Context : Set, Type : Context -> Set, Term : (Pi G : Context) Type(G) -> Set, ... then whatever extra structure, eg. ExtType : (Pi G : Context) Ty(G) -> Context, ExtDef : (Pi G : Context, A : Ty(G)) Tm(G,A) -> Context, -- we allow contexts with definitions. ...There are surely some connections with the next trinity.
Parent, third level: Father : A -> Fam(Fam(B)) Mother : A -> Pow(Pow(B)) Child, second level: Son : A -> Fam(B) Daughter : A -> Pow(B) HolyGhost : A -> BThis does not go further because the parent level "lacks pullovers". A pullover is an order enriched isotope of a pullback, something between a cardigan and a pair of flared dungarees. There is a systematic connection between the levels in which the morphisms of a higher level can be modelled as a kind of `span' in the next lower level.
pred : Pow(State) act : Pow(State^2) spec : Pow(State^w) -- w is omega = NatLamport says a (closed system) specification has the general form:
EXISTS aux . Init /\ ( x # x' => Act) /\ Livenesswhere Liveness is a "countable disjunction" of fairness properties
WF_x(A) = (<>enabled (A /\ x # x')) => <>(A /\ x # x') SF_x(A) = (<>enabled (A /\ x # x')) => <>(A /\ x # x')and
EXISTS auxis a kind of existential quantification over flexible variables that is insensitive to stuttering.
Echo of Julian Bradfield's question of whether modal mu-calculus alternation hierarchy collapses at the third level. (It doesn't!)
Another theological metaphor: To break a safety property is a sin of commission. To break a liveness property is a sin of omission.
Lamports page on TLA , his specification language.
An interesting question is to try to characterise as precisely as possible what a "reflection principle" is.