\varphi\rceil}}$, it now suffices to prove that the translations of the axioms $e_f^P$ and $e_b^P$ are derivable in $e{\ensuremath{{\cal I}}}_s$. This is straightforward, using the rules $e_f$, $e_b$, eq, Lemma \[lem\_transl\_is\_type\] and Lemma \[lem\_leibniz\].

Proofs for Section \[sec\_partiality\] {#sec_proofs_examples}
======================================

In this section we give sketches of formal proofs for the examples in Sect. \[sec\_partiality\]. The formal derivations are slightly simplified, by omitting certain steps and rule assumptions, simplifying inferences, and generally omitting some parts which may be easily reconstructed by the reader. We also assume certain basic properties of operations on natural number and don’t derive them. These properties may be derived from Theorem \[thm\_peano\], Lemma \[lem\_nat\_op\_well\_defined\] and the definitions of $\le$ and $-$.

${\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} \forall i,j : {\ensuremath{\mathrm{Nat}}}\,.\, (i \ge j) \supset
  ({\ensuremath{\mathrm{subp}}}\,i\,j = i - j)$

Let $\varphi(x) \equiv \forall i,j : {\ensuremath{\mathrm{Nat}}}\,.\, i \ge j \supset x
  =_{\ensuremath{\mathrm{Nat}}}i - j \supset {\ensuremath{\mathrm{subp}}}\,i\,j = i - j$. $$(a0.0)
  \inferrule*{
    i : {\ensuremath{\mathrm{Nat}}}, j : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}i : {\ensuremath{\mathrm{Nat}}}\\
    \inferrule*{
    }{
      {\ensuremath{\vdash}}\forall x, y : {\ensuremath{\mathrm{Nat}}}\,.\, (x - y) : {\ensuremath{\mathrm{Nat}}}}\;\raisebox{0.7em}{by~\ref{lem_nat_op_well_defined}}
  }{
    i : {\ensuremath{\mathrm{Nat}}}, j : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}\forall y : {\ensuremath{\mathrm{Nat}}}\,.\, (i - y) : {\ensuremath{\mathrm{Nat}}}}$$ $$(a0)
  \inferrule*{
    \inferrule*{
      (a0.0)
      \\
      i : {\ensuremath{\mathrm{Nat}}}, j : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}j : {\ensuremath{\mathrm{Nat}}}}{
      i : {\ensuremath{\mathrm{Nat}}}, j : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}(i - j) : {\ensuremath{\mathrm{Nat}}}}
    \\
    {\ensuremath{\vdash}}0 : {\ensuremath{\mathrm{Nat}}}}{
    i : {\ensuremath{\mathrm{Nat}}}, j : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}(0 =_{\ensuremath{\mathrm{Nat}}}(i - j)) : {\ensuremath{\mathrm{Nat}}}}\;\raisebox{0.7em}{by~\ref{lem_leibniz}}$$ Completely analogously, we obtain $$(a1)\;\; i : {\ensuremath{\mathrm{Nat}}}, j : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}(i \ge j) : {\ensuremath{\mathrm{Nat}}}$$ Now let $\Gamma_0 \equiv i : {\ensuremath{\mathrm{Nat}}}, j : {\ensuremath{\mathrm{Nat}}}, i \ge j, 0 =_{\ensuremath{\mathrm{Nat}}}i -
  j$. $$(a2)
  \inferrule*{
    \inferrule*{
      \inferrule*{
        \inferrule*{
          \inferrule*{
            \inferrule*{
            }{
              \Gamma_0 {\ensuremath{\vdash}}0 = i - j
            }\;\raisebox{0.7em}{by~\ref{lem_ind_eq}}
          }{
            \Gamma_0 {\ensuremath{\vdash}}{\ensuremath{\mathfrak{0}}}(i - j)
          }
          \\
          \Gamma_0 {\ensuremath{\vdash}}i \ge j
        }{
          \Gamma_0 {\ensuremath{\vdash}}i =_{\ensuremath{\mathrm{Nat}}}j
        }\;\raisebox{0.7em}{by~\ref{lem_le_ge_then_eq}}
      }{
        \Gamma_0 {\ensuremath{\vdash}}{\ensuremath{\mathrm{subp}}}\,i\,j = 0
      }
      \\
      \Gamma_0 {\ensuremath{\vdash}}0 = i - j
    }{
      \Gamma_0 {\ensuremath{\vdash}}{\ensuremath{\mathrm{subp}}}\,i\,j = i - j
    }
    \\
    (a0)
  }{
    i : {\ensuremath{\mathrm{Nat}}}, j : {\ensuremath{\mathrm{Nat}}}, i \ge j {\ensuremath{\vdash}}0 =_{\ensuremath{\mathrm{Nat}}}i - j \supset {\ensuremath{\mathrm{subp}}}\,i\,j = i - j
  }$$ $$(a)
  \inferrule*{
    \inferrule*{
      (a1)
      \\
      (a2)
    }{
      i : {\ensuremath{\mathrm{Nat}}}, j : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}i \ge j \supset 0 =_{\ensuremath{\mathrm{Nat}}}i - j \supset {\ensuremath{\mathrm{subp}}}\,i\,j = i - j
    }
    \\
    {\ensuremath{\vdash}}{\ensuremath{\mathrm{Nat}}}: {\ensuremath{\mathrm{Type}}}}{
    {\ensuremath{\vdash}}\varphi(0)
  }$$ Let $\Gamma_1 \equiv y : {\ensuremath{\mathrm{Nat}}}, \varphi(y), i : {\ensuremath{\mathrm{Nat}}}, j : {\ensuremath{\mathrm{Nat}}}, {\ensuremath{\mathfrak{s}}}y
  =_{\ensuremath{\mathrm{Nat}}}i - j$. $$(b0.0)
  \inferrule*{
    \Gamma_1 {\ensuremath{\vdash}}i : {\ensuremath{\mathrm{Nat}}}\\ \Gamma_1 {\ensuremath{\vdash}}j : {\ensuremath{\mathrm{Nat}}}}{
    \Gamma_1 {\ensuremath{\vdash}}(i =_{\ensuremath{\mathrm{Nat}}}j) : {\ensuremath{\mathrm{Prop}}}}\;\raisebox{0.7em}{by~\ref{lem_leibniz}}$$ $$(b0.1)
  \inferrule*{
    \inferrule*{
      \inferrule*{
        \inferrule*{
        }{
          \Gamma_1, i =_{\ensuremath{\mathrm{Nat}}}j {\ensuremath{\vdash}}i = j
        }\;\raisebox{0.7em}{by~\ref{lem_ind_eq}}
        \\
        \Gamma_1 {\ensuremath{\vdash}}{\ensuremath{\mathfrak{s}}}y =_{\ensuremath{\mathrm{Nat}}}i - j
      }{
        \Gamma_1, i =_{\ensuremath{\mathrm{Nat}}}j {\ensuremath{\vdash}}{\ensuremath{\mathfrak{s}}}y =_{\ensuremath{\mathrm{Nat}}}i - i
      }
    }{
      \Gamma_1, i =_{\ensuremath{\mathrm{Nat}}}j {\ensuremath{\vdash}}{\ensuremath{\mathfrak{s}}}y =_{\ensuremath{\mathrm{Nat}}}0
    }
    \\
    \inferrule*{
      \Gamma_1 {\ensuremath{\vdash}}y : {\ensuremath{\mathrm{Nat}}}}{
      \Gamma_1 {\ensuremath{\vdash}}({\ensuremath{\mathfrak{s}}}y) : {\ensuremath{\mathrm{Nat}}}}
  }{
    \Gamma_1, i =_{\ensuremath{\mathrm{Nat}}}j {\ensuremath{\vdash}}{\ensuremath{\mathfrak{s}}}y = 0
  }$$ $$(b0)
  \inferrule*{
    \inferrule*{
      \inferrule*{
        (b0.1)
        \\
        \Gamma_1, i =_{\ensuremath{\mathrm{Nat}}}j {\ensuremath{\vdash}}{\ensuremath{\mathfrak{0}}}0
      }{
        \Gamma_1, i =_{\ensuremath{\mathrm{Nat}}}j {\ensuremath{\vdash}}{\ensuremath{\mathfrak{0}}}({\ensuremath{\mathfrak{s}}}y)
      }
      \\
      \Gamma_1, i =_{\ensuremath{\mathrm{Nat}}}j {\ensuremath{\vdash}}\neg ({\ensuremath{\mathfrak{0}}}({\ensuremath{\mathfrak{s}}}y))
    }{
      \Gamma_1, i =_{\ensuremath{\mathrm{Nat}}}j {\ensuremath{\vdash}}\bot
    }
    \\
    (b0.0)
  }{
    \Gamma_1 {\ensuremath{\vdash}}\neg (i =_{\ensuremath{\mathrm{Nat}}}j)
  }$$ $$(c0)
  \inferrule*{
    \Gamma_1 {\ensuremath{\vdash}}\varphi(y)
    \\
    \Gamma_1 {\ensuremath{\vdash}}i : {\ensuremath{\mathrm{Nat}}}\\
    \inferrule*{
      \Gamma_1 {\ensuremath{\vdash}}j : {\ensuremath{\mathrm{Nat}}}}{
      \Gamma_1 {\ensuremath{\vdash}}({\ensuremath{\mathfrak{s}}}j) : {\ensuremath{\mathrm{Nat}}}}
  }{
    \Gamma_1 {\ensuremath{\vdash}}i \ge ({\ensuremath{\mathfrak{s}}}j) \supset y =_{\ensuremath{\mathrm{Nat}}}i - ({\ensuremath{\mathfrak{s}}}j) \supset
    {\ensuremath{\mathrm{subp}}}\,i\,({\ensuremath{\mathfrak{s}}}j) = i - ({\ensuremath{\mathfrak{s}}}j)
  }$$ $$(c1)
  \inferrule*{
    \inferrule*{
      \Gamma_1 {\ensuremath{\vdash}}i \ge j \\ (b0)
    }{
      \Gamma_1 {\ensuremath{\vdash}}i \ge ({\ensuremath{\mathfrak{s}}}j)
    }
    \\
    (c0)
  }{
    \Gamma_1 {\ensuremath{\vdash}}y =_{\ensuremath{\mathrm{Nat}}}i - ({\ensuremath{\mathfrak{s}}}j) \supset {\ensuremath{\mathrm{subp}}}\,i\,({\ensuremath{\mathfrak{s}}}j) = i - ({\ensuremath{\mathfrak{s}}}j)
  }$$ $$(c2)
  \inferrule*{
    \Gamma_1 {\ensuremath{\vdash}}{\ensuremath{\mathfrak{s}}}y =_{\ensuremath{\mathrm{Nat}}}i - j
    \\
    \inferrule*{
        \Gamma_1 {\ensuremath{\vdash}}i : {\ensuremath{\mathrm{Nat}}}\\ \Gamma_1 {\ensuremath{\vdash}}j : {\ensuremath{\mathrm{Nat}}}}{
      \Gamma_1 {\ensuremath{\vdash}}(i - j) : {\ensuremath{\mathrm{Nat}}}}
    \\
    \inferrule*{
      \Gamma_1 {\ensuremath{\vdash}}y : {\ensuremath{\mathrm{Nat}}}}{
      \Gamma_1 {\ensuremath{\vdash}}({\ensuremath{\mathfrak{s}}}y) : {\ensuremath{\mathrm{Nat}}}}
  }{
    \Gamma_1 {\ensuremath{\vdash}}{\ensuremath{\mathfrak{s}}}y = i - j
  }$$ $$(c3)
  \inferrule*{
    \inferrule*{
      \inferrule*{
        \Gamma_1 {\ensuremath{\vdash}}i \ge j \\ (b0)
      }{
        \Gamma_1 {\ensuremath{\vdash}}i > j
      }
    }{
      \ldots
    }
  }{
    \Gamma_1 {\ensuremath{\vdash}}{\ensuremath{\mathfrak{s}}}(i - ({\ensuremath{\mathfrak{s}}}j)) = i - j
  }$$ $$(c4)
  \inferrule*{
    \inferrule*{
      \inferrule*{
        \inferrule*{
          (c3)
          \\
          (c2)
        }{
          \Gamma_1 {\ensuremath{\vdash}}{\ensuremath{\mathfrak{s}}}(i - ({\ensuremath{\mathfrak{s}}}j)) = {\ensuremath{\mathfrak{s}}}y
        }
      }{
        \Gamma_1 {\ensuremath{\vdash}}{\ensuremath{\mathfrak{p}}}({\ensuremath{\mathfrak{s}}}(i - ({\ensuremath{\mathfrak{s}}}j))) = {\ensuremath{\mathfrak{p}}}({\ensuremath{\mathfrak{s}}}y)
      }
    }{
      \Gamma_1 {\ensuremath{\vdash}}i - ({\ensuremath{\mathfrak{s}}}j) = y
    }
  }{
    \Gamma_1 {\ensuremath{\vdash}}y =_{\ensuremath{\mathrm{Nat}}}i - ({\ensuremath{\mathfrak{s}}}j)
  }$$ $$(c)
  \inferrule*{
    \inferrule*{
      \inferrule*{
        \inferrule*{
          (b0)
        }{
          \Gamma_1 {\ensuremath{\vdash}}{\ensuremath{\mathrm{subp}}}\,i\,j = {\ensuremath{\mathfrak{s}}}({\ensuremath{\mathrm{subp}}}\,i\,({\ensuremath{\mathfrak{s}}}j))
        }
        \\
        \inferrule*{
          \inferrule*{
            (c1) \\ (c4)
          }{
            \Gamma_1 {\ensuremath{\vdash}}{\ensuremath{\mathrm{subp}}}\,i\,({\ensuremath{\mathfrak{s}}}j) = i - ({\ensuremath{\mathfrak{s}}}j)
          }
        }{
          \Gamma_1 {\ensuremath{\vdash}}{\ensuremath{\mathfrak{s}}}({\ensuremath{\mathrm{subp}}}\,i\,({\ensuremath{\mathfrak{s}}}j)) = {\ensuremath{\mathfrak{s}}}(i - ({\ensuremath{\mathfrak{s}}}j))
        }
      }{
        \Gamma_1 {\ensuremath{\vdash}}{\ensuremath{\mathrm{subp}}}\,i\,j = {\ensuremath{\mathfrak{s}}}(i - ({\ensuremath{\mathfrak{s}}}j)) \\ (c3)
      }
    }{
      \Gamma_1 {\ensuremath{\vdash}}{\ensuremath{\mathrm{subp}}}\,i\,j = i - j
    }
  }{
    y : {\ensuremath{\mathrm{Nat}}}, \varphi(y) {\ensuremath{\vdash}}\varphi({\ensuremath{\mathfrak{s}}}y)
  }$$ $$(d)
  \inferrule*{
    (a) \\ (c)
  }{
    {\ensuremath{\vdash}}\forall y,i,j : {\ensuremath{\mathrm{Nat}}}\,.\, i \ge j \supset y =_{\ensuremath{\mathrm{Nat}}}i - j \supset {\ensuremath{\mathrm{subp}}}\,i\,j = i - j
  }\;\raisebox{0.7em}{by~$n_i$}$$ $$(e)
  \inferrule*{
    \inferrule*{
      \inferrule*{
        \inferrule*{
          \ldots
        }{
          i : {\ensuremath{\mathrm{Nat}}}, j : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}(i - j) : {\ensuremath{\mathrm{Nat}}}}
        \\
        (d)
      }{
        i : {\ensuremath{\mathrm{Nat}}}, j : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}\forall k,l : {\ensuremath{\mathrm{Nat}}}\,.\, k \ge l
        \supset i - j =_{\ensuremath{\mathrm{Nat}}}k - l \supset {\ensuremath{\mathrm{subp}}}\,k\,l = k - l
      }
    }{
      i : {\ensuremath{\mathrm{Nat}}}, j : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}i \ge j \supset i - j =_{\ensuremath{\mathrm{Nat}}}i - j \supset {\ensuremath{\mathrm{subp}}}\,i\,j = i - j
    }
  }{
    i : {\ensuremath{\mathrm{Nat}}}, j : {\ensuremath{\mathrm{Nat}}}, i \ge j {\ensuremath{\vdash}}i - j =_{\ensuremath{\mathrm{Nat}}}i - j \supset {\ensuremath{\mathrm{subp}}}\,i\,j = i - j
  }$$ $$(f)
  \inferrule*{
    (e)
    \\
    \inferrule*{
      \inferrule*{
        \ldots
      }{
        i : {\ensuremath{\mathrm{Nat}}}, j : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}(i - j) : {\ensuremath{\mathrm{Nat}}}}
    }{
      i : {\ensuremath{\mathrm{Nat}}}, j : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}i - j =_{\ensuremath{\mathrm{Nat}}}i - j
    }
  }{
    i : {\ensuremath{\mathrm{Nat}}}, j : {\ensuremath{\mathrm{Nat}}}, i \ge j {\ensuremath{\vdash}}{\ensuremath{\mathrm{subp}}}\,i\,j = i - j
  }$$ $$\inferrule*{
    \inferrule*{
      (f)
      \\
      \inferrule*{
        \ldots
      }{
        i : {\ensuremath{\mathrm{Nat}}}, j : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}(i \ge j) : {\ensuremath{\mathrm{Prop}}}}
    }{
      i : {\ensuremath{\mathrm{Nat}}}, j : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}i \ge j \supset {\ensuremath{\mathrm{subp}}}\,i\,j = i - j
    }
    \\
    {\ensuremath{\vdash}}{\ensuremath{\mathrm{Nat}}}: {\ensuremath{\mathrm{Type}}}}{
    {\ensuremath{\vdash}}\forall i,j : {\ensuremath{\mathrm{Nat}}}\,.\, i \ge j \supset {\ensuremath{\mathrm{subp}}}\,i\,j = i - j
  }$$

If $f$ is a term such that $${\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} f(n) = {\ensuremath{\mathrm{Cond}\,(n > 100)\,(n - 10)\,(f(f(n + 11)))\,}}$$ then $${\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} \forall n : {\ensuremath{\mathrm{Nat}}}\,.\, n \le 101 \supset f(n) = 91.$$

Let $\varphi(y) \equiv \forall n : {\ensuremath{\mathrm{Nat}}}\,.\, n \le 101 \supset 101
  - n \le y \supset f(n) = 91$. $$(a0)
  \inferrule*{
    \inferrule*{
      n : {\ensuremath{\mathrm{Nat}}}, n \le 101, 101 - n \le 0 {\ensuremath{\vdash}}101 \le n
    }{
      n : {\ensuremath{\mathrm{Nat}}}, n \le 101, 101 - n \le 0 {\ensuremath{\vdash}}n =_{\ensuremath{\mathrm{Nat}}}101
    }\;\raisebox{0.7em}{by~\ref{lem_le_ge_then_eq}}
  }{
    n : {\ensuremath{\mathrm{Nat}}}, n \le 101, 101 - n \le 0 {\ensuremath{\vdash}}f(n) = f(101) = 101 -
    10 = 91
  }$$ $$(a)
  \inferrule*{
    \inferrule*{
      \inferrule*{
        \inferrule*{
          n : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}(101 - n) : {\ensuremath{\mathrm{Nat}}}}{
          n : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}(101 - n \le 0) : {\ensuremath{\mathrm{Prop}}}}
        \\
        (a0)
      }{
        n : {\ensuremath{\mathrm{Nat}}}, n \le 101 {\ensuremath{\vdash}}101 - n \le 0 \supset f(n) = 91
      }
      \\
      n : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}(n \le 101) : {\ensuremath{\mathrm{Prop}}}}{
      n : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}n \le 101 \supset 101 - n \le 0 \supset f(n) = 91
    }
    \\
    {\ensuremath{\vdash}}{\ensuremath{\mathrm{Nat}}}: {\ensuremath{\mathrm{Type}}}}{
    {\ensuremath{\vdash}}\varphi(0)
  }$$ Let $\Gamma_0 \equiv y : {\ensuremath{\mathrm{Nat}}}, \varphi(y), n : {\ensuremath{\mathrm{Nat}}}, n \le 101, 101
  - n \le {\ensuremath{\mathfrak{s}}}y$. Let $\Gamma_1 \equiv \Gamma_0, n + 11 > 101, n <
  101$. $$(b0.0)
  \inferrule*{
    \inferrule*{
      \Gamma_1 {\ensuremath{\vdash}}n : {\ensuremath{\mathrm{Nat}}}}{
      \Gamma_1 {\ensuremath{\vdash}}(n + 1) : {\ensuremath{\mathrm{Nat}}}}
    \\
    \Gamma_1 {\ensuremath{\vdash}}\varphi(y)
  }{
    \Gamma_1 {\ensuremath{\vdash}}n + 1 \le 101 \supset 101 - (n + 1) \le y
    \supset f(n + 1) = 91
  }$$ $$(b0)
  \inferrule*{
    (b0.0)
    \\
    \Gamma_1 {\ensuremath{\vdash}}n + 1 \le 101
  }{
    \Gamma_1 {\ensuremath{\vdash}}101 - (n + 1) \le y \supset f(n + 1) = 91
  }$$ $$(b1)
  \inferrule*{
    \inferrule*{
      \inferrule*{
        \Gamma_1 {\ensuremath{\vdash}}101 - n \le {\ensuremath{\mathfrak{s}}}y
        \\
        \inferrule*{
          \Gamma_1 {\ensuremath{\vdash}}101 - ({\ensuremath{\mathfrak{s}}}n) = {\ensuremath{\mathfrak{p}}}(101 - n)
        }{
          \Gamma_1 {\ensuremath{\vdash}}{\ensuremath{\mathfrak{s}}}(101 - ({\ensuremath{\mathfrak{s}}}n)) = 101 - n
        }
      }{
        \Gamma_1 {\ensuremath{\vdash}}{\ensuremath{\mathfrak{s}}}(101 - (n + 1)) \le {\ensuremath{\mathfrak{s}}}y
      }
    }{
      \Gamma_1 {\ensuremath{\vdash}}101 - (n + 1) \le y
    }
    \\
    (b0)
  }{
    \Gamma_1 {\ensuremath{\vdash}}f(n + 1) = 91
  }$$ $$(b)
  \inferrule*{
    \inferrule*{
      \inferrule*{
        \Gamma_1 {\ensuremath{\vdash}}n + 11 > 100
      }{
        \Gamma_1 {\ensuremath{\vdash}}f(n + 11) = n + 11 - 10 = n + 1
      }
      \\
      \inferrule*{
        \Gamma_1 {\ensuremath{\vdash}}n < 101
      }{
        \Gamma_1 {\ensuremath{\vdash}}\neg (n > 100)
      }
    }{
      \Gamma_1 {\ensuremath{\vdash}}f(n) = f(f(n + 11)) = f(n + 1)
    }
    \\
    (b1)
  }{
    \Gamma_1 {\ensuremath{\vdash}}f(n) = 91
  }$$ Let $\Gamma_2 \equiv \Gamma_0, n + 11 > 101, \neg (n < 101)$. $$(c)
  \inferrule*{
    \inferrule*{
      \Gamma_2 {\ensuremath{\vdash}}n \le 101 \\ \Gamma_2 {\ensuremath{\vdash}}\neg (n < 101)
    }{
      \Gamma_2 {\ensuremath{\vdash}}n =_{\ensuremath{\mathrm{Nat}}}101
    }
  }{
    \Gamma_2 {\ensuremath{\vdash}}f(n) = n - 10 = 101 - 10 = 91
  }$$ $$(d)
  \inferrule*{
    \inferrule*{
      \inferrule*{
        \Gamma_0, n + 11 > 101 {\ensuremath{\vdash}}n : {\ensuremath{\mathrm{Nat}}}}{
        \Gamma_0, n + 11 > 101 {\ensuremath{\vdash}}(n < 101) : {\ensuremath{\mathrm{Prop}}}}
    }{
      \Gamma_0, n + 11 > 101 {\ensuremath{\vdash}}n < 101 \lor \neg (n < 101)
    }
    \\
    (b)
    \\
    (c)
  }{
    \Gamma_0, n + 11 > 101 {\ensuremath{\vdash}}f(n) = 91
  }\;\raisebox{0.7em}{by~$\lor_e$}$$ Let $\Gamma_3 \equiv \Gamma_0, n + 11 \le 101$. $$(e0.1)
  \inferrule*{
    \Gamma_3 {\ensuremath{\vdash}}\varphi(y)
    \\
    \inferrule*{
      \Gamma_3 {\ensuremath{\vdash}}n : {\ensuremath{\mathrm{Nat}}}\\ \Gamma_3 {\ensuremath{\vdash}}11 : {\ensuremath{\mathrm{Nat}}}}{
      \Gamma_3 {\ensuremath{\vdash}}(n + 11) : {\ensuremath{\mathrm{Nat}}}}
  }{
    \Gamma_3 {\ensuremath{\vdash}}n + 11 \le 101 \supset 101 - (n + 11) \le y
    \supset f(n + 11) = 91
  }$$ $$(e0.2)
  \inferrule*{
    (e0.1)
    \\
    \Gamma_3 {\ensuremath{\vdash}}n + 11 \le 101
  }{
    \Gamma_3 {\ensuremath{\vdash}}101 - (n + 11) \le y \supset f(n + 11) = 91
  }$$ $$(e0)
  \inferrule*{
    (e0.2)
    \\
    \inferrule*{
      \Gamma_3 {\ensuremath{\vdash}}101 - n \le {\ensuremath{\mathfrak{s}}}y
    }{
      \Gamma_3 {\ensuremath{\vdash}}101 - (n + 11) \le y.
    }
  }{
    \Gamma_3 {\ensuremath{\vdash}}f(n + 11) = 91
  }$$ $$(e1)
  \inferrule*{
    \inferrule*{
      \inferrule*{
        \Gamma_3 {\ensuremath{\vdash}}n + 11 \le 101 \\ \Gamma_3 {\ensuremath{\vdash}}n : {\ensuremath{\mathrm{Nat}}}\\ \ldots
      }{
        \Gamma_3 {\ensuremath{\vdash}}n \le 100
      }
    }{
      \Gamma_3 {\ensuremath{\vdash}}f(n) = f(f(n+11))
    }
    \\
    (e0)
  }{
    \Gamma_3 {\ensuremath{\vdash}}f(n) = f(91)
  }$$ $$(e2.1)
  \inferrule*{
    \Gamma_3 {\ensuremath{\vdash}}f(91) = f(f(102)) \\ \Gamma_3 {\ensuremath{\vdash}}f(102) = 92
  }{
    \Gamma_3 {\ensuremath{\vdash}}f(91) = f(92)
  }$$ $$(e2.2)
  \inferrule*{
    \Gamma_3 {\ensuremath{\vdash}}f(92) = f(f(103)) \\ \Gamma_3 {\ensuremath{\vdash}}f(103) = 93
  }{
    \Gamma_3 {\ensuremath{\vdash}}f(92) = f(93)
  }$$ $$\vdots$$ $$(e2.10)
  \inferrule*{
    \inferrule*{
      \Gamma_3 {\ensuremath{\vdash}}f(100) = f(f(111)) \\ \Gamma_3 {\ensuremath{\vdash}}f(111) = 101
    }{
      \Gamma_3 {\ensuremath{\vdash}}f(100) = f(101)
    }
    \\
    \Gamma_3 {\ensuremath{\vdash}}f(101) = 91
  }{
    \Gamma_3 {\ensuremath{\vdash}}f(100) = 91
  }$$ $$(e2)
  \inferrule*{
    \inferrule*{
      \inferrule*{
        \inferrule*{
          \inferrule*{
            (e2.1)
            \\
            (e2.2)
          }{
            \Gamma_3 {\ensuremath{\vdash}}f(91) = f(93)
          }
          \\
          (e2.3)
        }{
          \Gamma_3 {\ensuremath{\vdash}}f(91) = f(94)
        }
        \\
        (e2.4)
      }{
        \vdots
      }
      \\
      \vdots
    }{
      \Gamma_3 {\ensuremath{\vdash}}f(91) = f(100)
    }
    \\
    (e2.10)
  }{
    \Gamma_3 {\ensuremath{\vdash}}f(91) = 91
  }$$ $$(e)
  \inferrule*{
    (e1) \\ (e2)
  }{
    \Gamma_3 {\ensuremath{\vdash}}f(n) = 91
  }$$ $$(f)
  \inferrule*{
    \inferrule*{
      \inferrule*{
        \Gamma_0 {\ensuremath{\vdash}}n : {\ensuremath{\mathrm{Nat}}}}{
        \Gamma_0 {\ensuremath{\vdash}}(n + 11 > 101) : {\ensuremath{\mathrm{Prop}}}}
    }{
      \Gamma_0 {\ensuremath{\vdash}}n + 11 > 101 \lor n + 11 \le 101
    }
    \\
    (d)
    \\
    (e)
  }{
    \Gamma_0 {\ensuremath{\vdash}}f(n) = 91
  }\;\raisebox{0.7em}{by~$\lor_e$}$$ $$(g0)
  \inferrule*{
    y : {\ensuremath{\mathrm{Nat}}}, \varphi(y), n : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}(101 - n \le {\ensuremath{\mathfrak{s}}}y) : {\ensuremath{\mathrm{Prop}}}\\
    (f)
  }{
    y : {\ensuremath{\mathrm{Nat}}}, \varphi(y), n : {\ensuremath{\mathrm{Nat}}}, n \le 101 {\ensuremath{\vdash}}101 - n \le {\ensuremath{\mathfrak{s}}}y \supset
    f(n) = 91
  }$$ $$(g1)
  \inferrule*{
    y : {\ensuremath{\mathrm{Nat}}}, \varphi(y), n : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}(n \le 101) : {\ensuremath{\mathrm{Prop}}}\\
    (g0)
  }{
    y : {\ensuremath{\mathrm{Nat}}}, \varphi(y), n : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}n \le 101 \supset 101 - n
    \le {\ensuremath{\mathfrak{s}}}y \supset f(n) = 91
  }$$ $$(g)
  \inferrule*{
    {\ensuremath{\vdash}}{\ensuremath{\mathrm{Nat}}}: {\ensuremath{\mathrm{Type}}}\\
    (g1)
  }{
    y : {\ensuremath{\mathrm{Nat}}}, \varphi(y) {\ensuremath{\vdash}}\varphi({\ensuremath{\mathfrak{s}}}y)
  }$$ $$(h)
  \inferrule*{
    (a) \\ (g)
  }{
    {\ensuremath{\vdash}}\forall y, n : {\ensuremath{\mathrm{Nat}}}\,.\, n \le 101 \supset 101 - n \le y \supset
    f(n) = 91
  }\;\raisebox{0.7em}{by~$n_i$}$$ $$(i)
  \inferrule*{
    n : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}(101 - n) : {\ensuremath{\mathrm{Nat}}}\\
    (h)
  }{
    n : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}\forall m : {\ensuremath{\mathrm{Nat}}}\,.\, m \le 101 \supset 101 - m
    \le 101 - n \supset f(m) = 91
  }$$ $$(j)
  \inferrule*{
    \inferrule*{
      \inferrule*{
        n : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}n : {\ensuremath{\mathrm{Nat}}}\\
        (i)
      }{
        n : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}n \le 101 \supset 101 - n \le 101 - n \supset
        f(n) = 91
      }
    }{
      n : {\ensuremath{\mathrm{Nat}}}, n \le 101 {\ensuremath{\vdash}}101 - n \le 101 - n \supset f(n) = 91
    }
  }{
    n : {\ensuremath{\mathrm{Nat}}}, n \le 101 {\ensuremath{\vdash}}f(n) = 91
  }$$ $$\inferrule*{
    \inferrule*{
      n : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}(n \le 101) : {\ensuremath{\mathrm{Prop}}}\\
      (j)
    }{
      n : {\ensuremath{\mathrm{Nat}}}{\ensuremath{\vdash}}n \le 101 \supset f(n) = 91
    }
    \\
    {\ensuremath{\vdash}}{\ensuremath{\mathrm{Nat}}}: {\ensuremath{\mathrm{Type}}}}{
    {\ensuremath{\vdash}}\forall n : {\ensuremath{\mathrm{Nat}}}\,.\, n \le 101 \supset f(n) = 91
  }$$

Semantics {#sec_semantics}
=========

In this appendix we define a semantics for ${\ensuremath{{\cal I}}}_s$ and for $e{\ensuremath{{\cal I}}}_s$. This semantics will be used in Appendix F to show consistency of ${\ensuremath{{\cal I}}}_s$ and $e{\ensuremath{{\cal I}}}_s$.

\[def\_I\_s\_structure\] An *${\ensuremath{{\cal I}}}_s$-structure* is a triple ${\ensuremath{{\cal A}}}= \langle A, \cdot,
  {\ensuremath{\llbracket\rrbracket_{}^{}}} \rangle$ where $A$ is the *domain* of ${\ensuremath{{\cal A}}}$, $\cdot$ is a binary operation on $A$, and the *interpretation* ${\ensuremath{\llbracket\rrbracket_{}^{}}} : {\ensuremath{\mathbb T}}\times A^V \to A$ is a function from ${\ensuremath{{\cal I}}}_s$-terms and valuations to $A$. We sometimes write $\cdot^{\ensuremath{{\cal A}}}$ and ${\ensuremath{\llbracket\rrbracket_{}^{{\ensuremath{{\cal A}}}}}}$ to indicate that these are components of ${\ensuremath{{\cal A}}}$.

A *valuation* $v$ is a function $v : V \to A$. We usually write ${\ensuremath{\llbrackett\rrbracket_{v}^{}}}$ instead of ${\ensuremath{\llbracket\rrbracket_{}^{}}}(t, v)$, and we drop the subscript when obvious or irrelevant. To stress that a valuation is associated with an ${\ensuremath{{\cal I}}}_s$-structure ${\ensuremath{{\cal A}}}$, we sometimes call it an ${\ensuremath{{\cal A}}}$-valuation. By $v[x/a]$ for $a \in A$ we denote a valuation $u$ such that $u(y) = v(y)$ for $y \ne x$ and $u(x) =
  a$. We use the abbreviations ${\ensuremath{{\cal T}}}^{\ensuremath{{\cal A}}}= \{ a \in A \;|\;
  {\ensuremath{\llbracketx : {\ensuremath{\mathrm{Type}}}\rrbracket_{\{x \mapsto a\}}^{{\ensuremath{{\cal A}}}}}} =
  {\ensuremath{\llbracket\top\rrbracket_{}^{{\ensuremath{{\cal A}}}}}}\}$ and $\iota^{\ensuremath{{\cal A}}}= \{ a \in A \;|\;
  {\ensuremath{\llbracketx : \iota\rrbracket_{\{x \mapsto a\}}^{{\ensuremath{{\cal A}}}}}} =
  {\ensuremath{\llbracket\top\rrbracket_{}^{{\ensuremath{{\cal A}}}}}}\}$ for $\iota \in {\ensuremath{{\cal T}}}_I$. The symbols $a$, $a'$, $b$, $b'$, etc. denote elements of $A$, unless otherwise stated. We often confuse $\top$, $\bot$, $\mathrm{Is}$, etc. with ${\ensuremath{\llbracket\top\rrbracket_{}^{}}}$, ${\ensuremath{\llbracket\bot\rrbracket_{}^{}}}$, ${\ensuremath{\llbracket\mathrm{Is}\rrbracket_{}^{}}}$, etc., to avoid onerous notation. It is always clear from the context which interpretation is meant.

\[def\_I\_s\_model\] An ${\ensuremath{{\cal I}}}_s$-model is an ${\ensuremath{{\cal I}}}_s$-structure ${\ensuremath{{\cal A}}}$ satisfying the following requirements:

-   ${\ensuremath{\llbracketx\rrbracket_{v}^{}}} = v(x)$ for $x \in V$,

-   ${\ensuremath{\llbrackett_1 t_2\rrbracket_{v}^{}}} = {\ensuremath{\llbrackett_1\rrbracket_{v}^{}}} \cdot
        {\ensuremath{\llbrackett_2\rrbracket_{v}^{}}}$,

-   ${\ensuremath{\llbracket\lambda x \,.\, t\rrbracket_{v}^{}}} \cdot a =
        {\ensuremath{\llbrackett\rrbracket_{v[x/a]}^{}}}$ for every $a \in A$,

-   if ${\ensuremath{{v}_{\upharpoonrightFV(t)}}} = {\ensuremath{{w}_{\upharpoonrightFV(t)}}}$ then ${\ensuremath{\llbrackett\rrbracket_{v}^{}}} = {\ensuremath{\llbrackett\rrbracket_{w}^{}}}$,

-   if for all $a \in A$ we have ${\ensuremath{\llbracket\lambda x
        \,.\, t_1\rrbracket_{v}^{}}} \cdot a = {\ensuremath{\llbracket\lambda x \,.\, t_2\rrbracket_{v}^{}}} \cdot a$ then ${\ensuremath{\llbracket\lambda x \,.\, t_1\rrbracket_{v}^{}}} = {\ensuremath{\llbracket\lambda x
          \,.\, t_2\rrbracket_{v}^{}}}$,

-   $\mathrm{Is} \cdot a \cdot {\ensuremath{\mathrm{Prop}}}= \top$ iff $a \in
        \{\top, \bot\}$,

-   ${\ensuremath{\llbracket{\ensuremath{\mathrm{Prop}}}: {\ensuremath{\mathrm{Type}}}\rrbracket_{}^{}}} = \top$,

-   ${\ensuremath{\llbracket\iota : {\ensuremath{\mathrm{Type}}}\rrbracket_{}^{}}} = \top$ for $\iota \in
        {\ensuremath{{\cal T}}}_I$,

-   if $a \in {\ensuremath{{\cal T}}}^{\ensuremath{{\cal A}}}$ and for all $c \in A$ such that $\mathrm{Is} \cdot c \cdot a = \top$ we have $b \cdot c = \top$ then $\forall \cdot a \cdot b = \top$,

-   if $a \in {\ensuremath{{\cal T}}}^{\ensuremath{{\cal A}}}$ and there exists $c \in A$ such that $\mathrm{Is} \cdot c \cdot a = \top$ and $b \cdot c =
        \bot$ then $\forall \cdot a \cdot b = \bot$,

-   if $\forall \cdot a \cdot b = \top$ then for all $c \in A$ such that $\mathrm{Is} \cdot c \cdot a = \top$ we have $b \cdot c = \top$,

-   if $\forall \cdot a \cdot b = \bot$ then there exists $c \in A$ such that $\mathrm{Is} \cdot c \cdot a = \top$ and $b \cdot c = \bot$,

-   $\vee \cdot a \cdot b = \top$ iff $a = \top$ or $b
        = \bot$,

-   $\vee \cdot a \cdot b = \bot$ iff $a = \bot$ and $b = \bot$,

-   if $\supset \cdot a \cdot b = \top$ then $a
        \in \{\top,\bot\}$, where $\supset = {\ensuremath{\llbracket\lambda x y \,.\,
          x \supset y\rrbracket_{}^{}}}$,

-   if $\bot = \top$ then for all $a \in A$ we have $a =
        \top$,

-   if $f \in A$, $a \in {\ensuremath{{\cal T}}}^{\ensuremath{{\cal A}}}$ and for all $c \in A$ such that $\mathrm{Is} \cdot c \cdot a = \top$ we have $\mathrm{Is} \cdot (f \cdot c) \cdot b = \top$, then $\mathrm{Is}
        \cdot f \cdot (\mathrm{Fun} \cdot a \cdot b) = \top$,

-   if $\mathrm{Is} \cdot f \cdot (\mathrm{Fun} \cdot a
        \cdot b) = \top$ and $\mathrm{Is} \cdot c \cdot a = \top$ then $\mathrm{Is} \cdot (f \cdot c) \cdot b = \top$,

-   if $a, b \in {\ensuremath{{\cal T}}}^{\ensuremath{{\cal A}}}$ then $\mathrm{Fun} \cdot a \cdot
        b \in {\ensuremath{{\cal T}}}^{\ensuremath{{\cal A}}}$,

-   if $\mathrm{Subtype} \cdot a \cdot b \in {\ensuremath{{\cal T}}}^{\ensuremath{{\cal A}}}$, $\mathrm{Is} \cdot c \cdot a = \top$ and $b \cdot c = \top$, then $\mathrm{Is} \cdot c \cdot (\mathrm{Subtype} \cdot a \cdot b) =
        \top$,

-   if $\mathrm{Is} \cdot c \cdot (\mathrm{Subtype} \cdot a
        \cdot b) = \top$ then $b \cdot c = \top$,

-   if $\mathrm{Is} \cdot c \cdot (\mathrm{Subtype} \cdot a
        \cdot b) = \top$ then $\mathrm{Is} \cdot c \cdot a = \top$,

-   if $a \in {\ensuremath{{\cal T}}}^{\ensuremath{{\cal A}}}$ and for all $c \in A$ such that $\mathrm{Is} \cdot c \cdot a = \top$ we have $b \cdot c \in
        \{\top, \bot\}$, then $\mathrm{Subtype} \cdot a \cdot b \in {\ensuremath{{\cal T}}}^{\ensuremath{{\cal A}}}$,

-   $o_i^\iota \cdot (c_i^\iota \cdot a_1 \cdot \ldots \cdot
        a_{n_i}) = \top$ where $o_i^\iota \in {\ensuremath{{\cal O}}}$ and $c_i^\iota \in {\ensuremath{{\cal C}}}$ has arity $n_i$,

-   $o_i^\iota \cdot (c_j^\iota \cdot a_1 \cdot \ldots \cdot
        a_{n_j}) = \bot$ where $i \ne j$, $o_i^\iota \in {\ensuremath{{\cal O}}}$, $c_j^\iota
        \in {\ensuremath{{\cal C}}}$ has arity $n_j$,

-   $d_{i,j}^\iota \cdot (c_i^\iota \cdot a_1 \cdot \ldots
        \cdot a_{n_i}) = a_j$ where $d_{i,j}^\iota \in {\ensuremath{{\cal D}}}$ and $c_i^\iota
        \in {\ensuremath{{\cal C}}}$ has arity $n_i$,

-   if for all $i=1,\ldots,m$ we have:

    -   for all $b_{1},\ldots,b_{n_i}$ such that

        -   $b_{j} \in {\iota_{i,j}^*}^{\ensuremath{{\cal A}}}$ for $j=1,\ldots,n_i$, and

        -   $a \cdot b_{k} = \top$ for $1 \le k \le n_i$ such that $\iota_{i,k} = \star$

        we have $a \cdot (c_i^\iota \cdot b_{1} \cdot \ldots \cdot
              b_{n_i}) = \top$

    then $\forall\cdot \iota^{\ensuremath{{\cal A}}}\cdot a = \top$, where $c_i^\iota \in
        {\ensuremath{{\cal C}}}$ has arity $n_i$, $\iota \in {\ensuremath{{\cal T}}}_I$, $\iota_{i,j}^* =
        \iota_{i,j}$ if $\iota_{i,j} \in {\ensuremath{{\cal T}}}_I$, $\iota_{i,j}^* = \iota$ if $\iota_{i,j} = \star$, and $\iota = \mu(\langle \iota_{1,1},
        \ldots, \iota_{1,n_1} \rangle, \ldots, \langle \iota_{m,1},
        \ldots, \iota_{m,m_i} \rangle)$,

-   if $a_j \in {\iota_{i,j}^*}^{\ensuremath{{\cal A}}}$ for $i=1,\ldots,n_i$ then $c_i^\iota \cdot a_1 \cdot \ldots \cdot a_{n_i} \in
        \iota^{\ensuremath{{\cal A}}}$, where $c_i^\iota \in {\ensuremath{{\cal C}}}$ has arity $n_i$, $\iota \in
        {\ensuremath{{\cal T}}}_I$, $\iota_{i,j}^* = \iota_{i,j}$ if $\iota_{i,j} \in {\ensuremath{{\cal T}}}_I$, $\iota_{i,j}^* = \iota$ if $\iota_{i,j} = \star$, $\iota =
        \mu(\langle \iota_{1,1}, \ldots, \iota_{1,n_1} \rangle, \ldots,
        \langle \iota_{m,1}, \ldots, \iota_{m,m_i} \rangle)$,

-   if for $a \in {\ensuremath{{\cal T}}}^{\ensuremath{{\cal A}}}$ there exists $b \in A$ such that $\mathrm{Is} \cdot b \cdot a = \top$ then $\mathrm{Is} \cdot
        (\epsilon \cdot a) \cdot a = \top$,

-   $\mathrm{Cond} \cdot \top \cdot a \cdot b = a$,

-   $\mathrm{Cond} \cdot \bot \cdot a \cdot b = b$,

-   $\mathrm{Eq} \cdot a \cdot b = \top$ iff $a = b$,

An *$e{\ensuremath{{\cal I}}}_s$-model* is an *${\ensuremath{{\cal I}}}_s$-model* which additionally satisfies:

-   if $a, b \in {\ensuremath{{\cal T}}}^{\ensuremath{{\cal A}}}$, $\mathrm{Is} \cdot f \cdot
        (\mathrm{Fun} \cdot a \cdot b) = \top$, $\mathrm{Is} \cdot g \cdot
        (\mathrm{Fun} \cdot a \cdot b) = \top$, and for all $c \in A$ such that $\mathrm{Is} \cdot c \cdot a = \top$, and all $p \in A$ such that $\mathrm{Is} \cdot p \cdot (\mathrm{Fun} \cdot b \cdot {\ensuremath{\mathrm{Prop}}})
        = \top$ we have $p \cdot (f \cdot c) = p \cdot (g \cdot c)$, then for all $p \in A$ such that $\mathrm{Is} \cdot p \cdot
        (\mathrm{Fun} \cdot (\mathrm{Fun} \cdot a \cdot b) \cdot {\ensuremath{\mathrm{Prop}}}) =
        \top$ we have $p \cdot f = p \cdot g$,

-   if ${\supset} \cdot a \cdot b = {\supset} \cdot b \cdot
        a = \top$ then $a = b$.

Here ${\supset} = {\ensuremath{\llbracket\lambda x y \,.\, x \supset y\rrbracket_{}^{}}}$.

For a term $\varphi$ and a valuation $u$ we write ${\ensuremath{{\cal A}}},u \models
  \varphi$ if ${\ensuremath{\llbracket\varphi\rrbracket_{u}^{{\ensuremath{{\cal A}}}}}} = \top$. Given a set of terms $\Gamma$, we use the notation ${\ensuremath{{\cal A}}}, u \models \Gamma$ if ${\ensuremath{{\cal A}}},
  u \models \varphi$ for all $\varphi \in \Gamma$. We drop the subscript ${\ensuremath{{\cal A}}}$ when obvious or irrelevant. We write $\Gamma
  \models_{{\ensuremath{{\cal I}}}_s} \varphi$ if for every ${\ensuremath{{\cal I}}}_s$-model ${\ensuremath{{\cal A}}}$ and every valuation $u$, the condition ${\ensuremath{{\cal A}}}, u \models \Gamma$ implies ${\ensuremath{{\cal A}}}, u
  \models \varphi$. The notation $\Gamma \models_{e{\ensuremath{{\cal I}}}_s} \varphi$ is defined analogously. The subscript is dropped when obvious from the context or irrelevant.

Note that every (nontrivial) ${\ensuremath{{\cal I}}}_s$-model is a $\lambda$-model. See e.g. [@Barendregt1984 Chapter 5] for a definition of a $\lambda$-model.

\[lem\_I\_s\_model\_conditions\] In every ${\ensuremath{{\cal I}}}_s$-model ${\ensuremath{{\cal A}}}$ the following conditions hold.

-   ${\wedge} \cdot a \cdot b = \top$ iff $a = \top$ and $b = \top$,

-   ${\wedge} \cdot a \cdot b = \bot$ iff $a = \bot$ or $b = \bot$,

-   if $a \in {\ensuremath{{\cal T}}}^{\ensuremath{{\cal A}}}$ and there exists $c \in
        A$ such that $\mathrm{Is} \cdot c \cdot a = \top$ and $b \cdot c =
        \top$ then $\exists \cdot a \cdot b = \top$,

-   if $a \in {\ensuremath{{\cal T}}}^{\ensuremath{{\cal A}}}$ and for all $c \in A$ such that $\mathrm{Is} \cdot c \cdot a = \top$ we have $b \cdot c
        = \bot$ then $\exists \cdot a \cdot b = \bot$,

-   if $\exists \cdot a \cdot b = \top$ then there exists $c \in A$ such that $\mathrm{Is} \cdot c \cdot a = \top$ and $b \cdot c = \top$,

-   $\supset \cdot a \cdot b = \top$ iff $a =
        \bot$, or $a = b =\top$,

-   $\supset \cdot a \cdot b = \bot$ iff $a = \top$ and $b = \bot$,

-   $\neg \cdot a = \bot$ iff $a = \top$,

-   $\neg \cdot a = \top$ iff $a = \bot$.

Here $\supset = {\ensuremath{\llbracket\lambda x y \,.\, x \supset y\rrbracket_{}^{}}}$, $\neg = {\ensuremath{\llbracket\lambda x \,.\, \neg x\rrbracket_{}^{}}}$, $\wedge =
  {\ensuremath{\llbracket\lambda x y \,.\, \neg ((\neg x) \vee (\neg y))\rrbracket_{}^{}}}$ and $\exists = {\ensuremath{\llbracket\lambda x y \,.\, \neg (\forall\, x\, \lambda
    z \,.\, \neg(y z))\rrbracket_{}^{}}}$.

Easy.

\[lem\_I\_s\_ef\_condition\] In every ${\ensuremath{{\cal I}}}_s$-model ${\ensuremath{{\cal A}}}$, for any $a \in {\ensuremath{{\cal T}}}^{\ensuremath{{\cal A}}}$ and $b, c \in
  {\ensuremath{{\cal A}}}$ such that $\mathrm{Is} \cdot b \cdot a = \top$ and $\mathrm{Is}
  \cdot c \cdot a = \top$, the condition

-   for all $p \in {\ensuremath{{\cal A}}}$ such that $\mathrm{Is} \cdot p \cdot
        (\mathrm{Fun} \cdot a \cdot {\ensuremath{\mathrm{Prop}}}) = \top$ we have ${\supset}
        \cdot (p \cdot b) \cdot (p \cdot c) = \top$

is equivalent to

-   for all $p \in {\ensuremath{{\cal A}}}$ such that $\mathrm{Is} \cdot p \cdot
        (\mathrm{Fun} \cdot a \cdot {\ensuremath{\mathrm{Prop}}}) = \top$ we have $p \cdot b = p
        \cdot c$

where ${\supset} = {\ensuremath{\llbracket\lambda x y \,.\, x \supset y\rrbracket_{}^{}}}$.

It is obvious from the definition of ${\supset}$ and the conditions ($\to_e$) and (pr) that (2) implies (1). We show that (1) implies (2). Let $p \in {\ensuremath{{\cal A}}}$ be such that $\mathrm{Is} \cdot p \cdot
  (\mathrm{Fun} \cdot a \cdot {\ensuremath{\mathrm{Prop}}}) = \top$ and let $b, c \in {\ensuremath{{\cal A}}}$ be such that $\mathrm{Is} \cdot b \cdot a = \top$ and $\mathrm{Is}
  \cdot c \cdot a = \top$. By ($\to_e$) and (pr) we have $p \cdot b
  \in \{\top,\bot\}$ and $p \cdot c \in \{\top,\bot\}$. If $p \cdot b
  = \top$ then we must have $p \cdot c = \top$ as well, by definition of ${\supset}$. If $p \cdot b = \bot$ then it is easy to see that $p' = {\ensuremath{\llbracket\lambda x . \neg(y x)\rrbracket_{\{y \mapsto p\}}^{}}}$ also satisfies $\mathrm{Is} \cdot p' \cdot (\mathrm{Fun} \cdot a \cdot
  {\ensuremath{\mathrm{Prop}}}) = \top$. We have $p' \cdot b = \top$, which implies $p' \cdot
  c = \top$, which means that $p \cdot c = \bot$ by ($\neg_\bot$).

\[thm\_sound\] If $\Gamma {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}} \varphi$ then $\Gamma \models_{\ensuremath{{\cal I}}}\varphi$, where ${\ensuremath{{\cal I}}}= {\ensuremath{{\cal I}}}_s$ or ${\ensuremath{{\cal I}}}= e{\ensuremath{{\cal I}}}_s$.

Induction on the length of derivation. All cases follow easily from appropriate conditions in the definition of an ${\ensuremath{{\cal I}}}_s$-model or from Lemma \[lem\_I\_s\_model\_conditions\]. With the rule $e_f$ we also need to use Lemma \[lem\_I\_s\_ef\_condition\].

For instance, suppose $\Gamma {\ensuremath{\vdash}}{\ensuremath{\mathrm{Eq}\,({\ensuremath{\mathrm{Cond}\,\varphi\,t_1\,t_2\,}})\,({\ensuremath{\mathrm{Cond}\,\varphi\,t_1'\,t_2\,}})\,}}$ was obtained by rule $c_3$. By the inductive hypothesis we have $\Gamma,
  \varphi \models {\ensuremath{\mathrm{Eq}\,t_1\,t_1'\,}}$ and $\Gamma \models \varphi :
  {\ensuremath{\mathrm{Prop}}}$. Assume ${\ensuremath{{\cal M}}}, u \models \Gamma$. We have ${\ensuremath{{\cal M}}}, u \models
  \varphi : {\ensuremath{\mathrm{Prop}}}$, so ${\ensuremath{\llbracket\varphi : {\ensuremath{\mathrm{Prop}}}\rrbracket_{u}^{{\ensuremath{{\cal M}}}}}} =
  \top$. By condition (pr) we obtain ${\ensuremath{\llbracket\varphi\rrbracket_{u}^{{\ensuremath{{\cal M}}}}}} \in
  \{\top, \bot\}$. Suppose ${\ensuremath{\llbracket\varphi\rrbracket_{u}^{{\ensuremath{{\cal M}}}}}} = \top$. Then ${\ensuremath{{\cal M}}}, u \models \Gamma, \varphi$, so ${\ensuremath{\llbracket{\ensuremath{\mathrm{Eq}\,t_1\,t_1'\,}}\rrbracket_{u}^{{\ensuremath{{\cal M}}}}}} = \top$. Hence by conditions (app), (eq) and (c1), we have ${\ensuremath{\llbracket{\ensuremath{\mathrm{Cond}\,\varphi\,t_1\,t_2\,}}\rrbracket_{u}^{{\ensuremath{{\cal M}}}}}} =
  {\ensuremath{\llbracket{\ensuremath{\mathrm{Cond}\,\varphi\,t_1'\,t_2\,}}\rrbracket_{u}^{{\ensuremath{{\cal M}}}}}}$. By conditions (app) and (eq) we obtain ${\ensuremath{{\cal M}}}, u \models
  {\ensuremath{\mathrm{Eq}\,({\ensuremath{\mathrm{Cond}\,\varphi\,t_1\,t_2\,}})\,({\ensuremath{\mathrm{Cond}\,\varphi\,t_1'\,t_2\,}})\,}}$. So suppose ${\ensuremath{\llbracket\varphi\rrbracket_{u}^{{\ensuremath{{\cal M}}}}}} = \bot$. Then we obtain the thesis by applying conditions (app), (c2) and (eq).

Other cases are established in a similar way.

If $\Gamma \models_{e{\ensuremath{{\cal I}}}_s} \varphi$ then $\Gamma {\ensuremath{\vdash}}_{e{\ensuremath{{\cal I}}}_s}
  \varphi$.

We do not attempt to prove the above conjecture in this paper, as it is not necessary for establishing consistency of $e{\ensuremath{{\cal I}}}_s$, which is our main concern here. We treat the semantics given merely as a technical device in the consistency proof.

Model Construction {#sec_construction}
==================

In this appendix we construct a nontrivial $e{\ensuremath{{\cal I}}}_s$-model, thus establishing consistency of the systems ${\ensuremath{{\cal I}}}_s$ and $e{\ensuremath{{\cal I}}}_s$. The construction is parametrized by a set of constants $\delta$. We will use this construction in the next appendix to show a complete translation of classical first-order logic into ${\ensuremath{{\cal I}}}_s$ and $e{\ensuremath{{\cal I}}}_s$.

The construction is an adaptation and extension of the one from [@Czajka2013Accepted] for the traditional illative system ${\ensuremath{{\cal I}}}_\omega$. The proof is perhaps a bit easier to understand, because we do not have to deal with certain oddities of traditional illative systems from [@Czajka2013Accepted], like e.g. the fact that $t : {\ensuremath{\mathrm{Prop}}}$ is defined as equivalent to $(\lambda x \,.\, t) :
{\ensuremath{\mathrm{Type}}}$ where $x \notin FV(t)$, using the notation of the present paper.

For two sets $\tau_1$ and $\tau_2$, we denote by $\tau_2^{\tau_1}$ the set of all (set-theoretical) functions from $\tau_1$ to $\tau_2$. Formally, $f \in \tau_2^{\tau_1}$ is a subset of $\tau_1
\times \tau_2$ such that for every $f_1 \in \tau_1$ there is exactly one $f_2 \in \tau_2$ such that ${\langlef_1,f_2\rangle} \in f$.

\[def\_canonical\] The subset ${\ensuremath{\mathbb T}}_I$ of ${\ensuremath{{\cal I}}}_s$-terms is defined inductively by the following rule:

-   for every $c_i^\iota \in {\ensuremath{{\cal C}}}$ of arity $n_i$, if $t_1,\ldots,t_{n_i} \in {\ensuremath{\mathbb T}}_I$ then $c_i^\iota t_1 \ldots t_{n_i}
        \in {\ensuremath{\mathbb T}}_I$.

The set ${\ensuremath{{\cal K}}}$ consists of unique fresh constants, one for each element of ${\ensuremath{\mathbb T}}_I$. By $\bar{c}_i^\iota(\bar{t}_1,\ldots,\bar{t}_{n_i}) \in {\ensuremath{{\cal K}}}$ we denote the constant corresponding to $c_i^\iota t_1 \ldots t_{n_i} \in
  {\ensuremath{{\cal K}}}$. Each basic inductive type $\iota \in {\ensuremath{{\cal T}}}_I$ determines in an obvious way a subset of ${\ensuremath{\mathbb T}}_I$ (the set of all terms generated by the constructors of $\iota$, respecting argument types), and thus it determines a subset $\bar{\iota} \subseteq {\ensuremath{{\cal K}}}$. Let $\bar{{\ensuremath{{\cal T}}}}_I =
  \{\bar{\iota} \;|\; \iota \in {\ensuremath{{\cal T}}}_I\}$. Note that $\bigcup
  \bar{{\ensuremath{{\cal T}}}}_I = {\ensuremath{{\cal K}}}$ and $\bar{\iota_1} \cap \bar{\iota_2} =
  \emptyset$ if $\iota_1 \ne \iota_2$.

Let ${\ensuremath{\mathrm{Bool}}}= \{{\ensuremath{\mathbf{t}}}, {\ensuremath{\mathbf{f}}}\}$ and ${\ensuremath{{\cal T}}}_0 = \{\delta, {\ensuremath{\mathrm{Bool}}},
  \emptyset\} \cup \bar{{\ensuremath{{\cal T}}}}_I$, where ${\ensuremath{\mathbf{t}}}$ and ${\ensuremath{\mathbf{f}}}$ are fresh constants. We define ${\ensuremath{{\cal T}}}_{n+1}$ as follows.

-   If $\tau \in {\ensuremath{{\cal T}}}_n$ and $\tau' \subseteq \tau$ then $\tau' \in
        {\ensuremath{{\cal T}}}_{n+1}$.

-   If $\tau_1, \tau_2 \in {\ensuremath{{\cal T}}}_n$ then $\tau_2^{\tau_1} \in
        {\ensuremath{{\cal T}}}_{n+1}$.

The set of *types* is now defined by ${\ensuremath{{\cal T}}}=
  \bigcup_{n\in{\ensuremath{\mathbb{N}}}}{\ensuremath{{\cal T}}}_n$.

We define a notation $\tau^{(\tau_1,\ldots,\tau_n)}$ inductively as follows:

-   $\tau^{(\tau_1)} = \tau^{\tau_1}$,

-   $\tau^{(\tau_1,\tau_2,\ldots,\tau_n)} =
        (\tau^{(\tau_2,\ldots,\tau_n)})^{\tau_1}$.

We define the set of *canonical constants* as $\Sigma = \delta
  \cup {\ensuremath{\mathrm{Bool}}}\cup {\ensuremath{{\cal K}}}\cup \Sigma_f$, where $\Sigma_f$ contains a unique fresh constant for each function in $\bigcup {\ensuremath{{\cal T}}}$. We denote the function corresponding to a constant $c \in \Sigma_f$ by ${\ensuremath{{\cal F}}}(c)$. To save on notation we often confuse constants $c \in
  \Sigma_f$ with their corresponding functions, and write e.g. $c \in
  \tau$ instead of ${\ensuremath{{\cal F}}}(c) \in \tau$, for $\tau \in {\ensuremath{{\cal T}}}$. It is always clear from the context what we mean. Note that if ${\ensuremath{{\cal F}}}(c) \in
  \tau_2^{\tau_1}$ then $\tau_1$ is uniquely determined. This is because ${\ensuremath{{\cal F}}}(c)$ is a set-theoretical function, i.e. a set of pairs, so its domain is uniquely determined. Note also that if ${\ensuremath{{\cal F}}}(c) \in
  \tau_2^{\tau_1}$ and ${\ensuremath{{\cal F}}}(c) \in {\tau_2'}^{\tau_1}$, then ${\ensuremath{{\cal F}}}(c)
  \in {(\tau_2 \cap \tau_2')}^{\tau_1}$.

Let $v, w \in \Sigma^*$. We write $v \sqsubseteq w$ if $w = vu$ for some $u \in \Sigma^*$, i.e. when $v$ is a prefix of $w$. We use the notation $v \sqsubset w$ when $v \sqsubseteq w$ and $v \ne w$.

A *$\Sigma$-tree* $T$ is a set of strings over the alphabet $\Sigma$, i.e. a subset of $\Sigma^*$, satisfying the following conditions:

-   if $w \in T$ and $v \sqsubseteq w$ then $v \in T$ (prefix-closedness),

-   $\sqsubseteq^{-1}$ is well-founded on $T$ (no infinite branches).

A *node* of a $\Sigma$-tree $T$ is any $w \in T$. We say that a node $w \in T$ is a *leaf* if there is no $w' \in T$ such that $w \sqsubset w'$. If $w \in T$ is not a leaf, then it is an *internal node*. The *root* of a $\Sigma$-tree is the empty string $\epsilon$.

We say that $T_1$ is a *subtree* of $T_2$ if there exists $w
  \in T_2$ such that $T_1 = \{v \in \Sigma^* \;|\; wv \in T_2\}$.

Note that a relation $\le$, defined by $T_1 \le T_2$ iff $T_1$ is a subtree of $T_2$, is a well-founded partial order, because $\Sigma$-trees have no infinite branches. This allows us to perform *induction on the structure of a $\Sigma$-tree*. We write $T_1
  < T_2$ if $T_1 \le T_2$ and $T_1 \ne T_2$.

The *height* $h(T)$ of a $\Sigma$-tree $T$ is an ordinal defined by induction on the structure of $T$.

-   If $T = \emptyset$ then $h(T) = 0$.

-   If $T \ne \emptyset$ then $h(T) = \sup_{T' < T} (h(T') + 1)$.

The set of constants $\Sigma^+$ is defined as $$\Sigma^+ = \Sigma \cup {\ensuremath{{\cal T}}}\cup \{\forall, \vee, \mathrm{Is},
  \mathrm{Subtype}, \mathrm{Fun}, \mathrm{Eq}, \mathrm{Cond},
  \mathrm{Choice}, {\ensuremath{\mathrm{Type}}}\} \cup {\ensuremath{{\cal C}}}\cup {\ensuremath{{\cal D}}}\cup {\ensuremath{{\cal O}}}$$ where ${\ensuremath{{\cal C}}}$, ${\ensuremath{{\cal D}}}$ and ${\ensuremath{{\cal O}}}$ are the sets of constructors, destructors and tests from the definition of ${\ensuremath{{\cal I}}}_s$. Note that for each $\tau \in {\ensuremath{{\cal T}}}$ we have $\tau \in \Sigma^+$ as a constant.

We use $V^+$ to denote a set of variables of cardinality at least the cardinality of $\Sigma^*$.

The set of *operation symbols* ${\ensuremath{\mathrm{Op}}}$ is defined to contain the following:

-   $\cdot \in {\ensuremath{\mathrm{Op}}}$,

-   if $x \in V^+$ then $\lambda x \in {\ensuremath{\mathrm{Op}}}$,

-   if $\tau \in {\ensuremath{{\cal T}}}$ and $\tau \ne \emptyset$ then ${\ensuremath{\mathrm{A}}}\tau \in
        {\ensuremath{\mathrm{Op}}}$ and ${\ensuremath{\mathrm{S}}}\tau \in {\ensuremath{\mathrm{Op}}}$.

Intuitively, ${\ensuremath{\mathrm{A}}}\tau$ means “for all elements of $\tau$ satisfying …”, and ${\ensuremath{\mathrm{S}}}\tau$ means “a subtype of $\tau$ consisting of elements satisfying …”. These will appear as node labels in a $\Sigma$-tree representing a semantic term. A node labelled with e.g. ${\ensuremath{\mathrm{S}}}\tau$ will have a child corresponding to each element of $\tau$. The subtype represented by this node will consist of those elements for which the corresponding child reduces to ${\ensuremath{\mathbf{t}}}$.

A *semantic term* is a pair ${\langle{\mbox{\cal Pos}},\kappa\rangle}$, where ${\mbox{\cal Pos}}$ is a $\Sigma$-tree and $\kappa : {\mbox{\cal Pos}}\to {\ensuremath{\mathrm{Op}}}\cup \Sigma^+ \cup
  V^+$ is a function such that:

-   $w \in {\mbox{\cal Pos}}$ is a leaf iff $\kappa(w) \in \Sigma^+ \cup V^+$,

-   if $\kappa(w) = \lambda x$ then $w0 \in {\mbox{\cal Pos}}$ and $wc \notin {\mbox{\cal Pos}}$ for $c \ne 0$,

-   if $\kappa(w) = \cdot$ then $w0, w1 \in {\mbox{\cal Pos}}$ and $wc \notin
        {\mbox{\cal Pos}}$ for $c \notin \{0,1\}$,

-   if $\kappa(w) \in \{ {\ensuremath{\mathrm{A}}}\tau, {\ensuremath{\mathrm{S}}}\tau\}$ then $wc \in
        {\mbox{\cal Pos}}$ iff $c \in \tau$.

In other words, semantic terms are possibly infinitely branching well-founded trees, whose internal nodes are labelled with operation symbols ${\ensuremath{\mathrm{Op}}}$, and leaves are labelled with constants from $\Sigma^+$ or variables from $V^+$.

We usually denote semantic terms by $t$, $t_1$, $t_2$, etc. We write ${\mbox{\cal Pos}}(t)$ for the underlying tree of $t$, and ${\ensuremath{{t}^{|p}}}$ instead of $\kappa(p)$.

The *height* of a semantic term $t$, denoted $h(t)$, is the height of its associated $\Sigma$-tree. When we say that we perform *induction on the structure of a semantic term* we mean induction on $h(t)$. By induction on an ordinal $\alpha$ and the structure of a semantic term we mean induction on pairs ${\langle\alpha,h(t)\rangle}$ ordered lexicographically.

A *position* in a semantic term $t$ is a string $w \in
  {\mbox{\cal Pos}}(t)$. The *subterm* of $t$ at position $p \in {\mbox{\cal Pos}}(t)$, denoted ${\ensuremath{{t}_{|p}}}$, is a semantic term ${\langle{\mbox{\cal Pos}}',\kappa'\rangle}$ where:

-   ${\mbox{\cal Pos}}' = \{ w \in \Sigma^* \;|\; pw \in {\mbox{\cal Pos}}(t) \}$,

-   $\kappa'(w) = \kappa(pw)$.

A variable $x \in V^+$ is *free* in a semantic term $t$ if there exists $p \in {\mbox{\cal Pos}}(t)$ such that ${\ensuremath{{t}^{|p}}} = x$ and for no $p' \sqsubseteq p$ we have ${\ensuremath{{t}^{|p}}} = \lambda x$. A variable is *bound* if it is not free.

We identify $\alpha$-equivalent semantic terms, i.e. ones differing only in the names of bound variables. We assume that no semantic term contains some variable both free and bound. We use the symbol $\equiv$ for identity of semantic terms up to $\alpha$-equivalence.

Substitution $t[x/t']$ for semantic terms is defined in an obvious way, avoiding variable capture. In other words, we adopt the convention that whenever we write a term of the form $t[x/t']$ we assume that no free variables of $t'$ become bound in $t[x/t']$.

In this section, when we speak of terms we mean semantic terms, unless otherwise stated. We often use abbreviations for semantic terms of the form $\lambda x \,.\, t$, $t_1 t_2$, $\lambda x
. (\mathrm{Fun}\,{x}\,{(t_1 t_2)})$, etc. The meaning of these abbreviations is obvious.

A *rewriting system* $R$ is a set of pairs of semantic terms. We usually write ${\ensuremath{t_1\rightarrowt_2}} \in R$ instead of ${\langlet_1,t_2\rangle} \in R$. A term $t$ is said to *$R$-contract* to a term $t'$ at position $p$, denoted $t {\ensuremath{\rightarrow}}_R^p t'$, if $p \in
  {\mbox{\cal Pos}}(t) \cap {\mbox{\cal Pos}}(t')$, the terms $t$ and $t'$ differ only in subterms at position $p$, and there exists ${\ensuremath{t_1\rightarrowt_2}} \in
  R$ such that ${\ensuremath{{t}_{|p}}} \equiv t_1$ and ${\ensuremath{{t'}_{|p}}} \equiv
  t_2$. We write $t {\ensuremath{\rightarrow}}_R t'$ if $t {\ensuremath{\rightarrow}}_R^p t'$ for some $p \in
  {\mbox{\cal Pos}}(t)$.

For each ordinal $\alpha$, we define two relations ${\ensuremath{\Rightarrow}}_R^\alpha$ and $\succ_R^\alpha$ by induction on the ordinal $\alpha$ and the structure of $t$.

-   If $c \in \Sigma$ then $c \succ_R^\alpha c$.

-   If $c \in \tau_2^{\tau_1}$ and for all $c_1 \in \tau_1$ there exists $t'$ such that $t c_1 {\ensuremath{\stackrel{*\;<\alpha}{\Rightarrow_{R}\;\,}}} t'
        \succ_R^{<\alpha} {\ensuremath{{\cal F}}}(c)(c_1)$, then $t \succ_R^\alpha c$.

-   If $t \equiv t'$ or $t {\ensuremath{\rightarrow}}_R^\epsilon t'$ then $t
        {\ensuremath{\Rightarrow}}_R^\alpha t'$.

-   If $t_1 {\ensuremath{\Rightarrow}}_R^\alpha t_1'$ and $t_2
        {\ensuremath{\Rightarrow}}_R^\alpha t_2'$ then $t_1 t_2 {\ensuremath{\Rightarrow}}_R^\alpha t_1'
        t_2'$.

-   If $t {\ensuremath{\Rightarrow}}_R^\alpha t'$ then $\lambda x \,.\, t
        {\ensuremath{\Rightarrow}}_R^\alpha \lambda x \,.\, t'$.

-   If $t_1 {\ensuremath{\Rightarrow}}_R^{\alpha} t_1'$ and $t_2
        {\ensuremath{\Rightarrow}}_R^{\alpha} t_2'$ then $(\lambda x \,.\, t_1) t_2
        {\ensuremath{\Rightarrow}}_R^\alpha t_1'[x/t_2']$.

-   If $c \in \Sigma^+$, $n \in {\ensuremath{\mathbb{N}}}$, $c t_1' \ldots t_n'
        {\ensuremath{\rightarrow}}_R^\epsilon t$ and $t_i {\ensuremath{\Rightarrow}}_R^\alpha t_i'$ for $i=1,\ldots,n$, then $c t_1 \ldots t_n {\ensuremath{\Rightarrow}}_R^\alpha t$.

-   If $t \succ_R^{<\alpha} c_1 \in \tau_1$ and $c \in
        \tau_2^{\tau_1}$, then $c t {\ensuremath{\Rightarrow}}_R^\alpha {\ensuremath{{\cal F}}}(c)(c_1)$.

-   If $t \succ_R^{<\alpha} c$ for some $c \in \tau \in {\ensuremath{{\cal T}}}$ then ${\ensuremath{\mathrm{Is}\,t\,\tau\,}} {\ensuremath{\Rightarrow}}_R^\alpha {\ensuremath{\mathbf{t}}}$.

-   If ${\ensuremath{{t}^{|\epsilon}}} \equiv {\ensuremath{{t'}^{|\epsilon}}} \equiv
        {\ensuremath{\mathrm{A}}}\tau$ or ${\ensuremath{{t}^{|\epsilon}}} \equiv {\ensuremath{{t'}^{|\epsilon}}}
        \equiv {\ensuremath{\mathrm{S}}}\tau$, and for all $c \in \tau$ there exists $t''$ such that ${\ensuremath{{t}_{|c}}} {\ensuremath{\Rightarrow}}_R^\alpha t'' {\ensuremath{\stackrel{*\;<\alpha}{\Rightarrow_{R}\;\,}}}
        {\ensuremath{{t'}_{|c}}}$, then $t {\ensuremath{\Rightarrow}}_R^\alpha t'$.

The notation ${\ensuremath{\Rightarrow}}_R^{<\alpha}$ is an abbreviation for $\bigcup_{\gamma<\alpha}{\ensuremath{\Rightarrow}}_R^{\gamma}$, and ${\ensuremath{\stackrel{*\;<\alpha}{\Rightarrow_{R}\;\,}}}$ denotes the transitive-reflexive closure of ${\ensuremath{\Rightarrow}}_R^{<\alpha}$. The notation $\succ_R^{<\alpha}$ is an abbreviation for $\bigcup_{\gamma<\alpha}\succ_R^\gamma$.

We define the relations ${\ensuremath{\Rightarrow}}_R$ and $\succ_R$ as the smallest fixpoint of the above construction, i.e. by monotonicity of the definition there exists the least ordinal $\zeta$ such that ${\ensuremath{\Rightarrow}}_R^\zeta \,=\, {\ensuremath{\Rightarrow}}_R^{<\zeta}$ and $\succ_R^\zeta
  \,=\, \succ_R^{<\zeta}$, and we take ${\ensuremath{\Rightarrow}}_R \,=\,
  {\ensuremath{\Rightarrow}}_R^\zeta$, $\succ_R \,=\, \succ_R^\zeta$. Note that $\omega$ steps do not suffice to reach the fixpoint. In fact, the ordinal $\zeta$ will be quite large.

We denote by ${\ensuremath{\stackrel{*}{\Rightarrow}}}_R$ the transitive-reflexive closure of ${\ensuremath{\Rightarrow}}_R$, and by ${\ensuremath{\stackrel{*}{\Leftrightarrow}}}_R$ the transitive-reflexive-symmetric closure of ${\ensuremath{\Rightarrow}}_R$. The subscript is often dropped when obvious from the context.

Notice that the relation ${\ensuremath{\Rightarrow}}_R$ encompasses an analogon of $\beta$-reduction, regardless of what the rules of $R$ are. Intuitively, the relation ${\ensuremath{\Rightarrow}}_R$ is a kind of parallel reduction on semantic terms, parametrized by the rules of $R$.

If $R \subseteq R'$ then ${\ensuremath{\Rightarrow}}_R \,\subseteq\,{\ensuremath{\Rightarrow}}_{R'}$ and $\succ_R \,\subseteq\,\succ_{R'}$.

Intuitively, and very informally, $t \succ_R c$ is intended to hold if $c \in \tau \in {\ensuremath{{\cal T}}}$ is a “canonical” object which “simulates” $t$ in type $\tau$. By $c$ “simulating” $t$ in type $\tau$ we mean that $c$ behaves in essentially the same way as $t$, modulo ${\ensuremath{\Rightarrow}}_R$, whenever a term of type $\tau$ is “expected”. Let us give some examples to elucidate what we mean by this. For instance, let $c_1 \in {\ensuremath{\mathrm{Nat}}}^{\ensuremath{\mathrm{Nat}}}= \tau_1$, $c_2 \in
\delta^\delta = \tau_2$ be two constants such that ${\ensuremath{{\cal F}}}(c_1)(c) \equiv
c$ for all $c \in {\ensuremath{\mathrm{Nat}}}$ and ${\ensuremath{{\cal F}}}(c_2)(c) \equiv c$ for all $c \in
\delta$. Note that by condition (6) in the definition of ${\ensuremath{\Rightarrow}}_R$ and the fact that $c_1 \succ_R c_1$ and $c_2 \succ_R c_2$ we have $c_1
c {\ensuremath{\Rightarrow}}_R c$ for all $c \in {\ensuremath{\mathrm{Nat}}}$ and $c_2 c {\ensuremath{\Rightarrow}}_R c$ for all $c \in \delta$. Now we have both $\lambda x \,.\, x \succ_R c_1$ and $\lambda x \,.\, x \succ_R c_2$, because $\lambda x \,.\, x$ behaves exactly like $c_1$ when given arguments of type ${\ensuremath{\mathrm{Nat}}}$, and exactly like $c_2$ when given arguments of type $\delta$. The condition (6) ensures that $\lambda x . x$ and $c_1$ will be indistinguishable wherever a term of type $\tau_1$ is “expected”. For instance, if $d
\in \delta^{\tau_1}$ then we have $d (\lambda x \,.\, x) {\ensuremath{\Rightarrow}}_R
{\ensuremath{{\cal F}}}(d)(c_1)$. In fact, we will later prove that, for an appropriate rewriting system $R$, the conditions $t c {\ensuremath{\stackrel{*}{\Rightarrow}}}_R t' \succ_R c'$ and $r \succ_R c$ imply the existence of $t''$ such that $t r
{\ensuremath{\stackrel{*}{\Rightarrow}}}_R t'' \succ_R c'$, where $t$ is an arbitrary term.

Note that we may have $c_1 \succ_R c_2$ with $c_1, c_2 \in \Sigma$, $c_1 \not\equiv c_2$ (i.e. $c_1$ and $c_2$ being two distinct canonical constants), if there does not exist a single $\tau \in {\ensuremath{{\cal T}}}$ such that $c_1,c_2 \in \tau$. We will later show that this is not possible, for a rewriting system $R$ to be defined, if such a $\tau
\in {\ensuremath{{\cal T}}}$ does exist.

We will build our model from equivalence classes of ${\ensuremath{\stackrel{*}{\Leftrightarrow}}}_R$ on semantic terms, for a certain rewriting system $R$ to be defined below. One of the main problems in the model construction is to ensure that the condition $(\forall_e)$ of Definition \[def\_I\_s\_model\] holds. The problem is that condition $(\to_i)$ needs to be satisfied as well, which means that we cannot know a priori which terms $t$ should satisfy ${\ensuremath{\mathrm{Is}\,t\,\tau\,}}$ for a function type $\tau \in {\ensuremath{{\cal T}}}$, because this must depend on the definition of ${\ensuremath{\Rightarrow}}_R$ for $(\to_i)$ to hold. And we cannot use a conditional rule of the form

-   if for all $t$ such that ${\ensuremath{\mathrm{Is}\,t\,\tau\,}} {\ensuremath{\stackrel{*}{\Rightarrow}}}_R {\ensuremath{\mathbf{t}}}$ we have $t_1 t {\ensuremath{\stackrel{*}{\Rightarrow}}}_R {\ensuremath{\mathbf{t}}}$ then $\forall\,\tau\,t_1 {\ensuremath{\Rightarrow}}_R
      {\ensuremath{\mathbf{t}}}$

because the definition would not be monotone. Our solution is to restrict quantification to canonical constants only, and to define the relation ${\ensuremath{\Rightarrow}}_R$ in such a way as to ensure that for each term $t$ with ${\ensuremath{\mathrm{Is}\,t\,\tau\,}} {\ensuremath{\stackrel{*}{\Rightarrow}}}_R {\ensuremath{\mathbf{t}}}$ there exist a canonical constant $c \in \tau$ and a term $t'$ such that $t {\ensuremath{\stackrel{*}{\Rightarrow}}}_R t'
\succ c$.

Let $\chi$ be a choice function for the family of sets ${\ensuremath{{\cal T}}}\setminus \{\emptyset\}$. We define a rewriting system $R$ by the rules presented in Fig. \[fig\_1\].

$$\begin{aligned}
    {\ensuremath{\mathrm{Eq}\,t_1\,t_2\,}} &\to& {\ensuremath{\mathbf{t}}}\;\;\; \mathrm{if\ } t_1 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}_R t_2 \\
    \forall \tau t &\to& t' \;\;\; \mathrm{where\ } \tau \in {\ensuremath{{\cal T}}},\,
    \tau \ne \emptyset,\, {\ensuremath{{t'}^{|\epsilon}}} \equiv {\ensuremath{\mathrm{A}}}\tau \mathrm{\ and\ }
    {\ensuremath{{t'}_{|c}}} \equiv t c \mathrm{\ for\ } c \in \tau \\
    \mathrm{Subtype}\, \tau\, t &\to& t' \;\;\; \mathrm{where\ }
    \tau \in {\ensuremath{{\cal T}}},\, \tau \ne \emptyset,\, {\ensuremath{{t'}^{|\epsilon}}} \equiv {\ensuremath{\mathrm{S}}}\tau
    \mathrm{\ and\ } {\ensuremath{{t'}_{|c}}} \equiv t c \mathrm{\ for\ } c \in
    \tau \\
    \forall \emptyset t &\to& {\ensuremath{\mathbf{t}}}\\
    \mathrm{Subtype}\, \emptyset\, t &\to& \emptyset \\
    t &\to& {\ensuremath{\mathbf{t}}}\;\;\; \mathrm{if\ } {\ensuremath{{t}^{|\epsilon}}} \equiv {\ensuremath{\mathrm{A}}}\tau \mathrm{\ and\ for\ all\ } c \in \tau \mathrm{\ we\ have\ } {\ensuremath{{t}_{|c}}} \equiv {\ensuremath{\mathbf{t}}}\\
    t &\to& {\ensuremath{\mathbf{f}}}\;\;\; \mathrm{if\ } {\ensuremath{{t}^{|\epsilon}}} \equiv {\ensuremath{\mathrm{A}}}\tau \mathrm{\ and\ there\ exists\ } c \in
    \tau \mathrm{\ such\ that\ } {\ensuremath{{t}_{|c}}} \equiv {\ensuremath{\mathbf{f}}}\\
    t &\to& \tau' \;\;\; \mathrm{if\ } {\ensuremath{{t}^{|\epsilon}}} \equiv {\ensuremath{\mathrm{S}}}\tau \mathrm{\ and\ for\ all\ } c \in \tau  \mathrm{\ we\ have\ }
    {\ensuremath{{t}_{|c}}} \in \{{\ensuremath{\mathbf{t}}},{\ensuremath{\mathbf{f}}}\}, \\ &&
    \;\;\;\;\;\;\;\;\mathrm{\ and\ } \tau' = \{ c \in \tau \;|\; {\ensuremath{{t}_{|c}}} \equiv {\ensuremath{\mathbf{t}}}\} \\
    \mathrm{Fun}\,\tau_1\, \tau_2 &\to& \tau_2^{\tau_1} \;\;\; \mathrm{for\ } \tau_1, \tau_2 \in {\ensuremath{{\cal T}}}\\
    {\ensuremath{\mathrm{Cond}\,{\ensuremath{\mathbf{t}}}\,t_1\,t_2\,}} &\to& t_1 \\
    {\ensuremath{\mathrm{Cond}\,{\ensuremath{\mathbf{f}}}\,t_1\,t_2\,}} &\to& t_2 \\
    \vee {\ensuremath{\mathbf{t}}}t &\to& {\ensuremath{\mathbf{t}}}\\
    \vee t {\ensuremath{\mathbf{t}}}&\to& {\ensuremath{\mathbf{t}}}\\
    \vee {\ensuremath{\mathbf{f}}}{\ensuremath{\mathbf{f}}}&\to& {\ensuremath{\mathbf{f}}}\\
    c_i^\iota \bar{t}_1 \ldots \bar{t}_{n_i} &\to& \bar{c}_i^\iota(\bar{t}_1, \ldots, \bar{t}_{n_i})
    \;\;\; \mathrm{if\ } \bar{t}_1, \ldots, \bar{t}_{n_i} \in \bar{\iota} \in \bar{{\ensuremath{{\cal T}}}}_I \\
    d_{i,j}^\iota (\bar{c}_i^\iota(\bar{t}_1,\ldots,\bar{t}_{n_i})) &\to& \bar{t}_j \\
    d_{i,j}^\iota (c_i^\iota t_1 \ldots t_{n_i}) &\to& t_j \\
    o_i^\iota (\bar{c}_i^\iota(\bar{t}_1, \ldots, \bar{t}_{n_i})) &\to& {\ensuremath{\mathbf{t}}}\\
    o_i^\iota (\bar{c}_k^\iota(\bar{t}_1, \ldots, \bar{t}_{n_k})) &\to& {\ensuremath{\mathbf{f}}}\;\;\; \mathrm{if\ } i \ne k \\
    o_i^\iota (c_i^\iota t_1 \ldots t_{n_i}) &\to& {\ensuremath{\mathbf{t}}}\\
    o_i^\iota (c_k^\iota t_1 \ldots t_{n_k}) &\to& {\ensuremath{\mathbf{f}}}\;\;\; \mathrm{if\ } i \ne k \\
    \mathrm{Choice}\, \tau &\to& \chi(\tau) \;\;\; \mathrm{if\ } \tau \in {\ensuremath{{\cal T}}},\, \tau \ne \emptyset \\
    {\ensuremath{\mathrm{Is}\,\tau\,{\ensuremath{\mathrm{Type}}}\,}} &\to& {\ensuremath{\mathbf{t}}}\;\;\; \mathrm{for\ } \tau \in {\ensuremath{{\cal T}}}\end{aligned}$$

The above is a circular definition because the condition in the rule for $\mathrm{Eq}$ refers to the system $R$. Note, however, that this reference is positive. Formally, we may therefore define a progression of rewrite systems $R_\alpha$ consisting of the above rules, but each using as $R$ the system $R_{<\alpha} =
\bigcup_{\gamma<\alpha}R_\gamma$. We note that $R_\alpha \subseteq
R_\beta$ for $\alpha \le \beta$ and take $R$ to be the least fixpoint.

From now on $R$ refers to the rewriting system defined above, and the relations ${\ensuremath{\rightarrow}}$, ${\ensuremath{\Rightarrow}}$, ${\ensuremath{\stackrel{*}{\Rightarrow}}}$, etc. refer to ${\ensuremath{\rightarrow}}_R$, ${\ensuremath{\Rightarrow}}_R$, ${\ensuremath{\stackrel{*}{\Rightarrow}}}_R$, etc. We write $t_1
{\ensuremath{\rightarrow}}_\equiv^p t_2$ if $t_1 {\ensuremath{\rightarrow}}^p t_2$ or $t_1 \equiv t_2$.

The three simple lemmas below follow by an easy inspection of the definition of $R$ and of ${\ensuremath{\Rightarrow}}$.

If $c {\ensuremath{\Rightarrow}}t$ where $c \in \Sigma^+$, then $t \equiv c$ or $c
  \in {\ensuremath{{\cal C}}}$ has arity $0$.

\[lem\_contr\_epsilon\] If $c \in \Sigma^+$, there exist $s_1,\ldots,s_n$ such that $c s_1
  \ldots s_n$ is a left side of a rule in $R$, and $c t_1 \ldots t_n
  {\ensuremath{\Rightarrow}}^\alpha t$, then there exist $t_1',\ldots,t_n'$ such that $t_i {\ensuremath{\Rightarrow}}^\alpha t_i'$ for $i=1,\ldots,n$ and $c t_1' \ldots
  t_n' {\ensuremath{\rightarrow}}_\equiv^\epsilon t$.

\[lem\_orthogonal\] If $t {\ensuremath{\rightarrow}}^\epsilon t_1$ and $t {\ensuremath{\rightarrow}}^\epsilon t_2$ then $t_1
  \equiv t_2$.

\[lem\_subst\_1\] The following conditions hold.

-   If $t_1 {\ensuremath{\rightarrow}}_{R_\beta}^{\epsilon} t_1'$ then $t_1[x/t_2]
        {\ensuremath{\rightarrow}}_{R_\beta}^{\epsilon} t_1'[x/t_2]$.

-   If $t_1 {\ensuremath{\Rightarrow}}_{R_\beta}^{\alpha} t_1'$ then $t_1[x/t_2]
        {\ensuremath{\Rightarrow}}_{R_\beta}^{\alpha} t_1'[x/t_2]$.

-   If $t_1 \succ_{R_\beta}^\alpha c$ then $t_1[x/t_2]
        \succ_{R_\beta}^\alpha c$.

Induction on triples $\langle \beta, \alpha, h(t_1) \rangle$ ordered lexicographically.

We first show that $t_1 {\ensuremath{\rightarrow}}_{R_\beta}^{\epsilon} t_1'$ implies $t_1[x/t_2] {\ensuremath{\rightarrow}}_{R_\beta}^{\epsilon} t_1'[x/t_2]$. The only non-obvious case is when $t_1 \equiv {\ensuremath{\mathrm{Eq}\,r_1\,r_2\,}}
  {\ensuremath{\rightarrow}}_{R_\beta}^\epsilon {\ensuremath{\mathbf{t}}}\equiv t_1'$ by virtue of $r_1
  {\ensuremath{\stackrel{*}{\Leftrightarrow}}}_{R_{<\beta}} r_2$. But then by the inductive hypothesis (for smaller $\beta$) we obtain $r_1[x/t_2] {\ensuremath{\stackrel{*}{\Leftrightarrow}}}_{R_{<\beta}}
  r_2[x/t_2]$. This implies that $t_1[x/t_2] \equiv
  {\ensuremath{\mathrm{Eq}\,r_1[x/t_2]\,r_2[x/t_2]\,}} {\ensuremath{\rightarrow}}_{R_\beta}^\epsilon {\ensuremath{\mathbf{t}}}\equiv
  t_1'[x/t_2]$.

We show that $t_1 {\ensuremath{\Rightarrow}}_{R_\beta}^{\alpha} t_1'$ implies $t_1[x/t_2] {\ensuremath{\Rightarrow}}_{R_\beta}^{\alpha} t_1'[x/t_2]$. If $t_1 \equiv
  t_1'$ then this is obvious. If $t_1 {\ensuremath{\rightarrow}}_{R_\beta}^\epsilon t_1'$ then this follows from the previous condition. If $t_1 \equiv c r_1
  \ldots r_n {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha t_1'$, $c \in \Sigma^+$, $c
  r_1' \ldots r_n' {\ensuremath{\rightarrow}}_{R_\beta}^\epsilon t_1'$, $r_i
  {\ensuremath{\Rightarrow}}_{R_\beta}^{\alpha} r_i'$, then $r_i[x/t_2]
  {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha r_i'[x/t_2]$ by the inductive hypothesis (because $h(r_i) < h(t_1)$). As in the previous paragraph, it also follows from the IH that $c r_1'[x/t_2] \ldots r_n'[x/t_2]
  {\ensuremath{\rightarrow}}_{R_\beta}^\epsilon t_1'[x/t_2]$. Therefore $t_1[x/t_2] \equiv
  c r_1[x/t_2] \ldots r_n[x/t_2] {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha
  t_1'[x/t_2]$. All other cases follow easily from the inductive hypothesis, and we omit them.

Now we prove that $t_1 \succ_{R_\beta}^\alpha c$ implies $t_1[x/t_2]
  \succ_{R_\beta}^\alpha c$. If $t_1 \equiv c$ then this is obvious. Otherwise $c \in \tau_2^{\tau_1} \in {\ensuremath{{\cal T}}}$ and for all $c_1
  \in \tau_1$ there exists $t_1'$ such that $t_1 c_1
  {\ensuremath{\stackrel{*\;<\alpha}{\Rightarrow_{R_\beta}\;\,}}} t_1' \succ_{R_\beta}^{<\alpha}
  {\ensuremath{{\cal F}}}(c)(c_1)$. But then by the IH we have $t_1[x/t_2] c_1
  {\ensuremath{\stackrel{*\;<\alpha}{\Rightarrow_{R_\beta}\;\,}}} t_1'[x/t_2] \succ_{R_\beta}^{<\alpha}
  {\ensuremath{{\cal F}}}(c)(c_1)$. Therefore $t_1[x/t_2] \succ_{R_\beta}^{\alpha} c$.

\[lem\_subst\_2\] If $t_2 {\ensuremath{\Rightarrow}}^{\alpha} t_2'$ then $t_1[x/t_2] {\ensuremath{\Rightarrow}}^{\alpha}
  t_1[x/t_2']$.

Induction on the structure of $t_1$. If $t_1 \equiv x$ or $x \notin
  FV(t_1)$ then this is obvious. If ${\ensuremath{{t_1}^{|\epsilon}}} \in \{{\ensuremath{\mathrm{A}}}\tau, {\ensuremath{\mathrm{S}}}\tau\}$ then by the inductive hypothesis ${\ensuremath{{t_1}_{|c}}}[x/t_2] {\ensuremath{\Rightarrow}}^{\alpha} {\ensuremath{{t_1}_{|c}}}[x/t_2']$ for $c
  \in \tau$. Therefore $t_1[x/t_2] {\ensuremath{\Rightarrow}}^\alpha t_1[x/t_2']$. Other cases follow directly from the inductive hypothesis in a similar fashion.

\[lem\_subst\] If $t_1 {\ensuremath{\Rightarrow}}^\alpha t_1'$ and $t_2 {\ensuremath{\Rightarrow}}^\alpha t_2'$ then $t_1[x/t_2] {\ensuremath{\Rightarrow}}^{\alpha} t_1'[x/t_2']$.

Induction on $\alpha$ and the structure of $t_1$.

If $t_1 \equiv t_1'$ then the claim follows from Lemma \[lem\_subst\_2\]. If $t_1 {\ensuremath{\rightarrow}}^\epsilon t_1'$ then we consider possible forms of $t_1$. Suppose $t_1 \equiv {\ensuremath{\mathrm{Eq}\,r_1\,r_2\,}}
  {\ensuremath{\rightarrow}}^\epsilon {\ensuremath{\mathbf{t}}}\equiv t_1'$ by virtue of $r_1 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}r_2$. By Lemma \[lem\_subst\_1\] we have $r_1[x/t_2] {\ensuremath{\stackrel{*}{\Leftrightarrow}}}r_2[x/t_2]$. Hence $t_1[x/t_2] \equiv {\ensuremath{\mathrm{Eq}\,r_1[x/t_2]\,r_2[x/t_2]\,}}
  {\ensuremath{\rightarrow}}^\epsilon {\ensuremath{\mathbf{t}}}\equiv t_1'[x/t_2']$. Suppose $t_1 \equiv
  \forall \tau t {\ensuremath{\rightarrow}}^\epsilon t_1'$ where $\tau \in {\ensuremath{{\cal T}}}$, ${\ensuremath{{t_1'}^{|\epsilon}}} \equiv {\ensuremath{\mathrm{A}}}\tau$, and for all $c \in \tau$ we have ${\ensuremath{{t_1'}_{|c}}} \equiv t c$. Then $t[x/t_2] {\ensuremath{\Rightarrow}}^\alpha
  t[x/t_2']$ by the inductive hypothesis, and $\forall \tau
  (t[x/t_2']) {\ensuremath{\rightarrow}}^\epsilon t_1'[x/t_2']$ by Lemma \[lem\_subst\_1\]. Hence by condition (5) in the definition of ${\ensuremath{\Rightarrow}}^\alpha$ we obtain $t_1[x/t_2] \equiv \forall \tau
  (t[x/t_2]) {\ensuremath{\Rightarrow}}^\alpha t_1'[x/t_2']$. Other cases are established in a similar manner.

If $t_1 \equiv (\lambda y \,.\, r_1) r_2 {\ensuremath{\Rightarrow}}^\alpha r_1'[y/r_2']
  \equiv t_1'$ where $x \not\equiv y$, $r_1 {\ensuremath{\Rightarrow}}^\alpha r_1'$ and $r_2 {\ensuremath{\Rightarrow}}^\alpha r_2'$, then by the inductive hypothesis $r_1[x/t_2] {\ensuremath{\Rightarrow}}^\alpha r_1'[x/t_2']$ and $r_2[x/t_2]
  {\ensuremath{\Rightarrow}}^\alpha r_2'[x/t_2']$. Recall that by our implicit assumption that in $t_1[x/t_2]$ no free variables of $t_2$ become bound, we have $y \notin FV(t_2)$, and hence $y \notin
  FV(t_2')$. Thus $t_1[x/t_2] \equiv (\lambda y \,.\, r_1[x/t_2])
  r_2[x/t_2] {\ensuremath{\Rightarrow}}^\alpha r_1'[x/t_2'][y/(r_2'[x/t_2'])] \equiv
  (r_1'[y/r_2'])[x/t_2'] \equiv t_1'[x/t_2']$.

If $t_1 \equiv c r_1 \ldots r_n {\ensuremath{\Rightarrow}}^\alpha t_1'$ where $c \in
  \Sigma^+$, $r_i {\ensuremath{\Rightarrow}}^\alpha r_i'$ for $i=1,\ldots,n$, and $c
  r_1' \ldots r_n' {\ensuremath{\rightarrow}}^\epsilon t_1'$, then $c r_1'[x/t_2'] \ldots
  r_n'[x/t_2'] {\ensuremath{\rightarrow}}^\epsilon t_1'[x/t_2']$ by Lemma \[lem\_subst\_1\] and $r_i[x/t_2] {\ensuremath{\Rightarrow}}^\alpha
  r_i'[x/t_2']$ by the inductive hypothesis. We thus conclude $t_1[x/t_2] \equiv c r_1[x/t_2] \ldots r_n[x/t_2] {\ensuremath{\Rightarrow}}^\alpha
  t_1'[x/t_2']$.

If $t_1 \equiv {\ensuremath{\mathrm{Is}\,t\,\tau\,}} {\ensuremath{\Rightarrow}}^\alpha {\ensuremath{\mathbf{t}}}\equiv t_1'$ where $t \succ^{<\alpha} c$ for some $c \in \tau$, then $t[x/t_2]
  \succ^{<\alpha} c$ by Lemma \[lem\_subst\_1\]. Therefore $t_1[x/t_2]
  \equiv {\ensuremath{\mathrm{Is}\,t[x/t_2]\,\tau\,}} {\ensuremath{\Rightarrow}}^\alpha {\ensuremath{\mathbf{t}}}\equiv
  t_1'[x/t_2']$.

If ${\ensuremath{{t_1}^{|\epsilon}}} \equiv {\ensuremath{{t_1'}^{|\epsilon}}} \equiv
  {\ensuremath{\mathrm{A}}}\tau$ and for all $c \in \tau$ there exists $t_c$ such that ${\ensuremath{{t_1}_{|c}}} {\ensuremath{\Rightarrow}}^\alpha t_c {\ensuremath{\stackrel{\;\;*\;<\alpha}{\Rightarrow\;\;}}}
  {\ensuremath{{t_1'}_{|c}}}$, then ${\ensuremath{{t_1}_{|c}}}[x/t_2] {\ensuremath{\Rightarrow}}^\alpha
  t_c[x/t_2']$ by the inductive hypothesis. By Lemma \[lem\_subst\_1\] we obtain $t_c[x/t_2'] {\ensuremath{\stackrel{\;\;*\;<\alpha}{\Rightarrow\;\;}}}
  {\ensuremath{{t_1'}_{|c}}}[x/t_2']$. This implies that $t_1[x/t_2]
  {\ensuremath{\Rightarrow}}^\alpha t_1'[x/t_2']$.

Other cases follow by analogous proofs.

\[lem\_contr\_stable\] If $c \in \Sigma^+$, $n \in {\ensuremath{\mathbb{N}}}$, $c t_1 \ldots t_n {\ensuremath{\rightarrow}}^\epsilon
  t$ and $t_i {\ensuremath{\Rightarrow}}^\alpha t_i'$ for $i=1,\ldots,n$, then there exists $t'$ such that $c t_1' \ldots t_n' {\ensuremath{\rightarrow}}^\epsilon t'$ and $t
  {\ensuremath{\Rightarrow}}^\alpha t'$.

If $c t_1 t_2 \equiv {\ensuremath{\mathrm{Eq}\,t_1\,t_2\,}} {\ensuremath{\rightarrow}}^\epsilon {\ensuremath{\mathbf{t}}}$ then $t_1
  {\ensuremath{\stackrel{*}{\Leftrightarrow}}}t_2$. Since ${\ensuremath{\Rightarrow}}^\alpha \,\subseteq\, {\ensuremath{\Rightarrow}}$, we have $t_1' {\ensuremath{\stackrel{*}{\Leftrightarrow}}}t_2'$. Thus ${\ensuremath{\mathrm{Eq}\,t_1'\,t_2'\,}} {\ensuremath{\rightarrow}}^\epsilon
  {\ensuremath{\mathbf{t}}}$.

Suppose $c t_1 t_2 \equiv \forall \tau t_2 {\ensuremath{\rightarrow}}^\epsilon t$ where $\tau \in {\ensuremath{{\cal T}}}$, ${\ensuremath{{t}^{|\epsilon}}} \equiv {\ensuremath{\mathrm{A}}}\tau$, ${\ensuremath{{t}_{|c}}} \equiv t_2 c$ for $c \in \tau$. We have $\forall \tau
  t_2' {\ensuremath{\rightarrow}}^\epsilon t'$ where ${\ensuremath{{t'}^{|\epsilon}}} \equiv {\ensuremath{\mathrm{A}}}\tau$ and ${\ensuremath{{t'}_{|c}}} \equiv t_2' c$ for $c \in \tau$. Since $t_2 c
  {\ensuremath{\Rightarrow}}^\alpha t_2' c$, by condition (8) in the definition of ${\ensuremath{\Rightarrow}}^\alpha$ we conclude that $t {\ensuremath{\Rightarrow}}^\alpha t'$.

If $c t_1 \equiv d_{i,j}^\iota (c_i^\iota r_1 \ldots r_{n_i})
  {\ensuremath{\rightarrow}}^\epsilon r_j \equiv t$ then $c_i^\iota r_1 \ldots r_{n_i}
  {\ensuremath{\Rightarrow}}^\alpha t_1'$. By Lemma \[lem\_contr\_epsilon\] there exist $r_1',\ldots,r_{n_i}'$ such that $r_k {\ensuremath{\Rightarrow}}^\alpha r_k'$ for $k=1,\ldots,n_i$ and $c_i^\iota r_1' \ldots r_{n_i}'
  {\ensuremath{\rightarrow}}_\equiv^\epsilon t_1'$. If $c_i^\iota r_1' \ldots r_{n_i}'
  \equiv t_1'$ then $c t_1' \equiv d_{i,j}^\iota (c_i^\iota r_1'
  \ldots r_{n_i}') {\ensuremath{\rightarrow}}^\epsilon r_j'$ and we are done. Otherwise $r_1',\ldots,r_{n_i}'\in\bar{\iota}$ and $t_1' \equiv
  \bar{c}_i^\iota(r_1',\ldots,r_{n_i}')$. Thus $c t_1' \equiv d_{i,j}
  (\bar{c}_i^\iota(r_1',\ldots,r_{n_i}')) {\ensuremath{\rightarrow}}^\epsilon r_j'$.

Other cases are trivial or follow by a similar proof.

We say that two binary relations on terms $\to_1$ and $\to_2$ *commute* if $t_1 \to_1 t_1'$ and $t_2 \to_2 t_2'$ imply $t_1'
  \to_2^\equiv t_3$ and $t_2' \to_1^\equiv t_3$ for some term $t_3$, where $\to_i^\equiv$ is the reflexive closure of $\to_i$.

\[lem\_hindley\_rosen\] If ${\ensuremath{\Rightarrow}}^{\alpha'}$ and ${\ensuremath{\Rightarrow}}^{\beta'}$ commute for all $\alpha' \circ_1 \alpha$ and $\beta' \circ_2 \beta$, then ${\ensuremath{\stackrel{\;\;*\;\circ_1\alpha}{\Rightarrow\;\;}}}$ and ${\ensuremath{\stackrel{\;\;*\;\circ_2\beta}{\Rightarrow\;\;}}}$, ${\ensuremath{\Rightarrow}}^{\circ_1\alpha}$ and ${\ensuremath{\stackrel{\;\;*\;\circ_2\beta}{\Rightarrow\;\;}}}$, as well as ${\ensuremath{\stackrel{\;\;*\;\circ_1\alpha}{\Rightarrow\;\;}}}$ and ${\ensuremath{\Rightarrow}}^{\circ_2\beta}$, commute. Here $\circ_1,\circ_2 \in \{<, \le\}$ and ${\ensuremath{\Rightarrow}}^{\le\gamma}\,=\,{\ensuremath{\Rightarrow}}^\gamma$ for $\gamma \in
  \{\alpha,\beta\}$.

The proof is a simple tiling argument similar to the proof of the Hindley-Rosen lemma, see e.g. [@Barendregt1984 Chapter 3].

\[lem\_commute\] For all ordinals $\alpha$, $\beta$ the following conditions hold:

-   ${\ensuremath{\Rightarrow}}^\alpha$ and ${\ensuremath{\Rightarrow}}^\beta$ commute,

-   if $t \succ^\alpha c$ and $t {\ensuremath{\Rightarrow}}^\beta t'$ then $t' \succ^\alpha c$,

-   if $t \succ^\alpha c_1$, $t \succ^\beta c_2$ and $c_1, c_2 \in \tau \in {\ensuremath{{\cal T}}}$ then $c_1 \equiv c_2$.

The proof is by induction on triples $\langle \alpha, \beta, h(t)
  \rangle$ ordered lexicographically, where in condition (${\romannumeral 1}$) the term $t$ is such that $t {\ensuremath{\Rightarrow}}^\alpha t_1$ and $t
  {\ensuremath{\Rightarrow}}^\beta t_2$ for some $t_1, t_2$. Together with condition (${\romannumeral 2}$) we also prove its dual, i.e. the condition with $\alpha$ and $\beta$ exchanged. We only give a proof for the original condition, but it is easy to see that the dual condition follows by exactly the same proof but with $\alpha$ and $\beta$ exchanged.

We first show condition (${\romannumeral 1}$). Assume $t {\ensuremath{\Rightarrow}}^\alpha
  t_1$ and $t {\ensuremath{\Rightarrow}}^\beta t_2$. We need to show that there exists $t'$ such that $t_1 {\ensuremath{\Rightarrow}}^\beta t'$ and $t_2
  {\ensuremath{\Rightarrow}}^\alpha t'$. It is clear that it suffices to consider only the situations when $t {\ensuremath{\Rightarrow}}^\alpha t_1$ follows by condition ($m$) and $t {\ensuremath{\Rightarrow}}^\beta t_2$ follows by condition ($n$) in the definition of ${\ensuremath{\Rightarrow}}$ for $m \le n$, provided that we never use the inductive hypothesis with $\beta$ increased, which is easily verified to be the case. Indeed, then we may use exactly the same proofs, but with $\alpha$ and $\beta$ exchanged, to handle the cases when $m > n$.

If $t \equiv t_1$ or $t \equiv t_2$ then the claim is obvious. Suppose $t {\ensuremath{\Rightarrow}}^\alpha t_1$ follows by condition (1) in the definition of ${\ensuremath{\Rightarrow}}^\alpha$. Then $t {\ensuremath{\rightarrow}}^\epsilon
  t_1$. By Lemma \[lem\_orthogonal\] it is impossible that $t
  {\ensuremath{\Rightarrow}}^\beta t_2$ follows by condition (1) in the definition of ${\ensuremath{\Rightarrow}}^\beta$, unless $t_1 \equiv t_2$. Suppose that $t
  {\ensuremath{\Rightarrow}}^\beta t_2$ follows by condition (5). Then $t \equiv c r_1
  \ldots r_n {\ensuremath{\rightarrow}}^\epsilon t_1$, $r_i {\ensuremath{\Rightarrow}}^\beta r_i'$ and $c
  r_1' \ldots r_n' {\ensuremath{\rightarrow}}^\epsilon t_2$. By Lemma \[lem\_contr\_stable\] there exists $t'$ such that $t_1
  {\ensuremath{\Rightarrow}}^\beta t'$ and $c r_1' \ldots r_n' {\ensuremath{\rightarrow}}^\epsilon t'$. But by Lemma \[lem\_orthogonal\] we have $t' \equiv t_2$. The only remaining possibility, when $t {\ensuremath{\Rightarrow}}^\alpha t_1$ follows by condtion (1), is that $t {\ensuremath{\Rightarrow}}^\beta t_2$ follows by condition (2). But then the claim follows from Lemma \[lem\_contr\_stable\].

Suppose $t \equiv r_1 r_2 {\ensuremath{\Rightarrow}}^\alpha r_1' r_2' \equiv t_1$ where $r_1 {\ensuremath{\Rightarrow}}^\alpha r_1'$ and $r_2 {\ensuremath{\Rightarrow}}^\alpha r_2'$. If $t {\ensuremath{\Rightarrow}}^\beta t_2$ follows by condition (2) then $t_2 \equiv
  r_1'' r_2''$ where $r_1 {\ensuremath{\Rightarrow}}^\beta r_1''$ and $r_2
  {\ensuremath{\Rightarrow}}^\beta r_2''$. By the inductive hypothesis (note that $h(r_1), h(r_2) < h(t)$) there exist $q_1$, $q_2$ such that $r_1'
  {\ensuremath{\Rightarrow}}^\beta q_1$, $r_1'' {\ensuremath{\Rightarrow}}^\alpha q_1$, $r_2'
  {\ensuremath{\Rightarrow}}^\beta q_2$ and $r_2'' {\ensuremath{\Rightarrow}}^\alpha q_2$. Thus $t_1
  \equiv r_1' r_2' {\ensuremath{\Rightarrow}}^\beta q_1 q_2$ and $t_2 \equiv r_1'' r_2''
  {\ensuremath{\Rightarrow}}^\alpha q_1 q_2$.

It is not possible that $t {\ensuremath{\Rightarrow}}^\beta t_2$ follows by condition (3). If it follows by condition (4) then $r_1 \equiv
  \lambda x \,.\, s_1$, $r_1' \equiv \lambda x \,.\, s_1'$, $s_1
  {\ensuremath{\Rightarrow}}^\alpha s_1'$, and $t_2 \equiv s_1''[x/r_2'']$ where $s_1
  {\ensuremath{\Rightarrow}}^\beta s_1''$, $r_2 {\ensuremath{\Rightarrow}}^\beta r_2''$. By the inductive hypothesis there exist $q_1$ and $q_2$ such that $s_1'
  {\ensuremath{\Rightarrow}}^\beta q_1$, $s_1'' {\ensuremath{\Rightarrow}}^\alpha q_1$, $r_2'
  {\ensuremath{\Rightarrow}}^\beta q_2$ and $r_2'' {\ensuremath{\Rightarrow}}^\alpha q_2$. By condition (4) in the definition of ${\ensuremath{\Rightarrow}}^\beta$ we have $t_1
  \equiv (\lambda x \,.\, s_1') r_2' {\ensuremath{\Rightarrow}}^\beta q_1[x/q_2]$. By Lemma \[lem\_subst\] we obtain $t_2 \equiv s_1''[x/r_2'']
  {\ensuremath{\Rightarrow}}^\alpha q_1[x/q_2]$.

If $t {\ensuremath{\Rightarrow}}^\beta t_2$ follows by condition (5) then $r_1 \equiv
  c s_1 \ldots s_n$, $s_i {\ensuremath{\Rightarrow}}^\beta s_i''$, $r_2 {\ensuremath{\Rightarrow}}^\beta
  r_2''$ and $c s_1'' \ldots s_n'' r_2'' {\ensuremath{\rightarrow}}^\epsilon t_2$. By inspecting the definition of $R$ we see that in this case $c q_1
  \ldots q_m {\ensuremath{\rightarrow}}^\epsilon r_1'$ is not possible for any $q_1,\ldots,q_m$ and any $m \le n$. By inspecting the definition of ${\ensuremath{\Rightarrow}}^\alpha$ we thus see that $r_1 {\ensuremath{\Rightarrow}}^\alpha r_1'$ is only possible when $r_1' \equiv c s_1' \ldots s_n'$ and $s_i
  {\ensuremath{\Rightarrow}}^\alpha s_i'$. By the inductive hypothesis there exist $q_1,\ldots,q_{n+1}$ such that $s_i'' {\ensuremath{\Rightarrow}}^\alpha q_i$, $s_i'
  {\ensuremath{\Rightarrow}}^\beta q_i$ for $i=1,\ldots,n$, and $r_2'' {\ensuremath{\Rightarrow}}^\alpha
  q_{n+1}$, $r_2' {\ensuremath{\Rightarrow}}^\beta q_{n+1}$. Therefore $c s_1' \ldots
  s_n' r_2' {\ensuremath{\Rightarrow}}^\beta c q_1 \ldots q_{n+1}$ and $c s_1'' \ldots
  s_n'' r_2'' {\ensuremath{\Rightarrow}}^\alpha c q_1 \ldots q_{n+1}$. By Lemma \[lem\_contr\_stable\] there exists $t'$ such that $t_2
  {\ensuremath{\Rightarrow}}^\alpha t'$ and $c q_1 \ldots q_{n+1} {\ensuremath{\rightarrow}}^\epsilon
  t'$. Hence by condition (5) also $t_1 \equiv c s_1' \ldots s_n' r_2'
  {\ensuremath{\Rightarrow}}^\beta t'$. See Fig. \[fig\_02\].

If $t {\ensuremath{\Rightarrow}}^\beta t_2$ follows by condition (6) then $r_1 \equiv
  r_1' \equiv c \in \tau_2^{\tau_1}$, $r_2 \succ^{<\beta} c_1 \in
  \tau_1$ and $t_2 \equiv {\ensuremath{{\cal F}}}(c)(c_1)$. By part (${\romannumeral 2}$) of the inductive hypothesis we conclude that $r_2' \succ^{<\beta}
  c_1$. Therefore $t_1 \equiv c r_2' {\ensuremath{\Rightarrow}}^\beta {\ensuremath{{\cal F}}}(c)(c_1) \equiv
  t_2$.

If $t {\ensuremath{\Rightarrow}}^\beta t_2$ follows by condition (7) then $r_1 \equiv
  \mathrm{Is}\, s$, $r_2 \equiv \tau$, $r_1' \equiv \mathrm{Is}\, s'$, $s {\ensuremath{\Rightarrow}}^\alpha s'$, $t_2 \equiv {\ensuremath{\mathbf{t}}}$ and $s \succ^{<\beta} c$ for some $c \in \tau \in {\ensuremath{{\cal T}}}$. By part (${\romannumeral 2}$) of the inductive hypothesis we have $s' \succ^{<\beta} c$. Therefore $t_1
  \equiv {\ensuremath{\mathrm{Is}\,s'\,r_2\,}} {\ensuremath{\Rightarrow}}^\beta {\ensuremath{\mathbf{t}}}\equiv t_2$. It is easy to see that it is impossible that $t {\ensuremath{\Rightarrow}}^\beta t_2$ follows by condition (8).

Now suppose that $t {\ensuremath{\Rightarrow}}^\alpha t_1$ follows by condition (3). Then $t \equiv \lambda x \,.\, r$ and $t_1 \equiv
  \lambda x \,.\, r_1$ where $r {\ensuremath{\Rightarrow}}^\alpha r_1$. It is easy too see that the only possibility is that $t {\ensuremath{\Rightarrow}}^\beta t_2$ follows by condition (3) as well. Then $t_2 \equiv \lambda x \,.\, r_2$ where $r {\ensuremath{\Rightarrow}}^\beta r_2$. By the inductive hypothesis there exists $q$ such that $r_1 {\ensuremath{\Rightarrow}}^\beta q$ and $r_2 {\ensuremath{\Rightarrow}}^\alpha
  q$. Therefore $t_1 \equiv \lambda x \,.\, r_1 {\ensuremath{\Rightarrow}}^\beta \lambda
  x \,.\, q$ and $t_2 \equiv \lambda x \,.\, r_2 {\ensuremath{\Rightarrow}}^\alpha
  \lambda x \,.\, q$.

Suppose that $t {\ensuremath{\Rightarrow}}^\alpha t_1$ follows by condition (4). Then $t \equiv (\lambda x \,.\, r_1) r_2$ and $t_1 \equiv r_1'[x/r_2']$ where $r_1 {\ensuremath{\Rightarrow}}^\alpha r_1'$ and $r_2 {\ensuremath{\Rightarrow}}^\alpha r_2'$. It is easy to see that the only possibility is that $t {\ensuremath{\Rightarrow}}^\beta t_2$ follows by condition (4) as well. Then $t_2 \equiv r_1''[x/r_2'']$ where $r_1 {\ensuremath{\Rightarrow}}^\beta r_1''$ and $r_2 {\ensuremath{\Rightarrow}}^\beta r_2''$. By the inductive hypothesis there exist $q_1$ and $q_2$ such that $r_1'
  {\ensuremath{\Rightarrow}}^\beta q_1$, $r_1'' {\ensuremath{\Rightarrow}}^\alpha q_1$, $r_2'
  {\ensuremath{\Rightarrow}}^\beta q_2$ and $r_2'' {\ensuremath{\Rightarrow}}^\alpha q_2$. Therefore by Lemma \[lem\_subst\] we obtain $t_1 \equiv r_1'[x/r_2']
  {\ensuremath{\Rightarrow}}^\beta q_1[x/q_2]$ and $t_2 \equiv r_1''[x/r_2'']
  {\ensuremath{\Rightarrow}}^\alpha q_1[x/q_2]$.

Suppose that $t {\ensuremath{\Rightarrow}}^\alpha t_1$ follows by condition (5). Then $t \equiv c r_1 \ldots r_n$, $r_i {\ensuremath{\Rightarrow}}^\alpha r_i'$ and $c r_1'
  \ldots r_n' {\ensuremath{\rightarrow}}^\epsilon t_1$. If $t {\ensuremath{\Rightarrow}}^\beta t_2$ also follows by condition (5), then there exist $r_1'',\ldots,r_n''$ such that $r_i {\ensuremath{\Rightarrow}}^\beta r_i''$ and $c r_1'' \ldots r_n''
  {\ensuremath{\rightarrow}}^\epsilon t_2$. By the inductive hypothesis there exist $q_1,\ldots,q_n$ such that $r_i' {\ensuremath{\Rightarrow}}^\beta q_i$ and $r_i''
  {\ensuremath{\Rightarrow}}^\alpha q_i$. Therefore $c r_1' \ldots r_n' {\ensuremath{\Rightarrow}}^\beta c
  q_1 \ldots q_n$ and $c r_1'' \ldots r_n'' {\ensuremath{\Rightarrow}}^\alpha c q_1
  \ldots q_n$. By Lemma \[lem\_contr\_stable\] there exist $t_1'$ and $t_2'$ such that $t_1 {\ensuremath{\Rightarrow}}^\beta t_1'$, $t_2 {\ensuremath{\Rightarrow}}^\alpha
  t_2'$, $c q_1 \ldots q_n {\ensuremath{\rightarrow}}^\epsilon t_1'$ and $c q_1 \ldots q_n
  {\ensuremath{\rightarrow}}^\epsilon t_2'$. But by Lemma \[lem\_orthogonal\] we have $t_1' \equiv t_2'$. See Fig. \[fig\_03\].

It is easy to verify that it is not possible that $t {\ensuremath{\Rightarrow}}^\beta
  t_2$ follows by condition (6). If $t {\ensuremath{\Rightarrow}}^\beta t_2$ follows by condition (7), then we must have $c \equiv \mathrm{Is}$, $t_1 \equiv
  t_2 \equiv {\ensuremath{\mathbf{t}}}$. It is not possible that $t {\ensuremath{\Rightarrow}}^\beta t_2$ follows by condition (8).

Suppose $t {\ensuremath{\Rightarrow}}^\alpha t_1$ follows by condition (6). Then $t
  \equiv c r {\ensuremath{\Rightarrow}}^\alpha {\ensuremath{{\cal F}}}(c)(c_1) \equiv t_2$ where $c \in
  \tau_2^{\tau_1}$ and $r \succ^{<\alpha} c_1 \in \tau_1$. It is easily verified that the only possibility is when $t {\ensuremath{\Rightarrow}}^\beta
  t_2$ follows by condition (6) as well. Then $t_2 \equiv
  {\ensuremath{{\cal F}}}(c)(c_1')$ and $r \succ^{<\beta} c_1'$ for some $c_1' \in
  \tau_1$. By part (${\romannumeral 3}$) of the inductive hypothesis we obtain $c_1' \equiv c_1$. Hence $t_1 \equiv t_2$.

Suppose $t {\ensuremath{\Rightarrow}}^\alpha t_1$ follows by condition (7). Then $t
  \equiv {\ensuremath{\mathrm{Is}\,r\,\tau\,}}$, $t_1 \equiv {\ensuremath{\mathbf{t}}}$, and $t {\ensuremath{\Rightarrow}}^\beta t_2$ may only follow by condition (7). But then we have $t_2 \equiv {\ensuremath{\mathbf{t}}}\equiv t_1$.

Finally, suppose $t {\ensuremath{\Rightarrow}}^\alpha t_1$ follows by condition (8) and so does $t {\ensuremath{\Rightarrow}}^\beta t_2$. Then e.g. ${\ensuremath{{t}^{|\epsilon}}}
  \equiv {\ensuremath{{t_1}^{|\epsilon}}} \equiv {\ensuremath{{t_2}^{|\epsilon}}} \equiv
  {\ensuremath{\mathrm{A}}}\tau$, and for all $c \in \tau$ there exist $t_c$ and $t_c'$ such that ${\ensuremath{{t}_{|c}}} {\ensuremath{\Rightarrow}}^\alpha t_c {\ensuremath{\stackrel{\;\;*\;<\alpha}{\Rightarrow\;\;}}}
  {\ensuremath{{t_1}_{|c}}}$ and ${\ensuremath{{t}_{|c}}} {\ensuremath{\Rightarrow}}^\beta t_c'
  {\ensuremath{\stackrel{\;\;*\;<\beta}{\Rightarrow\;\;}}} {\ensuremath{{t_2}_{|c}}}$. By the inductive hypothesis there exists $r$ such that $t_c {\ensuremath{\Rightarrow}}^\beta r$ and $t_c'
  {\ensuremath{\Rightarrow}}^\alpha r$. By the inductive hypothesis and Lemma \[lem\_hindley\_rosen\] there exist $q_1$ and $q_2$ such that ${\ensuremath{{t_1}_{|c}}} {\ensuremath{\Rightarrow}}^\beta q_1$, $r {\ensuremath{\stackrel{\;\;*\;<\alpha}{\Rightarrow\;\;}}} q_1$, ${\ensuremath{{t_2}_{|c}}} {\ensuremath{\Rightarrow}}^\alpha q_2$ and $r {\ensuremath{\stackrel{\;\;*\;<\beta}{\Rightarrow\;\;}}}
  q_2$. Again, by the inductive hypothesis and Lemma \[lem\_hindley\_rosen\] there exists $q_c$ such that $q_1
  {\ensuremath{\stackrel{\;\;*\;<\beta}{\Rightarrow\;\;}}} q_c$ and $q_2 {\ensuremath{\stackrel{\;\;*\;<\alpha}{\Rightarrow\;\;}}} q_c$. Hence for all $c \in \tau$ there exists $q_1$ such that ${\ensuremath{{t_1}_{|c}}}
  {\ensuremath{\Rightarrow}}^\beta q_1 {\ensuremath{\stackrel{\;\;*\;<\beta}{\Rightarrow\;\;}}} q_c$, and for all $c \in
  \tau$ there exists $q_2$ such that ${\ensuremath{{t_2}_{|c}}} {\ensuremath{\Rightarrow}}^\alpha q_2
  {\ensuremath{\stackrel{\;\;*\;<\alpha}{\Rightarrow\;\;}}} q_c$. Let $q$ be such that ${\ensuremath{{q}^{|\epsilon}}}
  \equiv {\ensuremath{\mathrm{A}}}\tau$ and ${\ensuremath{{q}_{|c}}} \equiv q_c$ for $c \in \tau$. By the above considerations we have $t_1 {\ensuremath{\Rightarrow}}^\beta q$ and $t_2
  {\ensuremath{\Rightarrow}}^\alpha q$. See Fig. \[fig\_04\].

Now we show condition (${\romannumeral 2}$). Thus suppose $t \succ^\alpha c$ and $t {\ensuremath{\Rightarrow}}^\beta t'$. If $t \equiv c$ then $t' \equiv c$ and thus $t' \succ^\alpha c$. Otherwise $c \in \tau_2^{\tau_1}$ and for all $c_1 \in \tau_1$ there exists $r$ such that $t c_1
  {\ensuremath{\stackrel{\;\;*\;<\alpha}{\Rightarrow\;\;}}} r \succ^{<\alpha} {\ensuremath{{\cal F}}}(c)(c_1)$. Then $t c_1
  {\ensuremath{\Rightarrow}}^\beta t' c_1$ and we conclude by part (${\romannumeral 1}$) of the inductive hypothesis and Lemma \[lem\_hindley\_rosen\] that there exists $r'$ such that $r {\ensuremath{\Rightarrow}}^\beta r'$ and $t' c_1
  {\ensuremath{\stackrel{\;\;*\;<\alpha}{\Rightarrow\;\;}}} r'$. By part (${\romannumeral 2}$) of the inductive hypothesis we obtain $r' \succ^{<\alpha} {\ensuremath{{\cal F}}}(c)(c_1)$. Thus for every $c_1 \in \tau_1$ there exists $r'$ such that $t' c_1
  {\ensuremath{\stackrel{\;\;*\;<\alpha}{\Rightarrow\;\;}}} r' \succ^{<\alpha} {\ensuremath{{\cal F}}}(c)(c_1)$. Hence $t'
  \succ^\alpha {\ensuremath{{\cal F}}}(c)(c_1)$. See Fig. \[fig\_05\].

It remains to show condition (${\romannumeral 3}$). Thus suppose $t
  \succ^\alpha c_1$ and $t \succ^\beta c_2$ for $c_1,c_2 \in \tau \in
  {\ensuremath{{\cal T}}}$. If $\tau \subseteq {\ensuremath{\mathrm{Bool}}}$, $\tau \subseteq \delta$ or $\tau
  \subseteq \bar{\iota} \in \bar{{\ensuremath{{\cal T}}}}_I$ then $t \equiv c_1 \equiv
  c_2$ because in this case $t \succ^\alpha c_1$ and $t \succ^\beta
  c_2$ may only be obtained by condition (a) in the definition of $\succ$. Otherwise $\tau \subseteq \tau_2^{\tau_1}$ and e.g. $t
  \succ^\alpha c_1$ is obtained by condition (b), hence $\alpha > 0$.

If $c_1 \not\equiv c_2$ then there exists $c \in \tau_1$ such that ${\ensuremath{{\cal F}}}(c_1)(c) \not\equiv {\ensuremath{{\cal F}}}(c_2)(c)$. There exists $t_1$ such that $t c {\ensuremath{\stackrel{\;\;*\;<\alpha}{\Rightarrow\;\;}}} t_1 \succ^{<\alpha} {\ensuremath{{\cal F}}}(c_1)(c)$. If $t
  \equiv c_2$ then by inspecting the definitions we see that this is only possible when $c_2 c {\ensuremath{\Rightarrow}}^{\gamma} {\ensuremath{{\cal F}}}(c_2)(c')
  \succ^{<\alpha} {\ensuremath{{\cal F}}}(c_1)(c)$ where $c \succ^{<\gamma} c' \in \tau_1$ and $\gamma < \alpha$. By condition (a) we have $c \succ^\beta
  c$. Since $c, c' \in \tau_1$ and $\gamma < \alpha$ we conlcude by part (${\romannumeral 3}$) of the inductive hypothesis that $c \equiv
  c'$. Thus ${\ensuremath{{\cal F}}}(c_2)(c) \succ^{<\alpha} {\ensuremath{{\cal F}}}(c_1)(c)$. Obviously ${\ensuremath{{\cal F}}}(c_2)(c) \succ^\beta {\ensuremath{{\cal F}}}(c_2)(c)$ and ${\ensuremath{{\cal F}}}(c_2)(c), {\ensuremath{{\cal F}}}(c_1)(c)
  \in \tau_2$, so again by part (${\romannumeral 3}$) of the inductive hypothesis we obtain ${\ensuremath{{\cal F}}}(c_1)(c) \equiv
  {\ensuremath{{\cal F}}}(c_2)(c)$. Contradiction.

Thus assume that $t \succ^\beta c_2$ also follows by condition (b) in the definition of $\succ$. Then there exists $t_2$ such that $t c
  {\ensuremath{\stackrel{\;\;*\;<\beta}{\Rightarrow\;\;}}} t_2 \succ^{<\beta} {\ensuremath{{\cal F}}}(c_2)(c)$. By part (${\romannumeral 1}$) of the inductive hypothesis and Lemma \[lem\_hindley\_rosen\] there exists $r$ such that $t_2
  {\ensuremath{\stackrel{\;\;*\;<\alpha}{\Rightarrow\;\;}}} r$ and $t_1 {\ensuremath{\stackrel{\;\;*\;<\beta}{\Rightarrow\;\;}}} r$. By part (${\romannumeral 2}$) of the inductive hypothesis we have $r
  \succ^{<\alpha} {\ensuremath{{\cal F}}}(c_1)(c)$ and $r \succ^{<\beta} {\ensuremath{{\cal F}}}(c_2)(c)$. By part (${\romannumeral 3}$) of the inductive hypothesis we obtain ${\ensuremath{{\cal F}}}(c_1)(c) \equiv {\ensuremath{{\cal F}}}(c_2)(c)$. Contradiction. See Fig. \[fig\_06\].

\[cor\_cr\] The relation ${\ensuremath{\Rightarrow}}$ has the Church-Rosser property.

The *rank* of a type $\tau \in {\ensuremath{{\cal T}}}$, denoted ${\ensuremath{\mathrm{rank}}}(\tau)$, is the smallest $n \in {\ensuremath{\mathbb{N}}}$ such that $\tau \in {\ensuremath{{\cal T}}}_n$. The *canonical type* of a canonical constant $c \in \Sigma$, denoted $\tau(c)$, is defined as follows.

-   If $c \in \delta$ then $\tau(c) = \delta$.

-   If $c \in {\ensuremath{\mathrm{Bool}}}$ then $\tau(c) = {\ensuremath{\mathrm{Bool}}}$.

-   If $c \in \bar{\iota} \in \bar{{\ensuremath{{\cal T}}}}_I$ then $\tau(c) = \iota$.

-   Otherwise let $\tau_2^{\tau_1} \in {\ensuremath{{\cal T}}}$ be such that $c \in
        \tau_2^{\tau_1}$ and ${\ensuremath{\mathrm{rank}}}(\tau_2) \le {\ensuremath{\mathrm{rank}}}(\tau_2')$ for every $\tau_2' \in {\ensuremath{{\cal T}}}$ such that $c \in {\tau_2'}^{\tau_1}$. Then $\tau(c) = \tau_2^{\tau_1}$. Note that there may be more than one $\tau_2$ satisfying the above condition. In this case we arbitrarily choose one of them, and it does not matter which.

The rank of a canonical constant $c$, denoted ${\ensuremath{\mathrm{rank}}}(c)$, is the rank of its canonical type.

\[lem\_smaller\_rank\] The following conditions hold.

-   For all $\tau_1, \tau_2 \in {\ensuremath{{\cal T}}}$ we have ${\ensuremath{\mathrm{rank}}}(\tau_1),
        {\ensuremath{\mathrm{rank}}}(\tau_2) < {\ensuremath{\mathrm{rank}}}(\tau_2^{\tau_1})$.

-   If $c \in \tau$ then ${\ensuremath{\mathrm{rank}}}(c) \le {\ensuremath{\mathrm{rank}}}(\tau)$.

For the first condition, note that ${\ensuremath{\mathrm{rank}}}(\tau_2^{\tau_1}) > 0$ and if $\tau_2^{\tau_1} \in {\ensuremath{{\cal T}}}_{n+1}$ then $\tau_1,\tau_2 \in {\ensuremath{{\cal T}}}_n$.

If $\tau(c) \in \{\delta, {\ensuremath{\mathrm{Bool}}}\} \cup \bar{{\ensuremath{{\cal T}}}}_I$ then the second condition is obvious. Otherwise $\tau(c) = \tau_2^{\tau_1}$, and if $c \in \tau$ then $\tau \subseteq \tau_3^{\tau_1}$ with ${\ensuremath{\mathrm{rank}}}(\tau)
  \ge {\ensuremath{\mathrm{rank}}}(\tau_3^{\tau_1})$ and ${\ensuremath{\mathrm{rank}}}(\tau_2) \le
  {\ensuremath{\mathrm{rank}}}(\tau_3)$. Suppose ${\ensuremath{\mathrm{rank}}}(\tau_1) = n_1$, ${\ensuremath{\mathrm{rank}}}(\tau_2) =
  n_2$, ${\ensuremath{\mathrm{rank}}}(\tau_3) = n_3$. Then $n_2 \le n_3$, ${\ensuremath{\mathrm{rank}}}(c) =
  \max(n_1, n_2) + 1$ and ${\ensuremath{\mathrm{rank}}}(\tau) \ge \max(n_1, n_3) + 1$. Thus ${\ensuremath{\mathrm{rank}}}(c) \le {\ensuremath{\mathrm{rank}}}(\tau)$.

We write $t \succsim c$ if $c \in \tau_2^{\tau_1}$ and for every $c_1 \in \tau_1$ there exists $t_{c_1}$ such that for all $t_1$ with $t_1 \succ c_1$ we have $t t_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}t_{c_1} \succ
  {\ensuremath{{\cal F}}}(c)(c_1)$. If for some $c_1 \in \tau_1$ there is more than one term $t_{c_1}$ satisfying the above condition, then we fix one arbitrarily, but globally, i.e. given $t$ and $c$ such that $t
  \succsim c$ we assume that $t_{c_1}$ is uniquely determined for each $c_1 \in \tau_1$, and it depends only on $t$, $c$ and $c_1$. Note that if $t \succsim c$ then $t \succ c$.

Let $t \succ c$. The *mutual rank* of $t$ and $c$, denoted ${\ensuremath{\mathrm{rank}}}(t,c)$, is defined by induction on ${\ensuremath{\mathrm{rank}}}(c)$. If $t \equiv c$ then ${\ensuremath{\mathrm{rank}}}(t,c) = 0$. If $t \not\succsim c$ then ${\ensuremath{\mathrm{rank}}}(t,c) =
  {\ensuremath{\mathrm{rank}}}(c)$. If $t \succsim c$ but $t \not\equiv c$ then $c \in
  \tau_2^{\tau_1}$ and ${\ensuremath{\mathrm{rank}}}(t,c)$ is defined by $${\ensuremath{\mathrm{rank}}}(t,c) = \sup_{c_1 \in \tau_1} {\ensuremath{\mathrm{rank}}}(t_{c_1},{\ensuremath{{\cal F}}}(c)(c_1))$$ where $t_{c_1}$ is the term required by the definition of $\succsim$, such that for all terms $t_1$ with $t_1 \succ c_1$ we have $t t_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}t_{c_1} \succ {\ensuremath{{\cal F}}}(c)(c_1)$. Note that ${\ensuremath{\mathrm{rank}}}(t,c) \le {\ensuremath{\mathrm{rank}}}(c)$, and if $t \succsim c$ then ${\ensuremath{\mathrm{rank}}}(t,c) <
  {\ensuremath{\mathrm{rank}}}(c)$.

Two positions $p_1,p_2 \in \Sigma^*$ are *parallel* if neither $p_1 \sqsubseteq p_2$ nor $p_2 \sqsubseteq p_1$. We write $t_1 \gg^n
  t_2$ if there exists a set $P \subseteq {\mbox{\cal Pos}}(t_1) \cap {\mbox{\cal Pos}}(t_2)$ of pairwise parallel positions such that for $p \in P$ we have ${\ensuremath{{t_1}_{|p}}} \succ {\ensuremath{{t_2}_{|p}}}$ and ${\ensuremath{{t_1}_{|p}}} \not\equiv
  {\ensuremath{{t_2}_{|p}}}$, no free variables of ${\ensuremath{{t_1}_{|p}}}$ become bound in $t_1$, for every $p \in {\mbox{\cal Pos}}(t_1) \setminus P$ we have $p \in
  {\mbox{\cal Pos}}(t_2)$ and ${\ensuremath{{t_1}^{|p}}} \equiv {\ensuremath{{t_2}^{|p}}}$, and ${\ensuremath{\mathrm{rank}}}_P(t_1,t_2) \le n$, where ${\ensuremath{\mathrm{rank}}}_P(t_1,t_2) = \sup_{p\in P}
  {\ensuremath{\mathrm{rank}}}({\ensuremath{{t_1}_{|p}}}, {\ensuremath{{t_2}_{|p}}})$. We write $t_1 \gg^{<n} t_2$ if the same conditions hold except that ${\ensuremath{\mathrm{rank}}}_P(t_1,t_2) < n$. We write $t_1 \gg t_2$ if $t_1 \gg^n t_2$ for some $n \in {\ensuremath{\mathbb{N}}}$.

\[lem\_gg\_subst\] If $t_1 \gg^n t_1'$, $t_2 \gg^n t_2'$ and $x \notin
  FV({\ensuremath{{t_1}_{|p}}})$ for all $p \in P_1$, where $P_1$ is the set of positions required by the definition of $t_1 \gg^n t_1'$, then $t_1[x/t_2] \gg^n t_1'[x/t_2']$.

Let $P_2$ be the set of positions required by the definition of $t_2
  \gg^n t_2'$. Take $$P = P_1 \cup \{ p \in {\mbox{\cal Pos}}(t_1[x/t_2]) \;|\; p = p_1p_2,\, {\ensuremath{{t_1}_{|p_1}}} \equiv x,\, p_2 \in P_2 \}$$ as the set of positions required by the definition of $t_1[x/t_2]
  \gg^n t_1'[x/t_2']$.

\[lem\_gg\] The following conditions hold.

-   If $t_1 \gg^n t_2 {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha
        t_2'$ then $t_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}t_1' \gg^n t_2'$.

-   If $t_1 \gg^n t_1'$ and $t_2
        {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha t_1'$ then there exists $t_2'$ such that $t_2' {\ensuremath{\stackrel{*}{\Rightarrow}}}t_1$ and $t_2' \gg^n t_2$.

-   If $t_1 \gg^n t_2 \succ_{R_\beta}^\alpha c$ then $t_1 \succ c$.

Induction on tuples $\langle n, \beta, \alpha, h(t_2) \rangle$ ordered lexicographically.

We first show condition (${\romannumeral 1}$). Thus suppose $t_1 \gg^n t_2
  {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha t_2'$. We consider possible forms of $t_2$ according to the definition of ${\ensuremath{\Rightarrow}}$.

If $t_2 \equiv t_2'$ then the claim is obvious. If $t_2
  {\ensuremath{\rightarrow}}_{R_\beta}^\epsilon t_2'$ and $t_2 {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha
  t_2'$ follows by condition (1) in the definition of ${\ensuremath{\Rightarrow}}$, then the only non-obvious case is when $t_2 \equiv {\ensuremath{\mathrm{Eq}\,r_1\,r_2\,}}
  {\ensuremath{\rightarrow}}_{R_\beta}^\epsilon {\ensuremath{\mathbf{t}}}\equiv t_2'$. Then $r_1
  {\ensuremath{\stackrel{*}{\Leftrightarrow}}}_{R_{<\beta}} r_2$ and $t_1 \equiv {\ensuremath{\mathrm{Eq}\,r_1'\,r_2'\,}}$ where $r_1' \gg^n r_1$ and $r_2' \gg^n r_2$. It follows from parts (${\romannumeral 1}$) and (${\romannumeral 2}$) of the inductive hypothesis that $r_1' {\ensuremath{\stackrel{*}{\Leftrightarrow}}}r_2'$. Thus $t_1 {\ensuremath{\Rightarrow}}{\ensuremath{\mathbf{t}}}\equiv t_2'$.

If $t_2 {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha t_2'$ follows by condition (2) then $t_2 \equiv r_1 r_2$, $t_2' \equiv r_1' r_2'$, $r_1
  {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha r_1'$ and $r_2 {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha
  r_2'$. We must also have $t_1 \equiv q_1 q_2$ where $q_1 \gg^n r_1$ and $q_2 \gg^n r_2$. By the inductive hypothesis ($h(r_1), h(r_2) <
  h(t_2)$) there exist $q_1'$ and $q_2'$ such that $q_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}q_1'$, $q_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}q_2'$, $q_1' \gg^n r_1'$, $q_2' \gg^n
  r_2'$. Thus $t_1 \equiv q_1 q_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}q_1' q_2' \gg^n r_1' r_2'
  \equiv t_2'$. If $t_2 {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha t_2'$ follows by condition (3) then the argument is analogous.

Suppose $t_2 {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha t_2'$ follows by condition (4). Then $t_2 \equiv (\lambda x \,.\, r_1) r_2$ and $t_2'
  \equiv r_1'[x/r_2']$ where $r_1 {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha r_1'$ and $r_2 {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha r_2'$. We must also have $t_1 \equiv
  (\lambda x \,.\, q_1) q_2$ where $q_1 \gg^n r_1$ and $q_2 \gg^n r_2$. By the inductive hypothesis there exist $q_1'$ and $q_2'$ such that $q_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}q_1'$, $q_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}q_2'$, $q_1' \gg^n r_1'$, $q_2' \gg^n r_2'$. By Lemma \[lem\_gg\_subst\] we obtain $q_1'[x/q_2'] \gg^n r_1'[x/r_2']$. Thus $t_1 \equiv (\lambda x
  \,.\, q_1) q_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}q_1'[x/q_2'] \gg^n r_1'[x/r_2'] \equiv t_2'$.

Suppose $t_2 {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha t_2'$ follows by condition (5). Then $t_2 \equiv c r_1 \ldots r_m$, $r_i
  {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha r_i'$, $c r_1' \ldots r_m'
  {\ensuremath{\rightarrow}}_{R_\beta}^\epsilon t_2'$. By the definition of $R_\beta$, the constant $c$ is not a canonical constant. This implies that $t_1
  \equiv c q_1 \ldots q_m$ where $q_i \gg^n r_i$. By the inductive hypothesis ($h(r_i) < h(t_2)$) there exist $q_1',\ldots,q_m'$ such that $q_i' \gg^n r_i'$ and $q_i {\ensuremath{\stackrel{*}{\Rightarrow}}}q_i'$. Thus $c q_1'
  \ldots q_m' \gg^n c r_1' \ldots r_m' {\ensuremath{\rightarrow}}_{R_\beta}^\epsilon
  t_2'$. But we have already verified in this inductive step that this implies that there exists $t_1'$ such that $c q_1' \ldots q_m'
  {\ensuremath{\stackrel{*}{\Rightarrow}}}t_1' \gg^n t_2'$. Therefore $t_1 \equiv c q_1 \ldots q_m
  {\ensuremath{\stackrel{*}{\Rightarrow}}}c q_1' \ldots q_m {\ensuremath{\stackrel{*}{\Rightarrow}}}t_1' \gg^n t_2'$.

Suppose $t_2 {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha t_2'$ follows by condition (6). Then $t_2 \equiv c r_2'$, $t_2' \equiv c_2 \equiv
  {\ensuremath{{\cal F}}}(c)(c_1)$, $r_2' \succ_{R_\beta}^{<\alpha} c_1 \in \tau_1$, $\tau(c) = \tau_2^{\tau_1}$ for some $\tau_2 \in {\ensuremath{{\cal T}}}$. We also have $t_1 \equiv r_1 r_2$ where $r_1 \gg^n c$, hence $r_1 \succ c$, and $r_2 \gg^n r_2' \succ_{R_\beta}^{<\alpha} c_1$. By part (${\romannumeral 3}$) of the inductive hypothesis we obtain $r_2 \succ
  c_1$. First assume that $r_1 \equiv c$. Then $t_1 \equiv r_1 r_2
  \equiv c r_2 {\ensuremath{\Rightarrow}}{\ensuremath{{\cal F}}}(c)(c_1) \equiv t_2'$ by virtue of $r_2
  \succ c_1$, and we are done. So suppose $r_1 \not\equiv c$. If $r_1
  \succsim c$ then let $q$ be the term required by the definition of $\succsim$, such that for every term $r$ with $r \succ c_1$ we have $r_1 r {\ensuremath{\stackrel{*}{\Rightarrow}}}q \succ c_2$. Then ${\ensuremath{\mathrm{rank}}}(q,c_2) \le
  {\ensuremath{\mathrm{rank}}}(r_1,c) \le n$, and $t_1 \equiv r_1 r_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}q \succ
  c_2$, because $r_2 \succ c_1$. So $t_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}q \gg^n c_2 \equiv
  t_2'$, which is our claim. Therefore suppose $r_1 \not\equiv c$ and $r_1 \not\succsim c$. Then we have ${\ensuremath{\mathrm{rank}}}(r_2,c_1) \le {\ensuremath{\mathrm{rank}}}(c_1)
  \le {\ensuremath{\mathrm{rank}}}(\tau_1) < {\ensuremath{\mathrm{rank}}}(c) = {\ensuremath{\mathrm{rank}}}(r_1,c) \le n$ by Lemma \[lem\_smaller\_rank\]. Thus $r_1 r_2 \gg^{<n} r_1 c_1$. By the fact that $r_1 \succ c$ there exists $t$ such that $r_1 c_1
  {\ensuremath{\stackrel{*}{\Rightarrow}}}t \succ {\ensuremath{{\cal F}}}(c)(c_1)$. By part (${\romannumeral 1}$) of the inductive hypothesis there exists $t'$ such that $r_1 r_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}t' \gg^{<n} t$. Let $c_2 \equiv {\ensuremath{{\cal F}}}(c)(c_1)$. We have $t' \gg^{<n} t
  \succ c_2$, so by part (${\romannumeral 3}$) of the inductive hypothesis we obtain $t' \succ c_2$. Since ${\ensuremath{\mathrm{rank}}}(t',c_2) \le {\ensuremath{\mathrm{rank}}}(c_2) \le
  {\ensuremath{\mathrm{rank}}}(\tau_2) < {\ensuremath{\mathrm{rank}}}(c) = {\ensuremath{\mathrm{rank}}}(r_1,c) \le n$, we conclude that $t_1 \equiv r_1 r_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}t' \gg^n c_2 \equiv t_2'$.

Suppose $t_2 {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha t_2'$ follows by condition (7). Then $t_2 \equiv {\ensuremath{\mathrm{Is}\,r_2\,\tau\,}}$, $t_2' \equiv {\ensuremath{\mathbf{t}}}$, $t_1 \equiv {\ensuremath{\mathrm{Is}\,r_1\,\tau\,}}$, $r_1 \gg^n r_2$, and $r_2
  \succ_{R_\beta}^{<\alpha} c$ for some $c \in \tau \in {\ensuremath{{\cal T}}}$. By part (${\romannumeral 3}$) of the inductive hypothesis we have $r_1 \succ
  c$. Therefore $t_1 \equiv {\ensuremath{\mathrm{Is}\,r_1\,\tau\,}} {\ensuremath{\Rightarrow}}{\ensuremath{\mathbf{t}}}\equiv t_2'$.

Finally, suppose $t_2 {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha t_2'$ follows by condition (8). Then e.g. ${\ensuremath{{t_2}^{|\epsilon}}} \equiv
  {\ensuremath{{t_2'}^{|\epsilon}}} \equiv {\ensuremath{{t_1}^{|\epsilon}}} \equiv {\ensuremath{\mathrm{A}}}\tau$, and for all $c \in \tau$ there exists $t_c$ such that ${\ensuremath{{t_1}_{|c}}}
  \gg^n {\ensuremath{{t_2}_{|c}}} {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha t_c
  {\ensuremath{\stackrel{*\;<\alpha}{\Rightarrow_{R_{\beta}}\;\,}}} {\ensuremath{{t_2'}_{|c}}}$. By part (${\romannumeral 1}$) of the inductive hypothesis ($h({\ensuremath{{t_2}_{|c}}}) <
  h(t_2)$) there exists $t_c'$ such that ${\ensuremath{{t_1}_{|c}}} {\ensuremath{\stackrel{*}{\Rightarrow}}}t_c'
  \gg^n t_c$. Applying the inductive hypothesis again, we conclude that there exists $q_c$ such that $t_c' {\ensuremath{\stackrel{*}{\Rightarrow}}}q_c \gg^n
  {\ensuremath{{t_2'}_{|c}}}$. Let $q$ be such that ${\ensuremath{{q}^{|\epsilon}}} \equiv
  {\ensuremath{\mathrm{A}}}\tau$ and ${\ensuremath{{q}_{|c}}} \equiv q_c$ for $c \in \tau$. Then ${\ensuremath{{t_1}_{|c}}} {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{{q}_{|c}}}$ for all $c \in \tau$, and hence $t_1 {\ensuremath{\rightarrow}}q$. We also have $q \gg^n t_2'$, because ${\ensuremath{{q}_{|c}}}
  \gg^n {\ensuremath{{t_2'}_{|c}}}$ for all $c \in \tau$.

We now show condition (${\romannumeral 2}$). Thus suppose $t_1 \gg^n t_1'$ and $t_2 {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha t_1'$. We consider possible forms of $t_2$ according to the definition of $t_2
  {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha t_1'$.

If $t_2 \equiv t_1'$ then the claim is obvious. If $t_2
  {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha t_1'$ follows by condition (1) in the definition of ${\ensuremath{\Rightarrow}}_{R_\beta}^\alpha$, then $t_2
  {\ensuremath{\rightarrow}}_{R_\beta}^\epsilon t_1'$ and the claim follows easily by inspecting the definition of $R_\beta$. If $t_2
  {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha t_1'$ follows by condition (2), then $t_2
  \equiv r_1 r_2$, $t_1' \equiv r_1' r_2'$, $r_1
  {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha r_1'$, $r_2 {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha
  r_2'$, $t_1 \equiv q_1' q_2'$, $q_1' \gg^n r_1'$, $q_2' \gg^n
  r_2'$. By the inductive hypothesis ($h(r_1), h(r_2) < h(t_2)$) there exist $q_1$, $q_2$ such that $q_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}q_1'$, $q_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}q_2'$, $q_1 \gg^n r_1$, $q_2 \gg^n r_2$. Thus $q_1 q_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}t_1$ and $q_1 q_2 \gg^n t_2$. If $t_2 {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha
  t_1'$ follows by condition (3) or condition (4) then the argument is analogous.

If $t_2 {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha t_1'$ follows by condition (5) then $t_2 \equiv c r_1 \ldots r_m$, $r_i {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha
  r_i'$, $c r_1' \ldots r_m' {\ensuremath{\rightarrow}}_{R_\beta}^\epsilon t_1'$, $t_1
  \equiv c q_1' \ldots q_m'$, $q_i' \gg^n r_i'$. By the inductive hypothesis there exist $q_1,\ldots,q_m$ such that $q_i {\ensuremath{\stackrel{*}{\Rightarrow}}}q_i'$ and $q_i \gg^n r_i$. Let $q \equiv c q_1 \ldots q_m$. We have $q \gg^n t_2$ and $q {\ensuremath{\stackrel{*}{\Rightarrow}}}c q_1' \ldots q_m' \equiv t_1$.

If $t_2 {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha t_1'$ follows by condition (6) then $t_2 \equiv c r$, $t_1' \equiv c_2 \equiv {\ensuremath{{\cal F}}}(c)(c_1)$, $c \in
  \tau_2^{\tau_1}$, $r \succ_{R_\beta}^{<\alpha} c_1 \in \tau_1$, $t_1
  \gg^n c_2$. If $t_1 \equiv c_2$ then the claim is obvious. Otherwise $t_1 \succ c_2$. Let $e \in (\mbox{\small Bool}^{\tau_1})^{\tau_1}$ be such that for $d_1, d_2 \in \tau_1$, we have ${\ensuremath{{\cal F}}}(e)(d_1)(d_2)
  \equiv {\ensuremath{\mathbf{t}}}$ if $d_1 \equiv d_2$, and ${\ensuremath{{\cal F}}}(e)(d_1)(d_2) \equiv
  {\ensuremath{\mathbf{f}}}$ if $d_1 \not\equiv d_2$. Let $q \equiv \lambda x . {\ensuremath{\mathrm{Cond}\,(e
    c_1 x)\,t_1\,(c x)\,}}$. If $s \succ d \in \tau_1$ and $d \not\equiv
  c_1$ then $q s {\ensuremath{\Rightarrow}}{\ensuremath{\mathrm{Cond}\,(e c_1 s)\,t_1\,(c s)\,}} {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathrm{Cond}\,{\ensuremath{\mathbf{f}}}\,t_1\,{\ensuremath{{\cal F}}}(c)(d)\,}} {\ensuremath{\Rightarrow}}{\ensuremath{{\cal F}}}(c)(d)$. If $s \succ c_1$ then $q s {\ensuremath{\Rightarrow}}{\ensuremath{\mathrm{Cond}\,(e c_1 s)\,t_1\,(c s)\,}} {\ensuremath{\Rightarrow}}{\ensuremath{\mathrm{Cond}\,{\ensuremath{\mathbf{t}}}\,t_1\,(c s)\,}} {\ensuremath{\Rightarrow}}t_1 \succ {\ensuremath{{\cal F}}}(c)(c_1) \equiv
  c_2$. Therefore $q \succsim c$, and ${\ensuremath{\mathrm{rank}}}(q,c) = {\ensuremath{\mathrm{rank}}}(t_1,c_2) \le
  n$, since ${\ensuremath{\mathrm{rank}}}({\ensuremath{{\cal F}}}(c)(d), {\ensuremath{{\cal F}}}(c)(d)) = 0$. Thus $q r \gg^n c r
  \equiv t_2$ and $q r {\ensuremath{\stackrel{*}{\Rightarrow}}}t_1$, because $r \succ c_1$.

If $t_2 {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha t_1'$ follows by condition (7) then the claim is obvious. If $t_2 {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha t_1'$ follows by condition (8) then e.g ${\ensuremath{{t_2}^{|\epsilon}}} \equiv
  {\ensuremath{{t_1'}^{|\epsilon}}} \equiv {\ensuremath{{t_1}^{|\epsilon}}} \equiv {\ensuremath{\mathrm{A}}}\tau$ and for all $c \in \tau$ there exists $t_c$ such that ${\ensuremath{{t_2}_{|c}}}
  {\ensuremath{\Rightarrow}}_{R_\beta}^\alpha t_c {\ensuremath{\stackrel{*}{\Rightarrow}}}_{R_\beta}^{<\alpha}
  {\ensuremath{{t_1'}_{|c}}}$. We also have ${\ensuremath{{t_1}_{|c}}} \gg^n {\ensuremath{{t_1'}_{|c}}}$ for all $c \in \tau$. Therefore by the inductive hypothesis for every $c
  \in \tau$ there exists $t_c'$ such that $t_c' \gg^n t_c$ and $t_c'
  {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{{t_1}_{|c}}}$. Again, by the inductive hypothesis ($h({\ensuremath{{t_2}_{|c}}}) < h(t_2)$), for every $c \in \tau$ there exists $q_c$ such that $q_c \gg^n {\ensuremath{{t_2}_{|c}}}$ and $q_c {\ensuremath{\stackrel{*}{\Rightarrow}}}t_c' {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{{t_1}_{|c}}}$. Let $q$ be such that ${\ensuremath{{q}^{|\epsilon}}} \equiv {\ensuremath{\mathrm{A}}}\tau$ and ${\ensuremath{{q}_{|c}}} \equiv q_c$ for $c \in \tau$. Then $q \gg^n t_2$ and $q {\ensuremath{\Rightarrow}}t_1$.

It remains to show condition (${\romannumeral 3}$). Thus suppose $t_1 \gg^n
  t_2 \succ_{R_\beta}^\alpha c$. If $t_2 \equiv c$ then the claim is obvious. Otherwise $c \in \tau_2^{\tau_1}$ and for every $c_1 \in
  \tau_1$ there exists $q_{c_1}$ such that $t_2 c_1
  {\ensuremath{\stackrel{*\;<\alpha}{\Rightarrow_{R_\beta}\;\,}}} q_{c_1} \succ_{R_\beta}^{<\alpha}
  c$. Since $t_1 c_1 \gg^n t_2 c_1$, by part (${\romannumeral 1}$) of the inductive hypothesis for each $c_1 \in \tau_1$ there exists $q_{c_1}'$ such that $t_1 c_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}q_{c_1}' \gg^n
  q_{c_1} \succ_{R_\beta}^{<\alpha} c$. By part (${\romannumeral 3}$) of the inductive hypothesis we obtain $q_{c_1}' \succ c$. This implies that $t_1 \succ c$.

\[cor\_succ\_arg\] If $t_2 \succ c$ and $t_1 c {\ensuremath{\stackrel{*}{\Rightarrow}}}d \in {\ensuremath{\mathrm{Bool}}}$, then $t_1 t_2
  {\ensuremath{\stackrel{*}{\Rightarrow}}}d$.

The above lemma and the ensuing corollary confirm our intuition about the meaning of $\succ$. This basically finishes the hard part of the proof. What remains are some relatively straightforward lemmas.

We write $t {\ensuremath{\vartriangleright}}\tau$ if $t {\ensuremath{\stackrel{*}{\Rightarrow}}}t' \succ c$ for some term $t'$ and some $c \in \tau$.

\[lem\_is\] We have ${\ensuremath{\mathrm{Is}\,t_1\,t_2\,}} {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{t}}}$ iff there exists $\tau \in
  {\ensuremath{{\cal T}}}$ such that $t_1 {\ensuremath{\vartriangleright}}\tau$ and $t_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}\tau$. Moreover, this $\tau \in {\ensuremath{{\cal T}}}$ is uniquely determined.

If $t_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}\tau \in {\ensuremath{{\cal T}}}$ and $t_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}t' \succ c$ for some $c \in \tau$ then ${\ensuremath{\mathrm{Is}\,t_1\,t_2\,}} {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathrm{Is}\,t_1\,\tau\,}}
  {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathrm{Is}\,t'\,\tau\,}} {\ensuremath{\Rightarrow}}{\ensuremath{\mathbf{t}}}$ by condition (7) in the definition of ${\ensuremath{\Rightarrow}}$. If ${\ensuremath{\mathrm{Is}\,t_1\,t_2\,}} {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{t}}}$ then ${\ensuremath{\mathrm{Is}\,t_1\,t_2\,}} {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$ by the Church-Rosser property of ${\ensuremath{\Rightarrow}}$ and the fact that ${\ensuremath{\mathbf{t}}}$ is in normal form. But this is only possible when ${\ensuremath{\mathrm{Is}\,t_1\,t_2\,}} {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathrm{Is}\,t'\,\tau\,}}
  {\ensuremath{\Rightarrow}}{\ensuremath{\mathbf{t}}}$ where $\tau \in {\ensuremath{{\cal T}}}$, $t_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}\tau$ and $t_1
  {\ensuremath{\stackrel{*}{\Rightarrow}}}t' \succ c$ for some $c \in \tau$, i.e. $t_1 {\ensuremath{\vartriangleright}}\tau$.

To see that $\tau$ is uniquely determined it suffices to notice that it is in normal form w.r.t. ${\ensuremath{\Rightarrow}}$ and ${\ensuremath{\Rightarrow}}$ has the Church-Rosser property.

\[lem\_forall\] The following conditions hold.

-   If $\tau \in {\ensuremath{{\cal T}}}$ and for all $t_2$ such that $t_2 {\ensuremath{\vartriangleright}}\tau$ we have $t_1 t_2 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{t}}}$, then $\forall \tau t_1 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{t}}}$.

-   If $\tau \in {\ensuremath{{\cal T}}}$ and there exists $t_2$ such that $t_2 {\ensuremath{\vartriangleright}}\tau$ and $t_1 t_2 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{f}}}$, then $\forall \tau t_1
        {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{f}}}$.

-   If $\forall t_1 t_2 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{t}}}$ then for all $t_3$ such that ${\ensuremath{\mathrm{Is}\,t_3\,t_1\,}} {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{t}}}$ we have $t_2 t_3 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{t}}}$.

-   If $\forall t_1 t_2 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{f}}}$ then there exists $t_3$ such that ${\ensuremath{\mathrm{Is}\,t_3\,t_1\,}} {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{t}}}$ and $t_2 t_3
        {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{f}}}$.

We show condition (a). Suppose $\tau \in {\ensuremath{{\cal T}}}$ and for all $t_2$ such that $t_2 {\ensuremath{\vartriangleright}}\tau$ we have $t_1 t_2 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{t}}}$. If $\tau
  \equiv \emptyset$ then $\forall \emptyset t_1 {\ensuremath{\rightarrow}}{\ensuremath{\mathbf{t}}}$ and the claim is obvious. Otherwise we have $\forall \tau t_1 {\ensuremath{\rightarrow}}t$ where ${\ensuremath{{t}^{|\epsilon}}} \equiv {\ensuremath{\mathrm{A}}}\tau$ and ${\ensuremath{{t}_{|c}}} \equiv
  t_1 c$ for $c \in \tau$. Since $c \in \tau$ we have $c {\ensuremath{\vartriangleright}}\tau$, so $t_1 c {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{t}}}$, hence $t_1 c {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$ by the Church-Rosser property. Therefore $t {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$. Condition (b) is shown in a completely analogous way.

We show condition (c). Suppose $\forall t_1 t_2 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{t}}}$. Then $\forall t_1 t_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$, which is only possible when $\forall \tau t_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$ and $t_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}\tau$ for some $\tau \in {\ensuremath{{\cal T}}}$. Suppose $t_3$ is such that ${\ensuremath{\mathrm{Is}\,t_3\,t_1\,}} {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{t}}}$. Then ${\ensuremath{\mathrm{Is}\,t_3\,t_1\,}} {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$, and we must have $t_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}\tau' \in {\ensuremath{{\cal T}}}$ and $t_3 {\ensuremath{\vartriangleright}}\tau'$, by Lemma \[lem\_is\]. Because both $\tau$ and $\tau'$ are in normal form, we conclude by the Church-Rosser property that $\tau
  \equiv \tau'$. Hence $t_3 {\ensuremath{\vartriangleright}}\tau$, i.e. $t_3 {\ensuremath{\stackrel{*}{\Rightarrow}}}t_3'
  \succ c \in \tau$. Since $\forall \tau t_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$, it is easy to see by inspecting the definitions that $t_2 c {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$. By Corollary \[cor\_succ\_arg\] we obtain $t_2 t_3 {\ensuremath{\stackrel{*}{\Rightarrow}}}t_2 t_3' {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$.

Condition (c) follows easily from definitions, Lemma \[lem\_is\] and the Church-Rosser property.

\[lem\_fun\] The following conditions hold.

-   If $\tau_1, \tau_2 \in {\ensuremath{{\cal T}}}$ and for all $t_2$ such that $t_2
        {\ensuremath{\vartriangleright}}\tau_1$ we have $t_1 t_2 {\ensuremath{\vartriangleright}}\tau_2$, then $t_1 {\ensuremath{\vartriangleright}}\tau_2^{\tau_1}$.

-   If $\tau_1, \tau_2 \in {\ensuremath{{\cal T}}}$, $t_1 {\ensuremath{\vartriangleright}}\tau_2^{\tau_1}$ and $t_2 {\ensuremath{\vartriangleright}}\tau_1$ then $t_1 t_2 {\ensuremath{\vartriangleright}}\tau_2$.

We show condition (a). Suppose $\tau_1, \tau_2 \in {\ensuremath{{\cal T}}}$ and for all $t_2$ such that $t_2 {\ensuremath{\vartriangleright}}\tau_1$ we have $t_1 t_2 {\ensuremath{\vartriangleright}}\tau_2$. Let $c \in \tau_1$. We obviously have $c {\ensuremath{\vartriangleright}}\tau_1$, so $t_1 c {\ensuremath{\vartriangleright}}\tau_2$, i.e. there exists a term $t_c$ and a constant $c' \tau_2$ such that $t_1 c {\ensuremath{\stackrel{*}{\Rightarrow}}}t_c \succ
  c'$. Recall that $\tau_2^{\tau_1}$ consists of all set-theoretic functions from $\tau_1$ to $\tau_2$. In particular, there exists $d
  \in \tau_2^{\tau_1}$ such that ${\ensuremath{{\cal F}}}(d)(c) \equiv c'$ for every $c
  \in \tau_1$ and $c' \in \tau_2$ depending on $c$ as above. But then $t_1 \succ d$, and hence $t_1 {\ensuremath{\vartriangleright}}\tau_2^{\tau_1}$.

We show condition (b). Suppose $\tau_1, \tau_2 \in {\ensuremath{{\cal T}}}$, $t_1 {\ensuremath{\vartriangleright}}\tau_2^{\tau_1}$ and $t_2 {\ensuremath{\vartriangleright}}\tau_1$. Then $t_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}t_1'
  \succ c \in \tau_2^{\tau_1}$ and $t_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}t_2' \succ c_1 \in
  \tau_1$. By condition (6) in the definition of ${\ensuremath{\Rightarrow}}$ we obtain $c t_2' {\ensuremath{\Rightarrow}}{\ensuremath{{\cal F}}}(c)(c_1) \succ {\ensuremath{{\cal F}}}(c)(c_1) \in \tau_2$. If $t_1'
  \equiv c$ then $t_1 t_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}c t_2' {\ensuremath{\Rightarrow}}{\ensuremath{{\cal F}}}(c)(c_1) \in
  \tau_2$, so $t_1 t_2 {\ensuremath{\vartriangleright}}\tau_2$. Otherwise $t_1' t_2' \gg c t_2'
  {\ensuremath{\Rightarrow}}{\ensuremath{{\cal F}}}(c)(c_1)$, and by part (${\romannumeral 1}$) of Lemma \[lem\_gg\] there exists $t$ such that $t_1 t_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}t_1' t_2' {\ensuremath{\stackrel{*}{\Rightarrow}}}t \succ {\ensuremath{{\cal F}}}(c)(c_1) \in \tau_2$. Hence $t_1 t_2
  {\ensuremath{\vartriangleright}}\tau_2$.

\[lem\_subtype\] If $\mathrm{Subtype}\,t_1\,t_2 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}\tau \in {\ensuremath{{\cal T}}}$ then there exists $\tau' \in {\ensuremath{{\cal T}}}$ such that $\tau \subseteq \tau'$, $t_1
  {\ensuremath{\stackrel{*}{\Rightarrow}}}\tau'$, and for all terms $t_3$:

-   if $t_3 {\ensuremath{\vartriangleright}}\tau'$ then $t_2 t_3 {\ensuremath{\vartriangleright}}{\ensuremath{\mathrm{Bool}}}$,

-   $t_3 {\ensuremath{\vartriangleright}}\tau$ iff $t_3 {\ensuremath{\vartriangleright}}\tau'$ and $t_2 t_3
        {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{t}}}$.

Suppose $\mathrm{Subtype}\,t_1\,t_2 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}\tau \in
  {\ensuremath{{\cal T}}}$. Since $\tau$ is in normal form, we conclude by the Church-Rosser property that $\mathrm{Subtype}\,t_1\,t_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}\tau$. By inspecting the definition of $R$ we see that this is only possible when $t_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}\tau' \in {\ensuremath{{\cal T}}}$. If $\tau' \equiv
  \emptyset$ then $\mathrm{Subtype}\,t_1\,t_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}\emptyset$ and by the Church-Rosser property we obtain $\tau \equiv
  \emptyset$. If $\tau \equiv \emptyset$ then obviously $\tau
  \subseteq \tau'$ and both conditions (a) and (b) are satisfied, because $t_3 \not{\ensuremath{\vartriangleright}}\emptyset$ for any $t_3$, as $t_3 {\ensuremath{\vartriangleright}}\emptyset$ would require the existence of some $c \in \emptyset$.

So suppose $\tau' \not\equiv \emptyset$ and $\tau \not\equiv
  \emptyset$. Then $\mathrm{Subtype}\,\tau'\,t_2 {\ensuremath{\rightarrow}}t$ where ${\ensuremath{{t}^{|\epsilon}}} \equiv {\ensuremath{\mathrm{S}}}\tau'$ and ${\ensuremath{{t}_{|c}}} \equiv t_2 c$ for $c \in \tau'$. By the Church-Rosser property we have $t
  {\ensuremath{\stackrel{*}{\Rightarrow}}}\tau$, and by inspecting the definitions we easily see that this is only possible when $t_2 c \equiv {\ensuremath{{t}_{|c}}} {\ensuremath{\stackrel{*}{\Rightarrow}}}d_c \in {\ensuremath{\mathrm{Bool}}}$ for every $c \in \tau'$ and $\tau = \{ c \in \tau'
  \;|\; d_c \equiv {\ensuremath{\mathbf{t}}}\}$. But then obviously $\tau \subseteq
  \tau'$. To show (a) suppose $t_3 {\ensuremath{\vartriangleright}}\tau'$, i.e. $t_3 {\ensuremath{\stackrel{*}{\Rightarrow}}}t_3' \succ c \in \tau'$. By Corollary \[cor\_succ\_arg\] we obtain $t_2 t_3 {\ensuremath{\stackrel{*}{\Rightarrow}}}d_c \in {\ensuremath{\mathrm{Bool}}}$. We now prove (b). Suppose $t_3
  {\ensuremath{\vartriangleright}}\tau$, i.e. $t_3 {\ensuremath{\stackrel{*}{\Rightarrow}}}t_3' \succ c \in \tau$. Since $\tau
  \subseteq \tau'$ we obviously have $t_3 {\ensuremath{\vartriangleright}}\tau'$. By Corollary \[cor\_succ\_arg\] we obtain $t_2 t_3 {\ensuremath{\stackrel{*}{\Rightarrow}}}d_c$. Since $c \in \tau$ we have $d_c \equiv {\ensuremath{\mathbf{t}}}$. For the other direction, assume $t_2 t_3 {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$ and $t_3 {\ensuremath{\vartriangleright}}\tau'$, i.e. $t_3 {\ensuremath{\stackrel{*}{\Rightarrow}}}t_3' \succ c \in \tau'$. By Corollary \[cor\_succ\_arg\] we have $t_2 t_3 {\ensuremath{\stackrel{*}{\Rightarrow}}}d_c \in
  {\ensuremath{\mathrm{Bool}}}$. By the Church-Rosser property we conclude $d_c \equiv
  {\ensuremath{\mathbf{t}}}$. Hence $c \in \tau$ and $t_3 {\ensuremath{\vartriangleright}}\tau$.

\[lem\_or\_eq\_choice\]

-   $\vee t_1 t_2 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{t}}}$ iff $t_1 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{t}}}$ or $t_2 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{t}}}$.

-   $\vee t_1 t_2 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{f}}}$ iff $t_1 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{f}}}$ and $t_2 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{f}}}$.

-   ${\ensuremath{\mathrm{Eq}\,t_1\,t_2\,}} {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{t}}}$ iff $t_1 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}t_2$.

-   If $\forall t \lambda x . {\ensuremath{\mathbf{f}}}{\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{f}}}$ with $x \notin FV(t_2)$, then $\mathrm{Is}\, (\mathrm{Choice}\, t)\, t
        {\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{t}}}$.

Follows easily from definitions and the Church-Rosser property.

\[lem\_inductive\] Suppose $\iota \in {\ensuremath{{\cal T}}}_I$, $\iota = \mu(\langle \iota_{1,1}, \ldots,
  \iota_{1,n_1}\rangle, \ldots, \langle
  \iota_{m,1},\ldots,\iota_{m,n_m} \rangle)$, $c_i^\iota \in {\ensuremath{{\cal C}}}$ has arity $n_i$, $\iota_{i,j}^* = \iota_{i,j}$ if $\iota_{i,j} \in
  {\ensuremath{{\cal T}}}_I$, $\iota_{i,j}^* = \iota$ if $\iota_{i,j} = \star$, and $\bar{\iota}_{i,j}^* \in \bar{{\ensuremath{{\cal T}}}}_I$ is the subset of ${\ensuremath{{\cal K}}}$ determined by $\iota_{i,j}^*$ (see Definition \[def\_canonical\]). Let $t$ be a term.

If for all $i=1,\ldots,m$ we have:

-   for all $t_1,\ldots,t_{n_i}$ such that

    -   $t_j {\ensuremath{\vartriangleright}}\bar{\iota}_{i,j}^*$ for $j=1,\ldots,n_i$, and

    -   $t t_j {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$ for all $1 \le j \le n_i$ such that $\iota_{i,j} = \star$

    we have $t (c_i^\iota t_1 \ldots t_{n_i}) {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$

then $\forall \bar{\iota} t {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$.

Note that for every ${\ensuremath{{\cal I}}}_s$-term in ${\ensuremath{\mathbb T}}_I$ (see Definition \[def\_canonical\]) there exists a semantic term corresponding to it in the obvious way. Thus, we may assume without loss of generality that ${\ensuremath{\mathbb T}}_I$ is a set of semantic terms. Let $s
  \in \bar{\iota}$. It follows by straightforward induction on the structure of the term $r \in {\ensuremath{\mathbb T}}_I$ corresponding to $s$ (see Definition \[def\_canonical\]) that $t r {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$. It is easy to see from the definition of $R$ that $r {\ensuremath{\Rightarrow}}s$. Therefore $t s {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$.

\[lem\_truth\_value\] $\forall \, (\mathrm{Subtype}\,{\ensuremath{\mathrm{Bool}}}\,(\lambda x . {\ensuremath{\mathbf{f}}})) \,
  (\lambda x . {\ensuremath{\mathbf{f}}}) {\ensuremath{\Rightarrow}}{\ensuremath{\mathbf{t}}}$.

It is easy to see that $\mathrm{Subtype}\,{\ensuremath{\mathrm{Bool}}}\,(\lambda x \,.\,
  {\ensuremath{\mathbf{f}}}) {\ensuremath{\Rightarrow}}\emptyset$, and by definition of $R$ we have $\forall\, \emptyset \lambda x \,.\, {\ensuremath{\mathbf{f}}}{\ensuremath{\rightarrow}}{\ensuremath{\mathbf{t}}}$.

\[lem\_supset\_t2\] If $\forall \, (\mathrm{Subtype}\,{\ensuremath{\mathrm{Bool}}}\,(\lambda x . t)) {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$ and $x \notin FV(t)$ then $t {\ensuremath{\stackrel{*}{\Rightarrow}}}\top$ or $t
  {\ensuremath{\stackrel{*}{\Rightarrow}}}\bot$.

Follows easily from definitions and the Church-Rosser property.

For $\tau \in {\ensuremath{{\cal T}}}$, we write $t_1 \sim_\tau t_2$ if for every term $t$ such that $t {\ensuremath{\vartriangleright}}{\ensuremath{\mathrm{Bool}}}^\tau$ we have $t t_1 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}t
  t_2$.

\[lem\_ext\_fun\] If $\tau_1, \tau_2 \in {\ensuremath{{\cal T}}}$, $\tau = \tau_2^{\tau_1}$, $t_1 {\ensuremath{\vartriangleright}}\tau$, $t_2 {\ensuremath{\vartriangleright}}\tau$ and for all $s$ such that $s {\ensuremath{\vartriangleright}}\tau_1$ we have $t_1 s \sim_{\tau_2} t_2 s$, then $t_1 \sim_{\tau} t_2$.

We have $t_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}t_1' \succ c_1 \in \tau$ and $t_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}t_2' \succ c_2 \in \tau$. Let $d_1 \in \tau_1$, $d_2 \in \tau_2$ and let $f \in {\ensuremath{\mathrm{Bool}}}^{\tau_2}$ be such that ${\ensuremath{{\cal F}}}(f)(d_2) \equiv
  {\ensuremath{\mathbf{t}}}$ and ${\ensuremath{{\cal F}}}(f)(d) \equiv {\ensuremath{\mathbf{f}}}$ for $d \ne d_2$. Since $t_1'
  \succ c_1$, there exists $s_1$ such that $t_1' d_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}s_1
  \succ {\ensuremath{{\cal F}}}(c_1)(d_1)$. Analogously $t_2' d_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}s_2 \succ
  {\ensuremath{{\cal F}}}(c_2)(d_1)$. Because $t_1 d_1 \sim_{\tau_2} t_2 d_1$, we have $f
  (t_1 d_1) {\ensuremath{\stackrel{*}{\Leftrightarrow}}}f (t_2 d_1)$. We have $f (t_1 d_1) {\ensuremath{\stackrel{*}{\Rightarrow}}}f
  (t_1' d_1) {\ensuremath{\stackrel{*}{\Rightarrow}}}f s_1$. Since $s_1 \succ {\ensuremath{{\cal F}}}(c_1)(d_1) \in
  \tau_2$ and $f \in {\ensuremath{\mathrm{Bool}}}^{\tau_2}$, we obtain $f s_1 {\ensuremath{\Rightarrow}}{\ensuremath{{\cal F}}}(f)({\ensuremath{{\cal F}}}(c_1)(d_1))$ by condition (6) in the definition of ${\ensuremath{\Rightarrow}}$. Analogously $f (t_2 d_1) {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{{\cal F}}}(f)({\ensuremath{{\cal F}}}(c_2)(d_1))$. Hence, by the Church-Rosser property ${\ensuremath{{\cal F}}}(f)({\ensuremath{{\cal F}}}(c_1)(d_1)) \equiv {\ensuremath{{\cal F}}}(f)({\ensuremath{{\cal F}}}(c_2)(d_1))$. In other words, ${\ensuremath{{\cal F}}}(c_1)(d_1) \equiv d_2$ iff ${\ensuremath{{\cal F}}}(c_2)(d_1) \equiv
  d_2$. Since $d_2 \in \tau_2$ was arbitrary, ${\ensuremath{{\cal F}}}(c_1)(d_1) \equiv
  {\ensuremath{{\cal F}}}(c_2)(d_1)$. But $d_1 \in \tau_1$ was also arbitrary, so $c_1
  \equiv c_2$.

Now, let $t$ be such that $t {\ensuremath{\vartriangleright}}{\ensuremath{\mathrm{Bool}}}^{\tau}$. Then $t {\ensuremath{\stackrel{*}{\Rightarrow}}}t' \succ p \in {\ensuremath{\mathrm{Bool}}}^{\tau}$. We have $t t_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}t' t_1
  {\ensuremath{\stackrel{*}{\Rightarrow}}}t' t_1' \gg p c_1 {\ensuremath{\Rightarrow}}{\ensuremath{{\cal F}}}(p)(c_1)$. By part (${\romannumeral 1}$) of Lemma \[lem\_gg\] we have $t' t_1' {\ensuremath{\stackrel{*}{\Rightarrow}}}r_1 \gg {\ensuremath{{\cal F}}}(p)(c_1)$ for some term $r_1$. But ${\ensuremath{{\cal F}}}(p)(c_1) \in
  {\ensuremath{\mathrm{Bool}}}$, so in fact $r_1 \equiv {\ensuremath{{\cal F}}}(p)(c_1)$ Analogously $t t_2
  {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{{\cal F}}}(p)(c_2) \equiv {\ensuremath{{\cal F}}}(p)(c_1)$. Therefore $t t_1
  {\ensuremath{\stackrel{*}{\Leftrightarrow}}}t t_2$. Hence $t_1 \sim_\tau t_2$.

\[lem\_ext\_bool\] Define $t_1 \supset t_2$ by $t_1 \supset t_2 \equiv \forall
  (\mathrm{Subtype}\, {\ensuremath{\mathrm{Bool}}}\, \lambda x . t_1) \lambda y . t_2$, where $x,y \notin FV(t_1,t_2)$. If $t_1 \supset t_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$ and $t_2 \supset t_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$, then $t_1 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}t_2$.

Suppose $t_1 \supset t_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$ and $t_2 \supset t_1
  {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$. We thus have $$\forall (\mathrm{Subtype}\, {\ensuremath{\mathrm{Bool}}}\, \lambda x . t_1) \lambda y . t_2
  {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{t}}}$$ which is only possible when $(\mathrm{Subtype}\, {\ensuremath{\mathrm{Bool}}}\, \lambda x
  . t_1) {\ensuremath{\stackrel{*}{\Rightarrow}}}\tau \in {\ensuremath{{\cal T}}}$. But this in turn is only possible when $t_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}t_1' \in \{{\ensuremath{\mathbf{t}}}, {\ensuremath{\mathbf{f}}}\}$. By an analogous argument $t_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}t_2' \in \{{\ensuremath{\mathbf{t}}}, {\ensuremath{\mathbf{f}}}\}$. Now it is easy to see that if $t_1' \ne t_2'$ then $t_1 \supset t_2 {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{f}}}$ or $t_2 \supset t_1 {\ensuremath{\stackrel{*}{\Rightarrow}}}{\ensuremath{\mathbf{f}}}$.

From now on, to avoid confusion, we use $r$, $r_1$, $r_2$, etc. to denote terms of ${\ensuremath{{\cal I}}}_s$, and $t$, $t_1$, $t_2$, etc. to denote semantic terms.

\[def\_model\] We define an ${\ensuremath{{\cal I}}}_s$-structure ${\ensuremath{{\cal M}}}= \langle A, \cdot,
  {\ensuremath{\llbracket\rrbracket_{}^{}}} \rangle$ as follows. As $A$ we take the set of equivalence classes of ${\ensuremath{\stackrel{*}{\Leftrightarrow}}}$ on semantic terms. We denote the equivalence class of a semantic term $t$ by $[t]$. We define $[t_1]
  \cdot [t_1] = [t_1 t_2]$. This is well-defined because $t_1
  {\ensuremath{\stackrel{*}{\Leftrightarrow}}}t_1'$ and $t_2 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}t_2'$ imply $t_1 t_2 {\ensuremath{\stackrel{*}{\Leftrightarrow}}}t_1' t_2'$. To save on notation, we sometimes confuse $[t]$ with $t$, where it does not lead to ambiguities.

Let $v : V \to A$ be an ${\ensuremath{{\cal M}}}$-valuation. We define a function $u$ from $V$ to semantic terms by $u(x) = t$ where $t$ is an arbitrary but fixed semantic term such that $[t] = v(x)$. By $u[x/t]$ we denote a function $w$ from $V$ to semantic terms such that $w(y) =
  u(y)$ for $y \ne x$, and $w(x) = t$. By induction on the structure of an ${\ensuremath{{\cal I}}}_s$-term $r$, we define a translation ${\ensuremath{\llceil r \rrceil}}^u$ from terms of ${\ensuremath{{\cal I}}}_s$ to semantic terms, parametrized by a function $u$ from $V$ to semantic terms:

-   ${\ensuremath{\llceil \mathrm{Is} \rrceil}} = \mathrm{Is}$, ${\ensuremath{\llceil \mathrm{Subtype} \rrceil}} = \mathrm{Subtype}$, ${\ensuremath{\llceil \mathrm{Fun} \rrceil}} = \mathrm{Fun}$, ${\ensuremath{\llceil \forall \rrceil}} =
        \forall$, ${\ensuremath{\llceil \vee \rrceil}} = \vee$, ${\ensuremath{\llceil \bot \rrceil}} = {\ensuremath{\mathbf{f}}}$, ${\ensuremath{\llceil \epsilon \rrceil}} = \mathrm{Choice}$, ${\ensuremath{\llceil \mathrm{Eq} \rrceil}} =
        \mathrm{Eq}$, ${\ensuremath{\llceil \mathrm{Cond} \rrceil}} = \mathrm{Cond}$, ${\ensuremath{\llceil \mathrm{Type} \rrceil}} = \mathrm{Type}$, ${\ensuremath{\llceil \mathrm{Prop} \rrceil}} = \mathrm{Bool}$, ${\ensuremath{\llceil \iota \rrceil}} =
        \bar{\iota}$ for $\iota \in {\ensuremath{{\cal T}}}_I$, ${\ensuremath{\llceil c_i^\iota \rrceil}} =
        c_i^\iota$ for $c_i^\iota \in {\ensuremath{{\cal C}}}$, ${\ensuremath{\llceil d_{i,j}^\iota \rrceil}} =
        d_{i,j}^\iota$ for $d_{i,j}^\iota \in {\ensuremath{{\cal D}}}$, ${\ensuremath{\llceil o_i^\iota \rrceil}} =
        o_i^\iota$ for $o_i^\iota \in {\ensuremath{{\cal O}}}$,

-   ${\ensuremath{\llceil x \rrceil}}^u = u(x)$ for $x \in V$,

-   ${\ensuremath{\llceil r_1 r_2 \rrceil}}^u = {\ensuremath{\llceil r_1 \rrceil}}^u \cdot {\ensuremath{\llceil r_2 \rrceil}}^u$,

-   ${\ensuremath{\llceil \lambda x \,.\, r \rrceil}}^u = \lambda y \,.\, {\ensuremath{\llceil r \rrceil}}^{u[x/y]}$ where $x \in V$ and $y \in V^+$ is a fresh variable.

Now the interpretation ${\ensuremath{\llbracket\rrbracket_{}^{}}}$ is defined by $${\ensuremath{\llbracketr\rrbracket_{v}^{}}} = [{\ensuremath{\llceil r \rrceil}}^u]$$ where $u$ is the function from $V$ to semantic terms, corresponding to $v$, as defined above.

\[thm\_consistent\] The system $e{\ensuremath{{\cal I}}}_s$ is consistent, i.e. $\not{\ensuremath{\vdash}}_{e{\ensuremath{{\cal I}}}_s} \bot$.

We show that ${\ensuremath{{\cal M}}}$ is an $e{\ensuremath{{\cal I}}}_s$-model. We need to check the conditions in Definition \[def\_I\_s\_model\]. Conditions (var) and (app) follow directly from the definition of ${\ensuremath{{\cal M}}}$. For condition ($\beta$) note that ${\ensuremath{\llbracket\lambda x \,.\, r\rrbracket_{v}^{}}}
  \cdot [t] = [{\ensuremath{\llceil \lambda x \,.\, r \rrceil}}^u] \cdot [t] = [(\lambda y
    \,.\, {\ensuremath{\llceil r \rrceil}}^{u[x/y]}) t] = [{\ensuremath{\llceil r \rrceil}}^{u[x/t]}] =
  {\ensuremath{\llbracketr\rrbracket_{v[x/[t]]}^{}}}$ where $u$ is like in Definition \[def\_model\]. Condition (fv) is obvious from the definition of ${\ensuremath{\llbracket\rrbracket_{}^{}}}$. For condition ($\xi$) suppose ${\ensuremath{\llbracket\lambda x \,.\, r_1\rrbracket_{v}^{}}} \cdot [t] = {\ensuremath{\llbracket\lambda
    x \,.\, r_2\rrbracket_{v}^{}}} \cdot [t]$ for every semantic term $t$. Then in particular this holds for any variable $y \in V^+$. We have ${\ensuremath{\llbracket\lambda x \,.\, r_1\rrbracket_{v}^{}}} \cdot [t] = [(\lambda y \,.\,
    {\ensuremath{\llceil r_1 \rrceil}}^{u[x/y]}) y] = [{\ensuremath{\llceil r_1 \rrceil}}^{u[x/y]}]$ and ${\ensuremath{\llbracket\lambda x \,.\, r_2\rrbracket_{v}^{}}} \cdot [t] = [(\lambda y \,.\,
    {\ensuremath{\llceil r_2 \rrceil}}^{u[x/y]}) y] = [{\ensuremath{\llceil r_2 \rrceil}}^{u[x/y]}]$, where $u$ is like in Definition \[def\_model\]. Hence $[{\ensuremath{\llceil r_1 \rrceil}}^{u[x/y]}] = [{\ensuremath{\llceil r_2 \rrceil}}^{u[x/y]}]$. But ${\ensuremath{\llbracket\lambda x \,.\, r_1\rrbracket_{v}^{}}} = [\lambda y \,.\,
    {\ensuremath{\llceil r_1 \rrceil}}^{u[x/y]}]$ and ${\ensuremath{\llbracket\lambda x \,.\, r_2\rrbracket_{v}^{}}}
  = [\lambda y \,.\, {\ensuremath{\llceil r_2 \rrceil}}^{u[x/y]}]$.

Condition (pr) follows from Lemma \[lem\_truth\_value\]. Condition (pt) follows directly from the definition of $R$. Conditions ($\forall_\top$), ($\forall_\bot$), ($\forall_e$) and ($\forall_e'$) follow from Lemma \[lem\_forall\] and Lemma \[lem\_is\]. Conditions ($\vee_1$) and ($\vee_2$) follow from Lemma \[lem\_or\_eq\_choice\]. Condition ($\supset_{t2}$) follows from Lemma \[lem\_supset\_t2\]. Condition ($\bot$) follows from Lemma \[lem\_truth\_value\] and the Church-Rosser property. Conditions ($\to_i$) and ($\to_e$) follow from Lemma \[lem\_fun\] and Lemma \[lem\_is\]. Condition ($\to_t$) follows from the definition of $R$ and the Church-Rosser propery. Conditions (s1)-(s3) follow from Lemma \[lem\_subtype\] and Lemma \[lem\_is\]. Condition (s4) follows easily from definitions and Lemma \[lem\_is\]. Conditions (o1), (o2), (d1) and (i2) follow directly from definitions. Condition (i1) follows from Lemma \[lem\_inductive\]. Conditions ($\epsilon$) and (eq) follow from Lemma \[lem\_or\_eq\_choice\]. Conditions (c1) and (c2) are obvious from the definition of $R$ and the Church-Rosser property. Condition (ef) follows from Lemma \[lem\_ext\_fun\]. Condition (eb) follows from Lemma \[lem\_ext\_bool\].

Now suppose ${\ensuremath{\vdash}}_{e{\ensuremath{{\cal I}}}_s} \bot$. Then by Theorem \[thm\_sound\] we have ${\ensuremath{{\cal M}}}\models \bot$, so ${\ensuremath{\llbracket\bot\rrbracket_{}^{}}} = [{\ensuremath{\mathbf{t}}}]$. But we have ${\ensuremath{\llbracket\bot\rrbracket_{}^{}}} = [{\ensuremath{\mathbf{f}}}]$, which implies ${\ensuremath{\mathbf{t}}}{\ensuremath{\stackrel{*}{\Leftrightarrow}}}{\ensuremath{\mathbf{f}}}$. This is impossible by the Church-Rosser property of ${\ensuremath{\Rightarrow}}$.

Complete Translation of First-Order Logic {#sec_embedding}
=========================================

In this appendix we show that the translation from Sect. \[sec\_consistent\] restricted to first-order logic is complete, i.e. we prove Theorem \[thm\_embedding\_01\]. The method of the proof is essentially the same as in [@Czajka2011], and it is a relatively simple application of the construction from the previous appendix.

First, let us precisely state the definition of the system $\mathrm{FO}$ of classical first-order logic.

-   The *types* of ${{\ensuremath{{\mathrm{FO}}}}}$ are given by $${\ensuremath{{\cal T}}}\;\; ::= \;\; o \;|\; \delta \;|\; \delta \to {\ensuremath{{\cal T}}}$$

-   The set of terms of ${{\ensuremath{{\mathrm{FO}}}}}$ of type $\tau$, denoted $T_\tau$, is defined as follows:

    -   $V_\delta \subseteq T_\delta$,

    -   $\Sigma_\tau \subseteq T_\tau$,

    -   if $t_1 \in T_{\delta\to\tau}$ and $t_2 \in T_\delta$ then $t_1 t_2 \in T_\tau$,

    -   $\bot \in T_o$,

    -   if $\varphi, \psi \in T_o$ then $\varphi \supset \psi \in
              T_o$,

    -   if $x \in V_\delta$ and $\varphi \in T_o$ then $\forall x :
              \delta \,.\, \varphi \in T_o$,

    where $V_\delta$ is a countable set of variables and for each $\tau \in {\ensuremath{{\cal T}}}\setminus \{o\}$ the set $\Sigma_\tau$ is a countable set of constants. We assume that the sets $\Sigma_\tau$ are all pairwise disjoint, and disjoint with $V_\delta$. Terms of type $o$ are *formulas*. As usual, we omit spurious brackets and assume that application associates to the left. We identify $\alpha$-equivalent terms, i.e. terms differing only in the names of bound variables are considered identical.

-   The system ${{\ensuremath{{\mathrm{FO}}}}}$ is given by the following rules and axioms, where $\Delta$ is a finite set of formulas, $\varphi, \psi$ are formulas. The notation $\Delta, \varphi$ is a shorthand for $\Delta \cup \{\varphi\}$.

    [**Axioms**]{}

    -   $\Delta, \varphi {\ensuremath{\vdash}}\varphi$

    -   $\Delta {\ensuremath{\vdash}}((\varphi \supset \bot) \supset \bot)
              \supset \varphi$

    [**Rules**]{}

      ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ -------------------------------------------------------------------------------------------------------------------------------------------
      $                                                                                                                                                                                                                                                                                                                                          $
                {\supset_i^{{{\ensuremath{{\mathrm{FO}}}}}}:}\; \inferrule{\Delta, \varphi {\ensuremath{\vdash}}\psi}{\Delta {\ensuremath{\vdash}}\varphi \supset \psi}                                                                     {\supset_e^{{{\ensuremath{{\mathrm{FO}}}}}}:}\; \inferrule{\Delta {\ensuremath{\vdash}}\varphi \supset
              $                                                                                                                                                                                                                                                 \psi \;\;\; \Delta {\ensuremath{\vdash}}\varphi}{\Delta {\ensuremath{\vdash}}\psi}
                                                                                                                                                                                                                                                                                                                                                 $

                                                                                                                                                                                                       

      $                                                                                                                                                                                                                                                                                                                                          $
                {\forall_i^{{{\ensuremath{{\mathrm{FO}}}}}}:}\; \inferrule{\Delta {\ensuremath{\vdash}}\varphi}{\Delta {\ensuremath{\vdash}}\forall x : \delta \,.\, \varphi} \; x \notin FV(\Delta)               {\forall_e^{{{\ensuremath{{\mathrm{FO}}}}}}:}\; \inferrule{\Delta {\ensuremath{\vdash}}\forall x : \delta \,.\, \varphi}{\Delta
              $                                                                                                                                                                                                                                                                                {\ensuremath{\vdash}}\varphi[x/t]}\; t \in T_\delta
                                                                                                                                                                                                                                                                                                                                                 $
      ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ -------------------------------------------------------------------------------------------------------------------------------------------

Note that the system ${{\ensuremath{{\mathrm{FO}}}}}$ is a restriction of .

A first-order structure ${\ensuremath{{\cal A}}}$ is a pair $\langle A, \{ f_c \;|\; c
  \in \Sigma_\tau, \tau \in {\ensuremath{{\cal T}}}\} \rangle$ where $A$ is the non-empty universe and $f_c$ are interpretations of constants (functions or relations on $A$ of appropriate arity, or elements of $A$). By ${\ensuremath{\llbracketc\rrbracket_{}^{{\ensuremath{{\cal A}}}}}}$ we denote the interpretation of $c$ in ${\ensuremath{{\cal A}}}$. A first-order valuation $u$ is a function from variables to the universe of a first-order structure. We define the relations of satisfaction ${\ensuremath{{\cal A}}}\models_{{\ensuremath{{\mathrm{FO}}}}}\varphi$ and semantic consequence $\Delta \models_{{\ensuremath{{\mathrm{FO}}}}}\varphi$ in an obvious way.

The following is a well-known result from elementary logic.

$\Delta {\ensuremath{\vdash}}_{{\ensuremath{{\mathrm{FO}}}}}\varphi$ iff $\Delta \models_{{\ensuremath{{\mathrm{FO}}}}}\varphi$

The mappings ${\ensuremath{\lceil-\rceil}}$ and $\Gamma(-)$ are defined exactly as in Sect. \[sec\_consistent\], restricting to terms of ${{\ensuremath{{\mathrm{FO}}}}}$. Recall that we assume $V_\delta \subseteq V$ and $\Sigma_\tau \subseteq \Sigma_s$ for $\tau \in {\ensuremath{{\cal T}}}$.

If $\Delta {\ensuremath{\vdash}}_{{\ensuremath{{\mathrm{FO}}}}}\varphi$ then $\Gamma(\Delta, \varphi),
  {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} {\ensuremath{\lceil\varphi\rceil}}$.

This is a special case of Theorem \[thm\_sound\_hol\].

In this section we use $s$, $s_1$, $s_2$, etc. for terms of ${\ensuremath{{\cal I}}}_s$. We assume that there is a fresh constant $\delta \in \Sigma_s$. This constant will represent the first-order universe. We use the notation $\tau^n\to\tau$ for $\tau\to\ldots\to\tau$ where $\tau$ occurs $n+1$ times, where $n > 0$.

If $\Gamma(\Delta, \varphi), {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{e{\ensuremath{{\cal I}}}_s}
  {\ensuremath{\lceil\varphi\rceil}}$ then $\Delta {\ensuremath{\vdash}}_{{\ensuremath{{\mathrm{FO}}}}}\varphi$.

Suppose $\Gamma(\Delta, \varphi), {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{e{\ensuremath{{\cal I}}}_s}
  {\ensuremath{\lceil\varphi\rceil}}$ but $\Delta \not{\ensuremath{\vdash}}_{{\ensuremath{{\mathrm{FO}}}}}\varphi$. Then $\Delta
  \not\models_{{\ensuremath{{\mathrm{FO}}}}}\varphi$, so there exist a first-order structure ${\ensuremath{{\cal A}}}$ and a first-order valuation $u$ such that ${\ensuremath{{\cal A}}}, u
  \models_{{\ensuremath{{\mathrm{FO}}}}}\Delta$, but ${\ensuremath{{\cal A}}}, u \not\models_{{\ensuremath{{\mathrm{FO}}}}}\varphi$.

We use the construction of Definition \[def\_model\] to transform ${\ensuremath{{\cal A}}}$ into an $e{\ensuremath{{\cal I}}}_s$-model ${\ensuremath{{\cal M}}}$, by taking the set of constants $\delta$ of ${\ensuremath{{\cal M}}}$ to consist of the elements of the universe of ${\ensuremath{{\cal A}}}$. We also need to extend the definition of the translation ${\ensuremath{\llceil - \rrceil}}$ from Definition \[def\_model\] to interpret the new constants that we added to the language of $e{\ensuremath{{\cal I}}}_s$. We set ${\ensuremath{\llceil \delta \rrceil}} = \delta$. If $c \in
  \Sigma_{\delta}$ then we set ${\ensuremath{\llceil c \rrceil}} =
  {\ensuremath{\llbracketc\rrbracket_{}^{{\ensuremath{{\cal A}}}}}}$. If $f \in \Sigma_{\delta^n\to\delta}$ then let $c_f \in \delta^{(\delta,\ldots,\delta)}$ be such that ${\ensuremath{{\cal F}}}(c_f)(a_1)(a_2)\ldots(a_n) = {\ensuremath{\llbracketf\rrbracket_{}^{{\ensuremath{{\cal A}}}}}}(a_1, \ldots,
  a_n)$ for any $a_1,\ldots,a_n \in \delta$. We set ${\ensuremath{\llceil f \rrceil}} =
  c_f$. Similarly, if $r \in \Sigma_{\delta^n\to o}$ then let $c_r \in
  {\ensuremath{\mathrm{Bool}}}^{(\delta,\ldots,\delta)}$ be such that for all $a_1,\ldots,a_n
  \in \delta$ we have ${\ensuremath{{\cal F}}}(c_r)(a_1)(a_2)\ldots(a_n) = {\ensuremath{\mathbf{t}}}$ iff ${\ensuremath{\llbracketr\rrbracket_{}^{{\ensuremath{{\cal A}}}}}}(a_1, \ldots, a_n)$ holds.

Note that in ${\ensuremath{{\cal M}}}$ we have $\delta = \{ a \in {\ensuremath{{\cal M}}}\;|\; \mathrm{Is}
  \cdot a \cdot \delta = \top \}$. This follows directly from Lemma \[lem\_is\] and the fact that for $a \in \delta$ we have $a
  \notin \tau_2^{\tau}$, and hence if $t {\ensuremath{\vartriangleright}}a$ then $t {\ensuremath{\stackrel{*}{\Leftrightarrow}}}a$. Note also that any first-order ${\ensuremath{{\cal A}}}$-valuation $v$ is also an ${\ensuremath{{\cal M}}}$-valuation, if for a variable $x$ we interpret $v(x)$ as an element of the set $\delta$ in ${\ensuremath{{\cal M}}}$.

Now it is easy to show by induction on the structure of a term $t
  \in T_\tau$ that ${\ensuremath{\llbracket{\ensuremath{\lceilt\rceil}}\rrbracket_{v}^{{\ensuremath{{\cal M}}}}}} =
  {\ensuremath{\llbrackett\rrbracket_{v}^{{\ensuremath{{\cal A}}}}}} \in \delta$ for any first order-valuation $v$, where $\tau \in {\ensuremath{{\cal T}}}\setminus \{o\}$. Using this we verify by straightforward induction on the structure of a first-order formula $\varphi$ that for any first-order valuation $v$ we have ${\ensuremath{\llbracket{\ensuremath{\lceil\varphi\rceil}}\rrbracket_{v}^{{\ensuremath{{\cal M}}}}}} = {\ensuremath{\mathbf{t}}}$ iff ${\ensuremath{{\cal A}}}, v \models
  \varphi$, and ${\ensuremath{\llbracket{\ensuremath{\lceil\varphi\rceil}}\rrbracket_{v}^{{\ensuremath{{\cal M}}}}}} = {\ensuremath{\mathbf{f}}}$ iff ${\ensuremath{{\cal A}}}, v \not\models \varphi$. For instance, suppose $\varphi \equiv
  \forall x : \delta \,.\, \psi$. Then ${\ensuremath{\lceil\varphi\rceil}} = \forall x :
  \delta \,.\, {\ensuremath{\lceil\psi\rceil}}$. Since ${\ensuremath{\llbracket\delta :
    {\ensuremath{\mathrm{Type}}}\rrbracket_{v}^{{\ensuremath{{\cal M}}}}}} = {\ensuremath{\mathbf{t}}}$, and $a \in {\ensuremath{{\cal A}}}$ iff $\mathrm{Is} \cdot a
  \cdot \delta = {\ensuremath{\mathbf{t}}}$, we have ${\ensuremath{\llbracket{\ensuremath{\lceil\varphi\rceil}}\rrbracket_{v}^{{\ensuremath{{\cal M}}}}}}
  = {\ensuremath{\mathbf{t}}}$ iff ${\ensuremath{\llbracket{\ensuremath{\lceil\psi\rceil}}\rrbracket_{v[x/a]}^{{\ensuremath{{\cal M}}}}}} = {\ensuremath{\mathbf{t}}}$ for every $a \in {\ensuremath{{\cal A}}}$ iff ${\ensuremath{{\cal A}}}, v[x/a] \models \psi$ for every $a \in {\ensuremath{{\cal A}}}$ iff ${\ensuremath{{\cal A}}}, v \models \forall x : \delta \,.\, \psi \equiv \varphi$, where we use the inductive hypothesis in the second equivalence.

It is easy to check that ${\ensuremath{{\cal M}}}, u \models_{e{\ensuremath{{\cal I}}}_s} \Gamma(\Delta,
  \varphi)$. Hence ${\ensuremath{{\cal M}}}, u \models_{e{\ensuremath{{\cal I}}}_s} \Gamma(\Delta, \varphi),
  {\ensuremath{\lceil\Delta\rceil}}$, because ${\ensuremath{{\cal A}}}, u \models_{{\ensuremath{{\mathrm{FO}}}}}\Delta$. Since ${\ensuremath{{\cal A}}}, u
  \not\models_{{\ensuremath{{\mathrm{FO}}}}}\varphi$, we also have ${\ensuremath{{\cal M}}}, u \not\models_{e{\ensuremath{{\cal I}}}_s}
  {\ensuremath{\lceil\varphi\rceil}}$. But by Theorem \[thm\_sound\] and $\Gamma(\Delta, \varphi), {\ensuremath{\lceil\Delta\rceil}} {\ensuremath{\vdash}}_{e{\ensuremath{{\cal I}}}_s}
  {\ensuremath{\lceil\varphi\rceil}}$ we have ${\ensuremath{{\cal M}}}, u \models_{e{\ensuremath{{\cal I}}}_s}
  {\ensuremath{\lceil\varphi\rceil}}$. Contradiction.

[^1]: So e.g. in the axiom $\beta$ the free variables of $t_2$ do not become bound in $t_1[x/t_2]$.

[^2]: To be more precise, for every possible substitution of terms for the free variables of $\Gamma,t$ we perform this substitution on $\Gamma,t$, denoting the result by $\Gamma^*,t^*$.

[^3]: By defining (see the next subsection) $\varphi = \neg \varphi$ one could then easily derive $\bot$ using the rule $\vee_e$ applied to $\varphi \vee \neg\varphi$.

[^4]: We mean this in a precise sense. This follows from our model construction.

[^5]: By soundness we mean that if the algorithm declares $t : \alpha$ correct (in a context $\Gamma$), then $\Gamma
      {\ensuremath{\vdash}}_{{\ensuremath{{\cal I}}}_s} t : \alpha$. Completeness is the implication in the other direction. The point is that one would want some standard type-checking algorithms to be modified to work on terms of ${\ensuremath{{\cal I}}}_s$, by declaring incorrect all type assertions not conforming to the syntax of (a straightforward translation of) the assertions handled by the algorithm.

[^6]: Substitution is defined for semantic terms in an obvious way, avoiding variable capture.
