On Definitions of Constants and Types in HOL

This paper reports on a simpler and more powerful replacement for the principles for defining new constants that were previously provided in the various HOL implementations. We discuss the problems that the new principle is intended to solve and sketch the proofs that it is conservative and that it subsumes the earlier definitional principles. The new definitional principle for constants has been implemented in HOL4 and in ProofPower and has been adopted in OpenTheory and in the work of Kumar, Myreen and Owens on a fully verified implementation of HOL. Kumar et al. have formally verified that the new definitional principle is conservative with respect to the standard set theoretic semantics of HOL. We continue this line of thought with a look at the mechanisms for defining new types and consider potential improvements, one of which has now been adopted in OpenTheory.


Introduction
Pitching specifications at an appropriate degree of precision and generality is an important aspect of systems engineering. In mathematics, it is vital to choose an appropriate set of abstract concepts on which to found a theory. Nonetheless, in the automated reasoning community we often seem to underplay the importance of clear, abstract definitions, with many developments being founded on rather crude axiomatisations. The widely used HOL logic contains some features intended to support abstract specifications. This paper discusses these features and some potential improvements to them. The design of the HOL logic and of its definitional principles [2] evolved in the late 80s and early 90s. Some form of this design has been implemented in HOL4 [16,17], HOL Light [8], HOL Zero [1], Isabelle/HOL [15], OpenTheory [11] and ProofPower [4]. While the definitional principles have stood the test of time in many practical applications, we believe there is still some room for improvement. We will discuss issues with the mechanisms for introducing new constants and types and consider new and more general mechanisms to address these issues.
The discussion of constant definitions in this paper is based on work originally presented at ITP2014 [3]. The discussion of type definitions is new for this special issue of the Journal of Automated Reasoning.

Definitional Principles in Logic
We begin by defining some terminology for use in discussing definitional principles in logic. This is largely technical and the reader may wish to skip it on a first reading referring back to it as necessary when later on we talk about consistency or conservativeness.
To discuss the notion of a definitional principle, we assume given a language equipped with an inference system or a semantics. We assume the language is parametrised by a signature defining a set of primitive constructs. In the sequel, we will solely be concerned with the HOL language and inference system as defined in [8]. Signatures will be as in [2] and comprise sets of type constructor names and associated arities and sets of constant names and associated types. The inference system of [8] can be shown to be equivalent to the somewhat different system used in HOL4 and ProofPower as defined in [2]. The judgments of the inference system are sequents t 1 , . . . , t n t, where t and the t i are terms of type bool.
A definitional principle is a generalised inference rule that includes a signature extension. An instance of such a principle has antecedents comprising a (possibly empty) list of judgments of some prescribed form over some signature Σ and has succedents comprising a list of judgments over some extended signature Σ . Intuitively, the succedents are axioms that specify the intended meaning of the new primitive constructs introduced in Σ , while the antecedents provide evidence that these axioms are consistent (or, even better, conservative, as discussed below). We define a context Γ = (Σ, A) to be a pair comprising a signature and a set of axioms. Definitional principles are applied sequentially to obtain new contexts from old ones starting from some initial context Γ 0 . It is only valid to apply a definitional principle to a context Γ = (Σ, A) if its antecedents are in the language over Σ and are derivable from the axioms A. The resulting context Γ is (Σ , A ∪ S) where Σ is the extended signature and S is the set of succedent theorems associated with this instance of the definitional principle.
In later sections, we will usually think of a definitional principle operationally and hence refer to it as taking some inputs and introducing new primitives and associated axioms. In practice, an implementation will often require input parameters in addition to the antecedent theorems in order to describe the form of the signature extension, e.g., to give the name of a new constant.
We say that a definitional principle is consistent if, whenever it is validly applied to a context Γ = (Σ, A) to give a new context Γ = (Σ , A ), then A is consistent if A is consistent.
We say that a definitional principle is model-theoretically conservative with respect to a semantics, if, whenever it is validly applied to a context Γ to give a new context Γ , then any model of Γ may be expanded to a model of Γ .
We say that a definitional principle is proof-theoretically conservative if, whenever it is validly applied to a context Γ = (Σ, A) to give a new context Γ = (Σ , A ), then any judgment over Σ that is derivable from A is also derivable from A.
Conservativeness, in either the model-theoretic or proof-theoretic sense, implies consistency. In general, consistency is a much weaker property than either kind of conservativeness. The two notions of conservativeness coincide for a logic that is sound and complete for the semantics in question. However, HOL is sound but not complete for its standard semantics. In the sequel when we refer to model-theoretic notions in HOL, we will always mean the standard semantics unless otherwise stated. See [2] for a readable and rigorous account of the standard semantics for HOL. Note that the standard semantics actually defines a proper class of standard models: "standard" means that function types are modelled by function spaces in the meta-logic and does not imply any restriction on the cardinality of a model (hence the careful use of the phrase "a standard model" in [2]).

The Existing Mechanisms
The original Classic HOL provided a mechanism for defining new constants known as new_definition. This worked as follows: given a possibly empty list of variables x 1 , . . . , x n and a term t whose free variables are contained in the x i , it introduced a new constant 1 c of the appropriate type and the axiom: This simple mechanism is remarkably powerful but suffered from two significant shortcomings, both pointed out by Roger Jones 2 :

RJ1
The mechanism does not support implicit definitions. As one example, it is pleasant to define the destructors of a data type as the left inverses of the constructors. Thus one wants to define Pre in terms of Suc by: Pre(Suc(n)) = n.
As another example, the exponential function is naturally defined by a differential equation: In such cases, the mechanism can be used to define constants having the desired properties, but one has to use the Hilbert choice operator to give witnesses and then derive the implicit definitions as theorems. This results in a loss of abstraction and unintended identities, e.g., the naive way of defining two constants c 1 and c 2 both with the loose defining property c i ≤ 10 will result in an extension in which c 1 = c 2 is provable.

RJ2
The mechanism is unsound. The condition on the free variables of t is certainly necessary. Without it, we could take t to be a variable, y : N, and define a new constant c satisfying ∀y : N·c = y. Specialising this in two different ways, we could prove both c = 1 and c = 2. However, the condition is not sufficient. If # is a polymorphic function such that # X is the size of X when X is a finite set, then we can use the mechanism to define a constant c : N satisfying the axiom c = #{x : α | x = x}, where α is a type variable. But then if 1 and 2 denote types with 1 and 2 members respectively, we can instantiate α to prove both c = #{x : 1 | x = x} = 1 and c = #{x : 2 | x = x} = 2.
The fix for RJ2 was to change new_definition so as to check that all type variables appearing anywhere in the term t also appear in the type of the constant c that is being defined. HOL Light, HOL Zero, Isabelle/HOL and ProofPower were all implemented after the problem was known, so they incorporated this solution from scratch. The fix in Classic HOL was carried forward into HOL4.
A new definitional principle was introduced to address RJ1. This is called new_specification. It takes as input a theorem of the form ∃v 1 . . . v n · p and introduces a list of new constants c 1 , . . . , c n and the axiom new_specification requires that the free variables of p be contained in the v i and that every type variable appearing anywhere in p also appear in the type of each new constant c i , thus avoiding reintroducing the problem of RJ2 under a different guise. The result is both proof-theoretically and model-theoretically conservative. It also supports a very useful range of implicit definitions. However, there are two issues that I noted during the ProofPower implementation: RA1 Given new_specification, new_definition is redundant: what it does can easily be realised by a derived mechanism that given the list of variables x 1 , . . . , x n and the term t, automatically proves: and then applies new_specification. Unfortunately, in order to prove existentially quantified statements, one needs a definition of the existential quantifier, and so new_definition seems necessary to avoid a bootstrapping problem 3 .
(Since it is only required for bootstrapping, the ProofPower implementation of new_definition only covers the simple case where the axiom has the form c = t.) 3 One of the referees made the interesting suggestion that one could get rid of the existential quantifier by expanding it using the definition given in [8]. However, one would also have to expand out the universal quantifiers, conjunctions and implications on which that definition depends. The resulting term: = (λ f · f ((λp· p) = (λp· p)) ((λp· p) = (λp· p)))) p q = p) ( p x)q)) q) contains 118 subterms: 32 variable occurrences, 12 occurrences of the equality constant, 43 applications and 31 λ-abstractions. To include such a monster in the definition of the logic seems far worse than accepting a one-off definitional principle for bootstrapping. Moreover, an implementation would be required to include in its logical kernel some trustworthy means for recognising instances of this term.

RA2
The condition on type variables imposed by new_specification is stronger than one would like. It is natural for certain "concrete" structures to be characterized by more "abstract" properties such as universal mapping properties. For example, data types can be characterized as initial algebras: However, the above characterization cannot be used as a defining property for the successor function with new_specification. Characterizing objects by universal properties is endemic in modern mathematics and computer science, so it is irritating to be compelled to resort to circumlocutions.
In HOL4, ProofPower and HOL Zero, new_specification is implemented as a primitive operation. However, in HOL Light, it is derived. I believe this was primarily a consequence of the following design goal for HOL Light: JH1 The primitive inference system for HOL Light should be defined in terms of language primitives and equality alone and should not depend on the axiomatization of the logical connectives.
A form of new_specification that does not involve existential quantification was implemented in early versions of HOL Light. This took as input a theorem of the form p t. Later, to simplify the correctness argument for the system, new_specification was re-implemented as a derived operation that uses the Hilbert choice operator to translate its inputs into a form suitable for new_definition, applies new_definition, then derives the desired axiom to be passed back to the user from the stronger axiom returned by new_definition. Thus HOL Light bypasses RA1, but at the price of a certain inelegance, since we have to trust the derived rule to discard the axiom returned by new_definition. This became worse when HOL Light was enhanced to address the following observation of Mark Adams:

MA1
If an LCF style system does not record all the axioms and definitions that have been introduced, the correctness claim for the system has to be defined in terms of a state and the sequence of operations which produced that state. This makes it impossible to implement a proof auditing procedure that works by analysing the current state of the system.
As a result of MA1, axioms and definitions in HOL Light are now recorded. The current HOL Light implementation uses a trick to prevent two constants with the same loose defining property being provably equal. The trick is based on the following idea: to define c 1 and c 2 such that c 1 , c 2 ≤ 10, say, define then c 1 and c 2 have the desired property, but c 1 = c 2 is not provable. Nonetheless some unintended identities are still provable that would not be provable if new_specification were implemented as a primitive as in HOL4 or ProofPower.
The equivalent of new_specification in Isabelle/HOL is its specification command. This is implemented using an equational definition and the choice function, but that definition only exists in a private namespace. Some aspects of the abstraction offered by new_specification are provided by the very popular locale mechanism in Isabelle.
Quantification over type variables as implemented in HOL-Omega [10] obviates many of the problems discussed here. However, our present concern is with improvements that preserve the delightful simplicity of the Classic HOL logic.

Proposed Alternative
The proposed alternative is to discard new_definition and to adapt and generalise new_specification so that it does not depend on the meaning of the existential quantifier. We call the generalised new_specification gen_new_specification. It takes as input a theorem of the following form where the v i are variables. If all is well, gen_new_specification will introduce new constants c 1 , . . . , c n and the following axiom: gen_new_specification imposes the following restrictions: -the v i must be pairwise distinct; -the terms t i must have no free variables; -the free variables of p must be contained in the v i ; -any type variable occurring in the type of any subterm of a t i must occur in the type of the corresponding v i .
There is no restriction on the type variables appearing in p.

Claim 1 gen_new_specification is a conservative definitional principle in both the proof-theoretic and model-theoretic senses.
Proof For proof-theoretical conservativeness, assume that a sequent Γ q containing no instances of the c i is provable using the axiom p[c 1 /v 1 , . . . , c n /v n ] introduced using gen_new_specification. We will show how to transform a proof tree with conclusion Γ q into a proof tree with the same conclusion that does not use the new axiom. First, by simple equality reasoning, derive from the theorem v 1 = t 1 , . . . , v n = t n p that was passed to new_specification, the theorem p[t 1 /v 1 , . . . , t n /v n ]. Now replace each type instance of a c i in the proof tree with the corresponding type instance of t i and wherever a type instance of the axiom p[c 1 /v 1 , . . . , c n /v n ] is used in the proof tree, replace it with the corresponding type instance of a proof tree for By inspection of the primitive inference rules in [8], if one replaces instances of constants in a correct inference by closed terms of the same type in such a way that assumptions or conclusions of the sequents involved that were syntactically identical before the replacement remain syntactically identical, then the result is also a correct inference. As the condition on type variables imposed by gen_new_specification guarantees that two instances of a c i are syntactically identical iff the corresponding instances of t i are syntactically identical, we have constructed a correct proof tree whose conclusion is Γ q. That concludes the proof of proof-theoretical conservativeness.
For model-theoretic conservativeness, note that ∃v 1 . . . v n · p is provable using the new axiom by taking the c i as witnesses, hence by proof-theoretic conservativeness ∃v 1 . . . v n · p is provable without using the new axiom and hence is true in any standard model. Therefore in any standard model, there exist v 1 , . . . , v n satisfying p and these elements may be used to expand the model to a model of the new axiom.

Claim 2 gen_new_specification subsumes new_definition.
Proof In the simplest case, to define c with axiom c = t, where t has no free variables and contains no type variables that do not appear in its type, apply gen_new_specification to the axiom v = t v = t. This is all we need to define the logical connectives [8].
For the general case, to define c with axiom . . x n = t from it and then apply gen_new_specification.

Claim 3 gen_new_specification subsumes new_specification.
Proof Given the theorem Iterating this process we can define c 2 , . . . , c n such that the defining axiom of c n is p[c 1 /v 1 , . . . , c n /v n ]. Thus we can achieve the same effect as new_specification at the expense of additional intermediate definitions. This is sufficient to define the constructor and destructors for binary products.
Once we have binary products, we can simulate n-tuples by iterated pairing. This means that given the theorem ∃v 1 . . . v n · p, we can derive the theorem ∃z· p[π 1 (z)/v 1 , . . . , π n (z)/v n ] in which the n bound variables v 1 , . . . , v n have been collected into a single n-tuple denoted by the fresh variable z (here π i denotes the projection onto the i-th factor). Now we can derive from that the theorem v 1 . Given this theorem as input, gen_new_ specification has exactly the same effect as new_specification given the input theorem ∃v 1 . . . , v n · p.

Assessment
Let me assess the proposed new definitional mechanism gen_new_specification against the observations that led to it: RJ1 By claim 3, the support for implicit definitions is at least as good with gen_new_ specification as with new_specification. In fact it is better: using gen_new_specification one can define new constants f : α → N and n : N with defining property ∀x· ¬ f x = n, but this is impossible using new_specification. RJ2 By claim 1, the proposed alternative is sound. What is more, this proof has been formalised in HOL4: Ramana Kumar, Scott Owens and Magnus Myreen have recently completed a formal proof of soundness for the HOL logic and its definitional principles including gen_new_specification [14]. RA1 By claim 2, new_definition is no longer required. (The definitions of the connectives as given in [8] only require the simple case in the proof of that claim, so no reasoning about the connectives is needed to define them and there is no bootstrapping issue.) RA2 The restriction on type variables now applies only to the equations that give the witnesses to the consistency of the definition. Defining properties such as initial algebra conditions are supported. JH1 gen_new_specification is defined solely in terms of equality and primitive language constructs.

MA1
The unintended identities arising as a result of recording definitions in HOL Light will not occur if gen_new_specification is adopted as the primitive mechanism for defining constants.
gen_new_specification has now been implemented in HOL4 and ProofPower. In both cases it is a replacement for new_definition: the existing new_specification has been retained for pragmatic reasons 4 . The ProofPower implementation includes an implementation of the proof of claim 3 above and this completely replaces new_ specification in the development of many of the theories supplied with the system, including all the "pervasive" theories such as the theories of pairs and natural numbers that form part of the logical kernel. gen_new_specification is included in version 6 of OpenTheory as the defineConstList command and is supported by the opentheory tool.

On Defining Types
For constant definitions, we have offered in section 3 a definite proposal that has been formally verified and adopted in several systems. For type definitions, we feel that there is still work to be done, both on the theory and how to implement it. Nonetheless, we believe that there are definitely some worthwhile alternatives to the existing mechanisms to be considered. In this section we discuss the existing mechanisms and discuss some possible alternatives.
Classic HOL provided a mechanism called new_type_definition for introducing new types that was carried over essentially unchanged into HOL4 and ProofPower. new_type_definition is given a theorem of the form ∃x : σ · p x where p is a closed term of type σ → bool. The type variables in p (which include those in σ ) must be contained in a given list of type variables α 1 , . . . , α n . new_type_definition introduces a new n-ary type constructor, op, say 5 together with the axiom: The polymorphic constant Type_Definition used above is pre-defined with type (β → bool) → (α → β) → bool and defining property: So ∃rep·Type_Definition p rep asserts that there exists a one-to-one correspondence between the new type (α 1 , . . . , α n )op and the subset of the existing type σ defined by the predicate p. The very simple subtyping mechanism offered by new_type_definition turns out to be very powerful. Let us look in some detail at one of its most fundamental applications, namely the definition of the type of natural numbers. The starting point for this is the type ind of individuals which is axiomatized by the assertion ∃ f : ind → ind·OneOne f ∧¬Onto f . 4 In ProofPower, certain performance-critical aspects of the implementation of the semantic embedding of Z [18] have been fine-tuned around new_specification and an opportunity to rework this code has not yet arisen. In HOL4, some significant refactoring would be required to avoid a use of new_specification prior to the point in the system build where new_specification is defined in terms of gen_new_specification and the best way to go about that refactoring is still under discussion. 5 The means for specifying the name of the new type constructor op and the list α 1 , . . . , α n are not important here. ProofPower is slightly more general than HOL4 in allowing α j that do not appear in σ or p. However, the extra generality appears to be of no practical importance.
Using this and new_specification, one introduces a predicate Is_N_Rep : ind → bool with defining property: The defining property of Is_N_Rep certainly implies ∃x· Is_N_Rep x and one may use new_type_definition to introduce a new type N with defining property: Applying new_specification, one introduces constants 0 and Suc whose defining property is as follows: Now standard arguments lead to the principle of definition by recursion 6 : Using this one defines the arithmetic operators and proves all their standard properties. This is a standard pattern in defining a new type: one first uses properties of the representing set to define constructors (0 and Suc here) and then proves a characterising theorem for the constructors (the principle of induction here) from which all subsequent results follow. The precise presentation of the above argument varies from system to system particularly as regards the introduction of constants other than those one expects to find in a theory of arithmetic, e.g., a constant for the representation function N → ind. The above account is based on the ProofPower development, in which the only "unexpected" constant is Is_N_Rep (and that is introduced only to conform with a standardised approach to introducing new types).
The following observation about new_type_definition has been made by several people over the years: XX1 Typically the existence of the representation function is irrelevant once one has proved some abstract characterisation of the new type, e.g., by the existence of constructors satisfying some closure property. It would be more elegant if one could introduce a new type with the abstract characterisation as the defining property.
There are (admittedly somewhat recondite) cases in which the lack of abstractness reported in XX1 actually results in a real loss of expressiveness. This occurs, for example, in John Harrison's work on self-verification of HOL Light [7]. To explain this, if X and Y are sets represented in the usual way as predicates in HOL, let me write X Y to mean there is a one-to-one mapping of X into Y and X ≺ Y to mean X Y ∧ ¬Y X . Harrison needs to introduce a new type Υ with universe U , say, such that for any set X , if X ≺ U , then P(X ) ≺ U . Now any countably infinite set enjoys this closure property (since powersets of finite sets are finite), so one can define Υ as a subtype of N. However, that leaves open the possibility that what is subsequently proved depends on Υ being countable. This is rather unsatisfactory in the context of [7]: Harrison's script (Model/modelset.ml in the HOL Light distribution) actually allows one to rearrange comments to replace the type definition with an axiom asserting the closure property, giving some evidence that the unwanted information given by the type definition is not actually used.
A solution to XX1 is actually given in the HOL4 documentation [2], but it has never been implemented. The solution comprises a new principle for defining types that I will call new_type_specification. This takes as input two theorems as follows 7 : Here p is a closed term of type σ → bool and q is a closed term of type bool. The type variables in p must be contained in a given list α 1 , . . . , α n of type variables. β must be a type variable that is not one of the α j . new_type_specification introduces a new n-ary type constructor 8 op together with the axiom: The idea here is that q represents some desired property of the generic instance (α 1 , . . . , α n )op of the new type with β standing in for that instance. We prove that property holds on the assumption that there is a one-to-one mapping rep between β and the extent of the predicate p on the representation type σ . We then receive the property q with β instantiated accordingly as the defining property of the new type.
A proof of the model-theoretic conservativness of new_type_specification is given in [2]. The model-theoretic conservativeness of new_type_definition follows from this, since the effect of the latter can be achieved with the former if we take q to be ∃rep : β → σ · Type_Definition p rep. However, because HOL is not complete with respect to the standard semantics, we cannot deduce from this that new_type_specification is conservative in the proof-theoretic sense. It can be shown that new_type_specification is proof-theoretically conservative using the method of Henkin models [9] (since, new_type_specification is conservative in the modeltheoretic sense under the Henkin semantics, but then as the proof system is complete for the Henkin semantics, we can conclude that new_type_specification and hence new_type_definition are proof-theoretically conservative). A direct syntactic proof of the conservativeness of new_type_specification seems much more difficult: an analogous principle for introducing new sorts in many-sorted first-order logic is easily justified using relativisation of quantifiers, but this line of argument does not generalise straightforwardly to the full typed λ-calculus.
So for example, p might be the predicate Is_N_Rep discussed above and the second theorem might capture the parts of the construction of the natural numbers discussed above that are concerned with the representation type as follows: Thus new_type_specification could be used to define the type N with the defining property asserting the existence of a a zero and a successor function satisfying the principle of induction. The representation type would only appear in the proof of the inputs to new_type_specification. Used in the context of Harrison's work on self-verification of HOL Light, new_type_ specification would have allowed Harrison to achieve the same effect as achieved with new axiom: the defining property of the new type would comprise only the desired closure properties and would give no upper bound on the cardinality.
Unfortunately, new_type_definition and new_type_specification conflict with the design principle JH1 requiring the definition of the inference system to be independent of the definition of logical connectives and other defined constructs such as Type_Definition. The existential theorem required as an input to both new_type_definition and new_type_specification is not a big problem: in place of the theorem ∃x· p x one can ask for a theorem of the form p w where w is some term. This reformulation is equivalent to the original, since ∃x· p x is provable iff p (εx· p x) is. However, the logical connectives appearing inside the definition of Type_Definition and hence, indirectly, in the output of new_type_definition and in the second part of the input to new_type_specification are much more problematic. HOL Light solves the problem by reformulating new_type_definition so that it not only introduces the new type but also introduces new constants for the abstraction and representation functions. I will borrow the name define_ty_op from OpenTheory for the HOL Light variant of new_type_definition. define_ty_op takes as input a theorem of the form p w where p is a closed term of type σ → bool for some type σ , and where the type variables occurring in p are contained in a list of type variables α 1 , . . . , α n . define_ty_op introduces a new n-ary type constructor op and constants rep : (α 1 , . . . , α n )op → σ and abs : σ → (α 1 , . . . , α n )op satisfying the following axioms: Here, a and r are free variables of type (α 1 , . . . , α n )op and σ , respectively, and "⇔" is just syntactic sugar for the bool → bool → bool instance of equality. The first of these axioms implies that rep is one-to-one and the second implies that the image of rep is the extent of the predicate p, thus together the two axioms imply ∃rep : (α 1 , . . . , α n )op → σ Type_Definition p rep· (with rep as the witness). Conversely, from ∃rep : (α 1 , . . . , α n )op → σ Type_Definition p rep· one can infer the existence of the functions abs and rep.
Objection XX1 applies even more strongly for a type definition principle that forces the definition of the representation and abstraction functions as new constants. Once one has an abstract characterisation of a new type, these constants are no longer of any use and so they are potentially misleading clutter (a naive user may be tempted to use them instead of the abstract characterisation).
This raises the problem of finding a way of expressing the abstraction offered by new_type_definition or even better new_type_specification without using the logical connectives. A solution to this problem has recently been found as the eventual outcome of the following objection raised by Mario Carneiro on the implementation of define_ty_op in OpenTheory version 5 (which follows HOL Light in this respect).

MC1
In existing implementations of define_ty_op, the names of the free variables a and r that appear in the axioms it introduces are fixed by the implementation, while in all the other rules the choice of free variable names is determined by the inputs to the rule.
An elegant way to solve MC1 would be to avoid the use of free variables in the new axioms altogether. A solution along these lines was found by Mario Carneiro himself soon after making the above observation, subject to a slight refinement by Joe Hurd. This solution has been adopted in version 6 of OpenTheory and replaces the two axioms introduced by define_ty_op by the following.
(λa· abs(rep a)) = (λa· a) (λr · rep(abs r ) = r ) = (λr · p r) These are easily seen to be equivalent to the original formulation and as they involve no free variables, this solves the problem of MC1. The observant reader will ask why the right-hand side of the second equation is not p rather than λr · p r: this was Joe Hurd's refinement: the reason is to separate concerns in the logic by preventing the type definition principle accidentally implying instances of the η-conversion axiom: given p = (λr · rep(abs r ) = r ), it is an easy exercise in the use of the HOL Light inference system, to derive p = λx· p x.
Carneiro and Hurd's method for capturing the semantics of the representation and abstraction functions also gives a way of expressing the intention of new_type_specification without using the logical connectives. I will call the resulting principle simple_ new_type_specification. We will give the principle in a more general form presently, but to simplify the notation initially we shall first describe a special case. In the special case, the principle takes as input two theorems as follows: p w (λa· abs(rep a)) = (λa· a), (λr · rep(abs r ) = r ) = (λr · p r) q where (just as in new_type_specification) p is a closed term of type σ → bool, q is a closed term of type bool and the type variables occurring in p are contained in a given list α 1 , . . . , α n of type variables. abs and rep are free variables of types σ → β and β → σ respectively, β being a type variable that is not one of the α j . Just like new_type_specification, simple_new_type_specification introduces a new n-ary type constructor op together with the axiom: Note that the free variables abs and rep are in the inputs to the definitional principle and hence do not give rise to objection MC1.
As a final remark on the principles for introducing new types, let me note: RA3 Particularly when defining syntax, mutually recursive types are common, but new_type_definition etc. only allow introduction of one type at a time.
simple_new_type_specification as we have described it above deals with objection XX1 as it stands and as the axioms it introduces contain no free variables it cannot give rise to the the implementation issue of MC1. It is easily extended to address the objection RA3 and this is the general form of the principle that we have promised to give. When used to define m types simultaneously, the principle takes as input m + 1 theorems as follows (m theorems with no assumptions and 1 with 2m assumptions): p m w m (λa 1 · abs 1 (rep 1 a 1 )) = (λa 1 · a 1 ), (λr 1 · rep(abs r 1 ) = r 1 ) = (λr 1 · p r 1 ), . . . (λa m · abs m (rep m a m )) = (λa m · a m ), (λr m · rep(abs r m ) = r m ) = (λr m · p r m ) q where: p i is a closed term of type σ i → bool; -w i is a term of type σ i : the type variables occurring in p i are contained in α i1 , . . . , α in i ; abs i is a free variable of type σ i → β i ; rep i is a free variable of type β i → σ i ; -α 11 , . . . , α 1n 1 , . . . , α m1 , . . . , α mn m , β 1 , . . . , β m are distinct type variables; q is a closed term of type bool.
On this input, simple_new_type_specification introduces new n-ary type constructors op 1 , . . . , op m together with the axiom: That this is model-theoretically conservative may be proved using the methods of the proof for new_type_specification in [2]. That it subsumes the existing mechanisms is clear from the discussion above.
The general form of simple_new_type_specification described above certainly addresses all the technical objections to the existing mechanisms. However, type definitions are much less frequent than constant definitions and are often made using a package, e.g., to define programming language syntax. It is conceivable that the form of simple_new_type_specification that introduces just one new type may be a good compromise between the complexity of the logical principle and its use in practice, given that most users do not interact directly with the underlying definitional principle. An experiment to port one of the existing type definition packages to work with simple_new_type_specification would be a sensible next step in the evaluation of these proposals.

Concluding Remarks
The reader may have noted that the approach discussed in section 4 will typically introduce a new type whose defining property asserts the existence of various constructor and destructor functions immediately followed by an application of gen_new_specification to introduce constants for those functions. It is certainly possible to give a definitional principle that combines the features of gen_new_specification and simple_new_type_ specification, simultaneously introducing new constants and new types (the variables representing abstraction and representation function would be permitted in the witnesses for the new constants). Details are left to the reader. The resulting definitional principle would subsume all the others considered in this paper. However it is not clear whether the extra complexity of such a rule merits the relatively modest reduction in clutter.
It is noteworthy that with a little care both the inference rules and the axiomatization of the logical connectives in HOL can be given in a form that is intuitionistically acceptable [8]. The law of the excluded middle only enters as a consequence of the axiom of choice when presented using Hilbert's choice operator [6]. Freek Wiedijk has made the interesting remark that the forms of type definition that provide an abstraction function as well as the representation function are not intuitionistically acceptable: new_type_definition is intuitionistically acceptable, but define_ty_op is not. To see the problem with define_ty_op, let φ be any closed term of type prop in higher-order intuionistic propositional calculus. (Here we write prop rather than bool for the type of propositions to avoid a classical bias). E.g φ might be the sentence ∀ p· p ∨ ¬p. Now consider the function χ = λp· p ∨ ¬p ∧ φ of type prop → prop. Then χ( ) holds and so, with define_ty_op, we can construct a new type, τ say, in one-to-one correspondence with the extent of χ. If we have abstraction and representation functions, abs : prop → τ and rep : τ → prop, the composite f = rep • abs : prop → prop then satisfies: Now let q = f (⊥). By (i), f (q) = q, whence by (ii), we have q ∨ ¬q ∧ φ, and so q ∨ ¬q holds. Now, by (ii), q = ⊥ iff ⊥ ∨ ¬⊥ ∧ φ, which is equivalent to φ. So, if we assume q, then q = ⊥ and we may deduce ¬φ, while if we assume ¬q, then we are assuming q ⇒ ⊥, whence q = ⊥, and we may deduce φ. Hence we have q ∨ ¬q ⇒ ¬φ ∨ φ, but as we have already observed q ∨ ¬q holds, and hence so does ¬φ ∨ φ. Thus a type definition principle providing the abstraction function will enable us to prove ¬φ ∨ φ for any closed sentence φ and this is not intuitionistically acceptable. This raises the apparently difficult challenge of formulating an intuitionistically acceptable type definition principle that avoids expanding out the definitions of the logical connectives in the definition of Type_Definition 9 . However, few people deliberately restrict themselves to the purely intutionistic fragment of HOL, so this is a question of mainly philosophical interest. This paper has been concerned with definitions in higher-order logic, but definitional principles like new_specification are also of interest in implementations of first-order logic. ACL2's encapsulate command [12] has much in common with new_specification. From an historical perspecive, it is interesting that the development of the precursor of encapsulate, the CONSTRAIN facility in NQTHM [5], was contemporary with the introduction of new_specification into HOL.
To return to higher-order logic, our new principle of constant definition seens to have been accepted by HOL developers and we believe it will prove a useful tool in improving the quality of specifications in HOL. The problem of reconciling the differences in the facilities offered for type definition between the various HOL implementations via a common abstraction of what they provide that meets the design desiderata of all the systems is a harder 9 Freek Wiedijk has proposed three axioms for the representation function that are intuitionistically acceptable and are classically equivalent to the axioms returned by define_ty_op. These axioms are rep a = rep b a = b (giving that rep is one-to-one), p(rep a) (giving that the range of rep is contained in the extent of p) and p r, (λa· r = rep a) = (λa· t) t (implying, taking t = ⊥, that the range of rep contains the extent of p in classical logic). Unfortunately, in intutionistic logic, these axioms do not seem to imply the result ∀r · p r ⇒ (∃a· r = rep a) that one would wish to hold when defining a new type in the intuitionistic fragment of HOL.
one, but we believe the work reported in this paper has made some useful progress in that direction.