Mechanized Metatheory Revisited: An Extended Abstract (Invited Paper)
T Y P E S
Mechanized Metatheory Revisited: An Extended Abstract
Dale Miller Inria
?cole Polytechnique
Palaiseau
France https://orcid.org/
Category Invited Paper
Proof assistants and the programming languages that implement them need to deal with a range of linguistic expressions that involve bindings. Since most mature proof assistants do not have builtin methods to treat this aspect of syntax, many of them have been extended with various packages and libraries that allow them to encode bindings using, for example, de Bruijn numerals and nominal logic features. I put forward the argument that bindings are such an intimate aspect of the structure of expressions that they should be accounted for directly in the underlying programming language support for proof assistants and not added later using packages and libraries. One possible approach to designing programming languages and proof assistants that directly supports such an approach to bindings in syntax is presented. The roots of such an approach can be found in the mobility of binders between termlevel bindings, formulalevel bindings (quantifiers), and prooflevel bindings (eigenvariables). In particular, by combining Church's approach to terms and formulas (found in his Simple Theory of Types) and Gentzen's approach to sequent calculus proofs, we can learn how bindings can declaratively interact with the full range of logical connectives and quantifiers. I will also illustrate how that framework provides an intimate and semantically clean treatment of computation and reasoning with syntax containing bindings. Some implemented systems, which support this intimate and builtin treatment of bindings, will be briefly described. 2012 ACM Subject Classification Theory of computation ? Proof theory, Theory of computation ? Automated reasoning, Theory of computation ? Higher order logic Related Version A full version of this paper, titled ?Mechanized metatheory revisited?, is available at http://www.lix.polytechnique.fr/Labo/Dale.Miller/papers/pubs.html. Funding This work was funded by the ERC Advanced Grant ProofCert. Foreword This extended abstract is a nontechnical look at the mechanization of formalized metatheory. While this paper may be provocative at times, I mainly intend to shine light on a slice of literature that is developing a coherent and maturing approach to mechanizing metatheory.
and phrases mechanized metatheory; mobility of binders; lambdatree syntax; higherorder abstract syntax

looked at existing practices and systems and urged the developers of proof assistants to make
improvements to existing systems.
Our conclusion from these experiments is that the relevant technology has developed
almost to the point where it can be widely used by language researchers. We seek
to push it over the threshold, making the use of proof tools common practice in
programming language research ? mechanized metatheory for the masses. [5]
In fact, a number of research teams have used proof assistants to formally prove significant
properties of programming language related systems. Such properties include type
preservation, determinancy of evaluation, and the correctness of an OS microkernel and of various
compilers: see, for example, [41, 42, 44, 59].
As noted in [5], the poor support for binders in syntax was one problem that held
back proof assistants from achieving even more widespread use by programming language
researchers and practitioners. In recent years, a number of enhancements to programming
languages and to proof assistants have been developed for treating bindings. These go by
names such as locally nameless [12, 76], nominal reasoning [3, 14, 69, 83], and parametric
higherorder abstract syntax [15]. Some of these approaches involve extending underlying
programming language implementations while the others do not extend the proof assistant
or programming language but provide various packages, libraries, and/or abstract datatypes
that attempt to orchestrate various issues surrounding the syntax of bindings. In the end,
nothing canonical seems to have arisen: see [4, 68] for detailed comparisons.
2
An analogy: concurrency theory
While extending mature proof assistants (such as Coq, HOL, and Isabelle) with facilities to
handle bindings is clearly possible, it seems desirable to consider directly the computational
principles surrounding the treatment of binding in syntax independent of a given programming
language. Developments in programming design has, of course, run into similar situations
where there was a choice to be made between accounting for features by extending existing
programming languages or by the development of new programming languages. Consider,
for example, the following analogous (but more momentous) situation.
Historically speaking, the first highlevel, mature, and expressive programming languages
to be developed were based on sequential computation. When those languages were forced
to deal with concurrency, parallelism, and distributed computing, they were augmented with,
say, thread packages and remote procedure calls. Earlier pioneers of computer programming
languages and systems ? e.g., Dijkstra, Hoare, Milner ? saw concurrency and communications
not as incremental improvements to existing imperative languages but as a new paradigm
deserving a separate study. The concurrency paradigm required a fresh and direct
examination and in this respect, we have seen a great number of concurrency frameworks appear:
e.g., Petri nets, CSP, CCS, IOautomata, and the ?calculus. Given the theoretical results
and understanding that have flowed from work on these and related calculi, it has been
possible to find ways for conventional programming languages to make accommodations
within the concurrency and distributed computing settings. Such understanding and
accommodations were not likely to flow from clever packages added to programming languages:
new programming principles from the theory of concurrency and distributed computing were
needed.
Before directly addressing some of the computational principles behind bindings in syntax,
it seems prudent to critically examine the conventional design of a wide range of proof
assistants. (The following section updates a similar argument found in [52].)
Dropping mathematics as an intermediate
Almost all ambitious theorem provers in use today follow the following two step approach to
reasoning about computation.
Step 1: Implement mathematics. This step is achieved by picking a general, well understood
formal system. Common choices are firstorder logic, set theory, higherorder logic
[16, 36], or some foundation for constructive mathematics, such as MartinL?f type theory
[18, 19, 45].
Step 2: Reduce reasoning about computation to mathematics. Computation is generally
encoded via some model theoretic semantics (such as denotational semantics) or as an
inductive definition over an operational semantics.
A key methodological element of this proposal is that we shall drop mathematics as an
intermediate and attempt to find more direct and intimate connections between computation,
reasoning, and logic. The main problem with having mathematics in the middle seems to be
that many aspects of computation are rather ?intensional? but a mathematical treatment
requires an extensional encoding. The notion of algorithm is an example of this kind of
distinction: there are many algorithms that can compute the same function (say, the function
that sorts lists). In a purely extensional treatment, it is functions that are represented
directly and algorithm descriptions that are secondary. If an intensional default can be
managed instead, then function values are secondary (usually captured via the specification
of evaluators or interpreters).
For a more explicit example, consider whether or not the formula ?wi. ?x.x 6= ?x.w
is a theorem. In a setting where ?abstractions denote functions (the usual extensional
treatment), we have not provided enough information to answer this question: in particular,
this formula is true if and only if the domain type i is not a singleton. If, however, we are
in a setting where ?abstractions denote syntactic expressions, then it is sensible for this
formula to be provable since no (capture avoiding) substitution of an expression of type i for
the w in ?x.w can yield ?x.x.
For a more significant example, consider the problem of formalizing the metatheory
of bisimulationupto [56, 72] for the ?calculus [57]. Such a metatheory can be used to
allow people working in concurrent systems to write hopefully small certificates (actual
bisimulationsupto) in order to guarantee that bisimulation holds (usually witnessed directly
by only infinite sets of pairs of processes). In order to employ the Coq theorem prover, for
example, to attack such metatheory, Coq would probably need to be extended with packages in
two directions. First, a package that provides flexible methods for doing coinduction following,
say, the KnasterTarski fixed point theorems, would be necessary. Indeed, such a package has
been implemented and used to prove various metatheorems surrounding bisimulationupto
(including the subtle metatheory surrounding weak bisimulation) [11, 70, 71]. Second, a
package for the treatment of bindings and names that are used to describe the operational
semantics of the ?calculus would need to be added. Such packages exist (for example, see
[6]) and, when combined with treatments of coinduction, may allow one to make progress on
the metatheory of the ?calculus. Recently, the Hybrid systems [27] has shown a different
way to incorporate both induction, coinduction, and binding into a Coq (and Isabelle)
implementation. Such an approach could be seen as one way to implement this metatheory
task on top of an established formalization of mathematics.
There is another approach that seeks to return to the most basic elements of logic by
reconsidering the notion of terms (allowing them to have binders as primitive features) and the
notion of logical inference rules so that coinduction can be seen as, say, the de Morgan (and
proof theoretic) dual to induction. In that approach, proof theory principles can be identified
in that enriched logic with least and greatest fixed points [7, 47, 58] and with a treatment of
bindings [81, 32]. Such a logic has been given a modelcheckingstyle implementation [9] and
is the basis of the Abella theorem prover [8, 31]. Using such implementations, the ?calculus
has been implemented, formalized, and analyzed in some detail [80, 79] including some of
the metatheory of bisimulationupto for the ?calculus [13].
I will now present some foundational principles in the treatment of bindings that are
important to accommodate directly, even if we cannot immediately see how those principles
might fit into existing mature programming languages and proof assistants.
4
How abstract is your syntax?
Two of the earliest formal treatments of the syntax of logical expressions were given by
G?del [35] and Church [16] and, in both of these cases, their formalization involved viewing
formulas as strings of characters. Clearly, such a view of logical expressions contains too much
information that is not semantically meaningful (e.g., white space, infix/prefix distinctions,
parenthesis) and does not contain explicitly semantically relevant information (e.g., the
functionargument relationship). For this reason, those working with syntactic expressions
generally parse such expressions into parse trees: such trees discard much that is meaningless
(e.g., the infix/prefix distinction) and records directly more meaningful information (e.g.,
the child relation denotes the functionargument relation). One form of ?concrete nonsense?
generally remains in parse trees since they traditionally contain the names of bound variables.
One way to get rid of bound variable names is to use de Bruijn?s nameless dummy
technique [21] in which (nonbinding) occurrences of variables are replaced by positive
integers that count the number of bindings above the variable occurrence through which
one must move in order to find the correct binding site for that variable. While such an
encoding makes the check for ?conversion easy, it can greatly complicate other operations
that one might want to do on syntax, such as substitution, matching, and unification. While
all such operations can be supported and implemented using the nameless dummy encoding
[21, 43, 61], the complex operations on indexes that are needed to support those operations
clearly suggests that they are best dealt within the implementation of a framework and not
in the framework itself.
The following four principles about the treatment of bindings in syntax will guide our
further discussions.
Principle 1: The names of bound variables should be treated in the same way we
treat white space: they are artifacts of how we write expressions and they have no
semantic content.
Of course, the name of variables are important for parsing and printing expressions (just as
is white space) but such names should not be part of the meaning of an expression. This first
principle simply repeats what we stated earlier. The second principle is a bit more concrete.
Principle 2: There is ?one binder to ring them all.?1
With this principle, we are adopting Church?s approach [16] to binding in logic, namely,
that one has only ?abstraction and all other bindings are encoded using that binder. For
example, the universally quantified expression (?x. B x) is actually broken into the expression
1 A scrambling of J. R. R. Tolkien?s ?One Ring to rule them all, ... and in the darkness bind them.?
(?(?x. B x)), where ? is treated as a constant of highertype. Note that this latter expression
is ?equivalent to (? B) and universal instantiation of that quantified expression is simply
the result of using ?normalization on the expression (B t). In this way, many details about
quantifiers can be reduced to details about ?terms.
Principle 3: There is no such thing as a free variable.
This principle is taken from Alan Perlis?s epigram 47 [63]. By accepting this principle, we
recognize that bindings are never dropped to reveal a free variable: instead, we will ask for
bindings to move. This possibility suggests the main novelty in this list of principles.
Principle 4: Bindings have mobility and the equality theory of expressions must
support such mobility [51, 53].
Since the other principles are most likely familiar to the reader, I will now describe this last
principle in more detail.
5
Mobility of bindings
Since typing rules are a common operation in metatheory, I illustrate the notion of binding
mobility in that setting. In order to specify untyped ?terms (to which one might attribute
a simple type via an inference), we introduce a (syntactic) type tm and two constants
abs : (tm ? tm) ? tm
and
app : tm ? tm ? tm.
Untyped ?terms are encoded as terms of type tm using the translation define as
dxe = x,
d?x.te = (abs (?x.dte)),
and
d(t s)e = (app dte dse).
The first clause here indicates that bound variables in untyped ?terms are mapped to
bound variables in the encoding. For example, the untyped ?term ?w.ww is encoded as
(abs ?w. app w w). This translation has the property that it maps bijectively ?equivalence
classes of untyped ?terms to ???equivalence classes of simply typed ?terms of type tm.
In order to satisfy Principle 3 above, we shall describe a Gentzenstyle sequent as a triple
? : ? ` B where B is the succedent (a formula), ? is the antecedent (a multiset of formulas),
and ? a signature, that is, a list of variables that are formally bound over the scope of the
sequent. Thus all free variables in the formulas in ? ? {B} are bound by ?. Gentzen referred
to the variables in ? as eigenvariables (although he did not consider them as binders over
sequents).
The following inference rule is a familiar rule.
? : ?, typeof x (int ? int) ` C
? : ?, ?? (typeof x (? ? ? )) ` C ?L
This rule states (when reading it from conclusions to premise) that if the symbol x can be
attributed the type ? ? ? for all instances of ? , then it can be assumed to have the type
int ? int. Thus, bindings can be instantiated (the ?? is removed by instantiation). On the
other hand, consider the following inferences.
?, x : ?, typeof dxe ? ` typeof dBe ?
? : ? ` ?x(typeof dxe ? ? typeof dBe ? 0) ?R
? : ? ` typeof d?x.Be (? ? ? 0)
These inferences illustrate how bindings can, instead, move during the construction of a
proof. In this case, the termlevel binding for x in the lower sequent can be seen as moving
to the formulalevel binding for x in the middle sequent and then to the prooflevel binding
(as an eigenvariable) for x in the upper sequent. Thus, a binding is not lost or converted to a
?free variable?: it simply moves.
The mobility of bindings needs to be supported by the equality theory of expressions.
Clearly, equality already includes ?conversion by Property 1. We also need a small amount
of ?conversion. If we rewrite this last inference rule using the definition of the d?e translation,
we have the inference figure.
?, x : ?, typeof x ? ` typeof (Bx) ? 0
? : ? ` ?x(typeof x ? ? typeof (Bx) ? 0) ?R
? : ? ` typeof (abs B) (? ? ? 0)
Note that here B is a variable of arrow type tm ? tm and that instances of these inference
figures will create an instance of (B x) that may be a ?redex. As I now argue, that ?redex
has a limited form. First, observe that B is a schema variable that is implicitly universally
quantified around this inference rule: if one formalizes this approach to type inference in,
say, ?Prolog, one would write a specification similar to the formula
?B?? ?? 0[?x(typeof x ? ? typeof (Bx) ? 0) ? typeof (abs B) (? ? ? 0)].
Second, any closed instance of (B x) that is a ?redex is such that the argument x is not
free in the instance of B: this is enforced by the nature of (quantificational) logic since the
scope of B is outside the scope of x. Thus, the only form of ?conversion that is needed to
support this notion of binding mobility is the socalled ?0conversion rule [50]: (?x.t)x = t
or equivalently (in the presence of ?conversion) (?y.t)x = t[x/y], provided that x is not free
in ?y.t.
Given that ?0conversion is such a simple operation, it is not surprising that higherorder
pattern unification, which simplifies higherorder unification to a setting only needing ?, ?0,
and ? conversion, is decidable and unitary [50]. For this reason, matching and unification
can be used to help account for the mobility of binding. Note also that there is an elegant
symmetry provided by binding and ?0reduction: if t is a term over the signature ? ? {x}
then ?x.t is a term over the signature ? and, conversely, if ?x.s is a term over the signature
? then the ?0reduction of ((?x.s) y) is a term over the signature ? ? {y}.
To illustrate how ?0conversion supports the mobility of binders, consider how one specifies
the following rewriting rule: given a conjunction of universally quantified formulas, rewrite it
to be the universal quantification of the conjunction of formulas. In this setting, we would
write something like:
(?(?x.A x)) ? (?(?x.B x)) 7? (?(?x.(A x ? B x))).
To rewrite an expression such as (??z(p z z)) ? (??z(q a z)) (where p, q, and a are constants)
we first need to use ?0expansion to get the expression
(??z((?w.(p w w))z)) ? (??z((?w.(q a w))z))
At this point, the pattern variables A and B in the rewriting rule can now be instantiated
by the closed terms ?w.(p w w) and ?w.(q a w), respectively, which yields the expression
(?(?x.((?w.(p w w)) x ? (?w.(q a w)) x))).
Finally, a ?0contraction yields the expected expression (?(?x.(p x x) ? (q a x))). Note that
at no time did a bound variable become unbound. Since pattern unification incorporates
?0conversion, such rewriting can be accommodated simply by calls to such unification.
The analysis of these four principles above do not imply that full ?conversion is needed
to support them. Clearly, full ?conversion will implement ?0conversion and several systems
(which we shall speak about more below) that support ?tree syntax do, in fact, implement
?conversion. Systems that only implement ?0conversion have only been described in print.
For example, the L? logic programming language of [50] was restricted so that proof search
could be complete while only needing to do ?0conversion. The ?I calculus (the ?calculus
with internal mobility [74]) can also be seen as a setting where only ?0conversion is needed
[53].
6
Logic programming provides a framework
As the discussion above suggests, quantificational logic using the proofsearch model of
computation can capture all four principles listed in the previous section. While it might be
possible to account for these principles also in, say, a functional programming language (a
halfhearted attempt at such a design was made in [49]), the logic programming paradigm
supplies an appropriate framework for satisfying all these properties. Such a framework is
available using the higherorder hereditary Harrop [54] subset of an intuitionistic variant of
Church?s Simple Theory of Types [16]: ?Prolog [53] is a logic programming language based
on that logic and implemented by the Teyjus compiler [73] and the ELPI interpreter [24].
The use of logic programming principles in proof assistants pushes against usual practice:
since the first LCF prover [37], many (most?) proof assistants have had intimate ties to
functional programming. For example, such theorem provers are often implemented using
functional programming languages: in fact, the notion of LCF tactics and tacticals was
originally designed and illustrated using functional programming principles [37]. Also, such
provers frequently view proofs constructively and can output the computational content of
proofs as functional programs [
10
].
I argue here that a framework based on logic programming principles might be more
appropriate for mechanizing metatheory than one based on functional programming principles.
Note that the arguments below do not lead to the conclusion that firstorder logic programming
languages, such as Prolog, are appropriate for metalevel reasoning: direct support for
?abstractions and quantifiers (as well as hypothetical reasoning) are critical and are not
supported in firstorder logic programming languages. Also, I shall focus on the specification
of mechanized metatheory tasks and not on their implementation: it is completely possible
that logic programming principles are used in specifications while a functional programming
language is used to implement that specification language (for example, Teyjus and Abella
are both implemented in OCaml).
6.1
Expressions versus values
In logic programming, (closed) terms denote themselves and only themselves (in the sense
of free algebra). It often surprises people that in Prolog, the goal ? 3 = 1 + 2 fails, but
the expression that is the numeral 3 and the expression 1 + 2 are, of course, different
expressions. The fact that they have the same value is a secondary calculation (performed
in Prolog using the is predicate). Functional programming, however, fundamentally links
expressions and values: the value of an expression is the result of applying some evaluation
strategy (e.g., callbyvalue) to an expression. Thus the value of both 3 and 1 + 2 is 3 and
these two expressions are, in fact, equated. Of course, one can easily write datatypes in
functional programming languages that denote only expressions: datatypes for parse trees are
such an example. However, the global notion that expressions denote values is particularly
problematic when expressions denote ?abstractions. The value of such expressions in
functional programming is trivial and immediate: such values simply denote a function (a
closure). In the logic programming setting, however, an expression that is a ?abstraction is
just another expression: following the principles stated in Section 4, equality of two such
expressions needs to be based on the rather simple set of conversion rules ?, ?0, and ?. The
?abstractionasexpression aspect of logic programming is one of that paradigm?s major
advantages for the mechanization of metatheory.
6.2
Syntactic types
Given the central role of expressions (and not values), types in logic programming are better
thought of as denoting syntactic categories. That is, such syntactic types are useful for
distinguishing, say, encodings of types from terms from formula from proofs or program
expressions from commands from evaluation contexts. For example, the typeof specification
in Section 5 is a binary relation between the syntactic categories tm (for untyped ?terms)
and, say, ty (for simple type expression). The logical specification of the typeof predicate
might attribute integer type or list type to different expressions via clauses such as
?T : tm ?L : tm ?? : ty [typeof T ? ? typeof L (list ? ) ? typeof (T :: L) (list ? )].
Given our discussion above, it seems natural to propose that if ? and ? 0 are both syntactic
categories, then ? ? ? 0 is a new syntactic category that describes objects of category ? 0 with
a variable of category ? abstracted. For example, if o denotes the category of formulas (a
la [16]) and tm denotes the category of terms, then tm ? o denotes the type of termlevel
abstractions over formulas. As we have been taught by Church, the quantifiers ? and ? can
then be seen as constructors that take expressions of syntactic category tm ? o to formulas:
that is, these quantifiers are given the syntactic category (tm ? o) ? o.
6.3
Substitution lemmas for free
Consider an attempt to prove the sequent
? : ? ` typeof (abs R) (? ? ? 0)
where the assumptions (the theory) contains only one rule for proving such a statement, such
as the clause used in the discussion of Section 5. Since the introduction rules for ? and ?
are invertible, the sequent above is provable if and only if the sequent
?, x : ?, typeof x ? ` typeof (R x) ? 0
is provable. Given that we are committed to using a proper logic (such as higherorder
intuitionistic logic), it is the case that modus ponens is valid and that instantiating an
eigenvariable in a provable sequent yields a provable sequent. In this case, the sequent
? : ?, typeof N ? ` typeof (R N ) ? 0
must be provable (for N a term of syntactic type tm all of whose free variables are in ?).
Thus, we have just shown, using nothing more than rather minimal assumptions about the
specification of typeof (and formal properties of logic) that if ? : ? ` typeof (abs B) (? ? ? 0)
and ? : ? ` typeof N ? then ? : ? ` typeof (B N ) ? 0. (Of course, instances of the term
(B N ) are ?redexes and the reduction of such redexes result in the substitution of N into
the bound variable of the term that instantiates B.) Such lemmas about substitutions
are common and often difficult to prove [85]: in this setting, this lemma is essentially an
immediate consequent of using logic and logic programming principles [8, 46]. In this way,
Gentzen?s cutelimination theorem (the formal justification of modus ponens) can be seen as
the mother of all substitution lemmas. The Abella theorem prover?s implementation of the
twolevel logic approach to reasoning about computation [33, 48] makes it possible to employ
the cutelimination theorem in exactly the style illustrated above.
6.4
Dominance of relational specifications
Another reason that logic programming can make a good choice for metatheoretic reasoning
systems is that logic programming is based on relations (not functions) and that metatheoretic
specifications are often dominated by relations. For example, the typing judgment describe
in the Section 5 is a relation. Similarly, both small step (SOS) and big step (natural
semantics) approaches to operational semantics describe evaluation, for example, as a
relation. Occasionally, specified relations ? typing or evaluation ? describe a partial function
but that is generally a result proved about the relation.
A few logic programmingbased systems have been used to illustrate how typing and
operational semantic specifications can be animated. The core engine of the Centaur project,
called Typol, used Prolog to animate metatheoretic specifications [17] and ?Prolog has been
used to provide convincing and elegant specifications of typing and operational semantics for
expressions involving bindings [2, 53].
6.5
Dependent typing
The typing that has been motivated above is rather simple: one takes the notions of syntactic
types as syntactic category ? e.g., programs, formulas, types, terms, etc ? and adds the arrow
type constructor to denote abstractions of one syntactic type over another one. Since typing
is, of course, an openended concept, it is completely possible to consider any number of
ways to refine types. For example, instead of saying that a given expression denotes a term
(that is, the expression has the syntactic type for terms), one could instead say that such
an expression denotes, for example, a function from integers to integers. For example, the
typing judgment t : tm (?t denotes a term?) can be refined to t : tm (int ? int) (?t denotes a
term of type int ? int). Such richer types are supported (and generalized) by the dependent
type paradigm [20, 38] and given a logic programming implementation in, for example, Twelf
[64, 66].
Most dependently typed ?calculi come with a fixed notion of typing and with a fixed
notion of proof (natural deduction proofs encoded as typed ?terms). The reliance described
here on logical connectives and relations is expressive enough to specify dependently typed
frameworks [26, 77, 78] but it is not committed to only that notion of typing and proof.
7
?tree syntax
The term higherorder abstract syntax (HOAS) was originally defined as an approach to
syntax that used ?a simply typed ?calculus enriched with products and polymorphism? [65].
A subsequent paper identified HOAS as a technique ?whereby variables of an object language
are mapped to variables in the metalanguage? [66]. The term HOAS is problematic for a
number of reasons. First, it seems that few, if any, researchers use this term in a setting that
includes products and polymorphism (although simple and dependently typed ?calculus
are often used). Second, since the metalanguage (often the programming language) can
vary a great deal, the resulting notion of HOAS can vary similarly, including the case where
HOAS is a representation of syntax that incorporates function spaces on expressions [22, 39].
Third, the adjective higherorder seems inappropriate here: in particular, the equality (and
unification) of terms discussed in Section 5 is completely valid without reference to typing.
If there are no types, what exactly is ?higherorder?? For these reasons, the term ??tree
syntax? [8, 53], with its obvious parallel to the term ?parse tree syntax,? has been introduced
as a more appropriate term for the approach to syntactic representation described here.
While ?tree syntax can be seen as a kind of HOAS (using the broad definition of
HOAS given in [66]), there is little connections between ?tree syntax and the problematic
aspects of HOAS that arise when the latter uses function spaces to encode abstractions.
For example, there are frequent claims that structural induction and structural recursive
definitions are either difficult, impossible, or semantically problematic for HOAS: see, for
example, [29, 39, 40]. When we consider specifically ?tree syntax, however, induction (and
coinduction) and structural recursion in the ?tree setting have been given proof theoretic
treatments and implementations.
8
Reasoning with ?tree syntax
Proof search (logic programming) style implementations of specifications can provide simple
forms of metatheory reasoning. For example, given the specification of typing, both type
checking and type inference are possible to automate using unification and backtracking
search. Similarly, a specification of, say, big step evaluation can be used to provide a symbolic
evaluator for at least simple expressions [17].
There is, however, much more to mechanizing metatheory than performing unification
and doing logic programmingstyle search. One must also deal with negations (difficult for
straightforward logic programming engines): for example, one wants to prove that certain
terms do not have simple types: for example,
` ? ?? : ty. typeof (abs ?x (app x x)) ?.
Proving that a certain relation actually describes a (partial or total) function has proved to
be an important kind of metatheorem to prove: the Twelf system [66] is able to automatically
prove many of the simpler forms of such metatheorems. Additionally, one should also deal
with induction and coinduction and be able to reason directly about, say, bisimulation of
?calculus expressions as well as confluence of ?conversion.
In recent years, several researchers have developed two extensions to logic and proof
theory that have made it possible to reason in rich and natural ways about expressions
containing bindings. One of these extensions involved a proof theory for least and greatest
fixed points: results from [47, 82] have made it possible to build automated and interactive
inductive and coinductive theorem provers in a simple, relational setting. Another extension
[32, 55] introduced the ?quantifier which allows logic to reason in a rich and natural way
with bindings: in terms of mobility of bindings, the ?quantifier provides an additional
formulalevel and prooflevel binder, thereby enriching the expressiveness of quantificational
logic.
Given these developments in proof theory, it has been possible to build both an interactive
theorem prover, called Abella [8, 30], and an automatic theorem prover, called Bedwyr [9],
that unfolds fixed points in a style similar to a model checker. These systems have successfully
been able to prove a range of metatheoretic properties about the ?calculus and the ?calculus
[
1, 8, 81
]. The directness and naturalness of the encoding for the ?calculus bisimulation is
evident in the fact that simply adding the excluded middle on name equality changes the
interpretation of that one definition from open bisimulation to late bisimulation [81].
Besides the Abella, Bedwyr, and Twelf system mentioned above, there are a number of
other implemented systems that support some or all aspects of ?tree syntax: these include
Beluga [67], Hybrid [27], Isabelle [62], Minlog [75], and Teyjus [60]. See [28] for a survey and
comparison of several of these systems.
The shift from conventional proof assistants based on functional programming principles
to assistants based on logic programming principles does disrupt a number of aspects of
proof assistants. For example, when computations are naturally considered as functional,
it seems that there is a lost of expressiveness and effectiveness if one must write those
specifications using relations. Recent work shows, however, that when a relation actually
encodes a function, it is possible to use the proof search framework to actually compute
that function [34]. A popular feature of many proof assistants is the use of tactics and
tacticals, which have been implemented using functional programs since their introduction
[37]. There are good arguments, however, that those operators can be given elegant and
natural implementations using (higherorder) logic programs [23, 25, 53]. The disruptions
that result from such a shift seem well worth exploring.
9
Conclusions
I have argued that parsing concrete syntax into parse trees does not yield a sufficiently
abstract representation of expressions: the treatment of bindings should be made more
abstract. I have also described and motivated the ?tree syntax approach to such a more
abstract framework. For a programming language or proof assistant to support this level
of abstraction in syntax, equality of syntax must be based on ? and ?0 (at least) and must
allow for the mobility of binders from within terms to within formulas (i.e., quantifiers) to
within proofs (i.e., eigenvariables). I have also argued that the logic programming paradigm
? broadly interpreted ? provides an elegant and highlevel framework for specifying both
computation and deduction involving syntax containing bindings. This framework is offered
up as an alternative to the more conventional approaches to mechanizing metatheory using
formalizations based on more conventional mathematical concepts. While the POPLmark
challenge was based on the assumption that increments to existing provers will solve the
problems surrounding the mechanization of metatheory, I have argued and illustrated here
that we need to make a significant shift in the underlying paradigm that has been built into
today?s most mature proof assistants.
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Brian Aydemir, Aaron Bohannon, and Stephanie Weirich. Nominal reasoning techniques in
Coq. In International Workshop on Logical Frameworks and MetaLanguages:Theory and
Practice (LFMTP), pages 69?77, Seattle, WA, USA, 2006.
Brian Aydemir, Stephan A. Zdancewic, and Stephanie Weirich. Abstracting syntax.
Technical Report MSCIS0906, University of Pennsylvania, 2009.
Brian E. Aydemir, Aaron Bohannon, Matthew Fairbairn, J. Nathan Foster, Benjamin C.
Pierce, Peter Sewell, Dimitrios Vytiniotis, Geoffrey Washburn, Stephanie Weirich, and
Steve Zdancewic. Mechanized metatheory for the masses: The POPLmark challenge. In
Theorem Proving in Higher Order Logics: 18th International Conference, number 3603 in
Lecture Notes in Computer Science, pages 50?65. Springer, 2005.
Brian E. Aydemir, Aaron Bohannon, and Stephanie Weirich. Nominal reasoning techniques
in Coq: (extended abstract). Electr. Notes Theor. Comput. Sci, 174(5):69?77, 2007. doi:
10.1016/j.entcs.2007.01.028.
David Baelde. Least and greatest fixed points in linear logic. ACM Trans. on Computational
Logic, 13(1), 2012. doi:10.1145/2071368.2071370.
David Baelde, Kaustuv Chaudhuri, Andrew Gacek, Dale Miller, Gopalan Nadathur, Alwen
Tiu, and Yuting Wang. Abella: A system for reasoning about relational specifications.
Journal of Formalized Reasoning, 7(2), 2014. doi:10.6092/issn.19725787/4650.
David Baelde, Andrew Gacek, Dale Miller, Gopalan Nadathur, and Alwen Tiu. The Bedwyr
system for model checking over syntactic expressions. In F. Pfenning, editor, 21th Conf.
on Automated Deduction (CADE), number 4603 in Lecture Notes in Artificial Intelligence,
pages 391?397, New York, 2007. Springer. doi:10.1007/9783540735953_28.
Ulrich Berger, Stefan Berghofer, Pierre Letouzey, and Helmut Schwichtenberg. Program
extraction from normalization proofs. Studia Logica, 82(1):25?49, 2006. doi:10.1007/
s1122500666045.
Filippo Bonchi and Damien Pous. Checking NFA equivalence with bisimulations up to
congruence. In ACM SIGPLANSIGACT Symposium on Principles of Programming
Languages (POPL), pages 457?468. ACM, 2013.
Arthur Chargu?raud. The locally nameless representation. Journal of Automated Reasoning,
pages 1?46, 2011. doi:10.1007/s1081701192252.
Kaustuv Chaudhuri, Matteo Cimini, and Dale Miller. A lightweight formalization of the
metatheory of bisimulationupto. In Xavier Leroy and Alwen Tiu, editors, Proceedings
of the 4th ACMSIGPLAN Conference on Certified Programs and Proofs, pages 157?166,
Mumbai, India, 2015. ACM. doi:10.1145/2676724.2693170.
James Cheney and Christian Urban. Nominal logic programming. ACM Trans. Program.
Lang. Syst., 30(5):1?47, 2008. doi:10.1145/1387673.1387675.
Adam Chlipala. Parametric higherorder abstract syntax for mechanized semantics. In
James Hook and Peter Thiemann, editors, Proceeding of the 13th ACM SIGPLAN
international conference on Functional programming, ICFP 2008, Victoria, BC, Canada,
September 2028, 2008, pages 143?156. ACM, 2008. doi:10.1145/1411204.1411226.
Alonzo Church. A formulation of the Simple Theory of Types. J. of Symbolic Logic, 5:56?68,
1940. doi:10.2307/2266170.
Dominique Cl?ment, Jo?lle Despeyroux, Thierry Despeyroux, Laurent Hasco?t, and Gilles
Kahn. Natural semantics on the computer. Research Report 416, INRIA, Rocquencourt,
France, 1985.
Robert L. Constable et al. Implementing Mathematics with the Nuprl Proof Development
System. PrenticeHall, 1986.
Thierry Coquand and G?rard Huet. The calculus of constructions. Information and
Computation, 76(2/3):95?120, / 1988.
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
Ulysse G?rard and Dale Miller. Separating functional computation from relations. In
Valentin Goranko and Mads Dam, editors, 26th EACSL Annual Conference on Computer
Science Logic (CSL 2017), volume 82 of LIPIcs, pages 23:1?23:17, 2017. doi:10.4230/
LIPIcs.CSL.2017.23.
Kurt G?del. ?ber formal unentscheidbare S?tze der Principia Mathematica und verwandter
Systeme I. Monatshefte der Mathematischen Physik, 38:173?198, 1931. English Version
in [84].
M. J. C. Gordon and T. F. Melham. Introduction to HOL ? A theorem proving environment
for higher order logic. Cambridge University Press, 1993.
Michael J. Gordon, Arthur J. Milner, and Christopher P. Wadsworth. Edinburgh LCF:
A Mechanised Logic of Computation, volume 78 of Lecture Notes in Computer Science.
Springer, 1979.
Robert Harper, Furio Honsell, and Gordon Plotkin. A framework for defining logics. Journal
of the ACM, 40(1):143?184, 1993.
Martin Hofmann. Semantical analysis of higherorder abstract syntax. In 14th Symp. on
Logic in Computer Science, pages 204?213. IEEE Computer Society Press, 1999.
Furio Honsell, Marino Miculan, and Ivan Scagnetto. ?calculus in (co)inductive type
theories. Theoretical Computer Science, 2(253):239?285, 2001.
Gerwin Klein, Kevin Elphinstone, Gernot Heiser, June Andronick, David Cock, Philip
Derrin, Dhammika Elkaduwe, Kai Engelhardt, Rafal Kolanski, Michael Norrish, Thomas
Sewell, Harvey Tuch, and Simon Winwood. seL4: Formal verification of an OS kernel.
In Proceedings of the 22nd Symposium on Operating Systems Principles (22nd SOSP?09),
Operating Systems Review (OSR), pages 207?220, Big Sky, MT, 2009. ACM SIGOPS.
Xavier Leroy. Formal verification of a realistic compiler. Commun. ACM, 52(7):107?115,
2009. doi:10.1145/1538788.1538814.
Chuck Liang, Gopalan Nadathur, and Xiaochu Qi. Choices in representing and reduction
strategies for lambda terms in intensional contexts. Journal of Automated Reasoning, 33:89?
132, 2005.
Donald MacKenzie. Mechanizing Proof. MIT Press, 2001.
Per MartinL?f. Intuitionistic Type Theory. Studies in Proof Theory Lecture Notes.
Bibliopolis, Napoli, 1984.
Raymond McDowell and Dale Miller. A logic for reasoning with higherorder abstract
syntax. In Glynn Winskel, editor, 12th Symp. on Logic in Computer Science, pages 434?
445, Warsaw, Poland, 1997. IEEE Computer Society Press.
Raymond McDowell and Dale Miller. Cutelimination for a logic with definitions and
induction. Theoretical Computer Science, 232:91?119, 2000. doi:10.1016/S03043975(99)
001711.
Raymond McDowell and Dale Miller. Reasoning with higherorder abstract syntax in a
logical framework. ACM Trans. on Computational Logic, 3(1):80?136, 2002.
Dale Miller. An extension to ML to handle bound variables in data structures: Preliminary
report. In Proceedings of the Logical Frameworks BRA Workshop, pages 323?335, Antibes,
France, jun 1990. Available as UPenn CIS technical report MSCIS9059. URL: http:
//www.lix.polytechnique.fr/Labo/Dale.Miller/papers/mll.pdf.
Dale Miller. A logic programming language with lambdaabstraction, function variables,
and simple unification. J. of Logic and Computation, 1(4):497?536, 1991.
Dale Miller. Bindings, mobility of bindings, and the ?quantifier. In Jerzy Marcinkowski
and Andrzej Tarlecki, editors, 18th International Conference on Computer Science Logic
(CSL) 2004, volume 3210 of Lecture Notes in Computer Science, page 24, 2004.
1 2 Beniamino Accattoli . Proof pearl: Abella formalization of lambda calculus cube property .
In Chris Hawblitzel and Dale Miller , editors, Second International Conference on Certified Programs and Proofs , volume 7679 of Lecture Notes in Computer Science, pages 173  187 .
Springer , 2012 .
Andrew W. Appel and Amy P. Felty . Polymorphic lemmas and definitions in ?Prolog and Twelf . Theory and Practice of Logic Programming , 4 ( 1 2): 1  39 , 2004 . doi: 10 .1017/ S1471068403001698.
N. G. de Bruijn . A survey of the project AUTOMATH . In J. P. Seldin and R. Hindley, editors, To H. B. Curry: Essays in Combinatory Logic, Lambda Calculus, and Formalism, pages 589  606 . Academic Press, New York, 1980 .
Indagationes Mathematicae , 34 ( 5 ): 381  392 , 1972 .
Jo?lle Despeyroux , Amy Felty, and Andre Hirschowitz . Higherorder abstract syntax in Coq . In Second International Conference on Typed Lambda Calculi and Applications , pages 124  138 , apr 1995 .
Cvetan Dunchev , Claudio Sacerdoti Coen, and Enrico Tassi . Implementing HOL in an higher order logic programming language . In Gilles Dowek, Daniel R. Licata, and Sandra Alves, editors, Proceedings of the Eleventh Workshop on Logical Frameworks and MetaLanguages: Theory and Practice , LFMTP 2016 , Porto, Portugal, June 23, 2016 , pages 4 : 1  4 : 10 . ACM, 2016 . doi: 10 .1145/2966268.2966272.
Cvetan Dunchev , Ferruccio Guidi, Claudio Sacerdoti Coen, and Enrico Tassi . ELPI: fast, embeddable, ?Prolog interpreter . In Martin Davis, Ansgar Fehnker, Annabelle McIver , and Andrei Voronkov, editors, Logic for Programming , Artificial Intelligence, and Reasoning  20th International Conference , LPAR20 2015 , Suva, Fiji, November 2428 , 2015 , Proceedings, volume 9450 of Lecture Notes in Computer Science, pages 460  468 . Springer, 2015 .
doi:10 .1007/9783 662 488997_ 32 .
Amy Felty and Dale Miller . Specifying theorem provers in a higherorder logic programming language . In Ninth International Conference on Automated Deduction, number 310 in Lecture Notes in Computer Science , pages 61  80 , Argonne, IL, may 1988 . Springer.
Amy Felty and Dale Miller . Encoding a dependenttype ?calculus in a logic programming language . In Mark Stickel, editor, Proceedings of the 1990 Conference on Automated Deduction, volume 449 of Lecture Notes in Artificial Intelligence , pages 221  235 . Springer, 1990 .
Amy Felty and Alberto Momigliano . Hybrid: A definitional twolevel approach to reasoning with higherorder abstract syntax . J. of Automated Reasoning , 48 : 43  105 , 2012 .
Amy P. Felty , Alberto Momigliano, and Brigitte Pientka . The next 700 challenge problems for reasoning with higherorder abstract syntax representations: Part 2A survey . J. of Automated Reasoning , 55 ( 4 ): 307  372 , 2015 .
M. J. Gabbay and A. M. Pitts . A new approach to abstract syntax involving binders . In 14th Symp. on Logic in Computer Science , pages 214  224 . IEEE Computer Society Press, 1999 .
Andrew Gacek . The Abella interactive theorem prover (system description) . In A. Armando, P. Baumgartner , and G. Dowek, editors, Fourth International Joint Conference on Automated Reasoning , volume 5195 of Lecture Notes in Computer Science, pages 154  161 .
Springer , 2008 . URL: http://arxiv.org/abs/0803.2305.
Andrew Gacek , Dale Miller , and Gopalan Nadathur . Reasoning in Abella about structural operational semantics specifications . In A. Abel and C. Urban, editors, International Workshop on Logical Frameworks and MetaLanguages: Theory and Practice (LFMTP 2008 ), number 228 in Electronic Notes in Theoretical Computer Science, pages 85  100 , 2008 .
doi:10 .1016/j.entcs. 2008 . 12 .118.
Andrew Gacek , Dale Miller , and Gopalan Nadathur . Nominal abstraction. Information and Computation , 209 ( 1 ): 48  73 , 2011 . doi: 10 .1016/j.ic. 2010 . 09 .004.
Andrew Gacek , Dale Miller , and Gopalan Nadathur . A twolevel logic approach to reasoning about computations . J. of Automated Reasoning , 49 ( 2 ): 241  273 , 2012 . doi: 10 .1007/ s1081701192181.
Dale Miller . Finding unity in computational logic . In Proceedings of the 2010 ACMBCS Visions of Computer Science Conference, ACMBCS '10 , pages 3 : 1  3 : 13 . British Computer Society, apr 2010 . URL: http://www.lix.polytechnique.fr/Labo/Dale.Miller/ papers/unity2010.pdf.
Dale Miller and Gopalan Nadathur . Programming with HigherOrder Logic . Cambridge University Press, jun 2012 . doi: 10 .1017/CBO9781139021326.
Dale Miller , Gopalan Nadathur, Frank Pfenning, and Andre Scedrov . Uniform proofs as a foundation for logic programming . Annals of Pure and Applied Logic , 51 : 125  157 , 1991 .
Dale Miller and Alwen Tiu . A proof theory for generic judgments . ACM Trans. on Computational Logic , 6 ( 4 ): 749  783 , oct 2005 . doi: 10 .1145/1094622.1094628.
Robin Milner . Communication and Concurrency. PrenticeHall International, 1989 .
Robin Milner . Communicating and Mobile Systems: The ?Calculus . Cambridge University Press, New York, NY, USA, 1999 .
Alberto Momigliano and Alwen Tiu . Induction and coinduction in sequent calculus . In Mario Coppo, Stefano Berardi, and Ferruccio Damiani, editors, Postproceedings of TYPES 2003, number 3085 in Lecture Notes in Computer Science , pages 293  308 , jan 2003 .
J. Strother Moore . A mechanically verified language implementation . J. of Automated Reasoning , 5 ( 4 ): 461  492 , 1989 .
Gopalan Nadathur and Dustin J. Mitchell . System description: Teyjus  A compiler and abstract machine based implementation of ?Prolog . In H. Ganzinger, editor, 16th Conf.
on Automated Deduction (CADE) , number 1632 in Lecture Notes in Artificial Intelligence , pages 287  291 , Trento, 1999 . Springer.
Gopalan Nadathur and Debra Sue Wilson. A notation for lambda terms: A generalization of environments . Theoretical Computer Science , 198 ( 12 ): 49  98 , 1998 .
Lawrence C. Paulson . A generic tableau prover and its integration with isabelle . J. UCS , 5 ( 3 ): 73  87 , 1999 . URL: http://www.jucs.org/jucs_5_3/a_generic_tableau_prover.
Alan J. Perlis. Epigrams on programming . ACM SIGPLAN Notices , pages 7  13 , 1982 .
doi:10.1145/947955 .1083808.
Frank Pfenning . Logic programming in the LF logical framework . In G?rard Huet and Gordon D. Plotkin, editors, Logical Frameworks , pages 149  181 . Cambridge University Press, 1991 .
Frank Pfenning and Conal Elliott . Higherorder abstract syntax . In Proceedings of the ACMSIGPLAN Conference on Programming Language Design and Implementation , pages 199  208 . ACM Press, jun 1988 .
Frank Pfenning and Carsten Sch?rmann . System description: Twelf  A metalogical framework for deductive systems . In H. Ganzinger, editor, 16th Conf. on Automated Deduction (CADE) , number 1632 in Lecture Notes in Artificial Intelligence , pages 202  206 , Trento, 1999 . Springer. doi: 10 .1007/3540486607\_ 14 .
Brigitte Pientka and Joshua Dunfield . Beluga: A framework for programming and reasoning with deductive systems (system description) . In J. Giesl and R . H?hnle, editors, Fifth International Joint Conference on Automated Reasoning, number 6173 in Lecture Notes in Computer Science , pages 15  21 , 2010 .
The POPLmark Challenge webpage . http://www.seas.upenn.edu/~plclub/poplmark/, 2015 .
Fran?ois Pottier . An overview of C?ml . In ACM Workshop on ML, Electronic Notes in Theoretical Computer Science , pages 27  51 , sep 2005 .
Damien Pous . Weak bisimulation upto elaboration . In C. Baier and H. Hermanns, editors, CONCUR , volume 4137 of Lecture Notes in Computer Science, pages 390  405 . Springer, 2006 .
Damien Pous . Complete lattices and upto techniques . In Zhong Shao, editor, APLAS , volume 4807 of Lecture Notes in Computer Science, pages 351  366 , Singapore, 2007 .
Damien Pous and Davide Sangiorgi . Enhancements of the bisimulation proof method . In Davide Sangiorgi and Jan Rutten , editors, Advanced Topics in Bisimulation and Coinduction , pages 233  289 . Cambridge University Press, 2011 . doi: 10 .1017/CBO9780511792588.
Xiaochu Qi , Andrew Gacek, Steven Holte, Gopalan Nadathur, and Zach Snow . The Teyjus system  version 2 , 2015 . URL: http://teyjus.cs.umn.edu/.
Davide Sangiorgi . ?calculus, internal mobility and agentpassing calculi . Theoretical Computer Science , 167 ( 2 ): 235  274 , 1996 .
Helmut Schwichtenberg . Minlog. In Freek Wiedijk, editor, The Seventeen Provers of the World, volume 3600 of Lecture Notes in Computer Science , pages 151  157 . Springer, 2006 .
doi:10 .1007/11542384\_ 19 .
Peter Sewell , Francesco Zappa Nardelli, Scott Owens, Gilles Peskine, Thomas Ridge, Susmit Sarkar, and Rok Strni?a . Ott: Effective tool support for the working semanticist . Journal of Functional Programming , 20 ( 01 ): 71  122 , 2010 .
Zachary Snow , David Baelde, and Gopalan Nadathur . A metaprogramming approach to realizing dependently typed logic programming . In Temur Kutsia , Wolfgang Schreiner, and Maribel Fern?ndez, editors, ACM SIGPLAN Conference on Principles and Practice of Declarative Programming (PPDP) , pages 187  198 , 2010 .
Mary Southern and Kaustuv Chaudhuri . A twolevel logic approach to reasoning about typed specification languages . In Venkatesh Raman and S. P . Suresh, editors, 34th International Conference on Foundations of Software Technology and Theoretical Computer Science (FSTTCS) , volume 29 of Leibniz International Proceedings in Informatics (LIPIcs) , pages 557  569 , New Delhi, India, 2014 . Schloss DagstuhlLeibnizZentrum f?r Informatik .
doi:10 .4230/LIPIcs.FSTTCS. 2014 . 557 .
Alwen Tiu . Model checking for ?calculus using proof search . In Mart?n Abadi and Luca de Alfaro, editors, Proceedings of CONCUR'05 , volume 3653 of Lecture Notes in Computer Science, pages 36  50 . Springer, 2005 .
Alwen Tiu and Dale Miller . A proof search specification of the ?calculus . In 3rd Workshop on the Foundations of Global Ubiquitous Computing , volume 138 of ENTCS , pages 79  101 , 2005 . doi: 10 .1016/j.entcs. 2005 . 05 .006.
Alwen Tiu and Dale Miller . Proof search specifications of bisimulation and modal logics for the ?calculus . ACM Trans. on Computational Logic , 11 ( 2 ), 2010 . doi: 10 .1145/1656242.
Alwen Tiu and Alberto Momigliano . Cut elimination for a logic with induction and coinduction . Journal of Applied Logic , 10 ( 4 ): 330  367 , 2012 . doi: 10 .1016/j.jal. 2012 . 07 .
Christian Urban . Nominal reasoning techniques in Isabelle/HOL. Journal of Automated Reasoning , 40 ( 4 ): 327  356 , 2008 .
Jean van Heijenoort . From Frege to G?del: A Source Book in Mathematics, 1879 1931 .
Source books in the history of the sciences series . Harvard Univ. Press, Cambridge, MA, 3rd printing, 1997 edition, 1967 .
Myra VanInwegen. The MachineAssisted Proof of Programming Language Properties . PhD thesis , University of Pennsylvania, may 1996 .